OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: AOL's 421 on Blacklist

From: /dev/rob0 (rob0gmx.co.uk)
Date: Fri Nov 25 2005 - 15:52:11 CST


On Friday 2005-November-25 15:34, mouss wrote:
> Greg Hackney a écrit :
> > Dunno which particular features AOL uses, but some listers
> > recommend 4xx RBL codes.
>
> who does recommend this?

Specifically me, but only for Spamcop.

> while this is used by some people, nobody
> seems to recommend it "at large". It helps avoiding FPs but adds
> its own problems.

Right. I'd never try it for any RBL in which I felt confident enough to
use for normal rejections, and anything else I would use only in
scoring. The reason I started with the Spamcop 454's is that spam was
getting past policyd-weight from Spamcop-listed sources.

> maps rbl is the last list I would use or tell someone to use.
> There are so many open and safe lists out there.

And then they were bought by Trend Micro! From bad, to worse! :)

> > They recommend a 4xx series code, in order to not lose any legit
> > email, once the block is opened.
>
> Do you have a url that recommends this. This seems bad to me.

Spamcop listings, I believe, time out after 8 hours. The theory is that
false and collateral damage listings will time out and later be
delivered, whereas a spewer which Spamcop caught first (it does
happen!) will eventually make it into XBL or other lists. (And if they
don't, so what? Let them keep retrying; it doesn't bother me.)

> The 4xx trick is
> a "hack", and has its own problems. For instance, the sender
> will wait 4/5 days before knowing that his mail was rejected. I

I turn on delay_warning_time, but yes, otherwise I agree. My Spamcop
thing seems to be working out well, though. I think this strategy is
reasonable for automated RBL's such as Spamcop and the one Greg
described.

BTW it's good to see your posts getting through to the list again. :)
--
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header