RBL

Realtime Blocking List:

A list of known spam sources (by IP address) that is updated constantly. Due to the large size and need for instant updates, most RBLs are not distributed as an acutal list. To check an incomming IP address, a reverse DNS request is sent to the RBL server with the IP in question. If the IP address is known, it is a spam source. Otherwise, it is probably ok.

Known major RBLs:

• http://www.spamhaus.org/ THE RBL. Accurate, timely, very complete and solid. This is the ONLY RBL I trust.
• http://www.tqmcube.com/ A very good RBL for chi-kor and other IP ranges that are known to carry a heavy spam load. Also developing a very nice spam list.
• http://www.okean.com/asianspamblocks.html many ways of listing the IP addresses of systems in China and Korea
• http://pgl.yoyo.org/adservers/ A blocking list for servers that host popup and banner ads.+ Not accesable via the standard DNS request system. There may be a working dns server for this list at dns1.zapadservers.olden.ch
• http://www.spamcom.net Was great, allows users to report spam (see "An automated spam reporting script for MS Outlook") so more responsive than most. Since purchased by IronPort, thier support, service, and attitude have gone south. No longer seems to have the ability to play well with others.
  • http://forum.spamcop.net/forums/index.php?showtopic=8259 Aparently not compatible with ASSP

Problems with RBLs

Country of origin blocking innocent users. E.g. not all CHI-KOR are spammers.

Note that blocking via country of origin WILL result in blocking innocent senders. At most, this country of origin RBLs should be used to flag, not reject, emails. As more products and services are offered in third world countries, this will become more of a serious issue.

Web based email privacy concerns prevent actual source of spam from being determined. e.g. gmail.

Google offers the gmail web based email service. Google refuses to identify the true source of an email in order to protect the confiditiality of thier users and so non-spammer gmail users are implicated by a few bad apple gmail users who are sending spam. Rather than work with Google to report the spam, RBLs block all email from the gmail server the spam happened to come through. As a result, other innocent gmail users are also listed as spammers. Both sides in this argument have valid points. Google can't be giving out the actual IP addresses of thier users without opening them up to possible attack. E.g. if you know the IP address of a browser that has been logged into gmail, then that browser probably has the google toolbar installed and a cracker (NOT hacker) might find another vulnerability in it as use the gmail info to target his attack. On the other hand, how are the spam reporters or RBLs supposed to block anyone other than the server if they have no way of knowing who the source is? The two sides need to work together.

Are you listed at an RBL? Click to find out:

See also:

• http://www.robtex.com/r/ List of RBLs allows one to check many at once.

  .