nanog mailing list archives
RE: Security of DNSBL spam block systems
From: Brad Knowles <brad.knowles () skynet be>
Date: Tue, 23 Jul 2002 22:20:58 +0200
At 2:29 AM -0400 2002/07/23, Phil Rosenthal wrote:
IMHO Even the really large DNSBL's are barely used -- I think (much) less than 5% of total human mail recipients are behind a mailserver that uses one...
Not true. There are plenty of large sites that use them (e.g., AOL), and many sites use them to help ensure that they themselves don't get added to the black lists.
IMO, there is a serious risk of having DNSBL servers attacked and used as a DoS.
The easiest way would be to check to see if the servers being used are open public caching recursive servers, in addition to their authoritative services. If so, then they would be open to cache poisoning attacks.
That said, I think the bigger black list services are run by people who have at least half a clue as to how a nameserver should be operated, and therefore they should be relatively secure. However, they would still be at risk if one of their parent zones is served by a nameserver that mixes both authoritative service & caching/recursive service, and therefore would be easily subject to cache poisoning.
-- Brad Knowles, <brad.knowles () skynet be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania.
Current thread:
- Security of DNSBL spam block systems Big_Bandwidth (Jul 22)
- RE: Security of DNSBL spam block systems Phil Rosenthal (Jul 22)
- <Possible follow-ups>
- RE: Security of DNSBL spam block systems Brad Knowles (Jul 23)
- RE: Security of DNSBL spam block systems Simon Lyall (Jul 23)
- Re: Security of DNSBL spam block systems Len Rose (Jul 24)