I believe that the asterisk means that any IP returned is a match. I have several of these configured in my Global.cfg file and they're at least working :)
DSBL         ip4r   list.dsbl.org         *      7   0
ORDB         ip4r   relays.ordb.org         *      7   0
BLITZEDALL      ip4r   opm.blitzed.org         *      7   0
In the case of BLITZEDALL, you can break out the tests and score them differently if you wish, however since they are all open relay type things, I opted to score it all the same.
I've noticed that some other lists such as SBBL which is listed as unknown is not responding to queries from sbbl.they.com. I did snoop around and find that their primary nameserver for they.com was in fact functioning with the blacklist, but only when appending lookups to sbbl.they.com, but I would need to place a record in my DNS server for it to work (placing a lookup in my DNS server for sbbl.they.com with their primary nameserver's IP).  I decided that was possibly not a wise idea and that they have limited access for a reason.
Maybe other "unlisted" entries reflect similar circumstances (not available under normal circumstances)?
Matt
Keith Johnson wrote:
It seems recently a lot of good ip4r tests have ended due to spammer Denial of Service attacks. With that in mind, it has caused me to shuffle around and find some good tests. I noticed in the Global.cfg file of a few default tests commented out that have return codes listed as * , however in Declude's "DNS-based spam database" table (thanks Scott for posting) they may show up as 127.0.0.2 (i.e. DSBL), and I became a little confused. Also, some are listed as Various, in which case would lend me to think that we should use * , however, on the Declude Website the ip4r test of ORDB shows a return of *. I just wanted to get a sanity check on the proper use of return codes, especially if they list as Various. Also, if the show in the Global.cfg as *, yet on the Declude Website have a return code, should I replace the * with a code. Thanks for the time.
Keith Johnson N?f????Ƨ??_???? ???y?nu?b??!??Á¿? 0u?%?ל?d??&j)\jg???????r[?x???Æ¢?f??)?+-N?????r??z;??ǧu?Ä™?????j)l??^r[?y?&jwmÊ—??Ë›???m??r[?x???Æ¢?8^j?!??q??y?.?Ö??i??0?f???܆+?com=
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
