DNS List Processing Workings - IMF Tune v7.1

IMF Tune provides support for subscribing to multiple DNS Lists. Today we explain how IMF Tune processes emails, focusing on the DNS List filtering stage. We discuss why IMF Tune aims to keep the number of DNS List queries at a minimum and how this is achieved.

Free DNS List Services

DNS List providers publish their list of spam/legitimate email sources at DNS servers for public consumption. Some are available for free, others are against payment. Some providers allow free access as long as a daily query quota is not exceeded. List providers may block users exceeding this limit. For details check the DNS List terms of use.

Keeping DNS List Queries at a Minimum

Keeping the number of DNS List queries at a minimum is beneficial for two main reasons. To begin with, less queries help users stay clear from query limits imposed by free list providers. The second reason is processing time. A DNS query involves sending a message across the internet and waiting for the response. The time involved in completing this operation is significantly longer than any other operation IMF Tune performs on scanning an email.

IMF Tune keeps the number of DNS queries at a minimum in a number of ways. The first method involves caching. IMF Tune implements the caching recommendations included in the DNS standard specifications. This immediately eliminates multiple queries for the same IP or URI.

The second method to cut on DNS queries involves an optimization specific to IMF Tune processing. IMF Tune processes emails in two stages. First it applies all rules, whitelists and blacklists. Basically all filters are applied with the exception of DNS Lists. In the second stage DNS Lists are applied.

The first stage gives IMF Tune an intermediate SCL rating. Given this SCL, IMF Tune tests this condition:
Could a DNS Lists match change the intermediate SCL rating?

If the answer is negative, DNS List processing is skipped.

To understand this point we need to refer to the FAQ:
I configured various Whitelists, Blacklists and SCL Rules. What happens if an email causes multiple matches?

This FAQ explains in detail how IMF Tune handles multiple matches. For example if an email matches both a whitelist and a blacklist, how is the email rated? Is it whitelisted or blacklisted? In this case IMF Tune always gives priority to the lowest SCL i.e. whitelisting wins. The FAQ goes further to explain what happens when instead of the extreme whitelist/blacklist result, we have an SCL rule that gives a value in between. For example we have a rule that sets the SCL to 7.

This is the logic IMF Tune applies when determining whether or not to skip DNS List processing. It looks at how the DNS Lists are configured. It also looks at the intermediate SCL rating obtained from the first filtering stage. It then assumes the DNS List will return a match and determines whether this would lead to an SCL change.

Let's consider the simplest example. An email gets whitelisted in the first stage. The email might have matched the Subject whitelist or the Sender auto-whitelist for example. In IMF Tune whitelisting always takes top priority. Once whitelisted the email rating never changes and DNS List processing can be safely skipped.

A more complex example is the case when an email gets blacklisted in the first stage. Here IMF Tune looks at each of the DNS Lists configured. It checks the type of SCL change a match would lead to. Since the first stage returned blacklisting, DNS Lists configured with a blacklist action are skipped. However DNS Lists configured to set the SCL to anything from Whitelist, SCL0 to SCL9 is still applied. So we have a case where some of the DNS Lists are skipped but others are still processed.

The effectiveness of this optimization depends on how often emails are matching other whitelists, blacklists and rules. Users employing Sender Auto Whitelisting tend to benefit most since with time all regular legitimate senders end up whitelisted. So a significant number of legitimate emails are never tested against DNS Lists.

It is worth keep in mind this optimization when testing IMF Tune DNS Lists. Otherwise one could easily get the impression that the DNS functionality is not working.

Version Information

This information applies to IMF Tune v7.1 build number 7.1.112.23. If IMF Tune is already installed you can verify the current build number from the configuration interface under the Miscellaneous category.