Skip to content
IPv4 cache refreshed 30 hr ago  ◆  IPv6 cache refreshed 29 hr ago  ◆  Prefixes in table 1,109,776 v4 · 261,954 v6  ◆  Peers 90 v4 · 20 v6  ◆  whois.pwhois.org:43 answering  ◆ 
Prefix WhoIs The Prefix
WhoIs Project
mail · Rspamd

The Prefix WhoIs Milter, inside Rspamd.

A plug-in for Rspamd that looks up the originator (the oldest public Received hop, or X-Originating-IP) and the deliverer (the MTA that connected to you), then stamps the message with what the routing table knows about each.

Prefix WhoIs plug-in for Rspamdv1.0.0
pwhois-rspamd-1.0.0.tar.gz 13 KB
md5 d37ac40d55b6a8a9ea5305dbbcb29c1d

Direct link: pwhois-rspamd-1.0.0.tar.gz

Tar/GZip, pure Lua. Requires Rspamd 3.x.

Only enter an address if you want release announcements. The list is very low-volume. Privacy notice.

Boring headers in, useful headers out

after pwhois-rspamd
To: "You" <you@example.com>
From: "John Doe" <johndoe@example.com>
X-PWhois-Origin: 4.2.2.1
X-PWhois-Origin-AS: 3356
X-PWhois-AS-Org-Name: Level 3 Parent, LLC
X-PWhois-Net-Name: LVLT-ORG-4-8
X-PWhois-Country-Code: US
X-PWhois-Deliverer-Origin: 8.8.8.8
X-PWhois-Deliverer-Origin-AS: 15169
X-PWhois-Deliverer-AS-Org-Name: Google LLC

Also written: AS-Path, Org-Name, City, Region, Country and the route's first-seen date. Choose the set in the configuration.

What you get

Headers. X-PWhois-* for the originator and X-PWhois-Deliverer-* for the deliverer, when they differ. Same header set as the Prefix WhoIs Milter.

Symbols. PWHOIS (informational, with ASN, prefix and country in its options), PWHOIS_DELIVERER_MISMATCH (originator and deliverer in different autonomous systems) and PWHOIS_FAIL (lookup did not complete in time). All three score 0 until you say otherwise; build on them with composites, multimap or force_actions.

Variables for your rules. pwhois_asn, pwhois_prefix, pwhois_country, pwhois_as_org, pwhois_org, pwhois_route_age. By default the plug-in also sets asn, ipnet and country, the variables Rspamd's own asn module publishes, so multimap rules keyed on ASN or country run on Prefix WhoIs data unchanged.

Safe under load. Lookups are asynchronous with a timeout; a slow or unreachable server never delays or refuses mail. Results are cached (Redis or in memory). Authenticated submissions and private addresses are skipped, and forged X-PWhois-* headers arriving with a message are removed.

Installation

Rspamd 3.x and outbound TCP to whois.pwhois.org port 43 from the scanning hosts. Unpack, then:

# make install

That places pwhois.lua in Rspamd's plugin directory, declares the module in modules.d/pwhois.conf, and drops the commented sample into local.d/pwhois.conf (an existing one is left alone). Then:

# rspamadm configtest && systemctl reload rspamd

Check it with the bundled fixture (or any message file):

$ rspamc symbols --ip 8.8.8.8 test/fixtures/basic.eml

PWHOIS appears in the symbol list with asn:, prefix: and cc: options; rspamc --json shows the headers under milter.add_headers.

Postfix and Sendmail need nothing new: the Rspamd proxy worker in milter mode (smtpd_milters = inet:localhost:11332 for Postfix) carries the headers back to the MTA. If you still run the Prefix WhoIs Milter, remove it from the chain; running both duplicates the headers.

Operation

Everything lives in local.d/pwhois.conf; every key is optional and the sample carries the defaults.

timeout = 5.0; # seconds; on expiry the message passes untouched check_authed = false; # skip mail from authenticated (submission) users check_local = false; # skip when the deliverer is a private address header_prefix = "X-PWhois-"; # "" writes no headers set_asn_vars = true; # feed asn / ipnet / country to multimap rules prefer_ipv4 = true; # connect to the server over IPv4 cache_ttl = 3600; # one query per address per hour # servers = "127.0.0.1:6379"; # share the cache in Redis ignore_networks = [ ]; # CIDRs never looked up or annotated

Scores. Merge conf/pwhois.group.conf into local.d/groups.conf and set weights, or reference the symbols from your own composites.

Allowance. Prefix WhoIs grants every address 5,000 queries a day by default. Higher limits are free for most uses: ask.

Logging. Rspamd logs each failed lookup (pwhois lookup of … failed) and adds PWHOIS_FAIL at score 0; nothing else is written unless you enable debug for the module (debug_modules = ["pwhois"] in local.d/logging.inc).

Route age. The first-seen date of the originator's route is written as a header and exported as pwhois_route_age. PWHOIS_YOUNG_ROUTE is present in the source but disabled: route-origination dates are not yet reliable enough to score on. The date describes the route, not the network; an old network that moves providers looks new for a while.

Bug reports through the contact form; include rspamc --json output for one message when you can.