Marrco wrote: >> stops scoring. If you have 10 RBL providers, and the minimum score to 2, >> a message won't be scored higher for 3 hits than 7 hits. >> >> Perhaps you could assign a score like 15 to each hit (instead of 30 for >> rbl fail, and 15 for rbl neutral), so one or two hits might not be >> fatal, but more would. Maybe a further extension would be to assign >> scores by individual RBL providers, so you might give more weight to a >> very reputable and solid RBL with little to no false positives, and a >> lower score to more agressive RBL with higher false positives. The file >> could be formatted as a CSV, for ease of use and extension. >> > > Assp provides e lot of flexibility in DNSbl managing. You can use them just > to add score, to block at the first hit, to allow multiple hits etc. The 2 > default options are really good. > > Please provide real examples (including IPs and DNSbl lists) that show why > the actual approach is not good enough and yours is better. > > My scenario is like this:
I'd like to assign a hit from each RBL a score. So instead of a simple 2-3 hit threshold, it would add scores up to kill a message. There are plenty of DNSRBLs, but not all of them are equal in scope/reliability/trustworthiness and so on. I have a handful of DNSRBLs that I use for filtering out zombie/spam/open relay IPs. There are other lists, though, that I'd like to use to score with: http://www.de.sorbs.net/ - SORBS provides a BL that lists dynamic/residential IP addresses. There are a few good reasons why someone might be sending mail from a dynamic/residential IP. One such reason is a small business server operating on cheap residential DSL. Most of the time, residential IPs are going to be zombie machines sending out spam, but I don't want to kill every message from a dynamic IP, just maybe score it a bit. So I might want to give it a lower score, like 10 or 12, instead of 15 for an individual hit http://www.spamcop.net/bl.shtml - SpamCop is another widely used RBL. It's only problem is that it is a little overzealous and will sometimes get you false positives. So I'd like to have it in my arsenal of RBLs, but I don't want a hit from SpamCop to be fatal. So again, I would lower its score to 10 or 12. There are other country-based DNSBL which will provide blocking based on what country the IP belongs to. Now I know that not _all_ email from Asia is spam, but a lot of it is. So I'd like to give it a few points in the score to puch it higher, but not kill it just because it's from Asia. I'd assign it a score of say 5 or 7. There are dozens of other lists that would be good to use to score with, but not to use to kill messages with. I hope that explains what I was thinking of. David ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
