On Friday, January 7, 2005, 9:02:47 PM, List User wrote:
> I have used the following rules (which greatly overlap the existing
> URI
> rules) to drive up scores, while not repeating the same tests or increasing
> the
> scores for existing tests. YMMV, but they work for me (v3.0.x).
> uridnsbl URIBL_COMPLETEWHOIS
> combined-HIB.dnsiplists.completewhois.com. A
> body URIBL_COMPLETEWHOIS
> eval:check_uridnsbl('URIBL_COMPLETEWHOIS')
> describe URIBL_COMPLETEWHOIS Contains an URL listed in the
> combined-HIB.dnsiplists.completewhois.com blocklist
> tflags URIBL_COMPLETEWHOIS net
> urirhssub URIBL_RHS_DSN fulldom.rfc-ignorant.org. A
> 127.0.0.2
> body URIBL_RHS_DSN eval:check_uridnsbl('URIBL_RHS_DSN')
> describe URIBL_RHS_DSN Contains an URL listed in the
> dsn.rfc-ignorant.org blocklist
> tflags URIBL_RHS_DSN net
> urirhssub URIBL_RHS_POST fulldom.rfc-ignorant.org. A
> 127.0.0.3
> body URIBL_RHS_POST eval:check_uridnsbl('URIBL_RHS_POST')
> describe URIBL_RHS_POST Contains an URL listed in the
> postmaster.rfc-ignorant.org blocklist
> tflags URIBL_RHS_POST net
> urirhssub URIBL_RHS_ABUSE fulldom.rfc-ignorant.org. A
> 127.0.0.4
> body URIBL_RHS_ABUSE eval:check_uridnsbl('URIBL_RHS_ABUSE')
> describe URIBL_RHS_ABUSE Contains an URL listed in the
> abuse.rfc-ignorant.org blocklist
> tflags URIBL_RHS_ABUSE net
> urirhssub URIBL_RHS_WHOIS fulldom.rfc-ignorant.org. A
> 127.0.0.5
> body URIBL_RHS_WHOIS eval:check_uridnsbl('URIBL_RHS_WHOIS')
> describe URIBL_RHS_WHOIS Contains an URL listed in the
> whois.rfc-ignorant.org blocklist
> tflags URIBL_RHS_WHOIS net
> urirhssub URIBL_RHS_BOGUSMX fulldom.rfc-ignorant.org. A
> 127.0.0.8
> body URIBL_RHS_BOGUSMX
> eval:check_uridnsbl('URIBL_RHS_BOGUSMX')
> describe URIBL_RHS_BOGUSMX Contains an URL listed in the
> bogusmx.rfc-ignorant.org blocklist
> tflags URIBL_RHS_BOGUSMX net
Hi Paul,
I'm not sure that this is a correct use of urirhssub, which
may have been more suited towards bitmasked lists such as
multi.surbl.org and CBL. In other words, it may only be
useable with power of two results like 127.0.0.2,4,8,16,32.
To be honest I haven't checked how the urirhssub source
code handles other cases. urirhsbl may be more appropriate
if the result codes are not encoded with bitmask positions.
http://www.surbl.org/lists.html#multi
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
