[dns-operations] [Fwd: Re: negative caching of throwaway spam domains]

[Ken A]

Michael Monnerie wrote:
> On Freitag, 15. Dezember 2006 19:32 Ken A wrote:
>> I was using it in Spam Assassin, and it was quite
>> helpful when combined with other rules.
> 
> I directly used it in Postfix to drop mail from such domains, but I'd 
> like to see your rules for SA, you use it for URI rules I guess?

This was posted to the SA list a while back by someone (watch the line 
wraps).

urirhssub URIBL_RHS_DOB         dob.sibl.support-intelligence.net 
A       127.0.0.2
body URIBL_RHS_DOB              eval:check_uridnsbl('URIBL_RHS_DOB')
describe URIBL_RHS_DOB          Contains an URI of a new domain (Day Old 
Bread)
tflags URIBL_RHS_DOB            net
score URIBL_RHS_DOB             2.75

I was combining that with tests for other high-hit spammy indicators, 
like country of origin, SARE_FRAUD, etc..

Ken A.
Pacific.Net

> mfg zmi
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.oarci.net
> http://lists.oarci.net/mailman/listinfo/dns-operations