Re: Suggested botnet rule scores

On 22 Aug 2007, John Rudd spake thusly:

> Nix wrote:
>> My ISP doesn't give me that option (well, OK, it probably gives *me*
>> that option because I can bug the ISP's technical director, but not
>> people who've posted bonds). I'd venture to guess that the vast majority of
>> small business UK ISPs, even those that do not provide useful outbound relaying
>> MTAs, do not delegate rDNS to individual users.
>
> And they can't set one of the MX records, or A records, for their mail domain to be the same as that of the static IP address their
> static IP address?
>
> Because EITHER one of those things will trigger an exception for Botnet.

Oh, right, so botnot only triggers if you're sending from something that isn't an MX *and* satisfies one of the other criteria?

That's sensible, and I hadn't thought of it, and I'd also brilliantly managed to overlook it repeatedly when wandering through the botnet code. (God knows how. Insufficient coffee, probably.)

There are sometimes reasons for a host without an MX to send mail, but it's bloody rare outside of big clusters (i.e. not boxes fronting for little networks), and I can see no reason why anyone can't get a lowpriority  MX pointing at them even if they can't run an MTA on it (no harm will be done in that case, of course). Received on Wed Aug 22 14:30:16 2007