DNS Blacklists - ORF Forums

Curious if anyone is using a blacklist other than the canned ones that Vamsoft puts out?

We are using Invaluement with great success so far. I will post our stats upson our ten day trial completion.

Is anyone else using a DNS blacklist they have had success with that is not part of the Vamsoft downloads?

We also use Invaluement - have done so for over a year and have been happy with the results. We were constantly having DNS errors/timeouts with Spamhaus and looked for an alternative.

I tried their commercial trial and go \t the same results.

@ATL: We signed up for SpamHaus Datafeed and do not use forwarders (ISP DNS servers) and we have not had any errors. Perhaps you could review your DNS, you may find a source for the errors.

As some of you know I am on a crusade to get snowshoe spam stopped and a good snowshoe-aware RBL would be perfect. So far I have not been able to find a good RBL that adequately handles snowshoe, at least not early enough to stop the initial bursts. SpamHaus Snowshoe CSS exists as part of ZEN but I have not seen help much (about once per day for our mail).

I spot-checked and spoke to Invaluement and it may work for some of you. For myself, I found that while he does list spam sources quickly, for us about 50% of the time the initial snowshoe bursts would still get thru so I am not settling.

Domain reputation for identifying new domains could be useful. For example, it is likely that a domain created today is a throw away domain for spam. If it exists for more than a few hours then the usual SURBL's pick it up. During the initial burst we are left exposed to it and a domain reputation service may help. As mentioned before in this forum, Farsight offers NOD for newly observed domains for a fee. Contact them for details. tcpiputils.com will also offer a domain reputation API due out next week but it will not run as an RBL but rather a REST query returning JSON so you'd need to code up an external agent for that. www.whoisxmlapi.com offers a similar service, again only providing JSON or XML.

I am currently crafting my own approach to snowshoe as an external agent since there do not seem to be any good options for ORF at the moment.

@Sam Russo: One thing I am going to try and see if it helps...

There is a setting under greylisting to not greylist if they pass the PSF test. I am turning that off. Now even if they pass the SPF test it will delay the email.

I am noticing alot of snowshoe that gets thru is listed like 1 minute later by Invaluement and sometimes Spamhaus.

Maybe this will help ? The spammers will maybe get delayed a few extra minutes and hopefully by then they will be listed?

@steve.mills: I have noticed this as well and am going to try the same thing. Did it help you?

Steve,

Thanks for posting this thread. Based on your positive feedback my organization decided to also try out Invaluement's 10 day trial. We are seeing very positive results as well. We receive in the vicinity of 35K emails a day between our 500 users and Invaluement adds about an extra 1,000 emails to the block list. We utilize Greylisting and out of all our (8)DNSBL and (4)SURBL tests which blocked 3016 emails-- Invaluement's contribution to that was 31%. We still get the biggest spam block rates from our SPF Testing, Honeypots, and Manual Sender/Keyword blacklists-- but as far as subscription blacklists only SpamHaus which we also pay for a feed contributes more than Invaluement.

The cost for a yearly subscription is low so I think we are going to go ahead and sign up for the service. Adding it to ORF was as simple mimicing the pre-existing Spamhouse entries as a positive hit also returns 127.0.0.2.

I wouldn't have found Invaluement without this post-- so many thanks to you!

I have been using Truncate and WPBL lately with some good results.

We registered with Barracuda, and it catches the most (16%), followed by CBL (5.5%) and UBL (5.1%). Truncate scored 2.7%.