[62126] in North American Network Operators' Group
Re: Verisign's New Change and Outdate RBL's
daemon@ATHENA.MIT.EDU (jlewis@lewis.org)
Tue Sep 16 08:42:51 2003
Date: Tue, 16 Sep 2003 08:41:57 -0400 (EDT)
From: jlewis@lewis.org
To: Patrick Muldoon <doon@inoc.net>
Cc: nanog@merit.edu
In-Reply-To: <3F6693F2.2030603@inoc.net>
Errors-To: owner-nanog-outgoing@merit.edu
On Tue, 16 Sep 2003, Patrick Muldoon wrote:
> Was playing with a test box here at home. Installed SpamAssassian from a
> newely cvsup'd ports tree on a FreeBSD box, and was surprised to see
> messages getting marked as received in blacklists that no longer exist.
> Most noteably ORBS. Since this was a fresh Install I hadn't gone
> through and removed the dead RBL's from 20_head_tests.cf yet. Since
> dorkslayers doesn't exist. any queries for it are returning that
> infamous sitefinder address.
>
> [doon@fawkes doon]$ host 34.131.246.64.orbs.dorkslayers.com
> 34.131.246.64.orbs.dorkslayers.com has address 64.94.110.11
I wonder if they've been playing with these wildcards on and off for a few
weeks? I have a script that checks for our mail servers in a bunch of
popular DNSBLs periodically. On and off over the past few weeks, I
started getting notifications from that script that all of our servers
were in the various dorkslayers.com DNSBL zones. The dorkslayers.com
DNSBLs were all shut down, AFAIK, at least several months ago. I got this
notification again last night, and finally commented out the tests for
those zones.
----------------------------------------------------------------------
Jon Lewis *jlewis@lewis.org*| I route
System Administrator | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
