Subject: [Asrg] New draft of the DNSBL definition document

From: "John R Levine" <[email-masked]>
Date: 28 Oct 2005 02:17:53 -0400

I've been meaning to do this for months and finally got around to it.

This is intended to define the technical way that DNSBLs and DNSWLs work.

It doesn't address issues of DNSBL management because someone else (you
know who you are) is working on a BCP for them.

Please take a look at this one and let me know if you see anything I
should fix.  Once it settles down I'll send it in as an I-D and remind the
IRTF chair that we'd like to move this towards an Informational RFC, and
they promised to work on a path from the IRTF to RFC other than treating
them as being just sent in by the individual authors.  Maybe they can
think about it at the Vancouver meeting.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"A book is a sneeze." - E.B. White, on the writing of Charlotte's Web

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John R Levine" <[email-masked]>
Date: 28 Oct 2005 15:34:29 -0400

> Minor nit:  As with how you have "test address" notes for IP-based lists,
> perhaps you should also note that example.com is the common test address for
> domain-based lists.

Is it?  I haven't looked at enough name-based DNSBLs to know.

Regards,

---

From: [email-masked] (Justin Mason)
Date: Fri, 28 Oct 2005 13:33:50 -0700

> Is it?  I haven't looked at enough name-based DNSBLs to know.

FWIW, it seems like a bad choice, since it has other meanings.  Can anyone
explain why this was used, and/or what lists use it?

- --j.

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 29 Oct 2005 01:03:41 +0200

John R Levine wrote:

> I haven't looked at enough name-based DNSBLs to know.

For the five RFCI zones it's example.tld

SURBL had a better idea (because it also lists IPs):
just use 2.0.0.127 as test entry also for RHSBLs.

I don't know any other RHSBL.  Bye, Frank

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 29 Oct 2005 01:36:25 +0200

Todd Vierling wrote:

> My gut-feeling guess would be that it was ideal due to the
> guarantee that it never really exists as a usable domain.

Yes, but the RfC reserving example.com also reserves test, so
there would be a more obvious choice.  For some time IANA had
an "example Web site" at example.cno, better stay away from it.

>From my POV three hould be three rules for all BLs:

- 127.0.0.2 is always listed (for a RHSBL read 2.0.0.127)
- 127.0.0.1 is never listed (for a RHSBL read 1.0.0.127)
- a "listed" result is 127.0.0.0/8 excluding 127.0.0.0/31
- for bitmapped results that excludes "odd" IPs 127.0.0.1,
  127.0.0.3 etc. up to 127.0.0.255, but OPM style is okay:
  127.1.0.1 etc. won't be confused with 127.0.0.1

For bitmapped results it could be an idea to include the
version number of the bit definitions in the result:
127,nn.hi.lo, nn = version 1..255, and hi.lo for 16 sets.

But that's only an idea, I don't know any RHSBL with more
than 7 sets, SURBL has 6 sets at the moment (but it won't
touch bit 0 when it gets more sources, 127.0.0.1 is taboo).

Back to the draft, here's a fix for the 127.0.0.1 issue:

=== old ===
example, the bit masks for the two sublists might be 127.0.0.1
and 127.0.0.2, in which case an entry for an IP on both lists
would be 127.0.0.3.  With multiple A records, each sublist has
=== new ===
example, the bit masks for the two sublists might be 127.0.0.2
and 127.0.0.4, in which case an entry for an IP on both lists
would be 127.0.0.6.  With multiple A records, each sublist has
=== end ===
                          Bye, Frank