Sure, you are right with what you said about dialup-host. These german T-Online host addresses ending on ...t-dialin.net are dynamic dial-up connections, and they belong also to DSL flatrate connections and therefore some guys are online for 24 hours or more and have enought time to spam the world from that IP (singlehop, with their own SMTP engines!)
So it is ok to give a score to that IPs with SpamAssassin, but rejecting emails (Postfix) on basis of this RBL-listing would be no good idea, because the same IP is used by many other dial-up users to send their normal emails (multihop, via the T-Online SMTP servers, like the received-trail show in my first posting) ...but I think we are going of-topic in this list here.. ;-) Matt Kettler wrote: > > >> See the notes at DSBL: http://dsbl.org/listing?80.142.228.8 They > > >> report it as a verified singlehop relay. > > >> > > > >Since the 80.142.228.8 is definitely a dialup-host from a big german ISP for > >customers with dynamic IPs it should not be listed as singlehop in the RBLs. > >I am sure, the spammer is up-and-away from that IP. But that is more an > >RBL-issue than a issue of SA. > > Why is it that should dialup nodes be exempt? > > In this case, that IP had an open relay running on it long enough for it to > be abused, reported, and then verified. > > The idea of exempting dialup nodes has come up before, but I'm sorry, I for > one disagree. > > A verified spam-source IP is a verified spam-source IP. Until the ISP > identifies and corrects the problem and reports back to the RBLs, I think > it's quite reasonable to list each IP address that has been verified as a > spam source. After all, until it's fixed you know this open relay is going > to keep dialing in. It's going to keep getting IP addresses from a single > dialup pool, which means it WILL come back to that IP. > > If the node really is a dialup, perhaps t-dialin.net should consider > restricting inbound tcp/25, or policing their networks. > > In any event, the ISP can request a removal. The fact that the IP is still > in the RBL indicates that t-dialin hasn't been addressing the issue. > >
