SURBL list,
Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...?
Matthew Wilson, MCSE (2003), MCSA-Messaging Network Administrator matthew@boomer.com Boomer Consulting, Inc. 610 Humboldt Manhattan, KS 66502 http://www.boomer.com 1-888-266-6375 x 17
on Tue, Nov 16, 2004 at 11:36:18AM -0600, Matthew Wilson wrote:
SURBL list,
Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...?
Dunno about hundreds, but I've certainly seen many with bogus domains in the neighborhood of a few dozen...
Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...?
Dunno about hundreds, but I've certainly seen many with bogus domains in the neighborhood of a few dozen...
If I remember, the ones I saw had around 350.
Bret
Steven Champeon wrote:
on Tue, Nov 16, 2004 at 11:36:18AM -0600, Matthew Wilson wrote:
SURBL list,
Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...?
Many !
Dunno about hundreds, but I've certainly seen many with bogus domains in the neighborhood of a few dozen...
No matter if domains are bogus or not.
SURBL software shall not check if the domain in URL exists, but if the domain is listed at SURBL. URLs with bogus domains aren't usually visible to users and, if the software is intelligent, it shall detect this and not even check them against surbl.
No, but then again. The default check is upto 20 domains .... so putting more than that in a message is no extra load on the dns servers ...
bye, Chris
----- Original Message ----- From: "Matthew Wilson" matthew@boomer.com To: "SURBL Discussion list" discuss@lists.surbl.org Sent: Tuesday, November 16, 2004 6:36 PM Subject: [SURBL-Discuss] SURBL bomb
SURBL list,
Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...?
Matthew Wilson, MCSE (2003), MCSA-Messaging Network Administrator matthew@boomer.com Boomer Consulting, Inc. 610 Humboldt Manhattan, KS 66502 http://www.boomer.com 1-888-266-6375 x 17
Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss
On Tuesday, November 16, 2004, 10:29:19 AM, Bret Miller wrote:
No, but then again. The default check is upto 20 domains .... so putting more than that in a message is no extra load on the dns servers ...
Supposedly, but even in SA 3.0.1, that limit is not used. Get the patch from bugzilla if you need it.
Yes, thanks to your help and others, it seems fixed for the upcoming SpamAssassin 3.0.2:
http://bugzilla.spamassassin.org/show_bug.cgi?id=3930
Jeff C. -- "If it appears in hams, then don't list it."
Has anyone seen any emails with hundreds of URIs - meant to overload filtering servers and the SURBL DNS servers, not poison them...?
Actually, I haven't seen one that was designed directly to do this, but did have one with so many URIs that it killed Net::DNS on Windows. The plugin is supposed to have a limit to prevent this from happening, but in SA 3.0.1 even, it doesn't actually use the limit.
I'm pretty sure the crash in Net::DNS only affects Windows and the only side effect on most other systems will be the number of DNS calls made. If you're really worried about it, go to bugzilla and get the patch that fixes it to use the limit.
Bret
-
Bret Miller -
Christiaan den Besten -
Jeff Chan -
Jose Marcio Martins da Cruz -
Matthew Wilson -
Steven Champeon