Re: [Exim] Lists antiSpam.

Top Page
Delete this message
Reply to this message
Author: Wakko Warner
Date:  
To: Andrew - Supernews
CC: exim-users
Subject: Re: [Exim] Lists antiSpam.
> Tim> Do you use DSBL and, if so, is it before or after CBL in your
> Tim> DNSBL list? Just curious, because I added CBL (after
> Tim> recommendations here) but after 2 weeks it hadn't actually
> Tim> caught anything that wasn't already in DSBL, so I turned it off
> Tim> again.
>
> >From the past few hours connection attempts here, based on a single
> lookup that stops as soon as it gets one hit, though the fact of
> getting a hit on one of these (other than the CBL) isn't in itself
> enough for us to block the mail, so these numbers may possibly include
> some non-spam:
>
> 1523 list.dsbl.org
>    2 opm.blitzed.org
>  840 bl.spamcop.net
>  226 blackholes.easynet.nl
>  760 spews
>   63 cbl.abuseat.org
>   21 sbl.spamhaus.org

>
> That's in order of testing. So even with dsbl, opm, spamcop, easynet
> and spews checked first, we get hits on CBL.
>
> (I'll probably drop opm, it's not worth it these days.)
>
> Changing the order around and letting it run for another couple of
> hours gave:
>
> 1157 cbl.abuseat.org
> 214 list.dsbl.org
> 338 bl.spamcop.net
> 64 blackholes.easynet.nl
> 347 spews
> 15 sbl.spamhaus.org


I have a spam tracking database at work which lists every possible reason a
message could be rejected and if it was.  Each of the RBLs I have listed
will test each IP and if they are found they are logged.  Order of this list
does not matter because of this.  Here's what I have:
RBL: bl.spamcop.net             Count: 12575
RBL: cbl.abuseat.org            Count: 5349
RBL: dnsbl.njabl.org            Count: 7646
RBL: dnsbl.sorbs.net            Count: 7224
RBL: list.dsbl.org              Count: 4924
RBL: relays.ordb.org            Count: 262
RBL: sbl.spamhaus.org           Count: 13717
--------------------------------------------------------------
RBL: bl.spamcop.net/127.0.0.2           Count: 12575
RBL: cbl.abuseat.org/127.0.0.2          Count: 5349
RBL: dnsbl.njabl.org/127.0.0.2          Count: 495
RBL: dnsbl.njabl.org/127.0.0.3          Count: 1490
RBL: dnsbl.njabl.org/127.0.0.4          Count: 3861
RBL: dnsbl.njabl.org/127.0.0.8          Count: 1
RBL: dnsbl.njabl.org/127.0.0.9          Count: 1799
RBL: dnsbl.sorbs.net/127.0.0.10         Count: 974
RBL: dnsbl.sorbs.net/127.0.0.2          Count: 1105
RBL: dnsbl.sorbs.net/127.0.0.3          Count: 793
RBL: dnsbl.sorbs.net/127.0.0.4          Count: 53
RBL: dnsbl.sorbs.net/127.0.0.5          Count: 9
RBL: dnsbl.sorbs.net/127.0.0.6          Count: 3967
RBL: dnsbl.sorbs.net/127.0.0.7          Count: 4
RBL: dnsbl.sorbs.net/127.0.0.9          Count: 319
RBL: list.dsbl.org/127.0.0.2            Count: 4924
RBL: relays.ordb.org/127.0.0.2          Count: 262
RBL: sbl.spamhaus.org/127.0.0.2         Count: 13717


I am actually surprised that spamhaus traps the most. I check through the
db occasionally to see things that weren't rejected (cbl.abuseat.org, ordb,
and sorbs are 2 that I don't use to block mail, they are statistical only)
From what I see, cbl and sorbs might block 2-3 messages a day if I were to
use them. Ordb might block one every week.

This information starts Nov 1 2003. I still have logs that date back to jun
2003. If anyone's interested, I'll compile the list.

--
Lab tests show that use of micro$oft causes cancer in lab animals