Loading...

Knowledge Center


How to verify that a particular host is blacklisted by the McAfee Blacklist service and raise a removal request
Technical Articles ID:   KB53783
Last Modified:  3/16/2017
Rated:


Environment

McAfee Email Gateway 7.x

Summary

To check if a particular host is blacklisted by the McAfee Blacklist (RBL) service:
  1.  Open a command-line session:
     
    1. On a Windows platform, click Start, Run, type cmd, and press ENTER.
    2. On a Linux/UNIX platform, press CTRL+ALT+F1 to change to a tty
        
  2. Type the following command and press ENTER:
     
    nslookup <Fully Qualified Domain Name (FQDN) of the host to be verified>
     
    Example: nslookup testhost.test.local
     
    The output should present the address of the host to be verified.
     
    Example: 10.9.8.7
      
  3. Use the nslookup command with the octets of the IP address reversed and add .cidr.bl.mcafee.com to the end of the command:
     
    nslookup <IP address in reverse>.cidr.bl.mcafee.com
     
    Example: nslookup 7.8.9.10.cidr.bl.mcafee.com

    IMPORTANT: Ensure that you use a period (.) between the IP address and cidr.bl.mcafee.com; do not use a space. 

    Correct: nslookup 7.8.9.10.cidr.bl.mcafee.com 
    Incorrect: nslookup 7.8.9.10 cidr.bl.mcafee.com
     
  4. If the reply is NXDOMAIN, the host is not listed in the McAfee RBL. If the reply is in the format 127.0.0.XXX, the host is listed in the McAfee RBL.

To raise removal request for McAfee RBL:
McAfee RBL is a composite of a list of IP addresses managed by Intel Security, and blacklists managed by Spamhaus (a third-party RBL). McAfee RBL propagates a host that is listed by Spamhaus.
  1. Verify whether your host is listed by Spamhaus:
    1. Navigate to: http://www.spamhaus.org/lookup/.
    2. Enter your potentially blacklisted IP address in the IP Address Lookup Tool.

      If your IP address is listed on one of their IP lists, this lookup tool will tell you which one and will give you a link to information on performing a removal. 
      Follow the information, and take the necessary actions for removal.

      NOTE:Spamhaus may indicate that your host (or network behind the given IP address if it is a firewall/NAT) is infected by virus and/or botnet and is sending spam messages, or your MTA is misconfigured so that it is acting as an open relay. This issue must be resolved before the host will be removed. Intel Security does not perform the Spamhaus removal process for you.
       
  2. After removing the Spamhaus listing, check if the McAfee RBL still lists your host.
    If you have removed your host from Spamhaus but McAfee RBL is still listing it, contact Technical Support and quote this article number.
     
    For Technical Support contact details:
    Go to http://www.mcafee.com/us/about/contact-us.aspx#ht=tab-techsupport and select your country from the drop-down list.

    Alternatively
    :
    Log in to the ServicePortal at https://support.mcafee.com:
    • If you are a registered user, type your User Id and Password, and click Log In.
    • If you are not a registered user, click Register and complete the required fields. Your password and login instructions will be emailed to you.

Previous Document ID

616705

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.