[SpamCop.net - protecting the internet through technology]

[SC-Help] Many questionable cases of "Cannot resolve"

J. Merrill jvm_cop at spamcop.net
Wed Jan 5 09:03:08 EST 2005


I have seen a substantial increase in the number of spams where
there is no identified web site.  In each case, the message
"Cannot resolve http://..." is part of the technical details --
as if the site has been taken down, and readers of the spam could
not successfully click on the links in the message.

In many cases, I have grabbed one or more of the non-resolvable
domains and used Windows 2000's command-line "ping" and seen that
ping is able to resolve these addresses, even though SpamCop's
server apparently cannot.

I know about DNS changes propagating at different speeds and so
on.  Many times, I have used "ipconfig /flushdns" to try to get
the freshest possible info.  If it weren't happening quite
consistently, I wouldn't be asking.

What I've done (when I feel inspired to take extra time for a
particular spam) is to use SpamCop to get a report of the IP
address that "ping" shows me, then modify the spam message by
adding something like

*** Spam reporter added:  http://202.102.230.36
*** because SpamCop could not resolve jkelwi.wise-sol.info

and have SpamCop re-parse the message.

Is that what I should be doing?  How can I know whether or not
the address that "ping" shows me is really involved?  Is there an
easy-to-use more-reliable way to get the "official" DNS status
for a domain?  (If the ISP has already taken the site down, will
this still count against its spam-friendliness rating?)

Thanks for any help.




More information about the SpamCop-Help mailing list