URIBL

[Matt Kettler]

Kevin Miller wrote:
> Some while back Julian added the URIBL black and greylist entries in
> spam.assassin.prefs.conf but they're commented out by default.  Have
> they proven themselves to be pretty reliable - i.e., not a lot of false
> positives?  I'm inclined to enable them but am interested in some
> feedback first.

IMHO, no, they aren't very reliable but I'd be in the minority.


That said, I still find them very useful, but I also find they tend to FP on
"overlap" conditions a lot. And that overlap causes a lot of problems when
you've got URIBL scoring high, and tacking onto some other URIBL (most often
BLACK+WS) which also scores high.

(Note: I'm also the cause of a massive flamewar over on spamassassin-users on
this topic. )

As a result of my own real-world problems with "multi-listing" I personally use
very mild scores:

score           URIBL_BLACK  1.5
score           URIBL_GREY  0.001

And an over-lap compensation rule (beware of line wrap):

meta URIBL_BLACK_OVERLAP (URIBL_BLACK && (URIBL_AB_SURBL || URIBL_JP_SURBL ||
URIBL_OB_SURBL || URIBL_WS_SURBL || URIBL_SC_SURBL))
score URIBL_BLACK_OVERLAP -1.0


The over-lap rule in effect reduces URIBL_BLACK to 0.5 points if it's also
matching any other SURBL rule.

To me, this makes a lot of sense because the SURBL rules were score-tuned with
respect to each other, but URIBL_BLACK was not a part of that mix. Simply adding
URIBL_BLACK in with a strong score upsets that balance.