Skip to main content

​
Running the Tool

To use this mode, run the “Comparison Tool” by passing in the API_KEY for querying Guardian Mail (which can be found at app.abusix.com), along with the DNS list you wish to compare against and the file containing the IP addresses to check. Each lookup will result in the tool outputting a log line in CSV (comma-separated values) format, which can be later analyzed. Therefore, you need to redirect stdout to a CSV file. Example:
As shown above, the tool periodically outputs the number of completed lookups. Once finished, it provides a summary table and exits. The summary table includes the following fields: The “results.csv” file can be loaded into most spreadsheet applications. By using “Auto Filter,” you can analyze all of the results to look for false positives and investigate the results of the lookups.

​
Real-time/Streaming Mode

One drawback of using the comparison tool with log files is that it only provides a simple way to compare Guardian Mail with another blocklist. It does not replicate what would happen if you were to add Guardian Mail to your SMTP server. To address this, we added real-time/streaming mode. To use this mode, you must extract the IP addresses hitting your MTAs in real-time. This can be done using UNIX commands such as “tail” and “grep” for a single node or system with a centralized log server. The requirement is that the extraction tool can extract one IP per line. In real-time/streaming mode, UNIX pipes extract the necessary data, and then the comparison tool is placed at the end of the pipe. Use ‘-‘ as the filename to tell the tool to read input from stdin instead of a file. For example, this is how to extract the necessary data from a Postfix log:
💡 Tip: If you use the GNU “grep” command, add the “–line-buffered” option to make grep flush its output on each line rather than buffering it. This ensures that the DNS lookups are dispatched immediately and spreads the DNS lookup load more efficiently.