zen.spamhaus.org not resolving

[Bdzzld]

Hello,

We've curently set up the bl.spamcop.net and zen.spamhaus.org RBLs to block e-mail at SMTP time (by default present in cPanel). We've however noticed e-mail coming through from IP-addresses which were blacklisted in zen.spamhaus.org and also noticed zen.spamhaus.org is no longer resolving on our servers.

Does any one have the same problem?

We've OpenDNS and Google DNS configured in /etc/resolv.conf

Thanks.

[Infopro]

http://spamhaus.org/ seems to be down. I would think this is a temp issue.

[metrop]

Try with Barracudacentral.org.

You need to register first and add your IP server. Add b.barracudacentral.org in RBL Manager.

[Bdzzld]

http://spamhaus.org/ seems to be down. I would think this is a temp issue.

The Spamhaus Project is not (spamhaus.org's web site has never worked w/o www).

[Infopro]

These are the correct URLs and are operating as expected:

http://www.spamhaus.org/

/http://www.spamhaus.org/drop/drop.lasso

Sorry for the confusion of my earlier post.

[Bdzzld]

I've set up the following new entry for spamhaus :

Rbl Name : spamhaus2
Rbl Info URL : http://www.spamhaus.org/drop/drop.lasso
Dns List : www.spamhaus.org

Should that be an alternative for the original?

Thanks.

[Infopro]

I've set up the following new entry for spamhaus :

Rbl Name : spamhaus2
Rbl Info URL : http://www.spamhaus.org/drop/drop.lasso
Dns List : www.spamhaus.org

Should that be an alternative for the original?

Thanks.

This is what mine looks like:

[Bdzzld]

As previously mentioned zen.spamhaus.org does not resolve (there's no entry for zen in the spamhaus.org DNS records), so those settings won't work any more. That's the reason for creating this thread in the first place.

[Infopro]

I'm clearly running without coffee this morning.. :/

Just poking around looking for news on this and coming up empty.

That drop list is specific and not ideal I don't think. The Spamhaus Project - DROP

The DROP list will not include any IP address space under the control of any legitimate network - even if being used by "the spammers from hell".

From my exim_rejectlog just now:

2011-07-26 12:03:47 H=(oranta.ua) [190.176.171.72] F= rejected RCPT : "JunkMail rejected - (oranta.ua) [190.176.171.72] is in an RBL, see /http://www.spamhaus.org/query/bl?ip=190.176.171.72"

Somethings still working over here.

[Bdzzld]

root@xxxxxx [~]# dig zen.spamhaus.org

; <<>> DiG 9.2.4 <<>> zen.spamhaus.org
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6243
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;zen.spamhaus.org.              IN      A

;; AUTHORITY SECTION:
zen.spamhaus.org.       110     IN      SOA     need.to.know.only. hostmaster.spamhaus.org. 1107261730 3600 600 432000 150

;; Query time: 35 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jul 26 19:38:17 2011
;; MSG SIZE  rcvd: 98

No IP-address is resolved here. You must be using other DNS servers to resolve, which (still) know the IP-address.

[Bdzzld]

Try with Barracudacentral.org.

You need to register first and add your IP server. Add b.barracudacentral.org in RBL Manager.

b.barracudacentral.org does not resolve either.

[mtindor]

Sure they resolve. Either your resolver is broke, or you don't quite understand what it is you are looking for.

zen.spamhaus.org only has NS records. When your server does a query of xxx.xxx.xxx.xxx.zen.spamhaus.org, your server checks to see what servers are listed in the NS records of zen.spamhaus.org. Then your server is supposed to query one of those servers.

Same thing with b.barracudacentral.org.

There are no "A", "CNAME", or "MX" records for b.barracudacentral.org or zen.spamhaus.org, which I'm sure is their intention. None of these records are needed. Their absence shouldn't be any sort of indicator to you.

dig zen.spamhaus.org NS
dig b.barracudacentral.org NS

Those two commands should produce a list of nameservers serving those zones.

M

[Bdzzld]

As you can see it (and so does zen.spamhaus.org) does not resolve to any IP-address :

root@xxxxxx [~]# dig b.barracudacentral.org

; <<>> DiG 9.2.4 <<>> b.barracudacentral.org
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49694
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;b.barracudacentral.org.                IN      A

;; AUTHORITY SECTION:
b.barracudacentral.org. 900     IN      SOA     not.available. hostmaster.barracudacentral.org. 1311708799 600 600 432000 900

;; Query time: 153 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jul 26 21:56:25 2011
;; MSG SIZE  rcvd: 100

root@xxxxxx [~]# ping b.barracudacentral.org
ping: unknown host b.barracudacentral.org

As previously mentioned we're using OpenDNs and GoogleDNS as resolvers. Are you using the same or others?

[mtindor]

You aren't supposed to be able to ping zen.spamhaus.org or b.barracudacentral.org. They simply don't have A / CNAME records associated with them, by design.

To test if you're reaching Spamhaus, you could test an IP that you know is in the Zen database.

For instance, if I want to see if 200.171.150.7 is in the DB:

dig 7.150.171.200.zen.spamhaus.org a

dig 7.150.171.200.zen.spamhaus.org txt

If I want to see whether 98.231.39.227 is in the Barracuda RBL:

dig 227.39.231.98.b.barracudacentral.org a

dig 227.39.231.98.b.barracudacentral.org txt

Reverse the octets of the IP address in question and prepend it to .b.barracudacentral.org or .zen.spamhaus.org in a TXT or A record query.

With all of that said, it could be simply that the Spamhaus servers are refusing to answer queries from your server because your server is generating too many queries for the free service. If your server queries reach a threshold, Spamhaus would like for you to use their pay service and they may block your server from making queries - http://www.spamhaus.org/organization/dnsblusage.html

M

[Bdzzld]

Thanks for sorting that out mtindor. It appears setting up Google DNS to resolve does not do the job :

root@xxxxxxxx [~]# dig 7.150.171.200.zen.spamhaus.org a @8.8.8.8

; <<>> DiG 9.2.4 <<>> 7.150.171.200.zen.spamhaus.org a @8.8.8.8
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 53719
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;7.150.171.200.zen.spamhaus.org.        IN      A

;; AUTHORITY SECTION:
zen.spamhaus.org.       150     IN      SOA     need.to.know.only. hostmaster.sp
amhaus.org. 1107270545 3600 600 432000 150

;; Query time: 136 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Jul 27 07:47:20 2011
;; MSG SIZE  rcvd: 112

OpenDNS to resolve works. Going back to OpenDNS then :

root@xxxxxxxx [~]# dig 7.150.171.200.zen.spamhaus.org a @208.67.220.220

; <<>> DiG 9.2.4 <<>> 7.150.171.200.zen.spamhaus.org a @208.67.220.220
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3089
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;7.150.171.200.zen.spamhaus.org.        IN      A

;; ANSWER SECTION:
7.150.171.200.zen.spamhaus.org. 98 IN   A       127.0.0.4
7.150.171.200.zen.spamhaus.org. 98 IN   A       127.0.0.11

;; Query time: 0 msec
;; SERVER: 208.67.220.220#53(208.67.220.220)
;; WHEN: Wed Jul 27 07:48:40 2011
;; MSG SIZE  rcvd: 80