Re: dnsbl.sorbs.net

Paul F. Hunt wrote:
> tops-tele.com is a local provider in my area that I (always?) see
> being blocked through Spamcop due to dnsbl.sorbs.net (and, yes, I
> know I can whitelist them).

I'm not following that.  What does 'blocked through Spamcop due to
[sorbs]' mean?

SCbl is the spamcop blocklist, which lists by IP addresses, not
domainnames.  Sorbs is multiple lists and combined and also lists by IP
addresses not domainnames.

If we want to talk about a mail being blocked which you see, then that
means that the sender of the mail would see some kind of nondelivery
error, which optimally would show the IP being blocked, so that we don't
have to guess at it.

> So I went to www.whois.sc and did a
> whois. That returned 208.24.123.5 . Then I went to dnsbl.sorbs.net to
> do a database query. It said:
>
> [208.24.123.5] was not found in the SORBS database.

Therein you see the 'problem' of needing to know what IP address you are
talking about in order to find out what its condition is.

Some nameservice on tops-tele.com will show that
tops-tele.com   DNS  208.24.123.5

but that doesn't tell us how its mail goes out.

Mail for tops-tele.com is handled by mail.tops-tele.com
mail.tops-tele.com  DNS  208.31.125.27

but that doesn't tell you how its mail goes out either.

So, then it is a pure guessing and sleuthing game.  My sleuthing leads
me to
208.24.123.52  rDNS  du-208-52.tops-tele.com

52.123.24.208.dnsbl.sorbs.net

11/30/04 13:36:57 dns 52.123.24.208.dnsbl.sorbs.net
Canonical name: 52.123.24.208.dnsbl.sorbs.net
Addresses:
  127.0.0.10
  127.0.0.7

dul.dnsbl.sorbs.net    127.0.0.10
Dynamic IP Address ranges

web.dnsbl.sorbs.net    127.0.0.7

List of web (WWW) servers which have spammer
abusable vulnerabilities (e.g. FormMail scripts)
Note: This zone now includes non-webserver
IP addresses that have abusable vulnerabilities.

So, there's a tops-tele.com which is sorbs listed, but that isn't
necessarily the cause of your problems, see what I mean about needing to
 know the IP of the problem mail which is being blocked by someone?


-- 
Mike Easter
kibitzer, not SC admin