Bug 5984 - try out Barracuda BRBL
try out Barracuda BRBL
Status: RESOLVED FIXED
Product: Spamassassin
Classification: Unclassified
Component: Rules
unspecified
Other All
: P5 enhancement
: 3.3.0
Assigned To: SpamAssassin Developer Mailing List
:
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2008-09-22 02:32 UTC by Justin Mason
Modified: 2010-09-14 14:11 UTC (History)
2 users (show)



Attachment Type Modified Status Actions Submitter/CLA Status

Note You need to log in before you can comment on or make changes to this bug.
Description Justin Mason 2008-09-22 02:32:24 UTC
http://www.barracudacentral.org/rbl - 'Barracuda Free Public RBL'.

the T&C's are broadly acceptable, I think:

  'The BRBL is open to public and can be used within reason. Barracuda is
  currently making this service available free of charge and we hope to
  keep it that way. Barracuda Networks does require free registration to
  gain access to the DNSBL. [..]

  Registration is simple and immediate. Please note that this service is
  provided free of charge, therefore Barracuda Networks reserves the right
  to refuse service to spammers, competitors and other parties at the
  company's discretion. This service is provided as is with no warrantee
  of any kind.'


Normally we'd have to pre-register IP addresses, but the Barracuda guys have set up a subzone explicitly for SA queries -- bb.barracudacentral.org.
Comment 1 Justin Mason 2008-09-22 02:38:52 UTC
: jm 11...; svn commit -m "add RCVD_IN_BRBL to test out new Barracuda RBL" rulesrc/sandbox/jm/20_bug_5984.cf
Adding         rulesrc/sandbox/jm/20_bug_5984.cf
Transmitting file data .
Committed revision 697747.


RCVD_IN_BRBL is a new net rule to check this out.
Comment 2 Henrik Krohns 2008-09-22 09:51:42 UTC
I seriously recommend adding -lastexternal to the rule. I'm seeing lots of FPs here for dynamic ips etc sending through ISP hosts. Without knowing what's listed and for how long, I doubt checking other than connecting client is sane. Try both in parallel to see what's the difference.

Comment 3 Justin Mason 2008-09-22 14:38:30 UTC
(In reply to comment #2)
> I seriously recommend adding -lastexternal to the rule. I'm seeing lots of FPs
> here for dynamic ips etc sending through ISP hosts. Without knowing what's
> listed and for how long, I doubt checking other than connecting client is sane.
> Try both in parallel to see what's the difference.

oops -- good point!
Comment 4 Justin Mason 2008-09-25 09:11:15 UTC
I got tired of waiting for the weekly --net mass-check, so did a quick one of my September mail.

T_RCVD_IN_BRBL is looking "deep" into the Received: headers; it didn't do great. T_RCVD_IN_BRBL_LASTEXT, by contrast, looks just at the most external relay. It's looking very reliable, hitting 53% of spam with just 2 FPs!   Better -- those 2 FPs -- I took a look, and actually it turns out both are misfiled spams. ;)


OVERALL    SPAM%     HAM%     S/O    RANK   SCORE  NAME
      0   246621     8760    0.966   0.00    0.00  (all messages)
0.00000  96.5698   3.4302    0.966   0.00    0.00  (all messages as %)

 34.970  36.2127   0.0000    1.000   1.00    1.61  RCVD_IN_SORBS_DUL
  overlap spam: 100% of RCVD_IN_SORBS_DUL hits also hit __RCVD_IN_SORBS;  60% of __RCVD_IN_SORBS hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  97% of RCVD_IN_SORBS_DUL hits also hit __RCVD_IN_ZEN;  39% of __RCVD_IN_ZEN hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  96% of RCVD_IN_SORBS_DUL hits also hit RCVD_IN_PBL;  45% of RCVD_IN_PBL hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  51% of RCVD_IN_SORBS_DUL hits also hit T_RCVD_IN_BRBL;  33% of T_RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  51% of RCVD_IN_SORBS_DUL hits also hit T_RCVD_IN_BRBL_LASTEXT;  35% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  51% of RCVD_IN_SORBS_DUL hits also hit __RCVD_IN_BRBL;  33% of __RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  24% of RCVD_IN_SORBS_DUL hits also hit RCVD_IN_XBL;  32% of RCVD_IN_XBL hits also hit RCVD_IN_SORBS_DUL
  overlap spam:  24% of RCVD_IN_SORBS_DUL hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  30% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_SORBS_DUL

 26.920  27.8764   0.0000    1.000   0.96    2.90  RCVD_IN_XBL
  overlap spam: 100% of RCVD_IN_XBL hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  94% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_XBL
  overlap spam: 100% of RCVD_IN_XBL hits also hit __RCVD_IN_ZEN;  31% of __RCVD_IN_ZEN hits also hit RCVD_IN_XBL
  overlap spam:  79% of RCVD_IN_XBL hits also hit T_RCVD_IN_BRBL;  39% of T_RCVD_IN_BRBL hits also hit RCVD_IN_XBL
  overlap spam:  79% of RCVD_IN_XBL hits also hit T_RCVD_IN_BRBL_LASTEXT;  41% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_XBL
  overlap spam:  79% of RCVD_IN_XBL hits also hit __RCVD_IN_BRBL;  39% of __RCVD_IN_BRBL hits also hit RCVD_IN_XBL
  overlap spam:  71% of RCVD_IN_XBL hits also hit RCVD_IN_PBL;  25% of RCVD_IN_PBL hits also hit RCVD_IN_XBL
  overlap spam:  62% of RCVD_IN_XBL hits also hit __RCVD_IN_SORBS;  28% of __RCVD_IN_SORBS hits also hit RCVD_IN_XBL
  overlap spam:  36% of RCVD_IN_XBL hits also hit RCVD_IN_BL_SPAMCOP_NET;  80% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_XBL
  overlap spam:  32% of RCVD_IN_XBL hits also hit RCVD_IN_SORBS_DUL;  24% of RCVD_IN_SORBS_DUL hits also hit RCVD_IN_XBL
  overlap spam:  29% of RCVD_IN_XBL hits also hit RCVD_IN_SORBS_WEB;  37% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_XBL

 51.400  53.2254   0.0228    1.000   0.96    0.01  T_RCVD_IN_BRBL_LASTEXT
  overlap spam: 100% of T_RCVD_IN_BRBL_LASTEXT hits also hit T_RCVD_IN_BRBL;  95% of T_RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam: 100% of T_RCVD_IN_BRBL_LASTEXT hits also hit __RCVD_IN_BRBL;  95% of __RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  90% of T_RCVD_IN_BRBL_LASTEXT hits also hit __RCVD_IN_ZEN;  54% of __RCVD_IN_ZEN hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  77% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_PBL;  53% of RCVD_IN_PBL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  60% of T_RCVD_IN_BRBL_LASTEXT hits also hit __RCVD_IN_SORBS;  53% of __RCVD_IN_SORBS hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  41% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_XBL;  79% of RCVD_IN_XBL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  41% of T_RCVD_IN_BRBL_LASTEXT hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  75% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  35% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_SORBS_DUL;  51% of RCVD_IN_SORBS_DUL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  24% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_SORBS_WEB;  59% of RCVD_IN_SORBS_WEB hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap spam:  21% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_BL_SPAMCOP_NET;  89% of RCVD_IN_BL_SPAMCOP_NET hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap  ham: 100% of T_RCVD_IN_BRBL_LASTEXT hits also hit T_RCVD_IN_BRBL;   2% of T_RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL_LASTEXT
  overlap  ham: 100% of T_RCVD_IN_BRBL_LASTEXT hits also hit __RCVD_IN_BRBL;   2% of __RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL_LASTEXT

 74.688  77.3365   0.1370    0.998   0.87    0.51  RCVD_IN_PBL
  overlap spam: 100% of RCVD_IN_PBL hits also hit __RCVD_IN_ZEN;  87% of __RCVD_IN_ZEN hits also hit RCVD_IN_PBL
  overlap spam:  63% of RCVD_IN_PBL hits also hit __RCVD_IN_SORBS;  82% of __RCVD_IN_SORBS hits also hit RCVD_IN_PBL
  overlap spam:  53% of RCVD_IN_PBL hits also hit T_RCVD_IN_BRBL;  73% of T_RCVD_IN_BRBL hits also hit RCVD_IN_PBL
  overlap spam:  53% of RCVD_IN_PBL hits also hit T_RCVD_IN_BRBL_LASTEXT;  77% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_PBL
  overlap spam:  53% of RCVD_IN_PBL hits also hit __RCVD_IN_BRBL;  73% of __RCVD_IN_BRBL hits also hit RCVD_IN_PBL
  overlap spam:  45% of RCVD_IN_PBL hits also hit RCVD_IN_SORBS_DUL;  96% of RCVD_IN_SORBS_DUL hits also hit RCVD_IN_PBL
  overlap spam:  25% of RCVD_IN_PBL hits also hit RCVD_IN_XBL;  71% of RCVD_IN_XBL hits also hit RCVD_IN_PBL
  overlap spam:  25% of RCVD_IN_PBL hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  67% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_PBL
  overlap  ham: 100% of RCVD_IN_PBL hits also hit __RCVD_IN_ZEN;   1% of __RCVD_IN_ZEN hits also hit RCVD_IN_PBL

  1.437   1.4881   0.0000    1.000   0.85    1.69  RCVD_IN_NJABL_PROXY
  overlap spam: 100% of RCVD_IN_NJABL_PROXY hits also hit __RCVD_IN_NJABL;  92% of __RCVD_IN_NJABL hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  96% of RCVD_IN_NJABL_PROXY hits also hit __RCVD_IN_ZEN;   1% of __RCVD_IN_ZEN hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  89% of RCVD_IN_NJABL_PROXY hits also hit RCVD_IN_PBL;   1% of RCVD_IN_PBL hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  78% of RCVD_IN_NJABL_PROXY hits also hit __RCVD_IN_SORBS;   1% of __RCVD_IN_SORBS hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  64% of RCVD_IN_NJABL_PROXY hits also hit RCVD_IN_SORBS_DUL;   2% of RCVD_IN_SORBS_DUL hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  56% of RCVD_IN_NJABL_PROXY hits also hit T_RCVD_IN_BRBL;   1% of T_RCVD_IN_BRBL hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  56% of RCVD_IN_NJABL_PROXY hits also hit __RCVD_IN_BRBL;   1% of __RCVD_IN_BRBL hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  52% of RCVD_IN_NJABL_PROXY hits also hit T_RCVD_IN_BRBL_LASTEXT;   1% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  30% of RCVD_IN_NJABL_PROXY hits also hit __DS_DEEP_RCVD_IN_SBLXBL;   1% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_NJABL_PROXY
  overlap spam:  27% of RCVD_IN_NJABL_PROXY hits also hit RCVD_IN_XBL;   1% of RCVD_IN_XBL hits also hit RCVD_IN_NJABL_PROXY

  0.208   0.0000   6.0502    0.000   0.77   -8.00  RCVD_IN_DNSWL_HI
  overlap  ham: 100% of RCVD_IN_DNSWL_HI hits also hit __RCVD_IN_DNSWL;  11% of __RCVD_IN_DNSWL hits also hit RCVD_IN_DNSWL_HI

 21.456  22.2151   0.0799    0.996   0.76    1.12  RCVD_IN_SORBS_WEB
  overlap spam: 100% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_SORBS;  37% of __RCVD_IN_SORBS hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  83% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_ZEN;  20% of __RCVD_IN_ZEN hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  64% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_PBL;  18% of RCVD_IN_PBL hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  60% of RCVD_IN_SORBS_WEB hits also hit T_RCVD_IN_BRBL;  24% of T_RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  60% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_BRBL;  24% of __RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  59% of RCVD_IN_SORBS_WEB hits also hit T_RCVD_IN_BRBL_LASTEXT;  24% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  38% of RCVD_IN_SORBS_WEB hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  28% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  37% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_XBL;  29% of RCVD_IN_XBL hits also hit RCVD_IN_SORBS_WEB
  overlap spam:  20% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_BL_SPAMCOP_NET;  37% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_SORBS_WEB
  overlap  ham: 100% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_DNSWL;   0% of __RCVD_IN_DNSWL hits also hit RCVD_IN_SORBS_WEB
  overlap  ham: 100% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_SORBS;   1% of __RCVD_IN_SORBS hits also hit RCVD_IN_SORBS_WEB
  overlap  ham:  85% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_ZEN;   0% of __RCVD_IN_ZEN hits also hit RCVD_IN_SORBS_WEB
  overlap  ham:  57% of RCVD_IN_SORBS_WEB hits also hit T_RCVD_IN_BRBL;   5% of T_RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_WEB
  overlap  ham:  57% of RCVD_IN_SORBS_WEB hits also hit __RCVD_IN_BRBL;   5% of __RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_WEB
  overlap  ham:  42% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_BL_SPAMCOP_NET;  16% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_SORBS_WEB
  overlap  ham:  42% of RCVD_IN_SORBS_WEB hits also hit __DS_DEEP_RCVD_IN_SBLXBL;   8% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_SORBS_WEB
  overlap  ham:  28% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_DNSWL_MED;   0% of RCVD_IN_DNSWL_MED hits also hit RCVD_IN_SORBS_WEB

  0.110   0.1143   0.0000    1.000   0.73    2.81  RCVD_IN_SBL
  overlap spam: 100% of RCVD_IN_SBL hits also hit __DS_DEEP_RCVD_IN_SBLXBL;   0% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_SBL
  overlap spam: 100% of RCVD_IN_SBL hits also hit __RCVD_IN_ZEN;   0% of __RCVD_IN_ZEN hits also hit RCVD_IN_SBL
  overlap spam:  73% of RCVD_IN_SBL hits also hit T_RCVD_IN_BRBL;   0% of T_RCVD_IN_BRBL hits also hit RCVD_IN_SBL
  overlap spam:  73% of RCVD_IN_SBL hits also hit __RCVD_IN_BRBL;   0% of __RCVD_IN_BRBL hits also hit RCVD_IN_SBL
  overlap spam:  58% of RCVD_IN_SBL hits also hit T_RCVD_IN_BRBL_LASTEXT;   0% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_SBL

  0.109   0.0000   3.1735    0.000   0.69   -4.30  RCVD_IN_BSP_TRUSTED
  overlap  ham:  97% of RCVD_IN_BSP_TRUSTED hits also hit RCVD_IN_DNSWL_MED;  16% of RCVD_IN_DNSWL_MED hits also hit RCVD_IN_BSP_TRUSTED
  overlap  ham:  97% of RCVD_IN_BSP_TRUSTED hits also hit __RCVD_IN_DNSWL;   6% of __RCVD_IN_DNSWL hits also hit RCVD_IN_BSP_TRUSTED

  0.018   0.0182   0.0000    1.000   0.58    1.84  RCVD_IN_NJABL_RELAY
  overlap spam: 100% of RCVD_IN_NJABL_RELAY hits also hit __RCVD_IN_NJABL;   1% of __RCVD_IN_NJABL hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  77% of RCVD_IN_NJABL_RELAY hits also hit T_RCVD_IN_BRBL;   0% of T_RCVD_IN_BRBL hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  77% of RCVD_IN_NJABL_RELAY hits also hit __RCVD_IN_BRBL;   0% of __RCVD_IN_BRBL hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  66% of RCVD_IN_NJABL_RELAY hits also hit __RCVD_IN_ZEN;   0% of __RCVD_IN_ZEN hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  60% of RCVD_IN_NJABL_RELAY hits also hit T_RCVD_IN_BRBL_LASTEXT;   0% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  26% of RCVD_IN_NJABL_RELAY hits also hit __RCVD_IN_SORBS;   0% of __RCVD_IN_SORBS hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  22% of RCVD_IN_NJABL_RELAY hits also hit __DS_DEEP_RCVD_IN_SBLXBL;   0% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_NJABL_RELAY
  overlap spam:  20% of RCVD_IN_NJABL_RELAY hits also hit RCVD_IN_BL_SPAMCOP_NET;   0% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_NJABL_RELAY

 12.100  12.5229   0.2055    0.984   0.56    2.19  RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  95% of RCVD_IN_BL_SPAMCOP_NET hits also hit __RCVD_IN_ZEN;  13% of __RCVD_IN_ZEN hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  93% of RCVD_IN_BL_SPAMCOP_NET hits also hit T_RCVD_IN_BRBL;  20% of T_RCVD_IN_BRBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  93% of RCVD_IN_BL_SPAMCOP_NET hits also hit __RCVD_IN_BRBL;  20% of __RCVD_IN_BRBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  89% of RCVD_IN_BL_SPAMCOP_NET hits also hit T_RCVD_IN_BRBL_LASTEXT;  21% of T_RCVD_IN_BRBL_LASTEXT hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  84% of RCVD_IN_BL_SPAMCOP_NET hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  35% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  80% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_XBL;  36% of RCVD_IN_XBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  61% of RCVD_IN_BL_SPAMCOP_NET hits also hit __RCVD_IN_SORBS;  12% of __RCVD_IN_SORBS hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  46% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_PBL;   7% of RCVD_IN_PBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  37% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_SORBS_WEB;  20% of RCVD_IN_SORBS_WEB hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap spam:  23% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_SORBS_DUL;   8% of RCVD_IN_SORBS_DUL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap  ham: 100% of RCVD_IN_BL_SPAMCOP_NET hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  50% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap  ham: 100% of RCVD_IN_BL_SPAMCOP_NET hits also hit __RCVD_IN_ZEN;   2% of __RCVD_IN_ZEN hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap  ham:  88% of RCVD_IN_BL_SPAMCOP_NET hits also hit T_RCVD_IN_BRBL;  23% of T_RCVD_IN_BRBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap  ham:  88% of RCVD_IN_BL_SPAMCOP_NET hits also hit __RCVD_IN_BRBL;  23% of __RCVD_IN_BRBL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap  ham:  50% of RCVD_IN_BL_SPAMCOP_NET hits also hit __RCVD_IN_DNSWL;   0% of __RCVD_IN_DNSWL hits also hit RCVD_IN_BL_SPAMCOP_NET
  overlap  ham:  33% of RCVD_IN_BL_SPAMCOP_NET hits also hit RCVD_IN_DNSWL_MED;   0% of RCVD_IN_DNSWL_MED hits also hit RCVD_IN_BL_SPAMCOP_NET

  0.012   0.0000   0.3425    0.000   0.54   -0.10  RCVD_IN_BSP_OTHER
  overlap  ham: 100% of RCVD_IN_BSP_OTHER hits also hit __RCVD_IN_DNSWL;   0% of __RCVD_IN_DNSWL hits also hit RCVD_IN_BSP_OTHER
  overlap  ham:  63% of RCVD_IN_BSP_OTHER hits also hit RCVD_IN_DNSWL_MED;   1% of RCVD_IN_DNSWL_MED hits also hit RCVD_IN_BSP_OTHER
  overlap  ham:  60% of RCVD_IN_BSP_OTHER hits also hit RCVD_IN_BSP_TRUSTED;   6% of RCVD_IN_BSP_TRUSTED hits also hit RCVD_IN_BSP_OTHER
  overlap  ham:  36% of RCVD_IN_BSP_OTHER hits also hit RCVD_IN_DNSWL_LOW;   5% of RCVD_IN_DNSWL_LOW hits also hit RCVD_IN_BSP_OTHER

 54.038  55.9291   0.7877    0.986   0.51    0.01  T_RCVD_IN_BRBL
  overlap spam: 100% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_BRBL; 100% of __RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL
  overlap spam:  95% of T_RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL_LASTEXT; 100% of T_RCVD_IN_BRBL_LASTEXT hits also hit T_RCVD_IN_BRBL
  overlap spam:  90% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_ZEN;  57% of __RCVD_IN_ZEN hits also hit T_RCVD_IN_BRBL
  overlap spam:  73% of T_RCVD_IN_BRBL hits also hit RCVD_IN_PBL;  53% of RCVD_IN_PBL hits also hit T_RCVD_IN_BRBL
  overlap spam:  59% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_SORBS;  55% of __RCVD_IN_SORBS hits also hit T_RCVD_IN_BRBL
  overlap spam:  41% of T_RCVD_IN_BRBL hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  79% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit T_RCVD_IN_BRBL
  overlap spam:  39% of T_RCVD_IN_BRBL hits also hit RCVD_IN_XBL;  79% of RCVD_IN_XBL hits also hit T_RCVD_IN_BRBL
  overlap spam:  33% of T_RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_DUL;  51% of RCVD_IN_SORBS_DUL hits also hit T_RCVD_IN_BRBL
  overlap spam:  24% of T_RCVD_IN_BRBL hits also hit RCVD_IN_SORBS_WEB;  60% of RCVD_IN_SORBS_WEB hits also hit T_RCVD_IN_BRBL
  overlap spam:  20% of T_RCVD_IN_BRBL hits also hit RCVD_IN_BL_SPAMCOP_NET;  93% of RCVD_IN_BL_SPAMCOP_NET hits also hit T_RCVD_IN_BRBL
  overlap  ham: 100% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_BRBL; 100% of __RCVD_IN_BRBL hits also hit T_RCVD_IN_BRBL
  overlap  ham:  79% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_ZEN;   6% of __RCVD_IN_ZEN hits also hit T_RCVD_IN_BRBL
  overlap  ham:  60% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_DNSWL;   0% of __RCVD_IN_DNSWL hits also hit T_RCVD_IN_BRBL
  overlap  ham:  33% of T_RCVD_IN_BRBL hits also hit __RCVD_IN_SORBS;   5% of __RCVD_IN_SORBS hits also hit T_RCVD_IN_BRBL
  overlap  ham:  30% of T_RCVD_IN_BRBL hits also hit __DS_DEEP_RCVD_IN_SBLXBL;  58% of __DS_DEEP_RCVD_IN_SBLXBL hits also hit T_RCVD_IN_BRBL
  overlap  ham:  23% of T_RCVD_IN_BRBL hits also hit RCVD_IN_BL_SPAMCOP_NET;  88% of RCVD_IN_BL_SPAMCOP_NET hits also hit T_RCVD_IN_BRBL

very nice indeed.  good to see it doesn't overlap too much with the other BLs.
Comment 5 Justin Mason 2009-03-29 15:04:15 UTC
: 411...; svn commit -m "remove non-lastext variant of RCVD_IN_BRBL, leaving just RCVD_IN_BRBL_LASTEXT" rulesrc/sandbox/jm/20_bug_5984.cf
Sending        rulesrc/sandbox/jm/20_bug_5984.cf
Transmitting file data .
Committed revision 759788.

RCVD_IN_BRBL_LASTEXT is live now.
Comment 6 kd6lvw+software 2010-09-13 14:56:21 UTC
Technical correction (from the docs):  "The 'zone' argument - This is the root zone of the DNSBL, ending in a period." 

The TWO references to this blacklist via check_rbl do not terminate the zone name with a period.

Either the documentation is wrong or we need to fix the rule definition by adding the trailing period.  (file:  updates_spamassassin_org/72_active.cf )

Alternative channel file khop-bl_sa_khopesh_com/khop-bl.cf makes the same mistake.
Comment 7 Mark Martinec 2010-09-13 15:22:19 UTC
I believe the dot is optional as far as the DNS resolving is concerned.
I'm not sure if there is some corner piece of code still relying on the dot.
If there is, it should be fixed IMO and the docs changed, making the
dot officially optional.
Comment 8 Tom Schulz 2010-09-13 15:38:44 UTC
The resolver code is often configured to try to add various suffixes to 
the host name if it does not resolve in an attempt to make it resolve.
A trailing period tells the resolver not to do this. If the name as given
does not resolve, then the resolver just quits.
Comment 9 Kevin A. McGrail 2010-09-13 15:46:57 UTC
(In reply to comment #8)
> The resolver code is often configured to try to add various suffixes to 
> the host name if it does not resolve in an attempt to make it resolve.
> A trailing period tells the resolver not to do this. If the name as given
> does not resolve, then the resolver just quits.

While the dot is optional, we should add it.  I've long since removed search domains out of my resolve.conf just for this issue.
Comment 10 Tom Schulz 2010-09-14 09:03:13 UTC
Should this bug be reopened?
Comment 11 Kevin A. McGrail 2010-09-14 09:10:57 UTC
(In reply to comment #10)
> Should this bug be reopened?

My personal feeling is a new bug should be opened and reference this one.
Comment 12 kd6lvw+software 2010-09-14 14:11:34 UTC
Technicaly, it could be handled that way.  However, noting that the correction is a one character change (in two places) to a ruleset file, I would consider it overkill.  Also, I appended here because it actually relates directly to the existing topic of this bug/feature report.  Therefore, I would suggest reopening as opposed to a separate report because it is this implementation that needs correction.  However, my access here doesn't give me a reopen option.