Re: Extending XBL to all untrusted

2009-07-13 Thread RW
On Mon, 13 Jul 2009 17:21:36 +0100 Ned Slider wrote: > I do a very similar thing and see very similar results to yours. > > I use zen.spamhaus to block at the smtp level and then run all > headers through sbl-xbl for a further few points. As already > mentioned elsewhere in this thread, it will

Re: Extending XBL to all untrusted

2009-07-13 Thread Rob McEwen
I agree so strongly about not checking against all IPs in the header that I'll probably turn down business from large anti-spam vendors who cannot guarantee in writing that ivmSIP and ivmSIP/24 will ONLY be checked against the actual sending IP. If this means I lose 4-5 figures in annual revenue fr

Re: Extending XBL to all untrusted

2009-07-13 Thread McDonald, Dan
On Mon, 2009-07-13 at 17:38 +0100, rich...@buzzhost.co.uk wrote: > On Mon, 2009-07-13 at 18:28 +0200, Matus UHLAR - fantomas wrote: > > On 13.07.09 16:26, rich...@buzzhost.co.uk wrote: > > > Do the RFC's state that they need to? > > > > yes, RFC4954 in section 7 does > > > Where - I don't see it

Re: Extending XBL to all untrusted

2009-07-13 Thread Justin Mason
On Fri, Jul 3, 2009 at 22:43, RW wrote: > > I think it might be worth having 2 XBL tests, a high scoring test on > last-external and a lower-scoring test that goes back through the > untrusted headers. > > I understand that Spamhaus doesn't recommend this, because dynamic IP > addresses can be reas

Re: Extending XBL to all untrusted

2009-07-13 Thread rich...@buzzhost.co.uk
On Mon, 2009-07-13 at 17:38 +0100, rich...@buzzhost.co.uk wrote: > On Mon, 2009-07-13 at 18:28 +0200, Matus UHLAR - fantomas wrote: > > > On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: > > > > > On Fri, 3 Jul 2009, RW wrote: > > > > > > I understand that Spamhaus doesn't recommend

Re: Extending XBL to all untrusted

2009-07-13 Thread rich...@buzzhost.co.uk
On Mon, 2009-07-13 at 18:28 +0200, Matus UHLAR - fantomas wrote: > > On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: > > > > On Fri, 3 Jul 2009, RW wrote: > > > > > I understand that Spamhaus doesn't recommend this, because dynamic IP > > > > > addresses can be reassigned from a sp

Re: Extending XBL to all untrusted

2009-07-13 Thread Matus UHLAR - fantomas
> On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: > > > On Fri, 3 Jul 2009, RW wrote: > > > > I understand that Spamhaus doesn't recommend this, because dynamic IP > > > > addresses can be reassigned from a spambot to another user, but I added > > > > my own rule it does seem to wo

Re: Extending XBL to all untrusted

2009-07-13 Thread Ned Slider
RW wrote: I think it might be worth having 2 XBL tests, a high scoring test on last-external and a lower-scoring test that goes back through the untrusted headers. I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, bu

Re: Extending XBL to all untrusted

2009-07-13 Thread rich...@buzzhost.co.uk
On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: > > On Fri, 3 Jul 2009, RW wrote: > > > I understand that Spamhaus doesn't recommend this, because dynamic IP > > > addresses can be reassigned from a spambot to another user, but I added > > > my own rule it does seem to work. In my

Re: Extending XBL to all untrusted

2009-07-13 Thread Matus UHLAR - fantomas
> On Fri, 3 Jul 2009, RW wrote: > > I understand that Spamhaus doesn't recommend this, because dynamic IP > > addresses can be reassigned from a spambot to another user, but I added > > my own rule it does seem to work. In my mail it hits about 9% of my > > spam, with zero false-positives. On 13.0

Re: Extending XBL to all untrusted

2009-07-13 Thread Tony Finch
On Fri, 3 Jul 2009, RW wrote: > > I understand that Spamhaus doesn't recommend this, because dynamic IP > addresses can be reassigned from a spambot to another user, but I added > my own rule it does seem to work. In my mail it hits about 9% of my > spam, with zero false-positives. You will get fa

Extending XBL to all untrusted

2009-07-03 Thread RW
I think it might be worth having 2 XBL tests, a high scoring test on last-external and a lower-scoring test that goes back through the untrusted headers. I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, but I added m