On 04/01/2015 10:45 PM, Amir Caspi wrote:
Certainly it would be interesting to add such capability to SA (to add points for known spammy DNS providers and/or registrars), though I imagine that could be a recipe for FPs in some cases. Then again, we did it for .pw URIs, so...
You can do it running your private dnsbl (using rbldnsd) and a urifullnsrhssub SA rule.
It's not hard to do - cheap as well as effective.
