DNS server for barracudacentral.org/account/password
Hello,
Our users receive quite a lot of spam and I am under the impression that barracudacentral.org (which is configured as custom RBL) is not answering requests. In /etc/resolv.conf we have our datacenter nameservers (we had some google NS but I removed them recently).
When I am trying to make a dig test query I do it like this:
dig @dc.name.server our.ip.in.reverse.b.barracudacentral.org
We are not getting any answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
Another problem is that I am unable to access https://www.barracudacentral.org/account/ to add our server IP to the list of IPs allowed for queries. I am getting 403 all the time.
So:
- am I performing the test query correctly?
- do I need to add my server IP or my datacenter nameservers IPs to barracudacentral.org/account?
- any way to login to https://www.barracudacentral.org/account?
Thanks,
Kind regards!
-
Hey there! Can you let me know where you see it not answering requests? Their main page at https://www.barracudacentral.org/ seems active as do all the menu pages on the left, such as https://www.barracudacentral.org/report
0 -
Hello,
I am not trying to access the publicly available pages from BarracudaCentral but to login to update my server IPs (I was able to do so).
So links like these are giving me 403:
https://www.barracudacentral.org/account
https://www.barracudacentral.org/account/passwordInitially this works:
https://www.barracudacentral.org/user/login
But after I enter the password I think I have, this also no longer work. But the /account/password never works for me (always 403).And the https://www.barracudacentral.org/report seems to be for me to report spams and viruses, not to ask for help. Even so I believe I have tried that (that form or one similar) when I initially encountered this problem but nobody answered.
0 -
I don't have a good explanation for any of that - it would be best to reach out to their team directly, but I can confirm those links also 403 for me.
0 -
cPRex I think at some point Barracuda Networks simply decided to stop allowing people to log in and add specific IPs for querying. Last time I looked for the option it was not available. And what they used to recommend as the URL in the reject text ( http://www.barracudanetworks.com/reputation/?pr=1&ip=###.######.### ) no longer works either. But, at least for my servers, I'm still able to use Barracuda's RBL along with my own dedicated resolvers for my machines. I imagine public resolvers are blocked. And I'm not sure Barracuda is allowing anyone to add IPs to get higher volumes like they used to.
0 -
Thank you both for your feedback. So the IPs that were already entered years ago for higher volumes remain "whitelisted"?
Could anyone help me with an example dig query (along with with what answer should I expect) to check if Barracuda is accepting any request volumes from my servers?
Thanks!
0 -
AndyB I can't say for certain, but it appears that way for me. Do keep in mind though that I do not make RBL queries through public resolvers. I have two Digital Ocean droplets set up to handle outbound queries from our machines. Those are the machine IPs that Barracuda sees. I'm having no problems with Barracuda RBL blocking though.
IP: 103.13.206.98
dig 98.206.13.103.b.barracudacentral.org txt
;; ANSWER SECTION:
98.206.13.103.b.barracudacentral.org. 900 IN TXT "http://www.barracudanetworks.com/reputation/?pr=1&ip=103.13.206.98"-------------------------------------
Or with nslookup on Win
C:\Users\dux>nslookup -q=txt 98.206.13.103.b.barracudacentral.org
Server: dns.google
Address: 8.8.8.8Non-authoritative answer:
98.206.13.103.b.barracudacentral.org text ="http://www.barracudanetworks.com/reputation/?pr=1&ip=103.13.206.98"
0 -
Thank you very much. The query for your sample IP (listed as poor in Barracuda) returns an answer.
Only now I have understood that if the dig yields no Answer section it simply means the IP is not listed as Poor on Barracuda. Initially I thought that the lack of an Answer section means the query was not successful for some reason (query incorrect or not accepted etc).
I have looked in exim_mainlog and indeed Barracuda does return results on the servers (so it works) but SpamCop and SpamHaus returns usually 2 to 3 times more results (they have more offending IPs). In the past I used to rely pretty much on Barracuda. Has Barracuda decreased in antispam coverage or this is simply normal?
0 -
I think it's fairly normal. I'm not sure that Barracuda necessarily has less IPs blocked (but they probably do have less IPs blocked). I think it's probably a situation where Spamhaus is a built-in RBL and Barracuda is an addon -- and I'm guessing that Barracuda is queried only after Spamhaus is. So Spamhaus triggers on the majority, and then if it's not in Spamhaus but is in Barracuda then the Barracuda rejection occurs.
I don't believe there has been any decrease in "spam coverage" from the Barracuda list over the years.
M
0 -
I see. You are probably right. Thank you very much for your help!
0
Please sign in to leave a comment.
Comments
9 comments