I guess we have another vigilante delusional on the network with these juvenilles and their "open relay" so-called testing. I wonder if other persons on this list have had their systems attacked in a similar manner to our servers? I also wonder what damage this does to the perception of the network increasingly spiralling into a mere collection of random acts by arbitrary mentally incapable hackers. Bob Allisat Free Community Network _ bob@fcn.net . http://fcn.net http://fcn.net/allisat _ http://fcn.net/draft ---------- Forwarded message ---------- Date: Fri, 20 Nov 1998 11:39:28 -0800 From: orbs@auto.dorkslayers.com To: bob@fcn.net Subject: your E-mail to orbs@auto.dorkslayers.com Thank you for sending mail to ORBS. You will not receive another response, other than this message, from ORBS unless your message contains: 1) A request for our DNS transfer-mode agreement. 2) A request for updates to our web site. 3) Information of interest regarding a relay that my site says is closed but you have verified is not. 4) Other information of direct interest to the site maintainer (like lists of open relays, etc.) 5) A request for a manual test of one or more servers that you maintain to verify that you have indeed fixed your open relay. I may take a while to respond, if I haven't gotten back to you in a week, poke me again. You can just remove your server from the list via the web page, if it's still open it will be re-added and you will receive another blocking notification. 6) Details of the relay prevention measures in place on your server, that can be verified from outside, if you are asking to be removed from our list but your server still fails a simple relay test. Note that these should include the inability to send to more than 5 recipients per message, or an exponential time delay on a per-recipient basis, of substantial enough duration to deter spammers. Note that if I unblock you due to such measures and subsequently receive proof of spam received via your server, that you will be blocked again until you completely disable relay. All other messages will be discarded unanswered, unless I'm bored, which doesn't happen often. Note that abusive or threatening messages may be posted to various anti-spam forums, at my discretion. Your question or statement is most likely addressed below. ----- ORBS Frequently Asked Questions Q) Help! My E-mail is being blocked and I don't understand the error messages or what's going on. A) Talk to whoever runs your mail server, they have a problem that needs to be fixed. Yes, really, regardless of what they tell you (this includes Netcom users). Q) I have fixed my open relay, please take me off your list. A) Please use our web site tools as instructed in the notification message. Our resources are limited and we cannot spend time doing things for which there are automated tools. See: http://www.dorkslayers.com/orbs/closed1.cgi Q) Ok, already, my relay's fixed but you keep trying to send test messages through it. A) Sorry, for reliability sake, our test program tests every 6 hours for 3 days unless a test makes it through. The tests will stop after that time and no one will be able to submit your IP address for further testing without manual intervention on our part. Q) I've removed my closed relay using your web page but sites are still blocking my mail. A) It can take up to 6 hours for changes made to the database to make it into the ORBS zone and be propogated to all subscriber sites. Sorry for the delay. Q) How do I know you're not a spammer or hacker? A) Post a query to SPAM-L, spamtools, or news.admin.net-abuse.email. We are well known in the anti-spam community and others will vouch for what we do. Q) We use Spamshield which lets our users relay but stops spammers. A) No, it doesn't. I used to accept this but received numerous examples of spam received via Spamshield-protected servers. Check out POP before SMTP instead, it actually works. Q) ORBS made a mistake. Our server doesn't permit relay, or there is no mail server at the address you've blocked. A) You'd be surprised how often I hear this. Let me assure you, there has been no mistake. Your server will not be placed on the list unless my 'bot successfully injects an E-mail message into the IP address you were told about, and that E-mail message makes it back out to the testing address. No exceptions. Of the dozens of systems people have told me I've made a mistake on, not one has been valid. I will no longer respond to these messages. Q) I know our server is open, but I can't fix it yet. Please don't publish the address or spammers will use it. A) I don't "publish" the addresses on the list. The list is made available as a DNS zone that can be queried by servers before they accept mail from anywhere. If they find that the remote address is present in the zone, they may choose to reject the message, they may choose to add a Header field telling the recipient that the remote server is on the list, or they may do nothing. In any case, they at no time have access to the contents of the list. Q) I don't understand why I have been placed on your list, and I am the administrator of my mail server. A) You are not qualified to administer your mail server. Hire someone who is. Give them the message we sent you and point them to our web site. Q) I don't know how to close my relay, help me. A) Check out http://www.dorkslayers.com/orbs/blockedadmin.cgi There are links at the bottom of the page to sites with that information. We also list some consultants who may be able to help you. You can also do a web search for relay restriction and related terms, there are lots of resources out there. If you use a commercial MTA, call your vendor or access their support resources. Q) My current MTA cannot restrict relay. A) Unplug it. Spend $49.00 on a RedHat CD and install it. Q) I'm going to sue you if you don't take me off your list. A) Be my guest. Since mail can't be blocked by my list directly (the recipient must choose to use my list to block mail), liability really belongs to those using my list. (and yes, either the recipient of your message or their system administrator has _chosen_ to use the ORBS list to block mail). US courts have consistently upheld that recipients have the right to block based on whatever criteria they choose. Also, your server gets on my list for one reason only - it permits third-party relay. This is tested prior to your server being placed on the list. Consequently, my listing your server is a statement of fact, since I only claim that your system has failed a relay test, and cannot be considered libellous. You would be better advised to spend the money on a consultant who can close your open relay for you. Q) I need to run an open relay for my remote users. Please take me off your list. A) No. Check out authenticated SMTP, POP before SMTP or POP XMIT. If MSN and Geocities can finally fix their relays, so can you. Q) I've fixed my relay and reported it to your list, but my mail's still being blocked. A) If the web page reports that you are no longer on our list, it may still take a couple of hours to make into the DNS system. Sorry for the delay. Q) Please send me details of the spamming incident which resulted in our being added to your list. A) I cannot. I don't have that information. Q) Who reported my relay to your site? A) I don't record that information. Q) Who gave you the authority to play God or to police the Internet? A) I don't. I provide a free service that many sites find valuable, a service which helps them combat a huge problem - relay spam. Many ORBS users have written to tell me that ORBS is their single most effective tool for stopping spam. You can't argue with success. Q) Why should we take you seriously with a name like Dorkslayers, or with invalid InterNIC contact info? A) Why should I care if you take me seriously? It's your E-mail. ---- Bob Allisat Free Community Network _ bob@fcn.net . http://fcn.net http://fcn.net/allisat _ http://fcn.net/draft