Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread Benny Pedersen
On March 13, 2015 7:36:21 PM David B Funk wrote: # dig -t ns hardinskinrestore.com. dig +trace example.com spam domains just need ns for there own subdomains, if its dns delegated, back to basic if comal is so hard :)

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread Dave Pooser
On 3/13/15, 2:47 PM, "Kevin A. McGrail" wrote: >On 3/13/2015 3:16 PM, David B Funk wrote: >>Your 'been there - got bitten', is that a reference to the temptation >>or the actual case of no NS records? >Axb's sister was once bitten by a M00se. She was Karving her initials on the m00se with the sh

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread Kevin A. McGrail
On 3/13/2015 3:16 PM, David B Funk wrote: Your 'been there - got bitten', is that a reference to the temptation or the actual case of no NS records? Axb's sister was once bitten by a M00se.

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread lconrad
On Friday 13/03/2015 at 2:17 pm, David B Funk wrote: On Fri, 13 Mar 2015, Axb wrote: On 03/13/2015 07:54 PM, John Hardin wrote: On Fri, 13 Mar 2015, David B Funk wrote: Except that the rrpproxy.net people have figured out a way to cirumvent this. They now register spammer domains and d

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread David B Funk
On Fri, 13 Mar 2015, Axb wrote: On 03/13/2015 07:54 PM, John Hardin wrote: On Fri, 13 Mar 2015, David B Funk wrote: Except that the rrpproxy.net people have figured out a way to cirumvent this. They now register spammer domains and don't list -any- NS records in the zone. Is *that* a useful

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread Axb
On 03/13/2015 07:54 PM, John Hardin wrote: On Fri, 13 Mar 2015, David B Funk wrote: Except that the rrpproxy.net people have figured out a way to cirumvent this. They now register spammer domains and don't list -any- NS records in the zone. Is *that* a useful spam sign? Remember, SA is not a

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread John Hardin
On Fri, 13 Mar 2015, David B Funk wrote: Except that the rrpproxy.net people have figured out a way to cirumvent this. They now register spammer domains and don't list -any- NS records in the zone. Is *that* a useful spam sign? Remember, SA is not an RFC compliance validation tool. If a few

Re: Bogus day old domains from RRPPROXY.NET

2015-03-13 Thread David B Funk
On Wed, 11 Mar 2015, Axb wrote: I don't quite understand your logic/language but yes, that's the point of such a list. You list the NS and all domains on that NS get scored. for example see: URIBL's "Extra Datasets via Datafeed Service" http://uribl.com/datasets.shtml black_ns.txt - This fil

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Axb
On 03/11/2015 01:49 PM, Gibbs, David wrote: On 3/10/2015 5:08 PM, Reindl Harald wrote: for postfix there is "check_sender_ns_access hash:/etc/postfix/blacklist_ns.cf" with the advantage of logging and a proper reject cat /etc/postfix/blacklist_ns.cf ns1.sedoparking.com REJECT Domain is pa

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Gibbs, David
On 3/10/2015 5:08 PM, Reindl Harald wrote: for postfix there is "check_sender_ns_access hash:/etc/postfix/blacklist_ns.cf" with the advantage of logging and a proper reject cat /etc/postfix/blacklist_ns.cf ns1.sedoparking.com REJECT Domain is parked at sedo.com ns2.sedoparking.com R

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Axb
On 03/11/2015 10:57 AM, Benny Pedersen wrote: Axb skrev den 2015-03-11 10:41: RPZ zones are domain lists - NOT nameservers lists nameservers is domain aswell imho :=) if anything using rbldnsd :-) here is just see domain not found if rpz listed, and i dont plan to list my dns hoster for

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Axb
On 03/11/2015 10:57 AM, Benny Pedersen wrote: Axb skrev den 2015-03-11 10:41: RPZ zones are domain lists - NOT nameservers lists nameservers is domain aswell imho :=) if anything using rbldnsd :-) here is just see domain not found if rpz listed, and i dont plan to list my dns hoster for

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Benny Pedersen
Axb skrev den 2015-03-11 10:41: RPZ zones are domain lists - NOT nameservers lists nameservers is domain aswell imho :=) if anything using rbldnsd :-) here is just see domain not found if rpz listed, and i dont plan to list my dns hoster for being free and good no matter how many bad dom

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Axb
On 03/11/2015 10:20 AM, Benny Pedersen wrote: Kevin Miller skrev den 2015-03-10 23:01: FWIW, I put on my BOFH hat, and just blocked those name servers at the filewall. They're based in Germany so it's a pretty safe bet that I'm not going to see legitimate mail from any of the legitimate domain

RE: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Benny Pedersen
Kevin Miller skrev den 2015-03-10 23:01: FWIW, I put on my BOFH hat, and just blocked those name servers at the filewall. They're based in Germany so it's a pretty safe bet that I'm not going to see legitimate mail from any of the legitimate domains hosted by them. That may not be the case for

Re: Bogus day old domains from RRPPROXY.NET

2015-03-11 Thread Axb
On 03/10/2015 11:01 PM, Kevin Miller wrote: -Original Message- From: Kevin A. McGrail [mailto:kmcgr...@pccc.com] Sent: Tuesday, March 10, 2015 1:31 PM To: Kevin Miller; users@spamassassin.apache.org Subject: Re: Bogus day old domains from RRPPROXY.NET On 2/19/2015 2:50 PM, Kevin Miller

Re: Bogus day old domains from RRPPROXY.NET

2015-03-10 Thread Reindl Harald
Am 10.03.2015 um 23:01 schrieb Kevin Miller: -Original Message- From: Kevin A. McGrail [mailto:kmcgr...@pccc.com] Sent: Tuesday, March 10, 2015 1:31 PM To: Kevin Miller; users@spamassassin.apache.org Subject: Re: Bogus day old domains from RRPPROXY.NET On 2/19/2015 2:50 PM, Kevin

RE: Bogus day old domains from RRPPROXY.NET

2015-03-10 Thread Kevin Miller
> -Original Message- > From: Kevin A. McGrail [mailto:kmcgr...@pccc.com] > Sent: Tuesday, March 10, 2015 1:31 PM > To: Kevin Miller; users@spamassassin.apache.org > Subject: Re: Bogus day old domains from RRPPROXY.NET > > On 2/19/2015 2:50 PM, Kevin Miller wrote:

Re: Bogus day old domains from RRPPROXY.NET

2015-03-10 Thread Kevin A. McGrail
On 2/19/2015 2:50 PM, Kevin Miller wrote: Is there a way to reject or up the score on anything that is served up by that name server or registar? I was thinking maybe putting the rrproxy.net nameserver in my dns as 127.0.0.1, on the theory that if it doesn't resolve the message will be reject

Bogus day old domains from RRPPROXY.NET

2015-02-19 Thread Kevin Miller
Lately we've been getting slammed by spam. The bulk of it (no pun intended) is coming from new domains (many just a day or two old) which originate from key-systems gmbh, and all use RRPPROXY.NET as their name servers such as this snippet from whois: Domain Name: WATTSMINDANDBODYLAB.COM