DNS

看到一条消息：

日前广州信息时报有报道说网易免费邮箱不能做为申请游戏《水浒Q传》使用一事件，并将该事件与之前的网易梦幻西游研发人员跳槽联系起来，网易公司为此发出声明：网易免费邮箱不会拒收正常的电子邮件，更不存在媒体中所猜测的报复行为。此次金山公司发送passport信件的域名（staff.kingsoft.com）所做SPF（SPF是当前应用很广的一种反垃圾技术）记录不全，由于其用来发送信件的部分IP没有在其SPF范围内，导致被网易系统判断为假冒发件者，因此被认为是垃圾邮件而拒收。做为全国最大的邮箱供应商，网易公司一直以方便用户使用为己任，严格遵守《互联网电子邮件服务管理办法》以及RFC的相关国际标准，尤其在反垃圾邮件方面更是起到了表率作用。网易拥有7x24小时的客户服务体系，用户和企业可以获得全面完善的咨询和支援服务。关于此事，网易客服至今未收到任何用户及企业的寻求支援。

一直想做的一件事：跨越三网的MX和NS互备，我认为基本上可以应付个人网站任何常见规模的网络间断和服务器宕机导致的潜在丢信问题。

(此文档属于备忘录性质，作者不对此备忘录的正确性、条理性、实用性、适用性承担任何责任。
版权所有 (c) 2006 李鑫，保留所有权利。未经作者书面或PGP签名许可，禁止转载、修改、复制，或以其它未经授权的方式使用本文内容)

今天 hengdm 同学投诉说他无法接收某个来自国内著名邮件服务提供商的邮件，一看果然被spamassassin拦住(注意我已经大大放宽了杀信的尺度)，结果是：

X-Spam-Status: Yes, score=14.944 tag=2 tag2=6.31 kill=8.6 tests=[AWL=-0.927, BAYES_99=4.3, DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_DSN=2.597, DNS_FROM_RFC_POST=1.708, FROM_EXCESS_BASE64=1.309, HTML_FONT_FACE_BAD=0.156, HTML_MESSAGE=0.001, HTML_OBFUSCATE_10_20=1.77, MIME_BASE64_NO_NAME=0.224, MIME_BASE64_TEXT=1.885, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, SUBJECT_ENCODED_TWICE=1.723]
X-Spam-Score: 14.944

呵呵，什么东西都可以是DNS。如果说这话的人不是讲冷笑话的话，我不知道您是觉得别人都是白痴，还是什么意思。

若想人不知，除非己莫为。

算了，不说了。

对于所有进入的连接：

• 必须发送EHLO或HELO
• 拒绝无效EHLO
• 允许经过身份认证的用户绕过余下的测试
• 禁止特定EHLO名字
• 拒绝EHLO机器名非FQDN的情形
• 拒绝不可解析的EHLO名字
• 除上述禁止情况之外，进入下一流程。

http://www.dnsreport.com/ 提供了一项检查服务，帮助你查找自己域名DNS配置中存在的问题。过去曾经以为自己很明白如何配置Internet域及其服务，查了才知道差很多，然后才加以改正。

A decision was made to enable SPF on beastie. SPF is a technology that mitigates forged spam (while it itself is not totally spam proof, as spammers can set up their own SPF record :-)

This article has suggested a way of hiding version.bind string. From a security perceive, this is an overkill and can usually be harmful:

• While it’s true that you can hide version.bind, the fact that version.bind is can be queried reveals that you are running BIND. It makes little sense to fake a version.
• The need of hiding information, which is unnecessarily hidden like this, means that the system administrator is neglecting security.
• Therefore, FOREACH(version.bind is queriable and is hidden) HACKEM :-)

Security can NOT be built on what others are not aware of.

As title. We *need* to struggle to make the upcoming 6.0-RELEASE a good release . I hope we can show the great improvements taken place in 6-CURRENT and hopefully we can cut 6-STABLE this June.

Highlights on recent 6-CURRENT that was not merged (and may never be merged):

• MPSAFE VFS
• Integrated VFS hashing (generallized, traditionally it’s different on ufs, msdosfs, etc)
• 64bit-ize of several utilities, to ensure better usage of large storage.

I’ve finally decided to move out from cnftp as I can’t figure out when, what and why its configuration that can influence my site keeps changed from time to time. Everything pulled out, and the httpd configuration has been removed to reflect this without misleading people who has decent DNS records cached in their DNS mirrors.

Still don’t know why a simple upgrade will cause GB2312 to represent in UTF8 errornously. Maybe when I have time, but not now.