Spam and Open Relay Blocking System

SORBS (Spam and Open Relay Blocking System) is a controversial open proxy and open mail relay DNSBL. It has been augmented with complementary lists that include various other classes of hosts, allowing for customized email rejection by its users.

History

The SORBS DNSbl project was created November of 2002. It was maintained as a private list until January 6, 2003 when DNSbl was officially launched to the public. The list consisted of 78,000 proxy relays and has grown to over 3,000,000 compromised spam relays. (Source: SORBS.NET as of February 8, 2006)

DUHL

SORBS adds IP ranges that belong to dialup modem pools, dynamically allocated wireless, and DSL connections as well as DHCP LAN ranges by using reverse DNS PTR records, WHOIS records, and sometimes by submission from the ISPs themselves. This is called the DUHL or Dynamic User and Host List.[1] The DUHL also includes IP ranges that may be static but only have generic reverse DNS records. SORBS does not automatically rescan DUHL listed hosts for updated rDNS so to remove an IP address from the DUHL, however if other blocks are scanned in the region of listings and the scan includes listed netspace, SORBS does automatically remove the netspace marked as static.

Matthew Sullivan of SORBS proposed in an Internet Draft that generic reverse DNS addresses include purposing tokens such as 'static' or 'dynamic', abbreviations thereof, and more. That naming scheme would have allowed end users to classify IP addresses without the need to rely on third party lists, such as the SORBS DUHL. The Internet Draft has since expired. Generally it is considered more appropriate for ISPs to simply block outgoing traffic to port 25 if they wish to prevent users from sending email directly, rather than specifying it in the reverse DNS record for the IP[2].

SORBS' dynamic IP list originally came from Dynablock but has been developed independently since Dynablock stopped updating in December 2003.[3]

Criticism

Inaccuracy

SORBS has an alleged effectiveness rate of 50-56%, and a false positive rate of 7.9-11.1%

Dynamic User/Host List

Owners of small businesses who operate mail servers through smaller ISPs frequently are flagged on the DUHL blacklist. SORBS has arbitrarily set removal criteria, including TTL values which they deem suitable. The inaccuracy of these criteria for listing has led some aggregate listings to warn that the DUHL "should not be used".

Removal procedure

In order for IP ranges who have spammed in the past to be removed from the spam database, SORBS requires a US$50 donation to a registered charity, or to a SORBS approved good cause like the Joey McNicol Legal Defense Fund. This donation is only required for deletions from the spam database that have not expired automatically, and it is waived both for IP ranges that have been reallocated elsewhere or if the ISP implements outbound content-based spam countermeasures. [4][5] However, because of these requirements, SORBS's removal procedure has been compared to extortion by staunch anti-blocklist groups. [6]

The Joey McNicol case was won on October 20, 2002, [7][8] and the fund is now used to defend other actions brought by spammers against people who fight spam.[9] Donations have been made to the Abusive Hosts Blocking List (FSS vs. AHBL)[10] and OsiruSoft Research & Engineering (Pallorium vs. Jared).[11]

Aggressiveness

IP addresses that send spam to SORBS spamtraps are added to their spam database manually. In order to prevent being blacklisted, major free email services such as Gmail, Yahoo, and Hotmail, as well as major ISPs now implement strong outgoing anti-spam countermeasures. However, smaller networks may still unwittingly be blocked. Because spammers use viruses, malware, and rootkits to force compromised computers to send spam, SORBS might list the mail servers that the infected IP uses to send its spam. Because of this, larger ISPs and corporate networks have started blocking port 25 in order to prevent these compromised computers from being able to send email except through designated servers.[12]

Wide networks of computers sharing the same IP address using network address translation may also be affected. If one computer behind the NAT is allowed to send spam, the whole network will be blacklisted if the NAT IP is ever blacklisted. For these reasons, blacklists should be used cautiously and should only be included as one component in wider anti-spam measures, such as SpamAssassin.

See also

• Comparison of DNS blacklists

External links

• Spam and Open Relay Blocking System
• Example of blocking practices.