On Sat, Oct 28, 2006 at 04:35:49PM +0530, Dhawal Doshy wrote:
> Hello List,
>
> I've been using policyd-weight in warn_if_reject mode for a
> couple of weeks and intend on doing so for a few more weeks. So
> far i appear to satisfied with the results.
>
> I already reject based on sbl-xbl and dsbl at the MTA and do
> not intend on changing this behavior. Based on some experience
> and some lookups for listed IP addresses i intend on replacing
> the default dnsbls with these.
>
> # HOST, BAD SCORE, GOOD SCORE, LOG
> NAME
> 'dynablock.njabl.org', 3.25, -1,
> 'DYN_NJABL',
> 'bl.spamcop.net', 3.75, -1.5,
> 'SPAMCOP',
> 'dnsbl.njabl.org', 4.25, -1.5,
> 'BL_NJABL',
> 'relays.ordb.org', 3.25, 0,
> 'ORDB_ORG',
> 'psbl.surriel.com', 4.35, 1, 'PSBL',
> 'spam.tqmcube.com', 3.75, 0,
> 'TQM_SPAM',
> 'ko.tqmcube.com', 4.35, 0,
> 'TQM_KOREA'
> );
>
> Ignore the scores in the above list as that is where i need
> your assistance. What ought to be the basis for scoring of
> these RBLs?
Aggressive/Effective RBLs may add a Good score, i.e. -1.5 or similiar
RBLs which are not that effective but have also zero false positives
may have a high BAD score and a 0 GOOD score
RBLs which are not really trustworthy should have a low BAD score and
0 GOOD score.
> Another thing, how does one use multi-lookup rbls? say one
> composite RBL returning different codes for different listing
> reasons.
We do not score for listing reasons. If the RBL returns
127.0.0.[1|2|3|and so on] we count it as one hit and apply the score of
the RBL. Aynthing else would go too far (we try to keep things as simple as
possible - i.e. less is more).
--
Robert Felber (PGP: 896CF30B)
Munich, Germany
____________________________________________________________
Policyd-weight Mailinglist - http://www.policyd-weight.org/
