Re: Working with Spamhaus

2015-07-31 Thread Randy via NANOG
- Original Message - From: Randy To: Jaren Angerbauer ; "nanog@nanog.org" Cc: Sent: Friday, July 31, 2015 9:53 PM Subject: Re: Working with Spamhaus - Original Message - From: Jaren Angerbauer To: "nanog@nanog.org" Cc: Sent: Friday, July 31, 2015

Re: Working with Spamhaus

2015-07-31 Thread Randy via NANOG
- Original Message - From: Jaren Angerbauer To: "nanog@nanog.org" Cc: Sent: Friday, July 31, 2015 2:28 PM Subject: Re: Working with Spamhaus Hi, As for SORBS, I'm not aware of anyone that uses it these days because of > the extortion thing and the rather ..ahem ..

Re: Working with Spamhaus

2015-07-31 Thread Jon Lewis
On Fri, 31 Jul 2015 valdis.kletni...@vt.edu wrote: On Sat, 01 Aug 2015 04:48:11 +0900, Randy Bush said: As for SORBS, I'm not aware of anyone that uses it these days many folk do Many of them your competitors? :) (Sorry, couldn't resist :) Is that to be encouraged? :) -

Re: Working with Spamhaus

2015-07-31 Thread William Herrin
On Fri, Jul 31, 2015 at 5:28 PM, Jaren Angerbauer wrote: > I work for Proofpoint -- we acquired SORBS back in 2011. There is > delisting (via SORBS support ticket). Additionally, there is NO CHARGE to > be delisted. Hi Jaren, The big problem I remember with SORBS from my ISP days was that if t

Re: Working with Spamhaus

2015-07-31 Thread Suresh Ramasubramanian
It's what they call a free country Those that don't use it don't use it, and those who do are free to do so --srs > On 31-Jul-2015, at 4:56 PM, Ricky Beam wrote: > >> On Fri, 31 Jul 2015 17:28:34 -0400, Jaren Angerbauer >> wrote: >> I work for Proofpoint -- we acquired SORBS back in 2011. >

Re: Working with Spamhaus

2015-07-31 Thread Ricky Beam
On Fri, 31 Jul 2015 17:28:34 -0400, Jaren Angerbauer wrote: I work for Proofpoint -- we acquired SORBS back in 2011. Hint: The Internet has a LONG memory. The liberal and numerous dropping of "for free" makes me laugh. "You" knew the tainted nature of what you were buying. Nobody, to this

Re: Working with Spamhaus

2015-07-31 Thread Jaren Angerbauer
Hi, As for SORBS, I'm not aware of anyone that uses it these days because of > the extortion thing and the rather ..ahem .. "eccentric" nature of it's > owner. > and > I see you've never had the pleasure of dealing with SORBS. All it takes is > *ONE* message - EVER - to be instantly, and foreve

Re: Working with Spamhaus

2015-07-31 Thread Valdis . Kletnieks
On Sat, 01 Aug 2015 04:48:11 +0900, Randy Bush said: > > As for SORBS, I'm not aware of anyone that uses it these days > > many folk do Many of them your competitors? :) (Sorry, couldn't resist :) pgpO2jdXrpYvy.pgp Description: PGP signature

Re: Working with Spamhaus

2015-07-31 Thread Randy Bush
> As for SORBS, I'm not aware of anyone that uses it these days many folk do randy

Re: Working with Spamhaus

2015-07-31 Thread Michael O Holstein
hael Holstein Cleveland State University From: Ricky Beam Sent: Thursday, July 30, 2015 6:41 PM To: Michael O Holstein Subject: Re: Working with Spamhaus On Thu, 30 Jul 2015 09:59:55 -0400, Michael O Holstein wrote: > 100 spammy messages isn't enough to get you in trouble,

Re: Working with Spamhaus

2015-07-30 Thread Michael O Holstein
>If you implement SPF / DKIM / DMARC / ADSP, force your customers to relay Before we went SaaS with email we had lots of spam problems and we also went this route .. you must relay through us and authenticate .. postfix along with the dkim and policyd milters (and SPF in DNS). The policyd one wo

Re: Working with Spamhaus

2015-07-30 Thread Private Sender via NANOG
If you implement SPF / DKIM / DMARC / ADSP, force your customers to relay their mail through something you control, and show them you are serious about stopping the spam they may work with you then. Otherwise, they just assume you're a spam house.

Re: Working with Spamhaus

2015-07-29 Thread Jon Lewis
On Wed, 29 Jul 2015, Bob Evans wrote: I see that point - however, spamhaus has become a haus-hold word these days and everyone runs into these issuesits not malware or bots we block from a network level blackhole. Yet it is basic network operations these days to have to deal with someone com

Re: Working with Spamhaus

2015-07-29 Thread Jon Lewis
On Wed, 29 Jul 2015, Bob Evans wrote: Would be nice to have an RBL service that attended NANOG meetings. Would make for a more trusted RBL we can tell customers to make use. How do you know they don't? Most of them keep a low profile due to things like http://www.bizjournals.com/southflori

Re: Working with Spamhaus

2015-07-29 Thread Suresh Ramasubramanian
Er - a couple of ways 1. If you run a farm of mail servers, something like splunk for your logs is kind of necessary. How difficult is it going to be to trigger a splunk alert on whatever looks like an administrative block? Either by a large provider, or by a DNS block list. 2. You can rsync

Re: Working with Spamhaus

2015-07-29 Thread Bob Evans
I see that point - however, spamhaus has become a haus-hold word these days and everyone runs into these issuesits not malware or bots we block from a network level blackhole. Yet it is basic network operations these days to have to deal with someone complaining about their hacked mail server

Re: Working with Spamhaus

2015-07-29 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 I agree with Suresh here -- NANOG used to almost be somewhat hostile to anyone who started discussions regarding anti-abuse and/or security issues which didn't involve routing backbone engineers. A lot of us old-timers took the hint and basically

Re: Working with Spamhaus

2015-07-29 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 I agree with Suresh here -- NANOG used to almost be somewhat hostile to anyone who started discussions regarding anti-abuse and/or security issues which didn't involve routing backbone engineers. A lot of us old-timers took the hint and basically

Re: Working with Spamhaus

2015-07-29 Thread Suresh Ramasubramanian
They come to M3AAWG on a regular basis and there’s the M3AAWG hosting SIG that you might want to participate in. NANOG doesn’t always have a mail abuse (and not very many network abuse) session on the agenda, plus just how many people doing routing or DNS seem to even care what their colleagu

Re: Working with Spamhaus

2015-07-29 Thread Bob Evans
Would be nice to have an RBL service that attended NANOG meetings. Would make for a more trusted RBL we can tell customers to make use. Spamhaus ever attend a NANOG meetings ? Thank You Bob Evans CTO > On Tue, Jul 28, 2015 at 11:41:08PM -0600, Bryan Tong wrote: >> Yes that is part of it. >> >>

Re: Working with Spamhaus

2015-07-29 Thread William Herrin
On Tue, Jul 28, 2015 at 11:39 PM, Bryan Tong wrote: > I wouldnt have such a disheartened attitude if they would have been > specific or given time to comply. > > eSited LLC > (701) 390-9638 Hi Brian, eSited has 37 unresolved spam listings with Spamhaus, all documented and some going as far back

Re: Working with Spamhaus

2015-07-29 Thread Stephen Satchell
On 07/28/2015 08:06 PM, Bryan Tong wrote: Hello All, SpamHaus has done us the favor of blacklisting all of our prefixes due to the issues with handful of IPs from customers we have removed from our network. They are now being unresponsive on helping us get these listings removed and we have a l

Re: Working with Spamhaus

2015-07-28 Thread Matt Palmer
On Tue, Jul 28, 2015 at 11:41:08PM -0600, Bryan Tong wrote: > Yes that is part of it. > > There are other blocks they listed as well. Well, http://www.spamhaus.org/sbl/query/SBL263089 has a fair amount of shady stuff going on, and http://www.spamhaus.org/sbl/listings/esited.com gives a pretty dec

Re: Working with Spamhaus

2015-07-28 Thread Bryan Tong
Yes Larry, I have followed those instructions without a response. So I was curious what to do when no response is given. I will wait longer and see. Sorry if anything I have done has upset you. Thanks On Wed, Jul 29, 2015 at 12:03 AM, Larry Sheldon wrote: > On 7/29/2015 00:58, Larry Sheldon w

Re: Working with Spamhaus

2015-07-28 Thread Larry Sheldon
On 7/29/2015 00:58, Larry Sheldon wrote: On 7/29/2015 00:37, Matt Palmer wrote: I suspect that http://www.spamhaus.org/query/ip/199.87.233.245 may be part of it (although it indicates a /21 blocked, not a /17). And the removal instructions for that range (SBL) seems crystal clear to me, but l

Re: Working with Spamhaus

2015-07-28 Thread Larry Sheldon
On 7/29/2015 00:37, Matt Palmer wrote: I suspect that http://www.spamhaus.org/query/ip/199.87.233.245 may be part of it (although it indicates a /21 blocked, not a /17). And the removal instructions for that range (SBL) seems crystal clear to me, but long experience teaches that what is cryst

Re: Working with Spamhaus

2015-07-28 Thread Bryan Tong
Yes that is part of it. There are other blocks they listed as well. On Tue, Jul 28, 2015 at 11:37 PM, Matt Palmer wrote: > On Tue, Jul 28, 2015 at 11:13:02PM -0500, Larry Sheldon wrote: > > On 7/28/2015 22:57, Bryan Tong wrote: > > > > >Yes I have followed all of the procedures. I will continue

Re: Working with Spamhaus

2015-07-28 Thread Matt Palmer
On Tue, Jul 28, 2015 at 11:13:02PM -0500, Larry Sheldon wrote: > On 7/28/2015 22:57, Bryan Tong wrote: > > >Yes I have followed all of the procedures. I will continue to wait to see > >if there is any change. > > Would you please send me the address range in question--I would like to see > what t

Re: Working with Spamhaus

2015-07-28 Thread Pavel Odintsov
Hello! Completely agree with Larry. I'm enough big hosting provider and we have multiple spam issues every day. But we fix they ASAP before any folks from SpamHaus become angry :) So we still have 1-2 abuses from SpamHaus every few weeks. But we resolve they in few hours and we haven't any issues

Re: Working with Spamhaus

2015-07-28 Thread Larry Sheldon
On 7/29/2015 00:24, goe...@anime.net wrote: On Tue, 28 Jul 2015, Larry Sheldon wrote: On 7/28/2015 22:06, Bryan Tong wrote: If anyone has any advice on how to deal with these people. Please let me know here or off list. Based on years of experience, the very best way is "don't". You have to

Re: Working with Spamhaus

2015-07-28 Thread goemon
On Tue, 28 Jul 2015, Larry Sheldon wrote: On 7/28/2015 22:06, Bryan Tong wrote: If anyone has any advice on how to deal with these people. Please let me know here or off list. Based on years of experience, the very best way is "don't". You have to work pretty hard to get a /17 listed. Don'

Re: Working with Spamhaus

2015-07-28 Thread Larry Sheldon
On 7/28/2015 22:57, Bryan Tong wrote: Yes I have followed all of the procedures. I will continue to wait to see if there is any change. Would you please send me the address range in question--I would like to see what they told you to do. -- sed quis custodiet ipsos custodes? (Juvenal)

Re: Working with Spamhaus

2015-07-28 Thread Bryan Tong
Hello, Yes I have followed all of the procedures. I will continue to wait to see if there is any change. Thanks On Tue, Jul 28, 2015 at 9:53 PM, Larry Sheldon wrote: > On 7/28/2015 22:39, Bryan Tong wrote: > >> Well, >> >> I wouldnt have such a disheartened attitude if they would have been >>

Re: Working with Spamhaus

2015-07-28 Thread Larry Sheldon
On 7/28/2015 22:39, Bryan Tong wrote: Well, I wouldnt have such a disheartened attitude if they would have been specific or given time to comply. I find listing an entire /17 without cause or a report to back it up an unjust action. Have you tried the widely known services they provide? http

Re: Working with Spamhaus

2015-07-28 Thread Larry Sheldon
On 7/28/2015 22:06, Bryan Tong wrote: If anyone has any advice on how to deal with these people. Please let me know here or off list. Based on years of experience, the very best way is "don't". Don't profit from spam, and as a result don't deal with Spamhaus at all. -- sed quis custodiet

Re: Working with Spamhaus

2015-07-28 Thread Bryan Tong
Well, I wouldnt have such a disheartened attitude if they would have been specific or given time to comply. I find listing an entire /17 without cause or a report to back it up an unjust action. I have contacted them through multiple mediums and have found no response. So if someone has had bet

RE: Working with Spamhaus

2015-07-28 Thread Michael J McCafferty
I know this is going to sound worse than the spirit in which I offer it but... Step one might be to adjust the attitude from "Deal with these people" to something along the lines of "how might we best resolve the issue". No matter who you deal with, you will get much further with a good hum