{"id":13412,"date":"2020-09-14T08:20:57","date_gmt":"2020-09-14T08:20:57","guid":{"rendered":"https:\/\/www.gmass.co\/blog\/?p=13412"},"modified":"2020-12-09T09:01:57","modified_gmt":"2020-12-09T09:01:57","slug":"spamhaus-dbl-listing","status":"publish","type":"post","link":"https:\/\/www.gmass.co\/blog\/spamhaus-dbl-listing\/","title":{"rendered":"Life on the Spamhaus DBL"},"content":{"rendered":"

About a month ago, our primary domain, gmass.co, was added to the Spamhaus Domain Blocklist<\/strong>, a.k.a the DBL<\/a>. The Spamhaus Project operates the world’s most widely used blacklists that are used to filter email and other Internet traffic. Spamhaus can’t block any traffic itself. They just publish IPs and domains from which they recommend that others block traffic. Their power is derived from the sheer number of organizations that have opted to use their lists of IP addresses and domains names to filter email. Microsoft, for example, uses the Spamhaus SBL list of IP addresses to block email to consumer email accounts @live.com and corporate accounts hosted on Office 365. While Spamhaus does provide explanations for listing IP addresses on their SBL list, they do not provide explanations<\/strong> for listing domains on their DBL list, but based on the evidence, I’m fairly certain a Spamhaus admin saw the GMass website, decided they didn’t like it, and then added my domain to the blocklist. More on that later.<\/em><\/p>\n

\"Listed<\/a><\/p>\n

The implications of being on the DBL are far and wide, and as I’ve discovered, the consequences go far beyond just having email blocked<\/strong>. In fact, I discovered that big companies like Twitter<\/strong> and LinkedIn<\/strong> use the Spamhaus DBL in ways about which most people are completely unaware. The exact return code for gmass.co is 127.0.1.2<\/strong>, which means Spamhaus has categorized<\/a> it as a “spam domain.”<\/p>\n

But it’s not. And Spamhaus won’t tell us why they’ve put gmass.co on their list. So read on.<\/p>\n

What happened, exactly?<\/h2>\n

In early August, GMass released a new feature, the Email Verifier<\/a>. It’s similar to commercial email verification services like NeverBounce<\/strong> and ZeroBounce<\/strong>, but ours was a free service. Our email verifier worked by establishing an SMTP connection and analyzing the response after the RCPT TO<\/strong> command. This is sometimes known as the \u201cbroken handshake\u201d method of verifying<\/strong> an email address. Other platforms, whose sole business is email address verification, use this technique plus other<\/em> techniques to validate an address.<\/p>\n

Shortly after I launched the verifier, the four IP addresses<\/strong> I was using to conduct verifications became listed on the <\/strong>Spamhaus CSS list<\/a>, which is an automated list of IP addresses that are engaged in “sending low reputation email” or represent “compromised hosts.” The CSS list has a self-removal delisting process<\/strong>, which I used to delist the IPs, because I was confident that I wasn’t violating any of the rules, and I figured that the listings were simply due to high SMTP traffic originating from IPs that had never had any SMTP traffic before.<\/p>\n

Also, I soon consolidated the verifier so that all verifications originated from a single IP rather than multiple ones.<\/p>\n

Eventually, the CSS self-removal process stopped working, so I reached out and asked for the IP address to be manually removed. My request was denied.<\/em><\/p>\n

Here’s the interesting part.<\/em> My logs show that my domain, gmass.co, was added to the DBL within ten minutes<\/strong> of a Spamhaus admin responding to my request for the delisting of my IP from the CSS list.<\/p>\n

GMass.co has been a registered domain for more than five years, and GMass has offered the same service (sending campaigns through Gmail) for all five of those years, but inside a ten-minute window of a Spamhaus admin responding to my IP delisting request, the GMass.co domain was added<\/strong>. The only way that could have happened is if in denying my IP delisting request, the admin thought:<\/p>\n

“Well, gee, not only am I going to deny your IP delisting request, but I’m also going to add your entire domain to the DBL.”<\/p><\/blockquote>\n

The DBL documentation states: “Most DBL listings occur automatically, although where necessary Spamhaus researchers will add or remove listings manually.”<\/p>\n

Based on the timing of events, it sure seems like Spamhaus targeted GMass and added my domain manually.\u00a0<\/strong><\/p>\n

The immediate consequences of a DBL listing<\/h2>\n

The Spamhaus DBL is used in ways I could never imagine. The intent of the DBL is to allow email server admins the ability to filter out email that contains spammy domains, and the DBL admins are the arbiters of decisions about whether a domain is spammy or not. What I found, however, is that the DBL’s reach goes far beyond email<\/strong>.<\/p>\n

Twitter<\/h3>\n

All links to gmass.co on Twitter stopped functioning.<\/em> They began to be redirected to a Twitter interstitial page that warned users that the URL is unsafe<\/strong> and recommended they don’t proceed. Here’s what people saw if they clicked a link to gmass.co in any tweet:<\/p>\n

\"Twitter<\/a><\/p>\n

Even the link to gmass.co in my Twitter bio<\/a> would send users to this “Unsafe URL” page.<\/p>\n

At first, I thought Twitter itself blocked gmass.co since I discovered the Twitter issue before I was even aware it was added to the Spamhaus DBL. But then I tested this by tweeting links to other<\/em> domains that are listed on the DBL, and the same thing happened.<\/p>\n

So, Twitter uses the Spamhaus DBL to mark links as unsafe.<\/strong><\/p>\n

I figured I might get around this by using a URL shortener. So I went to tinyurl.com and created a shortened link to the GMass homepage<\/strong> and used that in my Twitter bio. Didn’t work!<\/strong> Twitter was smart enough to check the redirect of a URL<\/strong>, and if the redirect went to a domain on the DBL, it was also blocked. Wow!<\/p>\n

This story has a happy ending though.<\/strong> I reported the issue to Twitter using their spam help form<\/a>.<\/p>\n

\"Twitter<\/a><\/p>\n

Several weeks later, I noticed that links to gmass.co started working again<\/strong>. Other than this auto-response after filling out the form, I never heard anything directly from them, even after they cleared the block on gmass.co.<\/p>\n

LinkedIn<\/strong><\/h3>\n

Similar to Twitter, LinkedIn also blocks links<\/strong> to a domain listed on the DBL. So on the GMass company page, if the domain is shown as gmass.co, this is what you see if you click:<\/p>\n

\"LinkedIn<\/a><\/p>\n

Unlike Twitter, however, LinkedIn does not check for redirects<\/strong>. With LinkedIn, a tinyurl.com shortened link that redirects to gmass.co would still work.<\/p>\n

LinkedIn, however, does go one step further than Twitter by blocking all the content on any company page if that company’s main domain is on the DBL.<\/p>\n

\"LinkedIn<\/a><\/p>\n

Wait, all my posts are gone!<\/p>\n

Facebook<\/strong><\/h3>\n

I should put the thumbs-up \u201clike\u201d icon right here, because no links to gmass.co on Facebook were blocked. I applaud Facebook for making their own decisions about domains rather than using Spamhaus.<\/p>\n

The entire country of Norway<\/strong><\/h3>\n

This was the most unexpected consequence. A Norwegian GMass user contacted me to tell me that he could no longer use the GMass website<\/strong>, and the extension inside Gmail wasn’t working either<\/strong>. Turns out that Norway’s largest ISP, Telenor<\/strong>, uses the Spamhaus DBL to block people from even accessing the website<\/strong> if its domain is on the DBL.<\/p>\n

\"Telenor<\/a>
Translation: You are about to enter a website which may contain viruses, fraud attempts or other malicious software and the filter Network protection from Telenor has therefore stopped you.<\/em><\/figcaption><\/figure>\n

Since our Chrome extension’s API endpoints are all gmass.co URLs, the connections to the endpoints stopped working also.<\/p>\n

I tweeted Telenor asking them to stop doing this, but not surprisingly, they didn’t respond.<\/p>\n

\n

@TelenorGroup<\/a> A mutual user of mine and yours told me that you block users’ access to domains on the Spamhaus DBL. Can you reconsider this decision? It’s silly to block access to a website because Spamhaus thinks the domain is involved in spam. Email and web are different.<\/p>\n

\u2014 Ajay Goel (@PartTimeSnob) August 19, 2020<\/a><\/p><\/blockquote>\n