potential blacklist stats

[Stephen Swaney]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of hermit921
> Sent: Monday, July 12, 2004 6:13 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: potential blacklist stats
>
> I put one IP blacklist in place (postfix) and it is blocking about 20% of
> incoming mail attempts.  A good start.  Now I want to find the next most
> effective (and well documented, low false positive rate, etc)
> blacklist.  Is there a way for MailScanner to do a check against several
> blacklists such as XBL, CBL, SORBS, etc. and report how many connections
> come from an IP address on each list?  Then pick the best one and block
> that in postfix.  Repeat cycle as feasible.
>


We recommend blocking at the MTA level - on one RBL,

        sbl.xbl.spamhaus.org (see www.spamhaus.org)

Blocking reduces the load on MailScanner / SpamAssassin much more than
blacklisting. The email is never accepted for delivery so it never hits
MailScanner, SpamAssassin or the virus scanner(s).

We have never had a complaint of lost email from our clients or our client
sites on this blocking. One of our ISP clients, whose domain had become a
spam magnet, cut incoming accepted mail by almost 90% by blocking on this
RBL. Most of our customer sites see a 30% load reduction by blocking on this
RBL.

Steve

Stephen Swaney
President
Fortress Systems Ltd.
Steve.Swaney at FSL.com

> This could provide us with some good data to persuade powers that be to
> allow us to use more blacklists.  What I really want is to show that [make
> up a number here] 30% of what we tag as spam would have been rejected
> before it was allowed onto our mail server.
>
> hermit921
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> Before posting, please see the Most Asked Questions at
> http://www.mailscanner.biz/maq/     and the archives at
> http://www.jiscmail.ac.uk/lists/mailscanner.html
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html