North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: Security of DNSBL spam block systems

  • From: Simon Lyall
  • Date: Tue Jul 23 20:06:10 2002

On Tue, 23 Jul 2002, Brad Knowles wrote:
> 	IMO, there is a serious risk of having DNSBL servers attacked and
> used as a DoS.

A slightly different sort of DOS from what you mean would be what we got a
few days ago. I got a call from our Noc about problems with our
old (but still online) incoming mail servers. They were taking about a
minute to put up their SMTP banner when you connected to them.

Turned out the problem was that we were using bl.spamcop.net which was
being DOSed at the time ( according to most reports, some said they had
upstream link problems ) .

The live servers are using spamassassin which has decent timeouts so they
were not affected. We try and slave as many RBLs as possible locally
to avoid these sort of problems.

-- 
Simon Lyall.                |  Newsmaster  | Work: [email protected]
Senior Network/System Admin |  Postmaster  | Home: [email protected]
ihug, Auckland, NZ          | Asst Doorman | Web: http://www.darkmere.gen.nz