Best way to implement sbl-xbl.spamhaus.org in SA 2.63

[ITReading ITReading <IT...@aldridge-borden.com>]

Hello all,
I want to enable SA to query sbl-xbl.spamhaus.org.  I have looked through the 20_dnsbl_tests.cf and read some on the spamhaus site.
It looks like I will need to remove all of the OPM tests to avoid double scoring.  Is this right?

Also, does anyone have a ruleset that will query for all the sbl-xbl.spamhaus.org responses?  (127.0.0.2-6)?

Any general ideas on the best way to implement the sbl-xbl in SA would be appreciated.  I unfortunately cannot enable this DNSBL at the MTA level (I want the messages to get marked up to the user in the rare case of a FP).

Thanks!
Charles

RE: Best way to implement sbl-xbl.spamhaus.org in SA 2.63

[Bret Miller <br...@wcg.org>]

> I want to enable SA to query sbl-xbl.spamhaus.org.  I have 
> looked through the 20_dnsbl_tests.cf and read some on the 
> spamhaus site. It looks like I will need to remove all of the 
> OPM tests to avoid double scoring.  Is this right?
> 
> Also, does anyone have a ruleset that will query for all the 
> sbl-xbl.spamhaus.org responses?  (127.0.0.2-6)?
> 
> Any general ideas on the best way to implement the sbl-xbl in 
> SA would be appreciated.  I unfortunately cannot enable this 
> DNSBL at the MTA level (I want the messages to get marked up 
> to the user in the rare case of a FP).

I would copy the current RCVD_IN_SBL rule and make it RCVD_IN_XBL. Change
the DNSBL address to sbl-xbl.spamhaus.org. then score it how you like AND
score RCVD_IN_SBL 0 so you don't get double marks. 

XBL isn't designed to be run on all received headers. I saw a lot of
false-positives, so don't score it too high. Running it at the MTA level
would get your FPs down to near 0, but then you say you can't do that. It's
actually the only one I use at the MTA level.

Bret