Re: [Declude.JunkMail] Fwd: Verisign's New Change and Outdate RBL's

[Matthew Bramble]

This is a great find!  I'm just wondering where the potential FP's would come from so that I can determine the proper scoring.  Obviously people that misspell their from domain could be tagged, but what happens when someone uses <> or how about just "John Smith", would that score on this test?  I'm of course capturing to see what I get. Also, is this a total replacement for MAILFROM on .com and .net domains? Thanks, Matt Bill Landry wrote: Yep, that's correct, and probably not a good thing. I have been using an rhsbl test, and it appears to be doing what it should--that is, query DNS with the return address and if it comes back with 64.94.110.11, add weight to the message. Here is what I am using: VERISCAM rhsbl . 64.94.110.11 1 0 Yes, that's a period "." where you would normally list the rhsbl lookup domain. This has the effect of JunkMail doing an "A" record lookup against your own DNS for the return address listed in the message, and if it is an invalid domain, the DNS returns with 64.94.110.11, which causes the message to fail the VERISCAM test and weight gets added to the message. I've set the weight to 1 for testing, but so far messages that have gotten flagged by the VERISCAM test have been spam. Bill ----- Original Message ----- From: "Keith Anderson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 15, 2003 11:48 PM Subject: RE: [Declude.JunkMail] Fwd: Verisign's New Change and Outdate RBL's The result would always be the same: 64.94.110.11 so you would tag every message as spam. Right? -----Original Message----- From: Joshua Levitsky [mailto:[EMAIL PROTECTED]] Sent: Monday, September 15, 2003 10:47 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Fwd: Verisign's New Change and Outdate RBL's Interesting side effect of Verislime's move. Just setup a ip4r test that goes to a bogus domain and then all the bad addresses result in an answer of 64.94.110.11. Maybe this is how we can take advantage of this? If i made an ip4r test of aklsjlajkdjkhskljdkjldhsjdshkhklshdkjl.com then I'd probably be good no? -Josh