Re: Verisign's New Change and Outdate RBL's

2003-09-16 Thread jlewis

On Tue, 16 Sep 2003, Patrick Muldoon wrote:

 Was playing with a test box here at home. Installed SpamAssassian from a 
 newely cvsup'd ports tree on a FreeBSD box, and was surprised to see 
 messages getting marked as received in blacklists that no longer exist.  
 Most noteably ORBS.  Since this was a fresh Install I hadn't gone 
 through and removed the dead RBL's from 20_head_tests.cf yet.  Since 
 dorkslayers doesn't exist. any queries for it are returning that 
 infamous sitefinder address.
 
 [EMAIL PROTECTED] doon]$ host  34.131.246.64.orbs.dorkslayers.com
 34.131.246.64.orbs.dorkslayers.com has address 64.94.110.11

I wonder if they've been playing with these wildcards on and off for a few
weeks?  I have a script that checks for our mail servers in a bunch of
popular DNSBLs periodically.  On and off over the past few weeks, I
started getting notifications from that script that all of our servers
were in the various dorkslayers.com DNSBL zones.  The dorkslayers.com
DNSBLs were all shut down, AFAIK, at least several months ago. I got this
notification again last night, and finally commented out the tests for
those zones.
 
--
 Jon Lewis [EMAIL PROTECTED]|  I route
 System Administrator|  therefore you are
 Atlantic Net|  
_ http://www.lewis.org/~jlewis/pgp for PGP public key_



Verisign's New Change and Outdate RBL's

2003-09-15 Thread Patrick Muldoon
Was playing with a test box here at home. Installed SpamAssassian from a 
newely cvsup'd ports tree on a FreeBSD box, and was surprised to see 
messages getting marked as received in blacklists that no longer exist.  
Most noteably ORBS.  Since this was a fresh Install I hadn't gone 
through and removed the dead RBL's from 20_head_tests.cf yet.  Since 
dorkslayers doesn't exist. any queries for it are returning that 
infamous sitefinder address.

[EMAIL PROTECTED] doon]$ host  34.131.246.64.orbs.dorkslayers.com
34.131.246.64.orbs.dorkslayers.com has address 64.94.110.11
So anybody that hasn't update their SpamAssassian config, now has the 
added benefit of all ip's being tagged as an open relay.

Just an FYI
-Patrick