You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris Thielen <cm...@someone.dhs.org> on 2004/03/22 16:19:03 UTC
Gracefully EOLing a DNSBL
> Infinite-Monkeys has been dead for some 6 months, and is now flagging
> ALL checked messages as spam in an effort to get sysadmins to finally
> update their rules. It seems to be working.
It seems that there is a fundamental problem with DNSBLs gracefully
exiting the scene. It's really too bad that those people who (for
whatever reason) can't maintain a DNSBL anymore seem to end up with a DDOS
on their hands and feel they have to resort to "everything is blacklisted"
to get any notice from mail system administrators. I think we need method
for clients of DNSBLs to be notified that the BL is shut down/shutting
down.
Perhaps a new ip address being resolved from a DNSBL query, such as
127.0.0.254, could indicate that the service is disabled or has been
permanently terminated. Clients of DNSBLs could then perform a
exponential backoff and eventually stop querying the BL, or send an
administrative notification that a "go away" response was received. I'm
not sure how the current DNSBL system was decided upon (defacto?) but for
something like this to be effective, the majority of DNSBL clients (MTAs,
in particular) would have to agree to implement it.
I'm definitely no expert on this topic, but maybe this can be food for
thought for those that are.
--
Chris Thielen
Easily generate SpamAssassin rules to catch obfuscated spam
phrases(0BFU$C/\TED SPA/\/\ P|-|RA$ES): http://www.sandgnat.com/cmos/
Keep up to date with the latest third party SpamAssassin Rulesets:
http://www.exit0.us/index.php/RulesDuJour
Re: Gracefully EOLing a DNSBL
Posted by Bob George <ma...@ttlexceeded.com>.
Kelson Vibber wrote:
> [...]
> If the DNSBL is pay-to-use, then sure, raise the price a little bit to
> cover the overhead of a mailing list that only sees one message every
> six months. But if you're letting people in for free, it's not that
> expensive to let them out for free as well.
Well, the cost of getting out seems to be "keep your software updated."
I don't blame the maintainers!
- Bob
Re: Gracefully EOLing a DNSBL
Posted by Kelson Vibber <ke...@speed.net>.
At 10:42 AM 3/22/2004, Bob George wrote:
>Justin wrote:
>>[...] Why so many of them don't provide this basic service I don't know.
>How much are you willing to pay for this?
That reminds me of a cartoon I once saw. It was a single panel, drawn by
either Charles Addams or Gahan Wilson - or maybe Edward Gorey - anyway, it
showed a girl with a lemonade stand, with a sign labeled "Iced Drink - 5
cents." A man was buying a drink from her.
Around the corner, another man was gasping and crawling toward a second
lemonade stand with a sign proclaiming "Iced Drink Antidote - $2.00"
If the DNSBL is pay-to-use, then sure, raise the price a little bit to
cover the overhead of a mailing list that only sees one message every six
months. But if you're letting people in for free, it's not that expensive
to let them out for free as well.
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Gracefully EOLing a DNSBL
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Wednesday, March 24, 2004 10:25 AM -0500 Sylvain Robitaille
<sy...@alcor.concordia.ca> wrote:
> On the other hand, if something like "dnsbl@concordia.ca" would be
> sufficient for all my mail relays, and those of subdomains under
> concordia.ca, that would be fine, except it's no different than the
> scenario I described in the first message I wrote in this thread.
How about the relay must be an MX for a subscribed address? You'd need
something that collected MX's periodically for subscribers.
The more fundamental problem is to prove to the DNSBL that the relay has a
live, active admin who pays attention to the announcements, not one who set
up the box and left the company a month ago.
Re: Gracefully EOLing a DNSBL
Posted by Sylvain Robitaille <sy...@alcor.concordia.ca>.
On Wed, 24 Mar 2004, Kenneth Porter wrote:
> Subscribe to the announce list using an address valid *on the relay*,
> such as postmaster@relay.concordia.ca, and forward that to your real
> address.
Once for each mail relay? I think I would prefer to simply not use such
a DNSBL. My small handful of mail relays is one thing, but I wouldn't
want to be working at a site where mail relays are measured in the
dozens and receive the same announcement for each mail relay. I really
only need to see it once.
> Presumably you have a working postmaster alias on all your relays?
I don't recall saying anything that would suggest that I don't know how
to set up a mail relay properly.
> ... Or you could use dnsbl@ to isolate the traffic.)
I like that idea in principle, but I'd still simply not use such a
DNSBL, if I had to subscribe once for each mail relay. Add a new mail
relay, and don't forget to subscribe it to the announcement list.
Replace a mail relay, and the new one must be subscribed until the
switch from the old one is complete, at which point it should be
unsubscribed or else you're causing too much grief for the DNSBL
maintainer. ...
On the other hand, if something like "dnsbl@concordia.ca" would be
sufficient for all my mail relays, and those of subdomains under
concordia.ca, that would be fine, except it's no different than the
scenario I described in the first message I wrote in this thread.
Actually, it *is* different:
mailhost.concordia.ca =~ m/\.concordia\.ca$/
mailhost.subdomain.concordia.ca =~ m/\.concordia\.ca$/
BUT
clienthost.concordia.ca =~ m/\.concordia\.ca$/
...
The DNSBL would have to be willing to accept queris from any host in the
domain. I still think it would be a performance nightmare, but perhaps
I'm wrong ....
--
----------------------------------------------------------------------
Sylvain Robitaille syl@alcor.concordia.ca
Systems analyst / Postmaster Concordia University
Instructional & Information Technology Montreal, Quebec, Canada
----------------------------------------------------------------------
Re: Gracefully EOLing a DNSBL
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Tuesday, March 23, 2004 5:13 PM -0500 Sylvain Robitaille
<sy...@alcor.concordia.ca> wrote:
> Consider for instance that I might subscribe "syl@alcor.concordia.ca"
> to the announcement list. Now, Alcor.Concordia.CA will never itself
> query the DNSBL, as it is not its own mail relay. My mail relays also
> handle mail for various subdomains under .concordia.ca, as well as
> "concordia.ca" itself. How does the DNSBL determine that a query from
> one of my mail relays should be permitted?
Subscribe to the announce list using an address valid *on the relay*, such
as postmaster@relay.concordia.ca, and forward that to your real address.
Presumably you have a working postmaster alias on all your relays? (abuse@
would also be a good alias, since we're talking about anti-spam management.
Or you could use dnsbl@ to isolate the traffic.)
Re: Gracefully EOLing a DNSBL
Posted by Sylvain Robitaille <sy...@alcor.concordia.ca>.
On Mon, 22 Mar 2004, Kenneth Porter wrote:
> If there's an announce list, then the DNSBL should only allow
> queries from servers that are subscribed and not rejecting the
> announcements. Maybe some volunteer can code some glue between Mailman
> and BIND to enforce that?
Consider for instance that I might subscribe "syl@alcor.concordia.ca"
to the announcement list. Now, Alcor.Concordia.CA will never itself
query the DNSBL, as it is not its own mail relay. My mail relays also
handle mail for various subdomains under .concordia.ca, as well as
"concordia.ca" itself. How does the DNSBL determine that a query from
one of my mail relays should be permitted?
--
----------------------------------------------------------------------
Sylvain Robitaille syl@alcor.concordia.ca
Systems analyst / Postmaster Concordia University
Instructional & Information Technology Montreal, Quebec, Canada
----------------------------------------------------------------------
Re: Gracefully EOLing a DNSBL
Posted by Kenneth Porter <sh...@sewingwitch.com>.
If there's an announce list, then the DNSBL should only allow queries from
servers that are subscribed and not rejecting the announcements. Maybe some
volunteer can code some glue between Mailman and BIND to enforce that?
Re: Gracefully EOLing a DNSBL
Posted by Justin <li...@numbnuts.net>.
On Mon, 22 Mar 2004, Bob George wrote:
> Sorry, just trying to be a bit ironic. But if I'm providing a service
> for free, decide to discontinue it, make all the right announcements
> that it's closing, then STILL keep it running for another 6 months, I'm
> only going to feel so bad for anyone that hasn't updated their software
> for that length of time.
I don't think that's the case we're talking about here though. It's not
like someone left their DNSBL unattended for months on end and ignored the
mailing list announcement that said the list was going away and suddenly
it broke. I'm thinking more along the lines of the ORSS that suddenly
listed everything. For example blackholes.2mbit.com went bye bye back in
May '02. I'm sure it was announced to NANAE but I never heard about it.
I don't have the time to spend scouring NANAE for every little piece of
news out there. blackholes.2mbit.com didn't offer an announcement mailing
list (I don't believe I asked but I'm sure one wasn't mentioned on their
site). They went down and the person running things didn't notice on our
end until December of that year. BTW I'm psyched to see that they've been
reincarnated as the AHBL. Woot! relays.osirusoft.com was taken down
rather abruptedly. If Joe had an announcement mailing list many of us
admins that used the ORSS could have removed the ORSS from our configs
before he changed the list to the "everything's bad" state. Even if we
only had a couple hours advance notice it would have helped many. I know
the ORSS didn't have a list because I talked to Joe about it a number of
times. IIRC Monkeys gave a couple week's notice on the demise of their
list. I actually saw that one in NANAE. If I hadn't noticed though I
wonder how long it would have been before I noticed I wasn't getting any
more updates. Not all mail admins have the time to keep up with NANAE or
NANAB(L). In fact few do.
Really an announcement mailing list is a trivial thing to set up and
effortless to admin (I've run many lists including discussion and
announcement lists). I would gladly help pay for someone to maintain a
good DNSBL and for the BW. I think most are afraid to accept $$ for it
though because they think it implies a high level of accuracy and
reliability. These people give us a great service. We should definitely
pay for it I think. That's my $.02 anyhow.
Justin
Re: Gracefully EOLing a DNSBL
Posted by Bob George <ma...@ttlexceeded.com>.
Justin wrote:
> On Mon, 22 Mar 2004, Bob George wrote:
> [...]
>>How much are you willing to pay for this?
>
> A basic mailing list? How much do you think it's going to cost?
Money-wise, not much. But time and maintenance-wise, probably "more than
zero."
> Actually I've offered to pay for AXFR access to DNSBLs before. We're
> paying MAPS for the DUL and RSS right now. I haven't encountered any that
> will accept $$ though.
Sorry, just trying to be a bit ironic. But if I'm providing a service
for free, decide to discontinue it, make all the right announcements
that it's closing, then STILL keep it running for another 6 months, I'm
only going to feel so bad for anyone that hasn't updated their software
for that length of time.
- Bob
Re: Gracefully EOLing a DNSBL
Posted by Justin <li...@numbnuts.net>.
On Mon, 22 Mar 2004, Bob George wrote:
> Justin wrote:
>
> > On Mon, 22 Mar 2004, Chris Thielen wrote:
> > [...] Why so many of them
> > don't provide this basic service I don't know.
>
> How much are you willing to pay for this?
A basic mailing list? How much do you think it's going to cost?
Actually I've offered to pay for AXFR access to DNSBLs before. We're
paying MAPS for the DUL and RSS right now. I haven't encountered any that
will accept $$ though.
Justin
Re: Gracefully EOLing a DNSBL
Posted by Bob George <ma...@ttlexceeded.com>.
Justin wrote:
> On Mon, 22 Mar 2004, Chris Thielen wrote:
> [...] Why so many of them
> don't provide this basic service I don't know.
How much are you willing to pay for this?
- Bob
Re: Gracefully EOLing a DNSBL
Posted by Justin <li...@numbnuts.net>.
On Mon, 22 Mar 2004, Chris Thielen wrote:
>
> > Infinite-Monkeys has been dead for some 6 months, and is now flagging
> > ALL checked messages as spam in an effort to get sysadmins to finally
> > update their rules. It seems to be working.
>
> It seems that there is a fundamental problem with DNSBLs gracefully
> exiting the scene. It's really too bad that those people who (for
> whatever reason) can't maintain a DNSBL anymore seem to end up with a DDOS
> on their hands and feel they have to resort to "everything is blacklisted"
> to get any notice from mail system administrators. I think we need method
> for clients of DNSBLs to be notified that the BL is shut down/shutting
> down.
I asked for a simple fix from a number of DNSBLs, a major one of which is
now KIA. All I was asking for was a simple announcement mailing list so
that the maintainers could let all responsible admins using their DNSBL
know of problems, changes, or its demise. Many of them do this. Many
don't. The response I almost always get from a DNSBL maintainer that
doesn't have a mailing list is that they post news to NANAE and that I
should monitor that. I don't have time to scour NANAE everyday for
information that I might very well need immediately. Why so many of them
don't provide this basic service I don't know.
Justin