From msk@cloudmark.com Wed Jan 18 19:38:25 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A03DD11E8093 for ; Wed, 18 Jan 2012 19:38:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.583 X-Spam-Level: X-Spam-Status: No, score=-102.583 tagged_above=-999 required=5 tests=[AWL=0.016, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1vFKmB9KO+Fq for ; Wed, 18 Jan 2012 19:38:24 -0800 (PST) Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.25]) by ietfa.amsl.com (Postfix) with ESMTP id BA88711E8071 for ; Wed, 18 Jan 2012 19:38:24 -0800 (PST) Received: from malice.corp.cloudmark.com (172.22.10.71) by EXCH-HTCAS901.corp.cloudmark.com (172.22.10.73) with Microsoft SMTP Server (TLS) id 14.1.355.2; Wed, 18 Jan 2012 19:38:15 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.10.71]) with mapi; Wed, 18 Jan 2012 19:38:24 -0800 From: "Murray S. Kucherawy" To: Anti-Spam Research Group - IRTF Date: Wed, 18 Jan 2012 19:38:21 -0800 Thread-Topic: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices Thread-Index: AczWRt0A2M0LxXzgQIWetG7jGRokcAAFOYZg Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/mixed; boundary="_002_F5833273385BB34F99288B3648C4F06F19C6C15902EXCHC2corpclo_" MIME-Version: 1.0 Subject: [Asrg] FW: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Jan 2012 03:38:25 -0000 --_002_F5833273385BB34F99288B3648C4F06F19C6C15902EXCHC2corpclo_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable FYI --_002_F5833273385BB34F99288B3648C4F06F19C6C15902EXCHC2corpclo_ Content-Type: message/rfc822 Received: from EXCH-HTCAS901.corp.cloudmark.com (172.22.10.73) by spite.corp.cloudmark.com (172.22.10.72) with Microsoft SMTP Server (TLS) id 8.3.213.0; Wed, 18 Jan 2012 17:08:32 -0800 Received: from mail.cloudmark.com (208.83.136.59) by ht1.cloudmark.com (172.22.10.80) with Microsoft SMTP Server (TLS) id 14.1.355.2; Wed, 18 Jan 2012 17:08:23 -0800 Received: from mail.ietf.org ?(mail.ietf.org [12.22.58.30]) by mail.cloudmark.com (8.14.3/8.14.3) with ESMTP id q0J18WUF024488 for ; Wed, 18 Jan 2012 17:08:32 -0800 (envelope-from ietf-announce-bounces@ietf.org) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 137DF11E80EF; Wed, 18 Jan 2012 17:07:53 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F85C11E80EC for ; Wed, 18 Jan 2012 17:07:50 -0800 (PST) Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yu0bbbFUbAs8 for ; Wed, 18 Jan 2012 17:07:48 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [IPv6:2001:1890:123a::1:2f]) by ietfa.amsl.com (Postfix) with ESMTP id D633B11E80E3 for ; Wed, 18 Jan 2012 17:07:43 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 1DF5A72E034; Wed, 18 Jan 2012 17:04:37 -0800 (PST) From: "rfc-editor@rfc-editor.org" To: "ietf-announce@ietf.org" , "rfc-dist@rfc-editor.org" , "irtf-announce@irtf.org" CC: "rfc-editor@rfc-editor.org" Sender: "ietf-announce-bounces@ietf.org" Date: Wed, 18 Jan 2012 17:04:37 -0800 Subject: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices Thread-Topic: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices Thread-Index: AczWRt0A2M0LxXzgQIWetG7jGRokcA== Message-ID: <20120119010437.1DF5A72E034@rfc-editor.org> List-Help: List-Subscribe: , List-Unsubscribe: , X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Exchange-Organization-AuthSource: EXCH-HTCAS901.corp.cloudmark.com X-MS-Has-Attach: X-Auto-Response-Suppress: All X-MS-Exchange-Organization-SenderIdResult: Pass X-MS-Exchange-Organization-SCL: -1 X-MS-Exchange-Organization-PRD: ietf.org X-MS-TNEF-Correlator: received-spf: Pass (EXCH-HTCAS901.corp.cloudmark.com: domain of ietf-announce-bounces@ietf.org designates 12.22.58.30 as permitted sender) receiver=EXCH-HTCAS901.corp.cloudmark.com; client-ip=12.22.58.30; helo=mail.cloudmark.com; dkim-signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1326935273; bh=tGFmkws+KYLrn5gOiO/IQZxoq5BKkIE+aa9smjEDFXw=; h=To:Subject:From:Message-Id:Date:Cc:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:MIME-Version: Content-Type:Content-Transfer-Encoding:Sender; b=n0FE8//38hPNUA/2fFZpl47siFYImnzLD+5r3FQPsVsODmPLcMUOjfA90h+Z+FCV3 CkUAK3oV7BcJMjkElFoZyz7F4Ii9z4PDw/WJY1PGGnXiOzbmi+LfL5Y/26FJLEostT q3QMwTIwlmFQOsgZH6Xw7SL5s24LbzfaGBgFMj7o= errors-to: ietf-announce-bounces@ietf.org delivered-to: ietf-announce@ietfa.amsl.com x-spam-flag: NO x-virus-scanned: amavisd-new at amsl.com x-spam-score: -102.425 x-spam-level: x-spam-status: No, score=-102.425 tagged_above=-999 required=5 tests=[AWL=0.175, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] x-original-to: ietf-announce@ietfa.amsl.com x-beenthere: ietf-announce@ietf.org x-mailman-version: 2.1.12 list-id: "IETF announcement list. No discussions." list-archive: list-post: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 A new Request for Comments is now available in online RFC libraries. =20 RFC 6471 Title: Overview of Best Email DNS-Based=20 List (DNSBL) Operational Practices=20 Author: C. Lewis, M. Sergeant Status: Informational Stream: IRTF Date: January 2012 Mailbox: clewisbcp@cauce.org,=20 matt@sergeant.org Pages: 21 Characters: 49264 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-irtf-asrg-bcp-blacklists-10.txt URL: http://www.rfc-editor.org/rfc/rfc6471.txt The rise of spam and other anti-social behavior on the Internet has led to the creation of shared DNS-based lists (DNSBLs) of IP addresses or domain names intended to help guide email filtering. This memo summarizes guidelines of accepted best practice for the management of public DNSBLs by their operators as well as for the proper use of such lists by mail server administrators (DNSBL users), and it provides useful background for both parties. It is not intended to advise on the utility or efficacy of particular DNSBLs or the DNSBL concept in general, nor to assist end users with questions about spam. This document is not an Internet Standards Track=20 specification; it is published for informational purposes. This document is a product of the IRTF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see http://www.ietf.org/mailman/listinfo/ietf-announce http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html. For downloading RFCs, see http://www.rfc-editor.org/rfc.html. Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC _______________________________________________ IETF-Announce mailing list IETF-Announce@ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce --_002_F5833273385BB34F99288B3648C4F06F19C6C15902EXCHC2corpclo_-- From uukutt@synacor.com Thu Jan 19 12:03:25 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A3EB21F86C8 for ; Thu, 19 Jan 2012 12:03:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rGDDdqaiNFV4 for ; Thu, 19 Jan 2012 12:03:24 -0800 (PST) Received: from p02c12o144.mxlogic.net (p02c12o144.mxlogic.net [208.65.145.77]) by ietfa.amsl.com (Postfix) with ESMTP id 24F1B21F86C6 for ; Thu, 19 Jan 2012 12:03:24 -0800 (PST) Received: from unknown [38.97.88.19] (EHLO SYNCORPEXCH01.synbuf.local) by p02c12o144.mxlogic.net(mxl_mta-6.12.0-2) over TLS secured channel with ESMTP id ff6781f4.0.13267.00-361.31717.p02c12o144.mxlogic.net (envelope-from ); Thu, 19 Jan 2012 13:03:24 -0700 (MST) X-MXL-Hash: 4f18770c493b86ed-1b244a4a819248ec068cb09e6ebcabb364a67998 Received: from SYNCORPEXCH01.synbuf.local ([fe80::5cf7:a34f:98:61d4]) by SYNCORPEXCH01.synbuf.local ([fe80::5cf7:a34f:98:61d4%24]) with mapi id 14.01.0355.002; Thu, 19 Jan 2012 15:03:11 -0500 From: Udeme Ukutt To: "asrg@irtf.org" Thread-Topic: RFC 6471 on Overview of Best Email DNS-Based List Thread-Index: AQHM1uVeNBtLjbvKUEm45TeWKEmlwA== Date: Thu, 19 Jan 2012 20:03:10 +0000 Message-ID: <72C04E5250AB6644B516D2E09A878B56035575@SYNCORPEXCH01.synbuf.local> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.17.18.54] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Spam: [F=0.2000000000; CM=0.500; S=0.200(2010122901)] X-MAIL-FROM: X-SOURCE-IP: [38.97.88.19] X-AnalysisOut: [v=1.0 c=1 a=viTJMZCVGM8A:10 a=u_JsY3FXRTIA:10 a=J5m6b7alnJ] X-AnalysisOut: [8A:10 a=BLceEmwcHowA:10 a=kj9zAlcOel0A:10 a=xqWC_Br6kY4A:1] X-AnalysisOut: [0 a=Ob48kErFws5eRw9n/NMDNA==:17 a=YlDpyLmHAAAA:8 a=b6nfwRh] X-AnalysisOut: [kAAAA:8 a=BqEg4_3jAAAA:8 a=8V94xjr4wWhANagRD38A:9 a=FH-L9R] X-AnalysisOut: [O_Ya6E8f7ld2IA:7 a=CjuIK1q_8ugA:10 a=IDBl0eKMknAA:10 a=WZi] X-AnalysisOut: [KUSCcF5cA:10 a=RjwTPiaSbNEA:10 a=1eQkaoUQ5BgA:10] Subject: Re: [Asrg] RFC 6471 on Overview of Best Email DNS-Based List X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Jan 2012 20:03:25 -0000 I just blogged about RFC 6471 as well. Great update to usher in 2012. Udeme=20 -----Original Message----- From: asrg-bounces@irtf.org [mailto:asrg-bounces@irtf.org] On Behalf Of asr= g-request@irtf.org Sent: Thursday, January 19, 2012 3:00 PM To: asrg@irtf.org Subject: Asrg Digest, Vol 88, Issue 1 If you have received this digest without all the individual message attachments you will need to update your digest options in your list subscription. To do so, go to=20 http://www.irtf.org/mailman/listinfo/asrg Click the 'Unsubscribe or edit options' button, log in, and set "Get MIME or Plain Text Digests?" to MIME. You can set this option globally for all the list digests you receive at this point. Send Asrg mailing list submissions to asrg@irtf.org To subscribe or unsubscribe via the World Wide Web, visit http://www.irtf.org/mailman/listinfo/asrg or, via email, send a message with subject or body 'help' to asrg-request@irtf.org You can reach the person managing the list at asrg-owner@irtf.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Asrg digest..." Today's Topics: 1. FW: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices (Murray S. Kucherawy) ---------------------------------------------------------------------- Message: 1 Date: Wed, 18 Jan 2012 19:38:21 -0800 From: "Murray S. Kucherawy" To: Anti-Spam Research Group - IRTF Subject: [Asrg] FW: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices Message-ID: =09 Content-Type: text/plain; charset=3D"us-ascii" FYI -------------- next part -------------- An embedded message was scrubbed... From: "rfc-editor@rfc-editor.org" Subject: RFC 6471 on Overview of Best Email DNS-Based List (DNSBL) Operational Practices Date: Wed, 18 Jan 2012 17:04:37 -0800 Size: 6637 URL: ------------------------------ _______________________________________________ Asrg mailing list Asrg@irtf.org http://www.irtf.org/mailman/listinfo/asrg End of Asrg Digest, Vol 88, Issue 1 *********************************** From martijn.grooten@virusbtn.com Tue Jan 24 07:08:03 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7523D21F851D for ; Tue, 24 Jan 2012 07:08:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.999 X-Spam-Level: X-Spam-Status: No, score=-7.999 tagged_above=-999 required=5 tests=[BAYES_50=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KVHkuxj+PIMb for ; Tue, 24 Jan 2012 07:08:02 -0800 (PST) Received: from mx3.sophos.com (mx3.sophos.com [216.47.234.212]) by ietfa.amsl.com (Postfix) with ESMTP id 0AFF121F8516 for ; Tue, 24 Jan 2012 07:07:59 -0800 (PST) Received: from mx3.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 0A1B5188418 for ; Tue, 24 Jan 2012 15:07:58 +0000 (GMT) Received: from uk-exch1.green.sophos (uk-exch1.green.sophos [10.100.199.16]) by mx3.sophos.com (Postfix) with ESMTPS id 9F6BE188007 for ; Tue, 24 Jan 2012 15:07:57 +0000 (GMT) Received: from UK-EXCHMBX1.green.sophos ([fe80:0000:0000:0000:e1bd:d3c1:23.222.229.221]) by uk-exch1.green.sophos ([10.100.199.16]) with mapi; Tue, 24 Jan 2012 15:07:56 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Date: Tue, 24 Jan 2012 15:07:50 +0000 Thread-Topic: RFC 6471 and "listing the Internet" as a punishment Thread-Index: AczaqfCm88WiqpQtTl2X1A2p94GEgA== Message-ID: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> Accept-Language: en-US, en-GB Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-cr-hashedpuzzle: AWHZ Asi2 CCzA DINn EU3U Elhk FeR+ F+xW HZjn I16t I+M2 JukB KG/B KJnn Kty1 K41O; 1; YQBzAHIAZwBAAGkAcgB0AGYALgBvAHIAZwA=; Sosha1_v1; 7; {708F422B-5387-42B5-8A06-3D36FA6A1428}; bQBhAHIAdABpAGoAbgAuAGcAcgBvAG8AdABlAG4AQAB2AGkAcgB1AHMAYgB0AG4ALgBjAG8AbQA=; Tue, 24 Jan 2012 15:07:50 GMT; UgBGAEMAIAA2ADQANwAxACAAYQBuAGQAIAAiAGwAaQBzAHQAaQBuAGcAIAB0AGgAZQAgAEkAbgB0AGUAcgBuAGUAdAAiACAAYQBzACAAYQAgAHAAdQBuAGkAcwBoAG0AZQBuAHQA x-cr-puzzleid: {708F422B-5387-42B5-8A06-3D36FA6A1428} acceptlanguage: en-US, en-GB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:08:03 -0000 It was nice to see the RFC being published. Good work. Then I came across this: http://blog.vamsoft.com/2012/01/24/ub-black-uribl-com-url-blacklist-started= -to-block-everything/ (Vamsoft ORF is a spam-filter.) Basically uribl.com was returning 127.0.0.1= to _all_ queries from nameservers that are sending high volumes (presumabl= y without paying for it) as some kind of punishment. http://uribl.com/ conf= irms that. Now, as Vamsoft mentions, it is not a good idea to use third-party nameserv= ers on a server you're making DNS requests from. (Although, unlike openDNS,= Google's nameservers do return NXDOMAIN when they can't resolve a domain.)= Moreover, it does seem Google's nameservers are now getting REFUSED as a r= esponse to any uribl.com request. I was just wondering whether the RFC says= anything about this kind of behaviour ('listing' everything as a punishmen= t). To my reading it doesn't. Martijn. Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From skull@bofhland.org Tue Jan 24 07:19:08 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0151C21F8653 for ; Tue, 24 Jan 2012 07:19:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FY5X2eRwLzhi for ; Tue, 24 Jan 2012 07:19:06 -0800 (PST) Received: from mithrandir.bofhland.org (mithrandir.bofhland.org [IPv6:2a02:9a8:94::b]) by ietfa.amsl.com (Postfix) with ESMTP id A8F8521F864A for ; Tue, 24 Jan 2012 07:19:06 -0800 (PST) Received: from zarathustra.local (zarathustra.spin.it [147.123.15.60]) by mithrandir.bofhland.org (Postfix) with ESMTPSA id 2C24A6C21A for ; Tue, 24 Jan 2012 16:19:03 +0100 (CET) Message-ID: <4F1ECBE4.1050802@bofhland.org> Date: Tue, 24 Jan 2012 16:19:00 +0100 From: "Emanuele Balla (aka Skull)" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> In-Reply-To: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> X-Enigmail-Version: 1.3.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:19:08 -0000 On 1/24/12 4:07 PM, Martijn Grooten wrote: > It was nice to see the RFC being published. Good work. > > Then I came across this: > > http://blog.vamsoft.com/2012/01/24/ub-black-uribl-com-url-blacklist-started-to-block-everything/ > > (Vamsoft ORF is a spam-filter.) Basically uribl.com was returning > 127.0.0.1 to _all_ queries from nameservers that are sending high > volumes (presumably without paying for it) as some kind of > punishment. http://uribl.com/ confirms that. > > Now, as Vamsoft mentions, it is not a good idea to use third-party > nameservers on a server you're making DNS requests from. (Although, > unlike openDNS, Google's nameservers do return NXDOMAIN when they > can't resolve a domain.) Moreover, it does seem Google's nameservers > are now getting REFUSED as a response to any uribl.com request. I was > just wondering whether the RFC says anything about this kind of > behaviour ('listing' everything as a punishment). To my reading it > doesn't. > > Martijn. In truth there's in point 3.3: « Note: In Section 3.4, it is noted that some DNSBLs have shut down in such a way to list all of the Internet. Further, in Section 3.5, DNSBL operators MUST NOT list 127.0.0.1. Therefore, a positive listing for 127.0.0.1 SHOULD indicate that the DNSBL has started listing the world and is non-functional. » and again, in point 3.5: « A functioning DNSBL MUST NOT list 127.0.0.1. There are a number of mail server implementations that do not cope with this well, and many will use a positive response for 127.0.0.1 as an indication that the DNSBL is shut down and listing the entire Internet.» That is not clearly against "listing everything as a punishment", but means uribl.com is technically "non-functional"... ;-) -- Paranoia is a disease unto itself. And may I add: the person standing next to you may not be who they appear to be, so take precaution. ----------------------------------------------------------------------------- http://bofhskull.wordpress.com/ From hanov3r@gmail.com Tue Jan 24 07:28:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AA3F21F8665 for ; Tue, 24 Jan 2012 07:28:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DaEQR2DvF11Z for ; Tue, 24 Jan 2012 07:28:31 -0800 (PST) Received: from mail-vx0-f182.google.com (mail-vx0-f182.google.com [209.85.220.182]) by ietfa.amsl.com (Postfix) with ESMTP id 7D0BD21F865C for ; Tue, 24 Jan 2012 07:28:31 -0800 (PST) Received: by vcbfl17 with SMTP id fl17so4236120vcb.13 for ; Tue, 24 Jan 2012 07:28:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=H2WQuy0kFgAAZ61u9OWxBbtl4AXCevWj7EG+t/cc214=; b=YueZzBFjB0/igXBdH/ITNP843DmLmyrHMDsPx3ENKHf7Tpkvkoi+S1uiKO/YwtGYoM 2StXBXeaDjOViofNDs6I40WvunRageHxxmTlLKZT9FomRYG65niuBTvgfUmHGd/Pp07X kND59vVdxGcm4Cu2ZP0NakydKcpCLQ5Ecpgok= Received: by 10.220.38.5 with SMTP id z5mr7368207vcd.63.1327418910792; Tue, 24 Jan 2012 07:28:30 -0800 (PST) Received: from h111.home.com (c-68-81-175-116.hsd1.pa.comcast.net. [68.81.175.116]) by mx.google.com with ESMTPS id fj4sm14589633vdb.22.2012.01.24.07.28.27 (version=SSLv3 cipher=OTHER); Tue, 24 Jan 2012 07:28:29 -0800 (PST) Message-ID: <4F1ECE0D.1090702@gmail.com> Date: Tue, 24 Jan 2012 10:28:13 -0500 From: David Romerstein User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> In-Reply-To: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:28:32 -0000 On 1/24/12 10:07 AM, Martijn Grooten wrote: > I was just wondering whether the RFC says anything about this kind of behaviour ('listing' everything as a punishment). To my reading it doesn't. Only thing in the RFC close to this is 3.4, regarding shutting down gracefully (MUST NOT list the entire Internet). Listing the world for folks overloading your system is unlikely to have the effect that you want, and is most likely going to impact folks who have no say in the configuration of the receiving mail server. -- D, who was just investigating a spate of URIBL-related blocks yesterday... From hanov3r@gmail.com Tue Jan 24 07:29:39 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 031AA21F86BB for ; Tue, 24 Jan 2012 07:29:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hWtzFrWaaK5w for ; Tue, 24 Jan 2012 07:29:38 -0800 (PST) Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by ietfa.amsl.com (Postfix) with ESMTP id 76F2D21F8678 for ; Tue, 24 Jan 2012 07:29:38 -0800 (PST) Received: by vbbfa15 with SMTP id fa15so1022282vbb.13 for ; Tue, 24 Jan 2012 07:29:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=WlVnLIgLo+3Y9Ju/ACyAkjyH0TNc6C7vyoUXTHdh11Q=; b=NGnHSiFBVeOZ7o2WTVjbctpratGyPCbrCdBMBhQsZbcl6ReEadXvKOaNtb/tgttQfZ t3GsTxs9zPWf/QyJGdiiSObC0eQWBUuABDl5EWxcQK91qDL+gPw7qqmA/6lFxRtbTL3y 9oBnNLjYc3mjYHXdfDH8P0NKEbEkXsf07Q3hg= Received: by 10.52.173.52 with SMTP id bh20mr6544536vdc.9.1327418977861; Tue, 24 Jan 2012 07:29:37 -0800 (PST) Received: from h111.home.com (c-68-81-175-116.hsd1.pa.comcast.net. [68.81.175.116]) by mx.google.com with ESMTPS id ga9sm14606364vdc.15.2012.01.24.07.29.34 (version=SSLv3 cipher=OTHER); Tue, 24 Jan 2012 07:29:37 -0800 (PST) Message-ID: <4F1ECE5A.5090500@gmail.com> Date: Tue, 24 Jan 2012 10:29:30 -0500 From: David Romerstein User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> In-Reply-To: <4F1ECBE4.1050802@bofhland.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:29:39 -0000 On 1/24/12 10:19 AM, Emanuele Balla (aka Skull) wrote: > In truth there's > in point 3.3: > > « Note: In Section 3.4, it is noted that some DNSBLs have shut down in > such a way to list all of the Internet. Further, in Section 3.5, > DNSBL operators MUST NOT list 127.0.0.1. Therefore, a positive > listing for 127.0.0.1 SHOULD indicate that the DNSBL has started > listing the world and is non-functional. » > > and again, in point 3.5: > > « A functioning DNSBL MUST NOT list 127.0.0.1. There are a number of > mail server implementations that do not cope with this well, and many > will use a positive response for 127.0.0.1 as an indication that the > DNSBL is shut down and listing the entire Internet.» "Listing 127.0.0.1" is not the same as "returning 127.0.0.1". -- D From skull@bofhland.org Tue Jan 24 07:30:41 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02DB721F86CB for ; Tue, 24 Jan 2012 07:30:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ct+TdjPhvJQQ for ; Tue, 24 Jan 2012 07:30:40 -0800 (PST) Received: from mithrandir.bofhland.org (mithrandir.bofhland.org [IPv6:2a02:9a8:94::b]) by ietfa.amsl.com (Postfix) with ESMTP id 43BFE21F8678 for ; Tue, 24 Jan 2012 07:30:40 -0800 (PST) Received: from zarathustra.local (zarathustra.spin.it [147.123.15.60]) by mithrandir.bofhland.org (Postfix) with ESMTPSA id F26396C21A for ; Tue, 24 Jan 2012 16:30:38 +0100 (CET) Message-ID: <4F1ECE9C.1030806@bofhland.org> Date: Tue, 24 Jan 2012 16:30:36 +0100 From: "Emanuele Balla (aka Skull)" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <4F1ECE5A.5090500@gmail.com> In-Reply-To: <4F1ECE5A.5090500@gmail.com> X-Enigmail-Version: 1.3.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:30:41 -0000 On 1/24/12 4:29 PM, David Romerstein wrote: > On 1/24/12 10:19 AM, Emanuele Balla (aka Skull) wrote: >> In truth there's >> in point 3.3: >> >> « Note: In Section 3.4, it is noted that some DNSBLs have shut down in >> such a way to list all of the Internet. Further, in Section 3.5, >> DNSBL operators MUST NOT list 127.0.0.1. Therefore, a positive >> listing for 127.0.0.1 SHOULD indicate that the DNSBL has started >> listing the world and is non-functional. » >> >> and again, in point 3.5: >> >> « A functioning DNSBL MUST NOT list 127.0.0.1. There are a number of >> mail server implementations that do not cope with this well, and many >> will use a positive response for 127.0.0.1 as an indication that the >> DNSBL is shut down and listing the entire Internet.» > > "Listing 127.0.0.1" is not the same as "returning 127.0.0.1". Damm. FAIL. :-D -- Paranoia is a disease unto itself. And may I add: the person standing next to you may not be who they appear to be, so take precaution. ----------------------------------------------------------------------------- http://bofhskull.wordpress.com/ From rsk@gsp.org Tue Jan 24 07:35:55 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3802921F84DC for ; Tue, 24 Jan 2012 07:35:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iOUFMSgNk2kK for ; Tue, 24 Jan 2012 07:35:51 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id D51F421F84BF for ; Tue, 24 Jan 2012 07:35:50 -0800 (PST) Received: from squonk.gsp.org (bltmd-207.114.17.210.dsl.charm.net [207.114.17.210]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id q0OFZnDd018771 for ; Tue, 24 Jan 2012 10:35:50 -0500 (EST) Received: from vorlon.gsp.org (vorlon.gsp.org [192.168.0.20]) by squonk.gsp.org (8.14.3/8.14.3) with ESMTP id q0OFikZm008360 for ; Tue, 24 Jan 2012 10:44:46 -0500 (EST) Received: from localhost6.localdomain6 (localhost.localdomain [127.0.0.1]) by vorlon.gsp.org (8.14.3/8.14.3/Debian-9.2ubuntu1) with ESMTP id q0OFZbsr008482 for ; Tue, 24 Jan 2012 10:35:37 -0500 Received: (from rsk@localhost) by localhost6.localdomain6 (8.14.3/8.14.3/Submit) id q0OFZXC0008481 for asrg@irtf.org; Tue, 24 Jan 2012 10:35:33 -0500 Date: Tue, 24 Jan 2012 10:35:33 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20120124153531.GA8414@gsp.org> References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4F1ECBE4.1050802@bofhland.org> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:35:55 -0000 On Tue, Jan 24, 2012 at 04:19:00PM +0100, Emanuele Balla (aka Skull) wrote: > and again, in point 3.5: > > ? A functioning DNSBL MUST NOT list 127.0.0.1. There are a number of > mail server implementations that do not cope with this well, and many > will use a positive response for 127.0.0.1 as an indication that the > DNSBL is shut down and listing the entire Internet.? > > That is not clearly against "listing everything as a punishment", but > means uribl.com is technically "non-functional"... ;-) I may well be misreading this report AND the RFC (coffee level: alarmingly low) but it appears to me that this DNSBL is not listing "127.0.0.1", but is returning 127.0.0.1 in response to queries for "example.com" (and all other domains) when those queries are issued from certain hosts. (And I presume those hosts are the set which have issued excessive and/or unwelcome queries in the opinions of the DNSBL's operators.) ---rsk From skull@bofhland.org Tue Jan 24 07:52:49 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F158B21F84DD for ; Tue, 24 Jan 2012 07:52:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_LETTER=-2] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fLuYEU4x413Q for ; Tue, 24 Jan 2012 07:52:48 -0800 (PST) Received: from mithrandir.bofhland.org (mithrandir.bofhland.org [IPv6:2a02:9a8:94::b]) by ietfa.amsl.com (Postfix) with ESMTP id 21F0B21F84BD for ; Tue, 24 Jan 2012 07:52:48 -0800 (PST) Received: from zarathustra.local (zarathustra.spin.it [147.123.15.60]) by mithrandir.bofhland.org (Postfix) with ESMTPSA id 9947C6C21A for ; Tue, 24 Jan 2012 16:52:46 +0100 (CET) Message-ID: <4F1ED3CA.5040200@bofhland.org> Date: Tue, 24 Jan 2012 16:52:42 +0100 From: "Emanuele Balla (aka Skull)" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <20120124153531.GA8414@gsp.org> In-Reply-To: <20120124153531.GA8414@gsp.org> X-Enigmail-Version: 1.3.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 15:52:49 -0000 On 1/24/12 4:35 PM, Rich Kulawiec wrote: > On Tue, Jan 24, 2012 at 04:19:00PM +0100, Emanuele Balla (aka Skull) wrote: >> and again, in point 3.5: >> >> ? A functioning DNSBL MUST NOT list 127.0.0.1. There are a number of >> mail server implementations that do not cope with this well, and many >> will use a positive response for 127.0.0.1 as an indication that the >> DNSBL is shut down and listing the entire Internet.? >> >> That is not clearly against "listing everything as a punishment", but >> means uribl.com is technically "non-functional"... ;-) > > I may well be misreading this report AND the RFC (coffee level: alarmingly > low) but it appears to me that this DNSBL is not listing "127.0.0.1", > but is returning 127.0.0.1 in response to queries for "example.com" > (and all other domains) when those queries are issued from certain hosts. > (And I presume those hosts are the set which have issued excessive > and/or unwelcome queries in the opinions of the DNSBL's operators.) You (and David) are absolutely right: I simply messed up the whole point. ;-) The only point that directly applies, here, is IMHO 3.3: « 3.3. DNSBLs SHOULD Provide Operational Flags Most IP address-based DNSBLs follow a convention of query entries for IP addresses in 127.0.0.0/8 (127.0.0.0-127.255.255.255) to provide online indication of whether the DNSBL is operational. Many, if not most, DNSBLs arrange to have a query of 127.0.0.2 return an A record (usually 127.0.0.2) indicating that the IP address is listed. This appears to be a de facto standard indicating that the DNSBL is operating correctly. See [RFC5782] for more details on DNSBL test entries. If this indicator is missing (query of 127.0.0.2 returns NXDOMAIN), or any query returns an A record outside of 127.0.0.0/8, the DNSBL should be considered non-functional. » Somehow, this seems to allow URIBL to do what it does: they state that returning 127.0.0.1 means you're an undesired client and you have the chance to trap that flag (with the right software, at least)... On the other side, there's point 3.4: « The DNSBL operator MUST issue impending shutdown warnings (on the DNSBL web site, appropriate mailing lists, newsgroups, vendor newsletters, etc.), and indicate that the DNSBL is inoperative using the signaling given in Section 3.3. [...] The shutdown procedure should have the following properties: 1. MUST NOT list the entire Internet » One could argue they're not shutting down (just listing the Internet :-D) so the point does not apply, but IMHO the underlying concept is. After all, they're trying to force the offending customers to change their configurations, just as during shutdowns... -- Paranoia is a disease unto itself. And may I add: the person standing next to you may not be who they appear to be, so take precaution. ----------------------------------------------------------------------------- http://bofhskull.wordpress.com/ From darxus@chaosreigns.com Tue Jan 24 10:23:54 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB01011E80AB for ; Tue, 24 Jan 2012 10:23:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.671 X-Spam-Level: X-Spam-Status: No, score=-1.671 tagged_above=-999 required=5 tests=[AWL=-0.929, BAYES_20=-0.74, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LMznzzcVBHKH for ; Tue, 24 Jan 2012 10:23:54 -0800 (PST) Received: from panic.chaosreigns.com (panic.chaosreigns.com [IPv6:2001:470:1f05:1b8a::1]) by ietfa.amsl.com (Postfix) with ESMTP id 33A3F11E80A6 for ; Tue, 24 Jan 2012 10:23:54 -0800 (PST) Received: by panic.chaosreigns.com (Postfix, from userid 1000) id D0C5E4C6A49; Tue, 24 Jan 2012 13:23:49 -0500 (EST) Date: Tue, 24 Jan 2012 13:23:49 -0500 From: darxus@chaosreigns.com To: asrg@irtf.org Message-ID: <20120124182349.GR27359@chaosreigns.com> References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <20120124153531.GA8414@gsp.org> <4F1ED3CA.5040200@bofhland.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4F1ED3CA.5040200@bofhland.org> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 18:23:55 -0000 As I tried to say in the past, having a value to return for all queries from a DNS server that has been deemed abusive is *useful* to black/whitelist providers. Enough that it's looking like it'll be done whether the ASRG likes it or not. If you'd prefer something other than 127.0.0.1 to be used, document it somewhere. Also, as the linked article said, "...the 127.0.0.1 response indicates that uribl.com does not accept any queries from the DNS server". SpamAssassin had this handled as URIBL defined, no false positives resulted. -- "Go forth, and be excellent to one another." - http://www.jhuger.com/fredski.php http://www.ChaosReigns.com From hanov3r@gmail.com Tue Jan 24 10:33:21 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A617011E8088 for ; Tue, 24 Jan 2012 10:33:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jVftecgc7JrI for ; Tue, 24 Jan 2012 10:33:21 -0800 (PST) Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by ietfa.amsl.com (Postfix) with ESMTP id 134A111E809D for ; Tue, 24 Jan 2012 10:33:20 -0800 (PST) Received: by vbbfa15 with SMTP id fa15so1260406vbb.13 for ; Tue, 24 Jan 2012 10:33:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=TGAXgJpwZx3OLk8Ht1C11DHR5L96y9Kg9+k4hseE2LI=; b=beR+2EUxFdDx29PhPD6UbG0Q/nqKOYasmAvd2nFE7J99fbJXRRGwNXQ44xkBX6zJpJ HFjKRoOpkGaeI084mq1u1KoAzKEErhda9rwULDuNSyGh31951HabmffFhMHHbiVG1rl9 hCVr93aGwoBBxU4lb5tcuIEPVGNfIfKgO1z4k= Received: by 10.52.76.196 with SMTP id m4mr6669832vdw.112.1327430000329; Tue, 24 Jan 2012 10:33:20 -0800 (PST) Received: from h111.home.com (c-68-81-175-116.hsd1.pa.comcast.net. [68.81.175.116]) by mx.google.com with ESMTPS id eh3sm15285682vdc.2.2012.01.24.10.33.18 (version=SSLv3 cipher=OTHER); Tue, 24 Jan 2012 10:33:19 -0800 (PST) Message-ID: <4F1EF96D.8010708@gmail.com> Date: Tue, 24 Jan 2012 13:33:17 -0500 From: David Romerstein User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <20120124153531.GA8414@gsp.org> <4F1ED3CA.5040200@bofhland.org> <20120124182349.GR27359@chaosreigns.com> In-Reply-To: <20120124182349.GR27359@chaosreigns.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 18:33:21 -0000 On 1/24/12 1:23 PM, darxus@chaosreigns.com wrote: > As I tried to say in the past, having a value to return for all > queries from a DNS server that has been deemed abusive is *useful* to > black/whitelist providers. Enough that it's looking like it'll be done > whether the ASRG likes it or not. If you'd prefer something other than > 127.0.0.1 to be used, document it somewhere. Following with RFC 6471, would it be possible to do a split zone (abusive/non-abusive), sending abusive IPs to do their loopups from IP addresses in TEST-NET RFC-5735 addresses? -- D From johnl@iecc.com Tue Jan 24 10:46:48 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D74F21F84B2 for ; Tue, 24 Jan 2012 10:46:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.792 X-Spam-Level: X-Spam-Status: No, score=-108.792 tagged_above=-999 required=5 tests=[AWL=1.907, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, URI_NOVOWEL=0.5, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fFP-gkz-jCUq for ; Tue, 24 Jan 2012 10:46:48 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id E5BB621F84C5 for ; Tue, 24 Jan 2012 10:46:47 -0800 (PST) Received: (qmail 2771 invoked from network); 24 Jan 2012 18:46:41 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 24 Jan 2012 18:46:41 -0000 Date: 24 Jan 2012 18:46:19 -0000 Message-ID: <20120124184619.98520.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <4F1EF96D.8010708@gmail.com> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 18:46:48 -0000 >Following with RFC 6471, would it be possible to do a split zone >(abusive/non-abusive), sending abusive IPs to do their loopups from IP >addresses in TEST-NET RFC-5735 addresses? In principle, although it's a little tricky since the setup is usually something like this: (at TLD) example.net NS foo.example.net <-- main name server that does split horizon (at foo.example.net) dnsbl.example.net NS rbldnsd.example.net <-- the server that's getting hammered So the server that's getting overloaded has to tell the server above what lies to tell. R's, John From johnl@iecc.com Tue Jan 24 10:50:08 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FDB811E8079 for ; Tue, 24 Jan 2012 10:50:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.429 X-Spam-Level: X-Spam-Status: No, score=-102.429 tagged_above=-999 required=5 tests=[AWL=0.171, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KHLvZ7DfhnQ8 for ; Tue, 24 Jan 2012 10:50:07 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 56D6111E8075 for ; Tue, 24 Jan 2012 10:50:07 -0800 (PST) Received: (qmail 4982 invoked from network); 24 Jan 2012 18:50:06 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:mime-version:content-type:vbr-info:user-agent:cleverness; s=1374.4f1efd5e.k1201; bh=HcpVroQVO6kFodQO/G/tkz8Om8vaSJNAQ1K1DLtZ/vQ=; b=pfRDvbnKeU21eKDkBeAUsHukSIrfPnBMJ88gnMZnaT0g3aANqUqWh0HpUDVqkZQe5enDAKUiCpazQwJbHasneE18ZZQLOXKMYjPI9x2EPlN1V8bljLo1s1BBGYbiHUtxX3PdQYtlNpiuMUpLvBC65hJGYhpOhUqk4V2MEcFFDoo= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Received: (ofmipd 127.0.0.1) with (DHE-RSA-AES256-SHA encrypted) SMTP; 24 Jan 2012 18:49:44 -0000 Date: 24 Jan 2012 13:50:04 -0500 Message-ID: From: "John R. Levine" To: "Anti Spam Research Group" User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 18:50:08 -0000 >Listing the world for folks overloading your system is unlikely to have >the effect that you want, and is most likely going to impact folks who >have no say in the configuration of the receiving mail server. You may be right, but I have to have some sympathy for BL operators who are getting bombed by clueless misconfigurations. Last month the abuse.net lookup stopped working, and after poking around, I saw that there was an enormous stream of A record queries from Marc Perkel's spam filtering company. They were clearly stupid, since you need to do a TXT lookup to find out what the abuse.net contacts are, and he wasn't doing any of those, apparently under the misconception that abuse.net is some kind of BL. I've had similar problems in the past with systems in Brazil that bombed korea.services.net. Although I agree that it is anti-social to list the world for every query, I'm less sure about individual query sources that are mishehaving. In the case of abuse.net, the A records are all non-zero anyway (the value is the number of TXT records it'll return, to help debug clients that have trouble with multiple TXT records), so I experimented for a while with different return values to try to get his attention, then finally gave up and put in a packet filter. If it becomes more of a problem, my main DNS servers can do split horizon DNS, so it'd probably be more effective to return NS records pointing to loopback addresses or the like. R's, John From hanov3r@gmail.com Tue Jan 24 10:59:49 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B12E21F851B for ; Tue, 24 Jan 2012 10:59:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vEnnAA138NYW for ; Tue, 24 Jan 2012 10:59:48 -0800 (PST) Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by ietfa.amsl.com (Postfix) with ESMTP id BE4BA21F851A for ; Tue, 24 Jan 2012 10:59:48 -0800 (PST) Received: by vbbfa15 with SMTP id fa15so1289652vbb.13 for ; Tue, 24 Jan 2012 10:59:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=doKF58TUPyyfK02ognLiDRf+G/nhtclmZ0nfUSn8SPU=; b=id429poC23g209w6OGzULqrZVpcQAxDYXoSa3LLF6FubM1lVNLkTf6uK2sOymVSs72 LkIYeEJVZiF95hnkHhJ49IdOibd7uTmnQRziJUsDCfzrOz5tZsUqMQZkvKrLf2AmcCHz z3SHYXZmcMouJGh0/oYA6PRFhFDV+OWh2H02w= Received: by 10.52.174.51 with SMTP id bp19mr6344634vdc.102.1327431588328; Tue, 24 Jan 2012 10:59:48 -0800 (PST) Received: from h111.home.com (c-68-81-175-116.hsd1.pa.comcast.net. [68.81.175.116]) by mx.google.com with ESMTPS id jr10sm15312669vdb.14.2012.01.24.10.59.46 (version=SSLv3 cipher=OTHER); Tue, 24 Jan 2012 10:59:47 -0800 (PST) Message-ID: <4F1EFFA1.1050505@gmail.com> Date: Tue, 24 Jan 2012 13:59:45 -0500 From: David Romerstein User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 18:59:49 -0000 On 1/24/12 1:50 PM, John R. Levine wrote: >> Listing the world for folks overloading your system is unlikely to have >> the effect that you want, and is most likely going to impact folks who >> have no say in the configuration of the receiving mail server. > > You may be right, but I have to have some sympathy for BL operators who > are getting bombed by clueless misconfigurations. I do not, in any way, disagree with this. I'm just wondering if there's a middle ground that can stop BL operators from being abused by (willfully or unwillfully) clueless folks without severely impacting innocent users. Something more than "just sit back and take all those stupid queries" and less than "return a response code that could indicate a listing for every one of those stupid queries". -- D From steve@blighty.com Tue Jan 24 11:14:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 695E711E8095 for ; Tue, 24 Jan 2012 11:14:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.11 X-Spam-Level: X-Spam-Status: No, score=-1.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DnG1fn2w4l3l for ; Tue, 24 Jan 2012 11:14:45 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id 8D40611E8087 for ; Tue, 24 Jan 2012 11:14:45 -0800 (PST) Received: from platter.wordtothewise.com (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id 526102DECF for ; Tue, 24 Jan 2012 11:14:42 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1251.1) From: Steve Atkins In-Reply-To: <4F1EFFA1.1050505@gmail.com> Date: Tue, 24 Jan 2012 11:14:41 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <44A1729E-13D7-4069-B464-403CCACF17F0@blighty.com> References: <4F1EFFA1.1050505@gmail.com> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1251.1) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 19:14:46 -0000 On Jan 24, 2012, at 10:59 AM, David Romerstein wrote: > On 1/24/12 1:50 PM, John R. Levine wrote: >>> Listing the world for folks overloading your system is unlikely to = have >>> the effect that you want, and is most likely going to impact folks = who >>> have no say in the configuration of the receiving mail server. >>=20 >> You may be right, but I have to have some sympathy for BL operators = who >> are getting bombed by clueless misconfigurations. >=20 > I do not, in any way, disagree with this. >=20 > I'm just wondering if there's a middle ground that can stop BL = operators from being abused by (willfully or unwillfully) clueless folks = without severely impacting innocent users. Something more than "just sit = back and take all those stupid queries" and less than "return a response = code that could indicate a listing for every one of those stupid = queries". The innocent users are the people who are abusing the blacklist and = those who send email to them. And most of them are using blacklist data = for scoring, not for blocking. Listing the world doesn't usually affect = them much at all. There really isn't much of a middle ground. If you have non-broken = software querying the blacklist then there aren't any problems - it'll = shut down gracefully when the blacklist goes away. But if the software = querying the blacklist doesn't do that (and almost everything deployed = is broken in that way) then you really only have three options as a = blacklist operator: 1. List nothing 2. List everything 3. List things at random (1) leads to no change, you get to keep fielding bogus DNS requests = until the end of time. (2) causes immediate change at abusers who are using the blacklist to = block email, and maximises the chance of someone using the data as part = of a scoring based system noticing (3) is worse than either, as it will potentially cause some mail to be = lost but is much less likely to cause people to stop using the list This isn't a trivial problem, nor a trivial amount of traffic. In the = past, I've had service overages of >$2000/mo due to massive DNSBL = traffic to cbl.abuseat.com (which isn't a DNSBL, so returns "not listed" = for every query). I'm currently eating quite amazing amounts of misconfigured CBL lookup = traffic (hundreds of different ways to misspell cbl.abuseat.org) - and = configuring my zones to list everything still doesn't stop the traffic. = I've played with long TTL delegations to non-routable addresses and = suchlike, and it doesn't have much effect either. At some point I'll = probably start running a "stunt" server rather than powerdns for that = zone, and be more creative with how I handle the abusive queries. Cheers, Steve From prvs=137066d255=lists@hireahit.com Tue Jan 24 11:44:19 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58C7121F854F for ; Tue, 24 Jan 2012 11:44:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UMmOVpfrGvGW for ; Tue, 24 Jan 2012 11:44:18 -0800 (PST) Received: from vinny.hireahit.com (vinny.hireahit.com [72.51.42.137]) by ietfa.amsl.com (Postfix) with ESMTP id 574B921F854C for ; Tue, 24 Jan 2012 11:44:18 -0800 (PST) Received: from [172.24.0.104] by hireahit.com (vinny.hireahit.com) (SecurityGateway 2.0.7) with SMTP id SG001546069.MSG for ; Tue, 24 Jan 2012 11:44:10 -0800 Message-ID: <4F1F0A11.40104@hireahit.com> Date: Tue, 24 Jan 2012 11:44:17 -0800 From: Dave Warren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20120118 Thunderbird/10.0 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECE0D.1090702@gmail.com> In-Reply-To: <4F1ECE0D.1090702@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SGOP-RefID: fgs=0 (_st=1 _vt=0 _iwf=0) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 19:44:19 -0000 On 1/24/2012 7:28 AM, David Romerstein wrote: > Listing the world for folks overloading your system is unlikely to > have the effect that you want, and is most likely going to impact > folks who have no say in the configuration of the receiving mail server. It will, however, impact folks who know how to get in touch with whoever does have a say in the configuration of said mail server. It's not spectacularly ideal, but lacking in some way to tell the software to reconfigure itself, it's sometimes the only way to get attention. -- Dave Warren, CEO Hire A Hit Consulting Services http://ca.linkedin.com/in/davejwarren From skull@bofhland.org Tue Jan 24 11:51:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1869111E8079 for ; Tue, 24 Jan 2012 11:51:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.932 X-Spam-Level: X-Spam-Status: No, score=-2.932 tagged_above=-999 required=5 tests=[AWL=-0.333, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kv2+MPTDVWJO for ; Tue, 24 Jan 2012 11:51:03 -0800 (PST) Received: from mithrandir.bofhland.org (mithrandir.bofhland.org [IPv6:2a02:9a8:94::b]) by ietfa.amsl.com (Postfix) with ESMTP id 2798011E8072 for ; Tue, 24 Jan 2012 11:51:02 -0800 (PST) Received: from enlil.local (baggins.skullkrusher.net [147.123.72.2]) by mithrandir.bofhland.org (Postfix) with ESMTPSA id B667B6C21A for ; Tue, 24 Jan 2012 20:51:01 +0100 (CET) Message-ID: <4F1F0BA3.6080805@bofhland.org> Date: Tue, 24 Jan 2012 20:50:59 +0100 From: "Emanuele Balla (aka Skull)" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <20120124153531.GA8414@gsp.org> <4F1ED3CA.5040200@bofhland.org> <20120124182349.GR27359@chaosreigns.com> In-Reply-To: <20120124182349.GR27359@chaosreigns.com> X-Enigmail-Version: 1.3.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 19:51:04 -0000 On 1/24/12 7:23 PM, darxus@chaosreigns.com wrote: > As I tried to say in the past, having a value to return for all > queries from a DNS server that has been deemed abusive is *useful* to > black/whitelist providers. Enough that it's looking like it'll be done > whether the ASRG likes it or not. If you'd prefer something other than > 127.0.0.1 to be used, document it somewhere. I fully agree with you, FWIW... > Also, as the linked article said, "...the 127.0.0.1 response indicates > that uribl.com does not accept any queries from the DNS server". > SpamAssassin had this handled as URIBL defined, no false positives > resulted. Yes, and somehow that's the point: SW (like spamassassin) that deal with return values correctly, will not encounter FPs but this means it also gives the BL operator no advantage. While any other return value outside 127/8, while more opportune, probably will affect bad implementations like 127.0.0.1 or any other code. IMHO there's no winner here... From derek.diget+asrg@wmich.edu Tue Jan 24 13:09:13 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3784321F8659 for ; Tue, 24 Jan 2012 13:09:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oCSB1dCLRgtt for ; Tue, 24 Jan 2012 13:09:11 -0800 (PST) Received: from mx-tmp.wmich.edu (mx-tmp.wmich.edu [141.218.1.43]) by ietfa.amsl.com (Postfix) with ESMTP id 9A21921F8652 for ; Tue, 24 Jan 2012 13:09:10 -0800 (PST) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: TEXT/PLAIN; charset=US-ASCII Received: from spaz.oit.wmich.edu (spaz.oit.wmich.edu [141.218.24.51]) by mta01.service.private (Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008; 64bit)) with ESMTPSA id <0LYB006L1MR6HK60@mta01.service.private> for asrg@irtf.org; Tue, 24 Jan 2012 16:09:07 -0500 (EST) X-WMU-Spam: Gauge=X, Probability=10% on Tue Jan 24 16:09:07 2012, Report=' WMU_MSA_SMTP+ 0, TO_IN_SUBJECT 0.5, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1800_1899 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, FROM_EDU_TLD 0, SPF_NEUTRAL 0, __ANY_URI 0, __BOUNCE_CHALLENGE_SUBJ 0, __BOUNCE_NDR_SUBJ_EXEMPT 0, __CT 0, __CT_TEXT_PLAIN 0, __HAS_MSGID 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __PHISH_SPEAR_STRUCTURE_1 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __URI_NO_PATH 0, __URI_NS ' X-WMU-PMX-Version: 5.5.9.395186, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.1.24.205714 - Tue Jan 24 16:09:07 2012 Date: Tue, 24 Jan 2012 16:09:06 -0500 (EST) From: Derek Diget X-X-Sender: diget@spaz.oit.wmich.edu To: Anti-Spam Research Group - IRTF In-reply-to: <4F1F0BA3.6080805@bofhland.org> Message-id: References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <20120124153531.GA8414@gsp.org> <4F1ED3CA.5040200@bofhland.org> <20120124182349.GR27359@chaosreigns.com> <4F1F0BA3.6080805@bofhland.org> Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 21:09:13 -0000 On Jan 24, 2012 at 20:50 +0100, Emanuele Balla (aka Skull) wrote: =>On 1/24/12 7:23 PM, darxus@chaosreigns.com wrote: =>> As I tried to say in the past, having a value to return for all =>> queries from a DNS server that has been deemed abusive is *useful* to =>> black/whitelist providers. Enough that it's looking like it'll be done =>> whether the ASRG likes it or not. If you'd prefer something other than =>> 127.0.0.1 to be used, document it somewhere. => =>I fully agree with you, FWIW... => => =>> Also, as the linked article said, "...the 127.0.0.1 response indicates =>> that uribl.com does not accept any queries from the DNS server". =>> SpamAssassin had this handled as URIBL defined, no false positives =>> resulted. => =>Yes, and somehow that's the point: SW (like spamassassin) that deal with =>return values correctly, will not encounter FPs but this means it also =>gives the BL operator no advantage. => =>While any other return value outside 127/8, while more opportune, =>probably will affect bad implementations like 127.0.0.1 or any other code. ASRG List, See the SpamAssassin bugs ids related to this issue from just a few weeks ago. Bug 6724 - DNSxL returning purposefully wrong answers as part of Anti-Abuse / Free for Some Policies Bug 6728 - DNSBLs need a way to turn off queries based on BLOCKED rules triggering -- *********************************************************************** Derek Diget Office of Information Technology Western Michigan University - Kalamazoo Michigan USA - www.wmich.edu/ *********************************************************************** From clewis+ietf@mustelids.ca Tue Jan 24 13:42:13 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF10621F8637 for ; Tue, 24 Jan 2012 13:42:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.336 X-Spam-Level: X-Spam-Status: No, score=-0.336 tagged_above=-999 required=5 tests=[AWL=0.712, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id icZ4l7+HsCYb for ; Tue, 24 Jan 2012 13:42:13 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 06EB221F8531 for ; Tue, 24 Jan 2012 13:42:12 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.3/8.14.3/Debian-9.1ubuntu1) with ESMTP id q0OLg5I4009440 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 24 Jan 2012 16:42:07 -0500 Message-ID: <4F1F25AD.7040908@mustelids.ca> Date: Tue, 24 Jan 2012 16:42:05 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <4F1ECBE4.1050802@bofhland.org> <20120124153531.GA8414@gsp.org> <4F1ED3CA.5040200@bofhland.org> <20120124182349.GR27359@chaosreigns.com> In-Reply-To: <20120124182349.GR27359@chaosreigns.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jan 2012 21:42:14 -0000 On 12-01-24 01:23 PM, darxus@chaosreigns.com wrote: > As I tried to say in the past, having a value to return for all > queries from a DNS server that has been deemed abusive is *useful* to > black/whitelist providers. Enough that it's looking like it'll be done > whether the ASRG likes it or not. If you'd prefer something other than > 127.0.0.1 to be used, document it somewhere. As I've said more than once, there are two methods of doing it documented already that are preferable to listing the world: - return TEST NET DNS server addresses, OR - return something outside of 127.0.0.0/8 The first one has the advantage of doing something useful EVEN IF the DNSBL client has never heard of RFC6471. From sm@resistor.net Wed Jan 25 10:39:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0F9B21F85E4 for ; Wed, 25 Jan 2012 10:39:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.623 X-Spam-Level: X-Spam-Status: No, score=-102.623 tagged_above=-999 required=5 tests=[AWL=-0.024, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fbErHtDAZY-D for ; Wed, 25 Jan 2012 10:39:02 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 22AB221F85D5 for ; Wed, 25 Jan 2012 10:39:02 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id q0PIcnBE013972 for ; Wed, 25 Jan 2012 10:38:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1327516734; i=@resistor.net; bh=0foDof4qR6uG0wAp2j9+640o9ccRRTfLOIlLHWVlfFI=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=MIq55/3+EBrp1OhsEo6dwI7VrI9CYDBLYuK3TSldnpZ+vF9xYKdoDmmqtMDyLTFPd E5FQ5SG+7w5k/PM+24o7Z1owFmxU2H/EIv7pZOUgROcVD9v+Cyz7Wqc8bwwa33eKpB y5qSD0jB+58M1bpCIu0DAZ0Va+DvX8KtM/4D7lJg= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1327516734; i=@resistor.net; bh=0foDof4qR6uG0wAp2j9+640o9ccRRTfLOIlLHWVlfFI=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=XPJlNqJPx0gd2sQYKO6YEoFHoQaiPe8NsLc+t6d4AoVRISNj7lkjPErCr1HTjulC0 3qduoX+WCTqWEFE6o/uETr7RiyvaFSYKlKFWdn/NsnXHRv4efIw+Vj5mCVJTRP3BQq IkortlEiNLBA4bz9v6qG+k4UPfAfvPIA98YJUl4s= Message-Id: <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Wed, 25 Jan 2012 10:37:52 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.gre en.sophos> References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jan 2012 18:39:04 -0000 At 07:07 24-01-2012, Martijn Grooten wrote: >(Vamsoft ORF is a spam-filter.) Basically uribl.com was returning >127.0.0.1 to _all_ queries from nameservers that are sending high >volumes (presumably without paying for it) as some kind of >punishment. http://uribl.com/ confirms that. "After investigating this further, it seems the affected ORF users all use Google public DNS servers for the queries (or use such servers as forwarders in their local DNS configuration)." Anyone using open recursive DNS servers or their ISP's DNS server for DNSBL queries is asking for trouble. The listing is to get the attention of the sender. It's "antisocial". Regards, -sm From prvs=137146ef3e=lists@hireahit.com Wed Jan 25 11:23:36 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8518121F853F for ; Wed, 25 Jan 2012 11:23:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.854 X-Spam-Level: X-Spam-Status: No, score=-2.854 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MKVzJWQI0fY7 for ; Wed, 25 Jan 2012 11:23:35 -0800 (PST) Received: from vinny.hireahit.com (vinny.hireahit.com [72.51.42.137]) by ietfa.amsl.com (Postfix) with ESMTP id D8B1D21F853C for ; Wed, 25 Jan 2012 11:23:35 -0800 (PST) Received: from [172.24.0.104] by hireahit.com (vinny.hireahit.com) (SecurityGateway 2.0.7) with SMTP id SG001550191.MSG for ; Wed, 25 Jan 2012 11:23:26 -0800 Message-ID: <4F2056AC.9060401@hireahit.com> Date: Wed, 25 Jan 2012 11:23:24 -0800 From: Dave Warren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20120118 Thunderbird/10.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> In-Reply-To: <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SGOP-RefID: fgs=0 (_st=1 _vt=0 _iwf=0) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jan 2012 19:23:36 -0000 On 1/25/2012 10:37 AM, SM wrote: > At 07:07 24-01-2012, Martijn Grooten wrote: >> (Vamsoft ORF is a spam-filter.) Basically uribl.com was returning >> 127.0.0.1 to _all_ queries from nameservers that are sending high >> volumes (presumably without paying for it) as some kind of >> punishment. http://uribl.com/ confirms that. > > "After investigating this further, it seems the affected ORF users > all use Google public DNS servers for the queries (or use such servers > as forwarders in their local DNS configuration)." > > Anyone using open recursive DNS servers or their ISP's DNS server for > DNSBL queries is asking for trouble. The listing is to get the > attention of the sender. It's "antisocial". I have to wonder, if a DNSBL were being operated entirely on a free basis (rather than a freemium model), might it not be better to take advantage of the large caches out there rather than having thousands of individual servers performing the same mundane set of lookups individually? Obviously this negates the DNSBL's ability to try and pull cash out of the larger entities, but purely from a resource management point of view, if someone wants to offer a front-line cache for free, surely that should reduce load. -- Dave Warren, CEO Hire A Hit Consulting Services http://ca.linkedin.com/in/davejwarren From sm@resistor.net Wed Jan 25 12:14:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9632721F84F6 for ; Wed, 25 Jan 2012 12:14:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.622 X-Spam-Level: X-Spam-Status: No, score=-102.622 tagged_above=-999 required=5 tests=[AWL=-0.023, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eOj0BJN7a-Fb for ; Wed, 25 Jan 2012 12:14:46 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C3B821F84EF for ; Wed, 25 Jan 2012 12:14:46 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id q0PKEftc003107 for ; Wed, 25 Jan 2012 12:14:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1327522486; i=@resistor.net; bh=CmYmeDm+4vsnf2M5Q/exLxid4BhLJUga/3jloDL760E=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=GqQvCvXyp6GcDZ4d3h96mMQ6Cus0zlZHv0SuE9KDiUuXdhF5UyGndwIXBNNokJ0O1 VDiAy9pUPtcTjuIUomQj0RYdCQ25A8vYoBI70VZqLnGxZfrWY8023rTu8JObqJgQ9z 5lbaGK/6dNnvhwVmD1bXzucGWwxecXasOROE9460= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1327522486; i=@resistor.net; bh=CmYmeDm+4vsnf2M5Q/exLxid4BhLJUga/3jloDL760E=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=cQsBDH3blB77WkJotPOb+vdcXrXGsLapeyr9PWZAaxpmxUh9JHO2zTJuvxCcmY5H/ CMhF670xj92jHklSOMuGnPyhwPWPWpyJ205SgtPNA7R4D8A186tvXMyuMUFpgm78fP DD1KxUC72gSQV0/81L31kg4KRaoQlBlVPe7HjpWU= Message-Id: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Wed, 25 Jan 2012 12:11:21 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: <4F2056AC.9060401@hireahit.com> References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jan 2012 20:14:47 -0000 At 11:23 25-01-2012, Dave Warren wrote: >I have to wonder, if a DNSBL were being operated entirely on a free >basis (rather than a freemium model), might it not be better to take >advantage of the large caches out there rather than having thousands >of individual servers performing the same mundane set of lookups individually? There are no large caches out there. That's not how DNS works in my opinion. >Obviously this negates the DNSBL's ability to try and pull cash out >of the larger entities, but purely from a resource management point >of view, if someone wants to offer a front-line cache for free, >surely that should reduce load. It is expensive to provide such a cache for free. Why would someone want to offer such a service for free? Regards, -sm From dotis@mail-abuse.org Wed Jan 25 13:12:11 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E9B821F84CD for ; Wed, 25 Jan 2012 13:12:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.264 X-Spam-Level: X-Spam-Status: No, score=-102.264 tagged_above=-999 required=5 tests=[AWL=0.335, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id scOFgJc9at9U for ; Wed, 25 Jan 2012 13:12:11 -0800 (PST) Received: from mailserv.mail-abuse.org (mailserv.mail-abuse.org [150.70.98.118]) by ietfa.amsl.com (Postfix) with ESMTP id 1FEA721F8613 for ; Wed, 25 Jan 2012 13:12:11 -0800 (PST) Received: from US-DOUGO-MAC.local (unknown [10.31.37.9]) by mailserv.mail-abuse.org (Postfix) with ESMTPSA id F14CA174048B for ; Wed, 25 Jan 2012 21:12:10 +0000 (UTC) Message-ID: <4F207029.3030501@mail-abuse.org> Date: Wed, 25 Jan 2012 13:12:09 -0800 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> <6.2.5.6.2.20120125114411.0c099da8@resistor.net> In-Reply-To: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jan 2012 21:12:11 -0000 On 1/25/12 12:11 PM, SM wrote: > At 11:23 25-01-2012, Dave Warren wrote: >> I have to wonder, if a DNSBL were being operated entirely on a free >> basis (rather than a freemium model), might it not be better to take >> advantage of the large caches out there rather than having thousands >> of individual servers performing the same mundane set of lookups >> individually? > > There are no large caches out there. That's not how DNS works in my > opinion. Dear SM, Many providers offer non-authoritative DNS servers. SOPA and PIPA bills attempt to regulate which domains are to be excluded, and ignore authoritative DNS traffic not cached by providers. Of course, only accepting results from authoritative servers would reduce performance. Infrequently requested records might be dropped prior to expiry to liberate cache. >> Obviously this negates the DNSBL's ability to try and pull cash out >> of the larger entities, but purely from a resource management point >> of view, if someone wants to offer a front-line cache for free, >> surely that should reduce load. > > It is expensive to provide such a cache for free. Why would someone > want to offer such a service for free? Use of these caching services generate valuable information and reduce network traffic between peers. Regards, Doug Otis From sm@resistor.net Wed Jan 25 15:20:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9092E11E80E0 for ; Wed, 25 Jan 2012 15:20:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.621 X-Spam-Level: X-Spam-Status: No, score=-102.621 tagged_above=-999 required=5 tests=[AWL=-0.022, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lflo3RK579ey for ; Wed, 25 Jan 2012 15:20:51 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id DF16611E80DF for ; Wed, 25 Jan 2012 15:20:50 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id q0PNKj7j026356 for ; Wed, 25 Jan 2012 15:20:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1327533650; i=@resistor.net; bh=z1bt6k5SMl9j7q6q+sh5ANtnxvz1O65G9mx45PNjz0k=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=JdN7DIGqwJBLvWwLT+/2KEsUJzIEX6ApDywXn3iBfm6RRqr6wlvzbKjwFf0RTFhao 8pzCCBJwkMOayExJEGnDy7sM5KcX/wKHUE3SSZNt28S31g7uvecUuyEP2ceStv7d+1 pMQ+mYbIJr0rVk97Yaj79n+F9rSndM+oMu7tecg4= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1327533650; i=@resistor.net; bh=z1bt6k5SMl9j7q6q+sh5ANtnxvz1O65G9mx45PNjz0k=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=LM2lcbYEjNJsbzTIeWijSuhS2QSDZhIhvas+E3jaOiGkzBRCfmQxbNZ1D9GRxsupR earxRPKckI5ZS0yVEYmuWDLNwlphJA33SUJcVh1vfSYHUS0FCTWHPsoW9Jqa0tgQ+3 sHSO6ZIY01aiipjfkU67l85IZJAIReaHlMYhFBsI= Message-Id: <6.2.5.6.2.20120125145006.0b057ce8@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Wed, 25 Jan 2012 14:57:47 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: <4F207029.3030501@mail-abuse.org> References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <4F207029.3030501@mail-abuse.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Jan 2012 23:20:52 -0000 Hi Doug, At 13:12 25-01-2012, Douglas Otis wrote: >Many providers offer non-authoritative DNS servers. SOPA and PIPA >bills attempt to regulate which domains are to be excluded, and >ignore authoritative DNS traffic not I do not have any opinion about SOPA and PIPA bills. BTW, do you have an opinion about Pippa? :-) >Use of these caching services generate valuable information and >reduce network traffic between peers. Could you elaborate on the "generate valuable information"? Are there any examples of DNS "caching services" set up to reduce network traffic and why it is being done? Regards, -sm From prvs=0372513BEA=paul@pscs.co.uk Wed Jan 25 16:00:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C22D011E8085 for ; Wed, 25 Jan 2012 16:00:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lf1GI69b98E8 for ; Wed, 25 Jan 2012 16:00:04 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id DCC5611E8071 for ; Wed, 25 Jan 2012 16:00:03 -0800 (PST) Received: from lmail.pscs.co.uk ([217.155.61.14]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP for ; Wed, 25 Jan 2012 23:59:58 -0000 Received: from [192.168.57.207] ([217.155.61.155]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP for ; Wed, 25 Jan 2012 23:26:19 -0000 Message-ID: <4F208F97.10701@pscs.co.uk> Date: Wed, 25 Jan 2012 23:26:15 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <4F207029.3030501@mail-abuse.org> <6.2.5.6.2.20120125145006.0b057ce8@resistor.net> In-Reply-To: <6.2.5.6.2.20120125145006.0b057ce8@resistor.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V5.0b - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 00:00:04 -0000 On 25/01/2012 22:57, SM wrote: > > > Are there any examples of DNS "caching services" set up to reduce > network traffic and why it is being done? Hang on - isn't that the whole point of DNS caching? If people didn't care about network traffic, no one would cache anything, they'd just resolve the addresses every time. Apart from increased network traffic, resolving every time would be much better, as there'd be no stale data. So, pretty much every caching DNS server is there to reduce network traffic. Isn't it? From brendan@swiftspirit.co.za Wed Jan 25 16:02:08 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DEE411E8071 for ; Wed, 25 Jan 2012 16:02:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HS_INDEX_PARAM=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqDhOabJj-hV for ; Wed, 25 Jan 2012 16:02:06 -0800 (PST) Received: from fw9a.glodns.net (fw9a.glodns.net [196.220.48.59]) by ietfa.amsl.com (Postfix) with ESMTP id 8E71311E8089 for ; Wed, 25 Jan 2012 16:02:06 -0800 (PST) Received: from localhost (unknown [127.0.0.1]) by fw9a.glodns.net (Postfix) with ESMTP id DE4C0260AD for ; Thu, 26 Jan 2012 00:02:05 +0000 (UTC) X-Virus-Scanned: amavisd-new at fw9a.glodns.net Received: from fw9a.glodns.net ([196.220.48.59]) by localhost (fw9a.glodns.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id uxGv5FCtL7dO for ; Thu, 26 Jan 2012 02:01:51 +0200 (SAST) Received: from control.glodns.net (smtp1w.glodns.net [75.126.138.3]) by fw9a.glodns.net (Postfix) with ESMTP id E282626072 for ; Thu, 26 Jan 2012 02:01:50 +0200 (SAST) Received: (qmail 19283 invoked from network); 26 Jan 2012 02:01:49 +0200 Received: from blvd-cr1-nat1.wa.co.za (HELO ?10.4.59.204?) (196.220.32.228) by smtp1b.plesk.glodns.net with (DHE-RSA-AES256-SHA encrypted) SMTP; 26 Jan 2012 02:01:49 +0200 Message-ID: <4F2097EA.2060103@swiftspirit.co.za> Date: Thu, 26 Jan 2012 02:01:46 +0200 From: Brendan Hide User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111224 Thunderbird/9.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <4F207029.3030501@mail-abuse.org> <6.2.5.6.2.20120125145006.0b057ce8@resistor.net> <4F208F97.10701@pscs.co.uk> In-Reply-To: <4F208F97.10701@pscs.co.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 00:02:08 -0000 On 01/26/12 01:26, Paul Smith wrote: > On 25/01/2012 22:57, SM wrote: >> >> >> Are there any examples of DNS "caching services" set up to reduce >> network traffic and why it is being done? > > Hang on - isn't that the whole point of DNS caching? If people didn't > care about network traffic, no one would cache anything, they'd just > resolve the addresses every time. Apart from increased network > traffic, resolving every time would be much better, as there'd be no > stale data. > > So, pretty much every caching DNS server is there to reduce network > traffic. Isn't it? Pretty much every ISP has caching DNS servers *partly* for this exact reason, yes. The other reason is speed. Cached entries result in less latency when the authoritative DNS server is on the other side of the world. :) -- __________ Brendan Hide Mobile: +27 83 448 3867 Mobile: brendan.cell@swiftspirit.co.za (plain text only please) Web Africa - Internet Business Solutions http://www.webafrica.co.za/?AFF1E97 From johnl@iecc.com Wed Jan 25 16:03:19 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9640621F85B7 for ; Wed, 25 Jan 2012 16:03:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -109.164 X-Spam-Level: X-Spam-Status: No, score=-109.164 tagged_above=-999 required=5 tests=[AWL=2.035, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GE1MOQQdaFcA for ; Wed, 25 Jan 2012 16:03:19 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 04DF921F85B6 for ; Wed, 25 Jan 2012 16:03:18 -0800 (PST) Received: (qmail 3778 invoked from network); 26 Jan 2012 00:03:17 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 26 Jan 2012 00:03:17 -0000 Date: 26 Jan 2012 00:02:55 -0000 Message-ID: <20120126000255.60406.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 00:03:19 -0000 >It is expensive to provide such a cache for free. Why would someone >want to offer such a service for free? Perhaps you might ask Google why they run 8.8.8.8 and 8.8.4.4. I run a free DNSBL, korea.services.net. The public caches have never been a problem. The people I have to block hammer on it directly from their own clients. The query streams suggest that they aren't caches, since they tend to ask the same questions over and over. R's, John From johnl@iecc.com Wed Jan 25 16:04:03 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E06C921F85DB for ; Wed, 25 Jan 2012 16:04:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -109.203 X-Spam-Level: X-Spam-Status: No, score=-109.203 tagged_above=-999 required=5 tests=[AWL=1.996, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ut1lLUgGUM6g for ; Wed, 25 Jan 2012 16:04:03 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 6917821F85B7 for ; Wed, 25 Jan 2012 16:04:03 -0800 (PST) Received: (qmail 4095 invoked from network); 26 Jan 2012 00:04:02 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 26 Jan 2012 00:04:02 -0000 Date: 26 Jan 2012 00:03:40 -0000 Message-ID: <20120126000340.60448.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <4F208F97.10701@pscs.co.uk> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 00:04:04 -0000 >So, pretty much every caching DNS server is there to reduce network >traffic. Isn't it? Except for the "pretty much" part, yes. R's, John From steve@blighty.com Wed Jan 25 16:09:02 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6338B21F855A for ; Wed, 25 Jan 2012 16:09:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.855 X-Spam-Level: X-Spam-Status: No, score=-1.855 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PG-hzjRmyL1O for ; Wed, 25 Jan 2012 16:09:01 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id 80CD221F85E9 for ; Wed, 25 Jan 2012 16:09:00 -0800 (PST) Received: from platter.wordtothewise.com (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id E245A2EB41 for ; Wed, 25 Jan 2012 16:08:58 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1251.1) From: Steve Atkins In-Reply-To: <4F208F97.10701@pscs.co.uk> Date: Wed, 25 Jan 2012 16:08:57 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <7B134912-5A3A-4BC7-B04A-D80D57068236@blighty.com> References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <4F207029.3030501@mail-abuse.org> <6.2.5.6.2.20120125145006.0b057ce8@resistor.net> <4F208F97.10701@pscs.co.uk> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1251.1) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 00:09:02 -0000 On Jan 25, 2012, at 3:26 PM, Paul Smith wrote: > On 25/01/2012 22:57, SM wrote: >>=20 >>=20 >> Are there any examples of DNS "caching services" set up to reduce = network traffic and why it is being done? >=20 > Hang on - isn't that the whole point of DNS caching? If people didn't = care about network traffic, no one would cache anything, they'd just = resolve the addresses every time. Apart from increased network traffic, = resolving every time would be much better, as there'd be no stale data. >=20 > So, pretty much every caching DNS server is there to reduce network = traffic. Isn't it? Partly, yes. It also reduces latency significantly (helped by very high = cache hit rates near the root of the tree). (Queries to DNSBLs and similar trees - e.g. in-addr.arpa - do damage = that somewhat, by creating a large number of different queries few of = which are reused, hence tending to evict higher value records from the = cache. But that's orthogonal to what we're discussing here, really.) Cheers, Steve= From sm@resistor.net Wed Jan 25 16:33:43 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7E3411E80A0 for ; Wed, 25 Jan 2012 16:33:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.62 X-Spam-Level: X-Spam-Status: No, score=-102.62 tagged_above=-999 required=5 tests=[AWL=-0.021, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uKcdnGXdEN6w for ; Wed, 25 Jan 2012 16:33:40 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id CB33C11E8097 for ; Wed, 25 Jan 2012 16:33:40 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id q0Q0XW4g023191 for ; Wed, 25 Jan 2012 16:33:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1327538017; i=@resistor.net; bh=+CqYPCMDIZajssoVySAu77E0NpHN4M0kpaGRq7KTDww=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=eSi1sw2P2QEr3Ez04y2gOIZAaFIBNEn5FVlBAaTuwuQDU2FqsI1sS2LeoH8yWoNPc 298uvJop4SoIkQMCKj4XnWuRAi8yvSTHJuygs2FO8GGbfw+jcZlFyGsu3EcgBzJUOB 1PHNPHyReUGA3Z1fOgVxbusY+EhSVUCVWZCgFeRM= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1327538017; i=@resistor.net; bh=+CqYPCMDIZajssoVySAu77E0NpHN4M0kpaGRq7KTDww=; h=Message-Id:Date:To:From:Subject:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=rt/2czfkpaf0zhvETZgmIPfjOGCQ0JBxrlqoXygxKkfBZ7AxgiMxWJTj9leO0RuHl 8E5lnN1Kc+1ohjtKMmcquANVNL0vhoo38qyBuvvxm1gvDhGqRg4/JZo68KdIs3wsca N8hDHdw44UuXc8q6Rk+00QijfNRCH86Um+jonHxY= Message-Id: <6.2.5.6.2.20120125162359.0998f438@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Wed, 25 Jan 2012 16:33:21 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: <20120126000255.60406.qmail@joyce.lan> References: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <20120126000255.60406.qmail@joyce.lan> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 00:33:44 -0000 At 16:02 25-01-2012, John Levine wrote: >Perhaps you might ask Google why they run 8.8.8.8 and 8.8.4.4. Vertical integration? :-) Regards, -sm From dotis@mail-abuse.org Thu Jan 26 10:27:11 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15CFD21F86D5 for ; Thu, 26 Jan 2012 10:27:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.281 X-Spam-Level: X-Spam-Status: No, score=-102.281 tagged_above=-999 required=5 tests=[AWL=0.318, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DDp2bBFN8wCy for ; Thu, 26 Jan 2012 10:27:10 -0800 (PST) Received: from mailserv.mail-abuse.org (mailserv.mail-abuse.org [150.70.98.118]) by ietfa.amsl.com (Postfix) with ESMTP id BB02421F86C3 for ; Thu, 26 Jan 2012 10:27:10 -0800 (PST) Received: from US-DOUGO-MAC.local (unknown [10.31.37.9]) by mailserv.mail-abuse.org (Postfix) with ESMTPSA id 16ABF17404B0 for ; Thu, 26 Jan 2012 18:27:10 +0000 (UTC) Message-ID: <4F219AFE.9030604@mail-abuse.org> Date: Thu, 26 Jan 2012 10:27:10 -0800 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <20120126000255.60406.qmail@joyce.lan> <6.2.5.6.2.20120125162359.0998f438@resistor.net> In-Reply-To: <6.2.5.6.2.20120125162359.0998f438@resistor.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 18:27:11 -0000 On 1/25/12 4:33 PM, SM wrote: > At 16:02 25-01-2012, John Levine wrote: >> Perhaps you might ask Google why they run 8.8.8.8 and 8.8.4.4. > > Vertical integration? :-) Dear SM, To support touted performance feature, chrome aggressively resolves links in advance. This strategy makes chrome sensitive to DNS performance. Cache in their recursive resolvers is kept current ahead of requests. People addicted to speed. ;^) Regards, Doug Otis From prvs=1374dfe299=lists@hireahit.com Fri Jan 27 16:51:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 209E721F85E4 for ; Fri, 27 Jan 2012 16:51:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[AWL=-0.835, BAYES_40=-0.185, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id laar6jjFs3Zb for ; Fri, 27 Jan 2012 16:51:46 -0800 (PST) Received: from vinny.hireahit.com (vinny.hireahit.com [72.51.42.137]) by ietfa.amsl.com (Postfix) with ESMTP id 7E02621F8592 for ; Fri, 27 Jan 2012 16:51:46 -0800 (PST) Received: from [172.24.0.104] by hireahit.com (vinny.hireahit.com) (SecurityGateway 2.0.7) with SMTP id SG001560247.MSG for ; Fri, 27 Jan 2012 16:51:37 -0800 Message-ID: <4F234694.3040000@hireahit.com> Date: Fri, 27 Jan 2012 16:51:32 -0800 From: Dave Warren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20120124 Thunderbird/10.0 MIME-Version: 1.0 To: asrg@irtf.org References: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <20120126000255.60406.qmail@joyce.lan> <6.2.5.6.2.20120125162359.0998f438@resistor.net> <4F219AFE.9030604@mail-abuse.org> In-Reply-To: <4F219AFE.9030604@mail-abuse.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SGOP-RefID: fgs=0 (_st=1 _vt=0 _iwf=0) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Jan 2012 00:51:47 -0000 On 1/26/2012 10:27 AM, Douglas Otis wrote: > To support touted performance feature, chrome aggressively resolves > links in advance. This strategy makes chrome sensitive to DNS > performance. Cache in their recursive resolvers is kept current ahead > of requests. People addicted to speed. ;^) I might be being argumentative for it's own sake (sorry), but doesn't this make Chrome less sensitive to DNS performance rather than more sensitive? With a browser that doesn't pre-cache DNS lookups, the user is aware of DNS latency every time they click a link and with every resource that the browser loads from a different domain. Conversely, with caching, in most cases pre-caching every link on a page will take longer than it takes the user to find a link and click on it even if the DNS cache is extremely slow. Now I'd agree that faster DNS servers makes a noticeable difference when browsing since many websites load content from a dozen or more hostname, but I'd argue that Chrome's precaching makes it less sensitive to slow DNS queries. -- Dave Warren, CEO Hire A Hit Consulting Services http://ca.linkedin.com/in/davejwarren From prvs=1374dfe299=lists@hireahit.com Fri Jan 27 16:51:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D11E21F8592 for ; Fri, 27 Jan 2012 16:51:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.742 X-Spam-Level: X-Spam-Status: No, score=-1.742 tagged_above=-999 required=5 tests=[AWL=-0.556, BAYES_40=-0.185, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U968FWnJtrUY for ; Fri, 27 Jan 2012 16:51:46 -0800 (PST) Received: from vinny.hireahit.com (vinny.hireahit.com [72.51.42.137]) by ietfa.amsl.com (Postfix) with ESMTP id 6753C21F8578 for ; Fri, 27 Jan 2012 16:51:46 -0800 (PST) Received: from [172.24.0.104] by hireahit.com (vinny.hireahit.com) (SecurityGateway 2.0.7) with SMTP id SG001560246.MSG for ; Fri, 27 Jan 2012 16:51:35 -0800 Message-ID: <4F234693.8030809@hireahit.com> Date: Fri, 27 Jan 2012 16:51:31 -0800 From: Dave Warren User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20120124 Thunderbird/10.0 MIME-Version: 1.0 To: asrg@irtf.org References: <18B53BA2A483AD45962AAD1397BE13253846E0FE87@UK-EXCHMBX1.green.sophos> <6.2.5.6.2.20120125102806.0ae6afe8@resistor.net> <4F2056AC.9060401@hireahit.com> <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <4F207029.3030501@mail-abuse.org> <6.2.5.6.2.20120125145006.0b057ce8@resistor.net> <4F208F97.10701@pscs.co.uk> <7B134912-5A3A-4BC7-B04A-D80D57068236@blighty.com> In-Reply-To: <7B134912-5A3A-4BC7-B04A-D80D57068236@blighty.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SGOP-RefID: fgs=0 (_st=1 _vt=0 _iwf=0) Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Jan 2012 00:51:47 -0000 (I'm a bit late getting back to this, my apologies) On 1/25/2012 4:08 PM, Steve Atkins wrote: > (Queries to DNSBLs and similar trees - e.g. in-addr.arpa - do damage that somewhat, by creating a large number of different queries few of which are reused, hence tending to evict higher value records from the cache. But that's orthogonal to what we're discussing here, really.) And, one might argue, an artifact of poor cache expiry policies. At least in my version of an ideal world, I'd want to keep records in the cache based on frequency of use over nearly anything else (within the TTL lifetime, of course) However, in the context of DNSBLs, you may well have the same problem as in-addr.arpa in that there are a lot of records that will have limited cache re-use. Still, if a DNSBL is overloaded, increasing TTLs and encouraging (rather than discouraging or prohibiting) use of public caches would probably decrease load on the DNSBL servers. For example, with a DNSBL negative-caching at, say, 150 seconds, my servers check Gmail's outbound IPs for DNSBL listings, on average, every 180 seconds or so. Were I and 10 of my best friends running similarly sized mail servers to start querying 8.8.8.8 instead of using our own internal resolvers, a DNSBL might see one hit every 150 seconds instead of 1 every 18 seconds (10 every 180 seconds). Now that being said, as a matter of practice I wouldn't suggest we start suggesting mail server operators start using Google's public DNS as their primary DNS. However, the reality of it is that the majority of people hit by "listing the Internet for over-quota usage" policies were using shared (or public) DNS resolvers, most weren't actually hitting any sort of limit due to their own traffic. Obviously if a DNSBL keeps their TTLs (positive and negative) too low then aggregating queries does little good, and there does need to be some level of responsiveness. However, if a DNSBL recommends a hourly or daily rsync for rsync users, that might suggest a starting point for TTLs. At the end of the day though, it's not about stopping abuse or people hammering the DNSBLs, but rather, it's about making it more convenient for larger players to pay money for a valuable service. That's not really unfair, and the freemium model is always a complicated one with potential holes for abuse, but it's disingenuous to declare that listing-the-internet is the only way to cut down query volume. -- Dave Warren, CEO Hire A Hit Consulting Services http://ca.linkedin.com/in/davejwarren From johnl@iecc.com Mon Jan 30 11:44:17 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1AD421F85D2 for ; Mon, 30 Jan 2012 11:44:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.233 X-Spam-Level: X-Spam-Status: No, score=-101.233 tagged_above=-999 required=5 tests=[AWL=-1.047, BAYES_40=-0.185, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BLUbZ+CfnZwv for ; Mon, 30 Jan 2012 11:44:17 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id C5B7521F850C for ; Mon, 30 Jan 2012 11:44:16 -0800 (PST) Received: (qmail 34767 invoked from network); 30 Jan 2012 19:44:14 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:mime-version:content-type:vbr-info:user-agent:cleverness; s=87ce.4f26f30e.k1201; bh=b/dAOGDYr1qj+JuDY1ztv7+ANxOHycEVhPGA/XzBego=; b=FQl8QG/j/pIPisYCJmQHvE5vgCDTykbRcRMikJX1Jjsfpr6XLgp1WAPS9bfulqwZphWiYOCd6OVDD3CfPShsnHk1veLgxsNPn7OK/B9WxNrvhi0bw9Ye2txti5/G7YHIIF92P95iBvzW9nisnhNENh/jp+PO+jSPTcP51ueEfQM= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Received: (ofmipd 127.0.0.1) with (DHE-RSA-AES256-SHA encrypted) SMTP; 30 Jan 2012 19:43:52 -0000 Date: 30 Jan 2012 14:44:12 -0500 Message-ID: From: "John R. Levine" To: "Anti Spam Research Group" User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Subject: [Asrg] Paris IETF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Jan 2012 19:44:18 -0000 It's session scheduling time again. I'm not going to ask for a session for ASRG, since we don't have anything going on to merit one, but if people will be there we could arrange to all have lunch one day. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly From dotis@mail-abuse.org Tue Jan 31 13:50:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84D141F0C3F for ; Tue, 31 Jan 2012 13:50:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.297 X-Spam-Level: X-Spam-Status: No, score=-102.297 tagged_above=-999 required=5 tests=[AWL=0.302, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uSUElCJbKFCP for ; Tue, 31 Jan 2012 13:50:04 -0800 (PST) Received: from mailserv.mail-abuse.org (mailserv.mail-abuse.org [150.70.98.118]) by ietfa.amsl.com (Postfix) with ESMTP id 11EB21F0C3E for ; Tue, 31 Jan 2012 13:50:03 -0800 (PST) Received: from US-DOUGO-MAC.local (SJDCLUXGATEWAY2.sdi.trendnet.org [10.31.37.9]) by mailserv.mail-abuse.org (Postfix) with ESMTPSA id E4A7B17404A1 for ; Tue, 31 Jan 2012 21:50:02 +0000 (UTC) Message-ID: <4F286209.60205@mail-abuse.org> Date: Tue, 31 Jan 2012 13:50:01 -0800 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <6.2.5.6.2.20120125114411.0c099da8@resistor.net> <20120126000255.60406.qmail@joyce.lan> <6.2.5.6.2.20120125162359.0998f438@resistor.net> <4F219AFE.9030604@mail-abuse.org> <4F234694.3040000@hireahit.com> In-Reply-To: <4F234694.3040000@hireahit.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] RFC 6471 and "listing the Internet" as a punishment X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jan 2012 21:50:04 -0000 On 1/27/12 4:51 PM, Dave Warren wrote: > On 1/26/2012 10:27 AM, Douglas Otis wrote: >> To support touted performance feature, chrome aggressively resolves >> links in advance. This strategy makes chrome sensitive to DNS >> performance. Cache in their recursive resolvers is kept current >> ahead of requests. People addicted to speed. ;^) > > I might be being argumentative for it's own sake (sorry), but doesn't > this make Chrome less sensitive to DNS performance rather than more > sensitive? > > With a browser that doesn't pre-cache DNS lookups, the user is aware > of DNS latency every time they click a link and with every resource > that the browser loads from a different domain. Conversely, with > caching, in most cases pre-caching every link on a page will take > longer than it takes the user to find a link and click on it even if > the DNS cache is extremely slow. > > Now I'd agree that faster DNS servers makes a noticeable difference > when browsing since many websites load content from a dozen or more > hostname, but I'd argue that Chrome's precaching makes it less > sensitive to slow DNS queries. Dear Dave, When DNS transactions attempt to include all possible choices, necessary transactions are at a greater risk of being queued, rather than being ready in advance. Chrome offers a switch setting to disable this behavior that may actually result in reduced performance. Regards, Doug Otis