Is SpamHaus Feed for RPZ is free or subscription based?

[babu dheen]

Dear All,

 I would like to integrate BIND DNS with Spamhaus Malware DB feed. But i need clarity whether Spamhaus offers this feed for free or subscription(cost) based?

Regards

Babu

[Steven Carr]

This is all explained clearly on their website...

http://www.spamhaus.org/organization/dnsblusage/

> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to
> unsubscribe from this list
>
> bind-users mailing list
> bind-...@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

[Noel Butler]

On 06/11/2013 18:52, babu dheen wrote:

> Dear All,
>
> I would like to integrate BIND DNS with Spamhaus Malware DB feed. But i
> need clarity whether Spamhaus offers this feed for free or
> subscription(cost) based?

If you want your local copy it will cost, and they charge like 20
counties of farms with herding bulls, so forget it, stick to their dns
based stuff.

[Dave Warren]

On 2013-11-06 01:04, Steven Carr wrote:
> This is all explained clearly on their website...
>
> http://www.spamhaus.org/organization/dnsblusage/
>

Perhaps you can point out where on that page RPZ is mentioned?

--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren

[Steven Carr]

On 6 November 2013 11:19, Dave Warren <da...@hireahit.com> wrote:
> Perhaps you can point out where on that page RPZ is mentioned?

The Spamhaus news article announcing the "beta" RPZ service
(http://www.spamhaus.org/news/article/669/) indicates that the
Spamhaus DBL is being repurposed as an RPZ data feed. There is nothing
else on the Spamhaus website regarding RPZ, and since it's using the
DBL as it's basis the logical assumption is the same "licensing"
applies (unless anyone from Spamhaus wants to correct matters).

Steve

[Simon Forster]

Thank you for the invite.

Broadly your summation is correct. Fleshing it out a little:

The Spamhaus DROP (Do not Route Or Peer) RPZ will have a maximum annual fee of US$500. The DROP (and eDROP) products contain hijacked IPs and those under the control of egregiously bad actors.

The $500 fee is to help cover the "repackaging" and delivery costs of the DROP lists via RPZ (although make a reasonably cogent argument as to why you should get the RPZ DROP without cost and we're likely to agree with you).

For those interested in rolling their own products, the DROP and eDROP lists are available free of charge at <http://www.spamhaus.org/drop/drop.txt> and <http://www.spamhaus.org/drop/edrop.txt>. We do not apply a licence to these products and creating your own derivative products currently is OK.

The DBL based RPZ has been made available free of charge but is moving towards a charged model. Fees will be as per the DBL blocklist product which is based on a user volume model. If you're already a subscriber to the rsync service and would like to use the Spamhaus RPZ product, there will be a small surcharge on your current subscription fees.

At this point in time we're not taking a position with respect to rsync service subscribers taking the data and repurposing it themselves for delivery as an RPZ via IXFR to the same audience as that benefiting from the protection offered by the rsync service. Put another way, if you subscribe to the rsync service for 10,000 users and decide to repurpose the data to make it available to the same audience via RPZ, your call.

For the record, I work for the commercial arm of Spamhaus[1].

All the best

Simon


[1] As this statement may get some people raising questions, The Spamhaus Project Ltd is a non-profit. I work for a smaller Spamhaus company which does aim to be profitable in order to cover the costs of the non-profit. Or as I prefer to paraphrase it, non-profit does not mean for-massive-great-loss.

[Dave Warren]

On 2013-11-06 06:08, Steven Carr wrote:
> On 6 November 2013 11:19, Dave Warren <da...@hireahit.com> wrote:
>> Perhaps you can point out where on that page RPZ is mentioned?
> The Spamhaus news article announcing the "beta" RPZ service
> (http://www.spamhaus.org/news/article/669/) indicates that the
> Spamhaus DBL is being repurposed as an RPZ data feed. There is nothing
> else on the Spamhaus website regarding RPZ, and since it's using the
> DBL as it's basis the logical assumption is the same "licensing"
> applies (unless anyone from Spamhaus wants to correct matters).
>

You're right, if you want to make assumptions based on years-old reports
of a new service entering beta and assume that it might be licensed
similarly to other services which are designed and distributed totally
differently, then it's "explained clearly on their website"

In the real world though, while I suspect you're correct, it's far from
"explained" "clearly" or "on their website"