bk99.de entertain the web since 1997

bk99.de
Hostblogger · Email securityCurated

Updating a DNS blacklist within seconds

Summary

Manuel Schmitt describes the beta test of a live-fed DNS version of the NixSpam blacklist that makes detected spam sources available within seconds. The existing list was available at ix.dnsbl.manitu.net. The test service used ix-new.dnsbl.manitu.net.

Ideas

  • A DNSBL distributes blocking information through fast, cacheable DNS queries.
  • Live feeding shortens the time between detecting spam and protecting other mail servers.
  • A separate test host name keeps experimental data apart from the existing production service.

Insights

  • The value of a reputation list depends heavily on being current and on controlled error correction.
  • Faster blocking also increases the damage of possible misclassifications.

Facts

  • Manuel developed the live feed together with Bert Ungerer of iX.

Recommendations

  • Measure latency, false positives and removal times separately.
  • Run test and production zones independently and publish a quick way to object.

References

Read the original article on Hostblogger

Search the Web Archive

Hostblogger · 2025

Migrating procmail rules to Sieve with a real parser

Manuel Schmitt replaces an unreliable procmail-to-Sieve converter with his own parser with a deliberately limited scope. The earlier converter was partly based on free scripts, including earlier work from Dovecot. The new converter was rewritten completely in-house.

Hostblogger · 2007

DDoS against a public DNS blacklist

Manuel Schmitt reports on a DDoS attack on ix.dnsbl.manitu.net and then considers a list of permitted query networks. ix.dnsbl.manitu.net was hit by a DDoS attack in June 2007. Bert Ungerer and Manuel discussed operating on a whitelist basis.