Re: dnsbl.sorbs.net

Paul F. Hunt wrote:
> It gets held in my incoming held email at Spamcop and the reason is
> given as:
>
>  X-SpamCop-Disposition: Blocked dnsbl.sorbs.net

Gotit.  I didn't know you were talking about spamcop mail;  I tho't you
were posting in the wrong ng.  Doh!  Don't mind /me/.  ;-)

I'm weak on spamcop mail, since I don't use it.  But, I'm not completely
helpless ;-)

> OK. I see that now. So I pulled up the original email. Its first
> "Received:" was 208.24.123.10.

Which [the first received line] would be an 'abnormal' way to be getting
mail from a 'real person' at that domain.  But, finding it in some lower
preceding line wouldn't necessarily be abnormal or even spammish.  To go
off to the side conjecturing for a minute, 208.24.123.10 rDNS
du-208-10.tops-tele.com 'looks like' [and is] an individual enduser in
that netblock which is actually here.

whois -h whois.arin.net 208.24.123.10 ...
Sprint   208.0.0.0 - 208.35.255.255
CITIZENS TELEPHONE CO.  208.24.123.0 - 208.24.123.255

which means that Sprint 'owns' the whole 208.x.x.x or 'class A' block
[almost 17 million IPs in there] and that the little subsection of that,
the 208.24.123.x or 'class C' block - 256 IPs in there belong to
citizen, which is where your target IP is, and your IP's 'name' looks
like 'dialup' or dynamic, and there are blocklists which identify such
dyamic IPs for you.  However, you should be careful about using a filter
on a dynamic IP.  More on that below.

So, most people on dynamic IPs, such as dialups, 'typically' are
supposed to go through their provider's smtp server.  They aren't
supposed to be sending out mail directly to your provider's MX.  And,
that is a 'good' reason for a /server/ to be having a list of dynamic
IPs.  However, it is sometimes a 'bad' reason for a filter such as
SpamPal's to filter on the occurrence of that IP anywhere in the header,
because a goodmail might've started at that IP and then went on to the
tops-tele.com smtp server and then out.

> That IP I can find at www.MXToolbox.com as being on a number of
> blocking lists with Return Codes of 127.0.0.7 and 127.0.0.10. But
> www.MXToolbox.com doesn't tell me what the 127 Return Codes mean.

I went over to mxtoolbox to poke around in the tools and see what they
look like.  The place where you would input that IP is in the blacklists
section and you can get a good education by tinkering around in there.
It is very useful to understand how the various blocklists work, and you
should try to have a good understanding of that if you are going to
involve yourself in picking one blocklist over another to be doing
things for you.

The blacklists section of mxtoolbox has links which can be clicked on to
either give you the detail [if there are any] of a listing or can take
you to the main section of a particular blacklist.  When you have an IP
which is listed like that one above in a number of blocklists, you can
go all around and read about what the various listings mean.  Very
informative.  It takes a long time, but eventually you become acquainted
with what each of them are all about.  I like the way mxtoolbox does it;
it is somewhat different from the way dnsstuff and openrbl handle the
same job.

> So I went to www.dnsbl.us.sorbs.net and found that 127.0.0.7 means
> 208.24.123.10 is in the web.dnsbl.sorbs.net database and 127.0.0.10
> means it's in the dul.dnsbl.sorbs.net database and, frankly, I still
> don't know any more than I did. But I guess I'm getting closer.

The .7 was originally intended to be for insecure webservers, but now
sorbs has changed it so that it has encompassed other problems as well,
so it doesn't mean exactly the same as it used to.  But, it does mean
something 'bad', ie the listing is associated with either a spam or an
identified insecurity, which is typically associated with spam.  The .10
doesn't necessarily mean something bad;  it is 'conditional'.  The .10
simply means that that IP is in a dynamic block.  Any dialup person's IP
is going to be in a dynamic block;  and the next time they dialup, they
will be a different IP.  However, normally we wouldn't expect to be
getting mail directly from a dynamic IP, so that makes it 'bad' because
of the condition.


-- 
Mike Easter
kibitzer, not SC admin