A situation recently popped up that prompted a question:
How many operations utilize any kind of dnsbl (or any other kind of third party
reporting service) on customer facing SMTP servers?
(customer facing == end users of your operation's service receive mail there)
I'm sure legal issues apply; any replies off-list would be greatly appreciated.
Thanks,
Todd Williamson
Covad IP Services
Covad Security Operations
(888)801-6285
twilliam@covad.com
I do on the ISP I consult with. We use:
dialups.mail-abuse.org (we pay for this)
relays.mail-abuse.org (we pay for this)
relays.osirusoft.com (all of it, 8 zones, 3 from outside sources)
spamhaus.relays.osirusoft.com
proxy.relays.osirusoft.com
socks.relays.osirusoft.com
spamsites.relays.osirusoft.com
spews.relays.osirusoft.com
inputs.relays.osirusoft.com
spamsources.relays.osirusoft.com
dialups.relays.osirusoft.com
list.dsbl.org
flowgoaway.com
And we were using relays.visi.com until their hardware failure. We also
used to use blackholes.five-ten-sg.com, multihop.dsbl.org, and
blackholes.2mbit.com.
Personally I use all of those as well as:
dialups.visi.com
blackholes.easynet.nl
opm.blitzed.org
All of those are used to flat out reject spam at the MTA. I will
eventually use those on the production MTAs.
In addition to those I listed above, we also score our mail. On the
non-production box I'm using all 13 foreign relay DNSBLs provided by
blackholes, SORBS (all 7 zones), proxies.relays.monkeys.com,
multihop.dsbl.org, and a breakdown of the blackholes.easynet.nl (formely
wirehub) lists.
Of this list we get (in one fashion or another) zone transfers of each
zone (AXFR, IXFR, rsync, or HTTP transfer). I only use those for which
that's an option. Otherwise I'd use ORDB and others.
Is that enough info? I can provide what I'd call an ideal configuration
if you want.
Justin