8

Spamhaus and other well-known DNSBLs don't yet support IPv6, and I'm not sure they ever will. What alternatives are there for spam filtering on IPv6?

One approach is to rely entirely on content-based filtering which requires that the MTA receive the whole content of the email before deciding whether to accept or reject it - which will significantly increase the inbound bandwidth requirements for a public MTA.

Another possible approach is to require SPF for inbound email and combine it with a blacklist of sending domains (as distinct from sending MTAs, as at present with DNSBLs). This would require all mail-forwarders to rewrite the envelope-sender, which is the underlying reason why SPF doesn't really work. DKIM works fine, but doesn't get the advantage of dropping the connection before DATA is reached in the SMTP/ESMTP session.

OK, so are there solutions for spam-filtering in IPv6 that allow for dropping a large fraction of spam connections to the recipient MTA before the content is transferred?

2 Answers 2

4

Have you tried creating your own dnsbl on your DNS server and populating it with IPv6 addresses?
This puts the onus of maintaining the blacklist on you, but it also gives you the ability to custom-blacklist (or custom-whitelist) hosts & networks, which can be useful if you ever disagree with the major blacklists.

virbl (http://virbl.bit.nl/index.php#ipv6) has some notes on how they're dealing with IPv6 blacklisting which may also be of interest -- As far as I know they're still the only v6-enabled dnsbl provider.

1
  • I'll have a look at virbl - sounds like they can point me in the right direction. Apr 12, 2011 at 14:36
3

Due to the "unlimited" number of ipv6 addresses a dsnbl for ipv6 has only limited impact. We would need other technologies for the first line of spam prevention. There is a service provided by commtouch who checks only the hashes of the mail header, maybe it would make sense to put more effort in a "free" solution for things like that. Or maybe there is already one?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .