Frank M. Cook wrote: > the silver lining instead the problems I've been having is that I > learned my rbl checking was screwed up. one of the things I did when my > spamassassin started to backup was to have my mailserver check three > rbl's ahead of spamassassin and simply throw out hits. the amount of > spam went way down and this caused me to realize that I was skipping rbl > checking without realizing it. > > is I turn rbl checking on what lists does it check? > > I'm getting great results from spamhaus, sorbs, and njabl. are these > same checks in spamassassin?
By default, yes, as well as DSBL, rsl.visi.com, AHBL and spamcop. >From SA 3.0.4's 50_scores.cf: These are normal Received: header IP-based RBLs: score RCVD_IN_BL_SPAMCOP_NET 0 1.832 0 1.216 score RCVD_IN_DSBL 0 2.765 0 3.805 score RCVD_IN_NJABL_DUL 0 1.655 0 0.088 score RCVD_IN_NJABL_PROXY 0 1.026 0 0.438 score RCVD_IN_NJABL_RELAY 0 0.934 0 1.397 score RCVD_IN_NJABL_SPAM 0 1.051 0 1.841 score RCVD_IN_RSL 0 0.677 0 1.720 score RCVD_IN_SBL 0 1.050 0 0.107 score RCVD_IN_SORBS_DUL 0 0.137 0 1.987 score RCVD_IN_SORBS_HTTP 0 0 0 0.043 score RCVD_IN_SORBS_SOCKS 0 0 0 0.338 score RCVD_IN_SORBS_MISC 0 1.597 0 2.493 score RCVD_IN_SORBS_SMTP 0 1.847 0 2.054 score RCVD_IN_SORBS_WEB 0 0 0 0.007 score RCVD_IN_SORBS_ZOMBIE 0 0.819 0 0 score RCVD_IN_XBL 0 2.511 0 3.076 score RCVD_IN_BSP_OTHER 0 -0.1 0 -0.1 score RCVD_IN_BSP_TRUSTED 0 -4.3 0 -4.3 Off by default due to low performance, but included for completeness of multi-result queries: score RCVD_IN_SORBS_BLOCK 0 score RCVD_IN_NJABL_MULTI 0 score RCVD_IN_NJABL_CGI 0 And by default these have rules, but are not on due to the "for pay" policy of maps: score RCVD_IN_MAPS_RBL 0 score RCVD_IN_MAPS_DUL 0 score RCVD_IN_MAPS_RSS 0 score RCVD_IN_MAPS_NML 0 You could over-ride the scores of those rules in local.cf if you're a MAPS subscriber. These also check the host-name of the From: header: score DNS_FROM_AHBL_RHSBL 0 0.070 0 0.295 score DNS_FROM_RFC_ABUSE 0 0.374 0 0 score DNS_FROM_RFC_BOGUSMX 0 1.463 0 2.630 score DNS_FROM_RFC_DSN 0 score DNS_FROM_RFC_POST 0 1.376 0 1.614 score DNS_FROM_RFC_WHOIS 0 0.492 0 0.296 > can I change the lists that are checked in > a configuration file or do I need to create rules? You'd have to create rules to add any that aren't in there. But there's a lot that's already in there..
