RBL Vs White List

24 December 2008 | Filed under: Spam

RBL

RBL is an abbreviation for “Real-time Black List”. An RBL is a list of ‘known’ SMTP servers notorious for sending SPAM. The List is regularly updated with new potentially harmful entities. These entities might be a list of domain names, IP addresses and viruses that are known to cause or associated with potentially harmful activities. When the user receives a message, the email server can look at the IP address of the originating SMTP server, and search for it in a black list. If the IP address is found in the black list, traffic from that particular IP address it’s automatically blocked.

In the past, blacklist solutions come in the form of software. Traditionally, there existed only two major forms of software that used Real Time Black Lists: antivirus and anti-spyware software. However, new advanced blacklist solutions which use heuristics like the DNSBL (DNS Black List) have come up.

There are many advantages associated with using Real Black Lists; one major advantage of RBLs is that they don’t entail any major work from the user. You don’t need to have specialty training. Other advantages include; automatic update of the blacklist, total security against known threats, no need for definition file updates. It also acts as an extra layer of protection because it does not rely entirely on definition files.

However, there are some drawbacks associated with using Real Time Black Lists. Your network is left under the control of a third party vendor and constantly updating the list might consume a good chunk of the available bandwidth. A large email from a good source might be mistakenly deleted or blocked. The scanning of all incoming and outgoing IP traffic might slow down the system. Works stations and networks might be vulnerable to day-zero attacks.

White list

A white list is a list of accepted e-mail addresses or domain names/IP addresses that the user deems are acceptable to receive email from and should not be deleted. The most popular list is the e-mail white list. E-mail white lists contain a list of of e-mail addresses or domain names from which e-mail blocking software will allow traffic to be received. The white list is an option for those who don’t like using Real Time Black Lists.

There are many advantages associated with using a white list.The system performs faster because there is no constant scanning of outgoing or incoming traffic. You don’t need to install unlicensed software. No executable programs like spyware or Trojan horses will ever get installed on your system. There is also no need for virus or spyware definition updates; therefore, systems are constantly protected from day-zero virus attacks.

One drawback of using a white list is that you might miss an important message from a credible source that you have not included in the white list.