After trying DNS TTLs at 1 hour, 25, 20, 15 and 10 minutes,
it appears that 15 minute TTLs optimizes both name server
traffic and the quickness of records being added or deleted
from the lists. Therefore, we are standardizing on 15 minute
TTLs for all SURBLs.
Note that this result applies to SURBL data and uses of it.
It may or may not apply to other types of RBLs.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
We'd like to welcome and thank the addition of a new public SURBL
name server administered by:
Chris Stone of AxisInternet, Inc.
Without all of our public nameservers and the help of their
administrators, SURBLs would not be possible.
Our thanks to all of them!
Some additional name server news: all of the name servers which
we had temporarily commented out while they were being repaired
have been fully returned to service. A name server status page
can be found at:
http://www.surbl.org/nameservers-output.html
Also in case we haven't already mentioned it, the name servers
are now organized into letter names like a.surbl.org,
b.surbl.org, ... through n.surbl.org, and each name round robins
into two or three servers. As more are added, we will try to
balance them all at three servers per name, so that traffic is
balanced overall. Having more than one server per name lets us
comment one out without needing to change NS records in the
subdomain zone files and delegations, when maintenance on a
particular name server needs to be done, etc. It also keeps the
SURBL DNS packets smaller to have fewer name servers listed in
the NS records.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
To follow up on an earlier announcement, in addition to a list of
the top SURBL DNS queries that hit whitelists:
http://www.surbl.org/dns-queries.whitelist.counts.txt
we've added a list of the top blocklist hits:
http://www.surbl.org/dns-queries.blocklist.counts.txt
Though the sample size is somewhat small at 32k queries over
the trailing 48 hours, the data may perhaps be useful for
expiring records from blocklists or checking whitelists.
We can increase the sample size if anyone thinks it worthwhile.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Martijn Jongen has added SURBL support to ORFilter, a
free-ware Exchange plug in.
http://martijnjongen.com/orfilter
It works with SMTP server, Exchange Server 2000 and 2003 under
Windows 2000, 2003, XP.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
We've made a list of the top SURBL DNS queries into my name server:
http://www.surbl.org/dns-queries.counts.txt
and a version with only whitelist hits:
http://www.surbl.org/dns-queries.whitelist.counts.txt
The sample size is somewhat small at 32k queries over the last 48
trailing hours, but it's still somewhat interesting. Specifically
2000 queries are sampled every 3 hours. (Please ignore some of
the junk at the end of the unwhitelisted counts. That's stuff
left over from DNS packets which I haven't cleaned out yet.)
I'm slightly surprised how high in the total rankings some spam
domains are. That represents a huge amount of spam sent and
blocked. :-)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
(forwarded:)
From: Ryan Thompson <ryan(a)sasknow.com>
Date: Monday, September 6, 2004, 5:50:46 PM
Subject: Announce: GetURI 1.5 Released -- Major additions
Web site URL: http://ry.ca/geturi/
I'm extremely pleased to announce the release of GetURI 1.5. This is a
major new release that includes many new features to aid in the fight on
spam. GetURI is a program designed to make identification and hand-
classification of URIs easier.
This new version supports spam *and* ham message directories, enabling
you to include ham messages in your checks, to quickly identify domains
which appear in ham. Previously, only spam messages could be fed to
GetURI.
Those processing spamtraps, or hand-checking submitted domains for
blacklisting or whitelisting will be pleased to know that GetURI now
supports two new options: --hamdomains, and --spamdomains, which accept
filenames containing simple lists of domains that appear in ham and
spam.
If fed any kind of ham domains, GetURI will look for and produce a list
of false positives: domains listed in SURBL that appear in ham.
New experimental code has been added to automatically determine the age
of domains being checked, which has so far been a huge help for
hand-classifying domains. This is done in the nicest way possible, but
it uses public whois, and, as such, may violate some whois servers'
terms of service, so --age must be specified explicitly.
A new utility, uricat, has been added to produce simple lists of URIs
found in one or more text files.
Full change history: http://ry.ca/geturi/CHANGELOG
Updated Sample results: http://ry.ca/geturi/results.html
Documentation and download: http://ry.ca/geturi/
As always, your feedback is most welcome!
- Ryan
--
Ryan Thompson <ryan(a)sasknow.com>
SaskNow Technologies - http://www.sasknow.com
901-1st Avenue North - Saskatoon, SK - S7K 1Y4
Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon
Toll-Free: 877-727-5669 (877-SASKNOW) North America
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Hello!
Currently we are running with a somehow frozen ws.surbl.org list. We are
experiencing hardware trouble with one of the SURBL machines. New updates
will be processed, but most likely activated after we restore full
functionality.
The main SURBL site is not afffected, its only related to the WS updates.
We are working hard to get the processing box back online.
Bye,
Raymond Dijkxhoorn - WS SURBL.
Bob Apthorpe has written an open source Posix text filter that
calls SpamAssassin:
http://www.cynistar.net/~apthorpe/code/babycart/babycart.html
It is useful as a general spam check on arbitrary text for
example from a wiki or blog. It can be used with SURBLs,
RBLs or any other SpamAssassin rules.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/