Convert Spamhaus lookups to use local datafeed zone

[Kris Deugau <kd...@vianet.ca>]

I think I found them all, but I'd like to get some more eyes on things 
just to make sure:

# replace stock Spamhaus rules with copies referring to local zones
header          __RCVD_IN_ZEN   eval:check_rbl('zen', 'zen.dnsbl.')
header          RCVD_IN_SBL     eval:check_rbl_sub('zen', '127.0.0.2')
header          RCVD_IN_XBL     eval:check_rbl('zen-lastexternal', 
'zen.dnsbl.', '127.0.0.[45678]')
header          RCVD_IN_PBL     eval:check_rbl('zen-lastexternal', 
'zen.dnsbl.', '127.0.0.1[01]')
uridnsbl        URIBL_SBL       sbl.dnsbl.      TXT

Did I miss any?

-kgd

Re: Convert Spamhaus lookups to use local datafeed zone

[Kris Deugau <kd...@vianet.ca>]

Michael Scheidell wrote:
> just set up a master zone for *.spamhaus.org, then you don't have to 
> change anything.

... until you try to visit their website.  You'd have to set up local 
zen.spamhaus.org, xbl.spamhaus.org, pbl.spamhaus.org, and sbl.spamhaus.org.

Their datafeed FAQ recommends creating a wholly local zone to use for 
your local services;  this also lets you compare the datafeed lookups 
with the public-server lookups while testing or as a crosscheck if the 
datafeed rsync process reports an error.  It also means you're *sure* 
you're using the local copy of the data, not the public mirrors.

Any direct answers to my original question - did I get all of the 
references to zen.spamhaus.org and any sublists?

-kgd

Re: Convert Spamhaus lookups to use local datafeed zone

[Michael Scheidell <sc...@secnap.net>]

> I think I found them all, but I'd like to get some more eyes on things 
> just to make sure:
>
just set up a master zone for *.spamhaus.org, then you don't have to 
change anything.


-- 
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
 > *| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best Anti-Spam Product 2008, Network Products Guide
    * King of Spam Filters, SC Magazine 2008

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________