Message Board

Newbie/Basic Questions

IP list available as RBL?

Author: P.Gear (23 Mar 09 6:39am)

Hi there,

I've just signed up, added my honeynet PHP code and donated an MX. Is there any way i can get access to the IP addresses as a DNS RBL for use with my mail server? I may also be able to provide a DNS secondary for such.

Regards,
Paul

Re: IP list available as RBL?

Author: M.Prince (26 Mar 09 4:11am)

The short answer is no.

The longer answer is that we do publish a sort of DNSBL called http:BL. However, it is specifically designed to not be used with mail servers and it would result in a significant number of false positives if you do use it in conjunction with your mail server. For example, we make no effort to remove IPs of large senders like Gmail, Hotmail, and Yahoo from http:BL.

Instead of being used with mail servers, http:BL is intended to protect web servers. Having Gmail's mail server's IP on the list doesn't cause harm, for the most part, because there is no web traffic coming from Gmail's mail server's IP.

Finally, using http:BL with your mail server is a violation of the Project Honey Pot Terms of Service and would likely result in your http:BL Access Key being revoked.

All that said, if you want to benefit from Project Honey Pot and protect your mail server we suggest you use other DNSBLs with which we share data. For example, I think SURBL is great and makes a lot of sense, especially in these days of zombie proxies creating effectively disposable IPs. We share data with SURBL and you can setup their system on most MTAs quickly. More information on SURBL is available online at:

http://www.surbl.org/

Thanks for your help with the Project!

Re: IP list available as RBL?

Author: J.P. (29 Jul 09 2:40am)

All the big mail senders have adopted SPF by now. So there should not be any problem with the false positives if the SPF check is done first.

Unlike other DNSBLs, Project Hoeny Pot works automatically, so the quality of its data should be much higher than the quality of manually compiled IP lists. Plus, since the community members are able to participate in building the database of IP addresses via their MX and honey pots, the resulting database should be of higher quality, because of this transparency.

Could you please reconsider your decision and publish DNSBL for the spam server and dictionary attack server? It should be up to the users to decide what the quality of the data is and what actions the mail server should take based on the information.

Thank you.