<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Quote “Surely contacting the domain registrars to get these domains taken down is a better approach than altering dns records at the ISP end.”<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I wholeheartedly agree with you. Trouble is many overseas registrars do not agree with us. Unless ‘bad’ registrars around the world are forced from the business, the problem continues and continues to grow.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>One personal example of mine. On a quiet day a few months ago I was tired of some spam getting through filters so I identified the registrar for a spam site that the spam email wanted me to visit. This registrar happened to be in Turkey so I wrote a polite email to the registrar and attached the offending spam email to my request for de-registration of the domain. Thinking “that might fix the problem, if not, I’m no worse off” I moved on to more productive work. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I was WRONG, it got worse. I now receive spam emails from Turkey!!! when I never did before. I do not think this is a coincidence. Rightly or wrongly, now my impression is that some registrars operate with little regard for the general well-being of the industry and probably the laws of their own country. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>While the move of serious organised crime into the internet needs addressing and ISPs are concerned enough to take some action to protect customers from criminals, this does then raise other important issues that if ISPs start this process, then it opens the door to allowing other insidious evils such as censorship or legal issues around ‘duty of care’ and probably more. Telstra may be able to claim they are merely doing what is necessary to protect their own ISP network but not being a lawyer I do not know if that is sufficient or even a valid claim.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Me looks ahead and sees a gentle slippery slope starting here. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m thinking the correct and best approach (and probably harder) is to sue registrars for failing in their responsibilities and leave ‘tampering of DNS’ alone.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Rod<br><br><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Martin - StudioCoast<br><b>Sent:</b> Thursday, 14 June 2012 4:55 PM<br><b>To:</b> AusNOG@lists.ausnog.net<br><b>Subject:</b> [AusNOG] Telstra manipulating DNS to block botnets<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><a href="http://www.computerworld.com.au/article/427613/telstra_trial_detects_5_4_per_cent_botnet_infection_rate/#closeme">http://www.computerworld.com.au/article/427613/telstra_trial_detects_5_4_per_cent_botnet_infection_rate/</a><br><br>Surely contacting the domain registrars to get these domains taken down is a better approach than altering dns records at the ISP end.<br>I guess this leads to a question to all network operators of Australian ISPs, do you modify DNS records in your cache and if so what for?<br><br><o:p></o:p></p></div></body></html>