[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: NEVER USE SORBS



Prelude: Please people, email is a very definite system and especially with
blocking we as admins should be pedantic and exact about issues. Having said
this, I would like to highlight that I actually did talk about listing and
not delisting:

On Wed, Jul 26, 2006 at 11:11:24AM -0400, John Kelly wrote:
> On Wed, 26 Jul 2006 18:00:03 +0300, Juha-Matti Tapio
> <jmtapio@verkkotelakka.net> wrote:
> > c) Sorbs lists IP addresses for low TTL values.
> > None of these are true
> Clearly they refuse to delist IPs with low TTL values.  Your statement
> is misleading.

You are confusing listing criteria and delisting criteria. Sorbs does not
specify low TTL as a listing criteria and I have yet to see anyone present
proof of otherwise. And if TTL is not a listing criteria, it therefore is
propably never the sole delisting criteria. A lot of people have claimed
otherwise, but _that_ is misleading and not proved.

Let's consider a hypothetical scenario:

There are two hosts (Again note that I do not work for Sorbs and I am only
speculating based on what I have read about Sorbs):

Dyn-1-2-3-4.domain.tld and foobar.domain.tld. Both of these have a low TTL
such as 7200. If the published Sorbs listing criteria are correct, Sorbs
will list on DUHL the first address on-sight, but will not list the second
one because there is no reason to believe it to be dynamic.

Now if they both are actually statically allocated mail hosts, I do believe
it is enough if the ISP gives the first host a real reverse name and bumps
up the TTL temporarily (in order to publically state that this name change
is not just a short term trick), and asks Sorbs for delisting. Once
delisting is done and the first host has a real name, I do not see any
reason why it would end up magically listed again if it keeps looking like a
static host.

The most vocal people tend to claim that this is too much work and
impossible for them to do. While the TTL is not something I would personally
do, Sorbs has decided to use it as some kind of automatic indicator of the
willingness of postmasters to properly configure their systems. That is not
an entirely unfair assumption.

Now if I were wrong and Sorbs actually listed (as some people keep claiming)
hosts with no other reason than low TTL, then I think they would be wrong in
doing that and they would end up with _a lot_ of false positives.

> > but I use DUHL personally and my $DAYJOB includes postmaster-duties
> One postmaster who favors SORBS.  I suppose there will always be a
> small minority opinion, no matter what the topic.

Out of tens of thousands of mails I have yet to have only one person who was
caught as a false positive. If I were the only person blocking mail with a
DUHL, so be it. And as some of you are apparently planning to do, please
feel free to blacklist me for being such a huge problem that several
mailinglist threads, lawsuit threats against Sorbs and custom blacklists are
needed to try to make a small minority start receiving more spam :)

Attachment: signature.asc
Description: Digital signature


Reply to: