In addition to suggestions made by others, make sure that you have the addresses corresponding to RBL responses included in your local blacklist, or else the RBL servers won't actually cause SMTP connections to be rejected. For the RBLs listed above, you need at least:
127.0.0.2-127.0.0.3 ; *.3 for Korean IPs in cn-kr.blackholes.us 127.1.0.1-127.1.0.32 ; opm.blitzed.org
If you want to determine if you are successfully rejecting connections based on RBL responses, filter your logs for entries containing 'blacklisted per rbl'.
Uh... wait... if you put an RBL into the RBL list, but don't ALSO put the those IPs into the blacklisted IPs list... then nothing actually happens?
Right. You can see if it is working by logging at a reasonably high level (4 or better I think...) and looking for the rejection messages.
I've got cbl and spamhaus in my RBL list, but I don't have the 127. IPs in the blacklist. I just checked my logs and see nothing about blacklisting per rbl.
Freaky... my spam has diminished considerably since I added the RBLs... I just assumed they were working. I also added two old spam filled user accounts as spam traps, so I guess maybe all the missing spam was getting bounced from those... or spammers just took a week off from hitting me :-)
It is also possible that since adding the RBL entries does make SIMS do the lookup against them that you have driven off the laziest of the spammers who give up if you take more than a few seconds to respond to a connection. This almost makes it worthwhile to just point an entry at a bogus list address with real DNS entries for a nameserver but no responding nameserver.
--
Bill Cole
[EMAIL PROTECTED]
############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
