Introduction

This page is to give information about getting vulnerable servers re-tested and de-listed.

If you are listed in the spam, zombies, DUHL, Open Relay, or Open Proxy server databases this page is not for you!

Unless you are accessing one of the Details pages using the listed host you will not get any further.

How to get Re-Tested!

1/ Use the host that listed to follow the instructions...!

2/ You need to get the key from the Support page...

1. Enter your details and then lookup the address, clicking the 'More..' key will give you the 'Information' page.
2. Click the 'Get Key' Button.
   Note: If you are not using the host listed you will not see the 'Get Key' button.
3. Click the 'retest' link.

3/ Send a mail to retest@stealth.sorbs.net with the Subject set to the key (no quotes necessary).

4/ When you receive the confirmation key, resend that using the instructions in the message.

Notes:

The "key=" & "confirm=" at the beginning of the keys are part of the keys, and need to be included in the Subject of the mail.

Immediately after the confirmation is received the address tested and providing it appears to be closed is marked as "inactive and not flagged to be published", the system will then periodically test the host to ensure it is not just temporarily unavailable.

Should a test message be received from any of the following re-tests the server will automatically be flagged to be published in DNS.

If the host does NOT fail the tests the 'last seen time' will NOT be

My host has been fixed and I have been re-tested clean, why am I still in the DB...?

updated - this value is the last time the entry was tested and confirmed open. SORBS sets a 'block' flag in the database rather than remove the entry. This ensures that reoccuring hosts are tracked and so they will become more and more difficult to remove from the database, the more they are tested open.

Database entries are purged after 'n' years of no activity. Where 'n' = number of re-activations after re-tests showed clean.

My address entry shows 'inactive and not flagged' but I still seen an entry in DNS, why...?

Because of load issues with DNS based block list SORBS sets each positive entry to a 2 day TTL, this means that DNS you queried will hold the entry for 2 days, even when it has been removed from the SORBS database.

Yes, it will cause you pain that neither you nor SORBS can control, however maybe that will be enough pain to ensure that you don't end up back in the database.

Why is it a pain in the butt to use...?

Simple, it is to stop spammers unlisting open hosts so they can use them for spamming, it is also to ensure the owner of the IP address blocked doesn't just block the tester to get unlisted then reopen the server later. It also ensures the IP owner requests the removal after the open relay server or proxy server is closed.