Tag Info

Hot answers tagged

15

As long as you bounce the mail by refusing to receive it in the first place, then a spammer cannot use you to annoy somebody innocent with a lot of bounces. You can either return an error on the RCPT TO command, which is what usually happens in case of a non-existent address, or you can return success on the RCPT TO command but return an error at the end of ...


6

ip route add blackhole 10.0.0.0/8 ip route add blackhole 172.16.0.0/12 ip route add blackhole 192.168.0.0/16 Since more specific routes always take precedence, any ranges advertised via OSPF will take precedence over the blackhole routes. Cisco: router>sh ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - ...


6

I'm going to make this answer fairly generic because the terminology and configuration details will vary depending on your specific mail server/spam filter software. There are actually 3 approaches for an invalid recipient: After the recipient is determined to be invalid, send an Undeliverable message back to the sender. Close the SMTP connection while ...


3

If your email server is configured properly, you should reject email to unknown users during the SMTP transaction. Reject Email During the SMTP Transaction Your server should be configured to reject email to unknown users during the SMTP transaction phase. Doing so returns a 550 SMTP error code to the sending server. Since this happens during the SMTP ...


3

Due to the fallback of directly contacting a host via its address records, a single "null MX" record of "MX 0 ." is the apparent preferred way to indicate that the host does not accept e-mail. This is similar to a "null SRV" record ("SRV 0 0 0 .") which specifically marks a service as not available (per the SRV-RR RFC 2782). "MX 0 localhost." (or ...


3

The blackhole servers contain DNS zones for the 10.in-addr.arpa, 16.172.in-addr.arpa, and 168.192.in-addr.arpa ranges, so cover all private IP addresses. prisoner.iana.org is the primary DNS server for those zones, the other 2 are secondary servers, used for backup and for when the primary server is to busy.


3

As long as you are thinking along these lines, you should know about the BOGON list. http://www.team-cymru.org/Services/Bogons/ And I would probably just use the netfilter/DROP like you suggested. The safest thing to do it keep the BOGON config at the external interface or firewall, so it is only in one place and doesn't break internal changes. If you have ...


3

Ross, I know you've accepted an answer, but I wanted to ask you to please get in touch with SH support and tell them about the IP issue, and ask to either speak to or have it forward to the AUP team. I work for Rackspace, the parent company of Slicehost, and we want to guard our IPs and those of our customers from improper blacklisting.


2

The entry in the Blacklist will be for the IP of the server, not the domain. Any domain sending email from that server would experience problems in doing so. There should be no link between your IP being blacklisted and your domain. This is assuming you were not the cause of the IP getting blacklisted. If you were sending out Spam from your domain, it ...


2

You do realise that Fedora isn't FreeBSD, don't you? To do something similar to this in a Linux distribution, just set the policy on your firewall to be DROP.


2

The blackhole-[12].iana.org servers are part of a DNS Anycast cloud operated by AS112 designed to soak up PTR record queries for the RFC 1918 private network address space and the 169.254/16 autoconfiguration block. This was done to mitigate the traffic that these useless queries were inflicting on the DNS root name servers. All such PTR queries to the ...


2

To attack #2, "Script to publish feed list into Windows DNS", you'll most likely be using dnscmd in some capacity. You'll need to use some PowerShell cmdlets (like get-content and write-host for possible examples) to cut up the feed list into the bits of information that are pertinent to the creation of an A or CNAME record in your own DNS server. Then stick ...


2

OK, so the problem was due to an error, but I never found out what the error was. I only solved this by trial and (ahem) error and I'd still like to know how I could have done this more methodically. For anyone interested, the problem was something to do with a missing field that Cake expected. I had disabled an input field that was prepopulated with data ...


2

Load up CPanel Go to "Set Default Address" I think the options you require are in there. If not, can you be more specific about what you're trying to do? This feature is sometimes disabled by your hosting provider, so you may need to request it be enabled.


2

I don't know what the "standard" way is, but here's one I've run across: set an MX record to a loopback address. I suppose any private IP address (or otherwise "invalid" IP - 0.0.0.0) would do the trick. I personally think it's kind of a lousy thing to do, but it would do what you want. You could couple it with a hostname like ...


1

I think specifying non-existent DNS name as domain mail hub (MX) would suffice. UPD.: And finally there is http://tools.ietf.org/html/draft-delany-nullmx-00


1

Check the MTU settings of your routers, firewalls and end points. Also check if you have flaky routes between both networks.


1

You could really simplify things by redirecting all of the ErrorDocument codes and wildcaard image types to the same blank pages/images as in the below. It tries to match a dead-on first, then allows the error document routunes as a fall-through. (you could do it all in error routines i suppose, but i think it's a mite slower, as an error routine?) At ...


1

Interesting solution .. I like it! You should use an address other than localhost, however. Bind another IP onto the NIC (or use a second NIC) on the box, and setup Apache to listen on that address, for whatever ports you want. Wildcard (*) should work. Then, the only traffic to that address is directed by the HOSTS file "spoof", and that traffic won't ...


1

In theory you can avoid the slow load time by making your blackhole list part of your root hints file (e.g. via $INCLUDE) and then changing that file from being a hint to a master. That last bit is necessary to prevent your server from download the real root hints from the internet. e.g. in named.ca: a.root-servers.net. IN A .... m.root-servers.net. IN ...


1

The standard for the DNS, RFC 1034 says (section 4.1) that, for reliability reasons, every DNS zone must have at least two name servers. This apply also to the "reverse" zones such as 10.in-addr.arpa and so on.



Only top voted, non community-wiki answers of a minimum length are eligible