Subject: blacklist user beware

From: Roy Bixler <[email-masked]>
Date: Mon, 5 Aug 2002 10:32:25 -0500

This weekend when setting up Z-Mailer on a new NetBSD installation, I
discovered an interesting little catch.  I use the ORDB list of open
relays in an attempt to reduce spam intake.  I soon found that the
SMTP server rejected mail from everywhere.  I removed the ORDB usage
from smtp-policy.src, re-ran policy-builder.sh and then SMTP server
started accepting mail again.  Strange ...  I thought there is a
problem with ORDB and I wrote to them about this.

It turns out that, instead of the usual DNS requests of the form
d.c.b.a.relays.ordb.org, the SMTP server was actually requesting
d.c.b.a.relays.ordb.org.org.  Whoever is in charge of the org.org
domain has some kind of wildcard DNS record set up and their default
is to return a 127.0.0.1 (i.e. an ORDB reject) for all requests not
otherwise in their database.  So my resolution of the problem was to
put the following rule in smtp-policy.src:

_rbl0          test-dns-rbl      blocklista:blocklistb:relays.ordb.org.
_rbl1          # Nothing at late phase

Note the dot at the end of the line.  By the way, I also found out
from the ORDB people that anyone using the relays.ordb.COM zone will
have the same trouble as above.

In hopes this might save someone some trouble-ly yours,
R.
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 5 Aug 2002 21:40:50 +0530

You can and should do it with all your blacklists. It'll speed up your
SMTP transactions and save on network traffic.

--Arnt
-

---

From: Matti Aarnio <[email-masked]>
Date: Mon, 5 Aug 2002 19:39:00 +0300

> discovered an interesting little catch.  I use the ORDB list of open
...
> d.c.b.a.relays.ordb.org.org.  Whoever is in charge of the org.org

   What might be in your   /etc/resolv.conf  file ?
   Specifically if you have a "search" line(s) there ?

   My resolver has never (to my knowledge) done any such traversals,
   but one never knows..

-- 
/Matti Aarnio	<[email-masked]>
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]

---

From: Roy Bixler <[email-masked]>
Date: Mon, 5 Aug 2002 12:01:15 -0500

>    My resolver has never (to my knowledge) done any such traversals,

I did originally have a problem with my /etc/resolv.conf file, but
this was that it lacked a 'domain' line.  After I inserted one, the
'host' command at least no longer tried to resolve through the org.org
domain.  At that point, I had already put a dot at the end of my
blacklist zone in smtp-policy.src, so I didn't test smtpserver to see
if the 'domain' line in /etc/resolv.conf fixed the spurious DNS
lookups.  Also, I did not have any 'search' lines in my
/etc/resolv.conf.

But, from now on, I plan to take Arnt's very sensible advice and put a
dot at the end of all my blacklist entries.  I like the idea of less
network traffic, faster lookups and blocking out funny business like
what org.org is doing with their DNS.  (Although, to be fair, perhaps
org.org set that up in self defence and in hopes of clueing
administrators into what DNS lookups their systems are actually
generating.)

R.
-