From lindsay@pa.net Thu Jul  8 21:39:31 2004
From: Lindsay Snider <lindsay@pa.net>
To: discuss@lists.surbl.org
Subject: Re: [SURBL-Discuss] Submissions to SURBL list thru SARE website.
Date: Thu, 08 Jul 2004 15:39:21 -0400
Message-ID: <40EDA2E9.9090304@pa.net>
In-Reply-To: <20040708192634.GE27275@hesketh.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5034478643574779226=="

--===============5034478643574779226==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Steven Champeon wrote:
> on Thu, Jul 08, 2004 at 03:17:52PM -0400, Chris Santerre wrote:
>=20
>>Good grief. Let me say this slowly....
>>
>>SURBL is for domains in LINKS, URLS, websites, images, things you click on,
>>images hosted in the email.
>>
>>SURBL is NOT, will never be used, doesn't care, /dev/null's, any domain or
>>IP the email came from.=20
>=20
>=20
> Well, I for one won't be sending any more domains along if I have to also
> distinguish between the domains I happened to find in email bodies from
> those I happened to find in message headers. Sorry. The overlap is far too
> great, as for example in a recent message I got (summarized):
>=20
> Received: from mx51.AfClawFrog1.us (mx51.afclawfrog1.us [216.162.182.51])
> Subject: [Target-removed] Free Break-In & Fire Protection System
> Message-ID: <wfbzwsbunaxhmuetqnef(a)mx51.AfClawFrog1.us>
>=20
> [text part with a snippet of fictional text]
>=20
> [html part containing several links to=20
>=20
> <a href=3D"http://medium.AfClawFrog1.us?id=3D[snipped long hash id]

I would suggest that as long as the link is used in the body, you are=20
good for submitting it to surbl.  I believe Chris is implying links only=20
found in headers are unusable for surbl never checks the headers.

>=20
> <img src=3D"http://images.AfClawFrog1.us/images/HomeSecurityProfessionals2_=
r1_c1.gif
> ]
>=20
> I ran a rDNS scan on the netblock and found another 40+ domains all of
> the same type. As they are found in both the body and the message headers,
> I want to be able to block all future mail rather than archiving it; which
> I can do from sendmail. SURBL just lets me filter after acceptance.
>=20
> Sorry, I don't have time to deal with the distinction. Because for me, for
> the most part, there quite simply is no distinction.
>=20

--===============5034478643574779226==--