Conditionally bypassing RBL checks - how?

[Marc Perkel <ma...@perkel.com>]

I have what I call a yellow list which is a list of IP addresses of 
hosts like yahoo, google, hotmail, aol, etc that send a mix of spam and 
nonspam. The idea being that if you are yellow listed then don't check 
any other list because if it was listed it would be a false positive.

So - the question - how would you write a rule to do a yellow list 
lookup and if listed then bypass all other RBL tests? This would 
increase speed and accuracy, and maybe get others inspired to build a 
better yellow list than I have.

Re: Conditionally bypassing RBL checks - how?

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 18.08.07 10:38, Marc Perkel wrote:
> I have what I call a yellow list which is a list of IP addresses of 
> hosts like yahoo, google, hotmail, aol, etc that send a mix of spam and 
> nonspam. The idea being that if you are yellow listed then don't check 
> any other list because if it was listed it would be a false positive.
> 
> So - the question - how would you write a rule to do a yellow list 
> lookup and if listed then bypass all other RBL tests? This would 
> increase speed and accuracy, and maybe get others inspired to build a 
> better yellow list than I have.

add them to trusted networks
-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The 3 biggets disasters: Hiroshima 45, Tschernobyl 86, Windows 95

Re: Conditionally bypassing RBL checks - how?

[Matt Kettler <mk...@verizon.net>]

That won't work.

If you zero the scores of the individual RBLs, then they are disabled.
Period. No meta rule can later re-enable them.

Sorry Marc, but at present, SA doesn't have any direct support for this.
However, you might be able to make use of SA's priority and the
shortcircuit plugin to get the desired effect.

You'd want to set it up the yelowlist RBL's priority just above the
priority of the normal RBLs, and make it shortcircuit around anything of
lower priority.

By default the AWL has the lowest priority (highest number) of 1000. You
could set the yellowlist to a priority of 10000, and all the normal RBLs
you want to bypass to 15000 or so.




Aaron Wolfe wrote:
> Just take away the scores for the individual RBLs, and your yellow
> list as another RBL,  and use metarules to score.
>
> -Aaron
>
>
>
>
> On 8/18/07, Marc Perkel <ma...@perkel.com> wrote:
>   
>> I have what I call a yellow list which is a list of IP addresses of
>> hosts like yahoo, google, hotmail, aol, etc that send a mix of spam and
>> nonspam. The idea being that if you are yellow listed then don't check
>> any other list because if it was listed it would be a false positive.
>>
>> So - the question - how would you write a rule to do a yellow list
>> lookup and if listed then bypass all other RBL tests? This would
>> increase speed and accuracy, and maybe get others inspired to build a
>> better yellow list than I have.
>>
>>
>>     
>
>   

Re: Conditionally bypassing RBL checks - how?

[Aaron Wolfe <aa...@gmail.com>]

Just take away the scores for the individual RBLs, and your yellow
list as another RBL,  and use metarules to score.

-Aaron




On 8/18/07, Marc Perkel <ma...@perkel.com> wrote:
> I have what I call a yellow list which is a list of IP addresses of
> hosts like yahoo, google, hotmail, aol, etc that send a mix of spam and
> nonspam. The idea being that if you are yellow listed then don't check
> any other list because if it was listed it would be a false positive.
>
> So - the question - how would you write a rule to do a yellow list
> lookup and if listed then bypass all other RBL tests? This would
> increase speed and accuracy, and maybe get others inspired to build a
> better yellow list than I have.
>
>