Michael Monnerie wrote:
> I generally like the idea. But this project is in the beginners phase, 
> and a whole lot of people will want to wait until others report it's 
> benefits. After all, who wishes to put it in production and then maybe 
> it causes a lot of FPs?

Duh:

score EMAILBL 0.001

*and then see what it hits on your own traffic stream* - hardly rocket
science.  You alone are the person best placed to see if there are any
FPs in your own mail stream and then increase the score as you gain
confidence.  Same way anyone adding rules to SA does this.

> ATM, you use a very conservative e-mail block list feed, meaning no FPs 
> should occur. But as there is currently no exact description of where e-
> mail reports will come from, nobody knows how good the list will be 
> then.

Like 99% of all blacklists out there - the data comes from spam traps
and is not manually added.

> That said, I'll implement and test it, and hopefully it's good, with no 
> FPs.

Great; report your stats here so the effectiveness can be gauged so the
people working on this know whether or not to continue running this list
and expand it to other freemail domains.

> I immeditately see that GMX is currently not listed in EMAILBL. It's a 
> big player in the DACH region (Germany, Austria, Switzerland). They have 
> a hard anti spam setup (e.g. not accepting mails from hosts without 
> reverse IP DNS entries, aka PTR Records), so maybe it's not worth to 
> list them?

Who cares if they have strict blocks on stuff coming in to their network
- an EMAILBL listing is all about whether or not spammers/scammers use
their service for drop-boxes, spew mail out from their service or use
their domain name.  Whereas URIBLs are to score/reject domain names in
e-mail; the EMAILBL is designed to score the *entire* e-mail address, so
it should have way less chance of FPs in the first place.

Regards,
Steve.

Reply via email to