mx2.freebsd.org in SORBS, AGAIN!

[cpghost at cordula.ws]

On Sat, Feb 12, 2005 at 03:18:17AM -0800, Ted Mittelstaedt wrote:
> > for some reason, mx2.freebsd.org is being repeatedly added to,
> > and some days later removed from the SORBS dnsbl. They keep
> > adding it, and then removing it with a reason: Listed in error.
> > Right now, it's listed again.
> 
> A spammer is forging several of SORBS spamtrap e-mail
> addresses on their outgoing spams.  The spams hit freebsd.org
> which of course is bouncing them back to the sender, which
> is in this case is the spamtrap e-mail addresses.  This
> triggers the SORBS autolisting.

Ah, okay. That's a good explanation. I already suspected that
mx2 was misconfigured or something.

> If your using sendmail, you should be able to workaround this by
> putting the freebsd.org mailserver's IP address in your access.db
> file, that should override the lockout check.  (assuming your
> using sendmail to call SORBS)  If your using SORBS from
> SpamAssassin, then you can whitelist the freebsd mailing list
> traffic.

I'm using postfix, so I'll have to investigate how to whitelist
IP addresses. Thanks :)

> I personally don't use SORBS on my mailservers, but not because
> I don't think they are a good blacklist.  I really don't know
> enough about them to know if they are good or not.  However
> I do run a script that examines the counts of mail blocked by
> blacklist servers, and I periodically review them and prune
> away the blacklist servers that appear to be ineffective.  I would
> suggest that you do the same and use the results of this
> to determine whether to continue using SORBS.

That's a very good idea too.

> Ted

Thanks,
-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/