Menu
Quick Stats
Download
UsageAbout Virbl
Virbl is a project of which the idea was born during the RIPE-48 meeting. The plan was to get reports of virusscanning mailservers, and put the IP-addresses that were reported to send viruses on a blacklist.
Why are you blocking my emails?We don't block anything. We only provide a list with IP's which have sent viruses to us or one of our contributors.
The people using the list are the people that decide how they which to implement it. Some use it to give messages a score in spamchecking, others use it to completely block messages from a listed IP. BIT is not responsible for blocking your mail. If blocking happens, the recipient chose to do so.
So when will you be listed?We will list an IP after it has sent two virus-emails to one of our sources. (See the contributors page.) We will remember that you sent those emails for seven days. You will only be listed as long as the last time we 'saw' you sending viruses is less than 24 hours and the total sent emails is greater than two, in the last seven days. So if you've fixed the problem, you will be delisted automatically in 24 hours.
I'm innocent! I only forward messages!If those messages contain viruses, you're not innocent. You are sending viruses around, you're just not originating them. Scan messages before you forward them. There are free virusscanners available, have a look at Amavisd and ClamAV.
I'm innocent! You listed me for sending a bounce-message!If those messages contain viruses, you're not innocent. You are sending viruses around, even though the message itself isn't really caused by you. Stop sending full body bounces. People only need to know the sender, recipient and error in a bounce. Not the whole message.
Here's how you can configure this behaviour for some mailservers:
- Sendmail: just add
define(`confPRIVACY_FLAGS', `nobodyreturn')dnl
to your sendmail.mc file. If a line like this already exists, just add`nobodyreturn'. - Postfix: configure
bounce_size_limit = 1024. - Exim: configure
bounce_return_body = false. - Exim 3: configure
return_size_limit = 1. - Qmail: cannot limit the size of bounces by default. You might be able to use the qmail-bounce.patch, if you can find it.
- Microsoft Exchange: you can fix this problem in the registry. Start
regedit, go to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMTPSVCand add a key namedQueuing(leave the "class" blank). Then click on this new key and select "Add value" from the "Edit" menu. Add the following: Value name:MaxDSNSize, Data type:REG_DWORD, Radix:DecimalValue Data:1024. You have to restart the SMTP service for this change to take effect. More info is available here Exchange 2000 < SP3). and here (Exchange 2003 and 2000 SP3)
If your mailserver software is not mentioned here, please let us know what software you use and how to configure this, so we can add it to this FAQ.
How can I be delisted?Short answer; you can't. FIX the problem that caused you to be listed here. You will automatically be delisted, 24 hours after the last virus from your IP was found.
Long answer; of course, one can think of situations in which you cannot help it that you are listed, for example as an ISP it is possible that your customers cause the listing of your relay server. In that case, email virbl_at_bit_dot_nl and explain to us how you ended up on this list, and how that isn't your fault.
Can I call you?No, you cannot call us. We will not respond with anything else than 'email virbl_at_bit_dot_nl'. So save yourself and us some time, and don't try to call.
I've got no clue as to why I should be listed. I NEED MORE INFO!That is possible. You can email virbl_at_bit_dot_nl, and ask for headers. If we can somehow verify that you are indeed entitled to see those headers, we will send you the header in question.
Is there a mailinglist where we can discuss stuff?Yes, there is. Feel free to sign up and email to the Virbl-l mailinglist.
Can you notify me of infections in my network?Yes. Enable the account for your AS and feel free to enable notifications. Notifications will be sent every 12 hours.