[Mimedefang] off topic: rfc-ignorant

William Leibzon william at completewhois.com
Fri Feb 18 17:49:15 EST 2005


On Fri, 18 Feb 2005, Aleksandar Milivojevic wrote:

> May make couple of people here smile (at least).
>
> The rfc-ignorant seems to be ignorant themself.  My log files are full of 
> these:
>
> lame server resolving '4.3.2.1.ipwhois.rfc-ignorant.org'(in 
> 'ipwhois.rfc-ignorant.ORG'?): 127.0.0.1#53
>  They are delegating ipwhois.rfc-ignorant.org to localhost (127.0.0.1).

Because of changes in RFCs ipwhois was discontinued from rfc-ignorant end
of last year, there is a link to announcement about it on their website.

Completewhois took most of the data and incorporated it into our invalid
whois project database, you can use it for blocklisting as
  invalidipwhois.dnsiplists.completewhois.com
Or in combination with bogons & hijacked lists:
  combined-hib.dnsiplists.completewhois.com

For more information see
  http://www.completewhois.com/invalidwhois/invalid_ipblocks.htm
  http://www.completewhois.com/bogons/using_bogon_lists.htm

> Wooohooo :-)))))
>
> (OK, I haven't checked RFCs, but delegating domain to localhost is simply 
> plain wrong)

Its not against any RFC and its not wrong. Its rather common trick used 
when previously public page is no longer public and website owner does
not want (or can not by order court, etc) maintain any info about it on 
its webiste, but removing its dns completely can not be done for some 
reason.

Whoever queries and sees 127.0.0.1 will understand (including based
on the logs like you did) that resource is no longer available and
will hopefully not query for it any more. As you can understand this
is what they they want, because if they just removed ipwhois.rfc-ignorant
then you'd continue to get NXDOMAIN and will never know to stop
querying for it.

---
William Leibzon
   mailto: william at completewhois.com
Anti-Spam and Email Security Research Worksite:
   http://www.elan.net/~william/emailsecurity/
Whois & DNS Network Investigation Tools:
   http://www.completewhois.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 1118 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20050218/86bef143/attachment.bin>


More information about the MIMEDefang mailing list