[dns-operations] [Fwd: Re: negative caching of throwaway spam domains]

Ken A ka at pacific.net
Sat Dec 16 00:01:09 UTC 2006

Michael Monnerie wrote:
> On Freitag, 15. Dezember 2006 19:32 Ken A wrote:
>> I was using it in Spam Assassin, and it was quite
>> helpful when combined with other rules.
> I directly used it in Postfix to drop mail from such domains, but I'd 
> like to see your rules for SA, you use it for URI rules I guess?

This was posted to the SA list a while back by someone (watch the line 

urirhssub URIBL_RHS_DOB         dob.sibl.support-intelligence.net 
body URIBL_RHS_DOB              eval:check_uridnsbl('URIBL_RHS_DOB')
describe URIBL_RHS_DOB          Contains an URI of a new domain (Day Old 
tflags URIBL_RHS_DOB            net
score URIBL_RHS_DOB             2.75

I was combining that with tests for other high-hit spammy indicators, 
like country of origin, SARE_FRAUD, etc..

Ken A.

> mfg zmi
> ------------------------------------------------------------------------
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.oarci.net
> http://lists.oarci.net/mailman/listinfo/dns-operations

More information about the dns-operations mailing list