Skip to content

Home

Jump to bottom
Marco Favero edited this page Feb 1, 2018 · 26 revisions

Welcome to the RBL Plugins wiki!

Integration

Intelligent relisting

The Splunk Alert Subscriber and the Spam Learn Observer can relist an item previously delisted. The new expiration time is doubled each time starting from the second relist.

For instance, if you set a list time of 1 day, these are the real expiration times for each relisting of the same item:

  • first: 1 day
  • second: 1 day
  • third: 2 days
  • fourth: 4 days
  • fifth: 8 days
  • ...

If a process try to relist an already listed item the follow action happens:

  • one day is added to the expiration time.
  • the counter of listing times is not updated
  • Reason, user or other fields are updated.

About domain list (uribl)

Popular software as Spamassassin perform domain rbl check. As written in Spamassassin documentation (as 3.4 version):

   An RHSBL zone is one where the domain name is looked up, as a
   string; e.g. a URI using the domain "foo.com" will cause a lookup of
   "foo.com.uriblzone.net". Note that hostnames are stripped from the
   domain used in the URIBL lookup, so the domain "foo.bar.com" will
   look up "bar.com.uriblzone.net", and "foo.bar.co.uk" will look up
   "bar.co.uk.uriblzone.net".

So, add "foo.bar.co.uk" to list is useless, because if a mail contains this domain, Spamassassin will check only "bar.co.uk" in your zone. This is why RBL-Manager validate the input domain against the first upper level domain with NS record, and try to list it.

Clone this wiki locally