eilandert/rbldnsd repository overview

⁠rbldnsd — hardened DNS blacklist (RBL/DNSBL) server, scratch image

eilandert/rbldnsd is a minimal, security-hardened Docker image of rbldnsd, the small, fast DNS daemon purpose-built to serve DNS blacklists (RBL/DNSBL) and whitelists. Built FROM scratch (just the static binary and its zone data), it is the local-reputation backend of the deb.myguard.nl⁠ mail stack, answering the RBL lookups that rspamd and Postfix fire on every inbound message.

⁠Why run rbldnsd in Docker

• Your own RBL zone, served locally — instant, private IP/domain reputation lookups without leaking every sender to a third party.
• Tiny, fast, scratch-based — essentially just the daemon; nothing else to attack or patch.
• Hardened by default — no shell, no package manager, dropped capabilities, read-only by construction. Context: Docker Hardening for Self-Hosters⁠.

⁠Hardened docker-compose.yml

services:
  rbldnsd:
    image: eilandert/rbldnsd:latest
    restart: unless-stopped
    read_only: true
    cap_drop: [ALL]
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./zones:/zones:ro              # your ip4set / dnset zone files
    ports:
      - "127.0.0.1:53:53/udp"
      - "127.0.0.1:53:53/tcp"

⁠Links

• How RBLs fit into spam filtering: Rspamd Explained — Bayes, Neural Nets, RBLs and all the cool tricks⁠
• All Docker images: https://deb.myguard.nl/nginx-dockerized/⁠
• Package repo & articles: https://deb.myguard.nl⁠
• Docker hardening guide: https://deb.myguard.nl/2026/05/docker-hardening-rootless-readonly-distroless/⁠
• Source: https://github.com/eilandert/dockerized⁠
• Discord: https://discord.gg/UQNsFg2y⁠