Re: Understanding dsbl?

In article <230620051316213493%[email protected]>,
Alan Harper <[email protected]> writes:

> Every time I think I understand something about mail protocols and spam
> filtering, it is demonstrated that I really don't. Perhaps someone can
> help me a little bit more here.
>
> A colleague who I work with is in Mexico, so he needs to use telnor.net
> as his ISP. He has a windows computer and is sending mail using
> Outlook, through a router (don't know which model), and uses
> opensourcehost.com as the smtp server. Our web site,
> terrapeninsular.org, maps to jag.opensourcehost.com = 69.93.35.100.
>
> He asked me to help because he was not able to send email to some
> recipients--and perhaps the problem was that his email was being ID'd
> as spam. I am trying to do what I can.

> I guess the first question is, do you think that 200.79.150.31 is the
> IP of his router, or a computer that is somewhere "upstream" of his
> computer?

It is either the I.P. of his computer, or the I.P. address of a NAT (Network
Address Translation) router that is between his computer and the Public
Internet.

If it is a NAT router then it can be shared with any number of computers, any
one of them could be infected.  However because of the nature of NAT,
unless special arrangement is made, no incomming connections are usually
allowed.  So while an infected computer can spam viruses, it is more difficult
for a spammer to send through such a zombied computer.

Microsoft has stated publicly that their computers require a hardware or
software firewall between them and the public internet.  The hardware ones for
home use are usually pre-configured for what is needed and are usually
plug in and forget devices.  Software firewalls are not as reliable and can be
disabled by malware or social engineering.

> This IP was listed in njabl
> http://njabl.org/cgi-bin/lookup.cgi?query=200.79.150.31 and is listed
> in dsbl http://dsbl.org/listing?200.79.150.31 . It appears that it is
> listed because there was an open relay at that IP in in 2004.

Not an open relay, an open proxy.  An open proxy is far worse than an
an open relay.  An open relay does not hide the I.P. address of the abuser
and can only relay e-mail.

An open proxy both hides the I.P. address of the abuser, it also usually
allows the abuser to use any TCP/IP protocol.  The presence of an open
proxy on a computer usually means that some criminal on the internet has
more control of that computer than the system owner.

> Someone,
> not me, tried to get it unlisted from dsbl, but dsbl won't unlist it
> because telnor doesn't respond to the postmaster mail addresses to
> confirm anything. (Telnor doesn't have to care, it is a near monopoly).

More precisely the error message is implying that the required ABUSE
and POSTMASTER addresses are not available at all to receive any messages.

And there are some networks that will refuse all e-mail from ISPs that do not
have working ABUSE and POSTMASTER addresses.

http://www.rfc-ignorant.org/tools/lookup.php?domain=telnor.net

And some of the postmasters that I know will put a local block an entire
network if their complaint to a required role account is rejected or
ignored.

And for the same postmasters, if they find a trend for a country is to have
unresponsive ISPs, then tend to start blocking the entire country unless one of
their users ask for a white listing of a specific IP address.

> The second question is, is there any easy way to see if there is still
> an open proxy at this address?

There are some people that may have access to proxy testing software.  You can
try doing a telnet command to the ports listed as being open and see if the
machine accepts a connection.

The DSBL testing software can be downloaded from their web site in source
format.

> As far as I can tell, njabl hasn't retested the address,

http://njabl.org/cgi-bin/lookup.cgi?query=200.79.150.31

States that they have tested it and removed the listing because they could not
find an open proxy.

> and dsbl won't retest it until telnor changes its
> procedures (I.e, until hell freezes over).

DSBL did not test the machine, and DSBL will not retest a machine.

DSBL lists machines that people on the internet can get to send a specially
crafted message to one of the DSBL mail servers.

The people usually do such a test after receiving spam from that I.P. address.

The listing remains until someone proves they can read an E-mail sent to one of
the RFC required e-mail addresses that all mail servers must have and their
operators must pay attention to.

If there is a zombie machine on a DHCP range, eventually it may cause the
entire DHCP pool to be listed by the DSBL and other blocking lists.

Getting a DHCP pool listed is not a bad thing as some spammers know that spam
from it will not get to a large number of mail servers.

A zombie or an open relay on an ISP costs that ISP a significant amount of
operating cash, so any network owner that is ignoring them or blocking
spam/abuse reports is only hurting their own profits.

According to one media report, if a spammer had to pay the going retail rate
for the bandwidth stolen through an open proxy, they would have to pay
$1,200 U.S. per week.

> Right now, whatever was blocking his email is no longer blocking it.
> This corresponds with my asking njabl to unlist this address, but I
> suspect that it was coincidence.

The I.P. address is not listed by NJABL at this time.  NJABL is included in
the apparently very popular SBL-XBL.SPAMHAUS.ORG list.

> Any other thoughts about what I can do to increase his chance of
> sending emails would be appreciated.

As long as the required role accounts of POSTMASTER and ABUSE are not
functional and acted on in real time by his ISP, he is likely to have
problems with other networks accepting his e-mail.  It also means that
he is also likely to have periods of very poor network connectivity.

And the people doing that type of blocking are not likely to change, as near as
I can tell, more and more network adminstrators are blocking networks that do
not have working role accounts, not only at the e-mail level, but at the router
level also.

And it is the well run networks that will issue rejection notices.  Many
networks will simply silently delete what they detect as spam.  One of the
reasons for this is to avoid cartooneys from people who get overly hostile
if one of their messages is mistakently tagged as spam.  Others just do it that
way because they are not competently run.


Smart hosting for your mail server will get around most of the blocks,
except for the apparently few spam filters like the one spamcop.net uses
that check all headers, and the people that are specifically blocking your ISP
as it seems to be one of the few ISPs that are being specfically blocked for
allegedly not removing spammers elsewhere on their network.


A well run mail server will issue a SMTP rejection code when it refuses a
message, and the standard block list check on the I.P. address is what is
available on all the commercial mail servers that I am aware of.

It costs more to do the addtional filtering checks and if the mail server
operator has properly tuned their local and public blocking lists, in many
cases, the additional filtering is more likely to catch real e-mails than it is
any spam that gets through.

Usually, but not always, it is safe to block the /23 (512 addresses)
surrounding an I.P. address that sent spam or a virus as there is usually that
much separation from the real mail servers I.P. addresses and the I.P.
addresses allocated to end users.  Such blocks usually need to be done manually
as the error rate is probably too high for a simple automatic process.


Mail servers that issue rejections based on I.P. addresses farther up the chain
or by message content risk un-subscribing their users from mailing lists where
spam or a virus leaked by the mailing list filters.

Using an Open Proxy blocking list like the SBL-XBL, or DSBL on the input to a
smart-hosting mail server can also prevent it from relaying spam or viruses
from one of your users incase their machine get zombied, or someone phishes
their account information.  You may occasionally need to whitelist an I.P. like
your colleague, but that should be a rare occurance.

In most cases an e-mail connection from an I.P. address in list.dsbl.org,
sbl-xbl.spamhaus.org means that the system is owned, and unless you
specifically know that the listing is old, it is not a good idea to relay that
mail.  By diverting such mail attempts to a local administrator, you will
probably be able to alert such users that someone else either has their access
credentials or control of their computer.

-John
[email protected]
Personal Opinion Only