Spam blocker rises from the dead to bite lax email administrators

Stuart Corner
Wednesday, 26 March 2008 10:47

Your IT - Home IT

A database of open relay email servers, provided until late 2006 as a voluntary service to help email administrators block spam, has suddenly re-activated but is returning every address queried as being on its blacklist.

Administrators of email systems should have stopped querying the database (relays.ordb.org) in December 2006 when it shut down, but some failed to do so. That was no problem until today, queries were simply rejected, but now the address of any email server presented is being returned as an open relay. This results in the querying system rejecting all incoming mails from that server.

In an email to customers, Melbourne based email and web filtering service, Mailguard, said: "It has come to our attention that several customers have been continuing to query the ORDB blacklist for their incoming mail, and this morning have begun rejecting this incoming mail believing that MailGuard's servers were blacklisted."

The email warned customers that: "it is likely that some of your outgoing email will be rejected by mail servers on the greater Internet which still refer to the ORDB blacklist. If this happens, you will receive an non-delivery report (possibly from MailGuard's servers) which states something along the lines of the following: 'This server does not accept messages from known blacklisted site. Your host was found in the DNS Blacklist at relays.ordb.org' or 'Service unavailable; Client host blocked using relays.ordb.org'."

ORDB was maintained by a group of volunteers in Denmark and operated for over five years. According to a report on The Register at the time of its  closure "a notice was posted on the site saying: 'It's been a case of a long goodbye as very little work has gone into maintaining ORDB for a while. Our volunteer staff has been pre-occupied with other aspects of their lives. In addition, the general consensus within the team is that open relay RBLs are no longer the most effective way of preventing spam from entering your network as spammers have changed tactics in recent years, as have the anti-spam community."

The ORB website's URLs (http://www.ordb.org and http://ordb.org) are no longer active (ORDB said they would shut down on 18 December 2006) so there is no indication of who is responsible for the re-activation of the 'service'. However one post on Slashdot stated, without any confirmation it had been done "as a way to get sleeping users to remove the ORDB query from their spam filters."