Security Basics mailing list archives

Re: RBLs for SPAM Control


From: Devdas Bhagat <devdas () dvb homelinux org>
Date: Thu, 4 Aug 2005 14:38:47 +0530

On 03/08/05 11:48 +1000, Alexis wrote:
Well, this morning i discovered that the IP address recently allocated to me 
by my ISP is on the dnsbl.sorbs.net RBL . . . . :-/ i must say i'm not 
enthused about the notion of being false-positived by spamfilters worldwide, 
particularly since i maintain a tiny mailing list which sends out a news 
email to  ~20 people each day.

Your next paragraph indicates that you are on the duhl.dnsbl.sorbs.net
list. That is especially meant to list dynamic IP addresses which should
not be sending direct to MX.

Of course, i could shut down my net connection, wait a bit, then restart
it in the hope that DHCP allocates me a different IP (although there's
obviously no guarantee that the new IP won't be on an RBL as well). But
this has got me wondering: how does an IP address get /removed/ from
RBLs? Is there some sort of 'time-out' period, where if there are no
reports of spam from a particular IP after a certain length of time, it
gets removed from the list? Otherwise, i suspect that in the not-too-distant
future, ISPs will find most of their IP address pool on an RBL . . . .

Different DNSBLs have different policies. list.dsbl.org does not time
out, but delists on request. The sbl removes IPs based on the removal of
the spammer. Spamcop has a three day lifetime for its entries. Normal
entries from dnsbl.sorbs.net expire in three months, but never from the
duhl.

Devdas Bhagat



Alexis.


Current thread: