Verisign's New Change and Outdate RBL's

Tue Sep 16 12:41:57 UTC 2003

On Tue, 16 Sep 2003, Patrick Muldoon wrote:

> Was playing with a test box here at home. Installed SpamAssassian from a 
> newely cvsup'd ports tree on a FreeBSD box, and was surprised to see 
> messages getting marked as received in blacklists that no longer exist.  
> Most noteably ORBS.  Since this was a fresh Install I hadn't gone 
> through and removed the dead RBL's from 20_head_tests.cf yet.  Since 
> dorkslayers doesn't exist. any queries for it are returning that 
> infamous sitefinder address.
> 
> [doon at fawkes doon]$ host  34.131.246.64.orbs.dorkslayers.com
> 34.131.246.64.orbs.dorkslayers.com has address 64.94.110.11

I wonder if they've been playing with these wildcards on and off for a few
weeks?  I have a script that checks for our mail servers in a bunch of
popular DNSBLs periodically.  On and off over the past few weeks, I
started getting notifications from that script that all of our servers
were in the various dorkslayers.com DNSBL zones.  The dorkslayers.com
DNSBLs were all shut down, AFAIK, at least several months ago. I got this
notification again last night, and finally commented out the tests for
those zones.

----------------------------------------------------------------------
 Jon Lewis *jlewis at lewis.org*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |  
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________