Skip to main content

Cut down on spam with IP Block List Providers (RBL)

Posted August 2009 by Steve Sinchak

One easy way to make a huge dent in the amount of spam your Exchange organization receives is to configure the IP Block List Providers anti-spam agent.  This component checks senders against known databases of spammers, infected computers and open relays.  Also known as real-time block lists (RBL), they are provided by a number of non-profit and for profit companies.  From my experience I like using the free block lists provided by:

  • SpamHaus - zen.spamhaus.org
  • SpamCop - bl.spamcop.net
  • Surriel - psbl.surriel.com
  • SORBS - dnsbl.sorbs.net

Adding the IP Block List provider to Exchange is very simple, just open up the Exchange Management Shell and run the command below:

Add-IPBlockListProvider -Name SpamHaus -LookupDomain zen.spamhaus.org -AnyMatch $True -Enabled $True -RejectionResponse “Your IP is on the spamhaus.org block list“

For other block list providers just modify the Name, LookupDomain and RejectionRespose.

After you add a IP block list provider you can run get-ipblocklistprovider to list all installed.  If you want to delete a provider run Remove-IPBlockListProvider -identity and hit enter.

Some IP Block List providers have test addresses that allow you to see if your block list is working.  For SpamHaus Zen just send an e-mail to [email protected] and you will get the results back via e-mail in a few minutes.

Related Posts


The Java Runtime Environment has become one of the most exploited components of any operating system. Even the US Department of Homeland Security warns users to disable java unless they have a really good reason to use it.  For most of us the days of Web sites requiring you to run Java applets has long passed.  However, there still are a good number of desktop applications written in Java so simply...

Read More

Port 3389 is the home of the remote desktop protocol that powers Remote Desktop Services on all modern versions of Windows.  If your system has Remote Desktop enabled, it is listening for connections on port 3389.  Since this port is both well known and can be used to attack accounts, it is low hanging fruit for script kiddies and bots looking for an easy target.

Read More

The default flower user picture is displayed for new accounts and on various logon screens throughout the OS.  Customizing this picture requires a simple file copy and doing so will allow you to personalize your PC or even display a corporate logo.

Read More

Microsoft included a batch rename feature in the latest version of Windows allowing you to select multiple files, right click on one and select rename. All of the selected files will be renamed with the name you provided and a number. This functionality works well for basic files but does not provide any flexibility in exactly how the files are numbered and also does not allow the file extension to...

Read More