Subject: [Fwd: [Asrg] 7. Best Practices - Service Providers & MTA Authors (was: Fwd: Verisign's New Change and Outdate RBL's)]

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 16 Sep 2003 08:43:22 -0400

Forwarding from the ASRG list, more anti-spam tools being broken by 
Verisign.

-------- Original Message --------
Subject: [Asrg] 7. Best Practices - Service Providers & MTA Authors 
(was: Fwd: Verisign's New Change and Outdate RBL's)
Date: Tue, 16 Sep 2003 11:43:03 +0200
From: Brad Knowles <[email-masked]>
To: IRTF ASRG <[email-masked]>

Folks,

	Just saw this on NANOG as well.  Looks like outdated anti-spam
configurations will now be turned into "reject everything" servers,
courtesy of Verisign/NetSOL.

>Date: Tue, 16 Sep 2003 00:39:14 -0400
>From: Patrick Muldoon <[email-masked]>
>To: [email-masked]
>Subject: Verisign's New Change and Outdate RBL's
>
>
>Was playing with a test box here at home. Installed SpamAssassian 
>from a newely cvsup'd ports tree on a FreeBSD box, and was surprised 
>to see messages getting marked as received in blacklists that no 
>longer exist.  Most noteably ORBS.  Since this was a fresh Install I 
>hadn't gone through and removed the dead RBL's from 20_head_tests.cf 
>yet.  Since dorkslayers doesn't exist. any queries for it are 
>returning that infamous sitefinder address.
>
>[doon@fawkes doon]$ host  34.131.246.64.orbs.dorkslayers.com
>34.131.246.64.orbs.dorkslayers.com has address 64.94.110.11
>
>So anybody that hasn't update their SpamAssassian config, now has 
>the added benefit of all ip's being tagged as an open relay.
>
>Just an FYI
>-Patrick

---

From: Dean Anderson <[email-masked]>
Date: Tue, 16 Sep 2003 10:32:06 -0400 (EDT)

The ORBS lookup is a problem with configuring invalid domains in spam
tools.  Someone else could have re-registered orbs.org, and taken control
of your email system.

This is just irresponsible configuration.

		--Dean