Scott,
Thanks for the answers. I just wanted to add my comments to two very important things.
Is there also an exclusion for ECAIR viruses and more importantly, is there an exclusion for things like macro viruses that will get sent from legitimate servers?
We will certainly be looking at ways to ensure that IPs do not get listed accidentally.
I think that for this to really go prime-time, you need exclusions so that only forging viruses or all viruses that come from DUL space, have no reverse DNS entry or have a reverse with an IP encoded in it get listed, and specifically not the types of things that get manually spread or might use a mail server to relay. Those exclusions I believe are the things that CBL uses in order to avoid listing legitimate mail servers and it works very well, though I'm sure that they also maintain an exclusion list separate from this. Excluding your own customer's IP's wouldn't be a bad idea either.
Regarding the data, as with all RBL's, it's quite helpful to know what the delisting procedure is for this...automatic expiration (how long) with or without a Web based delisting tool?
Maybe all of this has been considered, but I didn't get much from the E-mail or from the site in this regard.
The de-listing procedure is going to be handled manually initially.
You didn't address the part about automatic expiration. I've found terrible problems with almost all of the open-relay lists because it appears that none of them are expiring anything. DSBL admins boast about how they have 3.4 million IP's listed, but they have listings going back something like 5 years and they provide no way for residential IP's to be delisted without contacting an admin and they have expressed that they believe that multiple hop scanning is stupid...but only when you maintain bad data IMO. Anyway, I'm ranting...
Please delist after 2 weeks of inactivity (spam trap included). I think that makes perfect sense. I also think it would make sense to have a simple form like CBL that allows for at least an easy way to submit IP's for delisting, if not automated removal. If this is being used for tracking viruses primarily, it would seem better to help protect from false positives. I think that many of us are pretty comfortable with our block rates and can't afford to throw in new tests that might increase our FP rate unnecessarily and an expiration/removal method would definitely help.
Thanks,
Matt
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
