== Checking for dead DNSBls Another Saturday, another spam entry. Today I decided to look at our logs to see if some of the DNSBls we check had either gone away or weren't giving us any hits. Since our software checks DNSBls in sequence instead of in parallel, removing useless DNSBls both reduces query volume and speeds things up slightly. (In general, it's wise to do this periodically unless you're current on _news.admin.net-abuse.email_ and other information sources, and already know about any changed or decommissioned DNSbls.) This time around, I didn't find any. The closest to not being used is _opm.blitzed.org_, with _dnsbl.njabl.org_ and _relays.ordb.org_ as runners-up, but I decided not to remove any of them. I also considered shuffling the order of the checks, but decided against it on policy reasons. I would rather reject a SMTP connection for a clear neutral reason like 'open proxy' rather than something more contentious, like 'listed in Spews', even if being listed in Spews is several times more likely than being listed in _opm.blitzed.org_. So _opm.blitzed.org_ stays before Spews in our checks. This isn't a completely loss; although I wasn't able to remove anything and this blog entry is a bit boring as a result, at least I checked. {{CutShort:blog}} For information, here is the raw numbers: 161697 total rejections 17995 class bl-cbl 2385 class bl-spews 2250 class bl-sbl 2071 class bl-dsbl 1510 class bl-sdul 886 class bl-ordb 779 class bl-njabl 305 class bl-opm Also: 21900 DNS unknown: APNIC bad rDNS 16729 DNS unknown: Korean bad rDNS 7774 dynamic comcast.net ?? 6403 dynamic XXX-YYY comcast.net 6228 dynamic rr.com cablemodems 3187 DNS unknown: LACNIC bad rDNS 2985 dynamic rogers.com 2888 DNS unknown: Chinese bad rDNS 2564 dynamic verizon 2522 DNS unknown: misc bad rDNS 2436 DNS noforward: LACNIC bad rDNS The CBL figures will be somewhat distorted by last week's experiment in promoting it to the front of the checklist, as recounted in [[CBLStats-2005-06-27]]. And IP-level rejections: Host/Mask Packets Bytes 65.214.61.100 5409 260K 213.4.129.48 4690 215K 62.219.46.43 4580 220K 212.216.176.0/24 4310 213K 24.156.64.52 3761 181K 220.160.0.0/11 3297 168K 200.123.152.60 2536 152K 61.128.0.0/10 2529 129K 219.128.0.0/12 2173 112K There's some new faces this week, including a very persistent IP address in Israel. I'm vaguely startled that 24.156.64.52 is *still* hammering away (and more startled that it doesn't seem to be on the CBL or other lists of open proxies; just what is going on with that machine?).