Re: [Declude.JunkMail] SA help -
On 9 Nov 2004 at 22:54, Bill Landry wrote:
Nick, I cannot think of any RHSBLs that would be candidates for
urirhssub, other than the SURBLs that currently use bitmasked
responses.
I did not have any in mind but I was looking over the setups and this
scenerio came to mind..
Thanks for you excellent help - I am beginning to come around to see
how this latest SA can compete w/Declude; I just need more work on
my learning curve.
-Nick
However, if there were an RHSBL that supported multi-quad
responses (like DNSBLs do), I would try setting it up like: =
urirhssub URIBL_EX1 multiple.example.com. A 127.0.0.1 body URIBL_EX1
eval:check_uridnsbl('URIBL_EX1') describe URIBL_EX1 Contains a URL
listed in the EX1 blocklist tflags URIBL_EX1 net score URIBL_EX1 1.0
urirhssub URIBL_EX2 multiple.example.com. A 127.0.0.2
body URIBL_EX2 eval:check_uridnsbl('URIBL_EX2')
describe URIBL_EX2 Contains a URL listed in the EX2 blocklist
tflags URIBL_EX2 net
score URIBL_EX2 1.0
urirhssub URIBL_EX3 multiple.example.com. A 127.0.0.3
body URIBL_EX3 eval:check_uridnsbl('URIBL_EX3')
describe URIBL_EX3 Contains a URL listed in the EX3 blocklist
tflags URIBL_EX3 net
score URIBL_EX3 1.0
=
This checks out fine with spamassassin --lint, so I would think that
it should work fine.
Bill
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] SA help -
On 9 Nov 2004 at 11:12, Bill Landry wrote:
Bill,
How do you handle if a particular rhsbl returns multiple return codes
like 127.0.0 2; 127.0.0 4, etc and you want to pick which one to use -
is it:
urirhsbl URIBL_EX multiple.example.com. A 127.0.0.4
or
urirhssub URIBL_EX multiple.example.com. A 127.0.0.4
or
urirhssub URIBL_EX multiple.example.com. A 8
I read the docs and am confused!
Again - thanks
-Nick
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:Re: [Declude.JunkMail] anyone know how to stop this?
topic change
Date sent: Tue, 9 Nov 2004 11:12:15 -0800
Send reply to: [EMAIL PROTECTED]
- Original Message -
From: Nick [EMAIL PROTECTED]
A little SpamAssassin help please -
It does, but it can also be used with Declude as an RHSBL now:
MAILPOLICE-FRAUDfraud.rhs.mailpolice.com 127.0.0.230
to see if I have this correct for SA 3x
In my local.cf
urirhsbl URIBL_MP fraud.rhs.mailpolice.com. A
# A reecord lookup
header URIBL_MP eval:check_uridnsbl('URIBL_MP')
describe URIBL_MP Contains a URL listed in the MP SURBL blocklist
tflags URIBL_MP net score URIBL_MP 2.0
#value returned to SA
I can use and RHSBL I like - correct?
Not quite. Here's a sample of how to setup URIRHSBL support in SA:
urirhsbl URIBL_MP_RHSBL block.rhs.mailpolice.com. A
body URIBL_MP_RHSBL eval:check_uridnsbl('URIBL_MP_RHSBL')
describe URIBL_MP_RHSBL Contains a URL listed in the MP RHSBL
blocklist tflagsURIBL_MP_RHSBL net score URIBL_MP_RHSBL 2.0
This is for the MailPolice block list, which also incorporate the
fraud list. If you want to use fraud only, change the hostname
above from block to fraud.
Bill
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] SA help -
- Original Message -
From: Nick [EMAIL PROTECTED]
How do you handle if a particular rhsbl returns multiple return codes
like 127.0.0 2; 127.0.0 4, etc and you want to pick which one to use -
is it:
urirhsbl URIBL_EX multiple.example.com. A 127.0.0.4
or
urirhssub URIBL_EX multiple.example.com. A 127.0.0.4
or
urirhssub URIBL_EX multiple.example.com. A 8
I read the docs and am confused!
Nick, I cannot think of any RHSBLs that would be candidates for urirhssub,
other than the SURBLs that currently use bitmasked responses. However, if
there were an RHSBL that supported multi-quad responses (like DNSBLs do), I
would try setting it up like:
=
urirhssub URIBL_EX1 multiple.example.com. A 127.0.0.1
body URIBL_EX1 eval:check_uridnsbl('URIBL_EX1')
describe URIBL_EX1 Contains a URL listed in the EX1 blocklist
tflags URIBL_EX1 net
score URIBL_EX1 1.0
urirhssub URIBL_EX2 multiple.example.com. A 127.0.0.2
body URIBL_EX2 eval:check_uridnsbl('URIBL_EX2')
describe URIBL_EX2 Contains a URL listed in the EX2 blocklist
tflags URIBL_EX2 net
score URIBL_EX2 1.0
urirhssub URIBL_EX3 multiple.example.com. A 127.0.0.3
body URIBL_EX3 eval:check_uridnsbl('URIBL_EX3')
describe URIBL_EX3 Contains a URL listed in the EX3 blocklist
tflags URIBL_EX3 net
score URIBL_EX3 1.0
=
This checks out fine with spamassassin --lint, so I would think that it
should work fine.
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
