Re: Barracuda RBL in first place

2009-08-18 Thread LuKreme
On 17-Aug-2009, at 04:24, Ned Slider wrote: Question - in Postfix do user unknown rejections still incur a dns RBL lookup, or does the rejection occur before reject_rbl_client? HELO/EHLO rejections do not reach RBL, and neither do unknown, as long as you specify the right order in the

Re: Barracuda RBL in first place

2009-08-18 Thread LuKreme
On 17-Aug-2009, at 06:38, d.h...@yournetplus.com wrote: Nope. Only one query to the local spamhaus zone is performed: http://www.postfix.org/STRESS_README.html#hangup Oooo, NICE. I'm implementing that right now. -- Lister: What d'ya think of Betty? Cat: Betty Rubble? Well, I would

Re: Barracuda RBL in first place

2009-08-18 Thread Ned Slider
LuKreme wrote: On 17-Aug-2009, at 04:24, Ned Slider wrote: Question - in Postfix do user unknown rejections still incur a dns RBL lookup, or does the rejection occur before reject_rbl_client? HELO/EHLO rejections do not reach RBL, and neither do unknown, as long as you specify the right

Re: Barracuda RBL in first place

2009-08-18 Thread rich...@buzzhost.co.uk
On Tue, 2009-08-18 at 20:02 +0100, Ned Slider wrote: LuKreme wrote: On 17-Aug-2009, at 04:24, Ned Slider wrote: Question - in Postfix do user unknown rejections still incur a dns RBL lookup, or does the rejection occur before reject_rbl_client? HELO/EHLO rejections do not reach

Re: Barracuda RBL in first place

2009-08-18 Thread mouss
Marc Perkel a écrit : http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good to me. I don't really count apews

Re: Barracuda RBL in first place

2009-08-18 Thread rich...@buzzhost.co.uk
On Wed, 2009-08-19 at 01:06 +0200, mouss wrote: ... in short, whatever jeff says, spamhaus is the one. the fundamental concept is not how many spam it blocks, but how much do I trust it. Exactly!

Re: Barracuda RBL in first place

2009-08-17 Thread LuKreme
On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host is valid?

Re: Barracuda RBL in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 00:51 -0600, LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host

Re: Barracuda RBL in first place

2009-08-17 Thread Ned Slider
LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host is valid?

Re: Barracuda RBL in first place

2009-08-17 Thread d . hill
Quoting Ned Slider n...@unixmail.co.uk: LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the

Re: Barracuda RBL in first place

2009-08-17 Thread Matus UHLAR - fantomas
On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist policy. I.e.: smtpd_recipient_restrictions = [...]

Re: Barracuda RBL in first place

2009-08-17 Thread d . hill
Quoting Matus UHLAR - fantomas uh...@fantomas.sk: On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist policy. I.e.:

Re: Barracuda RBL in first place

2009-08-17 Thread Matus UHLAR - fantomas
Quoting Matus UHLAR - fantomas uh...@fantomas.sk: On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist policy. I.e.:

Re: Barracuda RBL in first place

2009-08-17 Thread d . hill
Quoting Matus UHLAR - fantomas uh...@fantomas.sk: Quoting Matus UHLAR - fantomas uh...@fantomas.sk: On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the

Re: Barracuda RBL in first place

2009-08-17 Thread Benny Pedersen
On Mon, 17 Aug 2009 14:20:18 +0200, Matus UHLAR - fantomas uh...@fantomas.sk wrote: reject_rbl_client zen.spamhaus.local=127.0.0.10, reject_rbl_client zen.spamhaus.local=127.0.0.11, reject_rbl_client zen.spamhaus.local, [...] isn't this a bit superflous? the last line should doo all

Re: Barracuda RBL in first place

2009-08-17 Thread Marc Perkel
rich...@buzzhost.co.uk wrote: I have to agree with LuKreme, my overnight had 446 blocked prior to RBL, and only 387 by RBL. Again, noted that 'Barracuda' missed 43, 35 of these Spamhaus caught - so for me Spamhaus is still better than Barracuda. Also, I was sat in on a phone conference at

Re: Barracuda RBL in first place

2009-08-17 Thread Rob McEwen
Michael Hutchinson wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Michael, Your suggestions are wonderful. These techniques will block more spam, with relatively few FPs, and their implementation doesn't require

RE: Barracuda RBL in first place

2009-08-16 Thread Michael Hutchinson
Hello All, Considering all of the interesting information that's being going around regarding Barracuda, and it's RBL's, I probably wouldn't use it. Not any time soon. But that's based purely on reputation, and has nothing to do with hit ratio. Our Spam gateway seems to do just fine without it.

RE: Barracuda RBL in first place

2009-08-16 Thread d . hill
Quoting Michael Hutchinson mhutchin...@manux.co.nz: Hello All, Considering all of the interesting information that's being going around regarding Barracuda, and it's RBL's, I probably wouldn't use it. Not any time soon. But that's based purely on reputation, and has nothing to do with hit

Re: Barracuda RBL in first place

2009-08-16 Thread MySQL Student
Hi, So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host is valid? Thanks, Alex

OT: RE: Barracuda RBL in first place

2009-08-16 Thread Michael Hutchinson
-Original Message- From: MySQL Student [mailto:mysqlstud...@gmail.com] Sent: Monday, 17 August 2009 10:56 a.m. To: SpamAssassin Users List Subject: Re: Barracuda RBL in first place Hi, So perhaps instead of adding another RBL, maybe some admins need to consider adding in some

Re: Barracuda RBL in first place

2009-08-15 Thread --[ UxBoD ]--
- Marc Perkel m...@perkel.com wrote: Aaron Wolfe wrote: On Fri, Aug 14, 2009 at 11:24 AM, Chris Owen ow...@hubris.net wrote: On Aug 14, 2009, at 10:13 AM, Mike Cardwell wrote: The comparisons on that page are useless. What matters is list policy, reliability and reputation.

Re: Barracuda RBL in first place

2009-08-15 Thread Yet Another Ninja
On 8/15/2009 11:02 AM, --[ UxBoD ]-- wrote: -- RANKRULE NAME COUNT %OFMAIL %OFSPAM %OFHAM -- 1 URIBL_INVALUEMENT

OT - my eyes hurt (Re: Barracuda RBL in first place)

2009-08-15 Thread Henrik K
On Sat, Aug 15, 2009 at 10:02:52AM +0100, --[ UxBoD ]-- wrote: - Marc Perkel m...@perkel.com wrote: Aaron Wolfe wrote: On Fri, Aug 14, 2009 at 11:24 AM, Chris Owen ow...@hubris.net wrote: On Aug 14, 2009, at 10:13 AM, Mike Cardwell wrote: The comparisons on that page are

Re: Barracuda RBL in first place

2009-08-15 Thread MySQL Student
Hi,                            Unknown user 32.00% (32.00%)            87427696                              Greylisted 24.88% (16.92%)            46225401                               Throttled 11.03% (5.64%)             15399444                     Relay access denied 0.01%  (0.00%)        

Re: Barracuda RBL in first place

2009-08-15 Thread MySQL Student
Hi, What log script do you good people use to generate the list above ? Is it a home brew or one we can download so we can compare our own hits ? http://www.rulesemporium.com/programs/sa-stats.txt Any chance someone knows where there is a compatible one that parses amavisd instead of spamd?

Re: Barracuda RBL in first place

2009-08-15 Thread Benny Pedersen
On Sat, 15 Aug 2009 13:28:01 -0400, MySQL Student mysqlstud...@gmail.com wrote: Any chance someone has a bit of time to hack on it on this lazy Saturday afternoon? :-) http://www.mikecappella.com/logwatch/ -- Benny Pedersen

Re: Barracuda RBL in first place

2009-08-15 Thread Roger Marquis
well, you have half of it, as any hit shown here by invaluement was missed by spamhaus. I can't give you the data for other cases because it's a short circuit - 550 type of thing. That's not an ideal metric. You really need to test every incoming message against each RBL (up to 4 or so, to

Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good to me. I don't really count apews myself since they are

Re: Barracuda RBL in first place

2009-08-14 Thread RW
On Fri, 14 Aug 2009 06:30:58 -0700 Marc Perkel m...@perkel.com wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 06:30 -0700, Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good

Re: Barracuda RBL in first place

2009-08-14 Thread Michael Scheidell
RW wrote: But isn't Barracuda considered to be more aggressive than Spamhaus, so is beating Spamhaus on a BOFH metric, where blocking 0.0.0.0/32 would beat everything, much of an acheivement? my rbl beats everyone. please find ONE spammer's ipv4 address that isn't listed in

Re: Barracuda RBL in first place

2009-08-14 Thread Mike Cardwell
Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good to me. I don't really count apews

Re: Barracuda RBL in first place

2009-08-14 Thread Chris Owen
On Aug 14, 2009, at 10:13 AM, Mike Cardwell wrote: The comparisons on that page are useless. What matters is list policy, reliability and reputation. SpamHaus is hands down the best dnsbl. While I certainly agree that SpamHaus is very good, I would argue that Invalument is currently

Re: Barracuda RBL in first place

2009-08-14 Thread LuKreme
On 14-Aug-2009, at 09:03, Michael Scheidell wrote: my rbl beats everyone. It IS very effective at stopping spam. In fact, it stops 100% of spam. But it's sorta like the world's greatest ftp site (ftp://127.0.0.1/) which has awesome stuff, but it's all stuff I already have -- I said

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 16:13 +0100, Mike Cardwell wrote: Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 09:28 -0600, LuKreme wrote: On 14-Aug-2009, at 09:03, Michael Scheidell wrote: my rbl beats everyone. It IS very effective at stopping spam. In fact, it stops 100% of spam. But it's sorta like the world's greatest ftp site (ftp://127.0.0.1/) which has awesome

Re: Barracuda RBL in first place

2009-08-14 Thread Mike Cardwell
rich...@buzzhost.co.uk wrote: I've not laughed so much since I added a low priority mx pointing to 127.0.0.1 . Heh. Looks like someone got there before me: http://rfc-ignorant.org/tools/lookup.php?domain=buzzhost.co.uk -- Mike Cardwell - IT Consultant and LAMP developer Cardwell IT Ltd.

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 18:33 +0100, Mike Cardwell wrote: rich...@buzzhost.co.uk wrote: I've not laughed so much since I added a low priority mx pointing to 127.0.0.1 . Heh. Looks like someone got there before me: http://rfc-ignorant.org/tools/lookup.php?domain=buzzhost.co.uk

Re: Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
Mike Cardwell wrote: Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good to me. I

Re: Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
rich...@buzzhost.co.uk wrote: On Fri, 2009-08-14 at 06:30 -0700, Marc Perkel wrote: http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as

Re: Barracuda RBL in first place

2009-08-14 Thread Aaron Wolfe
On Fri, Aug 14, 2009 at 11:24 AM, Chris Owenow...@hubris.net wrote: On Aug 14, 2009, at 10:13 AM, Mike Cardwell wrote: The comparisons on that page are useless. What matters is list policy, reliability and reputation. SpamHaus is hands down the best dnsbl. While I certainly agree that

Re: Barracuda RBL in first place

2009-08-14 Thread LuKreme
On 14-Aug-2009, at 18:44, Aaron Wolfe wrote: The Spamhaus Block List 21.87% (6.74%) 18405091 The Invaluement SIP Block List 22.14% (5.33%) 14557404 What would be interesting is the XOR on these two. I also don't understand what the

Re: Barracuda RBL in first place

2009-08-14 Thread Aaron Wolfe
On Fri, Aug 14, 2009 at 9:39 PM, LuKremekrem...@kreme.com wrote: On 14-Aug-2009, at 18:44, Aaron Wolfe wrote:                The Spamhaus Block List 21.87% (6.74%)             18405091         The Invaluement SIP Block List 22.14% (5.33%)             14557404 What would be interesting is

Re: Barracuda RBL in first place

2009-08-14 Thread Marc Perkel
Aaron Wolfe wrote: On Fri, Aug 14, 2009 at 11:24 AM, Chris Owenow...@hubris.net wrote: On Aug 14, 2009, at 10:13 AM, Mike Cardwell wrote: The comparisons on that page are useless. What matters is list policy, reliability and reputation. SpamHaus is hands down

Re: Barracuda RBL in first place

2009-08-14 Thread rich...@buzzhost.co.uk
On Fri, 2009-08-14 at 16:56 -0700, Marc Perkel wrote: My experience is that the barracuda lists are reasonably good. A few FP but not a lot. I get more FP's with Barracuda than I do UCE Protect - which is rather funny given the slating UCE Protect get. And if they are exceeding spamhaus then