You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Charles Sprickman <sp...@bway.net> on 2005/07/22 04:28:53 UTC
URIDNSBL and subdomains
Hello,
I've been watching some of the misses that have passed through
spamassassin (3.0.4) lately and they are pretty clean; no DNS BL hits,
etc.
One thing I did notice is that many of them have a fairly contorted URL
for the spamvertized products, ie:
kjekliennxi&ffiennnkenc.spamsite.com
This doesn't trigger any URIDNSBL hits, but if I punch the entire URI into
the surbl.org checker it does hit. It seems as if the SA check is looking
only at the domain part and not the subdomain.
Is this expected? Is there a switch to flip to get the whole hostname
checked?
Thanks,
Charles
___
Charles Sprickman
NetEng/SysAdmin
Bway.net - New York's Best Internet - www.bway.net
spork@bway.net - 212.655.9344
Re: URIDNSBL and subdomains
Posted by Loren Wilton <lw...@earthlink.net>.
> OK, so that's supposed to happen. Is there any way to have the entire
> host checked? I've seen a good volume of junk where the domain is clean,
> but if I do a manual lookup on the entire hostname in the spam it is
> indeed listed.
I *suspect* what is happening here is that the domain isn't in surbl when
the mail comes through, but it is 15 minutes later when you check.
The alternative is that there is a difference in the two-level/three-level
split decision between SA 3.0.4 and surbl. Neither works with the full
domain; that was a decision from the start at surbl. The split is based on
the tail of the domain name. It is (I think) a little more than the TLD
that goes into the decision, but that is the basic concept.
For instance, dribble.spammy.com will only check "spammy.com".
dribble.spammy.co.uk will check "spammy.co.uk". The idea is to find the
real host name denuded of any directory names.
Sometimes this will deliberately miss a spamsite. For instance,
myspamsite.yahoo.com will not be listed, because yahoo.com isn't a pure spam
host. Instead, a request will be sent to Yahoo to get the site removed.
Jeff will likely be along sooner or later and can give considerably more
detail on how all of this really works.
Loren
Re: URIDNSBL and subdomains
Posted by Charles Sprickman <sp...@bway.net>.
On Thu, 21 Jul 2005, Loren Wilton wrote:
> Sounds like an surbl problem if spamsite.com isn't listed.
That's just an example I made up... :)
> The leading subdomains are supposed to be trimmed off, since they are
> usually identifying strings for a given spam target rather than an
> actual part of the target name.
OK, so that's supposed to happen. Is there any way to have the entire
host checked? I've seen a good volume of junk where the domain is clean,
but if I do a manual lookup on the entire hostname in the spam it is
indeed listed.
Thanks,
Charles
> There are a few cases where things go
> to three levels rather than just two, but they are exceptions.
>
> Loren
>
>
> ----- Original Message -----
> From: "Charles Sprickman" <sp...@bway.net>
> To: <us...@spamassassin.apache.org>
> Sent: Thursday, July 21, 2005 7:28 PM
> Subject: URIDNSBL and subdomains
>
>
>> Hello,
>>
>> I've been watching some of the misses that have passed through
>> spamassassin (3.0.4) lately and they are pretty clean; no DNS BL hits,
>> etc.
>>
>> One thing I did notice is that many of them have a fairly contorted URL
>> for the spamvertized products, ie:
>>
>> kjekliennxi&ffiennnkenc.spamsite.com
>>
>> This doesn't trigger any URIDNSBL hits, but if I punch the entire URI into
>> the surbl.org checker it does hit. It seems as if the SA check is looking
>> only at the domain part and not the subdomain.
>>
>> Is this expected? Is there a switch to flip to get the whole hostname
>> checked?
>>
>> Thanks,
>>
>> Charles
>>
>> ___
>> Charles Sprickman
>> NetEng/SysAdmin
>> Bway.net - New York's Best Internet - www.bway.net
>> spork@bway.net - 212.655.9344
>
>
Re: URIDNSBL and subdomains
Posted by Loren Wilton <lw...@earthlink.net>.
Sounds like an surbl problem if spamsite.com isn't listed. The leading
subdomains are supposed to be trimmed off, since they are usually
identifying strings for a given spam target rather than an actual part of
the target name. There are a few cases where things go to three levels
rather than just two, but they are exceptions.
Loren
----- Original Message -----
From: "Charles Sprickman" <sp...@bway.net>
To: <us...@spamassassin.apache.org>
Sent: Thursday, July 21, 2005 7:28 PM
Subject: URIDNSBL and subdomains
> Hello,
>
> I've been watching some of the misses that have passed through
> spamassassin (3.0.4) lately and they are pretty clean; no DNS BL hits,
> etc.
>
> One thing I did notice is that many of them have a fairly contorted URL
> for the spamvertized products, ie:
>
> kjekliennxi&ffiennnkenc.spamsite.com
>
> This doesn't trigger any URIDNSBL hits, but if I punch the entire URI into
> the surbl.org checker it does hit. It seems as if the SA check is looking
> only at the domain part and not the subdomain.
>
> Is this expected? Is there a switch to flip to get the whole hostname
> checked?
>
> Thanks,
>
> Charles
>
> ___
> Charles Sprickman
> NetEng/SysAdmin
> Bway.net - New York's Best Internet - www.bway.net
> spork@bway.net - 212.655.9344
Re: URIDNSBL and subdomains
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, July 21, 2005, 7:28:53 PM, Charles Sprickman wrote:
> Hello,
> I've been watching some of the misses that have passed through
> spamassassin (3.0.4) lately and they are pretty clean; no DNS BL hits,
> etc.
> One thing I did notice is that many of them have a fairly contorted URL
> for the spamvertized products, ie:
> kjekliennxi&ffiennnkenc.spamsite.com
> This doesn't trigger any URIDNSBL hits, but if I punch the entire URI into
> the surbl.org checker it does hit. It seems as if the SA check is looking
> only at the domain part and not the subdomain.
> Is this expected? Is there a switch to flip to get the whole hostname
> checked?
As Loren correctly mentions, SURBLs and the applications that use
them usually try to check the registered domain, not the full
host name. Some exceptions include phishing hosts that might be
hosted on a legitimate ISP under their domain name, like
phisher.geocities.com or whatever.
So there is no switch to check the whole hostname and most of the
time the full hostnames would not match the SURBL data. There
are a number of reasons for this design decision, some of which
can be seen at:
http://www.surbl.org/faq.html#random
http://www.surbl.org/faq.html#cctlds
Most of the major spammers register dozens or hundreds of new
domains at a time, use some for a few days or weeks then abandon
them and start using others. We're a lot more interested in
catching those than some minor abuse at a free host, since the
ones using throwaway domains are probably the same ones sending
billions of spams per day using botnets, etc.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/