Security Basics: Re: RBLs for SPAM Control

[Devdas Bhagat <devdas () dvb homelinux org>]

On 03/08/05 11:48 +1000, Alexis wrote:
> Well, this morning i discovered that the IP address recently allocated to me 
> by my ISP is on the dnsbl.sorbs.net RBL . . . . :-/ i must say i'm not 
> enthused about the notion of being false-positived by spamfilters worldwide, 
> particularly since i maintain a tiny mailing list which sends out a news 
> email to  ~20 people each day.
Your next paragraph indicates that you are on the duhl.dnsbl.sorbs.net
list. That is especially meant to list dynamic IP addresses which should
not be sending direct to MX.

> Of course, i could shut down my net connection, wait a bit, then restart
> it in the hope that DHCP allocates me a different IP (although there's
> obviously no guarantee that the new IP won't be on an RBL as well). But
> this has got me wondering: how does an IP address get /removed/ from
> RBLs? Is there some sort of 'time-out' period, where if there are no
> reports of spam from a particular IP after a certain length of time, it
> gets removed from the list? Otherwise, i suspect that in the not-too-distant
> future, ISPs will find most of their IP address pool on an RBL . . . .
Different DNSBLs have different policies. list.dsbl.org does not time
out, but delists on request. The sbl removes IPs based on the removal of
the spammer. Spamcop has a three day lifetime for its entries. Normal
entries from dnsbl.sorbs.net expire in three months, but never from the
duhl.

Devdas Bhagat

> Alexis.