At 14:38 2004-08-15 -0400, Rob McEwen wrote:
Given Raymond and other's suggestions, I have set up a new test. I now filter at the MTA level using list.dsbl.org.
My personal experience is actually that list.dsbl.org generates more serious FPs than either SBL or XBL/CBL. They have a history of occasionally listing outgoing ISP mail servers and de-listing of those taking a couple of days. I have never seen that happen on XBL/CBL.
Finally, (...and this is the point of this message...) my fourth level is to filter on the ClientIP using each SpamHaus feed separately.
You might consider using SBL, CBL and OPM separately, rather than SBL and XBL separately. In my experience, there is/was a certain delay between entries being added/removed to/from the origin lists CBL and OPM, and those entries being mirrored to XBL. With newly introduced trojaned home computers, that slight delay might mean spam getting through or not.
Patrik