[SURBL-Discuss] RE: Start an IP list to block?

Chris Santerre csanterre at merchantsoverseas.com
Thu Sep 9 23:23:56 CEST 2004

>-----Original Message-----
>From: Matt Kettler [mailto:mkettler at evi-inc.com]
>Sent: Thursday, September 09, 2004 5:18 PM
>To: Chris Santerre; SURBL Discussion list (E-mail)
>Cc: Spamassassin-Talk (E-mail)
>Subject: Re: Start an IP list to block?
>At 04:56 PM 9/9/2004, Chris Santerre wrote:
>>So is there a way to use the IP info in a good way? Could SA 
>or SURBL do a
>>quick ping of the URL and match against a URL? This would 
>allow us to simply
>>list 1 IP instead of all these domains.
>Chris, SA 3.0 appears to already support checking DNS 
>blacklisting of URLs 
>based on resolved IP. (as well as surbl-style based on domain 
>name). So 
>theoretically, SURBL could open up a separate list based on 
>IP's (i.e.: 
>Take a look at the example where it checks the resolved IP of 
>a URL against 
>the SBL (an IP based list):
>         uridnsbl        URIBL_SBL       sbl.spamhaus.org.       TXT
>         header          URIBL_SBL       
>         describe        URIBL_SBL       Contains a URL listed 
>in the SBL 
>         tflags          URIBL_SBL       net
>and from URIDNSBL.pm:
>         This works by analysing message text and HTML for 
>URLs, extracting the
>         domain names from those, querying their NS records in 
>DNS, resolving
>         the hostnames used therein, and querying various DNS 
>blocklists for
>         those IP addresses.  This is quite effective.
>         SYNOPSIS
>         loadplugin    Mail::SpamAssassin::Plugin::URIDNSBL
>         uridnsbl      URIBL_SBLXBL    sbl-xbl.spamhaus.org.   TXT

OOOOOOHHHHH yeah! I didn't know that! Are we sure this is actually what it
means and not just a miss-syntaxed paragraph? It actually resolves the IP
against the RBL lookup?

If so....well then...problem solved, and devs get a cookie :)

--Chris (todays choices are: Oreo or NutterButter.)

More information about the Discuss mailing list