Distributed Sender Blackhole List

The Distributed Sender Blackhole List was a Domain Name System-based Blackhole List that listed IP addresses of insecure e-mail hosts. DSBL could be used by server administrators to tag or block e-mail messages that came from insecure servers, which is often spam.^[1]

The DSBL published its lists as domain name system (DNS) zones that could be queried by anyone on the Internet.

DSBL is a dead RBL as of May 2008. Its administrators continued to run their authoritative nameservers for several months after their decommissioning announcement; as of March 9, 2009, even those servers are offline. At this point, using any *.dsbl.org lookups in an RBL check results in DNS failures and can even prevent an SMTP server from starting a conversation.

Blocking

It is not possible for DSBL to block or intercept mail. E-mail is sometimes blocked or bounced with a message referencing DSBL. These messages were not blocked by DSBL; they were blocked by the administrator of the receiving mail server, who chose to reject messages coming from a potentially-insecure IP address listed by DSBL. See DNSBL for a description of how mail transfer agents interact with these lists.

Methodology

DSBL lists IP addresses of hosts that are demonstrated to be insecure. DSBL defines an insecure host as one that allows e-mail to be sent from anyone to anyone else. Normal servers only send mail from their own users to anyone else. Insecure servers are commonly abused by spammers, although DSBL does not claim that the hosts have sent spam or have been abused by spammers; only that they could be.

DSBL builds its lists by receiving specially-formatted "listme" e-mails triggered by testers. DSBL itself does not test hosts for security vulnerabilities. The testers use software that causes insecure servers to send a message to an e-mail address monitored by DSBL. The message includes a time-sensitive cryptographically secure cookie to prevent servers from being listed by mistake. When a valid listme message is received DSBL adds the IP address of the server that delivered the message to one of its lists.

For these messages to reach DSBL the insecure server must have allowed anyone (a DSBL tester) to send mail to anyone (DSBL's monitored address). This proof-of-vulnerability is kept on file at DSBL's web site.

In addition to open mail relays, DSBL lists hosts that were vulnerable to abuse due to formmail bugs, open proxies, and other problems. Because the testers can use any available method to trigger the listme messages, they can adapt to newly discovered vulnerabilities as spammers do.

The testers normally perform tests on hosts that have sent spam to them. Thus many of the IP addresses listed by DSBL are the addresses of servers that have been abused by spammers.

Delisting

For an IP address to be removed from DSBL's lists, the administrator of the IP address must demonstrate "accountability" by first requesting, and then responding, to a delisting message from DSBL. The message can only be sent to the postmaster or abuse desk of the listed IP address. The postmaster's e-mail domain is determined by consulting reverse DNS.

Until this accountability test is passed, the host remains listed. Thus it is possible that some of the IP addresses listed by DSBL have been secured, but are still listed because the administrator has not demonstrated accountability by requesting and responding to a de-listing message.

Because DSBL does not perform vulnerability tests, the only criterion for removal is this accountability test. It is entirely possible that hosts that are delisted are still vulnerable to abuse. If this is the case, it is expected that the host will be relisted by a tester the next time it is abused.

The problem with the delisting process is that dynamic dial-up IP-addresses which make it to the list will never be delisted since delisting would require to run an SMTP-server in the temporary dial-up IP. Another problem is that they require the SMTP server to be running behind a router that allows packets marked with the ECN bits. This may require an upgrade to the newest router software before the accountability email can be received.

Automated system and credibility

DSBL is a largely automated system. The delisting process, in particular, is an automated self-service web page. Manual processes are not used to remove an IP address from the list, except in rare cases where a bug in DSBL's software prevented a delisting. DSBL's operators believe that manual delisting processes would undermine the list's credibility.

Lists

DSBL operated three lists:

• unconfirmed.dsbl.org: The unconfirmed list contains IP addresses of hosts that have delivered listme messages triggered by anonymous or untrusted testers. DSBL does not recommend using this list as part of a blocking system.
• list.dsbl.org: The trusted list contains IP addresses of hosts that have delivered listme messages triggered by trusted testers.
• multihop.dsbl.org: The multihop list contains IP addresses of hosts that deliver mail for insecure servers. The servers in this list may appear to be secure, but can be abused by spammers because they trust other servers that are insecure. This category sometimes includes the mail servers of large ISPs, and DSBL recommends using this list as part of a message scoring system, not as a blocking list.

External links

• DSBL web site
• Open relay test which can report to DSBL

References

1. Smith, Curtis. Pro Open Source Mail: Building an Enterprise Mail Solution. United States, Apress, 2006. 278.