Zen.spamhaus.org timeouts

If you omit the +short you’ll probably see status: SERVFAIL in the reply.

If you switch to another resolver (e.g., OpenDNS) you might [EDIT: +see] things work:

admin@vm1:~$ dig +short @208.67.222.222 2.0.0.127.zen.spamhaus.org
127.0.0.4
127.0.0.10
127.0.0.2

I had this exact problem on a symbiosis bigv.io machine where all spamhaus.org lookups failed one day last December’ish, and forever more. Lookup volumes were low so I didn’t expect this to be a rate-limiting issue and talking to bytemark & spamhaus, I’m pretty sure it wasn’t due to my machine – yours might be.

Spamhaus were excellent throughout and pointed me at their Data Query Service.

Extracts from conversation with bytemark support will save me having to type :wink:

I’ve been in touch with spamhaus-tech who couldn’t see any reason for the SERVFAILs (100% on my machine, or intermittent, as you reported). As a workaround, they’ve pointed me at their Data Query Service which is performing beautifully as we speak and offers a number of advantages over the public mirror lookups.

Leaders in IP and domain reputation data | Spamhaus Technology

The DQS provides everything that the public mirrors do and more, primarily, dynamic updates (updates within seconds of hailstorm attacks) and zero reputation domains. I expect a few false-positives with the latter but I’m keen to experiment. Even better, use of DQS is free, subject to the same conditions as the public mirrors.

DNSBL Usage Terms - The Spamhaus Project

There’s some ambiguity surrounding these terms - it may be deliberate - but when I contacted them about this is the past they basically gave me the nod. Incidentally, the enquiry sprung up as a result of discussion on the bytemark forum but now that’s been unceremoniously nuked I can’t update the dying symbiosis community, at source. :wink:

I had the impression - no more than that - that spamhaus would have said if it was know a known block (rate-limiting, etc) on their part. I’m sure they’re masters of networking dark arts and they certainly firewall abusive-looking hosts (often suspected to be barracuda appliances). However, it didn’t look like the case here but I’m no expert and it I didn’t want to press them.

1 Like