Re: [cobalt-users] dnsbl advise...

[Larry Smith <lesmith@xxxxxxxxx>]

On Tuesday 07 October 2003 07:36, wcstaff wrote:
> > -----Original Message-----
> > From: cobalt-users-admin@xxxxxxxxxxxxxxx
> > [mailto:cobalt-users-admin@xxxxxxxxxxxxxxx] On Behalf Of Dan Kriwitsky
> > Sent: Tuesday, October 07, 2003 12:42 AM
> > To: cobalt-users@xxxxxxxxxxxxxxx
> > Subject: RE: [cobalt-users] dnsbl advise...
> >
> > > I have been thinking that I might want to implement at least
> > > one dnsbl list to protect our server from spam.  I want a
> > > list that does not block a lot but a list that blocks enough
> > > (am I picky or what?).  Anyway I would like to hear what
> > > other people use and what they recommend.
> >
> > There was a rather extensive discussion of this on the list a while
> > back. Decisions on which to use, whether to just tag or block really
> > depend a lot on your circumstances and the needs of your
> > customers. It's
> > pretty much OT for this list.
> > http://list.cobalt.com/pipermail/cobalt-users/2003-March/088092.html
> > Just ignore any use of osirusoft.com since it's gone as is
> > monkeys.com.
> > Other Sendmail changes to block by subject:
> > http://list.cobalt.com/pipermail/cobalt-users/2003-July/093712.html
> > There's also lots of discussions in the archives about using
> > mailscanner
> > and the various DNSBLs. http://www.moensted.dk/spam/ has
> > links to a lot
> > of them.
> >
> > --
> > C2003 Dan Kriwitsky
> > 
> > Please reply to the list only. Off list replies are not read.
>
> I have found this method to be unreliable. If one of the dnsbl servers are
> offline, you will get errors and incomplete message handling. Since it
> happened to us too many times and customers complained, we feel it is not a
> safe way to slow the spam down. So we went back to mailscanner, etc.
> Tom
>

Hmmm,  agree that mailscanner is "good" both from the perspective of cutting 
unwanted attachments and spam, but not sure how using DNSBL's could/would 
give errors or imcomplete message handling. (In fact mailscanner includes the 
capability of using dnsbl's in its scan).   I would be very interested in any 
particulars about this since DNSBL works via "DNS" - meaning that one asks if 
a reverse quad (IP in reverse) is listed with "that" dnsbl the same as asking 
if a host has an IP - and gets either a response or none.  No response is the 
same as not listed.  Worst case (other than the one dnsbl that chaged its 
record to report _all_ ip) is the short timeout for the dns query - 
generally....

EG:  
# host 211.206.106.131
Host not found.
# host 131.106.206.211.korea.services.net
131.106.206.211.korea.services.net has address 127.0.0.2
#  host 131.106.206.211.dnsbl.njabl.org
Host not found.

-- 
Larry Smith
SysAd ECSIS.NET
sysad@xxxxxxxxx