Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you setup blacklists for Microsoft Exchange 2003? For example, RBL or CBL lists mitigating known spam. Is it recommended to maintain several blacklists together? If so, is there a set that should usually be included for any serious production server?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

Regarding blacklists, I recommend that you try to pull the data from the RBL (often via rsync) and do your own sanitizing(1) on the downloaded list and run something like RBLDNSD or Wrbldnsd to serve the blacklist to your mailserver(s). Otherwise you will give away total-control to a third party to choose if you should receive or block a certain mail (depending on configuration). A better idea is to use several RBL's and increase "spaminess" score on each hit.

(1)Things we check for in the downloaded feed and removes if found:

  • Own ip addresses
  • Important customers network
  • Other well known mail-servers
  • Errors, and Internet-wide blocks (has happened)
share|improve this answer
add comment

When we did our own spam and virus filtering, we used spamhaus as our only blacklist.

Since we switched to "Microsoft Forefront Online Security for Exchange" (the name seems to keep getting longer!) a couple of years ago, we don't pay any attention to blacklists any more, they take care of it.

If we had to do spam/virus filtering in-house again, I'd be following most of rkthkr's advice.

("Microsoft Forefront Online Security for Exchange" is the name for the spam/virus filtering component of "Microsoft Exchange Hosted Services" which is what MS originally called "Frontbridge" when they bought them and then Frontbridge was originally called "Bigfish" when it started.)

share|improve this answer
add comment

We are using the following RBL Service Providers with good results in an exchange scenario but throught ASSP anti-Spam Proxy along with bayesian filtering and withelisting for our important partners:

  • zen.spamhaus.org
  • list.dsbl.org
  • dul.dnsbl.sorbs.net

  • share|improve this answer
        
    A heads up on SORBS, SORBS are having problems getting a new hosting provider and risks of being shut down 20th July 2009 at 12 noon. us.sorbs.net –  rkthkr Jun 26 '09 at 6:39
        
    Sad news, thanks for the info. –  Maxwell Jun 26 '09 at 6:53
    add comment

    Your Answer

     
    discard

    By posting your answer, you agree to the privacy policy and terms of service.

    Not the answer you're looking for? Browse other questions tagged or ask your own question.