Re: Extending XBL to all untrusted

2009-07-13 Thread Tony Finch
On Fri, 3 Jul 2009, RW wrote: I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, but I added my own rule it does seem to work. In my mail it hits about 9% of my spam, with zero false-positives. You will get false

Re: Extending XBL to all untrusted

2009-07-13 Thread Matus UHLAR - fantomas
On Fri, 3 Jul 2009, RW wrote: I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, but I added my own rule it does seem to work. In my mail it hits about 9% of my spam, with zero false-positives. On 13.07.09

Re: Extending XBL to all untrusted

2009-07-13 Thread rich...@buzzhost.co.uk
On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: On Fri, 3 Jul 2009, RW wrote: I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, but I added my own rule it does seem to work. In my mail it

Re: Extending XBL to all untrusted

2009-07-13 Thread Ned Slider
RW wrote: I think it might be worth having 2 XBL tests, a high scoring test on last-external and a lower-scoring test that goes back through the untrusted headers. I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user,

Re: Extending XBL to all untrusted

2009-07-13 Thread Matus UHLAR - fantomas
On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: On Fri, 3 Jul 2009, RW wrote: I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, but I added my own rule it does seem to work. In my mail

Re: Extending XBL to all untrusted

2009-07-13 Thread rich...@buzzhost.co.uk
On Mon, 2009-07-13 at 18:28 +0200, Matus UHLAR - fantomas wrote: On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: On Fri, 3 Jul 2009, RW wrote: I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to

Re: Extending XBL to all untrusted

2009-07-13 Thread rich...@buzzhost.co.uk
On Mon, 2009-07-13 at 17:38 +0100, rich...@buzzhost.co.uk wrote: On Mon, 2009-07-13 at 18:28 +0200, Matus UHLAR - fantomas wrote: On Mon, 2009-07-13 at 17:19 +0200, Matus UHLAR - fantomas wrote: On Fri, 3 Jul 2009, RW wrote: I understand that Spamhaus doesn't recommend this, because

Re: Extending XBL to all untrusted

2009-07-13 Thread Justin Mason
On Fri, Jul 3, 2009 at 22:43, RWrwmailli...@googlemail.com wrote: I think it might be worth having 2 XBL tests, a high scoring test on last-external and a lower-scoring test that goes back through the untrusted headers. I understand that Spamhaus doesn't recommend this, because dynamic IP

Re: Extending XBL to all untrusted

2009-07-13 Thread McDonald, Dan
On Mon, 2009-07-13 at 17:38 +0100, rich...@buzzhost.co.uk wrote: On Mon, 2009-07-13 at 18:28 +0200, Matus UHLAR - fantomas wrote: On 13.07.09 16:26, rich...@buzzhost.co.uk wrote: Do the RFC's state that they need to? yes, RFC4954 in section 7 does Where - I don't see it say it needs

Re: Extending XBL to all untrusted

2009-07-13 Thread Rob McEwen
I agree so strongly about not checking against all IPs in the header that I'll probably turn down business from large anti-spam vendors who cannot guarantee in writing that ivmSIP and ivmSIP/24 will ONLY be checked against the actual sending IP. If this means I lose 4-5 figures in annual revenue

Re: Extending XBL to all untrusted

2009-07-13 Thread RW
On Mon, 13 Jul 2009 17:21:36 +0100 Ned Slider n...@unixmail.co.uk wrote: I do a very similar thing and see very similar results to yours. I use zen.spamhaus to block at the smtp level and then run all headers through sbl-xbl for a further few points. As already mentioned elsewhere in this

Extending XBL to all untrusted

2009-07-03 Thread RW
I think it might be worth having 2 XBL tests, a high scoring test on last-external and a lower-scoring test that goes back through the untrusted headers. I understand that Spamhaus doesn't recommend this, because dynamic IP addresses can be reassigned from a spambot to another user, but I added