Re: How to incorporate network blocks

[Grant Taylor via users]

On 11/10/22 9:54 AM, Joey J wrote:

Hello All,


Hi,

I'm trying to see if there is a way to incorporate network ranges into 
SA to essentially flag messages.


N.B. at least one of the lists below is individual IPs and not networks 
/ ranges of IPs.  --  I'm not sure how to square that peg with your 
wants / needs.


I know I can use iptables and reject it before getting to SA, but in 
some cases we would have legit email get flagged within these bigger blocks.


I would suggest investigating the other offerings from each vendor.  I 
suspect there is a good chance that many, if not all, of them offer a 
DNS based query method.


See Riccardo's comment about Spamhaus / Spamteq.


I'm trying to incorporate:
feeds.dshield.org/block.txt
spamhaus.org/drop/drop.lasso
ciarmy.com/list/ci-badguys.txt
openbl.org/lists/base.txt
Short of that, it wouldn't be hard to turn them into a locally hosted BL 
and then configure SpamAssassin to query it.




--
Grant. . . .
unix || die



smime.p7s
Description: S/MIME Cryptographic Signature

Re: How to incorporate network blocks

[Riccardo Alfieri]

Hi,

I can't speak for the other feeds, but for our (DROP), if you register a 
DQS key and install our plugin it would work out of the box




On 10/11/22 17:54, Joey J wrote:


I'm trying to incorporate:
feeds.dshield.org/block.txt 
spamhaus.org/drop/drop.lasso 
ciarmy.com/list/ci-badguys.txt 
openbl.org/lists/base.txt 



--
Best regards,
Riccardo Alfieri

Spamhaus Technology
https://www.spamhaus.com/

How to incorporate network blocks

[Joey J]

Hello All,

I'm trying to see if there is a way to incorporate network ranges into SA
to essentially flag messages.

I know I can use iptables and reject it before getting to SA, but in some
cases we would have legit email get flagged within these bigger blocks.

I'm trying to incorporate:
feeds.dshield.org/block.txt
spamhaus.org/drop/drop.lasso
ciarmy.com/list/ci-badguys.txt
openbl.org/lists/base.txt

Thanks!

-- 
Thanks!
Joey

Re: Spamhaus DQS usage portal update frequency?

[Riccardo Alfieri]

Hi,

the graph is daily usage over the last 14 days, so it is updated daily 
with usage from the previous 24 hours.


On 09/11/22 19:54, AJ Weber wrote:

Does anyone know how often the DQL usage tab is updated by spamhaus?

I believe my SA was misconfigured, and didn't have anything showing 
for usage.  I think this is fixed now and sent test emails from their 
"Blocklist Tester Verification" tool.  All emails were correctly 
categorized as SPAM, and I see the relevant headers referring to the 
Spamhaus rules in them.


However, I still do not see any usage reflected in the portal at all.  
So I'm just trying to determine whether my config is correct now.


Thanks in advance,

AJ


--
Best regards,
Riccardo Alfieri

Spamhaus Technology
https://www.spamhaus.com/