On Fri, Jan 03, 2003 at 02:58:09PM -0600, Rich Puhek wrote: > I found that I can't outright block .cn and .kr without some customers > getting very irritated at me. Even if I could, maintaining a whitelist > would be a PITA for entire countries (or, worse, for RBLS like > unconfirmed.ordb.org.). So, I figure rather than just ditching those > RBLs, I've been relying on them with SA, they do help push many > borderline spams over the top.
I'm using a rather involved config (I actually generate the .cf file for spamassassin from a perl script) which adds points to mail for being relayed through any countries on my "hit list". Multiple countries get scored for all of them, and the score varies by country. My "hit list" includes Argentina, Brazil, Chile, China, Costa Rica, Hong Kong, India, Korea (of course), Malaysia, Morocco, the Philippines, Poland, Singapore, Taiwan, Turkey, and Uruguay. This list is really only based on the spam I've received, and it's trivial to add new ones. I check hosts in the Received headers with a regexp, and IP addresses with a DNSBL listing countries (zz.countries.nerd.dk or all.rbl.cluecentral.net). The regexp checks may not even be necessary, but they came first and I haven't tried it without them yet. So this doesn't end up blacklisting countries, but adds score for the bad ones, and more for the worse ones. I also have rules for extra points for HTML mail via one of the listed countries, and for mail via those countries without one of my addresses in To or Cc. Unfortunately, the thing won't work with stock 2.43 due to the issue with the order in which meta rules are evaluated. I've modified mine, but when 2.50 arrives with the real fix, perhaps I can release this stuff if anyone's interested. Spamassassin rocks the party all night long... using the above, plus a couple hundred lines of local.cf, I've had a total of two, maybe three (the third was gray-area) spams in my inbox in the past week with zero false positives. And I've gotten legitimate mail this week from someone in the Philippines, and it got through just fine. :) -Jeremy ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
