Re: [Declude.JunkMail] Spamhaus
Good to know. Thanks, Bill. Darin. - Original Message - From: Bill Landry [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 16, 2006 2:03 AM Subject: Re: [Declude.JunkMail] Spamhaus FYI, from Steve Linford of spamhaus: http://groups-beta.google.com/group/news.admin.net-abuse.email/msg/2d050ab220faf931 http://www.spamhaus.org/zen/ Bill David Sullivan wrote the following on 11/15/2006 12:58 PM -0800: Does anyone have the proper setup in Declude to query sbl-xbl.spamhaus.org and interpret the result? I don't think I'm doing it correctly. Thanks -David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
Bill, Thanks for posting that - one interesting thing I found was this. Use of the Spamhaus DNSBLs by commercial users, including corporate networks, ISPs and ESPs, requires a subscription to Spamhaus's Data Feed service. Looked at the cost for some of the scenario's and it does not seem cheap. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Bill Landry [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 16, 2006 2:03 AM Subject: Re: [Declude.JunkMail] Spamhaus FYI, from Steve Linford of spamhaus: http://groups-beta.google.com/group/news.admin.net-abuse.email/msg/2d050ab220faf931 http://www.spamhaus.org/zen/ Bill David Sullivan wrote the following on 11/15/2006 12:58 PM -0800: Does anyone have the proper setup in Declude to query sbl-xbl.spamhaus.org and interpret the result? I don't think I'm doing it correctly. Thanks -David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spamhaus
Does anyone have the proper setup in Declude to query sbl-xbl.spamhaus.org and interpret the result? I don't think I'm doing it correctly. Thanks -David -- Best regards, David mailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
Global.cfg - SBL ip4rsbl.spamhaus.org * 55 0 XBL ip4rxbl.spamhaus.org * 55 0 or , for combined results, SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 $default$.junkmail --- SBL WARN XBLWARN or , for combined results, SBL-XBLWARN Note that you'll want to change 55 to the weight you want to assign on failure. Darin. - Original Message - From: David Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, November 15, 2006 3:58 PM Subject: [Declude.JunkMail] Spamhaus Does anyone have the proper setup in Declude to query sbl-xbl.spamhaus.org and interpret the result? I don't think I'm doing it correctly. Thanks -David -- Best regards, David mailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Spamhaus
Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Spamhaus
Right. * means score on any result. SBL-XBL combines the two, which is more optimal if you want the results of both tests and score them the same. So if you run SBL-XBL, make sure you remove the individual SBL and XBL tests from your config. Darin. - Original Message - From: David Sullivan [EMAIL PROTECTED] To: Darin Cox declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 5:04 PM Subject: Re[2]: [Declude.JunkMail] Spamhaus Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUSdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamhaus
Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
I don't use sbl-xbl or xbl, so I can't confirm this... but there website refers to a 127.0.0.5 for a NJABL and the 127.0.0.4 for CBL No mention of blitzedall anymore. http://www.spamhaus.org/faq/answers.lasso?section=Spamhaus%20XBL What do the different return codes in the XBL mean? The return code (127.0.0.*) denotes the data source in the XBL (and also in the SBL-XBL combined zone) these are: Return Codes Data Source 127.0.0.4 CBL 127.0.0.5 NJABL - Original Message - From: Matt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 4:34 PM Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUSdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.65 0 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
Then what was wrong with my example? Darin. - Original Message - From: Matt To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:19 PM Subject: Re: [Declude.JunkMail] Spamhaus Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
You are correct. I clearly missed the change where they removed BLITZEDALL from distribution with the 127.0.0.6 result. That result is still listed on the main XBL page, but I didn't get a single hit for it today, so it clearly isn't working. NJABL has also been included now with 127.0.0.5 as you pointed out, so some may want to change in order to save a lookup on NJABL: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 NJABL ip4rsbl-xbl.spamhaus.org127.0.0.550 Matt Scott Fisher wrote: I don't use sbl-xbl or xbl, so I can't confirm this... but there website refers to a 127.0.0.5 for a NJABL and the 127.0.0.4 for CBL No mention of blitzedall anymore. http://www.spamhaus.org/faq/answers.lasso?section=Spamhaus%20XBL What do the different return codes in the XBL mean? The return code (127.0.0.*) denotes the data source in the XBL (and also in the SBL-XBL combined zone) these are: Return Codes Data Source 127.0.0.4 CBL 127.0.0.5 NJABL - Original Message - From: Matt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 4:34 PM Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUSdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.4 60 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.6 5 0 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
nothing - Matt with his trickery is adding more weight to a last hop that fails the test... -Nick Darin Cox wrote: Then what was wrong with my example? Darin. - Original Message - *From:* Matt mailto:[EMAIL PROTECTED] *To:* declude.junkmail@declude.com mailto:declude.junkmail@declude.com *Sent:* Wednesday, November 15, 2006 7:19 PM *Subject:* Re: [Declude.JunkMail] Spamhaus Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
Darin, You were using different addresses for the lookups. It works the same except that two requests are sent instead of one. If you combine the SBL, CBL(XBL) and NJABL lookups to use the same sbl-xbl.spamhaus.org domain, it will only need to do one lookup even if there are multiple results. Declude will handle the multiple results and skip redundant lookups. Matt Darin Cox wrote: Then what was wrong with my example? Darin. - Original Message - *From:* Matt mailto:[EMAIL PROTECTED] *To:* declude.junkmail@declude.com mailto:declude.junkmail@declude.com *Sent:* Wednesday, November 15, 2006 7:19 PM *Subject:* Re: [Declude.JunkMail] Spamhaus Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
I didn't think there was any difference between the two examples, except for the different scoring based on DNS result code. Just curious as to why mine was deemed improper... Darin. - Original Message - From: Nick Hayer To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:44 PM Subject: Re: [Declude.JunkMail] Spamhaus nothing - Matt with his trickery is adding more weight to a last hop that fails the test... -Nick Darin Cox wrote: Then what was wrong with my example? Darin. - Original Message - From: Matt To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:19 PM Subject: Re: [Declude.JunkMail] Spamhaus Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
Ok, I was really pointing to using combined results instead of separate. For the separate results, I was going by the hostnames SpamHaus listed: http://www.spamhaus.org/sbl/howtouse.html Their examples were sbl. and xbl. for individual, but I see what you were saying in terms of Declude lookup optimization. FWIW, I use the combined syntax with specific codes, just looked on their site for the info instead of looking in my config when responding... Darin. - Original Message - From: Matt To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:46 PM Subject: Re: [Declude.JunkMail] Spamhaus Darin, You were using different addresses for the lookups. It works the same except that two requests are sent instead of one. If you combine the SBL, CBL(XBL) and NJABL lookups to use the same sbl-xbl.spamhaus.org domain, it will only need to do one lookup even if there are multiple results. Declude will handle the multiple results and skip redundant lookups. Matt Darin Cox wrote: Then what was wrong with my example? Darin. - Original Message - From: Matt To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:19 PM Subject: Re: [Declude.JunkMail] Spamhaus Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
FYI... from http://www.spamhaus.org/xbl/index.lasso Mail servers already using dnsbl.njabl.org are advised to continue doing so, as dnsbl.njabl.org is itself a composite list and contains more than the open proxy IPs list part now incorporated in XBL. So there is partial, but not complete, overlap between XBL and NJABL. Darin. - Original Message - From: Matt To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:27 PM Subject: Re: [Declude.JunkMail] Spamhaus You are correct. I clearly missed the change where they removed BLITZEDALL from distribution with the 127.0.0.6 result. That result is still listed on the main XBL page, but I didn't get a single hit for it today, so it clearly isn't working. NJABL has also been included now with 127.0.0.5 as you pointed out, so some may want to change in order to save a lookup on NJABL: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 NJABL ip4rsbl-xbl.spamhaus.org127.0.0.550Matt Scott Fisher wrote: I don't use sbl-xbl or xbl, so I can't confirm this... but there website refers to a 127.0.0.5 for a NJABL and the 127.0.0.4 for CBL No mention of blitzedall anymore. http://www.spamhaus.org/faq/answers.lasso?section=Spamhaus%20XBL What do the different return codes in the XBL mean? The return code (127.0.0.*) denotes the data source in the XBL (and also in the SBL-XBL combined zone) these are: Return Codes Data Source 127.0.0.4 CBL 127.0.0.5 NJABL - Original Message - From: Matt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 4:34 PM Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUSdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.2 12 0 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.65 0 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamhaus
I just read that, too. I've commented out my NJABLPROXIES ip4r test in my global.cfg and noted that this is duplicated in my XBL test. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 15, 2006 5:06 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus FYI... from http://www.spamhaus.org/xbl/index.lasso Mail servers already using dnsbl.njabl.org are advised to continue doing so, as dnsbl.njabl.org is itself a composite list and contains more than the open proxy IPs list part now incorporated in XBL. So there is partial, but not complete, overlap between XBL and NJABL. Darin. - Original Message - From: Matt mailto:[EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:27 PM Subject: Re: [Declude.JunkMail] Spamhaus You are correct. I clearly missed the change where they removed BLITZEDALL from distribution with the 127.0.0.6 result. That result is still listed on the main XBL page, but I didn't get a single hit for it today, so it clearly isn't working. NJABL has also been included now with 127.0.0.5 as you pointed out, so some may want to change in order to save a lookup on NJABL: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.4 60 NJABL ip4rsbl-xbl.spamhaus.org127.0.0.5 50 Matt Scott Fisher wrote: I don't use sbl-xbl or xbl, so I can't confirm this... but there website refers to a 127.0.0.5 for a NJABL and the 127.0.0.4 for CBL No mention of blitzedall anymore. http://www.spamhaus.org/faq/answers.lasso?section=Spamhaus%20XBL What do the different return codes in the XBL mean? The return code (127.0.0.*) denotes the data source in the XBL (and also in the SBL-XBL combined zone) these are: Return Codes Data Source 127.0.0.4 CBL 127.0.0.5 NJABL - Original Message - From: Matt [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: declude.junkmail@declude.com mailto:declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 4:34 PM Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUSdnsbl %IP4R%.sbl-xbl.spamhaus.org127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl %IP4R%.sbl-xbl.spamhaus.org127.0.0.65 0 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4r sbl.spamhaus.org * 55 0 DC XBL ip4r xbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4r sbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
Re: [Declude.JunkMail] Spamhaus
Read my post and not Nick's :) Matt Darin Cox wrote: I didn't think there was any difference between the two examples, except for the different scoring based on DNS result code. Just curious as to why mine was deemed improper... Darin. - Original Message - *From:* Nick Hayer mailto:[EMAIL PROTECTED] *To:* declude.junkmail@declude.com mailto:declude.junkmail@declude.com *Sent:* Wednesday, November 15, 2006 7:44 PM *Subject:* Re: [Declude.JunkMail] Spamhaus nothing - Matt with his trickery is adding more weight to a last hop that fails the test... -Nick Darin Cox wrote: Then what was wrong with my example? Darin. - Original Message - *From:* Matt mailto:[EMAIL PROTECTED] *To:* declude.junkmail@declude.com mailto:declude.junkmail@declude.com *Sent:* Wednesday, November 15, 2006 7:19 PM *Subject:* Re: [Declude.JunkMail] Spamhaus Andy, What you posted will work exactly the same way and there is no advantage either way except that your example is more normalized. I use the variables for a purpose that isn't necessary for most. Matt Andy Schmidt wrote: Hi Matt: Are you saying there is an advantage of the dnsbl syntax over using the standard ip4r syntax: SPAMHAUS ip4rsbl-xbl.spamhaus.org127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL ip4rsbl-xbl.spamhaus.org127.0.0.650 As long as the test type and test subject is the same (e.g., ip4r sbl-xbl.spamhaus.org), it should do a single lookup an only evaluate the result several times!? I've only used the DNSBL syntax when looking up Reverse DNS names, e.g.: RDNSBL dnsbl%REVDNS%.rdns.mydomain.com * 20 0 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, November 15, 2006 05:35 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUS dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.2 120 XBLdnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.460 BLITZEDALL dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.650 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4rsbl.spamhaus.org * 55 0 DC XBL ip4rxbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4rsbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamhaus
And if you're wondering where the BLITZED ip4r test went: http://wiki.blitzed.org/OPM_status Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 15, 2006 5:13 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spamhaus I just read that, too. I've commented out my NJABLPROXIES ip4r test in my global.cfg and noted that this is duplicated in my XBL test. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 15, 2006 5:06 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spamhaus FYI... from http://www.spamhaus.org/xbl/index.lasso Mail servers already using dnsbl.njabl.org are advised to continue doing so, as dnsbl.njabl.org is itself a composite list and contains more than the open proxy IPs list part now incorporated in XBL. So there is partial, but not complete, overlap between XBL and NJABL. Darin. - Original Message - From: Matt mailto:[EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 7:27 PM Subject: Re: [Declude.JunkMail] Spamhaus You are correct. I clearly missed the change where they removed BLITZEDALL from distribution with the 127.0.0.6 result. That result is still listed on the main XBL page, but I didn't get a single hit for it today, so it clearly isn't working. NJABL has also been included now with 127.0.0.5 as you pointed out, so some may want to change in order to save a lookup on NJABL: SPAMHAUS ip4rsbl-xbl.spamhaus.org 127.0.0.2 120 XBLip4rsbl-xbl.spamhaus.org 127.0.0.460 NJABL ip4rsbl-xbl.spamhaus.org 127.0.0.550 Matt Scott Fisher wrote: I don't use sbl-xbl or xbl, so I can't confirm this... but there website refers to a 127.0.0.5 for a NJABL and the 127.0.0.4 for CBL No mention of blitzedall anymore. http://www.spamhaus.org/faq/answers.lasso?section=Spamhaus%20XBL What do the different return codes in the XBL mean? The return code (127.0.0.*) denotes the data source in the XBL (and also in the SBL-XBL combined zone) these are: Return Codes Data Source 127.0.0.4 CBL 127.0.0.5 NJABL - Original Message - From: Matt [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: declude.junkmail@declude.com mailto:declude.junkmail@declude.com Sent: Wednesday, November 15, 2006 4:34 PM Subject: Re: [Declude.JunkMail] Spamhaus This is how to do it properly. Declude will do the lookup once when configured like this. SPAMHAUSdnsbl %IP4R%.sbl-xbl.spamhaus.org127.0.0.2 120 XBLdnsbl %IP4R%.sbl-xbl.spamhaus.org127.0.0.460 BLITZEDALL dnsbl %IP4R%.sbl-xbl.spamhaus.org127.0.0.65 0 Matt David Sullivan wrote: Hello Darin, Wednesday, November 15, 2006, 4:12:49 PM, you wrote: DC SBL ip4r sbl.spamhaus.org * 55 0 DC XBL ip4r xbl.spamhaus.org * 55 0 I was using 127.0.0.2 for SBL and 127.0.0.4 for XBL but Spamhaus lists .2-4 for SBL and .2-6 for XBL but I guess * would work for each and capture all return codes. Right? DC SBL-XBL ip4r sbl-xbl.spamhaus.org * 55 0 This doesn't discriminate between the two then, right? Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Re: [Declude.JunkMail] Spamhaus
FYI, from Steve Linford of spamhaus: http://groups-beta.google.com/group/news.admin.net-abuse.email/msg/2d050ab220faf931 http://www.spamhaus.org/zen/ Bill David Sullivan wrote the following on 11/15/2006 12:58 PM -0800: Does anyone have the proper setup in Declude to query sbl-xbl.spamhaus.org and interpret the result? I don't think I'm doing it correctly. Thanks -David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamHaus
Has anyone been following the SpamHaus debacle? http://www.ibtimes.com/articles/20061009/anti-spam-lawsuit.htm - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamHaus
Yes. They are making a good point. The courts shouldn't allow spammers to file SLAPP suits as a way to threaten blacklists out of the business. Even though Spamhaus could have fought this and won quite easily, the fact that one has to spend resources fighting SLAPP suits is a threat in itself. This is more so a fight about the way that the US court system approaches spammer litigation than it is fighting the spammers itself. It's about time that the courts started throwing this stuff out and even fining the litigants. Matt Jay Sudowski - Handy Networks LLC wrote: Has anyone been following the SpamHaus debacle? http://www.ibtimes.com/articles/20061009/anti-spam-lawsuit.htm - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamhaus
is this the same as the following SBLip4rsbl.spamhaus.org Bennie - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Tuesday, November 30, 2004 5:18 PM Subject: Re: [Declude.JunkMail] Spamhaus It is the same as CBL, so be careful not to include both. XBL/CBL is very accurate, primarily targets spam zombies, and should hit on about 40% of your spam.MattDoug Anderson wrote: Anyone use the xbl db from spamhaus? Good, bad, otherwise?-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Spamhaus
Based on the following description of XBL from the spam database listing at http://www.declude.com/Articles.asp?ID=97 SBL Exploits Block List. This contains the same data as the CBL test. Can be combined with SBL by using sbl-xbl.spamhaus.org. Lists IP addresses of exploited servers. Note that this is not the same as the XBL spam test, run by another organization (which is why this needs to be referred to as SBL-XBL rather than just XBL). I am using the following in my global file; SBL ip4r sbl-xbl.spamhaus.org * 7 0 Is this the correct way to combine the tests? Thanks, John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bennie Sent: Wednesday, December 01, 2004 5:12 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamhaus is this the same as the following SBLip4rsbl.spamhaus.org Bennie - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Tuesday, November 30, 2004 5:18 PM Subject: Re: [Declude.JunkMail] Spamhaus It is the same as CBL, so be careful not to include both. XBL/CBL is very accurate, primarily targets spam zombies, and should hit on about 40% of your spam. Matt Doug Anderson wrote: Anyone use the xbl db from spamhaus? Good, bad, otherwise?
Re: [Declude.JunkMail] Spamhaus
No, that zone is only for SBL entries. There is a combined zone at sbl-xbl.spamhaus.org that will return a 127.0.0.2 for a SBL hit, a 127.0.0.4 for a XBL/CBL hit, and a 127.0.0.6 for a BLITZED-ALL hit (you should remove BLITZED-ALL's native zone if you use this, just like CBL). Using the sbl-xbl.spamhaus.org zone instead of three different zones for these purposes will save a couple of DNS lookups for each E-mail since Declude is smart enough to only query the zone once, and it can get as many result codes back from that single query as are needed. Unfortunately the config information on Spamhaus' site isn't perfectly clear, but what I have described above is accurate. http://www.spamhaus.org/xbl/index.lasso Matt Bennie wrote: is this the same as the following SBLip4rsbl.spamhaus.org Bennie - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Tuesday, November 30, 2004 5:18 PM Subject: Re: [Declude.JunkMail] Spamhaus It is the same as CBL, so be careful not to include both. XBL/CBL is very accurate, primarily targets spam zombies, and should hit on about 40% of your spam. Matt Doug Anderson wrote: Anyone use the xbl db from spamhaus? Good, bad, otherwise? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Spamhaus
Please explain. BLITZED-ALL and CBL dont check Spamhaus, do they? Scotts spam database page makes it look like BLITZED-ALL goes to opm.blitzed.org and CBL goes to cbl.abuseat.org. Is there a relationship of these to Spamhaus? And if I do drop those two for SBL-XBL, should I increase the SBL-XBL hit score? Thanks, John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, December 01, 2004 12:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamhaus No, that zone is only for SBL entries. There is a combined zone at sbl-xbl.spamhaus.org that will return a 127.0.0.2 for a SBL hit, a 127.0.0.4 for a XBL/CBL hit, and a 127.0.0.6 for a BLITZED-ALL hit (you should remove BLITZED-ALL's native zone if you use this, just like CBL). Using the sbl-xbl.spamhaus.org zone instead of three different zones for these purposes will save a couple of DNS lookups for each E-mail since Declude is smart enough to only query the zone once, and it can get as many result codes back from that single query as are needed. Unfortunately the config information on Spamhaus' site isn't perfectly clear, but what I have described above is accurate. http://www.spamhaus.org/xbl/index.lasso Matt
RE: [Declude.JunkMail] Spamhaus
Reply to myself. READ THE MESSAGE BETTER AND FOLLOW THE LINKS. When I did get out to the spamhaus page, most of my question as cleared up. Sorry. However Matt, should I adjust the sbl-xbl score up to compensate for removing the other separate tests? Thanks. John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Wednesday, December 01, 2004 12:32 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamhaus Please explain. BLITZED-ALL and CBL dont check Spamhaus, do they? Scotts spam database page makes it look like BLITZED-ALL goes to opm.blitzed.org and CBL goes to cbl.abuseat.org. Is there a relationship of these to Spamhaus? And if I do drop those two for SBL-XBL, should I increase the SBL-XBL hit score? Thanks, John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, December 01, 2004 12:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamhaus No, that zone is only for SBL entries. There is a combined zone at sbl-xbl.spamhaus.org that will return a 127.0.0.2 for a SBL hit, a 127.0.0.4 for a XBL/CBL hit, and a 127.0.0.6 for a BLITZED-ALL hit (you should remove BLITZED-ALL's native zone if you use this, just like CBL). Using the sbl-xbl.spamhaus.org zone instead of three different zones for these purposes will save a couple of DNS lookups for each E-mail since Declude is smart enough to only query the zone once, and it can get as many result codes back from that single query as are needed. Unfortunately the config information on Spamhaus' site isn't perfectly clear, but what I have described above is accurate. http://www.spamhaus.org/xbl/index.lasso Matt
Re: [Declude.JunkMail] Spamhaus
John, I score SBL, XBL and BLITZED-ALL separately, as if they were all from different zones as before. The change saves two DNS lookups (or more with HOPHIGH modified from the default in Declude Pro). Just make sure to configure each test for the exact response indicated, i.e. 127.0.0.2, 127.0.0.4 and 127.0.0.6 for the above mentioned respectively. I score SBL much higher than XBL and BLITZED-ALL, which I score the same, although all 3 are highly accurate and scored higher than almost everything else on my system. SBL targets primarily static spammers, and both XBL and BLITZED-ALL target zombies or exploited servers. The fact that SBL is maintained manually makes it only prone to human error and sometimes a lack of purity of reason (like listing some DUL space and random blocks, primarily in places like China, and have acknowledged to me that they do sometimes practice collateral damage in the "interest of the Internet as a whole", but I send them reminders every few weeks with FP's attached to discourage the practice which so far is very limited in that zone). Matt John Carter wrote: Reply to myself. READ THE MESSAGE BETTER AND FOLLOW THE LINKS. When I did get out to the spamhaus page, most of my question as cleared up. Sorry. However Matt, should I adjust the sbl-xbl score up to compensate for removing the other separate tests? Thanks. John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Carter Sent: Wednesday, December 01, 2004 12:32 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamhaus Please explain. BLITZED-ALL and CBL dont check Spamhaus, do they? Scotts spam database page makes it look like BLITZED-ALL goes to opm.blitzed.org and CBL goes to cbl.abuseat.org. Is there a relationship of these to Spamhaus? And if I do drop those two for SBL-XBL, should I increase the SBL-XBL hit score? Thanks, John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Wednesday, December 01, 2004 12:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamhaus No, that zone is only for SBL entries. There is a combined zone at sbl-xbl.spamhaus.org that will return a 127.0.0.2 for a SBL hit, a 127.0.0.4 for a XBL/CBL hit, and a 127.0.0.6 for a BLITZED-ALL hit (you should remove BLITZED-ALL's native zone if you use this, just like CBL). Using the sbl-xbl.spamhaus.org zone instead of three different zones for these purposes will save a couple of DNS lookups for each E-mail since Declude is smart enough to only query the zone once, and it can get as many result codes back from that single query as are needed. Unfortunately the config information on Spamhaus' site isn't perfectly clear, but what I have described above is accurate. http://www.spamhaus.org/xbl/index.lasso Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] Spamhaus
Anyone use the xbl db from spamhaus? Good, bad, otherwise?
Re: [Declude.JunkMail] Spamhaus
Yes, it nails alot of spam Rick DavidsonNational Systems ManagerNorth American Title Group- - Original Message - From: Doug Anderson To: [EMAIL PROTECTED] Sent: Tuesday, November 30, 2004 3:11 PM Subject: [Declude.JunkMail] Spamhaus Anyone use the xbl db from spamhaus? Good, bad, otherwise?
Re: [Declude.JunkMail] Spamhaus
It is the same as CBL, so be careful not to include both. XBL/CBL is very accurate, primarily targets spam zombies, and should hit on about 40% of your spam. Matt Doug Anderson wrote: Anyone use the xbl db from spamhaus? Good, bad, otherwise? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
