On Tuesday, April 6, 2004, 5:01:45 PM, Daniel Quinlan wrote: > Jeff Chan <[EMAIL PROTECTED]> writes:
>> Thanks much for the test data Daniel! Can I ask for a clarification >> of whether urirhsbl in URIBL is doing name resolution before comparing >> to SURBL, or whether it's comparing "names to names"? I tried to look >> for urirhsbl in the sources at: >> >> >> http://spamassassin.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm > Hmmm... that's not the current tree. That must be the nightly snapshot. > This is current: > http://cvs.apache.org/viewcvs.cgi/incubator/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm?rev=9881&root=Apache-SVN&view=markup > which says: > urirhsbl NAME_OF_RULE rhsbl_zone lookuptype > Specify a RHSBL-style domain lookup. "NAME_OF_RULE" > is the name of the rule to be used, "rhsbl_zone" is > the zone to look up domain names in, and "lookuptype" > is the type of lookup (TXT or A). Note that you must > also define a header-eval rule calling > "check_uridnsbl" to use this. > An RHSBL zone is one where the domain name is looked > up, as a string; e.g. a URI using the domain "foo.com" > will cause a lookup of "foo.com.uriblzone.net". Note > that hostnames are stripped from the domain used in > the URIBL lookup, so the domain "foo.bar.com" will > look up "bar.com.uriblzone.net", and "foo.bar.co.uk" > will look up "bar.co.uk.uriblzone.net". > The code just looks up the domain. Here are some non-dot-com-net-org > domains looked up as an example: > domain "dkldhfg33.us" listed > domain "hfgti6.info" listed > domain "hfgr33.us" listed > domain "net-click.net.ph" listed > domain "dkldhfg33.us" listed > domain "net-click.net.ph" listed > domain "dkldhfg33.us" listed > domain "dkldhfg33.us" listed > domain "hfgti6.info" listed > domain "dfhfks333.info" listed Perfect! Thanks for adding urirhsbl Justin. And thanks for testing it with SURBL Daniel. > Jeff Chan <[EMAIL PROTECTED]> writes: >> Given the 60% hit rate, I assume it's doing name to name. > Yep. We'll see how FPs look on other corpora this weekend, but it looks > good right now. Thanks! > If you want to do experiments with threshold tweaking or any other > changes at some point and you're able to set up a test DNSBL > (test.surbl.org), we could try comparing the two. Since it's working > well so far, I'd suggest leaving the current algorithm as-is until a > replacement algorithm is shown to be better through testing (and I think > improvements on either end should be quite possible considering we just > got the query working). Yes, the next version of the SURBL engine is in the works. It will use some of the concepts we have been discussing such as a longer default expiration of probably 10 days, and variable thresholding and expiration based on SBL and country inclusion probably. That alone will be a big improvement, though we may tweak more after that. We are setting the new engine up separately, and a separate test RBL is an excellent idea for side by side comparison before any changing over of the production list. Until then the current engine will continue to run untouched. It seems reasonably stable, fast, useful, etc., even though I see some of the same issues you do with domains expiring then coming back on etc. I'm focused on the new version instead of tweaking the old one, which is adequate for now. Thanks all for the continuing support! Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
