surbl module reports false positives when used with dns squatting ISPs

If you are pointing to a dns server that provides 'helpful' ip addresses for typo'd host names, the surbl module will return a score of 99 for domains that are not on found in the blacklist. This happens because a dns lookup for a host in surbl should only resolve for blacklisted domains but the 'helpful' dns servers always return an ip address.

An easy way to test if your dns is well behaved or 'helpful' is to run a check on google.com. The result when pointed at a well behaved dns server looks something like this:

$ php
<?php
print gethostbyname('google.com') . "\n";
print gethostbyname('google.com.multi.surbl.org') . "\n";
^D
74.125.224.81
google.com.multi.surbl.org

And from a 'helpful' dns server it will return two ip addresses:

$ php
<?php
print gethostbyname('google.com') . "\n";
print gethostbyname('google.com.multi.surbl.org') . "\n";
^D
74.125.224.81
11.22.33.44

A suggested work [1] around is to check that the resulting ip address is in the 127/24 block.

[1] http://www.surbl.org/guidelines See #7.