Jump to content
Sign in to follow this  
Cyber Dog

Zen/Spamhaus and abuseat.org lookups

Recommended Posts

I'm running a mail server on Ubuntu with a pretty stock spamassassin installation. I usually report any spam that gets through to spamcop. One pattern I've noticed is that many (although certainly not all) spams that get through show up in spamcop as listed in cbl.abuseat.org, even only minutes after arrival. I've grepped through the SA configs, and they include zen.spamhaus.org. A comment above this entry says it includes the abuseat.org CBL... a fact supported by their respective websites. Why, then, would I find it regularly missing these messages (which according to the X-spam-Status headers, were not positively matched in Zen)?

Share this post


Link to post
Share on other sites

Hi, Cyber Dog!

...Wow, almost a full day without a reply -- highly unusual! I am significantly less than an expert at spam handling but just so you have some reply: might this inquiry be more appropriate for SpamAssassin staff than for SpamCop users? There seem to be some SpamCop users here who have some knowledge of SpamAssassin but given the fact that no one has chimed in, it could be that this isn't the best place for you to get an answer.

...Good luck!

Share this post


Link to post
Share on other sites

The cbl (and njabl) data is added to zen (actually to xbl which is included in zen) by regular zone transfers and not in real time. The xbl FAQ says the transfers happen every 15 minutes.

Personally, I only used zen at the MTA for a short time before going back to querying cbl, njabl, pbl and the sbl. Both njabl and cbl are extremely dynamic and I had a noticeable increase in leakage when querying zen.

Edited by GraemeL

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×