On 2024-05-17 23:13, Noel Butler wrote:
On 18/05/2024 08:14, J Doe wrote:
Hello,
I make use of SpamAssassin 4.0.0 on a low volume e-mail server. I also
run my own validating resolver with Bind 9.18.27 on the e-mail server.
The only piece of software I have in my e-mail stack that uses SORBS is
SpamAssassin. I have noticed in my resolver logs multiple entries where
a query of SORBS results in REFUSED results.
Here is an example entry:
10-May-2024 05:34:39.024 lame-servers: info: REFUSED unexpected
RCODE resolving 'rbldns10.sorbs.net/A/IN': 108.59.172.201#53
While some queries succeed and SpamAssassin appears to be able to use
SORBS, there are always *multiple* REFUSED results only for sorbs.net.
Am I exceeding the number of free queries that SORBS allows ? If so, do
I need to register with SORBS (similar to how SpamHaus requires
registration to use their DQS service) ? If so, how do I update my SA
configuration ?
Thanks,
- J
SORBS has been ultra sensitive like that for a few years now, it allows
lookups, then it doesn't, seconds later it does, I suspect an ill
configured DoS protection mechanism that's overly paranoid, but good
luck getting anyone their to listen.
Hi Noel,
Thank you for your reply ... ok, good to know this is expected behaviour
for SORBS. Like you said, perhaps it is a DoS response ... maybe when
it gets a lot of look ups in a short period of time from an IP it then
throttles subsequent queries ?
- J
