Bill,

The value is in scoring the last hop hits higher than prior hop hits.  In this case, a hit on XBL for the last appropriate hop (not IPBYPASSED) would result in 8 points (6 + 2), while a hit on a prior hop would result in just 2 points.  Note that the number of false positives is much higher with prior hops on tests that populate from spamtraps or are designed to detect open relays.  Tests like SBL and other static spam source tests have very little danger in scoring the same for every hop, though SBL will sometimes list spam zombies that are unresolved for periods of time (I wish they didn't do that).

Matt



Bill Landry wrote:
----- Original Message ----- 
From: "Matt" <[EMAIL PROTECTED]>

  
XBL(LAST)        dnsbl    %IP4R%.sbl-xbl.spamhaus.org        127.0.0.4
6    0
XBL(ALL)            ip4r    sbl-xbl.spamhaus.org
127.0.0.4    2    0
    

Scott/Matt, would a configuration like above require multiple DNS queries
since the hostnames defined in the tests are no longer identical?  Or is the
variable (in this case "%IP4R%") ignored in the hostname, so that as far as
Declude is concerned, the hostnames are still identical?

Bill

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

-- 
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================

Reply via email to