On Wed, Sep 24, 2008 at 5:41 PM, <[EMAIL PROTECTED]> wrote: > On Tue, 23 Sep 2008, McDonald, Dan wrote: > >> On Tue, 2008-09-23 at 17:21 -0400, [EMAIL PROTECTED] wrote: >>> >>> Getting back to the subject...can anyone enlighten us to the efficacy of >>> this DNSBL? For example, how does it compare to zen.spamhaus.org, >> >> It hits significantly more spam than zen.spamhaus.org >> >> On my primary mx, today I had 94 mails that hit a zen list but not brbl, >> 591 that hit a zen list and brbl, and 8042 that hit brbl but not zen. >> >> I am checking -lastexternal addresses only. >> >> Looking through the 2400 or so domains that were marked as spam, I >> didn't see any obvious false positives. Looking through the 631 domains >> that did not have enough points to be classed as spam, I didn't see more >> than one or two that shouldn't have been blocked. granted, i did not >> look through the emails themselves, just the domain name. >> >> I'm currently scoring it 1.0, and might raise it up to 2.0 in a couple >> of days if nobody starts squawking.... > > I was actually hoping to use it like I use zen.spamhaus.org and > dul.sorbs.net and just reject emails listed on those. It is very rare that > I get a false positive from either, but their efficacy isn't what it used to > be, either. So, I just configured my tcpserver to invoke rblsmtpd using > b.barracudacentral.org as well as the other two, and after only a few > seconds, the difference was astounding. Here is perhaps 2 minutes worth of > stats: > > $ grep -c sorbs bl_stats > 9 > > $ grep -c spamh bl_stats > 228 > > $ grep -c barracud bl_stats > 1321 > > I thought maybe something was broken and it was rejecting everything, but > that doesn't appear to be the case. > > However, it may take a day or more to find out of the false positive ratio > of this dnsbl is too high to use it like this. > > Has anyone else done this? If so, what does the FP situation look like?
We've been testing here for over a week. The FP rate is very low but higher than that of zen or invaluement (which have practically none). I'd guess you might be able to use it as a blocklist depending on your site and user's expectations.. If you want a "set it and forget it", probably just add a decent score in SA. > > James Smallacombe PlantageNet, Inc. CEO and Janitor > [EMAIL PROTECTED] > http://3.am > ========================================================================= >
