[aclug-L] Re: Using RBL on Email server

[Carl D Cravens <raven@xxxxxxxxxxx>]

Jonathan Hall wrote:
> sbl.spamhaus.org and xbl.spamhaus.org are pretty safe to block without 
> fear of false-positives, for instance.  

If you're going to use these, be sure to use the combined sbl-xbl
server.  It cuts down on the overhead of looking up twice.  (For their
sake, if not for your own.)

> pbl.spamhaus.org is a good 
> candidate for 'intelligent' greylisting like Steve mentioned.
> 
> URIBL is also a great content-based RBL to use (it's a blacklist of URLs 
> found in email content).  SpamAssassin 3.2

I use multiple URI blocklists with SpamAssassin, and I'm pretty happy
with it.  They're a good second-layer filter.

To elaborate, you have to use it at a filtering level (as opposed to the
connection level of an RBL), because it scans the DATA for links within
the body of the message (URIs) and then looks those up to see if they're
known to be evil.

I bump up the score values for the URI lists... SpamAssassin's defaults
are really low.

(For the record, I'm not 500+ spam servers, but I've been running a
public mailing list server for over ten years and we get a lot of spam
to addresses that have been around for years.  We handle more spam than
most small businesses.)

-- 
Carl D Cravens (raven@xxxxxxxxxxx)
"A witty saying proves nothing." - Voltaire

-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi