[SURBL-Discuss] Most often "hit" SURBL domains

Jeff Chan jeffc at surbl.org
Thu Sep 30 04:11:02 CEST 2004

On Wednesday, September 29, 2004, 6:59:51 PM, David Funk wrote:
> On Wed, 29 Sep 2004, Jeff Chan wrote:

>> One issue is with the top spammer domains is that unlike the
>> whitehats, the big spammer domains tend to change over time.
>> The biggest spammers also seem to be the most dynamic.
>> So the whitehats may work better with local listing than the
>> blackhats.

> A far better way to effect this is to just increase the TTL on those
> long-term blackhat domains. (A static list is effectively an
> infinitly large TTL, query once and keep for ever).

But did you see my other comments?  The top blackhats change
domains frequently.  The biggest spammers appear to be the ones
to change domains the most often.  Their domains only stay on
the top of the heap for a few days.  So in terms of the biggest
spammers, I don't think there are long term ones.

BIND definitely supports per-record positive TTLs, but rbldnsd
I think doesn't at least in the dnset type of zone files we
use for SURBLs, and the majority of public name servers are
using rbldnsd.

Jeff C.
"If it appears in hams, then don't list it."

More information about the Discuss mailing list