It would probably be safe to negative score on the following:

REVDNS        -10        ENDSWITH    1.comcast.net
REVDNS        -10        ENDSWITH    2.comcast.net
REVDNS        -10        ENDSWITH    3.comcast.net
REVDNS        -10        ENDSWITH    4.comcast.net
REVDNS        -10        ENDSWITH    5.comcast.net
REVDNS        -10        ENDSWITH    6.comcast.net
REVDNS        -10        ENDSWITH    7.comcast.net
REVDNS        -10        ENDSWITH    8.comcast.net
REVDNS        -10        ENDSWITH    9.comcast.net
REVDNS        -10        ENDSWITH    0.comcast.net

If they keep the naming convention that you pointed out, that should work. I wouldn't take away too much weight though just in case.

Matt


Colbeck, Andrew wrote:


I'm seeing some false positives for mail from .comcast.net hosts that are
falling into various ip4r lists.  It's very sporadic.  It seems like quite a
few are being "tested" as mail relay hosts, but aren't.

Other providers provide a sensible naming convention to make it
straightforward to identify what server is really a comcast.net server as
opposed to just some server on their network, but these guys are fond of
host names like:

rwcrmhc12.comcast.net [216.148.227.85]
sccrmhc11.comcast.net [204.127.202.55]

... Or is it as simple as .comcast.net only appears in their valid hosts?  I
dunno.

Is there a clue in the business relationship between AT&T and Comcast?  I
dunno.

Andrew 8(

(I just wasted too much time checking for false positives... I found a very
few but the time involved made it an expensive proposition)
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





-- =================================================== Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --------------------------------------------------- Office Phone: (518) 862-9042 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] ===================================================


--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to