Subject: Testing DNSBLs

From: [email-masked]
Date: Tue, 14 Aug 2007 14:32:40 +0000 (UTC)

Hi!

Has anyone created a test to check if a specific IP is in a DNS based
black list?

It could be done with a DNS based test but you want the test to fail if
the entry is found and not if the entry is not found, i.e. Argus should
complain when the IP address is listed.

I guess that could be done with something like

        Service UDP/DNS {
                zone:   2.0.0.127.ix.dnsbl.manitu.net
                class:  IN
                query:  A
                test:   answer
                nexpect:        127.0.0.2
        }

but is there a more "elegant" way for multiple DNSBLs?

We want to keep an eye on the IP addresses of our mail servers and if
they are listed in the various black lists.

Greetings
-- 
Robert Sander                     Senior Manager Information Systems
Epigenomics AG    Kleine Praesidentenstr. 1    10178 Berlin, Germany
phone:+49-30-24345-0                            fax:+49-30-24345-555
http://www.epigenomics.com             [email-masked]

---

From: "Andrew Kirch" <[email-masked]>
Date: Tue, 14 Aug 2007 14:47:37 -0400

I don't know that I'd use argus for this.  www.dnsstuff.com queries all
of the major DNSBL's.  I think that'd be a lot easier than doing DNSBL
lookups for every IP you have, and it'd reduce the load on our (I own
and operate the AHBL (www.ahbl.org)) servers.  If you wanted to do
something more automated consider writing a shell script to parse your
mail log for 550's and have it fail when someone 550's your mail with a
regexp check for "please see www.<DNSBL THAT BLACKLISTED
YOU>.TLD/<somelookuppage>.pl" and then have argus fail on the exit code.
(export the mail log via NFS if it's not on the machine running Argus).
You might find starting with the AHBL SpamHaus, SpamCop, SORBS, DSBL,
NJABL is a good start, and their websites (and spamassassin/other spam
tools include example phrases to look for).  Hopefully this is a couple
good suggestions to get you started.

Andrew D Kirch - AllThingsIT
Office: 317-755-0200
GPG: 735D020C

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of [email-masked]
> Sent: Tuesday, August 14, 2007 10:33 AM
> To: [email-masked]
> Subject: Testing DNSBLs
> 
> Hi!
> 
> _______________________________________________
> http://argus.tcp4me.com/
> [email-masked]
> http://www.tcp4me.com/mailman/listinfo/arguslist

---

From: "Jason 'XenoPhage' Frisvold" <[email-masked]>
Date: Wed, 15 Aug 2007 16:18:39 -0400

> and operate the AHBL (www.ahbl.org)) servers.  If you wanted to do

Is one check a day really that much load?  I kinda liked Rob's idea,
actually.. Though, I try to focus on not letting spam emanate from my
server first..  :)

> Andrew D Kirch - AllThingsIT

- --
- ---------------------------
Jason 'XenoPhage' Frisvold
Engine / Technology Programmer
[email-masked]
RedHat Certified - RHCE # 803004140609871
MySQL Pro Certified - ID# 207171862
MySQL Core Certified - ID# 205982910
- ---------------------------
"Something mysterious is formed, born in the silent void. Waiting alone
and unmoving, it is at once still and yet in constant motion. It is the
source of all programs. I do not know its name, so I will call it the
Tao of Programming."

---

From: "Andrew Kirch" <[email-masked]>
Date: Wed, 15 Aug 2007 16:43:59 -0400

If it was one check a day, it's certainly not.  I am working from
experience where I had people downloading our spam-sources text zone
file once every 60 seconds.

> On Behalf Of Jason 'XenoPhage' Frisvold
> Sent: Wednesday, August 15, 2007 4:19 PM
> To: Discussion about Argus
> Subject: Re: Testing DNSBLs
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Andrew Kirch wrote:
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iD8DBQFGw1+fhR5xme3cl74RAiwpAJ9bDtxG69/ENgIgWl3SHvcfG9UgRQCfbQBy
> Dc7hYZUYTXeAYPZ1poJD6tU=
> =aAvf
> -----END PGP SIGNATURE-----