Nope, it does not run a lookup on every domain listed, only looks for a match. If RDNS reports *.yahoo.com, and .yahoo.com is listed in the RDNS filter file, then whatever negative point value you have defined will be deducted from the overall weight of the message.
Bill ----- Original Message ----- From: "Markus Gufler" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, June 09, 2003 9:55 AM Subject: RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights? > > A better way to do this is to setup a RDNS Filter and add a > > negative weight for any domain that you add that resolves > > correctly, like yahoo.com. For > > example: > > > > Global.cfg: > > REVDNS-FILTER filter M:\IMail\Declude\RevDNS-Filter.txt x 0 0 > > > > REVDNS-FILTER (samples): > > REVDNS -10 ENDSWITH .travelocity.com > > REVDNS -10 ENDSWITH .untd.com > > I understand. > But if I understand this right this will cause x REVDNS-lookups for > every single mail (X is the number of lines in the filter file) > > Should it by possible to run a new test like the following example? > > VALIDDOMAINS validdomains c:\imail\declude\vd.txt -5 +5 > > Vd.txt ---------------------- > @yahoo.com yahoo.com > @msn.com hotmail.com > ... > ----------------------------- > > Now if a mail comes in having a sender-adress containing @yahoo.com > Declude will see that this domain is listed in the filter file (vd.txt) > and REVDNS-check if it comes from a host having the right PTR record. > (yahoo.com) If so, this message will recieve -5 points. If the message > comes from an IP with an "invalid" PTR-record the message collects 5 > additional points. This all is done by a single DNS-query. > > I think at least some big emailers (yahoo, hotmail, ...) can be used in > such a test, if we see that very few spam mails comes from their mail > servers. > > Markus > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
