From: Jorey Bump (listjoreybump.com)
Date: Fri Dec 01 2006 - 08:13:57 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Carlos Eduardo R. L. de Miranda wrote:

> Our server is receiving lots of spam messages from servers with Russian
> domain.
> I would like to block every message from Russian domains.

If you must block by country, use an RBL:

  http://countries.nerd.dk/

However, I find such RBLs more useful in a scoring system. Here's what I
do in my SpamAssassin local.cf (watch the wrap):

# first discover country code of origin using a TXT lookup
header RCVD_COUNTRIES eval:check_rbl_txt('nerd-zz',
'zz.countries.nerd.dk.')
describe RCVD_COUNTRIES Received from countries.nerd.dk
tflags RCVD_COUNTRIES net
# All countries get a point by default
score RCVD_COUNTRIES 1.0

# now do a subtest based on the resulting lookup
# adjust score apropriately for your user base

# Remove the penalty for my own country, the source of most of my mail
header RCVD_VIA_US eval:check_rbl_sub('nerd-zz', 'us')
describe RCVD_VIA_US Received from United States
tflags RCVD_VIA_US net
score RCVD_VIA_US -1.0

# Remove the penalty for other countries I'm likely to correspond with
header RCVD_VIA_CANADA eval:check_rbl_sub('nerd-zz', 'ca')
describe RCVD_VIA_CANADA Received from Canada
tflags RCVD_VIA_CANADA net
score RCVD_VIA_CANADA -1.0

# Add additional points for countries that are common sources of spam
header RCVD_VIA_RUSSIA eval:check_rbl_sub('nerd-zz', 'ru')
describe RCVD_VIA_RUSSIA Received from Russia
tflags RCVD_VIA_RUSSIA net
score RCVD_VIA_RUSSIA 1.0

header RCVD_VIA_NIGERIA eval:check_rbl_sub('nerd-zz', 'ng')
describe RCVD_VIA_NIGERIA Received from Nigeria
tflags RCVD_VIA_NIGERIA net
score RCVD_VIA_NIGERIA 3.0

I stick with SpamAssassin's default required_score of 5.0 before a
message is marked spam. Note that I don't assign scores that will
automatically mark a message as spam (and SpamAssassin scores are not
merely additive, negative points are also assigned by some rules). While
I do believe that the country of origin can be an indicator of
*potential* spamminess, I try to choose weights that will put the score
over the top only when combined with other reliable indicators. Also,
the situation is constantly improving in some countries, so you
shouldn't just set and forget this.

Be sure to consider your user base. I have clients whose focus is
entirely international, so obviously I do not employ this technique on
their sites.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]