Re: [Exim] Verisign pulls a fast one

Página Inicial
Delete this message
Reply to this message
Autor: Tony Finch
Data:  
Para: sheldonh
CC: exim-users
Assunto: Re: [Exim] Verisign pulls a fast one
Sheldon Hearn <sheldonh@???> wrote:
>
>Here's what I've added to my unroutable-nets file, which is used for
>the ignore_target_hosts option of the dnslookup router:
>[...]
>I wouldn't mind someone else maintaining and hosting this list
>somewhere. :-)


You seem to have missed a few. No need to maintain the list manually
if you apply a bit of automation (see below). Though I wonder if the
Vatican is the only special case...

194.205.62.122  # AC A
206.253.214.102 # CC A
206.191.159.103 # CC MX
64.94.110.11    # COM A
219.88.106.80   # CX A
202.128.12.163  # MP A
195.7.77.20     # MUSEUM A
64.94.110.11    # NET A
64.55.105.9     # NU A
212.181.91.6    # NU A
203.119.4.6     # PH A
194.205.62.62   # SH A
195.20.32.86    # TK A
195.20.32.83    # TK A
195.20.32.99    # TK MX
194.205.62.42   # TM A
216.35.187.246  # WS A
216.35.187.251  # WS MX


Tony.
--
f.a.n.finch <dot@???> http://dotat.at/
SHANNON: SOUTH OR SOUTHWEST 4 OR 5, OCCASIONALLY 6 AT FIRST. OCCASIONAL RAIN.
MODERATE.


#!/bin/sh -e
#
# Produce a list of addresses that should not be delivered to,
# because they are stupid top-level domain wildcard records.
#
# $Cambridge: hermes/exim/sbin/badtlds,v 1.1 2003/09/17 16:54:18 fanf2 Exp $

PROBE=ucam-testing-for-broken-wildcard-records-`date +%Y%m%d-%H%M%S`

# whitespace and not whitespace regex sets
WS='[     ]'
NWS='[^     ]'


list_records () {
    local type domain regex
    type=$1 domain=$2 regex=$3
    dig $type $domain 2>/dev/null |
        sed "/^$regex$WS/!d
            /$WS$type$WS/!d
            s/.*$WS\($NWS$NWS*\)\$/\1/"
}


list_mxes () {
    local mx re
    list_records MX $1 $2 |
        sed 'h;s/\./[.]/g;G;s/\n/ /' |
        while read re mx
        do
            list_records A $mx $re
        done
}


# We use root server f (run by the good guys at the ISC) to get a list
# of top-level domains.
#
# We manually exclude the Vatican (VA) from the stupid list because
# their wildcard MXs include real MXs for their subdomains.
#
dig @f.root-servers.net. axfr . |
    sed '/^\([A-Z][A-Z]*\)[     ].*/!d;s//\1/;/VA/d' |
    sort -u |
    while read TLD
    do
        domain="$PROBE.$TLD."
        regex="$PROBE[.]$TLD[.]"


        list_records A $domain $regex |
            sed "s/.*/&    # $TLD A/"


        list_mxes $domain $regex |
            sed "s/.*/&    # $TLD MX/"
    done