Increased Volumes Of Spam

[Richard Frovarp]

Scott Silva wrote:
> Denis Beauchemin spake the following on 1/17/2007 6:00 AM:
>   
>> Randal, Phil a écrit :
>>     
>>> Scott Silva wrote:
>>>  
>>>       
>>>> cbl.abuseat.org is part of zen.spamhaus.org, via the included
>>>> lookup against the xbl list, so using both just increases your
>>>> dns lookups without any extra benefit.
>>>> Greetpause does help a lot, as I probably drop 10 to 20% of
>>>> the spam with it alone. Five seconds is a good starting point,
>>>> but probably not over 30 seconds.
>>>>     
>>>>         
>>> The only problem with zen.spamhaus.org is this statement, found on
>>> http://www.spamhaus.org/zen/index.lasso :
>>>
>>> "ZEN Usage
>>>
>>> Use of the Spamhaus DNSBLs via DNS queries to our public DNSBL mirrors
>>> is free for low-traffic mail servers serving less than 100 users. Use of
>>> the Spamhaus DNSBLs by commercial users, including corporate networks,
>>> ISPs and ESPs, requires a subscription to Spamhaus's Data Feed service."
>>>
>>>   
>>>       
>> Since I've seen this statement I tried to cut down on their RBL.  After
>> some reshuffling I get the following usage (today's stats so far):
>>    cbl.abuseat.org :  31957 (34.29%)
>>      list.dsbl.org :   1040 ( 1.12%)
>> safe.dnsbl.sorbs.net :  57967 (62.20%)
>>   zen.spamhaus.org :   2238 ( 2.40%)
>>
>> On Jan 1 I used only spamhaus and sorbs (in that order) and I had the
>> following stats:
>>    safe.dnsbl.sorbs.net :  63222 (29.63%)
>>        zen.spamhaus.org : 150167 (70.37%)
>>
>> I check the RBLs in this order in my sendmail.mc:
>> FEATURE(`dnsbl',`safe.dnsbl.sorbs.net',`"554 Rejected " $&{client_addr}
>> " found in safe.dnsbl.sorbs.net"')dnl
>> FEATURE(`dnsbl',`cbl.abuseat.org',`"554 Rejected " $&{client_addr} "
>> found in cbl.abuseat.org"')dnl
>> FEATURE(`dnsbl',`list.dsbl.org',`"554 Rejected " $&{client_addr} " found
>> in list.dsbl.org"')dnl
>> FEATURE(`dnsbl',`zen.spamhaus.org',`"554 Rejected " $&{client_addr} "
>> found in zen.spamhaus.org"')dnl
>>
>> Denis
>>
>>     
> Since there will be some duplication in any list, the order that you call them
> will have an effect on their hits. If you put cbl after zen, you will show no
> hits on cbl. You could try and move list.dsbl.org after zen and see how it
> fares also. Zen is a very good list IMHO.
>
>   

I'm not a fan of safe.dnsbl.sorbs.net. Their new.spam.dnsbl.sorbs.net 
zone is in that one. The description is: List of hosts that have been 
noted as sending spam/UCE/UBE to the admins of SORBS within the last 48 
hours. A week ago it was catching email from many google/gmail servers.

Zen is very good. Too bad they upped their subscription costs by 10 
times for educational entities.