DNS Blacklists Laced with Personal Agendas

While potentially useful in fighting spam, DNS Blacklists (or DNSBL's) can often have their databases influenced by human factors which can hurt the reliability of the information they provide.

DNSBL's are databases of servers and networks which can help spam filters figure out if a sender is a likely spam source. As the name would suggest, they are queried via the Domain Name Server (DNS) protocol. DNS is the primary name resolution system for the internet.

When a DNSBL is sent the address of a server or network, it responds with an IP address that indicates if it's included on the list of likely spammers. In some cases, different numbers may be returned indicating the severity of spam activity, or why the offender was included on the list.

In a recent case, an anti-spam provider – Postini was included in the DNSBL run by Spamhaus. Postini is generally not considered to be major source of spam, and an interview with Spamhaus's CEO confirmed this.

However, Spamhaus had received a few complaints regarding Positini and, "intended the brief listing to be a simple jolt to stress that spam is against our policy."

A few years back, the "Osirusoft" DNSBL was abruptly shutdown by its owner due to both technical and legal costs. In the process, he modified the database so it reported all mail servers and networks as being likely spammers. Again, the motive seemed to be a, "simple jolt" in order to get people to stop using the service. It certainly did help system administrators figure out what was going in a timely fashion, however a huge number of legitimate email messages were lost in the process.

The Osirusoft shutdown significantly shook the confidence of system administrators in DNSBL's. As a result of the problem, SpamButcher's default settings were changed to disable DNSBL support by default.

DNSBL's vary widely in inclusion criteria, and general operation. Some are compose of hand selected servers and networks, while others have completely automated mechanisms that determine which addresses will be included.

Users and system administrators should be aware of what anti-spam blacklists their software relies on, and generally avoid trusting any individual DNSBL to be the final decision if an email is spam or not. Many modern spam protection software packages are capable of including data from DNSBL's in conjunction with information regarding the actual email content to reach a more accurate filtering solution.

Back