[cobalt-users] Re: RaQ4 - blocking a whole domain

[Bruce Timberlake <bruce@xxxxxxxxxx>]

Bruce Timberlake wrote:

> > > I see your point, but how many people actually have legit mail servers
> > > in the rr.com domain?  I haven't seen any yet... same for Verizon and
> > > PacBell DSL, etc.  Especially for the cable users, I don't think they're
> > > "allowed" to run mail servers; all legit mail should be coming from
> > > recognizable MX servers set up by RR, etc.
> >
> >
> >
> > Agreed Bruce.  Where would one find the *legit e-mail server* info for 
> > some
> > of these?
>
>
> [root /root]# dig rr.com mx
>
> ; <<>> DiG 8.3 <<>> rr.com mx
> ;; res options: init recurs defnam dnsrch
> ;; got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 21
> ;; QUERY SECTION:
> ;;      rr.com, type = MX, class = IN
>
> ;; ANSWER SECTION:
> rr.com.                 1H IN MX        20 vamx02.mgw.rr.com.
> rr.com.                 1H IN MX        30 herndon.mgw.rr.com.
> rr.com.                 1H IN MX        10 vamx01.mgw.rr.com.
>
> ;; AUTHORITY SECTION:
> rr.com.                 1D IN NS        dns4.rr.com.
> rr.com.                 1D IN NS        dns1.rr.com.
> rr.com.                 1D IN NS        dns2.rr.com.
> rr.com.                 1D IN NS        dns3.rr.com.
>
> ;; ADDITIONAL SECTION:
> vamx01.mgw.rr.com.      5M IN A         24.28.193.148
> vamx02.mgw.rr.com.      1H IN A         24.30.200.18
> herndon.mgw.rr.com.     5M IN A         24.92.226.164
> herndon.mgw.rr.com.     5M IN A         24.93.35.209
> herndon.mgw.rr.com.     5M IN A         24.93.35.210
> herndon.mgw.rr.com.     5M IN A         24.93.40.180
> herndon.mgw.rr.com.     5M IN A         24.94.163.190
> herndon.mgw.rr.com.     5M IN A         24.94.165.190
> herndon.mgw.rr.com.     5M IN A         65.32.1.38
> herndon.mgw.rr.com.     5M IN A         65.32.1.42
> herndon.mgw.rr.com.     5M IN A         65.32.1.49
> herndon.mgw.rr.com.     5M IN A         66.75.160.12
> herndon.mgw.rr.com.     5M IN A         66.75.160.13
> herndon.mgw.rr.com.     5M IN A         24.25.4.95
> herndon.mgw.rr.com.     5M IN A         24.25.4.96
> herndon.mgw.rr.com.     5M IN A         24.25.4.97
> herndon.mgw.rr.com.     5M IN A         24.29.99.40
> herndon.mgw.rr.com.     5M IN A         24.29.99.41
> herndon.mgw.rr.com.     5M IN A         24.92.226.25
> herndon.mgw.rr.com.     5M IN A         24.92.226.31
> herndon.mgw.rr.com.     5M IN A         24.92.226.159
>
> ;; Total query time: 110 msec
> ;; FROM: www.brtnet.org to SERVER: default -- 24.52.223.218
> ;; WHEN: Tue Feb  3 11:31:30 2004
> ;; MSG SIZE  sent: 24  rcvd: 510
>
>
>
> As far as DNS is concerned, these are all the legit MX servers for the 
> rr.com domain... :)


You might want to do a "host ip.ad.re.ss" to get the actual host name 
for each IP... depends on how you're doing your blocking.

For example:

[root /root]# host 65.32.1.38
38.1.32.65.IN-ADDR.ARPA domain name pointer flmx01.mgw.rr.com