Payal Rathod wrote:
>
> Thanks for the mail. I want to do this for spamhaus and not spamcop. I
> cannot find an entry for it there.
> The only lines I see in 20_dnsbl_tests.cf are,
>
> header __RCVD_IN_SBL_XBL eval:check_rbl('sblxbl',
> 'sbl-xbl.spamhaus.org.')
> describe __RCVD_IN_SBL_XBL Received via a relay in Spamhaus SBL+XBL
> tflags __RCVD_IN_SBL_XBL net
>
>
> Also no scores are given. Please tell a way.
That's the un-scored parent rule that causes the DNS query. There are
two child rules that don't perform a DNS lookup, they just use the
results fetched by the rule above.
The Two scored rules are *DIRECTLY* below the rule above in
20_dnsbl_tests.cf.
Here's the whole spamhaus section of 20_dnsbl_tests.cf:
# ---------------------------------------------------------------------------
# Spamhaus SBL+XBL
#
# Spamhaus XBL contains both the Abuseat CBL (cbl.abuseat.org) and Blitzed
# OPM (opm.blitzed.org) lists so it's not necessary to query those as well.
header __RCVD_IN_SBL_XBL eval:check_rbl('sblxbl',
'sbl-xbl.spamhaus.org.')
describe __RCVD_IN_SBL_XBL Received via a relay in Spamhaus SBL+XBL
tflags __RCVD_IN_SBL_XBL net
# SBL is the Spamhaus Block List: http://www.spamhaus.org/sbl/
header RCVD_IN_SBL eval:check_rbl_sub('sblxbl', '127.0.0.2')
describe RCVD_IN_SBL Received via a relay in Spamhaus SBL
tflags RCVD_IN_SBL net
#reuse RCVD_IN_SBL
# XBL is the Exploits Block List: http://www.spamhaus.org/xbl/
header RCVD_IN_XBL eval:check_rbl('sblxbl-lastexternal',
'sbl-xbl.spamhaus.org.', '127.0.0.[456]')
describe RCVD_IN_XBL Received via a relay in Spamhaus XBL
tflags RCVD_IN_XBL net
#reuse RCVD_IN_XBL
#
---------------------------------------------------------------------------
The actual scores for these rules are (assuming SA 3.1.x):
score RCVD_IN_XBL 0 3.114 0 3.897
score RCVD_IN_SBL 0 2.712 0 3.160
And you can over-ride them the same way.
