RBLs - in MailScanner, SpamAssassin, or right in Sendmail?

[Res]

On Wed, 28 Feb 2007, Chris Yuzik wrote:

> So. Best practice. RBLs in MailScanner.conf? Or better in SpamAssassin? Or 
> better yet in Sendmail.mc? Obviously I want the magical sweet spot where I

In Sendmail, why accpt all that exta trash, just to dump it later.

> block 100.0000% of spam, with 0.000000% false positives. ;-)

You will never get that, no matter what you use, RBL's S.A, anything.
Hope your using 8.14.0, and enable:
FEATURE(`require_rdns')dnl
FEATURE(`block_bad_helo')dnl
...As a side note on bad_helo, you will need delay_checks enabled as well 
or the feature wont work at all...
(the docs are modified for this for next release and something else I 
added to them which escapes me) ......Oh yeah, that's it :)  don't rely
on the access file for bypassing bad_helo checks (for your winblows users 
who conenct saying HELO home.computer), you need the IP ranges in  the
/etc/mail/relay-domains  file.

> 1) Spamhaus-Zen?
Yes, highest hit count

> 2) Spamcop.net
Yes, catches a  lot of voerflow

> 3) NJABL
These guys used to be good, but i recent years the hit rate is very low, 
you could do without it, but it wont hurt to use combined.njabl, however 
sicne zen takes the DUL its double lookup

> 4) safe.dnsbl.sorbs.net
Yes, catches even mopre overflow
I just use dnsbl.sorbs.net, aggressive, yes, they are non forgiving, ie: 
where near all other 'wussy' RBLs not dare block hotmail or yahoo or 
gmail (even though these three still count for just over 50% of the 
spammers) SORBS will, still worth using though, in processing over a
million emails a day we never saw more than a dozen complaints a month.


-- 
Cheers
Res

"We can be Heroes, just for one day" - Davey (Jones) Bowie