I have never used any blacklists, however I am starting to get complaints from users about spam. I read Bill's blacklist and it seems a little complicated for me right now. Could I get some suggestions on how to start. Is it better to start with existing blacklists instead of creating my own? What is the best approach?
Really depends on how large and diverse your user base is, how large and diverse their correspondents are, and how important email is to your users.
I support organizations that have received legitimate email from Nigeria, Korea, Brazil, Russia, etc., so I can't use these broad-sweep RBLs. I also can't block huge swaths of large network providers just because spammers use them for short periods before their AUPs can kick in. I won't block a /19 netblock just because a spammer uses a /28 of it.
The only external RBL I use is Spamhaus; I've never had a complaint from a user about lost email as a result.
I also use spamtraps; I created a new email address and put it on some web sites in white 1-point print on a white background. Took four days to get spam on that.
And then I rely on user complaints (counting myself as a user). I use a standard acceptable-use process: I keep a database of complaints, I kick out a stock answer on every complaint, and if I don't get a response, I add the IP to the blacklist. It takes three complaints for me to block a /29, four to block a /28, and so on; I never block an extended range if all the complaints come from a subset. I use a similar process of monitoring complaints to take netblocks out of the blacklist. (I blocked a /29 that included some of AT&T's mail servers for a while. Sure cut down the spam, but I had to get rid of that line eventually).
Standard system administration ethics apply: always behave in a manner which is professional, objective, in the interests of the users, and which allocates resources efficiently (i.e. I don't spend more than half an hour a day fighting spam).
Alex von Thorn http://worldhouse.com/alex/
"Memory fades, but a Google search never forgets." -- Perry White
############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
