I use about 100 dnsbl/rbl/rhsbl list of varying weights and reliabilities.
How many matter...
I'd have to say the shining star is CBL. Hits 45% of the spam with a very
low false positive rate.
The relay RBLs days are way behind them,
The proxy RBLs most useful days are behind them
The DUL RBLs I don't think have ever been comprehensive/correct enough to be
as useful as they should be in the day of the spam zombie.
The spam source RBL's (other than CBL) are a little over-zealous to me
causing me some false positives problems, thus lower than weight. They seem
to be on the downtrend too. Oddly Fiveten Spam (127.0.0.2) has had a big
jump in the last two months catching 60% of the spam although with a >1 %
false positive rate.
I have 2 1/4 years of my spam test results posted at
All tests: http://it.farmprogress.com/declude/Testsbymonth.html
Spam tests: http://it.farmprogress.com/declude/spamtestbymonth.html
ham tests: http://it.farmprogress.com/declude/hamtestsbymonth.html
----- Original Message -----
From: "Pete McNeil" <[EMAIL PROTECTED]>
To: "Message Sniffer Community" <[email protected]>
Sent: Tuesday, June 06, 2006 8:26 AM
Subject: [sniffer]A design question - how many DNS based tests?
Hello Sniffer Folks,
I have a design question for you...
How many DNS based tests do you use in your filter system?
How many of them really matter?
Thanks!
_M
--
Pete McNeil
Chief Scientist,
Arm Research Labs, LLC.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[email protected]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[email protected]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
