[aclug-L] Re: Using RBL on Email server

[Dale W Hodge <dwh@xxxxxxxxxxxxxxxx>]

Spamhaus offers two combined lists sbl-xbl which obviously combine sbl 
and xbl lists, and zen which adds pbl to the first two.  There's a whole 
list of possible filters at http://spamlinks.net/filter-dnsbl-lists.htm

I've been adding and dropping lists for the past few days and I think 
I've finally gotten it to a point I can live with the results. My first 
few tries weren't aggressive enough and the next few were too aggressive.

I've also taken the suggestion and have added greylisting to the mix.
Anything that isn't caught by the filters gets greylisted. That seems to 
  be reducing the already reduced spam flow to almost nil.

However, I'm not running spam-assassin because it was requiring too much 
processor time on my underpowered mail servers. Instead I've opted to 
let Thunderbird do the filtering when I open my mailbox. Maybe not 
optimum, but even when it was working spam-assassin would sometimes 
munge an email. No such problem with T-bird.

--Dale


Jonathan Hall wrote:
> We use RBLs to stop 80-90% of our incoming SMTP connections, on ~500 
> anti-spam servers installed throughout the U.S. and Canada.
> 
> There are different RBLs, and indeed different _types_ of RBLs.  If 
> you're selective about which ones you use, you can practically eliminate 
> all false-positives.
> 
> sbl.spamhaus.org and xbl.spamhaus.org are pretty safe to block without 
> fear of false-positives, for instance.  pbl.spamhaus.org is a good 
> candidate for 'intelligent' greylisting like Steve mentioned.
> 
> URIBL is also a great content-based RBL to use (it's a blacklist of URLs 
> found in email content).  SpamAssassin 3.2 (and maybe 3.1) has a plugin 
> to use it.  I highly recommend using it!  When we have clients call and 
> complain that they're getting too much spam, 9 times out of 10, it's 
> because their URIBL SA plugin isn't working properly (usually due to 
> broken DNS).
> 
> A combination of approaches is almost always best.
> 

-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi