Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Once upon a time, using RBLs to drop mails was actually a good idea. These days seems it is no more possible for a reason or the other, so every one switched / is_switching to just use RBLs as another test in score based antispam solutions (read: SpamAssassin & friends).

This gives good results, but neglects one of the benefits of RBLs, namely the ability to reject (supposed) spam before even receiving the message body.

Is still there any RBL that makes sense to use that way, to hardly reject anything that fires a match in that list? If there are people doing it that way, do you ever get false positives due to the list?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

I still apply certain RBL hits as automatic rejection (CBL, also PBL if not SMTP AUTH'd) -- These lists are relative clean, so I have no qualms about sending "5xx You are listed in [BLACKLIST] visit [URL] for more information" messages to those senders. Other blacklists have been relegated to Score-Modifiers.

I also have a whitelist for one-off overrides in case some business-critical client gets blocked by one of my immediate-reject RBLs, but I haven't had to use that override in over 3 years, and the zone is empty now except for my local systems...

share|improve this answer

There isn't a right or wrong answer to this, except possibly: Your server, your rules.

If you are using a list that you know is very carefully ran by trustworthy people, and whose aims mesh closely with yours then by all means go for it.

share|improve this answer
    
The "trustworthy people" part is key IMHO -- If the list you're using is routinely full of false-positives (even transient ones) bouncing back 5xx messages because of a hit will be more trouble than it's worth. –  voretaq7 Jun 14 '10 at 21:04
    
that's why I asked the question in the first place, to gather from other's experience about the current offerings of RBLs –  Luke404 Jun 14 '10 at 21:06
    
Luke404, Well my opinion is that I wouldn't use any of them to drop mail outright by themselves. But that's just my opinion. I think some of them are less controversial than others, but still. –  RobM Jun 14 '10 at 22:21

First off, not all block lists are equal, yet you are asking the question as if they are. The IP address our email goes out through was at one time checked against some 200 block lists. Only one of those, a Chinese one, had us listed. Should our email therefor be dropped based on that one list or should a more intelligent set of rules apply?

It's far too easy to get on a list, yet can be very difficult to get off some of them. The reasons for being on them range from reasonable to downright absurd. I have in fact reduced the number of lists being checked down to about 20 or so, as the vast majority appear to have little or no credibility. Under the circumstances I cannot and will not accept any one list as authoritative. However, I believe anyone being on several of the major lists no doubt deserves being there and their mail is treated accordingly.

Our mail scanner is currently configured to reject email from any sender that is listed on three or more major lists. Less than that and other filters are applied before a decision is made. This results in us having a very high accuracy rate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.