Status of relays.osirusoft.com: DEAD

This one has been gone for a long while now, but somebody asked me about it the other day, so I figured I should post something about it here.

Joe Jared was the operator of relays.osirusoft.com, a widely used anti-spam blocklist service created in 2001 that combined multiple DNSBLs to help email administrators filter out spam. 

In August 2003, relays.osirusoft.com ceased operations following a series of Distributed Denial-of-Service (DDoS) attacks aimed at disrupting the service. These attacks overwhelmed the servers, leading Jared to shut down the blacklist. This decision was influenced by the persistent nature of the attacks and the challenges in maintaining the service under such conditions. 

Jared's stance on data tracking and responding to policy concerns wasn't always the best; I blogged about this back in 2001, lamenting that it would be better if he could stop handing opponents ammo to use against him. In 2004, Salon wrote about Joe's legal tangles with an alleged spammer, a case he seems to have eventually won.

SpamAssassin actually seems to have utilized the Osirusoft blocklist automatically once upon a time, leading to problems when the dying blocklist configured wildcard DNS, effectively "listing the world" -- often a problem with blocklists looking to stop providing service.

Status of ix.dnsbl.manitu.net: DEAD

The maintainers of the "NixSPAM" blocklist (with a DNSBL zone of ix.dnsbl.manitu.net) have decided to shut down. As of January 16, 2025, their website at nixspam.net states that, "With a heavy heart, we have decided to discontinue the project ix.dnsbl.manitu.net." This matches a statement posted by the blocklist's maintainer on X.

No further information is available at this time. The website indicates that further information may be coming. In the mean time, I suggest that you remove this DNSBL from any spam filtering or IP reputation checks as soon as possible, as when blocklists shut down, they often can end up with "wildcard DNS" that can cause unexpected and unwanted inbound email delivery impediments. 

Jan-Piet Mens previously described the NixSPAM thusly: "The NixSPAM black-list is a DNS block-list created by Bert Ungerer of ix. It contains automatically generated entries from open proxies, relays, dialup gateways, etc., and [...] Black-listed entries are automatically removed after 12 hours if no further spam from that particular source is detected within that time frame."

The NiXSPAM blocklist appears to have launched in 2003. Congrats to iX for a nearly 22 year long run.

Status of dnsbl.sorbs.net: DEAD

Multiple sources are reporting (and Proofpoint has confirmed -- see below) that the SORBS blocklist is shutting down.

According to SORBS website, they published the following DNS zones:

• badconf.rhsbl.sorbs.net
• block.dnsbl.sorbs.net
• dnsbl.sorbs.net
• dul.dnsbl.sorbs.net
• escalations.dnsbl.sorbs.net
• http.dnsbl.sorbs.net
• misc.dnsbl.sorbs.net
• new.spam.dnsbl.sorbs.net
• nomail.rhsbl.sorbs.net
• noserver.dnsbl.sorbs.net
• old.spam.dnsbl.sorbs.net
• recent.spam.dnsbl.sorbs.net
• rhsbl.sorbs.net
• smtp.dnsbl.sorbs.net
• socks.dnsbl.sorbs.net
• spam.dnsbl.sorbs.net
• web.dnsbl.sorbs.net
• zombie.dnsbl.sorbs.net

I would recommend removing any and all of these from any spam filter or mail server configuration ASAP.

You can find analysis on SORBS and this shutdown over on Mickey Chandler's Spamtacular blog. Word to the Wise had previously published a lengthy series of issues and concerns surrounding SORBS going all the way back to 2010.

Proofpoint confirmed SORBS closing to the Register, providing the following statement:

"The decision to sunset a product is never an easy one and was made after thorough consideration of various factors impacting the service's sustainability. We can confirm that SORBS was decommissioned on June 5, 2024, and the service no longer contains reputation data. Given the wide range of potential replacement solutions in the market, Proofpoint cannot make recommendations nor endorse any specific replacement product; this is dependent on an organization's needs."

As of the publishing of this note, the SORBS website itself does not seem to indicate that things are shutting down; but note the confirmation of shutdown by Proofpoint, as quoted in various press linked above.

Status of ubl.unsubscore.com: OFFLINE

LashBack's unsubscribe blacklist ("UBL"), as described by its publisher "is a unique, real-time blacklist of IP addresses which have sent email to addresses harvested from suppression files." It's a neat idea, an interesting way to monitor unsusbcribe compliance. But it can be tricky when it comes to things like shared IP addresses, addresss leakage, subscription forgery or data breaches. As I haven't tested it in a while, I can't speak to its accuracy as far as a spam filtering tool. I did test it years ago but that data is so dusty as to not warrant digging it back up.

Anyway, the reason I mention this today is that I've seen a poster on the Mailop list indicate that the Lashback UBL DNSBL is currently unavailable. If you use this DNSBL (ubl.unsubscore.com) in any of your spam filtering tools, you'll want to remove it.

Status of dnsbl.inps.de: DEAD

Christian Jung launched the inps.de DNSBL way back on December 29th, 2007.

Christian described the listing criteria as follows: "Every day thousands of spam e-mails arrive on our e-mail servers, which have to be processed by our anti-spam system. If an email is recognized as spam, the IP address of the sender is recorded in a blacklist for a certain period of time in order to enable faster email processing and reduce the system load."

Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.

He appears to be shutting it down in a graceful manner -- not "listing the world" as so many lists do as they wind down. This is good to see.

Note that in addition to the DNSBL dnsbl.inps.de, this also affects the DNSWL (whitelist) found at dnswl.inps.de. Both are ceasing.

If you use either the whitelist or blocklist in your email server config, you'll want to disable those checks as soon as possible.