Some results of using SURBLs appear in the News section. Detection rates are around 80 to 90%, with false positive rates of the different lists ranging from about 0.001 to 0.05%. We continually work to improve both the detection and false positive rates in a variety of ways. Descriptions of the different SURBL lists and their data sources can be found in the Lists section.
SURBLs are often used in conjunction with other conventional lists, such as those that list open relays, compromised hosts, etc.
In order to use SURBLs you need software that can parse URIs in message bodies, extract their hosts, and check those against a SURBL. Programs such as SpamAssassin 3 and many others now support SURBLs. For a list of some of those applications please see our Links page.
Another issue for some anti-spam or anti-phshing DNS or proxy services that modify the results of DNS queries is that some of those changes may not compatible with SURBL applications. In particular, modification of NXDOMAIN responses can result in false positives due to the changed Address bits in the response. But any modification of the DNS query results can lead to application errors. The solution is to not use DNS or proxy services that modify query results on your systems running SURBL applications.
Additionally some ISPs such as Verizon and others are now modifying some DNS NXDOMAIN responses in a way that causes what look like false positives on domains that are not blacklisted. They appear to be doing this to drive search traffic to other sites, but unfortunately it breaks DNS responses for SURBLs and other blacklists. Please check with your ISP if you are seeing DNS responses modified in this way. Verizon has an opt-out procedure with instructions on switching to DNS servers that do not change NXDOMAIN responses. Others such as Charter have opt-out nameservers that reportedly do not support NXDOMAIN. If so, then none of their nameservers may be compatible. One solution is to not use their nameservers.
These cases are very rare, but worth mentioning if it prevents some confusion.
If you were using SpamCopURI in an earlier version of SpamAssassin, please remove references to it when using SpamAssassin 3. We also recommend discontinuing the use of the BigEvil.cf ruleset if you are using ws.surbl.org, which is enabled by default in SA 3.
SURBLs are used in SpamAssassin 3 by the commands urirhsbl and urirhssub which can be found in the plugin URIDNSBL. The default command urirhssub is the preferred one since it uses SURBLs in the combined form of multi.surbl.org. More information about the SURBL lists combined into multi can be found in the Lists section. An older command urirhsbl would use SURBL lists individually, but it is not configured in the default rules, and it generally should not be used since it's much less efficient.
Important Note Regarding SpamAssassin 3.0.1 and later: When adding URIDNSBL rules, including SURBL or SBL ones using urirhsbl, urirhssub or uridnsbl, be sure to set the rule type to body. For example:urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html tflags URIBL_JP_SURBL net score URIBL_JP_SURBL 3.0This is a change from SpamAssassin 3.0.0, where body above was previously header. Here is the changelog reference:r54022 | felicity | 2004-10-07 22:21:30 +0000 (Thu, 07 Oct 2004) | 1 line bug 3734: uridnsbl rules work on body data, not header data, so change the rule type from header to body
When installing SpamCopURI, please make sure your Net::DNS is current. If you want to use the optional redirection resolution, also make sure that your libwww-perl (LWP) is current.
Important Note: Matt Kettler says: DO NOT run SA 2.63 on a production server. Upgrade to 2.64 or 3.x because 2.63 has a MIME parsing bug that can be used to DoS your server.
Note: If you are using SpamCopURI version 0.22 then please update your configuration to add two recent lists AB and JP. There are also a few typos corrected in this sample configuration.
An SA 3.0.1 and later rule and score using URIBL's urirhssub looks like this:
urirhssub URIBL_JP_SURBL multi.surbl.org. A 64
body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL')
describe URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html
tflags URIBL_JP_SURBL net
score URIBL_JP_SURBL 3.0
An SA 2.63 and 2.64 rule and score using SpamCopURI 0.22 or later
looks like this:
uri JP_URI_RBL eval:check_spamcop_uri_rbl('multi.surbl.org','127.0.0.0+64')
describe JP_URI_RBL Has URI in JP at http://www.surbl.org/lists.html
tflags JP_URI_RBL net
score JP_URI_RBL 3.0
(Note: JP is included in the default configuration of SpamAssassin 3.1,
so it's no longer necessary to manually add the configurations above if
you are using SA 3.1 or later.
It needs to be manually added to versions before 3.1 however.)
For more information about JP and the other SURBL lists, please see the SURBL Lists section. Additional new lists may be added as new data sources emerge. Please check the News and Lists pages for updates.
If your daily mail volume is below 250,000, use the public DNS servers. If your mail volume is above 250,000 per day, use rsync to get the zone files. Thank you.