Hi!
One idea I had to fix this is that SA not use the SURBL whitelist for 1 in 10 queries and that those be directed to a different zone. However, that would be somewhat counterproductive in terms of DNS caching and I'm not sure how happy Jeff would be about the idea.
Please dont, this wont scale at all, people running their own copy's of the RBL's wont be happy with this.
Another way would be to not use the exclusion list for certain periods of time if you could select just those times for generating volume data. A bit too hacky.
Another way to fix the problem would be to rank the domains with some other source of volume data (not SURBL-related) such as looking at a DNS cache at a large ISP.
We allready do these things, we monitor traffic on some of the SURBL servers and have pretty ok stats available of what the 'top domains' are.
Bye, Raymond.
