Jeremy Morton wrote:
Mind telling me which DNSBLs you subscribe to and how I subscribe to them?
Please don't top post - it kills the flow of the conversation.
Your example hit against spamhaus which is already present in spamassassin:
http://www.spamhaus.org/query/bl?ip=117.0.26.235
It's listed in XBL because the IP is likely infected with a spambot, and
in PBL which means it shouldn't be sending mail directly, period.
I deploy spamhaus (xen) at the smtp level in postfix, so nothing hitting
their lists is ever going to make it as far as spamassassin.
I've also have added some other lists to spamassassin including
uceprotect.net
http://www.uceprotect.net/en/rblcheck.php
Your example hits their level 2 & 3 lists which is a pretty strong
indication that the ISP in question doesn't take the issue of spam very
seriously. Level 2, and more so level 3 can and will give FPs, so you
need to understand the list you're querying and what it's telling you
when deciding what score to assign.
UCEProtect ask that if you're likely to do more than 1000 requests per
day that you rsync their RBLDNSD formatted data and perform queries locally.
