DNS Block List services appears to have changed

As you know, Sendmail takes great interest in maintaining the viability of our customer’s email systems. With this in mind, it has recently come to our notice that one of the more common DNS Block List services (see http://en.wikipedia.org/wiki/DNSBL ) appears to have changed the way they identify servers that they think may be using dynamic IP space in their “dul.dnsbl.sorbs.net” list. We have anecdotal evidence that the block rate has gone up by a factor of 10x in the last week or so.

Many system administrators use this DNSBL and therefore it may impact your organization as other organizations that do not use a commercial service to identify potential spammers may rely on this list to incorrectly identify your network (or a portion of your network) as potentially dangerous – and block all email originating from servers in the affected address blocks. The new elements of their criteria, we believe, are: (From their site: http://www.sorbs.net/faq/dul.shtml)

• The MX record of a domain needs to contain a host name that maps to the IP address involved. The Time to Live of the MX record needs to be at least 43200 seconds.

• The A record for the host name needs to have a TTL of at least 43200 seconds.

• The reverse DNS PTR record for the IP address involved needs to map back to the name given in the MX record, and to have a TTL of at least 43200 seconds.

Most of Sendmail’s customers use a default DNS TTL far shorter than 43,200 seconds for all three of these record types and could, therefore, potentially be blocked by this list. In reading the FAQ at sorbs.net, it appears that these criteria are secondary to being listed, but experience suggests this may not always be the case.

It is always better, in our experience, to identify issues like being listed by a DNSBL before your users do so. We strongly recommend that email administrators regularly check the reputation of their email servers – free services like http://www.MXToolbox.com/blacklists.aspx or http://whatismyipaddress.com/blacklist-check are useful tools in this regard. We urge you to look into this and consider what, if any, impact it may have on your email traffic. Modifying the TTL of the DNS records described above should resolve any potential impact from this DNS Block List – but may have other impact within your organization. By monitoring your reputation on these lists you can proactively guard against future problems.

Bob Boucneau & Richard Rognlie, Messaging Architects, Sendmail.