DNSBL 153977 223488821 2008-07-04T08:12:47Z Lyondif02 1514964 /* Terminology */ typo {{Refimprove|date=April 2008}}A '''DNS Blacklist''', or '''DNSBL''' ([[DNSBL#Terminology|definition below]]), is a means by which an Internet site may publish a list of [[IP address]]es that some people may want to avoid and in a format which can be easily queried by computer programs on the Internet. The technology is built on top of the Internet [[Domain Name System]], or DNS. DNSBLs are chiefly used to publish lists of addresses linked to [[spamming]]. Most [[mail transport agent]] (mail server) software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists. DNSBL names a medium, not any specific list or policy. There has been a good deal of controversy over the past several years over the operation of specific lists, such as the [[Mail Abuse Prevention System|MAPS]] RBL and [[Spam Prevention Early Warning System|SPEWS]]. == Terminology ==<!-- This section is linked from [[DNSBL]] --> The following are all closely related terms: * '''RBL''' is an abbreviation for "Real-time Blackhole List". As mentioned below, "RBL" was the name of the first system to use this technology, a proprietary MAPS DNSBL, and "RBL" is a registered trademark<ref>{{cite web |url=http://tmportal.uspto.gov/external/portal/tow?SELECT=US+Serial+No&TEXT=78055989|title=USPTO Serial #78055989/Reg. #2775425|accessdate=2008-05-27}} </ref>. Some pieces of mail software have configuration parameters that use "RBLs" or "RBL domains" when any DNSBLs can be used, not just the MAPS RBL. * '''DNSBL''' is an abbreviation that sometimes stands for "DNS blacklist", although different DNSBL operators define the term in various ways. The use of the word "blacklist" is somewhat controversial. The reasons cited include its association with [[Joseph McCarthy]] and legal liability<ref name='spamref1'> {{cite web|url=http://www.scconsult.com/bill/dnsblhelp.html |title=Blacklists, Blocklists, DNSBL's, and survival: |accessdate=2007-01-26 |last=Cole |first=William K |date=2007-01-16 }}</ref>. Instead, some people have suggested that DNSBL should stand for "DNS blocklist" even though DNSBLs are not always used for direct blocking, or "DNS blackhole list" based on the RBL expansion, even though the DNSBL method does not create true [[black hole (networking)|blackholes]]. A minimally controversial expansion of the acronym is "DNS-Based List"<ref>{{cite web|url=http://www.scconsult.com/bill/dnsblhelp.html#2-7 |title=Blacklists, Blocklists, DNSBL's, and survival: |accessdate=2008-05-26 |last=Cole |first=William K |date=2007-01-16 }}</ref><ref>{{cite web|url=http://groups.google.com/group/news.admin.net-abuse.email/msg/1f7376e33e08d25d?q=%22DNS+based+list%22|title=Usenet post referring to DNS-based list|date=1999-09-23|accessdate=2008-05-27}}</ref><ref>{{cite web|url=http://groups.google.com/group/news.admin.net-abuse.email/msg/c4d4fbdbfdfe82e1?q=%22DNS+based+lists%22|title=Usenet post by MAPS staff using "DNS-based lists" generically|date=2000-03-10|accessdate=2008-05-27}}</ref>. * '''DNSWL''' is an abbreviation for "DNS whitelist". It is a list of IP addresses that some people may want to treat more favourably. * '''RHSBL''' is an abbreviation for "Right Hand Side Blacklist". This is similar to a DNSBL but it lists [[domain name]]s rather than IP addresses. The term comes from the "right-hand side" of an email address — the part after the ''@'' sign — which clients look up in the RHSBL. * '''URIBL''' is an abbreviation for "[[Uniform Resource Identifier]] Blacklist". A URIBL lists domain names and IP addresses that appear in URIs such as web sites mentioned in message bodies. It contrasts with an RHSBL which lists domain names used in e-mail addresses<ref> {{cite web|url=http://www.spambouncer.org/reference/blocklists.shtml#URIBL |title=The URIBL Blocklist Family |accessdate=2007-01-26 |last=Hampton |first=Catherine A. |date=2005 |work=Blocklists Supported by the SpamBouncer |publisher=SpamBouncer }}</ref>. == History of DNSBLs == The first DNSBL was the Real-time Blackhole List (RBL), created in 1997 by [[Paul Vixie]] as part of his [[Mail Abuse Prevention System|Mail Abuse Prevention System (MAPS)]]; Dave Rand at Abovenet was its first subscriber.<ref> {{cite web|url=http://sunsite.uakom.sk/sunworldonline/swol-12-1997/swol-12-vixie.html |title=What will stop spam?: |accessdate=2008-05-16 |last=McMillan |first=Robert |date=1997-12-xx }}</ref> Initially, the RBL was not a DNSBL, but rather a list networks transmitted via [[BGP]] to [[router]]s owned by subscribers so that network operators could blackhole all [[TCP/IP]] traffic for machines used to send spam or host spam supporting services, such as a website. The purpose of the RBL was not simply to block spam&mdash;it was to educate [[Internet service provider]]s and other Internet sites about spam and related problems, such as open [[SMTP]] relays, [[spamvertising]], etc. Before an address would be listed on the RBL, volunteers and MAPS staff would attempt repeatedly to contact the persons responsible for it and get its problems corrected. Such effort was considered very important before blackholing all network traffic, but it also meant that spammers and spam supporting ISPs could delay being put on the RBL for long periods while such discussions went on. Later, the RBL was also released in a DNSBL form and Paul Vixie encouraged the authors of [[sendmail]] and other mail software to implement RBL clients. These allowed the mail software to query the RBL and reject mail from listed sites on a per mail server basis instead of blackholing all traffic. Soon after the advent of the RBL, others started developing their own lists with different policies. One of the first was Alan Brown's [[ORBS|Open Relay Behavior-modification System (ORBS)]]. This used automated testing to discover and list mail servers running as [[open mail relay]]s&mdash;exploitable by [[spammers]] to carry their spam. ORBS was controversial at the time because many people felt running an open relay was acceptable, and that scanning the Internet for open mail servers could be abusive. In [[2003]], a number of DNSBLs have come under [[denial-of-service attack]]s. Since no party has admitted to these attacks nor been discovered responsible, their purpose is a matter of speculation. However, many observers believe the attacks are perpetrated by spammers in order to interfere with the DNSBLs' operation or hound them into shutting down. In [[August 2003]], the firm ''[[Osirusoft]]'', an operator of several DNSBLs including one based on the [[Spam Prevention Early Warning System|SPEWS]] data set, shut down its lists after suffering weeks of near-continuous attack. == DNSBL operation == To operate a DNSBL requires three things: a domain to host it under, a nameserver for that domain, and a list of addresses to publish. It is possible to serve a DNSBL using any general-purpose [[Comparison of DNS server software|DNS server software]]. However this is typically inefficient for zones containing large numbers of addresses, particularly DNSBLs which list entire [[Classless Inter-Domain Routing]] netblocks. DNSBL-specific software &mdash; such as Michael J. Tokarev's [http://www.corpit.ru/mjt/rbldnsd.html rbldnsd], [[Daniel J. Bernstein]]'s [http://cr.yp.to/djbdns.html rbldns], or the [http://www.simpledns.com/kb.aspx?kbid=1241 DNS Blacklist Plug-In] for [[Simple DNS Plus]] &mdash; is faster, uses less memory, and is easier to configure for this purpose. The hard part of operating a DNSBL is populating it with addresses. DNSBLs intended for public use usually have specific, published policies as to what a listing means, and must be operated accordingly to attain or keep public confidence. === DNSBL queries === When a mail server receives a connection from a client, and wishes to check that client against a DNSBL (let's say, ''dnsbl.example.net''), it does more or less the following: #Take the client's IP address&mdash;say, ''192.168.42.23''&mdash;and reverse the bytes, yielding ''23.42.168.192''. #Append the DNSBL's domain name: ''23.42.168.192.dnsbl.example.net''. #Look up this name in the DNS as a domain name ("A" record). This will return either an address, indicating that the client is listed; or an "NXDOMAIN" ("No such domain") code, indicating that the client is not. #Optionally, if the client is listed, look up the name as a text record ("TXT" record). Most DNSBLs publish information about why a client is listed as TXT records. Looking up an address in a DNSBL is thus similar to looking it up in reverse-DNS. The differences are that a DNSBL lookup uses the "A" rather than "PTR" record type, and uses a forward domain (such as ''dnsbl.example.net'' above) rather than the special reverse domain ''in-addr.arpa''. There is an informal protocol for the addresses returned by DNSBL queries which match. Most DNSBLs return an address in the 127.0.0.0/8 IP [[loopback]] network. The address 127.0.0.2 indicates a generic listing. Other addresses in this block may indicate something specific about the listing&mdash;that it indicates an open relay, proxy, spammer-owned host, etc. For details see an [http://tools.ietf.org/html/draft-irtf-asrg-dnsbl Internet draft] by the [[Anti-Spam Research Group]]. === RHSBL queries === An RHSBL query is fairly straightforward. Just prepend the domain name to the DNS list host as follows: example.net.rhsbl.dnslist.com Generally if an A record is returned the name is listed. === DNSBL policies === Different DNSBLs have different policies. DNSBL policies differ from one another on three fronts: *'''Goals.''' What does the DNSBL ''seek'' to list? Is it a list of open-relay mail servers or open proxies&mdash;or of IP addresses known to send spam&mdash;or perhaps of IP addresses belonging to ISPs that harbor spammers? *'''Nomination.''' How does the DNSBL ''discover'' addresses to list? Does it use nominations submitted by users? Spam-trap addresses or [[honeypot (computing)|honeypot]]s? *'''Listing lifetime.''' How long does a listing ''last''? Are they automatically expired, or only removed manually? What can the operator of a listed host do to have it delisted? == Criticisms == Email users who find their messages blocked from mail servers that use DNSBLs often object vociferously, sometimes to the extent of attacking the existence of the lists themselves. The following lists are controversial: * Lists of dynamic or dial-up IP addresses. These lists most often also include "static" [[ADSL]] addresses, thus "''end-user'' IP addresses" might have been a better description. Some mail sites choose not to accept messages from such addresses, since they are often home computers exploited by spammer viruses.<br>This can inconvenience [[Small office/home office|SOHO]] users who wish to run their own mail servers on residential ISP connections or local [[Mail transfer agent|MTA]]s on laptops for example. To work around this, users who wish to run their own mail server are expected to relay via their ISP's mail server using the [[smart host]] functionality built-in to most mail servers. * Lists that include "spam-support operations", such as [http://www.mail-abuse.com/ MAPS RBL]. A spam-support operation is a site that may not directly send spam, but provides commercial services for spammers, such as hosting of Web sites that are advertised in spam. Refusal to accept mail from spam-support operations is intended as a [[boycott]] to encourage such sites to cease doing business with spammers, at the expense of inconveniencing non-spammers who use the same site as spammers. * Predictive ("early warning") lists, notably [[Spam Prevention Early Warning System|SPEWS]]. SPEWS lists addresses belonging to spam-support operations, under the hypothesis that such addresses are more likely to send spam in the future. SPEWS "escalates" listings, increasing the size of the netblock listed, as a site continues to support spam. * Some lists have unclear listing criteria and delisting may not happen automatically nor quickly. A few DNSBL operators will request payment (e.g. uceprotect.net[http://www.uceprotect.net/en/index.php?m=2&s=0]) or donation (e.g. [[SORBS]]). Some of the many listing/delisting policies can be found in the [[Comparison of DNS blacklists]] article. Although many have voiced objections to specific DNSBLs, few people object to the principle that mail-receiving sites should be able to reject undesired mail systematically. One who does is [[John Gilmore (activist)|John Gilmore]], who deliberately operates an [[open mail relay]]. Gilmore accuses DNSBL operators of violating [[antitrust]] law. :''For Joe Blow to refuse emails is legal (though it's bad policy, akin to "shooting the messenger"). But if Joe and ten million friends all gang up to make a blacklist, they are exercising illegal monopoly power.'' [http://www.toad.com/gnu/verio-censorship.html] A number of parties, such as the [[Electronic Frontier Foundation]] and [[Peacefire]], have raised concerns about some use of DNSBLs by [[Internet service provider|ISP]]s. One joint statement issued by a group including EFF and [[Peacefire]] addressed "stealth blocking", in which ISPs use DNSBLs or other spam-blocking techniques without informing their clients. [http://www.peacefire.org/stealth/group-statement.5-17-2001.html] Spammers have pursued lawsuits against DNSBL operators on similar grounds: * In [[2003]], a newly-formed corporation calling itself "EmarketersAmerica" filed suit against a number of DNSBL operators in [[Florida]] court. Backed by spammer [[Eddy Marin]], the company claimed to be a trade organization of "email marketers" and that DNSBL operators [[The Spamhaus Project|Spamhaus]] and [[Spam Prevention Early Warning System|SPEWS]] were engaged in [[restraint of trade]]. The suit was eventually dismissed for lack of [[standing (law)|standing]]. [http://www.linxnet.com/misc/spam/slapp.php] * In [[2006]] a US court ordered Spamhaus to pay $11,715,000 in damages to the spammer "e360 Insight LLC". The order was a default judgment, as Spamhaus (which is a UK operation, outside the court's jurisdiction) did not defend itself. See [[The Spamhaus Project#e360_Lawsuit|e360 Lawsuit]]. == See also == * [[Comparison of DNS blacklists]] * [[News.admin.net-abuse.blocklisting]] == References == {{reflist}} {{Spamming}} [[Category:Spamming]] [[cs:Blacklist]] [[de:Realtime Blackhole List]] [[es:Lista negra (Internet)]] [[it:DNSBL]] [[pl:DNSBL]] [[ru:DNSBL]]