Status of dnsbl.sorbs.net: DEAD

Multiple sources are reporting (and Proofpoint has confirmed -- see below) that the SORBS blocklist is shutting down.

According to SORBS website, they published the following DNS zones:

• badconf.rhsbl.sorbs.net
• block.dnsbl.sorbs.net
• dnsbl.sorbs.net
• dul.dnsbl.sorbs.net
• escalations.dnsbl.sorbs.net
• http.dnsbl.sorbs.net
• misc.dnsbl.sorbs.net
• new.spam.dnsbl.sorbs.net
• nomail.rhsbl.sorbs.net
• noserver.dnsbl.sorbs.net
• old.spam.dnsbl.sorbs.net
• recent.spam.dnsbl.sorbs.net
• rhsbl.sorbs.net
• smtp.dnsbl.sorbs.net
• socks.dnsbl.sorbs.net
• spam.dnsbl.sorbs.net
• web.dnsbl.sorbs.net
• zombie.dnsbl.sorbs.net

I would recommend removing any and all of these from any spam filter or mail server configuration ASAP.

You can find analysis on SORBS and this shutdown over on Mickey Chandler's Spamtacular blog. Word to the Wise had previously published a lengthy series of issues and concerns surrounding SORBS going all the way back to 2010.

Proofpoint confirmed SORBS closing to the Register, providing the following statement:

"The decision to sunset a product is never an easy one and was made after thorough consideration of various factors impacting the service's sustainability. We can confirm that SORBS was decommissioned on June 5, 2024, and the service no longer contains reputation data. Given the wide range of potential replacement solutions in the market, Proofpoint cannot make recommendations nor endorse any specific replacement product; this is dependent on an organization's needs."

As of the publishing of this note, the SORBS website itself does not seem to indicate that things are shutting down; but note the confirmation of shutdown by Proofpoint, as quoted in various press linked above.

Status of ubl.unsubscore.com: OFFLINE

LashBack's unsubscribe blacklist ("UBL"), as described by its publisher "is a unique, real-time blacklist of IP addresses which have sent email to addresses harvested from suppression files." It's a neat idea, an interesting way to monitor unsusbcribe compliance. But it can be tricky when it comes to things like shared IP addresses, addresss leakage, subscription forgery or data breaches. As I haven't tested it in a while, I can't speak to its accuracy as far as a spam filtering tool. I did test it years ago but that data is so dusty as to not warrant digging it back up.

Anyway, the reason I mention this today is that I've seen a poster on the Mailop list indicate that the Lashback UBL DNSBL is currently unavailable. If you use this DNSBL (ubl.unsubscore.com) in any of your spam filtering tools, you'll want to remove it.

Status of dnsbl.inps.de: DEAD

Christian Jung launched the inps.de DNSBL way back on December 29th, 2007.

Christian described the listing criteria as follows: "Every day thousands of spam e-mails arrive on our e-mail servers, which have to be processed by our anti-spam system. If an email is recognized as spam, the IP address of the sender is recorded in a blacklist for a certain period of time in order to enable faster email processing and reduce the system load."

Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.

He appears to be shutting it down in a graceful manner -- not "listing the world" as so many lists do as they wind down. This is good to see.

Note that in addition to the DNSBL dnsbl.inps.de, this also affects the DNSWL (whitelist) found at dnswl.inps.de. Both are ceasing.

If you use either the whitelist or blocklist in your email server config, you'll want to disable those checks as soon as possible. 

Status of all.rbl.webiron.net and bsb.spamlookup.net: DEAD or BROKEN

Two anti-spam blocking lists appear to have died or malfunctioned recently.

Users on the Mailop mailing list are reporting that Webiron (all.rbl.webiron.net) blocklist appears to be malfunctioning. Its domain has expired and the temporary holding pattern pending payment or termination has resulted in the Webiron DNSBL effectively "listing the world" because of wildcard DNS entries.

Another list, BSB (bsb.spamlookup.net), a DNSBL focusing on "comment spam," also recently appears to have died, as reported by MX Toolbox back on April 17th.

When most lists "die" or malfunction, they often end up with wildcard DNS entries in place, as this is a common domain DNS setting implemented by registrars, domain speculators, or domain parkers. What this means is that every single DNSBL query made to the DNSBL's domain is falsely returns with "yes, block that IP address." Meaning your spam filter suddenly blocks 100% of your inbound mail. This is bad news, if you like to actually receive inbound mail.

If you're using either of these lists, you should cease doing so immediately, as their use may impede your ability to receive inbound mail successfully. As always, it's important to pay attention what DNSBLs you use for spam filtering, and periodically review and ensure that they still exist and that they're working properly.

And if you run a DNSBL, see RFC 6471 for best practices around DNSBL management, including how to appropriately shut one down.

Status of megarbl.net: DEAD

The DNSBL "MegaRBL.net" is no-more. According to the Internet Archive, MegaRBL had been around since at least some time in 2013. It was a non-commercial independently run spamtrap-driven blocking list. Mailop subscribers suggest the list may have been dead for years, but the Internet Archive shows its website being alive and active as recently as March 2019.

As of today, November 25, 2019, the blocklist's domain name appears to have expired and the new owner or domain registrar has implemented wildcard DNS. This has the net effect of "listing the world" and it means that if you use this DNSBL in your mail server configuration, you're likely to now be rejecting all attempts to send mail to your users.

You don't want that! Remove the "MegaRBL.net" DNSBL from your mail server configuration as soon as possible.