<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.3">
</HEAD>
<BODY>
Hi Gert,<BR>
<BR>
On Wed, 2014-02-19 at 10:54 +0100, Gert Doering wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
Hi,
On Wed, Feb 19, 2014 at 02:45:33PM +1000, Noel Butler wrote:
> We block only by IP from whatever spam source is used (4, or 6), and
> rbldnsd handles ipv6 nicely (albeit in /64's - fair enough too, since
> most end users get that, typically), so your MTA's query would get a
> response from your DNSBL if it has an entry.
Blocking by /64 by default is likely to get collateral damage. Enough
people do shared subnets with multiple customers in the same /64 - while
I won't recommend it, it is *done*, and blocking the whole /64 because
you have seen SPAM from a single IP out of it is hurting the wrong
people.
</PRE>
</BLOCKQUOTE>
<BR>
But, since pretty much every end user gets a /64 (I accept some web hosts and vps services do not work that way - including one of my vps providers), blocking a /64 would be identical to blocking a single IPv4 address with NAT, so should be overall, no worse than what we've been doing for decades.<BR>
<BR>
I would prefer it if rbldnsd allowed smaller, or even singular, but it does not, and the reasoning that was given was fair enough, it only allows a single IPv6 address if it is an exclusion, you may know this already, but for others, as an eg to take out fdid:c01d:1ce:ab/64 but allow real mail server fdid:c01d:1ce:ab::10you use<BR>
<BR>
fdid:c01d:1ce:ab<BR>
!fdid:c01d:01ce:ab00:0000:0000:0000:0010<BR>
It accepts no other approaches<BR>
<BR>
(note: If I block an IPv6 address in postfix's access files, I usually only block singular, unless I end up with a few addresses in same /64, then I'll change to /64 and clear out the singles)<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
And yes, I've seen that in the wild, Ironport reputation for a very
well-behaved machine going down the drain because of "bad neighbourhood".
</PRE>
</BLOCKQUOTE>
<BR>
ironport *shudders* I never let external orgs decide who I can trust, what's that saying... "trust is earned, not bought"<BR>
<BR>
Cheers<BR>
<BR>
<BR>
</BODY>
</HTML>