North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: Regarding panix.com
- From: Matthew Sullivan
- Date: Mon Jan 17 06:56:26 2005
Something to give thought to everyone on this list using DNSbls....
Bruce Tonkin wrote:
What sort of support would you give a not-for-profit Org such as
SORBS.net or an Org such as Spamhaus.org if our domains were hijacked
maliciously (or not)....?
I have had a few emails regarding a perception that we have limited
support to deal with issues such as panix.com, so I will just set the
We provide a standard first level retail customer service line 24 hours
by 5.5 days. (which gives business hours service in all world time
We provide 24 hour by 7 day customer service for resellers (typically
ISPs, web hosting companies etc).
This would be particularly important to consider in the event of somone
hijacking and creating a record such as:
*.dnsbl.sorbs.net 604800 IN A 127.0.0.2
*.sbl.spamhaus.org 604800 IN A 127.0.0.2
We provide 24 hour by 7 day second level technical operations support.This is certainly a start, and hopefully the nessesary people will make
things happen to ensure it never happens again.
Most major registrars and ICANN have direct contacts into the technical
parts of Melbourne IT. I received notification from several parties
via email (but I don't read email 24 hours a day).
We are looking at our processes to ensure that incidents such as
occurred with panix.com can be addressed more quickly within Melbourne
IT, and also checking to ensure that an appropriate number of external
people have access to the right contacts at Melbourne IT to fast track
For the record, SORBS.net is registered with GANDI, I have no intention
of updating the NS servers away from ones listed in the SORBS.net domain
or transfering the domains to another registrar, however I am yet to
find any method to 'LOCK' or 'UNLOCK' the domain...
I note that Spamhaus.org is set 'CLIENT TRANSFER PROHIBITED' and 'CLIENT
UPDATE PROHIBITED' so in theory this shouldn't be a problem, but the
various earlier comments indicating that panix.com was thought to be
'LOCKED' before the issues of the last few days provide more food for