Some email blacklists focus solely on allowing their users to block mail from problematic sources. Others aim to reduce the amount of bad mail sent and prefer senders clean up their practices, rather than just blocking them wholesale. The Spamhaus SBL is one of the second type, using listings both to block mail permanently from irredeemable spammers and as short term encouragement for a sender to fix their practices.
All a blacklists infrastructure – and the infrastructure of related companies, such as reputation monitoring services – is based on identifying senders by their IP addresses and recording their misbehaviour as records associated with those IP addresses. For example, one test entry for the SBL is the IP address 192.203.178.107, and the associated record is SBL230. Because of that they tend not to have a good way to deal with entities that aren’t associated with an IP address range.
Sometimes a blacklist operator would like put a sender on notice that the mail they’re emitting is a problem, and that they should take steps to fix that, but they don’t want to actually block that senders mail immediately. How to do that, within the constraints of the IP address based blacklist infrastructure?
IP addresses are assigned to users in contiguous blocks and there’s always a few wasted, as you can’t use the first or last addresses in that range (for technical / historical reasons). Our main network consists of 128 IP addresses, 184.105.179.128 to 184.105.179.255, but we can’t put servers on 184.105.179.128 (as it’s our router) or 184.105.179.255 (as it’s the “broadcast address” for our subnet).
So if Spamhaus wanted to warn us that we were in danger of having our mail blocked, they could fire a shot across our bow without risk of blocking any mail right now by listing the first address in our subnet – 184.105.179.128 – knowing that we don’t have a server running on that address.
For any organization with more than 128 IP addresses – which includes pretty much all ISPs and ESPs – IP addresses are assigned such that the first IP address in the range ends in a zero, so that warning listing will be for an address “x.y.z.0” – it’s a dot-zero listing.
RSS - Posts
Does Spamhaus actually provide these kinds of warnings or are you just saying they could do this?
Spamhaus do use this sort of listing, usually to provide a an SBL record for an issue at a reasonably respected ESP or ISP without actually blocking mail. I don’t have a current example handy because, well, those respected ESPs and ISPs tend to resolve the issues and get them delisted fairly quickly.
Spamhaus definitely provides dot-zero warnings, Tom. Here is one that’s live now:
http://www.spamhaus.org/sbl/query/SBL187554
I noticed this particular SBL because I used ZoneAlarm in the 1990s and gave Zonelabs an email address when registering my copy. That email address had become unusable by the early 2000s because of the amount of spam that it received, and I closed it in 2002. Checkpoint, who at some point bought ZoneLabs, is still mailing that email address.
Interesting. All of the networks I have ever administered have the default gateway (“the router”) on one less than the broadcast–w.x.y.254 in the example case.
Interesting, ZA/ZL was a client of mine back in my Minnesota days. I can’t remember if they used our confirmed opt-in signup server, though.
Spamhaus does indeed provide these kind of warnings. They will also move an active listing to a “dot zero” listing as a probationary measure after mitigation has begun and while perhaps waiting to watch for a positive outcome.
@Larry. Yes, the default gateway can be anywhere in the range, and one below the top (.254) is nearly as common as one above the bottom (.1), I think. The first address in the range (.0) is used to identify the subnet itself (for anything bigger than a /31, anyway).
(There’s actually a second reason not to use any .0 address, even if it’s in the middle of /23 or bigger CIDR block – there are still machines out there that have remnants of pre-CIDR logic and won’t communicate successfully with another machine that has a .0 address.)
I’d never heard of this before. Spamhaus should do this for all IP ranges, not just for respected ESPs/ISPs. Is there any reason not to give all mailers a warning and an opportunity to clean up what they’re doing?
I’m gonna guess that it’s because there’s no point in giving warnings to people who won’t heed them, therefore ‘respected’.
Another reason for listing .0/32 addresses on the SBL can be to notify an upstream provider if a network asset is found to be hijacked for example. In such cases, a ‘network pointer record’ is created to send off a SBL notification to the upstream provider in question. The IP of the last network hop prior to entering the network asset is then listed, see http://www.spamhaus.org/sbl/query/SBL179085 for example.
Some network owners actually have .0 addresses in their IP pool, OVH is one example that springs to mind.