Technical Tip: Performing a basic RBL/ORDBL/DNSBL SPAM test with the FortiGate

Description

This article describes that www.spamhaus.org provides a useful testing facility when using their service.  

Scope

The FortiGate must be configured with one of their SPAM testing zones, such as 'sbl.spamhaus.org'.

Solution

An email must be sent from the SMTP server which is being SPAM protected from the FortiGate, to the following address:  nelson-sbl-test@crynwr.com.

The receiving email server will then auto-reply with an email which is on spamhaus' SPAM list, and if the FortiGate is properly configured, the return email reply will either be SPAM tagged or Rejected by the FortiGate. 

This Spamhaus service will also reply with a second email which is not SPAM, but that includes the details of the communication between its SMTP server and yours.

See example below:

220 emea-fortinet.dnsalias.org Microsoft ESMTP MAIL Service, Version: 6.0.3790.0 ready at  Fri, 12 Nov 2004 16:37:03 +0100
helo sbl.crynwr.com
250 emea-fortinet.dnsalias.org Hello [192.203.178.107]
mail from:<>
250 2.1.0 <>....Sender OK
rcpt to:<thomasp@emea-fortinet.dnsalias.org>
250 2.1.5 thomasp@emea-fortinet.dnsalias.org
data
354 Start mail input; end with <CRLF>.<CRLF>
From: nelson-SBL-test@crynwr.com
To: thomasp@emea-fortinet.dnsalias.org
Date: Fri, 12 Nov 2004 15:37:15 -0000
Message-Id: <1100273835@sbl.crynwr.com>
Precedence: junk

Test message
.

554 5.7.1 This message has been blocked because it is from a RBL/ORDBL IP address.
Terminating conversation

Note that if SPAM tagging is configured on the FortiGate (instead of REJECT), then the returned communication report message from Spamhaus will state that the SPAM email was successfully delivered. This is normal.

Further information is available here:
http://www.spamhaus.org/sbl/howtouse.html