nanog mailing list archives
Re: Regarding panix.com
From: Matthew Sullivan <matthew () sorbs net>
Date: Mon, 17 Jan 2005 21:54:36 +1000
Something to give thought to everyone on this list using DNSbls.... Bruce Tonkin wrote:
What sort of support would you give a not-for-profit Org such as SORBS.net or an Org such as Spamhaus.org if our domains were hijacked maliciously (or not)....?I have had a few emails regarding a perception that we have limited support to deal with issues such as panix.com, so I will just set the record straight. We provide a standard first level retail customer service line 24 hours by 5.5 days. (which gives business hours service in all world time zones). We provide 24 hour by 7 day customer service for resellers (typically ISPs, web hosting companies etc).
This would be particularly important to consider in the event of somone hijacking and creating a record such as:
*.dnsbl.sorbs.net 604800 IN A 127.0.0.2 or *.sbl.spamhaus.org 604800 IN A 127.0.0.2 etc....
This is certainly a start, and hopefully the nessesary people will make things happen to ensure it never happens again.We provide 24 hour by 7 day second level technical operations support. Most major registrars and ICANN have direct contacts into the technical parts of Melbourne IT. I received notification from several parties via email (but I don't read email 24 hours a day). We are looking at our processes to ensure that incidents such as occurred with panix.com can be addressed more quickly within Melbourne IT, and also checking to ensure that an appropriate number of external people have access to the right contacts at Melbourne IT to fast track serious issues.
For the record, SORBS.net is registered with GANDI, I have no intention of updating the NS servers away from ones listed in the SORBS.net domain or transfering the domains to another registrar, however I am yet to find any method to 'LOCK' or 'UNLOCK' the domain... I note that Spamhaus.org is set 'CLIENT TRANSFER PROHIBITED' and 'CLIENT UPDATE PROHIBITED' so in theory this shouldn't be a problem, but the various earlier comments indicating that panix.com was thought to be 'LOCKED' before the issues of the last few days provide more food for thought.
Regards, Matthew
Current thread:
- Regarding panix.com Bruce Tonkin (Jan 16)
- Re: Regarding panix.com Steve Sobol (Jan 16)
- Re: Regarding panix.com Richard Cox (Jan 16)
- <Possible follow-ups>
- RE: Regarding panix.com Bruce Tonkin (Jan 16)
- Re: Regarding panix.com Matthew Sullivan (Jan 17)
- Re: Regarding panix.com Steve Sobol (Jan 19)
- Re: Regarding panix.com Matthew Sullivan (Jan 21)
- Re: Regarding panix.com Matthew Sullivan (Jan 17)
- Re: Regarding panix.com Steve Sobol (Jan 19)
- RE: Regarding panix.com Bruce Tonkin (Jan 17)
- Re: Regarding panix.com George William Herbert (Jan 17)
- RE: Regarding panix.com Bruce Tonkin (Jan 17)