DNSBL

This article is about the DNSBL. For other uses, see black hole (disambiguation).

A DNS-based Blackhole List (DNSBL) or Real-time Blackhole List (RBL) is an effort to stop email spamming. It is a "blacklist" of locations on the Internet reputed to send email spam. The locations consist of IP addresses which are most often used to publish the addresses of computers or networks linked to spamming; most mail server software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists. The term "Blackhole List" is sometimes interchanged with the term "blacklist" and "blocklist".

A DNSBL is a software mechanism, rather than a specific list or policy. There are dozens of DNSBLs in existence,[1] which use a wide array of criteria for listing and delisting of addresses. These may include listing the addresses of zombie computers or other machines being used to send spam, ISPs who willingly host spammers, or those which have sent spam to a honeypot system.

Since the creation of the first DNSBL in 1997, the operation and policies of these lists have been frequently controversial,[2][3] both in Internet advocacy and occasionally in lawsuits. Many email systems operators and users[4] consider DNSBLs a valuable tool to share information about sources of spam, but others including some prominent Internet activists have objected to them as a form of censorship.[5][6][7][8] In addition, a small number of DNSBL operators have been the target of lawsuits filed by spammers seeking to have the lists shut down.[9]

History of DNSBLs

The first DNSBL was the Real-time Blackhole List (RBL), created in 1997, at first as a BGP feed by Paul Vixie, and then as a DNSBL by Eric Ziegast as part of Vixie's Mail Abuse Prevention System (MAPS); Dave Rand at Abovenet was its first subscriber.[10] The very first version of the RBL was not published as a DNSBL, but rather a list of networks transmitted via BGP to routers owned by subscribers so that network operators could drop all TCP/IP traffic for machines used to send spam or host spam supporting services, such as a website. The inventor of the technique later commonly called a DNSBL was Eric Ziegast while employed at Vixie Enterprises.

The term "blackhole" refers to a networking black hole, an expression for a link on a network that drops incoming traffic instead of forwarding it normally. The intent of the RBL was that sites using it would refuse traffic from sites which supported spam — whether by actively sending spam, or in other ways. Before an address would be listed on the RBL, volunteers and MAPS staff would attempt repeatedly to contact the persons responsible for it and get its problems corrected. Such effort was considered very important before blackholing all network traffic, but it also meant that spammers and spam supporting ISPs could delay being put on the RBL for long periods while such discussions went on.

Later, the RBL was also released in a DNSBL form and Paul Vixie encouraged the authors of sendmail and other mail software to implement RBL support in their clients. These allowed the mail software to query the RBL and reject mail from listed sites on a per-mail-server basis instead of blackholing all traffic.

Soon after the advent of the RBL, others started developing their own lists with different policies. One of the first was Alan Brown's Open Relay Behavior-modification System (ORBS). This used automated testing to discover and list mail servers running as open mail relays—exploitable by spammers to carry their spam. ORBS was controversial at the time because many people felt running an open relay was acceptable, and that scanning the Internet for open mail servers could be abusive.

In 2003, a number of DNSBLs came under denial-of-service attacks. Since no party has admitted to these attacks nor been discovered responsible, their purpose is a matter of speculation. However, many observers believe the attacks are perpetrated by spammers in order to interfere with the DNSBLs' operation or hound them into shutting down. In August 2003, the firm Osirusoft, an operator of several DNSBLs including one based on the SPEWS data set, shut down its lists after suffering weeks of near-continuous attack.

Technical specifications for DNSBLs came relatively late in RFC5782.[11]

URI DNSBLs

A URI DNSBL is a DNSBL that lists the domain names and sometimes also IP addresses which are found in the "clickable" links contained in the body of spams, but generally not found inside legitimate messages.

URI DNSBLs were created when it was determined that much spam made it past spam filters during that short time frame between the first use of a spam-sending IP address and the point where that sending IP address was first listed on major sending-IP-based DNSBLs.

In many cases, such elusive spams contain in their links domain names or IP addresses (collectively referred to as a URIs) where that URI was already spotted in previously caught spam and where that URI is not found in non-spam e-mail.

Therefore, when a spam filter extracts all URIs from a message and checks them against a URI DNSBL, then the spam can be blocked even if the sending IP for that spam has not yet been listed on any sending IP DNSBL.

Of the three major URI DNSBLs, the oldest and most popular is SURBL.[12] After SURBL was created, some of the volunteers for SURBL started the second major URI DNSBL, URIBL.[13] In 2008, another long-time SURBL volunteer started another URI DNSBL, ivmURI.[14] The Spamhaus Project provides the Spamhaus Domain Block List (DBL) which they describe as domains "found in spam messages".[15] The DBL is intended as both a URIBL and RHSBL, to be checked against both domains in a message's envelope and headers and domains in URLs in message bodies. Unlike other URIBLs, the DBL only lists domain names, not IP addresses, since Spamhaus provides other lists of IP addresses.

URI DNSBLs are often confused with RHSBLs (Right Hand Side BLs). But they are different. A URI DNSBL lists domain names and IPs found in the body of the message. An RHSBL lists the domain names used in the "from" or "reply-to" e-mail address. RHSBLs are of debatable effectiveness since many spams either use forged "from" addresses or use "from" addresses containing popular freemail domain names, such as @gmail.com, @yahoo.com, or @hotmail.com URI DNSBLs are more widely used than RHSBLs, are very effective, and are used by the majority of spam filters.

How a DNSBL works

To operate a DNSBL requires three things: a domain to host it under, a nameserver for that domain, and a list of addresses to publish.

It is possible to serve a DNSBL using any general-purpose DNS server software. However this is typically inefficient for zones containing large numbers of addresses, particularly DNSBLs which list entire Classless Inter-Domain Routing netblocks. For the large resource consumption when using software designed as the role of a Domain Name Server, there are role-specific software applications designed specifically for servers with a role of a DNS blacklist.

The hard part of operating a DNSBL is populating it with addresses. DNSBLs intended for public use usually have specific, published policies as to what a listing means, and must be operated accordingly to attain or sustain public confidence.

DNSBL queries

When a mail server receives a connection from a client, and wishes to check that client against a DNSBL (let's say, dnsbl.example.net), it does more or less the following:

  1. Take the client's IP address—say, 192.168.42.23—and reverse the order of octets, yielding 23.42.168.192.
  2. Append the DNSBL's domain name: 23.42.168.192.dnsbl.example.net.
  3. Look up this name in the DNS as a domain name ("A" record). This will return either an address, indicating that the client is listed; or an "NXDOMAIN" ("No such domain") code, indicating that the client is not.
  4. Optionally, if the client is listed, look up the name as a text record ("TXT" record). Most DNSBLs publish information about why a client is listed as TXT records.

Looking up an address in a DNSBL is thus similar to looking it up in reverse-DNS. The differences are that a DNSBL lookup uses the "A" rather than "PTR" record type, and uses a forward domain (such as dnsbl.example.net above) rather than the special reverse domain in-addr.arpa.

There is an informal protocol for the addresses returned by DNSBL queries which match. Most DNSBLs return an address in the 127.0.0.0/8 IP loopback network. The address 127.0.0.2 indicates a generic listing. Other addresses in this block may indicate something specific about the listing—that it indicates an open relay, proxy, spammer-owned host, etc. For details see RFC 5782.

URI DNSBL

A URI DNSBL query (and an RHSBL query) is fairly straightforward. The domain name to query is prepended to the DNS list host as follows:

example.net.dnslist.example.com

where dnslist.example.com is the DNS list host and example.net is the queried domain. Generally if an A record is returned the name is listed.

DNSBL policies

Different DNSBLs have different policies. DNSBL policies differ from one another on three fronts:

Varieties of DNSBLs

In addition to the different types of listed entities (IP addresses for traditional DNSBLs, host and domain names for RHSBLs, URIs for URIBLs) there is a wide range of semantic variations between lists as to what a listing means. List maintainers themselves have been divided on the issues of whether their listings should be seen as statements of objective fact or subjective opinion and on how their lists should best be used. As a result, there is no definitive taxonomy for DNSBLs. Some names defined here (e.g. "Yellow" and "NoBL"[16] ) are varieties that are not in widespread use and so the names themselves are not in widespread use, but should be recognized by many spam control specialists.

White List
A listing is an affirmative indication of essentially absolute trust
Black List
A listing is a negative indication of essentially absolute distrust
Grey List
Most frequently seen as one word (greylist or greylisting) not involving DNSBLs directly, but using temporary deferral of mail from unfamiliar sources to allow for the development of a public reputation (such as DNSBL listings) or to discourage speed-focused spamming. Occasionally used to refer to actual DNSBLs on which listings denote distinct non-absolute levels and forms of trust or distrust.
Yellow List
A listing indicates that the source is known to produce a mixture of spam and non-spam to a degree that makes checking other DNSBLs of any sort useless.
NoBL List
A listing indicates that the source is believed to send no spam and should not be subjected to blacklist testing, but is not quite as trusted as a whitelisted source.

Uses of DNSBLs

Criticisms

Some end-users and organizations have concerns regarding the concept of DNSBLs or the specifics of how they are created and used. Some of the criticisms include:

Despite the criticisms, few people object to the principle that mail-receiving sites should be able to reject undesired mail systematically. One person who does is John Gilmore, who deliberately operates an open mail relay. Gilmore accuses DNSBL operators of violating antitrust law.

For Joe Blow to refuse emails is legal (though it's bad policy, akin to "shooting the messenger"). But if Joe and ten million friends all gang up to make a blacklist, they are exercising illegal monopoly power.[24]

A number of parties, such as the Electronic Frontier Foundation and Peacefire, have raised concerns about some use of DNSBLs by ISPs. One joint statement issued by a group including EFF and Peacefire addressed "stealth blocking", in which ISPs use DNSBLs or other spam-blocking techniques without informing their clients.[25]

Spammers have pursued lawsuits against DNSBL operators on similar grounds:

See also

References

  1. "DNS & RHS blackhole lists". Archived from the original on 2013-03-21. Retrieved 2013-03-26.
  2. "RFC6471". Retrieved 2013-03-26.
  3. "RBLMon.com: What are RBLs and How do they Work?". Retrieved 2013-03-26.
  4. "Revealing Botnet Membership Using DNSBL Counter-Intelligence" (PDF). Retrieved 2013-03-26.
  5. "RBL Criticism". Retrieved 2013-03-26.
  6. 1 2 "Electronic Frontier Foundation, EFFector, Vol. 14, No. 31, Oct. 16, 2001". Retrieved 2013-03-26.
  7. "Verio gags EFF founder over spam". Retrieved 2013-03-26.
  8. "Choosing Spam over Censorship". Retrieved 2013-03-26.
  9. "EMarketersAmerica.org sues anti-spam groups". Retrieved 2013-03-26.
  10. McMillan, Robert (1997-12-xx). "What will stop spam?:". Retrieved 2008-05-16. Check date values in: |date= (help)
  11. "RFC5782".
  12. "SURBL". SURBL. Retrieved 2012-05-06.
  13. "URIBL". URIBL. Retrieved 2012-05-06.
  14. "ivmURI". Dnsbl.invaluement.com. 2008-05-31. Retrieved 2012-05-06.
  15. "The Domain Block List". The Spamhaus Project. Retrieved 2014-10-10.
  16. Perkel, Marc. "A new paradigm for DNS based lists". Retrieved 20 March 2012.
  17. As of July 2016, 30 out of 41 MTAs listed in Comparison of mail servers#Antispam features are known to support DNSBL, 1 doesn't, and the remaining 10 are not known.
  18. "Junk Email Filter". Wiki.junkemailfilter.com. 2012-02-17. Retrieved 2012-05-06.
  19. "Email delivery problems explained". Retrieved 2013-03-26.
  20. "The Spamhaus Project, Policy Block List". Retrieved 2013-03-26.
  21. "Maps Rbl". Mail-abuse.com. 2012-03-03. Retrieved 2012-05-06.
  22. UCEPROTECT. "UCEprotect.net". UCEprotect.net. Retrieved 2012-05-06.
  23. Simpson, Ken. "Getting onto a blacklist without sending any spam". MailChannels Blog. MailChannels Corporation. Retrieved 16 September 2011.
  24. "TOAD.com". TOAD.com. Retrieved 2012-05-06.
  25. "Coalition statement against "stealth blocking"". Peacefire.org. 2001-05-17. Retrieved 2012-05-06.
  26. "Linxnet.com". Linxnet.com. Retrieved 2012-05-06.

External links

This article is issued from Wikipedia - version of the 12/4/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.