RBL checking w/ MS and SA

[Julian Field]

At 18:54 13/01/2003, you wrote:
>There must be something I'm missing?  The MailScanner's RBL lists in my
>setup seem as if all of them are not being checked.  I normally get multiple
>RBL returns on most SPAM messages.  I do have SpamAssassin enabled -- if I
>added lists to the MailScanner.conf and the spam.lists.conf files, I assumed
>the MailScanner either did RBL checking on it's own or passed the RBL's on
>to SpamAssassin to be checked?

The RBL checking in MS and SA are separate. If the sender appears in any of
the "Spam Lists" or "Spam Domain Lists" in MS then they will be marked as
spam. SA does its own RBL checking as well unless you set "skip_rbl_checks
= 1" in your spam.assassin.conf file. If SA gets a "hit" on any of the RBLs
that it checks, then a value is added to the overall SpamAssassin score.

>- Do I need to add the RBL checking to the spamassassin config to make it
>all happen and to check all of the RBLs I desire to use?

If you want "appearance in any RBL implies spam" then use MS to do it. If
you want it to add to the SA score, then let SA do it. There's not much
point doing the RBL checks twice, it just slows everything down.

>- Is the MailScanner spam.lists.conf file used if SpamAssassin is in play?

Yes. The MS spam lists and SA are separate.

>- Also one other question about the MailScanner.conf and the DNS blacklists,
>what is the difference between the "Spam List" configuration entry and the
>"Spam Domain List".  I guess I don't see how the two actually interact.  If
>SA is used, is it a moot point what's in this part of the config?

Most RBLs are done using the IP address of the SMTP server that sent you
the message. These are "Spam Lists". But a few are done using the domain
name instead. These are "Spam Domain Lists". Personally I don't use "Spam
Domain Lists" at all, but some people do.

>Just a little confused -- sorry.

No problem. The whole MS/SA interaction can seem a little complicated at
first :-)

In your config below, you are doing some of the RBL checks twice, which
isn't optimal, but won't do any harm if your server can handle the load.
You can configure MS so that if it gets any "hits" on the "Spam Lists" then
it won't bother calling SA at all, as it will have already decided the
message is spam. You might try using that.

If you need any more help or explanation, do get in touch.

>Here are excerpts from my config files...
>----------------------------
>MailScanner.conf
>----------------------------
># This is the name of the file that translates the names of the "Spam List"
># values to the real DNS names of the spam blacklists.
>Spam List Definitions = /etc/MailScanner/spam.lists.conf
>...
># Do you want to check messages to see if they are spam?
># This can also be the filename of a ruleset.
>Spam Checks = yes
>
># This is the list of spam blacklists (RBLs) which you are using.
># See the "Spam List Definitions" file for more information about what
># you can put here.
># This can also be the filename of a ruleset.
>#Spam List = ORDB-RBL Infinite-Monkeys # MAPS-RBL+ costs money (except
>.ac.uk)
>Spam List = ORDB-RBL spamcop.net Infinite-Monkeys osirusoft.com
>WIREHUB-DNSBL OSIRUSOFT-SPEWS
>
># This is the list of spam domain blacklists which you are using
># (such as the "rfc-ignorant" domains). See the "Spam List Definitions"
># file for more information about what you can put here.
># This can also be the filename of a ruleset.
>#Spam Domain List =
>...
># Set the location of the SpamAssassin user_prefs file. If you want to
># stop SpamAssassin doing all the RBL checks again, then you can add
># "skip_rbl_checks = 1" to this prefs file.
>SpamAssassin Prefs File = /etc/MailScanner/spam.assassin.prefs.conf
>----------------------------
>/MailScanner.conf
>----------------------------
>----------------------------
>spam.assassin.prefs.conf
>----------------------------
>...
># By default, SpamAssassin will run RBL checks.  If your ISP already
># does this, set this to 1.
>#
># skip_rbl_checks 1
>...
>----------------------------
>/spam.assassin.prefs.conf
>----------------------------
>
>Thanks for your time,
>
>Todd

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support