Status of blackholes.intersil.net: DEAD

I've recently received a few requests regarding blackholes.intersil.net. According to this message to news.admin.net-abuse.blocklisting, this blocking list was retired in July, 2006. Confusingly, the zone still contains a test entry. Regardless, I've seen no hits against it in a very long time. Therefore, if you are using this DNSBL for spam blocking, I recommend you cease doing so. If you have any further information about this list, please feel free to contact me.

Status of blacklist.spambag.org: DEAD

As of Sunday, May 27th, 2007, the blocking list Spambag, with the DNSBL zone blacklist.spambag.org, is no longer available. The website www.spambag.org does not resolve to an IP address, and there appear to be no DNS entries under the DNSBL sub-zone.

Spambag, created and run by Sam Varshavchik, developer of the Courier mail server, has been operating this list since at least November, 2001.

The list had the following listing criteria: "[Spambag is my] personal list of networks who I block from sending me mail or accessing my web servers, because I believe the networks actively or passively allow abusive or antisocial behavior. Examples of what I consider abusive or antisocial behavior are: spamming, mailbombing, mail server dictionary attacks, and web page E-mail address harvesting."

I last noted a hit against this DNSBL on May 26th, at 1:34 am US central time. Note that I was not a user of this list; I simply measure its effectiveness and status, like I do for many other lists.

This post to news.admin.net-abuse.email explains that Sam Varshavchik shut the list down, and that he felt his efforts had not been as productive as he would've liked them to be.

I would recommend removing blacklist.spambag.org from your list of DNSBLs to check, as it is no longer in operation.

Status of relays.orbs.org: Shut down, legal troubles in 2001

Remember ORBS? Short for “Open Relay Behavior Modification System,” it was a blocking list run by Alan Brown from New Zealand. (Mr. Brown ran the second version of ORBS. The first version had been run by Canadian Alan Hodgson.)

People keep asking me about the situation regarding ORBS and its eventual downfall. It happened so long ago, that I don't feel that it would be appropriate to try to fill people in from memory alone. Instead, here's links to a lot of the articles I've found regarding Alan Brown and ORBS. If you have any others, drop me a line and I'll add them to this page.

• Wikipedia's page on ORBS.
• Thread from the newsgroup nz.comp that discusses the shutdown and contains opinions regarding ORBS' listing policies.
• Here's an overview of legal action against Alan Brown, I believe around the same times as ORBS was imploding. Apparently he was sued for defamation over this newsgroup post, and lost. (More commentary on that here, from someone else involved, writing about it a couple of years after the fact.)
• This Register article talks about the legal action against Alan Brown and ORBS regarding Alan's listing of Xtra and Actrix. Courts found that they were falsely listed on the ORBS blocking list.
• An Actrix rep points out that the reason they were listed is due to getting sucked into the disagreement between Alan Brown and Domainz Followups from others indicate that the Actrix IP address was listed as an open relay input. According to Actrix, it was not an open relay.
• Some newsgroup commentary regarding the defamation suit and ORBS listing policies.
• Tom Betz posts Alan Brown's statement to SPAM-L encouraging the blocking of Telecom NZ and indicating that he's no longer in New Zealand.
• Here's an interesting article about ORBS and the controversy surrounding its practices, from Salon.com.

Please note that I'm not linking to any commentary or conspiracy theories put forth by emotional, anti-blocklisting “how dare you block my guaranteed opt-in email” people. There are many blocklists run correctly and appropriately. There were then, and there are now. The lists themselves weren't the problem, and aren't the problem now. Like with any other field of study, type of product, or process, some manage it well, and others do not.

NJABL Dynablock List Now Obsolete

With the advent of Spamhaus's new PBL anti-spam blocking list, it appears that the NJABL Dynablock list is now obsolete. I just saw the following post on the public SPAM-L mailing list, from the NJABL folks: The following text was sent to list AT njabl.org on Jan 19, 2007. Judging from the number of DNS queries still being handled for dynablock.njabl.org, the message doesn't seem to have made it to a wide enough audience.

If you use or know people who use dynablock.njabl.org, this is important information:

With the advent of Spamhaus's PBL (http://spamhaus.org/pbl/), dynablock.njabl.org has become obsolete. Rather than maintain separatesimilar DNSBL zones, NJABL will be working with Spamhaus on the PBL. Effective immediately, dynablock.njabl.org exists as a copy of the Spamhaus PBL. After dynablock users have had ample time to update their configurations, the dynablock.njabl.org zone will be emptied.

Other NJABL zones (i.e. dnsbl, combined, bhnc, and the qw versions) will continue, business as usual, except that combined will eventually lose its dynablock component.

If you currently use dynablock.njabl.org we recommend you switch immediately to pbl.spamhaus.org.

If you currently use combined.njabl.org, we recommend you add pbl.spamhaus.org to the list of DNSBLs you use.

You may also want to consider using zen.spamhaus.org, which is a combination zone consisting of Spamhaus's SBL, XBL, and PBL zones.

(Editor's note: I'm very happy with ZEN so far. See this post detailing my recent experiences.)

Status of block.blars.org: DEAD

The “Blars” DNSBL (block.blars.org) appears to have gone on walkabout.

Created in 2002, the “Blars Block List” was an aggressive, semi-private blocking list run by a gentleman known to the greater internet community only by the pseudonym of “Blars.”

The "BlarsBL" had a broad criteria for listing. This included spam sending domains, open relays, sites with disagreeable spam reporting policies, sites lacking abuse addresses, those who host spammer dropboxes or websites, those who have threatened Blars or others with legal action, and sites originating break-in attempts and other exploits (open proxy, open relay, etc.).

The list has been criticized for implying that payment was required for removal. From the site: "If you would like a site be added or removed from BlarsBL, you may hire Blars at his normal consulting rates (currently $250/hour, 2 hour minimum, $1000 deposit due in advance for non-established customers) to investigate your evidence about the site. If it is found that the entry was a mistake, no charge will be made and the entire deposit will be refunded."

The list appears to be no more. The websites www.blars.org and block.blars.org both resolve to a “This domain is parked free with GoDaddy” placeholder page.

Note: I confirmed today that all lookups against block.blars.org DSNBL will result in a match. This is the “Osirusoft solution,” also known as “listing the whole world.” Intentional or not, this means that if you continue to use this blocking list, you will receive no incoming mail whatsoever. If you are using this list to reject mail, I recommend you cease doing so immediately. It will block all of your inbound mail. See this page at MXToolbox.com further confirmation of BLARS mysterious disappearance. This post from the newsgroup news.admin.net-abuse.email indicates that it has likely been out of operation since approximately December 18, 2006.

Status of relays.ordb.org: DEAD

Created by Thomas Jensen in 2001, the Open Relay Database (ORDB) was one of the multitude of open relay spam blocking lists to come about in the wake of the legal troubles of Alan Brown and his New Zealand-based ORBS DNSBL.

The ORDB service ceased operation on December 18, 2006. The website was retired on December 31, 2006.

The website indicated that blocking open relays is no longer as effective as it once was.

"It's been a case of a long goodbye as very little work has gone into maintaining ORDB for a while. Our volunteer staff has been pre-occupied with other aspects of their lives. In addition, the general consensus within the team is that open relay RBLs are no longer the most effective way of preventing spam from entering your network as spammers have changed tactics in recent years, as have the anti-spam community.”

If you have checks against relays.ordb.org configured in your mail server or spam filtering software, please stop querying the list immediately. Use of the list will no longer block any unwanted spam, and the nameservers listed in the domain registration are likely overwhelmed with traffic. This is especially heightened due to the fact that the list was in wide, popular use, and also that it was so recently retired.

3/26/08 Update: ORDB has "listed the entire world" -- returning any query with a "listed" response. The result is that if you still have ORDB in your mail server config files, you're now blocking 100% of your inbound mail. For anyone still trying to "use" ORDB, you're not going to receive any inbound mail until you disable queries to it.

Status of opm.blitzed.org: DEAD

The primary project of the “Blitzed” group is the Blitzed Internet Relay Chat (IRC) network.

They also operated a DNSBL zone called opm.blitzed.org. This was the Blitzed Open Proxy Monitor (OPM). This popular open proxy DNSBL was run in such a way as to not probe a remote server to determine its open proxy status unless the server was implicated in reports of abuse. It did not list open relays.

The Blitzed group seems to have suffered a database or server failure as of May, 2006. This email to the “OPM Announce” mailing list details the situation, and explains that the OPM list would not be resurrected.

The list is not active at this time.

Based on this information, I would recommend that you remove opm.blitzed.org from the list of DNSBLs being checked in your mail server. It will no longer block any spam, and the potential exists for unpredictable results to be returned. Additionally, you'll be generating unnecessary DNS query traffic to the Blitzed network.

Status of relays.visi.com: DEAD

The zone relays.visi.com was home to the VISI.com Relay Stop List (RSL). According to the site, “RSL was created by volunteers, VISI.com users who wanted a conservative open relay list to use to assist VISI.com's "nospam" server filters. We are happy to share it with others in the Internet community.”

Hosted by VISI.com, a strong regional internet service provider with thousands of clients, it was positioned as a free alternative to the MAPS RSS relay blocking list. (The MAPS lists were originally free, but were converted to a “paid access only” system in 2001.)

In 2003, the RSL suffered from a hardware failure that resulted in a loss of data, but the system was restored by August.

The RSL website was last known to have been active in 2004. I have it on pretty good authority that since then, the people behind the project have moved on to other things.

The list is not active at this time. It will not block any spam, and I recommend against including it in any DNSBL checks, as it generates unnecessary DNS traffic to VISI.com.

Status of relays.radparker.com: DEAD

The DNSBL relays.radparker.com is no longer valid. If you are using relays.radparker.com in a mail server or spam filtering product, please stop doing so immediately. It will not block any spam. No DNSBL has been available under this domain for years, and unexpected results may be returned.

It used to be the home to a list called the Radparker Relay Spam Stopper (RRSS). The RRSS was a list that I myself (Al Iverson) created in early 1999 to help mail server administrators reject mail from open relaying mail servers. Back then, open relays were the primary transmission vector for the worst-of-the-worst kinds of spam. I created the list primarily to offer an alternative to ORBS, an open relay blocking list run by Alan Brown out of New Zealand. (This ORBS was a sort of descendant of a previous ORBS, run in Canada by Alan Hodgson.) Alan (Brown) had a habit of getting into arguments with people who were listed, actively probing mail servers without permission, listing things that didn't actually qualify as an open relays, and so forth. I found it distasteful and unfriendly.

Major policy differences for my new alternative open-relay list included:

• A remote server was not tested for open relay unless a spam message was received.

• Public record was kept of the spam message, and test proving the site was an open relay.

• Anybody could request that any listing be removed, and it would be removed.
  

The net result was that ORBS ended up imploding under various legal challenges, and the RRSS ended up becoming the Mail Abuse Prevention System (MAPS) RSS, later a component of a commercial spam-filtering solution, provided as of late by MAPS' current owners, Trend Micro.

Throughout the spring and summer of 1999, the RRSS list grew in popularity. At its peak, we figured that it was protecting over 350,000 mailboxes from open relay spam, and was used by quite a few local and regional ISPs, including USWest/Qwest.

I created the list on my own, on my spare time. Back then, it was hosted by my employer, with their permission. This meant that the company would occasionally get a screaming goober phone call from somebody whose mail got blocked, who couldn't figure out how to resolve the issue, and was sure that there was some giant conspiracy in place to harass them. (I probably wasn't as polite to some of those folks as I should have been, either.) Eventually enough of those calls started coming in that I decided it wasn't very wise to continue hosting the RRSS from my office at work. That's when I started talking to MAPS. They offered to host the project for me under the MAPS umbrella, a partnership I entered into somewhere around August or September 1999. Eventually my volunteer work turned into a full time job working for MAPS, where I continued to manage and develop the RSS project, as well as working as an investigator for the MAPS RBL (Realtime Blackhole List) project.

I left MAPS in October, 2000.

The zone relays.radparker.com was emptied out sometime after the project was moved to the MAPS' servers in California. That was back sometime in 1999 or 2000. It's not been used to host a DNSBL since.

Interestingly, the RRSS data, process, and code was my own intellectual property that I brought with me to MAPS, and never had any sort of formal agreement to transfer ownership to them. When I later left, I decided my heart lay elsewhere and I never pursued any sort of plan to take the project back unto myself. My friend Gordon Fecyk, who created what became the MAPS DUL, found himself in a similar situation when he left MAPS in 2002. In his case, he attempt to continue with his DUL project. This resulted in him being sued by MAPS, having been accused of stealing MAPS' own intellectual policy-- a claim I suspect was distorted and probably unfounded, as did others.

MAPS founder Paul Vixie recently posted to a mailing list that the original, long-dead MAPS RBL zone of rbl.maps.vix.com is still receiving may queries against it. This got me to thinking – I did a bit of Google searching myself and found that there are still some people out there wondering if the RRSS zone of relays.radparker.com is working. So, here I am, posting this information, in the hope that the next time somebody's wondering, they'll query Google for more information, and find this page with the definitive answer: Nope, there is no DNSBL to be found at relays.radparker.com.

Status of rbl.maps.vix.com: INVALID DOMAIN

In January 2007, MAPS (Mail Abuse Prevention System) co-founder Paul Vixie noted on the NANOG mailing list that he continues to receive significant traffic from sites attempting to query the “rbl.maps.vix.com” blocking list.

The DNS zone “rbl.maps.vix.com” was the original zone for the MAPS Realtime Blackhole List (RBL), the first widely-used anti-spam DNSBL. The zone has long since been replaced with another, named blackholes.mail-abuse.org.

The queries against rbl.maps.vix.com will never return anything valid. It’s my understanding that you currently would get no response, and it will block no more mail. You risk eventually blocking wanted mail, if Vixie later decides to implement a wildcard listing strategy, to force sites to stop using his list. (This would make all inbound mail to any site using the list bounce.)

If you currently have rbl.maps.vix.com on the list of DNSBLs you are querying, please remove it. As indicated above, there is currently no spam-blocking value, and there is potential for future risk.

It appears that RBLSMTPD, a tool to allow sites to utilize DNSBLs to block mail, widely utilized in conjunction with qmail, will default to querying rbl.maps.vix.com. If you use RBLSMTPD, please review your configuration to ensure that you’re not contributing to this problem.

If you are attempting to use the MAPS RBL, please do not simply change over to the blackholes.mail-abuse.org zone. The MAPS services are not free, and are blocked from unregistered access. Please see the MAPS website for more information.

If you’re looking for a free, reputable blocking list suite to try, my recommendation would be to consider Spamhaus’s ZEN combined list. I plan to post an article about them very soon, and I’ll link to that from here, after it’s posted.

It's very unlikely that you would see a bounced email message making reference to rbl.maps.vix.com. If you do see such a bounce, it is likely in error. Contact the site (from another email account or via telephone call) and point them toward this site for further information.

Status of lbl.lagengymnastik.dk: DEAD

The DNSBL lbl.lagengymnastik.dk is no longer active. It ceased operation back in 2003 or 2004.

In January 2007, Henrik, the operator of this DNSBL, indicated that his bandwidth is still being greatly consumed by DNS queries against his list. Because of this, he has implemented a “wildcard listing strategy” to force sites to stop using the list.

In a wildcard listing strategy, a DNSBL lists all IP addresses in the world. That means that anybody using this list will no longer be able to receive any mail at all. This controversial “last resort” is done as a wake-up call for sites using the list. Suddenly they stop receiving all inbound mail, and hopefully they soon realize what’s going on and resolve it.

If you find your mail bouncing with a reference to the lbl.lagengymnastik.dk list, contact the site that blocked your mail. I assume you’ll have to do that via telephone, since mail to them will not go through. Inform them that the list is no longer around. Direct them to this site or recommend they do a Google search to learn more.

For more information, visit the LBL website, and this posting to the usenet newsgroup news.admin.net-abuse.blocklisting. (Note that “the Osirusoft solution” refers to a wildcard listing strategy.)

How to confirm the current status of SPEWS

I figured it would be helpful if people were able to check my work. If you’d like to confirm for yourself whether or not SPEWS has been updated recently, here’s a couple different ways you could do that.

Go to this page on the SPEWS site, using the Mozilla Firefox web browser. You’ll get a list of network blocks and IP addresses. Right click on an empty space on the page, and select “View Page Info.” The window that pops up contains a “modified” field. That indicates the last time the SPEWS data was updated.

If you don’t use Firefox, here’s another way you can check. Go to http://web-sniffer.net and paste in this URL: http://www.spews.org/spews_list_level1.txt

Then, hit the submit button. You’ll get a page of output that includes a “last modified” field. This field indicates the last time SPEWS data was updated.

From here you can return to “SPEWS Current Status,” or return to “What to do if you’re listed on SPEWS.”

SPEWS Current Status: DEAD

Please note: I have no involvement in SPEWS. I publish this information simply to be helpful to people I see trying to figure out what to do about a SPEWS listing.

SPEWS is clearly dead/abandoned. SPEWS data has not been updated since Wednesday, August 23, 2006 11:03:29 PM.

This means that the SPEWS data has not changed since August, 2006. This data likely would not be intentionally frozen in time. I am told that the data was generally updated periodically. This probably means that whoever maintains the SPEWS list is unwilling to make updates, or has abandoned this data. I'm not sure -- I don’t know what’s going on behind the scenes. I just know that the data is out of date.

If you'd like to confirm this for yourself, I explain how to do that here.

I confirmed with other smart anti-spam folks to ensure that I am checking this properly, and I’m pretty sure it’s correct.

I will update this page with more information as I have it. Please feel free to contact me if you have any information regarding the SPEWS site or data.

Update as of Thursday, February 1, 2007: Matthew Sullivan of SORBS has emptied out the SPEWS data he was previously serving via his nameservers. Read more >>

If you are listed on SPEWS, don't despair. I've compiled some tips on how to deal with the situation. Click here to read on.

What to do if you're listed on SPEWS

The newsgroup news.admin.net-abuse.blocklisting (NANAB) regularly plays host to blocklist removal requests. Most of those requests seem to be aimed at SPEWS (the Spam Prevention Early Warning System). The SPEWS FAQ says that “general blocklist related issues can be discussed in the public forums” including NANAB. The end result is that lots of folks post to NANAB, asking that their IP address(es) be removed from SPEWS. Those folks get lots of responses, and only some of them are helpful. Because (as of January, 2007) SPEWS seems to have been frozen in time for many months, I’m sharing this information on my site to help affected folks get the facts on what’s going on, and provide suggestions on how to handle the situation.

Note: This isn’t guidance on how to avoid getting listed or sidestep anti-spam groups. This is information regarding how to address an issue with a now-defunct blocklist, where there’s nobody at the group to contact to request delisting.

If you’re listed on the SPEWS blocking list, as confirmed by checking their website, then I’m of the opinion that the following steps are probably what you should take to deal with the issue.

1. Check the status of SPEWS here. If it’s long out of date, proceed with the steps below. If it’s been updated recently, read the SPEWS website for information on how to proceed.
2. Assuming that SPEWS has not been updated in months, your next step should be a review your bounce data. Does it contain bounce data that references a SPEWS block?
3. If no, don’t worry about it. You just determined that you’re not having blocking issues that you can trace back to SPEWS. It’s annoying that you’re listed on the website, but there’s little easy recourse available to you to address that. However, if your bounce data does indicate blocking that you can trace to a SPEWS listing, proceed with the following steps.
4. If you have a spam issue, resolve it. Just because SPEWS may be gone, doesn’t mean that your spam blocking issues are going to magically going to go away. If SPEWS is listing you, other blocklists or ISPs are probably blocking your mail. Make sure you’re doing everything possible to comply with best practices, and remember that complying with the law just isn’t enough. I realize that this guidance is pretty brief and high level. Reach out to an email service provider (ESP) or email deliverability/reputation consultant for further assistance, as appropriate.
5. Contact the site bouncing your mail. Show them that SPEWS is out of date and is no longer updating. Feel free to point them at this site. You should be able to demonstrate to them that you do not spam. Be polite. ISPs and companies are perfectly free to block your mail. Attempts to strong-arm a site into accepting your mail are legally and ethically questionable, and will cause far more problems than realize.
6. Read the bounce to see if you can determine who is serving up the SPEWS blocklist. SPEWS doesn’t publish the data as a blocklist themselves; they leave that to others. As of February 1, 2007, Matthew Sullivan of SORBS has stopped serving the stale SPEWS data. I assume that other sites serve it up as well. If you find that a site is serving up this outdated info from SPEWS, contact them and let them know that the information they’re sharing is out of date. Feel free to point them toward this site. Recommend they follow Matthew's example with regard to nulling out the listings until (if) SPEWS returns.

I hope you find this information helpful. Please feel free to contact me with your comments or feedback. But, please note that I'm unable to consult with you regarding your specific situation -- I've already got a full time day job, and I'm not looking for consulting clients.