Adding the Abusix Mail Intelligence blocklists to SecurityGateway

Adding the Abusix Mail Intelligence blocklists to SecurityGateway

Abusix Mail Intelligence is a set of blocklists that are designed to help protect mail servers from spam, malware, phishing and ransom attacks.

You can sign up for a free 14-day trial of Abusix Mail Intelligence at https://abusix.com/. The trial will monitor the number of queries you make against Abusix Mail Intelligence and as long as the number isn’t in excess of 5,000 queries a day, you’d typically be able to sign up for their free usage tier. On very large or very busy mail servers, prices start at $10 a month for 10,000 queries a day. For further details please see the Abusix Mail Intelligence Pricing Page.

Setup Steps:


Once signed up to Abusix, at https://app.abusix.com/email-protection make a note of Your API Key.

At Security -> Anti-Spam -> DNS Blacklists (DNSBL) -> Configuration, tick “Enable DNSBL queries” (if it is not already ticked) and add a new DNS-BL to “DNS-Blacklists (All domains)” in the form:

Host: YOUR-API-KEY.combined.mail.abusix.zone

SMTP Response: $IP$ blocked by Abusix

(replace YOUR-API-KEY with the actual API KEY Abusix provide)

If you’d prefer SecurityGateway to accept the email and automatically quarantine it, then at Security -> Anti-Spam -> DNS Blacklists (DNSBL) -> Configuration -> “If the sending server of a message is listed”, choose “quarantine the message”. You may also want to tag the subject with a value that helps you easily see it was quarantined in this way, like in this example:



If you’d rather SecurityGateway just rejects connections from mail servers that return a positive response from Abusix, then at Security -> Anti-Spam -> DNS Blacklists (DNSBL) -> Configuration -> “If the sending server of a message is listed”, choose “refuse the message”:



Important Note:


Abusix allow you to perform queries against them regardless of  the DNS servers SecurityGateway is using, as long as you have a valid API Key and account with them.
However, if you are already using other DNS-BL’s in  SecurityGateway like zen.spamhaus.org, then its important that SecurityGateway is not using open DNS resolvers (Google DNS, CloudFlare DNS, etc) or these checks might fail. These specific DNS-BL’s don’t allow queries from these DNS servers due to the volume of queries they create.

You can check the DNS servers being used under Setup/Users -> System -> DNS Servers