I've been wondering about this for some time... Does the order really affect
the number of lookups?
I'd thought that the RBL lookups went out pretty much all at once. It turns
out that they don't. I looked back through some old logs where I had stepped
up logging and found this...
<snip>
looks like about a 4-second delay before looking up the next listed RBLs...
Which is why I've created a master internal blacklist that's an amalgamation
of most of the blackholes.us country codes plus additional IP ranges from
other Eastern European and South American countries (for example, cable
modem blocks from Romania and Peru) so that one query nabs about 60% of my
blacklisted traffic. (Today, for instance, it blocked 5029; cbl.abuseat.org
blocked 3224-- thanks, Bill Cole, for introducing that list to us;
sbl.spamhaus.org hit 3002; dialups.visi.com hit 121; and opm.blitzed.org hit
14.) If you run your own DNS I highly recommend it for country codes; I
certainly wouldn't use it for any other blacklists, but IP ranges tend to
stay local to their assigned countries.
Woah, sbl caught 3000 messages AFTER cbl?
I removed sbl from my list because in the week following adding cbl I got -0- hits on sbl.
I've though about adding the dialups/cn-kr bocks to a local rbl but haven't been able to muster up the initiative to set it up, and I really don't want to mess up my existing DNS since it server RealDomains.
--
There's nothing to do, so you just stay in bed [ah, poor thing] Why live in the world when you can live in your head?
############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
