I agree with your sentiment. My first thought, however, was that is extremely costly to dynamically lookup DNS for every page request. Even if a DNS lookup was

I agree with your sentiment. My first thought, however, was that is extremely costly to dynamically lookup DNS for every page request. Even if a DNS lookup was only performed if the IP matched that range, you'd still end up doing a DNS lookup for every MSNBot hit. If they're calling way too many pages (which is the reason for the block in the first place), this will thrash your server. Now, if you followed the above but then added the IP to a static blacklist if it resolved to an MSFT host - and a whitelist if not - then the system should work without too much of a performance hit (except a small one upfront). Of course, at that rate, it would probably be easier to just submit a batch job to generate IPs in that range for blacklist and whitelist. Anyways, your rhetorical point still stands :-)