Loading...

Knowledge Center


How to verify that a particular host is blacklisted by the McAfee Blacklist service and raise a removal request
Technical Articles ID:   KB53783
Last Modified:  2/24/2016
Rated:


Environment

McAfee Email and Web Security appliance software 5.x
McAfee Email Gateway 7.x

Summary

To check if a particular host is blacklisted by the McAfee Blacklist (RBL) service:
  1.  Open a command-line session:
     
    1. On a Windows platform, click Start, Run, type cmd, and press ENTER.
    2. On a Linux/UNIX platform, press CTRL+ALT+F1 to change to a tty
        
  2. Type the following command and press ENTER:
     
    nslookup <Fully Qualified Domain Name (FQDN) of the host to be verified>
     
    Example: nslookup testhost.test.local
     
    The output should present the address of the host to be verified.
     
    Example: 10.9.8.7
      
  3. Use the nslookup command with the octets of the IP address reversed and add cidr.bl.mcafee.com to the end of the command:
     
    nslookup <IP address in reverse>.cidr.bl.mcafee.com
     
    Example: nslookup 7.8.9.10.cidr.bl.mcafee.com
     
  4. If the reply is NXDOMAIN, the host is not listed in the McAfee RBL. If the reply is in the format 127.0.0.XXX, the host is listed in the McAfee RBL.
 
To raise removal request for McAfee RBL:

McAfee RBL is a composite of a list of IP addresses managed by Intel Security, and blacklists managed by Spamhaus (a third-party RBL). McAfee RBL propagates a host that is listed by Spamhaus.
  1. Verify whether your host is listed by Spamhaus:
    1. Navigate to: http://www.spamhaus.org/lookup/.
    2. Enter an IP address to the IP Address Lookup Tool.

      If your IP address is listed on one of their IP lists, this lookup tool will tell you which one and will give you a link to information on performing a removal. Follow the information, and take the necessary actions for removal.

      NOTE: Spamhaus may indicate that your host (or network behind the given IP address if it is a firewall/NAT) is infected by virus and/or botnet and is sending spam messages, or your MTA is misconfigured so that it is acting as an open relay. This issue must be resolved before the host will be removed. Intel Security does not perform the Spamhaus removal process for you.
       
  2. After removing the Spamhaus listing, check if the McAfee RBL still lists your host.
    If you have removed your host from Spamhaus but McAfee RBL is still listing it, contact Technical Support and quote this article number.
     
    {GENAA.EN_US}

Previous Document ID

616705

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.