Subject: Re: [Asrg] DNSBL and IPv6

From: Hal Murray <[email-masked]>
Date: Thu, 25 Oct 2012 17:34:59 -0700

> Anyway, back on topic: I'm still not convinced we'd be talking about
> IPv6-based blacklists if we didn't have a long and successful history of
> IPv4-based blacklists.

How about enumerating goodness rather than badness?

Does anybody have a list of techniques to consider?

We don't have to list IP Addresses.  We could list domains and only accept 
mail if the IP Address reverses to a listed domain (and forward confirms).

Would ISPs be willing to run a (white)list of their customers?  (Either by 
domain or IP Address.)  How about web hosters?

> Can't we do something entirely different for IPv6? Like, use domain-based
> filtering by making it mandatory to DKIM-sign a message you send over IPv6
> outside of your network?

Does DKIM tell me anything about the sending site being good or bad?

If I get a DKIM signed message, I could lookup the domain rather than the 
sender's IP address.  Does that avoid the too-many-IPv6 addresses problem?

> I'm obviously biased since I run dnswl.org, but an IPv6-based whitelist may
> work better than an IPv6-based blacklist. Enumerating the goodness is
> generally easier than enumerating the badness. 

What fraction of email comes from hosts you have listed?  How hard would it 
be to scale your list up to cover the whole world?

Assuming that you don't want to put all your eggs in one basket, how many 
white lists would you need and/or how would you decide the order to check 
them?

Do we need a list of ISPs that maintain a list of their their clients?

-- 
These are my opinions.  I hate spam.

---

From: "Emanuele Balla (aka Skull)" <[email-masked]>
Date: Fri, 26 Oct 2012 10:12:20 +0200

> mail if the IP Address reverses to a listed domain (and forward confirms).

It's even worse, probably.
Reverse DNS lookups have the same problem DNSxL lookups have about
caching. And usually also a much higher latency because they need to hop
through several delegations before getting an answer.

> Does DKIM tell me anything about the sending site being good or bad?

No, but gives you an hook (the signing entity) you can bind to a
reputation score.

> sender's IP address.  Does that avoid the too-many-IPv6 addresses problem?

Not necessarily. See subdomaining...

-- 
Paranoia is a disease unto itself. And may I add: the person standing
next to you may not be who they appear to be, so take precaution.
-----------------------------------------------------------------------------
http://bofhskull.wordpress.com/

---

From: Matthias Leisi <[email-masked]>
Date: Fri, 26 Oct 2012 15:28:35 +0200

> be to scale your list up to cover the whole world?

We do store IPv6 addresses, but we don't publish them yet (since there
is no standard yet - the result of the discussion here may lead to the
emergence of a de-facto standard, or at least a first trial). So I can
not really tell what fraction we have listed in IPv6 world.

I can tell about our estimate on what we cover in terms of IPv4 based
on the dnswl.org stats. These stats are based not on SMTP trafffic,
but on the DNS traffic which we log (sample) on some of the public
mirrors. Larger senders with better cache utilization are likely to be
somewhat underrepresented in our data. We then do not use the absolute
numbers, but logarithmic magnitudes:

Magnitude	Percent
10.0	100%
9.0	10%
8.0	1%
7.0	0.1%
6.0	0.01%
5.0	0.001%
4.0	0.0001%
3.0	0.00001%
2.0	0.000001%
1.0	0.0000001%

Extract from our magnitudes report (I'll happily share more data on request):
1	9.63	IPs where we have no record
2	9.24	IPs which are in our DB*, not published - contains a lot of
"bad apples" ("DNSWL Id 0")
3	8.86	IPs which are in our DB*, not published - with fewer "bad
apples" ("DNSWL Id 1")
4	8.44	Yahoo
5	8.38 Google
6	8.36 Internally blacklisted (snowshoe ranges etc)
7	8.12 Hotmail
8	8.03 Facebook
9	7.91	Exacttarget
10	7.89	cheetahmail.com	

* Through imports from third parties or "learned" through the DNS logs

It's clear that key is the mag 9.63 of where we have no record. This
category contains all the residential/dynamic/botnet IPs; we do not
count the number of different IPs.

DNSWL Id 0 contains about 300k IPs, DNSWL Id 1 contains about 100k
IPs, all the other (published) DNSWL records contain about 200k IPs.
Records in 0 and 1 have quite some fluctuation (eg removed since they
are not present in the import source any more; promoted from "0" to
"1" based on some criteria; demoted from "1" to "0" based on the lack
of the same criteria). Entries are manually promoted from "0" and "1"
to one of the published DNSWL Ids.

Possibly 80k in each of the two "special" records may be considered
"good" (as in: not operated by spammer/bot herders), which would lead
to ~ 360k mostly legitimate SMTP-sending IPs.

> white lists would you need and/or how would you decide the order to check

One? Definitely too risky. Two? Not sufficient, in my view. Three?
That may work. Four? Could improve diversity. Five? There is a point
where returns of additional lists become diminishing (eg higher
latency, larger overlaps).

-- Matthias