spamhaus abuse free usage rules

[Benny Pedersen <me...@junc.eu>]

header RCVD_IN_XBL                   eval:check_rbl('zen-lastexternal', 
'zen.spamhaus.org.', '^127\.0\.0\.[4567]$')
header RCVD_IN_PBL                   eval:check_rbl('zen-lastexternal', 
'zen.spamhaus.org.', '^127\.0\.0\.1[01]$')
header RCVD_IN_ZEN_BLOCKED_OPENDNS   eval:check_rbl('zen-lastexternal', 
'zen.spamhaus.org.', '^127\.255\.255\.254$')
header RCVD_IN_ZEN_BLOCKED	     eval:check_rbl('zen-lastexternal', 
'zen.spamhaus.org.', '^127\.255\.255\.255$')

suggested changes :)

add one

header __RCVD_IN_ZEN eval:check_rbl('zen','zen.spamhaus.org.')

too simple ?

header RCVD_IN_XBL eval:check_rbl_sub('zen-lastexternal', 
'^127\.0\.0\.[4567]$')
header RCVD_IN_PBL eval:check_rbl_sub('zen-lastexternal', 
'^127\.0\.0\.1[01]$')
header RCVD_IN_ZEN_BLOCKED_OPENDNS 
eval:check_rbl_sub('zen-lastexternal', '^127\.255\.255\.254$')
header RCVD_IN_ZEN_BLOCKED eval:check_rbl_sub('zen-lastexternal', 
'^127\.255\.255\.255$')

this is the same as for hostkarma

gool, one single dns query and seperate results with return codes

fails ?

fun part is this

header RCVD_IN_SBL_CSS        eval:check_rbl_sub('zen', '127.0.0.3')
describe RCVD_IN_SBL_CSS	Received via a relay in Spamhaus SBL-CSS
tflags RCVD_IN_SBL_CSS	net
reuse  RCVD_IN_SBL_CSS
score RCVD_IN_SBL_CSS 0 3.558 0 3.335 # n=0 n=2

are already using check_rbl_sub

my changes does nothing to datafeed users, but it makes big diffrenses 
to free usage

Re: spamhaus abuse free usage rules

[Henrik K <he...@hege.li>]

On Thu, Jan 12, 2023 at 04:01:02AM +0100, Benny Pedersen wrote:
> 
> my changes does nothing to datafeed users, but it
> makes big diffrenses to free usage

Makes zero difference how the rules are called, SA never sends duplicate
physical queries, they are cached and reused.