SORBS - Is There a Better Spam Blacklist?

rootnl asks: "Recently I decided to upgrade my email server with better spam detection and decided to use the SORBS blacklist. It is a very aggressive blacklist and could be deemed quite effective. However, I discovered two totally legal servers currently being blocked by their Spam 'o Matic service: a Google Gmail server (64.233.182.185), and another server belonging to an ISP called Orange (193.252.22.249). Now, normally one would think these providers would probably get themselves de-listed, but the process provided revolves around donating money. As I just happen to have a friend that is using the said ISP, I have to seriously reconsider using SORBS. What is your experience with SORBS? If you have alternatives, what would you suggest as a better blacklist service?"

Comments

How About?

[elzurawka]

This

Re:How About?

[Anonymous Coward]

That is a list of web pages. This is about email spam on a LAN level. Stop typing open eyes.

Re:How About?

[jo42]

Eh? Phishing is only a sub-set of spam.

Dunno about better

[melonman]

But avoid SPEWS like the plague. They have a wonderful policy of blacklisting entire 16-bit IP ranges because one machine in an enormous server park has been used to send spam.

They know this causes massive collateral damage to machines administrated by totally independent companies, many of them small and liable to suffer severe hardship because of this arbitrary action. That's precisely the idea: they keep hurting non-spammers to make them lobby the server parks to deal with the spammers.

Unless you think that kidnapping children and refusing to return them unless their parents fight the mafia for you is an ethical law-enforcement policy, SPEWS is obviously far far worse than the problem they are allegedly attempting to solve.

Re:Dunno about better

[Brightest Light]

What exactly is an RBL operator supposed to do about large server parks that simply do not give a shit about the spammers residing on their network? What do you do about networks that actively aid spammers by moving them around and around to clean IP space as they're blacklisted? Playing IP whack-a-spammer went out of fashion years ago, and obviously asking politely doesn't work. Yeah, finding your ISP listed on SPEWS sucks, because there's no real way to contact them; though you can beg in NANAE and NANABL for the entertainment of the wannabe 'spam-fighters' till you're blue in the face -- but if your ISP does not care about the fact that one of their customers is stealing bandwidth, CPU cycles, and time from other people and their ISPs, what else can SPEWS do about it? My understanding of the SPEWS escalation process is that they notify the ISP about the spammer on their network, and then if nothing is done, they list the surrounding IP blocks in an ever-increasing fashion. Meaning if the ISP simply does not care that there's a spammer on their network, they are made to care by virtue of their entire netspace being (eventually) listed. What else *can* an RBL operator do when the ISP does not listen or care? I ask this as a serious question. IANASFBFNANAE (I am not a SPEWS fan boy from NANAE) - in fact, I don't directly use RBLs any longer.

Re:Dunno about better

[91degrees]

Most blocking lists will ist the entire ISP if they'r causing a problem. SPEWS only lists the entire netblock. And often seem to list based on pretty arbitrary criteria. There are ISPs listed by SPEWS that last had a spammer several years ago but SPEWS continues to list them for reasons that are not shared by any other ISP, ISPs listed that haven't hosted spam, and ISPs that don't even exist any more. And the slight lack of logic of blocking email from addresses that only host websites.

That and SPEWS hasn't been updated for 4 months which suggests to a lot of people it's a dead list.

Re:Dunno about better

[melonman]

The error in your reasoning starts when you assume that self-appointed do-gooders have the right to infringe the rights of third parties. (I'm not going to answer any posts about how actually it's just a list and no-one has to use it bla bla - save it for the bar-room barristers.) Vigilantes are always a menace, especially when they have a policy of hurting the innocent.

I think there's a pretty fundamental difference between a quasi-domestic ISP and a server park running dedicated servers which are the legal responsibility of completely independent companies. The only reason my machines share an IP range with spammers is because (like almost everyone), I'm not rich enough to buy my own pipe and deal directly with IANA.

And SPEWS' policy didn't make me put pressure on my ISP, it just made me vow never ever to use SPEWS on any server I have anything to do with, and to bitch about SPEWS on every possible occasion until the end of time. Part of fighting spam is getting the masses on the side of fighting spam, and I'm afraid that my starting position with anyone fighting spam now is "Is this just a cover for inflicting pain on the innocent?"

If the SPEWS ban had become a real problem I would rather have paid for a separate clean SMTP server than cave into the spam mafia. It's not that I like spam, I just hate bullies more. (We have since changed server parks, but this had nothing to do with SPEWS or spam.)

The good news is that, from my experience, almost no-one I ever wanted to send mail to uses SPEWS. That's the flip-side of blocking huge IP ranges in order to feel important: people with a life realise that being able to email more than 5% of the IP range is A Good Thing and simply sideline you.

Re:Dunno about better

[91degrees]

I'm not going to answer any posts about how actually it's just a list and no-one has to use it bla bla - save it for the bar-room barristers.

Indeed. It's pedantry. And a rather cowardly refusal to accept responsibility for their actions. If I had a blocking list, then I'd say with pride that I block spam, and some list maintainers do this.

Some people do use SPEWS simply as a preventative spam blocking system. SPEWS itself doesn't claim to be any more than this. It's a bit heavy on the false positives but if people prefer things that way then who are we to criticise? The problem comes from the NANAE fanatics who insist that SPEWS is a punishment mechanism.

Re:Dunno about better

[Scarblac]

What they can do is list the IPs from which spam has originated. Period. That's what they're supposed to do.

Re:Dunno about better

[Ed Avis]

It's not the RBL's job to fight spam, only to give an honest estimation of how likely a particular IP address is to be a spammer. People can then use this to configure their mail system to filter out most spam and let through most legitimate mail.

If SPEWS feel the need to punish ISPs for their behaviour, they need two classes of blacklist: one that says 'this address sends spam', and one that says 'this address probably isn't a spammer, but it belongs to a Bad Network'. Then let users choose for themselves whether to take part in the crusade.

Re:Dunno about better

[Anonymous Coward]

I disagree.

Why? Well, I think the ISP in this question is acting 'as the mafia don'. He usually doesn't involve himself with the criminal activity itself - but he gets a cut of all the money.

This is like saying "We don't want to talk to you, if you pay money to the mafia don" (the ISP).

Re:Dunno about better

[Lost Race]

SPEWS is probably not relevant any more. There have been no changes to the published DNSBL zones since 2006-08-24; apparently the database is no longer being maintained.

Re:Dunno about better

[geminidomino]

Indeed. It's pedantry. And a rather cowardly refusal to accept responsibility for their actions. If I had a blocking list, then I'd say with pride that I block spam, and some list maintainers do this.

You mean like Joe Jared, or maybe the NANAE Nine?

Lawyers are the only creatures on the planet with less scruples than spammers. Prudence does not necessarily equal cowardice.

Re:Dunno about better

[meringuoid]

The error in your reasoning starts when you assume that self-appointed do-gooders have the right to infringe the rights of third parties.

Is it the right of the owner of a mail server freely to accept or refuse messages at will? Is it his right to define whatever rules he wishes for the acceptance or rejection of email? Is there anybody in the world who has the right to order him to do otherwise?

If the answers are 'yes', 'yes' and 'no' respectively, I submit to you that it is those who would silence SORBS, SPEWS and the like who are infringing the rights of third parties, by ordering mail admins to only use means of filtering email of which they personally approve.

Re:Dunno about better

[epine]

The error in your reasoning starts when you assume that self-appointed do-gooders have the right to infringe the rights of third parties. (I'm not going to answer any posts about how actually it's just a list and no-one has to use it bla bla - save it for the bar-room barristers.)

You have some gall beginning your post with an analysis of the error in other people's logic while predicating your argument on rights that don't exist and then insisting that if anyone points this out you'll stick your fingers in your ears and hum "nya nya nya nya". Sounds a lot like the behaviour of the ISPs you are seeking to defend.

I wish I had a moderation button that would add your introductory remarks to your slashdot sig for all time.

Re:Dunno about better

[scdeimos]

And the slight lack of logic of blocking email from addresses that only host websites.

Whilst I have no experience with SPEWS, I have worked with ISP's and webhosting providers in the past. Blocking IP's that "only host websites" makes perfect sense when those web sites host brain dead form-to-mail scripts/executables (ie: sender and recipient addresses can be supplied as form parameters) - it's as good as advertising free SPAM zombies.

Re:Dunno about better

[Pig Hogger]

But avoid SPEWS like the plague. They have a wonderful policy of blacklisting entire 16-bit IP ranges because one machine in an enormous server park has been used to send spam.
They know this causes massive collateral damage to machines administrated by totally independent companies, many of them small and liable to suffer severe hardship because of this arbitrary action. That's precisely the idea: they keep hurting non-spammers to make them lobby the server parks to deal with the spammers.

Bullshit. SPEWS policy is extremely simple: one spam will list THE IP, and it is only if abuse complaints regarding spam are NOT resolved that the listing is escalated until the whole ISP is blacklisted.

SPEWS is a list of spam-tolerant ISPs.

The hardship cast upon smaller clients of the ISP is brought to them only by their indirect support of spammers through their direct support of spam-friendly ISPs.

Now if one wants a less aggressive blacklist, one can always look at Spamhaus.

Re:Dunno about better

[Pig Hogger]

And SPEWS' policy didn't make me put pressure on my ISP, it just made me vow never ever to use SPEWS on any server I have anything to do with, and to bitch about SPEWS on every possible occasion until the end of time.

Then you totally missed the point. It is not SPEWS that blocks you, it's the networks who use SPEWS that do.

And no amount of bitching is going to solve your problem, which is that you are supporting a spam-friendly ISP. And for this, you deserve to be listed.

Re:Dunno about better

[Pig Hogger]

What they can do is list the IPs from which spam has originated. Period.

And you will have as much spam as before.

Spam-friendly ISPs will regularly give different Ip addresses to spammers.

SPEWS stands for SPam Early Warning System. That is, it BLOCKS spam BEFORE it leaves the network, in anticipation of the ritual spammer IP address change. And that can only be achieved by listing the whole IP range of the spam-friendly ISP.

Re:Dunno about better

[fractalus]

What's you're supposed to do is suck it up and take it like a man.

Let me explain. You have to decide what it is you're trying to accomplish as a blacklist operator. Are you trying to advise people of spam sources? Or are you trying to punish spammers and their friends?

If you're just trying to advise people of spam sources, so that they can choose not to receive mail from spammers, then do just that. List spam sources, and stop there. Mission accomplished, although spammers will move around and you'll have to maintain your database. Don't like that? Don't run a blacklist.

If you're trying to punish spammers, or you're trying to evict them from the internet, then you're probably OK with the whole collateral damage thing. And that's fine... just be honest with your blacklist users that that's what you do, so they can make an informed decision about whether you're trustworthy or not.

The biggest problem with blacklists is that their operators tend to start out with the first attitude, but as the maintenance grinds them down, they shift over to the second group. So most blacklists start off well-intentioned before sliding down into ethics almost as questionable as the spammer.

Re:Dunno about better

[mvdwege]

SPEWS only lists the entire netblock. And often seem to list based on pretty arbitrary criteria.

I tend to hear that a lot. Funnily enough everyone posting these kind of complaints about SPEWS never seem to add any examples.

So, care to give examples?

Mart

Re:Dunno about better

[mvdwege]

If SPEWS feel the need to punish ISPs for their behaviour, they need two classes of blacklist: [...]

People would take you a lot more seriously if you would do your homework before making bold statements.

Hint: try reading the SPEWS FAQ and looking at the database before spouting off.

Mart

Re:Dunno about better

[Anonymous Coward]

Change your name from "melonman" to "melonhead".

Re:Dunno about better

[91degrees]

You know, I don't think many people really have a problem with people using SPEWS just as a blocking mechanism. They might think it's a crappy list, but there are other pretty hopeless lists that don't offend anyone nearly as much.

What gets people upset is when it changes from a blocking tool to some sort of police service, and people use it to bully ISPs to behave in a certain manner, or bully their customers to change, or various other irritating things that a lot of SPEWS advocates (but not SPEWS itself) do.

Re:Dunno about better

[iangoldby]

What exactly is an RBL operator supposed to do about large server parks that simply do not give a shit about the spammers residing on their network?

The original post explained why the end does not justify the means. You 'counter' it by insisting that since you can't think of anything better the end does justify the means. Welcome to rational debate.

Not that I'm blaming you - and you did say that you don't use RBLs anymore.

Perhaps since there is no 'rational' answer to this question of priorities, the best solution is to let the people who are affected by the collateral damage - i.e. the email recipients - decide on their priorities for themselves.

Re:Dunno about better

[Anonymous Coward]

SPEWS is a menace!

I used to work for a hosting company that got a new customer that turned out to be a major spammer. When the complaints started we started the process of terminating this customer but this was impeeded due to the fact that all messages from SPEWS and most other RBLs were anonymous and due to legal reasons a complaint had to be from a known person in order for it to be usable in the process. It was also impossible to respond to the complaints or correct errors, the latter turned out to be important because as we terminated the spamming customer, SPEWS refused delisting because the IP's were still in use... Which they weren't but they had got the range in question wrong. This entire matter was closed in early 2002 and the listing still stands, despite attempts at having things delisted several times since (which resulted in nothing but ridicule from NANAE). There has not been a single major complaint since 2002 (their evidence file has not been updated at all) and they still lists this hosting company as a major spam heaven, listing their entire allocation full throttle.

Re:Dunno about better

[Temsin]

You needn't worry about SPEWS. It is already dead: http://mirror.bliab.com/spews/ .

Expect SORBS to be kicked off the servers they are on for financial fraud pretty soon.

In case you didn't know: SORBS also hosts the SPEWS blacklist.

As you've guessed, both blacklists are nothing but extortion rackets.

Re:Dunno about better

[ohtani]

I certainly can!

My previous dedicated hosting provider was somehow inner-twined for being a spammer, when I know they would have and probably did indeed delete said spammer's account and remove their server right away. And that's assuming they even had spammers in the first place!

The case I saw seemed to be that my host was a "Sister's Daughter's Pet's Vet's Mother's Husband" type relationship. And because I was on that host I was affected too! Thank god almost nobody that was receiving e-mail being sent through my server actually USED SPEWS.

Re:Dunno about better

[Tinfoil]

My current employer was listed on SPEWS for this very reason. However, my provider did deal with the issue in a very quick and timely manner, IMHO, by shutting down the spammers account within 24 hours of my bringing it to their attention, but SPEWS took their damned time removing the block. It caused some rather large headaches for a week or two as our primary vendor supplying 80% of our stock was utilizing SPEWS.

SPEWS is bad. SORBS isn't horrible. The problem with many block lists is that they are, more often than not, staffed by anti-spam militants and really don't give a rats ass if their lists cause problems as long as they themselves do not get spam. They, somewhat understandably, spout "If you don't like it, you don't have to use it", which I can't argue with.

Re:Dunno about better

[Ed Avis]

spews.org is missing from DNS for me for some reason, but thanks for the correction. If this is indeed the case, then I wonder what all the fuss is about.

Re:Dunno about better

[LurkerXXX]

No, that's what YOU think they are supposed to do. Myself, I like to know what asshole ISPs are out there that like to host spammers and give them a new IP every day, and just block the whole crappy ISP. If you want your mail to get to my mail server, start using another ISP with ethics, otherwise I'm just going to bounce everything you send because I'm tired of dealing with all the crud from your ISP. That's what I want them to do. :)

Re:Dunno about better

[mvdwege]

That is not a verifiable example. That is hearsay.

What was the name of that provider? What was the netblock being 'blocked'?

Mart

Re:Dunno about better

[mrmeval]

The server park can deal with the asshat spammer or lose business.

Re:Dunno about better

[mvdwege]

OK, I'm assuming your ignorance was not malicious. Yes, SPEWS does use multiple levels of blocking, for sources that are positively identified as either being spam sources or belonging to a provider that does not appear to have decent abuse handling they publish a list that can be used for blocking, and for other sources they use a list that is merely 'watched' (and expressly advised not to be used as an RBL).

Although the fact that they haven't been updated since August worries me a little. Possibly the SPEWS admins suffer from burn-out? Or they have concluded that others do the same work much better (like e.g. Spamhaus)?

Mart

Re:Dunno about better

[LurkerXXX]

Don't like that? Don't run a blacklist.

Wow, I'm glad they have you to tell them how they have to run a blacklist.

FYI, some ISPs give spammers new IP addresses every day. IMO there's just one way that should be dealt with, block the ISP entirely. There's no need to take in new spam every day until you catch that day's list of IPs from that ISP. Just blocking the ISP is much more efficient. If there is collateral damage, that's the fault of the crappy ISP.

Don't like how they run their blacklist? Tough. Don't use it. Others who like it will. They don't have to 'not run a blacklist' because you aren't happy about it.

Re:Dunno about better

[91degrees]

Spews doesn't seem to be working for me right now so I can't provide numbers. However, I have seen an IP address that appears to be listed for a popular and quasi legal scam (reprehensible - yes but they're not spammers). I've also seen a few listings for companies that haven't existed for some time and listings where the only apparent spamming from the IP address was one which had sent spam for a total of 2 weeks some years ago, and then been stopped.

Re:Dunno about better

[TheDawgLives]

That doesn't work in a business setting. As an e-mail system manager, I get heat for letting in spam but I get a LOT more heat for blocking legitimate business related e-mail. And my bosses don't care about RBLs and ISPs that allow spam, they just want their e-mail. Just yesterday dnsrbl.sorbs.net blocked an e-mail from an sbc mail server. I had to switch to safe.dnsrbl.sorbs.net. That doesn't block as many IPs because it doesn't include the escalations.
It would be nice to punish brain-dead ISPs, but in the business world you'd just be punishing yourself.

Re:Dunno about better

[Anonymous Coward]

, which is that you are supporting a spam-friendly ISP. And for this, you deserve to be listed.

And this is the stupid attitude that makes people hate SPEWS so much. Who says its a spam supporting ISP? SPEWS does, but are they right? Why should we listen to SPEWS? Why should we give a damn what SPEWS thinks? SPEWS hides away in its secret lair somewhere deciding X is a spammer, Y is not a spammer, and anyone who is listed is, for some reason, expected to immediately jump and guess what will mollify SPEWS, or post on a public newsgroup and essentially beg to be removed, where they wil lbe told what they need to do by peopel who make it perfecrtly cclear that they don't represent the organisation.

You want to use them for listing. Fine. But what makes you think other people should give a damn about their opinion? It's the mail admins whop are doing the blocking. Not the spammer. The mail admin should accept responsibility for what they're doing and not blame it on someone else.

Re:Dunno about better

[Anonymous Coward]

Let me get this right.

Some ISPs give spammers a new IP address every day. Based on the actions of these few, we should assume that every ISP that is ever too slow in stopping a spammer will behave in exactly the same way. And it's the ISPs fault that you're assuming that they're going to behave in this way.

I'm sure that's not your position but it's how it sounds to me.

Re:Dunno about better

[LurkerXXX]

Then you read it wrong. Some RBLs start small (an inital IP) and then expand the range they block if the ISP is hosting a lot of spammers and not getting rid of them. There are methods for getting off RBLs if you follow them. (and you can get off SORBS free and quickly if you follow them, read other posts from other folks here for examples)

Re:Dunno about better

[merc]

The error in your reasoning starts when you assume that self-appointed do-gooders have the right to infringe the rights of third parties. (I'm not going to answer any posts about how actually it's just a list and no-one has to use it bla bla - save it for the bar-room barristers.) Vigilantes are always a menace, especially when they have a policy of hurting the innocent.

What the hell are you talking about? It's quite the opposite -- barring private contracts you have no implicit right to send e-mail to any mail server. What rights do you believe are being infringed? -- please enlighten us with your vast legal know-how Mr. Internet lawyer, and disclose the details of these alleged rights. As the administrator of my mail servers I have the right to block you for any reason I deem whatsoever, and even more should I have determine that your network is a threat to the stability of mine.

The Internet is not a public resource but a network of private LANs. If anyone is the self-appointed do-gooders it's those that believe they have some god-given right to re-appropriate others' private property.

My servers, my rules. If you don't like it die in a fire while pounding sand.

Re:Dunno about better

[The Vulture]

Just yesterday, where I work, in fact.

SPEWS blocks the entire netblock that our company resides in. That netblock is managed by NextWeb, the only ISP we can get with our building location, and although we have not spammed anybody, we are collateral damage.

Yesterday, I was contacting a company about a technical support issue, and their e-mail server sent me back a nice 550 of, "5.7.0 Your server is a suspected spammer, we are quarantining the e-mail" (or something like that, not those exact words).

SPEWS is the only DNSBL that our IP address is listed in. Unfortunately, the SPEWS page is down right now, so I can't see their BS "evidence".

-- Joe

Re:Dunno about better

[Brightest Light]

Actually, I was not attempting to 'counter' or debate anything. I asked a simple question. Welcome to third-grade reading comprehension.

At no point did I suggest that the ends justified the means, I merely asked what alternatives an RBL operator has when faced with an ISP that knows, but does not care that spammers reside on and operate from their network. What precisely *are* they supposed to do? Playing whack-a-spammer by only listing IPs that send spam does not work when there are ISPs that actively aid their spamming customers by moving them around as their existing IP space gets listed. I'm not suggesting that SPEWS' actions are the right ones, but since people seem to frequently (entirely reasonably, IMO) criticize and villify SPEWS, surely they have a viable alternative to suggest that isn't "shut up and take your spam".

Re:Dunno about better

[nuzak]

> Unless you think that kidnapping children and refusing to return them unless their parents fight the mafia for you is an ethical law-enforcement policy,

BadAnalogyGuy, is that you?

Re:Dunno about better

[nuzak]

Spam Prevention Early Warning System, actually.

And while their listing expansion policy has always been pretty zealous, the best thing SPEWS had going for it was its evidence files, containing sample spam and WHOIS information. I speak in the past tense because they're always woefully out of date these days, and the information is worse than nothing when you have to look at it then hit whois to see who the REAL owners are now. I don't think any mail admin seriously uses SPEWS anymore except as a very minor advisory flag.

Re:Dunno about better

[nuzak]

Typical chickenboning spammer, probably created his slashdot ID just to post on this article.

Re:Dunno about better

[iangoldby]

Don't take it personally - sorry if I was offensive. This argument always comes down to a value judgement over the (dis)merits of spam getting through versus legitimate mail not getting through. Different people quite rightly have different opinions.

The argument along the lines "If there is no better way of blocking spam, we'll just have to use RBLs" is flawed, because it only begs the question. (i.e. it assumes that the 'correct' judgement is to accept blocking of legitimate mail as a price worth paying for reducing spam.)

My point was that the only person qualified to decide whether collateral damage is a price worth paying is the intended recipient of the email. ISPs and system administrators should not be making this decision on their users'/customers' behalf, and especially not without telling them.

Personally, I think 'Shut up and take your spam' is a better solution than RBLs and collateral damage, because it puts control in the hands of the recipient where it belongs. It's far from ideal, but it is probably the best we have. That's my own value judgement.

Re:Dunno about better

[iangoldby]

Is it the right of the owner of a mail server freely to accept or refuse messages at will?

My answer is that it may not be. It is not, for example, if he has an responsibility to provide an email service to others.

Is it his right to define whatever rules he wishes for the acceptance or rejection of email?

See above.

Is there anybody in the world who has the right to order him to do otherwise?

Perhaps. The people he provides email accounts for?

I get sick of the arrogant attitude of certain administrators that they can do what the hell they like, and if users don't like it they can get an account elsewhere. Most of the time spam blocking policies and their likely consequences are not even public knowledge, and the users don't know they are likely to be suffering collateral damage.

Control over spam rejection policies should reside in the hands of the users, not the administrators.

Re:Dunno about better

[iangoldby]

What the hell are you talking about? It's quite the opposite -- barring private contracts you have no implicit right to send e-mail to any mail server

You've got it exactly backwards. If I have an agreement for a service that includes email, I have a right to expect that any email sent to me can reach my account. It is not the rights of the sender that are being infringed, it is the rights of the recipient.

Re:Dunno about better

[merc]

You've got it exactly backwards. If I have an agreement for a service that includes email, I have a right to expect that any email sent to me can reach my account. It is not the rights of the sender that are being infringed, it is the rights of the recipient.

You need to read before you click submit; go back and read my post again. Pay particular attention this time to where I mention the words "private contracts". Did you hear me talk about my private property? Please tell me what law requires that I accept e-mail from anyone barring a contract to do so.

Even then I still must disagree with you, and so have courts:

References:

"The University of Texas was within its rights to block spam sent by an internet dating agency, even though the unsolicited emails complied with the requirements of federal anti-spam laws, an Appeals Court has ruled."

http://www.out-law.com/page-5986

Re:Dunno about better

[John Hasler]

> Personally, I think 'Shut up and take your spam' is a better solution than
> RBLs and collateral damage, because it puts control in the hands of the
> recipient where it belongs.

If I had not been able to switch to DSL from dialup a while back I would have had to give up my current email address. The volume of spam would by now have exceeded the capacity of the link. It is simply not possible for all users to "take their spam".

Re:Dunno about better

[Brightest Light]

Apologies are in order for my snarkitutde. I really need to remember to get the caffeine fix *before* replying to posts on slashdot.

I agree with you entirely that one providing e-mail services to paying customers really ought to inform those customers of what they're doing to filter their e-mail. I had to pick my e-mail provider very very carefully for this reason, and thus far I've had no problems (been with 'em going on 4 years) because they're entirely up-front about what they do by default (nothing) and give you complete control over a huge list of spam-filtering options (whitelist, goldlist, greylist, bayesian filtering, a whole slew of RBLs) that you can *choose* to apply to your incoming e-mail. Of course, this is a service specifically tailored for the more clued-in users out there.

I'd think for somebody managing the e-mail service of a medium to large sized ISP, this is less of an option. Then again, any e-mail administrator who uses RBLs as a sole means of determining whether or not a message should be delivered to its recipient ought not to be employed as an e-mail administrator for much longer. It's been my personal experience that a customer will happily take hundreds of spam, but god help you if you drop a legitimate e-mail of theirs.

Re:Dunno about better

[iangoldby]

That's not an argument against putting choice in the hands of the recipient though.

Re:Dunno about better

[Anonymous Coward]

He's got a lower UID than you, and there are a lot of people who don't like SPEWS who aren't spammers.

And what he says is true.

Re:Dunno about better

[John Hasler]

If you believe that your ISP is breaching his contract with you by rejecting mail addressed to you based on a SPEWS list, sue him. SPEWS is not blocking your mail. Your ISP is.

Re:Dunno about better

[iangoldby]

I think it is perhaps you who needs to read what I wrote, this time with a more open mind.

(It's not about you - you may well run your own private email server where you have no responsibilities to any other users. I don't care. What you missed is that those of us who oppose the use of RBLs are not in general the senders of blocked emails. Mostly, we are those who are trying to receive emails that are being blocked on our behalfs by high-handed ISPs and administrators. So arguing about whether or not it is the right of the sender to expect his email to enter your private server is completely backwards. I stand by my post.)

Re:Dunno about better

[melonman]

It would be nice to punish brain-dead ISPs, but in the business world you'd just be punishing yourself.

That's the bottom line for me. People who bang on about how they spend half their waking hours tweaking the mail server in their dorm room to reject everybody's mail Because They Have Root are essentially harmless and just need to get a life, but transferring that approach to business is like hacking your own limbs off in a sword fight to stop your opponent injuring you.

Anyway, the news that SPEWS may well have gone belly up, and that no-one with a user base in binary double figures uses it anymore anyway, has really made my week.

Re:Dunno about better

[melonman]

It is not SPEWS that blocks you, it's the networks who use SPEWS that do.

I didn't miss that point, I'm just so tired of it that I declared up front my intention not to play word games around it one more time.

And no amount of bitching is going to solve your problem,

What problem? My servers are primarily web servers, so they don't send a lot of mail. The mail servers I use are not in the same continent, let alone the same server park. The one problem we had concerned one address on one mailing list app on one of a large number of domains we host. If anyone any of our customers wanted to talk to used SPEWS, we would have forked out $15 a year for a clean SMTP server, but they didn't, so we didn't.

which is that you are supporting a spam-friendly ISP.

No, we were (past tense) bound into a contract with an ISP that SPEWS claimed were spam-friendly. Since there's no appeal process, I struggle to treat that claim as having Voice of God authority.

And for this, you deserve to be listed.

Which totally ignores questions like

• How long it takes an ISP to investigate a claim and terminate a hosting contract in such a way as to avoid being sued by their former customer. (If my ISP terminated my hosting contract in error, I would certainly sue for punitive damages.)
• How hard it is to get out of a dedicated hosting contract (when we did leave that ISP for other reasons, I received threatening letters for a year afterwards, and they only stopped when I offered to send the entire file to the press)
• How long it takes to move from one server to another, when you have dozens of customers with their own login details and domain names pointing at the old server that are administrated by your customers
• How you can guarantee that the server you move to won't suddenly turn up on the SPEWS blacklist the week after you sign a 2-year contract because someone in their park of 3,000 servers sent some spam, or maybe because the Redsocks are top of the league.

But something tells me that none of this is of any interest to you, because you sound like the sort of spamlist groupie who would happily nuke every major city in the world to reduce his own received spam by 30%. Thankfully, you are in a tiny tiny minority, which is presumably why SPEWS has folded in all but name (YYYEEESSS!!!)

Re:Dunno about better

[Anonymous Coward]

Funnily enough everyone posting these kind of complaints about SPEWS never seem to add any examples.

You aren't paying much attention then. Go search usenet, or the NANOG mailing list. Plenty of real life examples of SPEWS/SORBS/etc. abuse and idiocy.

Re:Dunno about better

[Pig Hogger]

An anonymous coward said the following:

which is that you are supporting a spam-friendly ISP. And for this, you deserve to be listed.

And this is the stupid attitude that makes people hate SPEWS so much. Who says its a spam supporting ISP? SPEWS does, but are they right? Why should we listen to SPEWS? Why should we give a damn what SPEWS thinks?

You don't have to give a damn. No one forces you to use SPEWS. If you don't like them, just don't use them!

SPEWS hides away in its secret lair somewhere deciding X is a spammer, Y is not a spammer, and anyone who is listed is, for some reason, expected to immediately jump and guess what will mollify SPEWS, or post on a public newsgroup and essentially beg to be removed, where they wil lbe told what they need to do by peopel who make it perfecrtly cclear that they don't represent the organisation.

SPEWS is anonymous precisely to avoid being sued into oblivion by spammers.

SPEWS carefully documents the reason for every one of it's listings. It is up to the culprit to clean up his act and announce that he cleaned-up his act on NANAE to be delisted.

And delisted he will be, IF, and ONLY IF he REALLY cleaned-up his act.

What is wrong with that?

You want to use them for listing. Fine. But what makes you think other people should give a damn about their opinion? It's the mail admins whop are doing the blocking. Not the spammer. The mail admin should accept responsibility for what they're doing and not blame it on someone else.

And that's what they do. They block under advisory from SPEWS and if you have beef with that, take it to those who block you, not SPEWS (or blocklists in general).

Re:Dunno about better

[Pig Hogger]

No, we were (past tense) bound into a contract with an ISP that SPEWS claimed were spam-friendly. Since there's no appeal process, I struggle to treat that claim as having Voice of God authority.

SPEWS carefully documents the reason behind each listing. There is nothing arbitrary there.

How long it takes an ISP to investigate a claim and terminate a hosting contract in such a way as to avoid being sued by their former customer. (If my ISP terminated my hosting contract in error, I would certainly sue for punitive damages.)

Then the contract has been written in a clown. A proper contract would have a terminate for cause clause, for causing a listing on a blocklist.

Again, this is not SPEW's fault but the ISP's/yours.

Re:Dunno about better

[iangoldby]

You are spot on there.

The trouble is though that in my experience, ISPs don't put that kind of detail into the small print of the contract, and I certainly don't like the idea of going to the courts. If you can really be bothered, have a look at the story of my battle with my previous ISP for an example of what is likely to happen when you try to complain in exactly this situation.

Re:Dunno about better

[Anonymous Coward]

What SPEWS has done sounds libellous. You should sue. If you file, you can ask a judge to write a court order to their ISPs to reveal their identities. A dollar says a single letter to their home address will settle the matter.

Re:Dunno about better

[Anonymous Coward]

You don't have to give a damn. No one forces you to use SPEWS. If you don't like them, just don't use them!

The impression I get, repeatedly, is that the people who are listed on SPEWS should care about SPEWS opinion. That they are obliged to do whatever people thinks SPEWS want them to do to get off SPEWS. The people on SPEWS don't have a choice about being on it.

I don't care who uses it to block email. Really I don't. It just irritates when they blame the person being blocked.

SPEWS is anonymous precisely to avoid being sued into oblivion by spammers.

So? The result of being anonymous is that they abruptly become substantially less trustworthy. Whatever their claimed reason.

SPEWS carefully documents the reason for every one of it's listings. It is up to the culprit to clean up his act and announce that he cleaned-up his act on NANAE to be delisted.

S2010 claims "Spamming to harvested/scanned fax-to-email numbers". No evidence. Just a statement. S3045 - listed for "spamming". As far as I can tell, the company doesn't even exist any more. There are a hell of a lot of these. Most of the records report abuse from several years ago.

And delisted he will be, IF, and ONLY IF he REALLY cleaned-up his act.

What is wrong with that? Why should someone have to post to a public forum filled with childish idiots nitpicking about how things should be done, and accusing the ISP of being a spam support opearation whether there's any evidence or not apart from SPEWS possibly giving an example from 2001? Does SPEWS actually require this for delisting? If so they're going to have a lot of redundant entries. A lot of ISPs simply aren't going to do this.

And that's what they do. They block under advisory from SPEWS and if you have beef with that, take it to those who block you, not SPEWS (or blocklists in general).

They can block whoever they like. SPEWS can list whoever they like. I don't care. It doesn't matter.

But don't blame the poor guy who's blocked for the fact that you have used a poor quality list from an organisation that many people think are pretty inept.

Re:Dunno about better

[91degrees]

Then the contract has been written in a clown. A proper contract would have a terminate for cause clause, for causing a listing on a blocklist.

Really? That would be a tricky clause to get right. What do these usually look like? What does this clause in your contract say?

Re:Dunno about better

[Achromatic1978]

SPEWS carefully documents the reason behind each listing. There is nothing arbitrary there.

I read this. And I'd read other people saying the opposite. So I used someone else's example, S3045. "Spamming". Wow. Careful documentation of the reason for a listing. Oh, and they dumped a few WHOIS records in there too. Phewee. And here I was thinking they might have skimped on the "careful documentation of the reason behind a listing".

All I ask..

[NoxNoctis]

is that you not use SPEWS. Oh the pain that "list" causes me.

Never ever...

[cyberrobo]

...use RBLs at SMTP-Level without any kind of scoring algorithm (only block when $x out of $y RBLs have the IP listed) unless you don't care about your mails. There have been major fuckups with single RBLs in the past and there will be such in the future. Especially with SORBS. See http://www.google.com/search?q=sorbs+sucks.

I thought that'd be common knowledge by now, but apparently I'm mistaken.

Re:Never ever...

[geminidomino]

How many Scoring Algorithms can be used during the DATA phase?

Re:Never ever...

[swillden]

How many Scoring Algorithms can be used during the DATA phase?

Any scoring algorithm that relies only on the sending server IP address, HELO data, MAIL FROM, and RCPT TO can be done prior to DATA. There are plenty of tools that implement an SMTP server front-end and do scoring at this level, and blocking based on the score.

SURBL

[tootired]

SURBL is a URL blacklist.

Employing it enables your spam software to block emails that have matching blocked urls in the message body.

I have not gotten any false positives with it and it blocks a ton of nasty phishing stuff in addition to the usual SpermaMAXX crap.

Re:SURBL

[bcrowell]

Thanks for the tip! I just implemented SURBL on my box. It's not so surprising that everything that SURBL flags is spam, but what's more surprising is that virtually everything that's spam is flagged by SURBL.

Expect many false positives

[dtfinch]

All the blacklists I know have a tendency to block entire ISPs rather than just the ranges known to generate spam, if they think the ISP isn't taking sufficient action against its spammers or spambot infected customers.
Blacklists and whitelists are useful, but I wouldn't use them as the sole indicator of whether or not an email is spam.

Re:Expect many false positives

[dtfinch]

Pretend I said "blacklist" instead of "block", since the lists don't do the blocking.

Re:Expect many false positives

[Anonymous Coward]

The point of blocking a rogue ISP, rather than just "the ranges known to generate spam", is simple. If the ISP has made it clear it has a policy of permitting its services to be used to generate spam, then any and all of its IP addresses are likely to be used by spammers within short notice. Spammers are aware of when they're blocked, and if the ISP is on the spammers' side, they will happily hand the spammer new IP addresses every time the old ones get blocked.

Trying to keep spammers blocked when the ISPs are moving them around is called "whack-a-mole" and it is a pointless endeavor.

ISPs have a choice not to willingly host spammers. They don't have to become super-duper spamfighters in order not to get blocked. All they need to do is not host spammers. It's really not that hard! Just consider: if you're an ISP and someone calls up and says they want to be your customer, and you find out that they want to sell penis pills and horse porn, use your common sense! The ISPs that are willful spammer hosts at this point are the ones which have thrown their lot in with the spammers, and to hell with the rest of the net.

Want to know where the spammers are? Check this list. The ISPs with the worst spammer problems are Verizon Business, Serverflo, and SBC. If you choose to host with these ISPs, you are moving into a neighborhood where the "government" (the ISP) is already proven to be in bed with the Internet's largest native criminal element. If you do this, you should expect the rest of the world to treat you with some suspicion.

Re:Expect many false positives

[mutterc]

Spamhaus claims to not do this... the only time they list IPs that are not spam sources are pre-emptively when a spammer on their ROKSO list gets an account, and sometimes ISP's corporate mail servers (not the customers' ones, and not customer machines).

Re:Expect many false positives

[91degrees]

I think they will block an entire ISP if the ISP is particularly bad with spam. This is rare, and is typically only when they're pretty certain that they only support spammers. But it does happen.

SORBS should be shut down.

[finchwizard]

I'm sorry but SORBS should be shut down. The amount of time I myself and many colleagues have managed to get onto SOBS because we were classed as a dynamic IP range, despite having blocks of IP's and it's extremely hard to get off it. I understand blocking people with Open relay servers, but being in a dynamic range, which can mean IP's being assigned to you from your ISP is a joke. Everyone should be boycotting these guys, two of the large ISP's in Australia use these guys to filter out spam, and are being blocked by small business's and Education. I've never posted comments on Slashdot yet, but this is one I feel very strongly on, and SORBS should be avoided at all costs. If they deem you a Spammer, despite proving to them you are not, they still reserve the right to keep you on the list and completely screw over your business.

Re:SORBS should be shut down.

[CowboyBob500]

I use SORBS precisely because they block dynamic IP ranges. 99% of spam comes from trojaned machines on dynamic IPs and I find this extremely effective at blocking spam. If your mailserver lives on a dynamically assigned IP then that is your problem. In my opinion a mail server should ALWAYS be on a static IP - I view it as a sign of a trusted mail server. If your ISP can't provide this, then you need to change your ISP. I'm sorry, but I have absolutely no sympathy in this situation. There is no reason for a real business to rely on dynamic IPs on their servers.

Bob

Re:SORBS should be shut down.

[c_g_hills]

SORBS does not block anybody. It is simply a tool used by postmasters to make decisions about what messages they wish to accept.

Re:SORBS should be shut down.

[finchwizard]

All 30 IP's I rent are Static, and that has never changed over the years I've owned them, my servers are also running Linux and are very secure with both Spamassassin and ClamAV scanning, as well as blocking certain mimetypes. So don't give me dynamic IP range stuff, I was lucky that my ISP managed to straighten them out, but I've had friends that aren't as lucky. Of course SORBS is going to block a high rate of spam, it's also blocking a lot of legitimate people, and the fact they are extorting people to get off the list is ludacris.

Re:SORBS should be shut down.

[Anonymous Coward]

I think parent posters concern was that SORBS falsely identifies a static IP range as dynamic. I can see them maybe blocking IP addresses in a range that they think are all dynamic (maybe blocking an entire /21 or /22), but AFAIK SORBS really has no way of knowing for sure unless they have detailed information on an ISP's IP addressing layout and policy.

Re:SORBS should be shut down.

[91degrees]

Interesting. Why do you think this matters? Is there some shame in blocking IP addresses?

Re:SORBS should be shut down.

[tacocat]

I agree with this assessment. SORBS is one of those spam fanatical groups that should be convinced they need a regime change. They are way too aggressive.

One RBL list that I was using briefly because of false positives still had an interesting approach. They blocked anyone who was reported as delivering spam for 45 minutes and then removed from the list. Problem for me what they blocked my mailing lists that I subscribe too.

They should never report mailing lists as sending spam. The mailing lists are trying to sort their own out and to block them causes a lot of damage.

Re:SORBS should be shut down.

[geminidomino]

AFAIK SORBS really has no way of knowing for sure unless they have detailed information on an ISP's IP addressing layout and policy.

That's what rDNS is for. If it's not working, they should contact their isp.

Re:SORBS should be shut down.

[iangoldby]

I don't think anyone who administers email on behalf of others should use SORBS. If you use the SORBS lists to block email, some legitimate email will be blocked. You can only really justify use of SORBS in this way if everyone affected understands and is happy with this situation.

I object to SORBS on ideological grounds - that its fee for delisting is about as close as you can get to extortion without actually breaking the law.

It is also frighteningly easy to get listed. They look after a number of 'secret' spam-trap addresses. They operate a 'three strikes and you are out' policy with these trap addresses. That is, on the third instance of a server sending an email to a SORBS spam-trap address, that server will be blacklisted. Blacklisting is permanent if you don't pay the delisting fee.

The usual argument is that server administrators are responsible for preventing their servers from being used for spam. That's all very well, but if a malicious (or just stupid) user sent just three emails to SORBS spam-trap addresses, that server will be blacklisted immediately. No 'if's, no 'but's. How is an administrator expected to prevent that?

In summary, I would recommend everyone to steer well clear of SORBS, unless used strictly as part of a scoring system. If you do use SORBS, make sure that everyone affected understands the consequences of collateral damage and is happy that some legitimate emails to them will be blocked.

Large ISPs that block emails using SORBS are being totally irresponsible.

(You can read a bit more about my battle with NTL here, for what its worth.)

Re:SORBS should be shut down.

[Anonymous Coward]

What does that remind me of? Oh yeah:

SORBS doesn't block people, sysadmins block people!

Re:SORBS should be shut down.

[LurkerXXX]

I use spamd and RBLs and don't have to waste CPU cycles on Spamassasin, so don't give me any of this dynamic IP ranges are ok stuff...

He's free to use the tools he likes to do the job. It's his mail server folks are trying to talk to. He's free to reject whoever he wants and for whatever reason.

Re:SORBS should be shut down.

[cnelzie]

A number of ISPs list their entire range of addresses as "Dynamic" even when they lease out large numbers of those addresses as static.

    I hope that you fall prey to this problem and have to deal with many hours of fighting your way up level 1, 2 and 3 tech support at an ISP that does so, only to be given a phone number to call a small office on the other side of the country that handles their DNS Entries and then deal with their staff being unable or unwilling to input the exact entries you are looking for.

    Then going back to SORBS and having them tell you to go away, because they won't remove you from the list.

    SORBS appears to never have an actual human being look at your rDNS records. So, if you are able to get your ISP to alter their DNS records for the block of IP Addresses you "own" and it isn't EXACTLY what the SORBS Robot Script is looking for, all you will receive is a form letter the same as the first form letter you received after you went to their site to see about getting your static IP removed from their list.

    The form letter will, once again, be written to appear to have been reviewed by a human being, only it isn't.

    SORBS appears to be an extortion service geared towards hitting small businesses who likely don't have the time or funds to persue lengthy international court proceedings.

Re:SORBS should be shut down.

[Exstatica]

I've had this exact same problem. I work for an ISP that is a business ISP and we do not provide any ips via dhcp. We just don't follow thier "requirement" of having the reverse records contain the word static in it. I've been in contact with them about 15 times and still have not gotten a response to get them removed. ips are still listed. STOP USING BLACKLISTS, and if you must just tag it as spam and put it in the spam folder.

Re:SORBS should be shut down.

[nuzak]

I don't think you're reading the GP properly. He claims his IPs are static.

Of course if his ISP is incapable of SWIP'ing them properly, this is hardly the fault of SORBS.

Re:SORBS should be shut down.

[dodobh]

Just set reverse DNS up correctly. Then contact SORBS.

Re:SORBS should be shut down.

[eneville]

I'm sorry but SORBS should be shut down.The amount of time I myself and many colleagues have managed to get onto SOBS because we were classed as a dynamic IP range, despite having blocks of IP's and it's extremely hard to get off it.I understand blocking people with Open relay servers, but being in a dynamic range, which can mean IP's being assigned to you from your ISP is a joke.Everyone should be boycotting these guys, two of the large ISP's in Australia use these guys to filter out spam, and are being blocked by small business's and Education.I've never posted comments on Slashdot yet, but this is one I feel very strongly on, and SORBS should be avoided at all costs.If they deem you a Spammer, despite proving to them you are not, they still reserve the right to keep you on the list and completely screw over your business. i suggest you find yourself a descent ISP. if the isp does not exist, then invest some money in a mail relay with a dedicated hosting provider. just send your mail there and let it deliver the mail for you AND ONLY you.

Re:SORBS should be shut down.

[Akatosh]

I manage email systems for a large isp. Our static ip ranges ranges are automaticaly swipped, with the word 'static' in the whois description, assigned non generic reverse DNS consisting of the customer's hostname + domain name (ex. mail.someusersdomain.com), with long dns ttls. Despite that, Sorbs repeatedly lists said users as dynamic. The last Sorbs isp ticket I opened to delist one of these ranges (again), using the correct registered arin contact address, took five months. I count myself lucky, because the ticket before that fell off the face of the earth with no response. Sorbs knowingly lists people who do not meet their listing criteria, and does not delist when you follow their documented delisting procedures.

Block dynamic ranges? Yes, good idea. Block dynamic ranges using Sorb's dynamic list? Bad idea. Sorbs and Spews are both bad ideas.

Spamhaus and dsbl are reputable and well maintained alternatives.

Orange = Wanadoo

[grahamm]

Orange is part of Wanadoo who are known to be both spam friendly and to host spamvertised web sites. So maybe listing Orange is not such a bad idea.

Re:Orange = Wanadoo

[Ksempac]

First Wanadoo doesnt exist anymore. Second Orange has never been part of Wanadoo. Wanadoo was the ISP branch of France Telecom (the main phone company in France), who bought the British mobile phone company Orange. Then they decided to merge all their mobile phones/ISP services in Europe (including Wanadoo and Orange, but also many others) into one single company called Orange. Third, before saying some company is spam friendly, you should get some reliable source.

Re:Orange = Wanadoo

[grahamm]

If you do a 'whois' search on the IP address given for the 'Orange' ISP it shows the owner as being Wanadoo Netherlands.

it's not the providers job to delist themself

[tolonuga]

if you run a anti spam filter, it is your job to make sure your data is accurate.
but if you think your users would pressure some admin so they get back to you,
that is keeping mails hostage and not an acceptable practice.

if you do that, it is not part of the solution, it is part of the problem.

Re:it's not the providers job to delist themself

[Dark_Gravity]

it's not the providers job to delist themself

Frankly, I have no interest in subsidising a provider that feels that way.

if you run a anti spam filter, it is your job to make sure your data is accurate.

If you *USE* a DNSbl in your anti spam filtering solution, it is your job to make sure the data is accurate enough to meet the needs of your users.

The DNSbl operators have no obligation to any users other than those with a contract indicating such obligation. SPEWS owes no one anything. At least one postmaster somewhere owes SPEWS some very small debt of gratitude at a minimum. Not every DNSbl is right for every mail server. Using the presence of an IP on a DNSbl may not be adequate reason to reject an SMTP transaction, but sometimes it is the right thing to do.

Trying to pin bad system administration on a DNSbl operator is as pathetic as the poor workman who always blames his tools.

Use spam assassin with more that one RBL

[simm1701]

I prefer to use spam assassin and use a couple of RBLs with various weightings on each.

I keep the weightings quite low since I find most of the RBLs too agressive - added to the bayes and other checks however it is quite good at pushing spam into the right destination (and for the very spammy thats /dev/null)

True this means I actually have to receive and process the mail rather than just arbitarily ignoring connections, but my mail server doesn't really get that much traffic as its only personal use.

Re:Use spam assassin with more that one RBL

[Zocalo]

To extend on that I also have a META rule set up to handle DNSBLs in SpamAssassin that adds some additional points based on how many RBLs each IP address has hit. A server on one DNSBL may be a false positive or an over aggressive listing, but if it's on three or four then it's almost certainly spam and gets an extra couple of points towards being classed as spam. If it matches five or more, then it gets an instant +50 file in the mailbox "/dev/null" score.

Re:Use spam assassin with more that one RBL

[Anonymous Brave Guy]

Yes, combination techniques are definitely the way to go. Any one RBL (or content test for that matter) can be fooled or make a mistake. Fooling many such tests or accidentally hitting all of them is much less likely.

Looking at the filtered headers for a system I admin, which catches nearly all incoming spam and very rarely (perhaps once in six months) gets any false positives, the vast majority of the real spam is picked up by several RBLs, and then fails several of the content tests as well.

There is simply no need to rely on any single point of failure in spam control, and given the notorious unreliability of several major RBLs, it would be insane to do so.

Re:Use spam assassin with more that one RBL

[SuiteSisterMary]

That's elegant. Can you share?

Re:Use spam assassin with more that one RBL

[Zocalo]

From memory (I've not double checked that the syntax is valid either) the basic structure of the rule is as follows:

# Assign a score of 1.0 to a "shadow" of each DNSBL rule the message hit
# (not included in the total message spam score):
meta __AMB_DNSBL1_HIT ( DNSBL_RULE_NAME1 > 0 )
meta __AMB_DNSBL2_HIT ( DNSBL_RULE_NAME2 > 0 )
...
score __AMB_DNSBL1_HIT 1.0
score __AMB_DNSBL2_HIT 1.0
...

# Count the number of hits on the "shadow" rules:
meta __AMB_DNSBL_TOTAL ( __AMB_DNSBL1_HIT + __AMB_DNSBL2_HIT + ... )

# Now bitch slap the message score accordingly:
meta AMB_DNSBL_MULTI2 ( __AMB_DNSBL_TOTAL =~ 2)
meta AMB_DNSBL_MULTI3 ( __AMB_DNSBL_TOTAL =~ 3)
meta AMB_DNSBL_MULTI4 ( __AMB_DNSBL_TOTAL > 4)
score AMB_DNSBL_MULTI2 2.0
score AMB_DNSBL_MULTI3 5.0
score AMB_DNSBL_MULTI4 50.0

You'll need to replace the "DNSBL_RULE_NAME?" entries with the actual names of each DNSBL rule that you are doing, including the system defaults, or just those that you trust enough to use in this manner if you prefer. As an additional twist I have my own local DNSBL list which counts for three regular hits via the following META rule:

meta __AMB_MYDNSBL_HIT ( AMB_DNSBL > 0 )
score __AMB_MYDNSBL_HIT 3.0

Note that newer versions of SpamAssassin may make this easier - I wrote this sometime ago and haven't looked at the documentation on rule creation to see what's new for quite a while.

Re:Use spam assassin with more that one RBL

[SuiteSisterMary]

Thanks muchly!

Freedom2Surf

[Phil John]

They're currently allegedly trying to extort money from a UK ISP Freedom2Surf (sadly now part of the Pipex group).

By default SORBS apparently block all dynamic IP's. For some strange reason they've deemed that 8192 IP's that are actually in the F2S static range are dynamic because the reverse DNS includes the IP address.

I've heard that they want $50 per IP to unblock them. They wont even talk to users who have static IP address in that range to get the block lifted.

Re:Freedom2Surf

[Anonymous Coward]

Read the SORBS Dynamic IP removal information carefully - You might notice that they ask you to conform to an RFC that the founder of SORBS wrote himself. Suss, or what?

Re:Freedom2Surf

[Anonymous Coward]

"I've heard that they want $50 per IP to unblock them. They wont even talk to users who have static IP address in that range to get the block lifted."

I'm afraid thats a lie. My company use(d) Freedom2Surf static IP addresses and we were blocked by SORBS. However if you visit the website and follow the criteria they ask: correct reverse DNS, TTL, MX records, blah, blah, blah....

A quick automiatic assessment later you are unblocked...total cost: the amount of time for a sysadmin to do his job properly.

I was a bit pissed with SORBS at first by they do provide a reasonable, if you can match the criteria, process to get yourself unblocked.

Throwing about sensationalist lies helps nobody.

Organic_Info (can not sign in right now).

Re:Freedom2Surf

[ahodgson]

Why would they? I don't even need SORBS to tell me that reverse addresses with dotted quads in them are block-on-sight.

Re:Freedom2Surf

[Anonymous Coward]

Don't talk shit, they don't charge for removal of dynamic addresses.

Answered by editor

[dtfinch]

"from the blacklists-in-general-are-like-this dept."
That about sums it up.

SORBS should be avoided at all costs

[Anonymous Coward]

Several reasons why:
Large netblocks will be repeatedly put onto one of their lists if they dont comply with the founder/main admin's idea of how reverse dns should be configured. They will list IP blocks that dont conform to an RFC that funnily enough, he wrote.

Getting in contact with them in any reasonable timeframe is damn near impossible in any timely manner.
Primary/Secondary SMTP servers of ISP's will often by listed as part of their blanket block approach.

They continually block whole IP ranges that are statically assigned, often automatically with seemingly no human oversight. There can be found many complaints on assorted web forums across the net, especially australian, full of people trying to figure out why they were listed on one of the sorbs lists, and how to be removed.

Almost all of the issues i have run into with SORBS dont seem to have anything to do with eliminating spam, more to do with pushing the founders RFC for reverse lookups. Comply, and you are free from hassle forever. Fail to comply, and face loosing SMTP access to any providers using SORBS for anythere from a day to over a week.

Re:SORBS should be avoided at all costs

[Pig Hogger]

Large netblocks will be repeatedly put onto one of their lists if they dont comply with the founder/main admin's idea of how reverse dns should be configured. They will list IP blocks that dont conform to an RFC that funnily enough, he wrote.

If it's in an RFC, it's the law.

Re:SORBS should be avoided at all costs

[sparks]

This is categorically not true. An RFC is a request for comments. A suggestion. That's all. No one is required to comply with anything in an RFC.

Re:SORBS should be avoided at all costs

[sparks]

It's not even an RFC. It's a badly written and expired draft.

Linked here

There is absolutely no chance of this becoming an RFC. It's utterly facile.

Re:SORBS should be avoided at all costs

[KillerBob]

Is that so?

An RFC is a Request For Comments. It's a suggestion that may or may not become standard practice. It's in no way "law". It's up to software writers and administrators whether or not to implement them. Now, you have some choices... my own sendmail server ignores connections from hosts that don't have full compliance with RFC 821, for example. That's basic greylisting. But his suggested RFC has not passed into canon by any stretch.

Re:SORBS should be avoided at all costs

[Anonymous Coward]

You're driveling man!

SORBS will add netblocks that look dynamic, they will not add networks that look static. 1.2.3.4.user.domain.com looks dynamic when surrounded by similar hostnames (especially when there is no matching A record as the RFCs indicate you should have), as does 3.4.5.6.dhcp.insightbb.com and 2.3.4.5.in-addr.btinternet.com.

On the other hand 1.2.3.4.user.sta.domain.com, and 2.3.4.5.biz.rr.com does look like it's a static user pool, as does mail.domain.com and badwolf.domain.com...

Its not rocket science, and even the proposed (and expired) RFC does state "a suggested naming scheme for generic rDNS records" ... doesn't say, you must do this or else...

Re:SORBS should be avoided at all costs

[Achromatic1978]

Agreed. It's horrible. How do you specify that an endpoint IP is connected by T1/E1, etc - what about multiple homing? What relevance does this have to anything? If it's an accessible endpoint, I don't care if it bounces off satellite or microwave. Why the need to differentiate ADSL and SDSL. All this does is create an admin nightmare. Upgrade a customer from one service to another, change their naming structure. Bleh.

SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Coward]

I have a fixed IP address provided by my ISP. I run my own servers and have done for nearly 10 years. My servers are not now, and have never been Open Relay. I have run every possible test to make sure that is the case. SORBS, in their infinite wisdom, deem my address to be dynamic because it is part of a permanently leased dynamic range, so they block me, and therefore I cannot send email to anyone using two of the major ISP's in Australia. I have emailed sorbs and asked them to check my server. No response. I have spoken to the Telecommunications Industry Ombudsman in Australia, who tell me they can't do anything, that I should talk to "The Australian Communications and Media Authority", but if you are to check the SORBS site it specifically mentions that "The Australian Communications and Media Authority" have no influence over them at all. I have threatened SORBS with legal action. No response. Basically, they don't care less that I can't send email to the majority of Australia's internet users, because I won't donate money to them.

If you visit their site their tag line says "Fighting spam by finding and listing Exploitable Servers." This really should read "Exploiting small businesses through a cash for delisting scam".

Oh, and I forgot to mention, I've been told that the two major Australian ISP's who use SORBS just happen to form part of the "group of companies as a private venture" that make up SORBS. Interesting huh?

Use Surgemail

[Anonymous Coward]

We have used Surgemail and are extremely happy with the performance and with the spam/RFC compliance filtering.
check out http://www.surgemail.com/ it is platform independant. Works on Windows, Mac, *Nixes

See what works best

[Anonymous Coward]

Multi-RBL check

Type in a few of your favourite IP addresses. See which lists have fewest missess.

My most recent spamcop report.

[Anonymous Coward]

Using XXXX#XXXX@XXXXX.spamcop.net for statistical tracking.
Yum, this spam is fresh!
Message is 0 hours old
85.100.228.125 not listed in dnsbl.njabl.org
85.100.228.125 not listed in dnsbl.njabl.org
85.100.228.125 not listed in cbl.abuseat.org
85.100.228.125 listed in dnsbl.sorbs.net ( 127.0.0.10 )
85.100.228.125 not listed in relays.ordb.org.
85.100.228.125 not listed in accredit.habeas.com
85.100.228.125 not listed in plus.bondedsender.org
85.100.228.125 not listed in iadb.isipp.com
Possible open relay: 216.81.179.210
Yum, this spam is fresh!
Message is 0 hours old
216.81.179.210 not listed in relays.ordb.org.

I can't resist

[dethro]

Either you are for us or for the terrorists.

In my experience RBLs do their job fine. They are an easy way to stop spam and because of that a lot of people use them. Because of this "ease of use" people get mad when a RBL tags an innocent IP addy.

You have to realize this is a war. Much more than 50 percent of email is spam - we have to take drastic measures to provide a basic service - email. If you don't like the way the RBLs operate - use other methods to stop spam. There are plenty of other ways - they just require more attention on your part. Deal with it.

Re:I can't resist

[cshotton]

You have to realize this is a war. Much more than 50 percent of email is spam - we have to take drastic measures to provide a basic service - email.

That is because e-mail is an inherently broken set of protocols that were designed in the 70's as a hack to implement a store and forward message system on the old ARPAnet. If the e-mail industry spent the same amount of effort on engineering a next generation set of e-mail protocols and authentication methods that they spend on hacks like black hole lists, white lists, spam filters, etc., we'd have solved this problem long ago.

The problem is that the e-mail software business is much like the pharmaceutical industry. There's no long-term money in providing a cure. The money is made off of hacks that address symptoms, regardless of their ineffectiveness. The tragedy is that with a few well-considered extensions to the current SMTP standard, integrated public key technology could completely eliminate spam from anonymous or bogus senders.

The real question is why hasn't the IETF addressed this problem and issued standards that correct the flaws? Sure, there is an enormous installed base of broken SMTP servers, but a freely available backward compatible implementation of a new mail infrastructure solves that problem in a few years. So why don't we fix e-mail?

Re:I can't resist

[sauge]

There are a large crowd of email maintainers who believe anonymous email is important for political reasons.

I think your right on the mark though with the pharmacy analogy. We were able to implement SMTP to ESMTP quite easily so it shows people can definitely implement changes in protocols.

I also vote with people who think black hole lists are pretty much useless these days because they swallow up so many innocent people/organizations.

It would be nice to have an open source barracuda ( http://www.barracudanetworks.com/ns/?L=en ) like box - these things really work well.

Re:I can't resist

[cshotton]

There are a large crowd of email maintainers who believe anonymous email is important for political reasons.

Nothing about integrating public key crypto (or other signing technologies) into the e-mail infrastructure eliminates the ability to send anonymous e-mail. But it DOES make it a certainty that you can identify anonymous or fraudulent e-mail and reject it at the protocol level if you choose to do so. The lack of a pervasive authenticated e-mail infrastructure is the only reason spam exists. If the sender can be consistently identified (even if they are anonymous) or can be consistently identified as fraudulent or not verified, rejection of undesired message traffic becomes trivial.

Re:I can't resist

[cswiger2005]

There are several forms of PKI (ie, SSL X.509 certs, PGP/GnuPG/OpenPGP keypairs) which can be used with email: see RFC's 1991, 2440, 2487. There's also some good links off the IETF's S/MIME page here: http://www.imc.org/ietf-smime/

These have been around for several years, but the uptake of TLS/SSL aware SMTP servers has been slow, and the adoption of signed/secure email has also been very slow. The first problem lies mostly with mail server admins, because setting up even self-signed certs is time-consuming and complex unless you do it regularly, but is more likely to make progress than convincing the majority of users to deal with PGP's "web of trust", keysigning parties, and so forth.

Re:I can't resist

[nuzak]

> The tragedy is that with a few well-considered extensions to the current SMTP standard, integrated public key technology could completely eliminate spam from anonymous or bogus senders.

X.400 was tried. No one wants it. Rather than assert that a sprinkling of magic PKI fairy dust will fix everything, why don't you actually detail the problem?

And I've said it before: The problem is not a technical one. Any ISP that actually gives enough of a shit to roll out such drastic revamps of their entire email infrastructure could simply block outbound port 25 on consumer class IP's and cut their spam emanations by 99% or more. Yes, zombies could use the outbound mailhost, but assuming SMTP auth for outbound (again, assuming they gave a damn) that leaves a trail for throttling or outright shutting off accounts.

The real problem is that it's cheaper for ISP's to ignore their outbound spam. It needs to become expensive. It's why I simply can't cry too loudly when ISP's get blocked by expansive blacklists, though it's clear that it's not actually effective.

Re:I can't resist

[nuzak]

> There are a large crowd of email maintainers who believe anonymous email is important for political reasons.

Let them choose something else. The spammers broke email.

It's not like one can't just sign up on one of a zillion webmail accounts anyway.

Re:I can't resist

[Kalriath]

Do you really think the big anti-spam vendors (IronPort/Cisco, Symantec, Barracuda, etc) will allow any change to the protocol to make spam impossible? The irony is the big Barracuda banner ad on this very page.

SpamHaus, SPEWS and SpamCop

[christophe.vg]

For a few years now, I'm using three RBL's to filter the incoming mails on our mail server, which hosts a few small-sized customers and some personal domains. The RBL's I use are: SpamHaus, SPEWS and SpamCop. We have set them up in sequence, so that a mail caught by one is not passed to the following anymore.

Looking at two days ...

01/01/07
total mails processed : 1432
considered non-spam : 719 (50.21%)
total number of blocks : 713 (49.79%)
spamhaus : 630 (88.36%)
spews : 2 ( 0.28%)
spamcop : 81 (11.36%)

01/01/06
total mails processed : 381
considered non-spam : 155 (40.68%)
total number of blocks : 226 (59.32%)
spamhaus : 191 (84.51%)
spews : 31 (13.72%)
spamcop : 4 ( 1.77%)

... it shows the trend I've seen over this time: SpamHaus does a great job for me and we haven't received any complaints from the customers concerning people not able to contact them.

Given these (poor-man's statistics) it seems that SPEWS is of little use to us. SpamHaus catches most of the problems. Maybe even if we switched SPEWS' and SpamCop's order, we might see that the latter would be able to catch those mails now caught by the former. It's surely something we're going to try.

On the other hand, it might very well be that SPEWS would catch also all SPAM caught by SpamHaus. Reversing the current order might be a nice test before we come to any real conclusions on which RBL to drop ;-)

The (current) bottom line: For us, SPEWS isn't causing any problems, but also doesn't help us that much. SpamHaus seems to be a great RBL source and SpamCop seems to be a nice addition.

But it doesn't stop all SPAM.

Re:SpamHaus, SPEWS and SpamCop

[Anonymous Coward]

Might be an idea to drop SPEWS. Hasn't been updated since August, so it may be dead.

Re:SpamHaus, SPEWS and SpamCop

[oldosadmin]

If you're using SpamCop, you will get hit with some false positives. SpamCop's list is agressive, and lots of innnocent servers get listed in their rbl. Especially if you ever want to recieve emails from people using ESPs (IntelliContact, Vertical Response, Bronto), then don't use SpamCop.

(FYI: In the interest of full disclosure, I work for IntelliContact)

Re:SpamHaus, SPEWS and SpamCop

[onShore_Jake]

I notice that you have (what you call poor-man's) statistics on the number of blocked spams. I have been searching for a way to measure the effectiveness of SpamHaus. Can you please let me know how you arrived at the stats for spamhaus? I'm using OS X server 10.4.8.

I would suggest staying away from it

[arivanov]

Sorbs blacklists nearly all ISP relays which force their customers to send through them or do transparent SMTP proxying. On the positive side this means that you are not going to get those 1-2 per day annoying Spanish or Dutch lotto scams from orange/freeserve webmail. On the negative side this means that you are not going to get mails from small law abiding businesses like recruitment agencies and such. They also blacklist nearly all lesser webmails.

I tried it for 2 weeks around the time when SpamHaus future was in doubt in October and found it to have an unacceptable level of false positives.

I would suggest using all server level antispam possible - greylisting, autoblacklisting on spamtrap and top it up with SpamHaus. That leaves the annoying crap from l'Orange, but gives close to 0% false positives.

SORBS?

[sigmoid_balance]

Orange is not just an ISP. It's a multinational mobile telecom company. http://en.wikipedia.org/wiki/Orange_SA. As far as I know, after they were bought by France Telecom, they moved many their servers to a unique class B adress space. Maybe that address you found is from the old ones, which is not used anymore for mail, so unblocking it doesn't interest them.

On the other hand, getting a blacklist like this, doesn't seem to solve your problem: getting less SPAM. Do you think spammers don't have enough money to get themselves out of blacklists? Do you think that every individual legit(not SPAM) business or server checks all, of the many, blacklists to see if he's on one of them? And if they do, how many will pay the fee to get themselves of that list?

sbl-xbl

[Halo1]

sbl contains the spamhauses, xbl trojaned boxes/open proxies etc (you can of course also only use one of them). See http://www.spamhaus.org/xbl/index.lasso

Some other zones

[Anonymous Coward]

http://openrbl.org/client/t/zones.htm

I HATE sorbs!

[therealking]

I abosolutely HATE sorbs. We have roadrunner buisness class at work with a static IP. SORBS blocks our mail because according to thier "superior" knowledge our IP is dynamic. When I tried to get us delisted, I got an automated response that said basically This is an automated response, no human has read your request but we've denied your request to be delisted.

If I ever meet the guy who runs sorbs I believe I will punch him in the mouth.

Re:I HATE sorbs!

[Anonymous Coward]

>>If I ever meet the guy who runs sorbs I believe I will punch him in the mouth.

This already happened in NZ several years ago. Folklore has it that Alan Brown, who ran ORBS - a predecessor to SORBS, upset a sysadmin/ISP operator so much that they drove a few hundred kilometres to punch him. After ORBS shut down he subsequently got involved in SORBS and we can assume therefore that a lot of the draconian ORBS policies were picked up by SORBS, ergo the direct progenitor of this nonsense has already been punched in the mouth. That's not to say it shouldn't happen again :)

ref: http://www.google.com/search?q=alan+brown+sorbs there's plenty to find out about him

Unfortunately, xtra (one of the ISP's affected by ORBS) did not learn from this episode and now uses SORBS.

Re:I HATE sorbs!

[Dark_Gravity]

We have roadrunner buisness class at work with a static IP.

That is your first problem. My opinion of your provider aside, if you know what you are doing and how to talk to them (RR.com), you can actually do okay on biz.rr.com. The first thing you need to do is get rid of any DNS that reverses to anything that contains the string biz.rr.com, because email from there is never a good thing. My postmaster friends that use biz.rr.com to provide their IP transport all know that, and now you do, too. Quit blaming DNSbls for your inexperience as an email administrator.

sorbs is one the best blacklists out there

[cyberfoxz]

I work at the abuse dept. of a large dutch ISP and we rely heavily on sorbs. When I started working there one of my collegues convinced us that there is no way you could be able to contact sorbs and I thought that to be true. We found out however that it is really not that hard to get in touch with them and if you follow their guidlines, you never have to pay for delisting. The paying part is mainly to scare of spammers delisting adresses they do not own. They use a smal set of totaly acceptable rules to delist adresses from their DUL list (if u use a mailserver on a dynamic adres, go get a static one. If you can't, you should be using your ISP's mailserver). Their rules:
1. Only the owner of the adress space may contact them, as listed in one of the five RIR databases (RIPE, ARIN etc). We always use abuse@isp.com, because this is a known adress in RIPE.
2. The IP adress must be known as static and have a PTR-record stating it is static (mail.domain.com is acceptable).
3. It must have a correct A-record.
4. The TTL in of the A-record must be 86400 sec.
If you contact them in the way they wish to be contacted (just read their website, it's not that hard), they will delist you in 24-48 hours. However, if you aren't the owner of the adress space or the simple rules are not followed, your request wil be ignored. Everyone who thinks they can't get through to sorbs just isn't reading their guidelines, it's that simple.

Re:sorbs is one the best blacklists out there

[TheLink]

One of the best? Really? So what's their false positive and false negative rate?

So far in my experience RBLs have an unacceptably high false positive rate because of the way most of them work - they go by IP _ranges_.

My email provider doesn't block spam for me, they just give it a spam ranking. I then run my email through a bayes filter, if the ISP's ranking is high enough for my comfort or the bayes thingy thinks it's spam, then it's spam.

So far I've noticed only a few false positives (I scan very quickly through spam once in a long while - sorting by subjectline helps ;) ). And even so they weren't really false positives - they were either spamlike emails from friends/relatives (who I whitelist), or one of those chain emails.

I once was on the verge of blacklisting one of my relatives who kept sending junk.

Since you are an ISP, why don't you as an ISP regularly set up a bunch of decoy email accounts and start signing them up for spam? You know the usual methods. Even better if you can get few people to donate their longtime spamridden email address and they can get everyone else to no longer send emails to them. Then any email that hits multiple accounts is most likely to be junk.

I'm sure gmail does some statistical stuff to filter out spam. I'm sure they can figure out which email accounts are "related" and which aren't. If lots of unrelated/unlinked accounts start getting very similar email that aren't from whitelists (mailing lists etc), then it's almost certainly spam.

It's easier for an ISP or large email provider to do such things than an individual user.

Re:sorbs is one the best blacklists out there

[Anonymous Coward]

Yeah, 'known as static'. IE, conform to the IETF draft they wrote about how other people's reverse DNS should look. And there's _nooo_ reason you'd ever want short TTLs on your reverse DNS, because people don't ever move their mail servers..

Re:sorbs is one the best blacklists out there

[Thorizdin]

Sorry, but this is incorrect. SORBS does _not_ make execptions for people who follow the rules, at least not in the 8 tickets that we have had to open with them. They can be contacted via their web site ticketing system, but communication is slow, arrogant, ignorant, and inconsistent. We were able to get delisted once without paying their blackmail, but the next time we were listed they refused to even provide headers so we could locate the offender. Perhaps you were fortunant enough to only have to deal with them once, but they are far from reasonable.

Re:sorbs is one the best blacklists out there

[hlygrail]

All I can say is, stay out of the "coffehouses" there for a couple days before posting on /.

SORBS == ass.

As someone who's run my own mail services on a dynamic address for the last 7 years (for reference, the actual IP has changed only 3 times, the most recent when we physically moved), I can assure you that SORBS has the highest false-positive rate of any of the others I've plugged in and tested. The only ones I still use are SpamHaus and SpamCop. Everything else gets killed off by intelligent scoring from SpamAssassin and my own filter rules. And just because I don't have the ability to get a reasonably-priced static address that doesn't live within someone else's IP range is by NO means any indication that my mail server has any problems. As has been pointed out earlier, SORBS model appears be more about blocking entire IP ranges, then make money unblocking them.

DNS block lists are no longer as effective as anti-spam tool as they once were. I get better results so far from greylisting and using a spamtrap. Oh, and tarpitting is always good. :)

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Pig Hogger]

so they block me, and therefore I cannot send email to anyone using two of the major ISP's in Australia. I have emailed sorbs and asked them to check my server.

You're shooting at the wrong duck. You're not being blocked by SORBS, but by the "two major ISPs in Australia". Your beef is with them, not SORBS.

Maybe a change of tactics is in order.

[kunwon1]

ORDB just shut its doors. From their closing announcement: (emphasis mine)

We regret to inform you that ORDB.org, at the ripe age of five and a half, is shutting down. It's been a case of a long goodbye as very little work has gone into maintaining ORDB for a while.

Our volunteer staff has been pre-occupied with other aspects of their lives. In addition, the general consensus within the team is that open relay RBLs are no longer the most effective way of preventing spam from entering your network as spammers have changed tactics in recent years, as have the anti-spam community.

We encourage system owners to remove ORDB checks from their mailers immediately and start investigating alternative methods of spam filtering. We recommend a combination involving greylisting and content-based analysis (such as the dspam project, bmf or Spam Assassin).

I use SPEWS

[Anonymous Coward]

and if you don't like that, you can kiss my ass.

There are no worse than SORBS

[Anonymous Coward]

There fussy, blacklist at will... my old hosting provider was trying to clear it's name with them, completely impossible despite the net-block being registered to them, then they mentioned lawyers and sorbs refused to do anything ever again if there were now lawyers involved...

So, yes SORBS is the worst.. it stops spam in the same kinda way that unpluging your modem stops spam.

SpamHaus

[Wdomburg]

SpamHaus is the only blacklist that I trust to do straight blocking on. We've been using them for years and have gotten a grand total of two complaints about blocked mail; in both cases the sender was on the XBL because their machine was compomised. Considering our active userbase is in the hundreds of thousands, I'd say that isn't bad at all. :)

We actively discourage people from using SORBS. Even if they were more accurate, their removal policy is extortion.

Any of the other blacklists out there I would recommend only as part of a scoring algorithm. Most are fairly cavalier about blocking entire netblocks even if the problem is isolated, most have no automatic aging of entries, many have poor delisting policies or are slow to respond and the false positive rates tend to vary from ok to abysmal (SpamCop, for example, doesn't seem to know the difference between a bounce message and a piece of spam... though to their credit they are fairly good about removals and provide a feedback loop so you at least know when they've tagged a message as spam).

Re:SpamHaus

[dodobh]

We use the SORBS dynamic block list in addition to the sbl-xbl. We have about two orders of magnitude more users than you do.

Blacklists are so 2004

[target562]

With the advent of the spam bot networks, blacklists aren't as useful for spam fighting as they used to be. Greylisting + content analysis is currently the way to go; though Spamhaus still does a decent job, but not Spamcop due to their "unsolicited bounces" thing...

Re:Blacklists are so 2004

[Anonymous Coward]

Content analysis is expensive though, and doesn't immediately reject the connection like IP address based blocking can do. And blacklists can still be used for botnets to an extent.

But pretty much EVERY ISP is spam-friendly

[Anonymous Brave Guy]

The problem with this argument is, as usual, collateral damage. While there may be a spammer using Wanadoo somewhere, there are also many legitimate users who will be caught in the blast radius.

Before anyone replies with the usual holier-than-thou "Well they should change their ISP then", please consider that this is not trivial for a lot of people. Moreover -- and here's the real kicker -- pretty much every ISP is "spam-friendly" because, as the recent spam wave has demonstrated all too clearly, pretty much every ISP has lots of compromised machines running on it, and those machines can be abused without the informed consent of either their owner or the ISP.

Just say "no"

[LoadWB]

I support the use of DNSRBLs (not by use alone, but it should augment a content-filtering system,) with the exception of SORBS. I have found it to be far too aggressive, more so than SPEWS. In fact, an ISP with which I partner wound up on SORBS, and during the removal process they discovered that a number of the recommended donation recipients will not accept the donations because of the myriad complaints over the process.

Ah, well.

No one takes them seriously

[Spazmania]

At this point, very few people take SORBS seriously. They're inaccurately over-aggressive. If you use it for more than your personal email, you're begging for a lot of user complaints.

My own fun story is that they went on to my web site and subscribed their spamtraps to my opt-in email list. I didn't double-confirm, so I guess its my fault that they scammed me. SORBS then used the emails emitted from that single IP address to justify blocking 8,192 of my ISP's email addresses.

Every other RBL maintainer has found my list to be clean. The only non-SORBS problem I've had with an RBL was with Spamcop. That was immediately resolved when the only folks who responded to further inquiry apologized for reporting the list mail by mistake.

Re:No one takes them seriously

[iangoldby]

If those spam-trap addresses became public knowledge, one could have a lot of 'fun' with them.

If an ISP uses SORBS to block incoming mail, it would be easy to get that ISP onto its own block-list. All it takes is three emails...

Re:No one takes them seriously

[Anonymous Coward]

As one who knows, you're a liar.

Re:No one takes them seriously

[Spazmania]

Of course. I must be a liar because the alternative is that SORBS is comprised of extortionist vigilante scumbags and that just can't be.

Re:No one takes them seriously

[Anonymous Coward]

By "I didn't double confirm", do you really mean "I got an email address, and I assumed only the owner could know it so I started the spam hose flowing"?

If all someone needs to subscribe to your mail is an email address (which you have no way to tie to that person in a single step), you're asking for trouble.

Nobody is obligated to read your email. Maybe they want to block you because your last name is x letters long. They're free to do that, and anyone who shares their opinions is free to follow their recommendation to block your mail. They can also demand that you run around naked covered in bacon grease to be delisted. You can do it, or tell them to piss off.

Re:No one takes them seriously

[Xochil]

Or neither.

It seems to be that the biggest problem is you are not competently managing your mail list. There is zero excuse for not using confirmed opt-in. Those who do not, deserve to be blacklisted.

--Mike

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Brave Guy]

That's a very shortsighted view. We had defamation laws for a reason, and that reason is that while sticks and stones will break your bones, words most certainly can hurt you as well. I don't see why the actions of SORBS -- which sound like a pretty obvious protection racket looking at the comments in this thread -- wouldn't lead to a very fast court case with a very negative result for the operators of SORBS.

URIBLs are great

[oldosadmin]

I'd highly reccomend using some aggressive URIBL filtering -- that way, if someone gets blocked, you can be certain /they/ are the person you wanted to block.

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Coward]

Sorry, but the defamation would be against your ISP, not yourself since it is their IP block that SORBS is blocking. And if you read SORBS website for what they say about their list, I don't think you are going to find that they have defamed you in any way. The major ISPs in Australia have chosen to use that list to lessen spam. Talk to them about not using SORBS, or get an IP for yourself from another ISP that isn't likely to get themselves listed on SORBS.

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[SuiteSisterMary]

I'd say a little of column a, a little of column b.

I mean, sure, most of the blacklists say 'Hey, don't use this to reject mail completely!' They generally, however, go on to say '*wink wink* if you really want to, though, here's a config file snippet to drop into your mail config. *wink wink*.

Wrong Layer

[jofny]

The idea of identifying/tracking/blocking content/activity/people at the IP level was always a hack at best and has long since become a complete haphazard solution. Black Lists are a bad idea that's gone on to far. Instead of putting all of that energy into building, maintaining, and implementing those lists on networks, spend some time fixing it at an app protocol or content (auth) level. Yeah, initially a lot of legit mail won't get through - but that's true of black lists as well. I know there are a lot of reasons people still do this at an IP level, but why engage in a never ending battle using methods that you -know ahead of time- will -never- solve the problem?

Re:Wrong Layer

[dodobh]

Got an example solution?

Re:Wrong Layer

[jofny]

Of course not, otherwise I wouldn't be talking about it publicly - I'd be busy patenting it or something else equally evil :) But, seriously, I wasn't suggesting that I had a solution only that IP-based solutions are known to ultimately be futile. You have no knowledge of the data source at all. This is one of the larger problems with security on the internet in general and isn't limited to spam - authenticated authorization. I'm not suggesting that, with email, you need to care who each individual is. I'm only suggesting that until there are globally useable objects (as IP's are) that can tokenize an individual's credentials (not their ID), the spam fight will always be one that's lost, because that's the real data you're interested in shaping/controling/filtering/authorizing - not the IP and not the message content. So that's why I hate to see so many people dedicating cycles to IP filtering. If you really want to help -fix the problem- (not just hide it to varying degrees of ineffectiveness), spend your time working on the credentials token problem (IMHO).

Re:Wrong Layer

[dodobh]

Who issues the credentials? A government? A third party like Verisign, Microsoft, or SCO?
What happens in case the issuer turns hostile?

What happens if I do not trust your credential issuer? IP based solutions are the only ones that scale up to large workloads at the moment. (Hint: at the workloads my systems deal with, programmer time is cheaper than adding extra hardware).

Re:Wrong Layer

[jofny]

No one issues them. Everyone issues them. It doesn't matter at this point because we don't even have a universally recognized container/object for them. If we did, it still wouldn't (hypothetically) matter in some potential scenarios. For example, you could allow end-user and ISP and ____ level tagging of the credentialing source in addition to the crdentials themselves. If you consistently allow spammers to be authenticated, you'll end up with a low trust level and people will be less likely to trust your users. (Obviously, this would probably also be done at a user level as well, but I'm not sure that piece would be as valuable.) Different credentialing services could figure out their own methods for authentication.
This sounds a lot like IP lists, except it splits the trust away from an object tied to location and machine it ties it more closely with who is sending. And it takes it out of the -transport- protocols altogether.
And this conversation, with all of the problems with the scenario I've just described, is still (to me) far more productive than one focusing on "should we use THIS service that won't ever fix the problem or THAT service that won't ever fix the problem".

Re:Wrong Layer

[dodobh]

How do you deal with identity theft (including zombies)? This has been asked before in the context of micro-payments and hash-cash and other such ideas as well.

There is a difference between "I signed it" and "The computer signed it". One can't be hijacked easily, the other can.

Plus, you have to send the identifier during the SMTP part of the transaction, not in the headers (otherwise, the bandwidth transfer rise itself can kill smaller sites).

Re:Wrong Layer

[jofny]

Good question. If we don't limit ourselves to money and the poorest 90% of the world (said in jest, but in reality I'm guessing those 90% dont have access or machines...) then I'd honestly say RFID (or equiv). Not something that contains your identity per se, but at least a remote "key" to your online identity tokens. If you're not close by, things aren't done in your name (unless theyve previously been signed by the same means and are scheduled). Biometrics would work as well, but I like the data of authorization not being stored on the machine...prefer the constant reverification with RFID. I can't (and not sure anyone can) get away from the reality that if it's a system self-contained within the computer/network, someone can shove something between you and the auth mech. Even so, then we get into broader computer security issues that will really take a complete reworking of how computers are internetworked to solve. Namely the fact that we can't semantically descibe our intent in security policy...so any walls/mitigations we put up tend to be static. Without all data objects having self-contained security attributes which require legitimate participating systems for access and a real semantic security policy taking advantage of those attributes, pretty much any data on the network can be intercepted, altered, or denied somehow.

Re:Wrong Layer

[dodobh]

Without all data objects having self-contained security attributes which require legitimate participating systems for access and a real semantic security policy taking advantage of those attributes, pretty much any data on the network can be intercepted, altered, or denied somehow.

And you can never trust security attributes coming from the client. In essence, what it boils down to is that you build a trusted system, and only allow trusted users access (like a telephone network, where the only groups till recently who could do things like setting caller ID were telcos).

What we need is resilient systems, which can be attacked, but not collapse under load.

Re:Wrong Layer

[jofny]

And you can never trust security attributes coming from the client.

Yeah, hence the RFID/external verification comments. Any conversation that has the word "trust" and "network" in it will ultimately get down to that. Anything self-contained can be subverted. The two (external identify key and semantic policy descriptions inherent to data objects) go hand in hand.

What we need is resilient systems, which can be attacked, but not collapse under load.

I don't know. I'd rather have my data fail closed than be stolen or otherwise abused. A resilient mail system (to bring it back to SPAM) would just be able to send/receive that much more spam.

Re:Wrong Layer

[dodobh]

I don't know. I'd rather have my data fail closed than be stolen or otherwise abused. A resilient mail system (to bring it back to SPAM) would just be able to send/receive that much more spam.

A resilient system would not collapse under the load of spam.

Re:Wrong Layer

[jofny]

A resilient system in this context just means it can deliver more spam. The issue isn't that spam is causing mail systems to collapse, it's that people are collapsing - and they're generally collapsing before the IT systems do. Resilient systems don't help with that.

Re:Wrong Layer

[dodobh]

I wish. My systems tend to collapse more than I do, from the sheer volume of crap.

BTW, are you the same jofny as on Freenode? (If yes, lets discuss this in #security or #postfix after the 25th, when I get back to my home system).

Avoid SORBS at all costs

[Pigeon451]

My website has been in the SORBS blacklist on a few occasions (due to actions of others on the shared IP). It is incredibly difficult to remove it from the blacklist. There have been many negative discussions about SORBS on the internet, search for it.

My website has also been listed on spamcop, which IMHO is a very good spam filter. It will blacklist your site for x number of hours, then if no more complaints are received, it will automatically be delisted. A very good system.

See this wiki item: http://en.wikipedia.org/wiki/SORBS

"Some of the controversy arises from SORBS' policy of requiring a US$50 donation to the Joey McNicol Legal Defense Fund in order to get an IP de-listed from the spam database.[1] Because of this requirement, SORBS has often been compared to an extortion racket."

Re:Avoid SORBS at all costs

[policysup]

I hope Spam cop stays good now that it is owned by CISCO. Sherman

Re:Avoid SORBS at all costs

[Dark_Gravity]

I hope Spam cop stays good now that it is owned by CISCO. Sherman

You forgot the URL!

http://www.ironport.com/company/ironport_pr_2007-0 1-04.html

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[91degrees]

It would take a brave man to sue a blocking list. Or at least a man that has no desire ever to send an email ever again. If there's a single legal threat then there's a definite risk that every other blocking list in the world will block you.

SORBS

[policysup]

The comment below is from Matt at SORBS: "http://www.dnswl.org/ might be what you're looking for. I fully support this project, particularly for people wanting to use SORBS and are concerned about major ISPs getting listed for smart hosting the *occasional* spam. Regards, Mat" I would say do the same thing. What really should happen is that SORBS should use this list, instead of making eveyone else do it. Currently if you get listed, there is a good chance you will never get off with out "paying", and I don't know many companies that could start that practice. Sherman

Are these the type of people you want to use?

[Anonymous Coward]

SORBS is run by a juvenile, unprofessional staff with an astoundingly arrogant attitude (that also can't spell, as shown below). Below is a response I received from "Joey" at SORBS. I have a Small Business Account at Yahoo (paying $11/month on separate servers), and was unable to send email a friend and business associate because his ISP used SORBS. Happy ending? He had his business use a different ISP...one that didn't use SORBS.

SORBS' methods aren't granular enough to prevent false positives (in fact, they are willing to block 1,000s of mail accounts to block one spammer), and in doing so their practices block legitimate mail, they have no reasonable resolution systems (other than ones that seem like extorting normal users to pay to unlock actual spammer's dynamic IP ranges that we happen to share), and they have rude customer service.

Would you really consider using a service like this? Forwarded message below the >>>

Run away!
Craig

>>>>

> How do I get my email off of your list? I am not a spammer. Your
> database
is what flagged me incorrectly. How do I correct it? I'm not trying to complain, just trying to fix it.
>
> Thanks,
> XXXX
>
Your email is not listed in SORBS ,Your provider yahoo shares this same IP address that is listed in SORBS with 1000's of other users including non paying spammers .
You have not been flagged incorrectly or at all .

As I said you will need to complain to yahoo if you aren't happy with the fact that their decission to share the service you are paying them to provide with spammers id causing you problems.
--
Joey ( SORBS Volunteer )
Western Australia.

Blacklists are bad, mmmkay

[Shawn is an Asshole]

If you reject email based on a blacklist, that's putting an awful amount of trust in the maintainers of the lists. Rejecting email based on a blacklist is always a dumb idea.

Blacklists do have a use, however. Use them with something like SpamAssassin. Rather than reject mail based on the list, just add points to the score.

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Brave Guy]

How do you figure that out?!

If I'm in danger of successfully suing one company, do you think the other companies in the same industry are going to line up with signs saying "Sue us too!"?

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Pig Hogger]

We had defamation laws for a reason, and that reason is that while sticks and stones will break your bones, words most certainly can hurt you as well. I don't see why the actions of SORBS

There is nothing defamitory there. SORBS says that spam comes from such-and-such range, and they have samples to prove it.

Truth is proof against defamation.

My experience with SORBS

[atomic-penguin]

Somehow, we ended up listed on their dynamic/dial-up list. We were a medium sized business with a /27 subnet in the middle of a Class C amongst several other small businesses. We also had two /24's on two other networks.

To get de-listed you had to meet a couple requirements. You had to have an MX record as a hostname (pretty much the standard). You had to have a reverse DNS or PTR record for the address. I used their ticket logging system to send them a compelling argument, and the whole Class C was finally de-listed three weeks later.

dig -t mx ourdomain.com
ourdomain.com. 86400 IN MX 10 mail.ourdomain.com.

dig -x xxx.xxx.xxx.xxx
xxx.xxx.xxx.xxx.in-addr.arpa. 86400 IN PTR mail.ourdomain.com.

Even though we met their requirements for not being listed, somehow we and our network neighbors were listed. Another note, I believe they have a reverse priority queue. The more times you submit complaints to their ticket system, the longer it takes for you to be de-listed.

DO NOT USE BLARS :o)

[juanhf]

Whatever you do, DO NOT USE BLARS he runs a pretty mean black list, so bad that he his website probably got pulled or he was forced to pull it

if you happen to be the mail admin i would suggest checking out mxtoolbox.com

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[91degrees]

If I'm in danger of successfully suing one company, do you think the other companies in the same industry are going to line up with signs saying "Sue us too!"?

Honestly? - YES. Or at least I consider it enough of a risk. I genuinely rate their fanaticism that highly. Oh, Not all of them and those that do will probably add a weaselly disclaimer of the sort that computer nerds think provide legal protection, or create a separate list that doesn't include me, but I wouldn't take the risk.

Greylisting is so 2004

[Anonymous Coward]

Try Nolisting. It's nifty.
Nolisting + Greylisting + content analysis = less spam.

Re:Greylisting is so 2004

[Onymous Coward]

Wondering why you didn't post with your regular account. Anyway...

Setting primary MX to a non-MTA machine sounds very interesting. Tell me more. I'll read the web page more fully in a minute. Basically you configure your DNS to have your primary MX be a non-functioning MTA so that legitimate MTAs roll onto a working address?

I've heard that some spamware targets the last MX as well. Maybe it makes sense to make the primary and last MXs both bogus?

And there's the possibility that they target a random MX. So maybe set up a large number of MX records where the only working one is the second in line?

And port 25 on the non-functioning MTAs should probably return an RST rather than timeout so that the sending MTA can move on more quickly, right?

Re:Greylisting is so 2004

[Anonymous Coward]

Setting primary MX to a non-MTA machine sounds very interesting. Tell me more. I'll read the web page more fully in a minute. Basically you configure your DNS to have your primary MX be a non-functioning MTA so that legitimate MTAs roll onto a working address?
Won't work. I run my own server for a number of personal domains, and act as seconday mail server for some others I have a close relationship with. A lot of the spambots deliberately target secondary mail servers as an attempt to do an end-run around the spam filters. I currently deal with huge quantities of spam targeting the domains I act as secondary server for.

Re:Greylisting is so 2004

[Anonymous Coward]

You run Nolisting on the primary: it rejects delivery outright and some spambots give up.

You run Greylisting on the secondary: it temp-fails delivery and some spambots give up.

If I read the description of Nolisting correctly, Nolisting and Greylisting together should eliminate 76-95% of spam before it even arrives.

Like alcohol and night swimming, it's a winning combination!

Re:Greylisting is so 2004

[Onymous Coward]

Exactly. The other AC didn't seem to realize that some improvement is still improvement. "Won't work" is not the same thing as "won't help".

"A lot of the spambots deliberately target secondary mail servers..." A "lot" of spambots means not all of them, so some of the spambots will be thwarted by a non-functioning primary MTA. == benefit. But what about effect to legitimate MTAs? False positives are a serious concern.

The nolisting (not sure I like the name) website appears to have stats on spambots v. valid MTAs connecting to primaries v. secondaries, but it's hard to decipher. The best I can figure out is that there is a 3.5% gap in the "Primary only" category where valid MTAs might be falling through the cracks. A couple factors might mitigate or annihilate this percentage: DNSBL nonlisting isn't equivalent to being ham, and the testing methodology may have failed to capture later SMTP connections that would have put the sending MTA into the "Both MX" category.

Anyway, you'd expect reasonable MTAs to get this send-to-secondary aspect of the RFCs correct since primary failures just happen. I'll have to read up on the RFCs.

Oh, and here's something I just found:

Now, a neat trick is the script someone here (or in postfix land) sent to me,
which knows whether the primary is up, and alters an SA score on the
secondary based on this condition. If the primary is alive, and you send
mail to the secondary, an additional x points are tacked on. If the primary
is dead, they aren't tacked on.

Cheers and geronimo.

CBL - Composite Block List

[ShaunC]

I can highly recommend the Composite Block List (CBL), cbl.abuseat.org. They seem to have an extremely good handle on trojanned zombie/bot machines. I started using the CBL when the massive pump-and-dump stock spam runs started several months ago, and it's been very effective.

As an aside, if you're being flooded with the stock spams, implement a filter to silently drop mails with a message-ID containing "6c822ecf" ...

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Brightest Light]

I have threatened SORBS with legal action.

Well, there's your problem right there! Most people don't really like legal threats, and amongst the more fanatical anti-spammers, they're quite the source of amusment. I submit for your consideration the cart00ney.org blacklist, which is an RBL specifically for listing people that send legal threats to blacklist operators. I also suggest that you search Google Groups' archive of NANAE for 'Matthew Sullivan' and 'cart00ney', because I'm sure your threat got a good laugh out of everybody there. I'm sure that was your last resort after trying to do all the things a civil and reasonable person would and failing to see any results, but it was definitely not the wisest thing to do.

No such thing as a "better" blacklist...

[Kazoo the Clown]

Blacklists are like closing the barn doors after the horses have escaped, it's a fundamentally flawed concept. By the time a spam source ends up on a blacklist any spammer worth its salt has already moved on. Combined with the tendency for false positives, it's a cure that's worse than the disease. A "smart" spam filter like SpamBayes is better, but it's not perfect either, and you'll have to keep it in training-- not so easy if you're trying to filter for a whole shop and not just your own personal email. At least a local algorithmic filter allows you to correct false positives more quickly than does a blacklist-- with a blacklist the only quick solution to a false positive problem is to stop using it.

Re:No such thing as a "better" blacklist...

[Onymous Coward]

I'm often suspect of communication that adopts a tone of authority while making sweeping, generalized assertions, all the while light on details.

If there exist much worse blacklists, then by definition there must exist better.

Some of us actually use DNSBLs and have seen the benefit. For those who actually use DNSBLs to good effect and understand their worth, let me tell you the list I'm currently using:
    maps_rbl_domains = sbl.spamhaus.org list.dsbl.org

I had ORDB on there until they decided to throw in the towel. And just as well--not a lot of hits on their list. Open relays are no longer they problem they once were and spammers are now, it seems, using subverted machines.

We've established that not all blacklists are equal. My recommendation to avoid false positives is to be a very selective shopper. Understand the listing and delisting policies and make sure they're reasonable. My searching (some time back) netted me just the three: ORDB Relays, Spamhaus SBL, and DSBL Trusted Senders. I'm again in the market for another good one or two, and CBL is a candidate. But I'm having a hard time deciding on it without a perfectly clear understanding of how they perform their listing.

Sorry, but you are wrong, SORBS is untrustworthy.

[Dion]

Well, I have a number of servers on static IPs that SORBS think are dynamic.

I have tried telling the idiots that they are wrong, but to no avail.

It's really a problem that people trust such a bunch of retards, because it's hard for the administrators of the mail servers to know if important mail is being blocked, very hard for users to know and even more impossible for users to smack some sense into the the head of the fool who runs their mail server.

What I have done in stead of using the static and poorly administered black lists is to use a number of short term, spamtrap driven blacklists, sbl-xbl.spamhaus.org which is somewhat static, but seems to be well run along with greylisting.

With greylisting most spammers never try again and even if they do there is a good chance that they will fall into a spamtrap and be stopped by the RBL the next time around.

I used to use SORBS (that was before I figured out they were fucking around), ORDB (which ended up taking almost no hits) and a few other lists and with the new setup I have gone from getting 70 or more spams pr. day to less than one.

Ditch SORBS, they suck because they list much more than just dynamic addresses and refuse to fix their mistakes.

Thank you

[rootnl]

Thanx for all the advice.
In my current setup, my primary mail server is located in a data center where I have to pay for bandwidth, so using a blacklist does help reducing the traffic and server load as the mail does not get much further than the initial control. However this require a blacklist to be very accurate. I also have been playing with mx priority and fallback methods using a second mail server in another data center. This way, when a mail is bounced, the second server will get picked up and the mail is processed only by a spamfilter (spamassasin). The first server I use a IMAP server as my priority mailbox and the second as a POP server which I check once a while.

I guess as some have mentioned, ip based blacklisting is not so effective anymore, it can do more damage than good if not maintained properly. After all, the blacklist providers(if I may call them that) are not the ones blocking the email, their users are. Maybe they should encourage people to use their blacklist in a spamfilter with a scoring algorithm rather than a blocking method in a smtp server (give better examples).

Not sure if there is any such animal

[Al Lowe]

But I can tell you, I got so mad at my hosting service when they went to SORBS, and didn't tell me. I switched, even though I still had 8 months to go and couldn't get a refund! And I checked with the service I went to first, to make sure they weren't going to use any of that bull crap SORBS.

wah wah wah...

[Dion]

SORBS claim they list dynamic addresses, but they clearly don't and they don't care about fixing the problem.

Blacklists are (nearly) useless.

[Harik]

Breakdown of a single day at one of my servers:

91 Relay access denied
135 http://www.spamhaus.org/SBL/sbl.lasso?
2306 http://www.spamcop.net/bl.shtml?
4364 greylist expired 6007 Sender address rejected
41144 Helo command rejected
117479 Recipient address rejected

As you can see, the most common hit is trawling for valid names. Second most common hit is people claiming to be the domain they're sending to. we've got postfix set to say 'F off' to any machine that lies in HELO, fails to use a FQDN or a ton of other mistakes.

After that, we've got the 400 series errors of cannot lookup sender addresses, followed by greylisting expirations, and finally, the two RBLs actually used on this machine, and finally open relay probes.

What's not listed is the multiplicitive effect of HELO and greylisting blocking, and that's pretty hard to determine. Someone will have to honeypot that one to get some numbers, but a HELO block stops a host from sending ANY spam to you. How many mailadmins out there see their (decently populated) servers only get a single email when a spamrun is in progress? Exactly. Same with greylisting. Spammers consider any error a permenant fail (for that run) because it's more time-efficient to just go on to the next email then to keep a retry queue. Since they never try to send the same email again, they never get through the greylist (since it's based on host:sender:recipient) tuples.

On my personal server, I don't even use RBLs anymore, they are too prone to false-positives for the tiny amount of spam they do catch. And politically, while vengance and retribution seems like a cunning plan, in reality the only people who ever suffer are the collateral damage. Deep-pocket ISPs with 2-3 year downstream contracts and painful early termination clauses keep a lot of collateral damage from being able to vote with their wallet. Plus, thanks to ARIN's inability to move forward with IPv6 in a reasonable fashion, or give portable netblocks to people, moving is exceptionally painful for basically everyone except the largest players (who are not generally colatteral damage). The big losers here are the joejob victims who get blacklisted, small businesses who lose contracts due to having their email blocked, medium buisnesses and small ISPs who have to play whack-a-mole on customer servers trying to find the exploit-of-the-week that allows formmail/mail relay/postmaster bounce spam. The winners are big fat companies like MCI, since they get spammer buisness, and lock their non-spamming customers into contracts that don't let them move when their service is impaired. (Nobody considers being on a blacklist grounds for early termination, or even downtime. OBVIOUSLY you did something wrong to get on it.) And of course, dedicated mail-hosts who are the last resort when you're locked into listed netblocks.

Of the winners and losers, who do you see posting to NANAE? What sides do they take on the RBL issue? Isn't it interesting to follow the money?

SORBS doesn't block mail

[bill_mcgonigle]

If you have a problem with SORBS-RBL'ed mail being blocked, it's your configuration that's a problem not SORBS.

GMail is "blocked"? No, somebody once sent mail through GMail that was spam and SORBS reports it as such.

The same goes for Yahoo, all the major ISP's, and more.

So, if you chose to block all mail that has been tagged by SORBS you obviously don't understand what SORBS does or didn't think it through very well. I admit to doing the latter myself.

What I would like to see is a lovely set of SpamAssassin rules that knows about SORBS and knows about all the major ISP's and adjusts scores appropriately. I tried Googling for such a thing myself and didn't come up with any. Pointers appreciated.

Re:SORBS doesn't block mail

[Anonymous Coward]

> What I would like to see is a lovely set of SpamAssassin rules that
> knows about SORBS and knows about all the major ISP's and adjusts
> scores appropriately. I tried Googling for such a thing myself and
> didn't come up with any. Pointers appreciated.

Here's a pointer: dnswl.org may get included in one of the upcoming
SpamAssassin releases. Currently, there is a rule in the "Rule Sandbox"
http://svn.apache.org/viewvc/spamassassin/rules/tr unk/sandbox/felicity/70_dnswl.cf?view=markup

dnswl.org lists "good" mailservers at four trust levels (none, low, med,
hi). All levels can be used to eg bypass greylisting (because all listed
addresses are supposed to be real mailservers) and outright blocking caused
by RBLs, and all can be used in a scoring mechanism (eg -0.1, -1, -10,
-100 points in SpamAssassin).

Yes, there is a certain risk that a spam may slip through (especially in the
"none" and "low" categories), but in many cases a missed spam is a lower
risk than lost legitimate mails.

More information (including on how to get your own server listed) can
be found at http://www.dnswl.org/

Disclaimer: I'm involved with the project. Btw., we welcome support in
the form of well-maintained whitelist data and DNS mirrors :)

Is that you, Morris?

[Anonymous Coward]

Shouldn't you be flooding NANAE or ranting about the 'SPEWS KOOKS' or something?

Re: SORBS - Is There a Better Spam Blacklist?

[JoeSA]

There are hundreds of DNSbls to choose from http://moensted.dk/spam/?addr= I suggest tagging till you find which closest meet your needs, then whitelist those you want messages from, in case their ISP is having abuse issues that get noticed by the DNSbls you use. Plenty of spam seems to be comming from IP 64.233.182.185 Atleast one other DNSbl has IP 64.233.182.185 currently listed. http://moensted.dk/spam/?addr=64.233.182.185 Plenty of spam seems to be comming from IP 93.252.22.249 also a few other DNSbls have IP 93.252.22.249 currently listed. http://moensted.dk/spam/?addr=93.252.22.249

Re: SORBS - Is There a Better Spam Blacklist?

[rootnl]

Thanks for this info, it does shed some light into the why's. I assume you made a copy paste mistake with the second ip, should start with 193...The big question will always be whether Google were informed that one of their servers were abused, or they were just blatantly added to SORBS blacklist.

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[raju1kabir]

SORBS, in their infinite wisdom, deem my address to be dynamic because it is part of a permanently leased dynamic range, so they block me, and therefore I cannot send email to anyone using two of the major ISP's in Australia.

What halfass ISP are you using that doesn't provide its customers with an SMTP forwarder for just this very purpose?

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Coward]

What the heck has "open relay" got to do with it? The problem is that your space is listed as dynamic - this ISN'T a statement about your mail server or anything. Turning your mail server off does not affect a dyanmic IP listing, okay? Pay attention to the facts. RBLs are long past checking just open relays.

(Aside: I run a mail server. I don't care if you have run a perfect mail server, if you don't have a static IP address, I don't want email from you NO MATTER WHAT.)

There's no point in emailing SORBS to 'check your server' because it is nothing to do with your server. It's only your address we're talking about.

Right.

Secondly, it looks like you failed to talk to the one organisation that can actually help you. Your OWN ISP's helpdesk. See, like virtually all such blocklists, SORBS distrusts email from end users claiming that they have a static IP (as spammers are prone to making the same false claim.) The normal approach is to get your ISP's helpdesk to contact SORBS. This works a lot more reliably.

Re: SORBS - Is There a Better Spam Blacklist?

[Anonymous Coward]

From one who knows, Google are very aware of the issue and are not doing anything about it... Even SpamCop has things to say about Google and Gmail hosts.

spamhaus use their blacklist as a stick

[mattbee]

Not true any more, sadly. A /24 of Bytemark's network was put on spamhaus' main blacklist in August because we didn't respond to a phishing take-down notification within 12 hours, i.e. where one of our customers' servers had been compromised and was hosting a phishing site. I was told sharply that 12 hours was "more than enough time" to respond to such an abuse complaint - this was a complaint delivered at around 7pm which I responded to by noon the next day. And of course because spamhaus is widely trusted as a hand-edited list of career spammers, it caused hell for us for about a day. This seems to be a new and unadvertised policy - they are using their list as a blunt stick to fight network crime in general, and not just to warn you about spammers.

John Reid at spamhaus told me: When we see an exploited server on an unknown hosting company range, we fear that much off their network may be exploited as well. We err on the side of caution, especially when we see the site has been up for a longer-than-normal period

Make of that what you will! I think it's lazy policy-on-the-hoof that will make their list less trustworthy for mail filtering - the bottom line is that they blocked a host which was sending no email. Therefore none of their users would have seen any less spam as a result.

Re:spamhaus use their blacklist as a stick

[efalk]

I was told sharply that 12 hours was "more than enough time" to respond to such an abuse complaint

I agree. There was ongoing crime on your network. You should have responded immediately. Running the abuse desk at a sizeable ISP is not a 9-5 job.

In broadcast radio, the FCC has a regulation: the owner of a transmitter is legally required to maintain control of that transmitter. If something goes wrong (power fluctuations, frequency drift, someone shouting obscenities into the mic), you're required to rectify the situation immediately, not sometime the next day during business hours. If you can't get the transmitter back under control within a reasonably short time, you must shut it down.

I think this is a good policy and should apply to the internet. Once notified that there was an ongoing crime on your network, your obligation was to make it stop or pull the plug. If you can't get in touch with the owner of that server, then walk to the racks and yank a cable. If you can't be bothered to do that, then don't complain if someone else takes emergency action.

...Therefore none of their users would have seen any less spam as a result.

Perhaps, but fewer of them would have been ripped off by the phish.

Also, one of the kee aspects of fighting spam is doing it quickly. A spammer only needs their site to stay on line for a day or two to make spamming profitable. If phish and other spammer sites were taken down immediately, spamming would be much less of a problem.

Re:spamhaus use their blacklist as a stick

[91degrees]

I agree. There was ongoing crime on your network. You should have responded immediately. Running the abuse desk at a sizeable ISP is not a 9-5 job.

I agree with you there, but crime enforcement is not what Spamhaus is there for. If this was just a website, and the phishng mail was being sent from elsewhere, then the listing would have no effect, apart from applying extra pressure to deal with this more quickly.

I have no problem with pressuring network providers to deal with crime in general, but using a spam blocking list to do it is not the right way to do things. Unless I misunderstand, the list exists only to block spam. Doing anything else with it is an abuse of trust.

Re:spamhaus use their blacklist as a stick

[mattbee]

I agree. There was ongoing crime on your network. You should have responded immediately. Running the abuse desk at a sizeable ISP is not a 9-5 job.

In broadcast radio, the FCC has a regulation: the owner of a transmitter is legally required to maintain control of that transmitter. If something goes wrong (power fluctuations, frequency drift, someone shouting obscenities into the mic), you're required to rectify the situation immediately, not sometime the next day during business hours. If you can't get the transmitter back under control within a reasonably short time, you must shut it down.

I think this is a good policy and should apply to the internet. Once notified that there was an ongoing crime on your network, your obligation was to make it stop or pull the plug. If you can't get in touch with the owner of that server, then walk to the racks and yank a cable. If you can't be bothered to do that, then don't complain if someone else takes emergency action.


I'll just call the internet police and let them know your views, I'm sure they'll do a fine job of telling every ISP in the world how to run their business :) I assume you don't run an ISP and pay for support staff otherwise you'd know what a reasonable response time is, and what isn't. With most abuse desks you'll be lucky to get an automatic acknowledgement - we actually respond to ours with a human response, and fast action. We take abuse seriously and respond to it.

My complaint wasn't so much that spamhaus didn't wait very long, or that they used the wrong channel to talk to us (our regular support address, rather than our urgent fix-now email address, or phone, both of which would have got an instant response), it's that they are now using their blacklist for something completely unrelated to helping their users block spam, and in a pretty casual manner. More incidents like this will dilute their credibility in the long run, and the career spammers will benefit from it as MTA admins begin trust spamhaus less.

Re:Dunno about better (SBC)

[Anonymous Coward]

They blacklisted the entire block of IP addresses owned by SBC!

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Coward]

OK, let me clarify a few things here. When I first had the issue with my emails bouncing I went through the normal processes. I contacted my ISP (whose network is ironically part of the network owned by the large Australian ISP who was bouncing my emails) and told them about the matter. They told me that my IP address is part of the range they allocate to clients requiring static IP's and that as long as I maintain the account I have the LEASE on that IP address - in other words, I don't own it, I LEASE it - just like someone would lease a vehicle. I thought "fair enough - for all intents and purposes the IP is mine" - just like if I lease a vehicle it is mine for all intents and purposes. So then I went to the large Australian ISP who was using the SUCKS list - the ones who were bouncing my emails - and complained that my IP was fixed and bla bla bla. Basically they told me to take a running leap - that THEY weren't blocking my emails it was the SUCKS list that they were using that had my IP listed that was causing the issue so I should take it up with my ISP and the SUCKS people. Hmmm, OK, I've spoken to my ISP and am happy enough with their explanation, so lets try the SUCKS people. So I tried their contact form - which basically spat me out as soon as I entered my IP. So I did a whois on their IP and send a nice email to their tech contact requesting that someone contact me about the issue. Nothing. So I sent another email from another account that doesn't go out via my server to make sure they got it. Nothing. It was at this point - totally frustrated that nobody could give a rats %$@# that I couldn't send email that I contact the Telecommunication Industry Ombudsman, who told me I needed to speak with "The Australian Communications and Media Authority". I recalled seeing something on the SUCKS site so went and checked and sure enough they specifically say that "The Australian Communications and Media Authority" have no authority over them. Another dead end. So I sent another nice email indicating that I REALLY needed to speak to someone who could sort this out for me. Nothing. Finally, totally frustrated that I could get no response, I sent a not-so-nice email telling them that I was investigating my legal rights, and to this day I have still not had one reply from them.

Now the real kicker to this is that I have been told that the large Australian ISP who I originally had issues with is one of the "group of companies as a private venture" (from the SUCKS site) that makes up SUCKS. But what is even worse is that if you whois my IP, it belongs to that same ISP!!! So basically they are blocking one of their own IP's. Oh, I also forgot to mention that the only solution offered by that large ISP when I first contacted them was to lease a "real IP" address from THEM for some ridiculous amount of money. And this is legal how???

Re:SORBS!!! I'd like to ABsorb the so-and-so's!!!

[Anonymous Coward]

Firstly ask the both isps in writing (on paper) to whitelist you as they are using a rbl which has known errors in it.
If they fail to whitelist you then sue the isp for "restraint of trade" or similar. Their choice of rbl is causing
you material harm which is a legitimate grievance.

Don't blame the DNSBL operators -- it's your fault

[lumbercartel.ca]

You chose to use one or more of the SORBS.net RBLs for blocking (presumably without testing first), and then you were disappointed because you didn't get the results you expected? If you truly understood SORBS.net's criteria, and the purpose of RBLs in the first place, then there clearly would be no need to complain.

Responsible mail server operators often do the following prior to implementing any RBL in a blocking fashion:

- Understand the listing criteria (anyone who doesn't do this is definitely a gambler)

- Test it in tagged mode (this decision is subjective, but strongly recommended for those who aren't familiar with DNSBLs or spam fighting in general) and inspect the results periodically to verify accuracy

The reason this testing needs to be performed is that every mail server deals with different eMail traffic patterns (in part due to serving different users/purposes/etc.), and what works well in one environment could be a complete disaster in another.

One must also realize that it's not the fault of the DNSBL operator if legitimate eMail gets blocked (assuming that the criteria is being enforced without exceptions, as has always been the case with SORBS.net as far as I know), rather it's the fault of the spammer and the provider that doesn't terminate spammer accounts (I certainly don't want to receive eMail from ISPs that harbour spammers, and that's my absolutely undeniable right).

If you find that a DNSBL isn't working for you, two options that come to mind are to either combine it with a whitelist (it's entirely up to you to make exceptions to rules on your own systems) or stop using it entirely. In my experience, DNSBL operators typically don't care if you don't use their services, and often discourage relying on their databases anyway -- they're merely providing the listing service for free in the hopes that it will help to make the internet better for everyone, which is a noble attitude worthy of much respect.

I use almost a dozen DNSBLs on all my servers, and the logs consistently indicate a rejection rate of over ~95%. Users are pleased because they get a lot less spam through our systems than they do from most others. Occasionally there is a question about someone's eMail getting blocked, and we handle these on a case-by-case basis (sometimes we refuse to whitelist an ISP, typically because of their attitude or history, but this is rare because most of the time they're willing to terminate spammers to get {and remain} de-listed).

An important part of using a DNSBL is to require those who are blocked to clean up their act. It's a social responsibility that all mail server administrators have, and it's so easy to encourage clean-up on the other end simply because they're the ones who have to take the appropriate steps to get de-listed (there's no need for whitelisting if they actually do get rid of the spam problem on their end, after all). And if they just whine about their upstream provider not fixing it, then that's still their problem (they can always take their business somewhere else -- this is a very compelling way to find out how seriously the take the spam problem, since supporting a spam-friendly upstream provider is approximately as bad as harbouring spammers directly).

How?

[sisinka]

Just how do you want to contact them given they DO know you are just a goddam spammer?

Re: SORBS - Is There a Better Spam Blacklist?

[JoeSA]

Re: Plenty of spam seems to be coming from those IPs {Seems I was auto edited? (does not like the less than & greater than brackets)} Check these links, http://groups.google.com/groups?as_q=&as_epq=64.23 3.182.185&as_ugroup=news.admin.net-abuse.*&scoring =d http://tinyurl.com/yn2ghp http://snipurl.com/16uf2 http://moensted.dk/spam/?addr=64.233.182.185 http://groups.google.com/groups?as_q=&as_epq=193.2 52.22.249&as_ugroup=news.admin.net-abuse.*&scoring =d http://tinyurl.com/yfglt2 http://snipurl.com/16ufd http://moensted.dk/spam/?addr=193.252.22.249 Re: The big question will always be whether Google were informed that one of their servers were abused, or they were just blatantly added to SORBS blacklist. Likely both. I have been privy to some google / gmail mail server admin correspondence, they have been working on improving their outbound filtering (for the last 2 years?) and seem to have made a dent, but by no means have they stopped emitting spam. I suspect most DNSbls that use spam traps, don't bother telling the ISP about the abuse _before_ listing the IP, as by the time the ISP's abuse desk gets around to reading & acting on the e-mail, the spam run to thousands? millions? has already completed. (Most using DNSbls as part of their spam control, are hoping the DNSbl sees the spam before it gets to their server.)

hey! idiot! yes, you!

[RMH101]

...SPEWS and other blacklists don't force anyone to use them. If you're having trouble with a block, it's because someone's ISP has decided that using SPEWS blacklists works for them. It makes commercial sense...

Re:hey! idiot! yes, you!

[melonman]

It makes commercial sense in the same way that unplugging all your customers to slash bandwidth use makes sense. Reducing your spam overheads is good, but not as good as keeping your customers.

As a small ISP running out of a bigger ISP's server park, that's our entire problem (or it would be if any large ISP used SPEWS, which doesn't seem to be the case from our experience). The logic by which widening IP blocks put pressure on the ISP fails as soon as the CEO fails to receive an important mail. The CEO screams at their mail admin, who either turns off whichever list is causing the blocking or finds a new job. Lecturing the CEO about how losing lucrative contracts thanks to SPEWS makes good commercial sense is another way of starting a job search.

I have been asked a few times by customers why their mail doesn't arrive (which has nothing to do with our servers since they send mail using their local ISPs). The problems IME are always with small companies, not telecom-scale ISPs. My response is always to tell them to tell the person they are trying to email to beat up the local mail admin, and this seems to work. I've honestly never heard of a company changing their hosting arrangements because of a "collateral damage" spam block. The pressure results in reduced influence of collateral damage spam lists, not in commercial pressure on spam-friendly ISPs. And that's because non-techies in business would rather receive all their mail and lots of spam rather than half their mail and less spam.

it's all about the T&Cs you signed...

[RMH101]

...when you joined your ISP. If they adhere to them, you can't complain. If they don't, you can. End of story.

Re:it's all about the T&Cs you signed...

[iangoldby]

Here in the UK at least, the terms and conditions of the major ISPs are so vague as to be completely useless in this kind of dispute.