Re: RBL's and SA

for me, spamhaus actually catches bounce backs from mail servers that don't have an ip address or domain specified in the IP Src. example:

20031023075003-0700:IP Filter: SpamHaus RBL MATCH: IP Src: <> IP dest: <ruben.gonzales@xxxxxxxxx>

20031023075012-0700:IP Filter: SpamHaus RBL MATCH: IP Src: <> IP dest: <glaadvolunteersny-request@xxxxxxxxx>

i've looked at nearly every one of these (i have the filter copying to an address that i check out), and they are legit bounces. is there a way for me to do an exclude in the filter if the source address is blank?

thanks!

aasun

On Tuesday, October 21, 2003, at 07:57 AM, Elton wrote:

I split my (7) RBL's into separate filters, and was surprised that four of the seven are all but worthless.

Aprox. 22,000 spams in the last 10 days with "zero" false positives; SA Running "out of the box", no white-list, etc..

sbl.spamhaus.org.........48.55%

bl.spamcop.net...........21.23%

spam_assassin............19.22% *not an RBL

dnsbl.njabl.org..........10.14%

spamguard.leadmon.net.....0.69%

blackholes.uceb.org.......0.09%

relays.ordb.org...........0.06%

rdts.bl.reynolds.net.au...0.03%

*Note: Spam Assassin sits behind these RBL's; ie: the (7) rbl's are excluded in the SA_Filter -- SA would get more spam if it were not setup this way.

I figure if I "can" the bottom four RBL's, SA will pick-up what they get. Also, since the RBL don't exclude each other, they may be getting duplicates; spamhaus.org may be getting what the bottom four is getting.

I know many people use ordb.org; alone -- what a joke.

Elton

Aasun Eble

Director of Technology

Direct: 323-634-2040

Main: 323-933-2240

Fax: 323-933-2241