I've purchased a subscription to the URIBL DNS datafeed and as I understand it, it includes a Gold listing which includes predicted spam domains (day old bread, etc).
I created a new file in /etc/mail/spamassassin called urlblgold.cf with this:
urirhssub URIBL_GOLD multi.uribl.com. A 16
body URIBL_GOLD eval:check_uridnsbl('URIBL_GOLD')
describe URIBL_GOLD Contains an URL listed in the URIBL GOLD greylist
tflags URIBL_GOLD net
# score URIBL_GOLD 3.0
score URIBL_GOLD 1.1
This is pretty much right from the uribl.com datafeed section. I just don't see any hits on it. When I ran LINT on it, I did see it get loaded. Is /etc/mail/spamassassin the correct place to put this? I couldn't find definitions for URIBL_BLACK or I would've put it there.