[SURBL-Discuss] When did a specific URL get into SURBL?

[Jeff Chan]

Quoting Kelly Jones <kelly.terry.jones at gmail.com>:

> How can I tell when a specific URL was entered into SURBL? Is there an
> RSS news feed or DNS text record or something that tells this?

That information is not currently available publically.

> My scenario: my tech-savvy user gets an email advertising spammer.com
> and says "I did 'host spammer.com.multi.surbl.org' and SURBL's
> blocking this domain-- why did it get through?".
>
> I want to answer (accurately) "spammer.com is in SURBL *now*, but it
> wasn't when you received the mail-- spammer.com was entered into SURBL
> at xxxx, while the email you forwarded came in earlier, at yyy".
>
> Any way to do this? We seem to get a lot of spam that slips by SURBL,
> but shows up in multi.surbl.org shortly thereafter

We are pretty much always trying to speed up the listings.

> (I realize that
> someone has to receive the spam before a URL can added to SURBL...)

That assumption does not always apply.

> Another interesting use would be figuring out how long to quarantine
> possible spam-- in most cases, holding suspicious emails for just 12
> hours would vastly reduce the amount of spam we get.

Yes, a quarantine and later check may improve spam detection rates, at a
possible cost of some delayed messages.  It may be possible to only quarantine
messages that look suspicious in the first place.  If so the side effects may
be minimized.

Cheers,

Jeff C.