Cyber Dog Posted November 19, 2007 Share Posted November 19, 2007 I'm running a mail server on Ubuntu with a pretty stock spamassassin installation. I usually report any spam that gets through to spamcop. One pattern I've noticed is that many (although certainly not all) spams that get through show up in spamcop as listed in cbl.abuseat.org, even only minutes after arrival. I've grepped through the SA configs, and they include zen.spamhaus.org. A comment above this entry says it includes the abuseat.org CBL... a fact supported by their respective websites. Why, then, would I find it regularly missing these messages (which according to the X-spam-Status headers, were not positively matched in Zen)? Link to comment Share on other sites More sharing options...
turetzsr Posted November 20, 2007 Share Posted November 20, 2007 Hi, Cyber Dog! ...Wow, almost a full day without a reply -- highly unusual! I am significantly less than an expert at spam handling but just so you have some reply: might this inquiry be more appropriate for SpamAssassin staff than for SpamCop users? There seem to be some SpamCop users here who have some knowledge of SpamAssassin but given the fact that no one has chimed in, it could be that this isn't the best place for you to get an answer. ...Good luck! Link to comment Share on other sites More sharing options...
GraemeL Posted November 20, 2007 Share Posted November 20, 2007 The cbl (and njabl) data is added to zen (actually to xbl which is included in zen) by regular zone transfers and not in real time. The xbl FAQ says the transfers happen every 15 minutes. Personally, I only used zen at the MTA for a short time before going back to querying cbl, njabl, pbl and the sbl. Both njabl and cbl are extremely dynamic and I had a noticeable increase in leakage when querying zen. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.