views:

37

answers:

1

I want to query Spamhaus's SBL using a domain name. I know this is possible to do because this form (Find SBL Listings by ISP Domain Name) does it and SpamAssassin does it, but I can only seem to get it to work with IP addresses. I took a quick look at the SpamAssassin code, but it has been so generalized that I could probably spend a couple hours tracking down the code that actually does something. Right now I can successfully query SBL for IP addresses like this:

#returns 127.0.0.2, so 208.73.210.0 is on the blacklist
dig +short 0.210.73.208.sbl.spamhaus.org 

#returns nothing, so 72.14.225.72 isn't on the blacklist
dig +short 72.225.14.72.sbl.spamhaus.org

Querying with domain names seems to have something to do with DNS TXT records, but I don't know the right hostname to lookup. When I try something like

dig oversee.net.sbl.spamhaus.org TXT

I don't get any useful information back, but if you search with the form you find that oversee.net is associated with 208.73.210.0 which was reported as spamming on 30-Jul-2009 21:17 GMT.

A: 

Domains are in the "Domain Block List", not the SBL. Use dbl.spamhaus.org as the domain suffix.

The particular search you linked to is based on the ISP's domain name, and I don't believe it uses the same DNSBL interface.

Alnitak
That is what I tried first, but "oversee.net.dbl.spamhaus.org" says oversee.net is clean. DBL checks to see if the domain "oversee.net" is used by spammers. But that is the name of the owner of the IP address, not the spammer. What I am trying to find (and the form on Spamhaus shows) is if any of the IP addresses owned by that ISP are being used by spammers. For instance google.com is obviously a clean website (and DBL confirms this), but the form shows that 12 of their IP addresses are being used to spam (the spammers are using Google Docs and the new Google URL shortener to redirect spam).
Chas. Owens