Most of my experience receiving "certified spam" has been with returnpath. It's still too hard to find how to report abuse (it's not a prominent link on the returnpath.net), and reporting spam that they've certified has been only somewhat satisfactory - a few places have been delisted, but not promptly. To returnpath's credit, it appears that the addresses linkedin uses to send invitation spam to mailinglists have been delisted - but this should have happened within a few business days of the first complaint.
The HOSTKARMA_WL list, on the other hand, seems to be mostly accurate, but more importantly, when I get spam from a host in it, I forward it to supp...@junkemailfilter.com with a delisting request, and almost always the result is the IP address delisted in well under a day (often an hour). With returnpath (BSP/HABEAS), I suspect that there are multiple kinds of entities listed. Some are legitimate transaction mail (e.g. banks sending to addresses they think belong to their customers, and trying to avoid being misfiled), and some are not legitimate. SA takes a statistical approach. For tests and lists where that's a fair description of the world, that's sensible. pay-to-list whitelists break the assumptions, because there are incentives other than avoiding spam at play. Given how slowly pay-to-list whitelists delist spammers, it's clear those effects are substantial. Another complicating factor is spammy mail that is legitimately opt in, and listed in a whitelists. If I choose not to get any of that, then the subset of my mail that's in a pay-to-list whitelist is small and mostly spam. If I did sign up for that sort of mail, it would have more ham. So the notion of a single spam score for all audiences for a whitelist rule is problematic. My conclusions: whitelists that don't take money from people to be on them tend to be ok. It's good to complain to every whitelist about every whitelisted spam received, except maybe dnswl_low when it's reasonably obviously a compromised machine. For people who don't sign up for spammy-seeming opt-in lists, returnpath's whitelist is probably best given a mild positive score (2ish?). I choose to leave it at the default score and complain about certified spam instead. I am unclear on IADB quality.
pgp4bYq8SKp43.pgp
Description: PGP signature
