John D. Hardin wrote on Sat, 11 Aug 2007 18:21:35 -0700 (PPT): > I think there was some consensus about using that in concert with an > excessive number of A records as a spam sign. Check the thread > history. I don't think anyone is suggesting by itself it's a useful > indicator.
This is what I had in mind. Otherwise it might indeed fire too often. I don't know if the combination will turn out to be of any help in spam detection. I'm not pro or con, I just wanted to add some comments about the query load and storage as this is of concern to me. My main point was that you don't have to rely on caching at the nameserver. You can have your own storage, as we have with AWL, Bayes etc., and thus minimize the query load. And for getting false positives out of it you best use a whitelist as just removing it from the database will not help much. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com
