Frequently
Asked
Questions

FAQs | DNS Firewall

• How do I find the IP addresses of my DNS Servers for DNS RPZ?

  Log into your server and run the following command(s):

  • curl -4 https://deteque.com/whatsmyip/
  • curl -6 https://deteque.com/whatsmyip/

  The result from these commands will provide you with the IP that you need to enter into our Customer Portal under the Access tab of your DNS RPZ settings.

  Please note that if you have multiple servers pointing to our services, you will need to run this command on each server that you will be pointing to our service.

  Once you have entered the IP addresses, it can take up to one hour to be provisioned in our systems.

• What are DNS RPZ Threat Feeds?

  The threat Feeds are Response Policy Zones (RPZs) that provide automatic protection against phishing sites and malware downloads.

  They are delivered in industry-standard RPZ format, which allows a recursive DNS resolver to choose specific actions to be performed. This includes dropping, blocking, and passing through traffic.

• What error does the DNS resolver return when a site gets blocked?

  A DNS resolver will return an NXDOMAIN (invalid domain) response when it is matched against a threat feed listing.

  Those utilizing the Dedicated Service can point to an internal IP resource that will allow the block to redirect to an information page that can provide a warning, some education, or insight into why something was blocked.

• What hardware and software do I need to support DNS RPZ Threat Feeds?

  If you chose to use Spamhaus’ Managed Service this is not an issue. However, where you are running your own DNS infrastructure and want to use our Dedicated Service, here are our recommendations:

  While it is possible that the current hardware that is running your DNS resolver may be able to handle the processing of DNS RPZ Threat Feeds, we recommend the following hardware configuration:

  8 core CPU

  8 gigabytes of RAM

  Bare-metal dedicated server

  Please ensure that you are running the most up-to-date version of your resolver software.

• Why have the names of the datasets and data access methods changed?

  Many of our datasets and data access methods have served users for years under technical names and acronyms. As more people start using our data, we've renamed them so it's clearer at a glance what each one is. The legacy names haven't disappeared. You'll still see them in older documentation, and we list them below so you can match old to new.

  What has changed?

  Legacy name	New name
  Data Query Service (DQS)	Blocklists via DNS Query
  Web Query Service (WQS)	Blocklists via HTTPS
  BGP Firewall	Border Gateway Protocol
  DNS Firewall	DNS Response Policy Zones
  Spamhaus Intelligence API (SIA)	Intelligence API

  Legacy name	New name
  Authentication Blocklist (AuthBL)	Bruteforce IPs
  Botnet Controller List (BCL)	Botnet C2 IPs
  Hash Blocklist (HBL)	Low Reputation Resources
  Domain Dataset	Domain Intel
  Exploits Blocklist (XBL)	Compromised IPs
  Combined Spam Sources (CSS)	Email Spam IPs
  ASN DROP	Highly Malicious ASNs
  Don't Route Or Peer (DROP)	Highly Malicious Networks
  Domain Blocklist (DBL)	Low Reputation Domains
  Spamhaus Blocklist (SBL)	Malicious Network Ranges
  Policy Blocklist (PBL)	Non-mail Emitting IPs

  Does the data or service I receive change?
  No. Only the names have changed. The data, coverage and delivery are exactly as before.

  Do I need to update my configuration?
  No action is needed.

  Have the free Spamhaus Project blocklists been renamed?
  No. The SBL, XBL, DBL, PBL, CSS and DROP keep their names on the Spamhaus Project. The new names apply only to the commercial datasets available through Spamhaus Technology.

  Have the abuse.ch platforms been renamed?
  No. MalwareBazaar, ThreatFox, URLhaus and YARAify keep their names. Commercial access to their data is described as Malware samples, Malware IOCs, Malware URLs and YARA scan results.

  Why do I still see the old names in places?
  We're updating our website, documentation and customer materials in stages, so you may come across legacy names for a while. The tables above map each one.

• Why would I want to block DNS resolution?

  There are many networks, domains, and IP addresses on the internet whose sole purpose is to cause harm to or steal information from unsuspecting users who visit their servers and sites.

  For example: a phishing domain, created for the sole purpose of stealing data, can be used for a spam campaign that is sent to users on your network asking them to verify their account. The email is received and is not blocked by your spam filtering, so the message gets delivered into your user’s inbox. When the user clicks on the link to verify their account, because the site is listed in the Threat Feeds, their computer is unable to resolve the phishing website.

  This action will protect your user from surrendering their personal information, and potentially prevent their workstation from becoming infected with botnet software. Blocking malicious content also offers you the potential to educate your users immediately.