TechTheft

Building a DNSBL

There are two cardinal sins when it comes to blacklists:

1. Putting/keeping someone on them who should not be
2. NOT putting someone on them who really should be.

Avoiding '1' is a matter of discipline and a thick skin. Avoiding '2' is a matter of being totally independent from all pressures surrounding you.

I am now in the early stages of establishing my own blocklist technology, which will list/delist IPs automatically based on traffic samples received. If the experiment goes as planned, it's likely that I will start serving my list to the public as a DNSBL.

Am I correct in assuming that I have the right, as a blocklist maintainer, to list any IPs (despite other peoples' disagreement)? I would NOT be blocking anyone's mail, just compiling statistics and giving others access to these statistics to do what they wish.

See the Legal section for more details

The Policies published for a DNSBL should derive from your listing criteria and methods of input and removal.

Structure of Policy Documents:

1. Name of DNSBL
2. What is listed within the DNSBL
3. What responses by the DNSBL mean
4. What actions cause additions to the DNSBL
5. What actions cause removal from the DNSBL
6. How users can instigate removal actions themselves
7. How list maintainers can be contacted (if at all)

It is important to tell users who may be blocked as collateral damage what their options are. A good option here is to explain what the evidence/response means and who to contact to get the case closed (Usually their ISP).

Some other helpful inclusions in policy documents are:
• where evidence can be found for listings
• what will happen to persons making unfounded legal threats 'cartooneys' against the DNSBL or its maintainers.