completewhois

[Greg Skouby <gs...@sitesnow.com>]

With SA-3.2.0 I seem to be getting sub 5 second scan times pretty
regularly but when I upgraded to SA-3.2.3 I was lucky to get sub 10
second. I flipped on debugging and see a bunch of these messages: 

Thu Aug 16 15:22:53 2007 [9050] dbg: dns: timeout for whois,
__RCVD_IN_WHOIS, DNSBL-A,
dns:A:21.97.71.64.combined-HIB.dnsiplists.completewhois.com. after 7
seconds


(sorry for the nasty line wrap)

The DNS lookup seemed to be timing out quicker in 3.2.0 for whatever
reason and I wasn't noticing the delay for that release.
Does anybody know the status of completewhois? People on spam-l have
been commenting on how unreliable they have become and I was just
wondering if other people were seeing the same thing and if I/we should
just take this rule out for the time being. I like what completewhois
does but probably not at the expense of delayed scan times. 


Thanks!



--Greg

Re: completewhois

[Jeff Chan <je...@surbl.org>]

Quoting Rick Macdougall <ri...@ummm-beer.com>:

> Greg Skouby wrote:
> > With SA-3.2.0 I seem to be getting sub 5 second scan times pretty
> > regularly but when I upgraded to SA-3.2.3 I was lucky to get sub 10
> > second. I flipped on debugging and see a bunch of these messages:
> >
> > Thu Aug 16 15:22:53 2007 [9050] dbg: dns: timeout for whois,
> > __RCVD_IN_WHOIS, DNSBL-A,
> > dns:A:21.97.71.64.combined-HIB.dnsiplists.completewhois.com. after 7
> > seconds
> >
> >
> > (sorry for the nasty line wrap)
> >
> > The DNS lookup seemed to be timing out quicker in 3.2.0 for whatever
> > reason and I wasn't noticing the delay for that release.
> > Does anybody know the status of completewhois? People on spam-l have
> > been commenting on how unreliable they have become and I was just
> > wondering if other people were seeing the same thing and if I/we should
> > just take this rule out for the time being. I like what completewhois
> > does but probably not at the expense of delayed scan times.
> >
> >
>
> I'm seeing the same thing although it isn't as bad today for some
> reason.  I couldn't even load their website until last night.
>
> I'm currently considering using a curl -R -s -z type of script to
> download their bogons-cidr-all.txt et al and run a local rbldnsd mirror
> of their data.
>
> Rick
>

A couple obvious possiblities:

1.  Servers are overutilized
2.  Being ddossed

Jeff C.

Re: completewhois

[Rick Macdougall <ri...@ummm-beer.com>]

Greg Skouby wrote:
> With SA-3.2.0 I seem to be getting sub 5 second scan times pretty
> regularly but when I upgraded to SA-3.2.3 I was lucky to get sub 10
> second. I flipped on debugging and see a bunch of these messages: 
> 
> Thu Aug 16 15:22:53 2007 [9050] dbg: dns: timeout for whois,
> __RCVD_IN_WHOIS, DNSBL-A,
> dns:A:21.97.71.64.combined-HIB.dnsiplists.completewhois.com. after 7
> seconds
> 
> 
> (sorry for the nasty line wrap)
> 
> The DNS lookup seemed to be timing out quicker in 3.2.0 for whatever
> reason and I wasn't noticing the delay for that release.
> Does anybody know the status of completewhois? People on spam-l have
> been commenting on how unreliable they have become and I was just
> wondering if other people were seeing the same thing and if I/we should
> just take this rule out for the time being. I like what completewhois
> does but probably not at the expense of delayed scan times. 
> 
> 

I'm seeing the same thing although it isn't as bad today for some 
reason.  I couldn't even load their website until last night.

I'm currently considering using a curl -R -s -z type of script to 
download their bogons-cidr-all.txt et al and run a local rbldnsd mirror 
of their data.

Rick