On Oct 18, 2008, at 9:29 AM, Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
The following are my numbers for the last few days. Cosider that SURBL blocks happen after a very complete envelope filtering ruleset: Spamhaus, Spamcop, local DNSBLs and sender domain filters, several HELO-based filters, header-checks against known spamware patterns and so on.
So, every SURBL block probably happens where no envelope-based or header-based rule applies, like in botnet spam relayed through legit mailservers; even if the overall numbers are low, those blocks are nontheless vital for the ruleset, since SURBL blocks are only followed by our local URI-based DNSBL and AV scans.
I'm just reporting numbers of total reject, spamhaus rejects (each sub-list happening in different parts of the ruleset, not querying Zen as a whole...) and SURBL rejects:
Day Rejects Spamhaus SURBL 2008-10-07 1420832 1120226 9686 2008-10-09 1490590 1186971 11489 2008-10-10 1705009 1348736 8556 2008-10-11 1526548 1210702 2663 2008-10-12 1074636 863936 2919 2008-10-13 1171171 916355 2826 2008-10-14 1312566 1015615 2540 2008-10-15 1344592 1039028 2430 2008-10-16 2072244 1690267 2678 2008-10-17 1053814 823683 2345
HTH
Bye!