Test records
Back to DNSBLThese records are permanent tests and are excluded from live listing totals.
| Query | Expected | Meaning |
|---|---|---|
2.0.0.127.bl.scott.ovh | 127.0.0.2 | User-reported spam |
3.0.0.127.bl.scott.ovh | 127.0.0.3 | Open relay/proxy |
4.0.0.127.bl.scott.ovh | 127.0.0.4 | Web/application attack |
8.0.0.127.bl.scott.ovh | 127.0.0.8 | Repeat offender |
2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.bl.scott.ovh | 127.0.0.2 | IPv6 canary for 2001:db8::2 |
IPv6 lookups
IPv6 addresses are expanded and reversed nibble by nibble in the query name. Query that owner for an A response. ScotNet uses the same 127.0.0.x return-code namespace for IPv4 and IPv6 offenders. The exact lookup format does not change when an address is covered by an escalated prefix.
Exact listings and prefix escalation
Exact-address listing is the default: IPv4 /32 and IPv6 /128. Prefix escalation is reserved for repeated abuse from multiple distinct addresses in the same network.
| Evidence source | Family | Default | Escalation | Evidence window |
|---|---|---|---|---|
| Apache-security | IPv4 | Exact /32 | /24 after 6 distinct listed addresses | 7 days |
| Apache-security | IPv6 | Exact /128 | /64 after 3 distinct listed addresses | 7 days |
| Threatmail | IPv4 | Exact /32 | /24 after 6 distinct listed addresses | 14 days |
| Threatmail | IPv6 | Exact /128 | /64 after 3 distinct listed addresses | 14 days |
Apache-security and Threatmail are evaluated independently: for example, three Apache addresses plus three Threatmail addresses do not satisfy either six-address IPv4 threshold. Escalated ranges use 127.0.0.8, expire after 30 quiet days, and are checked by the daily zone-consistency audit.
Consumers continue querying the exact IPv4 or IPv6 lookup owner. When a range is actively escalated, DNS answers that exact lookup from the prefix policy; no separate client-side range query is required.
Return codes and policy
Consumers should make decisions from the stable 127.0.0.x return code. Feed source, category and subcategory are explanatory metadata and may become more specific without changing the broad DNS classification.
| Code | Classification | Typical evidence | Default retention |
|---|---|---|---|
127.0.0.2 | User-reported spam | Trusted ARF/original-message evidence | 30 days |
127.0.0.3 | Open relay/proxy | Verified relay or proxy behaviour | 14 days |
127.0.0.4 | Web/application attack | Apache exploit evidence or Threat Prevention alert | 30 days |
127.0.0.8 | Repeat offender | Repeated independent abuse or qualifying prefix escalation | 90 days |
Canonical feed labels
Sanitised history uses stable source labels so integrations do not need to handle older aliases such as web:post, spam or manual-miko.
| Canonical source | Meaning | Automatic listing policy |
|---|---|---|
apache-security | Local Apache security evaluation | High-confidence exploit rules or repeated qualifying probes |
threatmail | application platform Threat Prevention alerts received through IMAP | Medium/high/critical alerts according to configured threshold and confidence |
user-spam-report | Trusted user-submitted ARF/original-message evidence | Usually private pending review until corroborated |
manual-admin | Direct operator listing | Operator controlled |
operator-review | Approved private review candidate | Operator controlled and audited |
Threatmail taxonomy
Threatmail evidence is mapped to a broad category and subcategory without exposing email content, destination addresses, subjects or credentials. Current categories include command-and-control, malware, exploit, reconnaissance, credential-attack, denial-of-service, reputation, policy and other.
The category helps reporting and filtering; the original stable DNS return code remains authoritative for enforcement.
Public JSON check API
DNS remains authoritative. The JSON API is a rate-limited convenience endpoint for scripts and canary monitoring: 60 requests/minute and 500 requests/hour per client IP.
Public JSON history API
Sanitised per-IP history is served from an atomically published SQLite snapshot backed by a root-only SQLite/WAL primary, with public-history.json retained as an automatic compatibility fallback. It is limited to 10 requests/minute and 100 requests/hour per client IP. Invalid IP input is rejected before database or fallback-file access.
For automated or bulk DNSBL checking, use DNS rather than repeatedly polling the PHP APIs.
Postfix
Use with care on production mail. Start with reject_rbl_client only at a sensible point in your restriction chain.
Rspamd
SpamAssassin
Exim
Fail2ban pre-check idea
For Fail2ban, treat ScotNet DNSBL as a signal, not as the only reason to ban. Query DNS first, then decide whether to shorten or lengthen ban time.