Subject: [Asrg] Another draft of the DNSxL document

From: "John L" <[email-masked]>
Date: 1 Nov 2005 01:12:12 -0500

Many people sent in helpful comments, which I've tried to reflect.

Changes:

Correct RBL history
Add discussion of use for URI blacklists and in scoring filters
Note IPv6 lists are possible even though I don't know of any
Note possible traffic analysis
Many minor editorial changes

Please take another look.  I'd like to make one more minor round of 
updates and then ship it off and see if I can get it through the RFC 
process.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 01 Nov 2005 10:14:42 +0100

John L wrote:

> Please take another look.

The example still uses 127.0.0.1.  It shouldn't, that IP is
never listed and never returned as result.  When SC "listed"
127.0.0.1 for a day this caused some unnecessary confusion
(made it even to /. IIRC)

Simple fix s/1+2=3/2+4=6/ proposed in:
<http://permalink.gmane.org/gmane.ietf.asrg/11079>

Other points:

For lists of domain names the term RHSBL is popular (about
20,000 Google hits), maybe mention this in chapter 3.

In 2.3 replace "127/8" by "127.0.0.0/8 excl. 127.0.0.0/31".

I still prefer to recommed 2.0.0.127 as test entry everywhere,
also for RHSBLs.  SURBL uses this among other test entries,
but there's no example.com.multi.surbl.org

The security considerations are incomplete:  Combined lists
should never combine completely unrelated sets, especially
not "black" and "white" sets, the users would get it wrong.

Are you sure that you want to discuss a commercial service
like [3] in an RfC ?  I'd delete the reference and wouldn't
use the term RBL at all, proposed text:

- The list became known as the Real-time Blackhole List (RBL).
+ The list became known as the Real-time Blackhole List.

- Many network managers wanted to use the RBL to block unwanted
+ Many network managers wanted to use this list to block unwanted
  e-mail, but weren't prepared to use a BGP feed.  They created
  a DNS-based distribution scheme that quickly became more
  popular than the original BGP distribution.  Other people
- created other DNS-based blacklists either to compete with the
+ created other DNS-based blacklists either to compete with this
- RBL or to complement it by listing different categories of IP
+ list or to complement it by listing different categories of IP
- addresses.  Although some people refer to all DNS-based
+ addresses.
- blacklists as ``RBLs'', the term properly is used for the MAPS
- RBL, the descendant of the original list.  (In the United
- States, the term RBL is a registered service mark of MAPS[3].)

That deletes reference [3] avoiding potential legal headaches
in a "last call" or IESG review.
                                    Bye, Frank

---

From: Daniel Feenberg <[email-masked]>
Date: Tue, 1 Nov 2005 07:13:55 -0500 (EST)

> updates and then ship it off and see if I can get it through the RFC 

Would it be out of place to note in the document that RBLs allow MTAs
to reject mail rather than discard it? The various RFCs documenting
SMTP all emphasize the necessity of not losing messages, so I would
think you could mention that a properly used RBL conforms to that.

---

From: Bill Cole <[email-masked]>
Date: Tue, 1 Nov 2005 08:13:33 -0500

At 10:14 AM +0100 11/1/05, Frank Ellermann  imposed structure on a 
stream of electrons, yielding:
>never listed

False to fact.

>and never returned as result.

I'm not sure 'never' is really true. It is never returned wisely, certainly.

>  When SC "listed"

But SpamCop was by no means the first to do so and probably won't be 
the last. It has been done intentionally by list maintainers as a 
test record, without adequate appreciation for the depth of 
cluelessness among their users.

>like [3] in an RfC ?

That is a tough one, because not mentioning it leaves a very real gap 
in an informational document (like an answer to the question "why 
does my mail server documentation call DNSBL's RBL'S?") but on the 
other hand, the online references available all lead to the current 
owner of the MAPS intellectual property, whose  chief effort since 
acquiring those remains seems to be to bury the history and the 
technical details rather than to document anything.

-- 
Bill Cole
[email-masked]

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 01 Nov 2005 16:26:08 +0100

> False to fact.

Okay, add "normally", that's what I meant.  A DNSBL of private
and reserved IPs is somewhat "special".  Testing one I know:

2.0.0.127.combined-hib.dnsiplists.completewhois.com = 127.0.0.2

host: unknown host 1.0.0.127.combined-hib.dnsiplists.completewhois.com

For a list with 127.0.0.1 as potential entry 127.0.0.2 is most
probably no test entry, so that's IMHO really a "special" case,
where no "normal" conventions work as expected.

Was it Osirusoft, that ended with "all IPs listed" ?  A sanity
test "127.0.0.1 not listed" could catch this condition.

> I'm not sure 'never' is really true.

I'm sure, it's also only "normally" :-)  A counter-example is
2.0.0.127.wadb.isipp.com = 127.0.0.1

> It is never returned wisely, certainly.

Maybe the 127.0.0.1/31 issue should be added to the "security
considerations" (?)

> It has been done intentionally by list maintainers as a test
> record, without adequate appreciation for the depth of

Yes, that's what I wanted to express by "never" :-)  The "fix"
s/1+2=3/2+4=6/ would replace the 127.0.0.1 example by 127.0.0.4
avoiding the critical bit 0.
                             Bye, Frank

---

From: John Levine <[email-masked]>
Date: 1 Nov 2005 17:33:37 -0000

>to reject mail rather than discard it?

It already does.

R's,
John

---

From: John Levine <[email-masked]>
Date: 1 Nov 2005 17:37:35 -0000

>The example still uses 127.0.0.1.

Only as a return value, which is indeed what a fair number of DNSBLs
do.  You may not like it, but my goal here is to document what people
do, not to write a BCP which is a separate project.

>Are you sure that you want to discuss a commercial service

Of course.  There's no rule against discussing commercial stuff and
there never has been.

>in a "last call" or IESG review.

Could you explain what legal headaches you're referring to?  In the
MAPS section, I'm reporting the history.  The mention of the RBL
registered service mark is a fact (an easily verified one at that),
not an IPR claim.

R's,
John

---

From: Florian Weimer <[email-masked]>
Date: Tue, 01 Nov 2005 21:52:34 +0100

Small nit: Some very long domain names cannot be listed in a
domain-based list because the domain name itself does not exceed the
host name length limit, but appending the DNSxL anchor name does.

What do existing implementation do in this case?

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 02 Nov 2005 06:32:24 +0100

John Levine wrote:
 
> Only as a return value, which is indeed what a fair number
> of DNSBLs do.

You have it in the bit-mapped example, the only lists I know
where bit 0 is used are OPM and IADB.  For OPM it's no issue,
they use 127.1.0.x => 127.0.0.1 impossible.  Maybe the "1" in
127.1.0.x is some version number, or it's a kludge to avoid
the "critical" 127.0.0.1 as result.

I've kicked 2.0.0.127.wadb.isipp.com = 127.0.0.1 from rxwhois,
it doesn't pass my minimal sanity check.  After Osirusoft I at
least _try_ to detect irregular conditions.

> You may not like it, but my goal here is to document what
> people do, not to write a BCP which is a separate project.

If there are many lists using 127.0.0.1 for bit-mapped results
you could mention it in the "security considerations".  Which
_other_ (excl. IADB) DNSBLs use bit 0 for their first set ?

The most simple approach is "don't talk about it", use bit 1
for set 1 and bit 2 for set 2, with 127.0.0.6 for the union.

Example `rxwhois -a` output (special case OPM eplained above):
127.0.0.2 (------1-): .combined-hib.dnsiplists.completewhois.com
127.0.0.2 (------1-): .ix.dnsbl.manitu.net
127.0.0.2 (------1-): .bl.spamcop.net
127.0.0.2 (------1-): .multi.surbl.org
127.0.0.2 (------1-): .psbl.surriel.com
127.0.0.2 (------1-): .combined.njabl.org
127.0.0.2 (---43210): .opm.blitzed.org
127.0.0.2 (------1-): .list.dsbl.org
127.0.0.2 (------1-): .relays.ordb.org
127.0.0.2 (-----2--): .sbl-xbl.spamhaus.org
127.0.0.2 (------1-): .cbl.abuseat.org

 [RBL] 
> Could you explain what legal headaches you're referring to?

If I could explain it won't be a headache.  Is it allowed to
mention "US service marks" in an RfC ?  Is that relevant for
anybody outside of the US, if yes, what is a "service mark" ?

IANAL and therefore I'd stay way from it where possible.  Bye