SBL ip4r sbl-xbl.spamhaus.org 127.0.0.2 28 0 XBL ip4r sbl-xbl.spamhaus.org 127.0.0.4 8 0
This should improve performance nominally by caching the lookup locally, so the second lookup will hit on the cached copy of the record queried in the first. You can use just one test though if you score them the same by doing the following:
SBL-XBL ip4r sbl-xbl.spamhaus.org * 8 0
I have more faith in SBL though, so I prefer to score that higher than XBL. XBL (CBL) is very, very good though. If you score on multiple hops, I think it was Andrew that suggested to append DYNA to the CBL test name, so that would look like the following:
SBL ip4r sbl-xbl.spamhaus.org 127.0.0.2 28 0 XBL-DYNA ip4r sbl-xbl.spamhaus.org 127.0.0.4 8 0
The DYNA will keep XBL from being run on anything but the last hop, and avoid tagging the occasional dial-up IP that gets shared by many users, where one of those IP's might have been used at one time as a zombie.
BTW, about 350 hits this morning on CMDSPACE, and every last one reached my delete weight so far. Fixing the XBL problem also made a noticeable impact on what's getting held. I can't recall ever seeing an FP on XBL (CBL).
Matt
Matthew Bramble wrote:
Yes.
XBL integrates CBL now, and maybe more.
Matt
Kami Razvan wrote:
Matt:
Is CBL this: CBL:*:cbl.abuseat.org
Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Wednesday, January 07, 2004 6:01 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] IP4 Tests
BONDEDSENDER doesn't catch much, maybe 0.5% at best on my system, probably
more like 0.2% though.
I'm not getting anything on XBL, and I just found that the test entry
returned 127.0.0.4 instead of the 2 in my config. That's not that I read on
their site originally, but it now says to use that.
XBL ip4r xbl.spamhaus.org 127.0.0.4 8 0
Note: don't use SBL-XBL or CBL if you use XBL and SBL separately, which is
advisable.
Matt
Markus Gufler wrote:
BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -5 0
XBL ip4r xbl.spamhaus.org 127.0.0.2 8 0
Am I missing something or why I can't find nearly zero positive results in our logfile for this two tests?
I've running this tests now for 7 days:
BONDEDSENDER catches at max. 2 messages per day (from over 2500 incomming
messages/day)
XBL has never had any positive result.
My entries in the global.cfg are exact as those above.
Markus
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
