- NZNOG - lists.nznog.org

Re: Dynamic address space in SORBS causes mail rejection
by Richard Cox 15 Jun '04

15 Jun '04

On Wed, 16 Jun 2004 11:14:12 +1200 "Craig Box" <craig(a)itpartners.co.nz> wrote: | While we're on the subject of mail rejections, I look after a couple | of sites on a TelstraClear Tempest connections, both with IP addresses | on 203.97.48.0/21. Unfortunately, spam DNS blacklist SORBS list them | as being on Dynamic IP space: | | 203.97.48.x found in Dynamic IP Space (Cable, DSL & Dial Ups) | Address or Block: 203.97.48.0 / 21 | Information: Dynamic IP address, use your ISPs mail server | | ..and as such a number of sites (a number growing by about one a day, | just the ones I get told about) are blocking mail based on the SORBS | listing. The point being that the inbound mail administrators have the right to decide whether to accept connections from hosts in dynamic-IP ranges. | Some months ago I got in touch with TC's faults desk and they | claim to have emailled off to SORBS to have this reclassified. | | Nothing changed, so I got in touch with our local tech contact at TC; | he said he'd fire it off to the ISP guys but I've not heard back from | him either. All true. On Jan 30 The Telstra Abuse Desk wrote to SORBS about the block being labelled as "dynamic" and asked for "a copy of the headers of the spam". SORBS replied, explaining that the DUHL list identified their IP's DHCP status, not that any spam had been sent. Telstra Abuse Desk didn't respond to that reply. On March 11 Mark Seward wrote in again from Telstra, asking for the block status to be changed: SORBS replied, explaining that for security reasons such a request would need to come from the designated APNIC PoC for the IP block (which currently would be netobjs(a)clear.net.nz) However that reply got an auto-response saying that Mark Seward was no longer with Telstra, and mail should now go to Peter Ambrose and/or Sid Jones, so SORBS dutifully forwarded the previous correspondence to those two people, hoping they'd get the appropriate person to write in to authorise the change. But nothing further was heard until April 7 when Jason, as "isp.duty(a)team.telstraclear.co.nz" wrote in asking how to get the block's status changed, and he was sent a similar answer to that which had gone to Mark Seward, Peter Ambrose, and Sid Jones: but still nothing was heard from the designated PoC. | I've asked around about this and the best suggestions are "you're an | ISP customer, you should be smarthosting through an ISP mail server." | Problems with this include the fact that we no longer have any control | over retry/routing/any of the niceties of controlling your own outbound | SMTP; the fact that clear.net.nz mailservers are currently being eaten | by Zafi and mail delivery will probably slow down; and the fact that | we "just plain shouldn't have to." If you're on static IP, then as you say, you shouldn't have to. TelstraClear should have been able to follow the simple instructions to get this changed, normally a very straightforward process! | I'm not sure where to go from here. It's possible that if I ask TC | to set the PTR for each affected customer to smtp.$CLIENT and then | manually request that it's removed from SORBS, it may be done. If an IP is to send mail, that is a good suggestion in its own right. DNS should also have a sensible TTL - at least 12 hours is reasonable. -- Richard Cox

1 0

Akamai outage
by Juha Saarinen 15 Jun '04

15 Jun '04

http://www.infoworld.com/article/04/06/15/HNakamaioutage_1.html Not sure if NZ is affected too, but have noticed that Windows Update is unusually slow. -- Juha

2 1

Dynamic address space in SORBS causes mail rejection
by Craig Box 15 Jun '04

15 Jun '04

Hi everyone. While we're on the subject of mail rejections, I look after a couple of sites on a TelstraClear Tempest connections, both with IP addresses on 203.97.48.0/21. Unfortunately, spam DNS blacklist SORBS (http://www.dnsbl.au.sorbs.net/) list them as being on Dynamic IP space: 203.97.48.x found in Dynamic IP Space (Cable, DSL & Dial Ups) Address or Block: 203.97.48.0 / 21 Information: Dynamic IP address, use your ISPs mail server ...and as such a number of sites (a number growing by about one a day, just the ones I get told about) are blocking mail based on the SORBS listing. Some months ago I got in touch with TC's faults desk and they claim to have emailled off to SORBS to have this reclassified. Nothing changed, so I got in touch with our local tech contact at TC; he said he'd fire it off to the ISP guys but I've not heard back from him either. I've asked around about this and the best suggestions are "you're an ISP customer, you should be smarthosting through an ISP mail server." Problems with this include the fact that we no longer have any control over retry/routing/any of the niceties of controlling your own outbound SMTP; the fact that clear.net.nz mailservers are currently being eaten by Zafi and mail delivery will probably slow down; and the fact that we "just plain shouldn't have to." We have a hosted mail server of our own that we could use as a smarthost, however it will be a significant increase in load on this machine where we have a perfectly good mail server sitting at the clients site. I agree completely about customers not running mail service on dial-up lines, but a Tempest connection with a static IP address is a business service, not a 56k modem with an infected Windows box behind it. I'm not sure where to go from here. It's possible that if I ask TC to set the PTR for each affected customer to smtp.$CLIENT and then manually request that it's removed from SORBS, it may be done. Their FAQ (http://www.dnsbl.au.sorbs.net/DUL-FAQ.html) suggests I'm more likely to be asked to have my ISP ask. I'd like to see TC deal to this, perhaps by putting more information in the WHOIS db about what space is static and what is dynamic, and possibly changing PTR records appropriately. According to the DNSBL faq, the contact listed in the RIR can have it changed - it would be really nice if this problem could go away. If there are any other suggestions that anyone has about how to deal with this problem, please let me know. Regards, Craig Box Phone 07 957 2653 IT Partners Ltd Fax 07 957 2659 PO Box 9361 Mobile 021 475 869 Hamilton, New Zealand _________________________________________________________________ #include <standard-disclaimer.h> _________________________________________________________________

1 0

Map/schematic over NZ Internet connectivity?
by Juha Saarinen 15 Jun '04

15 Jun '04

Has the NZ Internet connectivity been mapped out yet? Maybe I'm not googling right, but I can't find any resource which lists national and international connectivity for New Zealand. -- Juha

6 9

RE: [nznog] TelstraClear Inhternational / National Traffic billing
by Donald Neal 15 Jun '04

15 Jun '04

> On Tue, 15 Jun 2004, Joe Abley wrote: > > > On 15 Jun 2004, at 08:22, Drew Broadley wrote: > > > > > The end is nigh. > > > > The doomsaying is all very dramatic, but where's the reasoning? > > > > If it suddenly costs money to talk to networks which are > customers of > > TCL, it surely makes *more* sense to peer with them > directly, not less. Indeed. Peering by US content providers is one of the big changes identified in http://www.nanog.org/mtg-0405/pdf/norton.pdf . Perhaps sadly, one of the possible futures for the US identified by the author in answer to questions about his presentation at the most recent NANOG was the New Zealand model, in which charges aren't made for national traffic. - Donald Neal Donald Neal | Bubble and squeak Technical Specialist | - Boiled mouse. Operations Engineering | [Martin Neal] Integration & Services Division +----------------------- Alcatel NZ Ltd - Telecom's network operations manager ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

TelstraClear Inhternational / National Traffic billing
by neil gardner 15 Jun '04

15 Jun '04

Hi guys - I just spent 5 minutes talking to Telstra in between 45 minutes of working while on hold... The question I asked was: If TelstraClear go ahead with cutting the links to a couple of big national network access points (I was speaking to a non-tech), what will happen to the national / international traffic billing. This person had zero clue but came back ten minutes later and stated she'd been talking to someone that knew exactly what I was talking about. His statement was that "Shortly the International / National traffic distinction will be phased out and there will be only one class of traffic. The cost will be similar to the current International rate. But don't worry since it only matters if you go over your limit" (The lady relayed his comment and that's as close to a direct quote as I can recall) Does this mean that TelstraClear are going to adopt the Telecom Jetstream traffic charging model? Anyone in the know care to correct me if I was given false information by junior Telstra Staff? Or, horribly, was this statement correct? (I specifically wanted to know what would happen to my national / international charging if TelstraClear cut their peering, and it appears they do in fact have a plan to make sure the consumer experiences no confusion over what's National or International traffic) Cheers - Neil G NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

11 14

Re: [nznog] SMTP Servers and Reverse DNS Lookup
by Juha Saarinen 14 Jun '04

14 Jun '04

neil gardner wrote: > Um, no false positives? doesn't that mean you manually inspect all your > logs of dropped connections? Doesn't, by extension, that mean you might > as well let all the stuff through and check them at the client end? :-) Yes, I do check the logs, which is a lot easier than it may appear. No, it doesn't mean I might as well let the stuff through... -- Juha

1 0

Re: [nznog] SMTP Servers and Reverse DNS Lookup
by neil gardner 14 Jun '04

14 Jun '04

Um, no false positives? doesn't that mean you manually inspect all your logs of dropped connections? Doesn't, by extension, that mean you might as well let all the stuff through and check them at the client end? :-) Cheers - N >>> Juha Saarinen <juha(a)saarinen.org> 15/06/2004 3:30:14 p.m. >>> neil gardner wrote: > http://www.cs.niu.edu/~rickert/cf/bad-ehlo.html > > Decent understandable writeup of the "You should send the right info" > and "Don't drop email if you get the wrong info" arguments... ... and having said all that, I admit to dropping some some messages based on HELOs. Mainly viruses and spamware connections, with no false positives yet. Touch wood. -- Juha NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

2 1

Re: [nznog] SMTP Servers and Reverse DNS Lookup
by neil gardner 14 Jun '04

14 Jun '04

http://www.cs.niu.edu/~rickert/cf/bad-ehlo.html Decent understandable writeup of the "You should send the right info" and "Don't drop email if you get the wrong info" arguments... Cheers - N. >>> Juha Saarinen <juha(a)saarinen.org> 15/06/2004 2:56:14 p.m. >>> Regan Murphy wrote: > Is this sort of configuration becoming standard for organistions? Some admins think it's BOFH to do stuff like that, in the mistaken belief that it's RFC-compliant. It's a bit like fundamentalists interpreting various religious scriptures, but if they want to drop legitimate email, their choice I say. -- Juha _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

2 1

SMTP Servers and Reverse DNS Lookup
by Regan Murphy 14 Jun '04

14 Jun '04

I was having problems sending mail to an organisation and eventually worked out that the host name and reverse dns entry did not match and therefore mail transfer was refused: ------- 220 mail.xxxbar.co.nz ESMTP NetIQ MailMarshal (v5.5.5.8) Ready ehlo hellmouth.oaxxxsystems.co.nz 554 No SMTP service here ------- As soon as I corrected my server to use the correct host name to match the reverse (vampire.oaxxxsystems.co.nz) then mail was allowed to go through. I would assume this was a recent change by the receiving organisation as I have not had problems sending them emails before. Is this sort of configuration becoming standard for organistions? I would expect that may create problems for smaller organisations sending email directly from their in-house hosted mail server for which they have no control over reverse-dns entries. -- Regards, Regan

5 5