Re: Is there a RHSBL for parked domains?

2011-10-15 Thread John Peach
On Thu, 13 Oct 2011 15:33:48 +0530
Ram r...@netcore.co.in wrote:

 
 
 On 10/13/2011 02:37 AM, Ralf Hildebrandt wrote:
  * Noel Jonesnjo...@megan.vbhcs.org:
 
  You might be able to do something with check_recipient_mx_access.
  Mostly, these domains have no MX, but only an A record. But yes, I
  havne'T yet checked if they all resolve to but a few IPs
 
 Since all the non existing domains are now being typo-squatted with A 
 records and MX records too
 What I saw that most of these domains use common MX or NS records
 
 I use  check_recipient_mx_access   and reject these mails at SMTPD
 I typically reject all mails where MX points to mx.fakemx.net , or 
 mxs1.tradenames.com  .. among others

check_recipient_ns_access would make more sense I think. sedoparking,
at least, uses ns1.sedoparking.com, ns2.sedoparking.com.

-- 
John


Re: Is there a RHSBL for parked domains?

2011-10-13 Thread Ram



On 10/13/2011 02:37 AM, Ralf Hildebrandt wrote:

* Noel Jonesnjo...@megan.vbhcs.org:


You might be able to do something with check_recipient_mx_access.

Mostly, these domains have no MX, but only an A record. But yes, I
havne'T yet checked if they all resolve to but a few IPs


Since all the non existing domains are now being typo-squatted with A 
records and MX records too

What I saw that most of these domains use common MX or NS records

I use  check_recipient_mx_access   and reject these mails at SMTPD
I typically reject all mails where MX points to mx.fakemx.net , or 
mxs1.tradenames.com  .. among others



Ofcourse getting users to use addressbook is the correct thing , but 
when you have far too many users from different cities this may not be easy











Is there a RHSBL for parked domains?

2011-10-12 Thread Ralf Hildebrandt
My users make a lot of typos in their recipient email addresses.
Is there an easy way (i.e. a RHSBL) for parked domains?

Or is there another easy way of detecting parked domains?
Things that come to mind:

* hostname resolve to but a few IP addresses
* NS records for domain point to special parking DNS servers
* other stuff Victor has found out, but I haven't

-- 
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebra...@charite.de | http://www.charite.de



Re: Is there a RHSBL for parked domains?

2011-10-12 Thread Noel Jones
On 10/12/2011 3:27 PM, Ralf Hildebrandt wrote:
 My users make a lot of typos in their recipient email addresses.
 Is there an easy way (i.e. a RHSBL) for parked domains?
 
 Or is there another easy way of detecting parked domains?
 Things that come to mind:
 
 * hostname resolve to but a few IP addresses
 * NS records for domain point to special parking DNS servers
 * other stuff Victor has found out, but I haven't
 


You might be able to do something with check_recipient_mx_access.
Search around and see if you can find a list of parking IPs
somewhere.  And then tell us about it, and look really smart.

But this probably won't help with the typical squatter or
{defensively owned by the real} domain... probably stuck with
whack-a-mole there.


  -- Noel Jones


Re: Is there a RHSBL for parked domains?

2011-10-12 Thread Lst_hoe02

Zitat von Ralf Hildebrandt ralf.hildebra...@charite.de:



My users make a lot of typos in their recipient email addresses.
Is there an easy way (i.e. a RHSBL) for parked domains?


Get your users to use a managed address book so they don't have to  
type the address. Seriously this was the only way we got down the  
number of misrouted mails. You can't imaging how creative humans are  
in mistyping.


Regards

Andreas




smime.p7s
Description: S/MIME Cryptographic Signature


Re: Is there a RHSBL for parked domains?

2011-10-12 Thread Ralf Hildebrandt
* Noel Jones njo...@megan.vbhcs.org:

 You might be able to do something with check_recipient_mx_access.

Mostly, these domains have no MX, but only an A record. But yes, I
havne'T yet checked if they all resolve to but a few IPs

 But this probably won't help with the typical squatter or
 {defensively owned by the real} domain... probably stuck with
 whack-a-mole there.

In my case my users keep hitting parked domains

-- 
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebra...@charite.de | http://www.charite.de