dnsbl defaults

[Fritz Borgstedt]

>I think it's not a good idea because on their site they ask NOT to
>use dns
>query but rsync for servers with more than 1000 queries per day


ASSP uses a cache.

fritz


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

[Marrco]

I see actual (1.3.9.1) dnsbl defaults include UCEPROTECT

I think it's not a good idea because on their site they ask NOT to use dns
query but rsync for servers with more than 1000 queries per day (
http://www.uceprotect.net/en/index.php?m=6&s=11 ) or at least a note could
be added (pls don't use uceprotect on MTA with more than 1k requests per
day)

(my defaults are:
zen.spamhaus.org|bl.spamcop.net|dul.dnsbl.sorbs.net|combined.njabl.org  with
RBLmaxits set to 1)


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

[_larsneo_]

talking about the dnsbl default settings i'd recommend to remove blackholes.five-ten-sg.com from the defaults due to it's accurancy - see http://www.dnsbl.com/2007/10/fiveten-blacklist-not-accurate.html

regards from germany
andreas <larsneo>

[Fritz Borgstedt]

>blackholes.five-ten-sg.com

is quite successful if you use RBLmaxhits=2.
With RBLmaxhits=1 it is not recommended.


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

[GrayHat]

> my defaults are:
>
> zen.spamhaus.org
> bl.spamcop.net
> dul.dnsbl.sorbs.net
> combined.njabl.org
>
> with RBLmaxits set to 1

I think you may add

ix.dnsbl.manitu.net
bhnc.njabl.org

the second one won't add so much, but having it won't hurt; the first
one
(manitu) is often useful, especially for fresh spamruns flowing out of
compromised machines whose IP addresses aren't already listed
on the other DNSBLs

Also, speaking of spamruns... lately I saw a lot of spam coming out
of *valid* servers (e.g. gmail ones); the spammers use stolen mail
credentials to connect to the servers and pump-out their trash; now;
on one hand, you can't "block" (or blacklist) those servers or you'll
loose "good" emails; on the other hand, delaying won't help here,
since the sending server is a "regular" one, so it will retry; now ...

An idea to filter such kind of spam, may be parsing the "received"
headers lines and checking if an IP along the chain is blacklisted;
I know, it's a "risky business" since you'll risk to intercept a dynamic
IP used to send a legitimate message through a valid server; and
I also know it will impose more load on ASSP; but I think that it may
still be an idea worth a thought


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

[tanstaafl_bh]

On 8/6/2008, marrco (assp@...) wrote:

> I see actual (1.3.9.1) dnsbl defaults include UCEPROTECT
>
> I think it's not a good idea because on their site they ask NOT to use dns
> query but rsync for servers with more than 1000 queries per day (
> http://www.uceprotect.net/en/index.php?m=6&s=11 ) or at least a note could
> be added (pls don't use uceprotect on MTA with more than 1k requests per
> day)
>
> (my defaults are:
> zen.spamhaus.org

You are aware that zen has a similar limitation (for free users)?

http://www.spamhaus.org/organization/dnsblusage.html

--

Best regards,

Charles


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

[Marrco]

>> I see actual (1.3.9.1) dnsbl defaults include UCEPROTECT
>>
>> I think it's not a good idea because on their site they ask NOT to use
dns
>> query but rsync for servers with more than 1000 queries per day (
>> http://www.uceprotect.net/en/index.php?m=6&s=11 ) or at least a note
could
>> be added (pls don't use uceprotect on MTA with more than 1k requests per
>> day)
>>
>> (my defaults are:
>> zen.spamhaus.org
>
>You are aware that zen has a similar limitation (for free users)?
>
>http://www.spamhaus.org/organization/dnsblusage.html

Yes, but the limit is 300.000 queries per day, not just 1000 and that's a
huge difference for me !
But I think it should be a good idea to at least add a note with the limits
(100.000 - 1000 etc) and a link to the website




-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

[James Brown]

On 07/08/2008, at 4:45 PM, _larsneo_ wrote:

talking about the dnsbl default settings i'd recommend to remove
blackholes.five-ten-sg.com from the defaults due to it's accurancy - see
http://www.dnsbl.com/2007/10/fiveten-blacklist-not-accurate.html

Yes, I can't send email to Thomas Eckard because of this:

<assp.globalpb@...>: host thockar.dyndns.org[87.170.95.143] said: 550
   5.7.1 Blacklisted by blackholes.five-ten-sg.com (in reply to end of DATA
   command)

But according to blackholes.five-ten.sg.com my mail server's IP is not listed.

James.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test