Andy Dills wrote:
It appears (from email recently sent to the admins of a few small
mailservers I help admin) that the people in charge of uribl.com have
decided to set a pretty low threshold for blacklisting DNS servers from
querying, demanding that people who hit that threshold pay them a rather
exorbitant rate for a data feed.
Demanding? I believe the first thing that excessive query volume email
tells you is to simply shut it off and be done. The data feed option
is just that, an option. If you see no value in it, then you wont be
missing anything by us not answering your queries.
I have judged this threshold to be low based on the size of some of the
mail/dns servers whose admins have gotten this email, along with the fact
that this is the only blacklist to have taken this obnoxious stance.
What is your definition of low volume? db2.xecu.net + dns02.xecu.net
accounts for nearly 500k queries/day (~3GB of data/mo).
There are over 40k unique IP that query URIBL public dns. As any mirror
operator can see, we have around 180 IPs in the ACL. So thats ~0.45%.
And those 180 blocked IPs consist of far fewer organizations/companies
as many have more than 1 IP on that list.
Filtering the top 0.45% IPs results in 20% fewer queries/second to the
mirrors. I dont see trying to limit excessive bandwidth usage on
donated mirrors as an "obnoxious stance".
because right now the default inclusion of tests against
multi.surbl.com is in reality just a "trial service" and an opportunity
for this for-profit organization to create revenue streams.
If you remove it from SA by default, you're doing so at the expense of
the other 99.55%.
We asked you to shut off your queries on 2007-12-27 19:15:09. Nearly 3
months later and we still saw the same high volume queries from your
systems.
I really don't care much either way, for me it's a done deal, I'm
disabling the tests on my mail servers and advising others to do the same.
I'm just wondering if the community at large is aware of this and has an
opinion.
Superb. Thats all you had to do in the first place without raising a stink.
If SA wants to completely remove uribl.com tests because we dont allow
the heavy hitters to query the public mirrors, thats their choice.
Although, the usage policy for Spamhaus
(http://www.spamhaus.org/organization/dnsblusage.html) doesnt prevent
inclusion of RCVD_IN_SBL in SA.
Thanks,
--
Dallas Engelken
[EMAIL PROTECTED]
http://uribl.com
