Why does ORF does not work with one than more RBL - ORF Forums

@RadekK: Hello RadekK,

By design, ORF checks the incoming emails against 'all' of the DNSBLs that are selected on the DNS Blacklists page. The fact that the source IP of the spam is currently listed on the Barracuda and SORBS DNS blacklists does not necessarily mean that it had been on those lists already when ORF inspected the email. It is likely that the spammer's IP was picked up by the DNSBLs after you had received the unwanted emails. That said, if you have just enabled the aforementioned DNSBLs, you should save the ORF configuration (Ctrl + S) to apply the new settings - otherwise, ORF will not use your latest DNSBL selection.

Hello RadekK,

I believe there is a slight misunderstanding here. We are not the maintainers of the DNS Blacklists, we just give you the definition file that you can import into ORF, so you do not have to add each DNSBL by hand to the configuration. When the DNS Blacklist test is enabled and an email arrives, ORF sends a DNS query to the each selected DNSBL provider and decides what to do with the email (blacklist it or allow it to pass) based on the response it receives from said providers. I am not entirely sure how often the DNSBLs are updated - it differs from provider to provider- but I would say, typically every 1-30 minutes 24/7.

If you want to learn more about the providers' policies, I suggest you visit their websites for details. You may find the website address of each DNSBL provider on the 'Blacklist Web' tab in the 'DNS Blacklist Properties' dialog (just double-click the DNSBL you are interested in on the DNS Blacklist page of the ORF Administration Tool to invoke the dialog).