SENDER IP CATEGORY

[nicola.piazzi]

If you want to category server that send you emails you can put this code into a cf file
Query is done by default so no extra access to dns will be done
I find it useful to give bad score to Category 15 (Email Marketing Providers)



# DNSWL BY CATEGORY
# SOME CATEGORY NEED BAD SCORE TO STOP MASS MAIL
#
header DNSWL_2 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.2\.\d+$')
describe DNSWL_2 dnswl.org - Category 2 (Financial services)
tflags DNSWL_2 net
score DNSWL_2 0.00
#
header DNSWL_3 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.3\.\d+$')
describe DNSWL_3 dnswl.org - Category 3 (Email Service Providers)
tflags DNSWL_3 net
score DNSWL_3 0.00
#
header DNSWL_4 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.4\.\d+$')
describe DNSWL_4 dnswl.org - Category 4 (Organisations)
tflags DNSWL_4 net
score DNSWL_4 0.00
#
header DNSWL_5 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.5\.\d+$')
describe DNSWL_5 dnswl.org - Category 5 (Service/network providers)
tflags DNSWL_5 net
score DNSWL_5 0.00
#
header DNSWL_6 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.6\.\d+$')
describe DNSWL_6 dnswl.org - Category 6 (Personal/private servers)
tflags DNSWL_6 net
score DNSWL_6 0.30
#
header DNSWL_7 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.7.\d+$')
describe DNSWL_7 dnswl.org - Category 7 (Travel/leisure industry)
tflags DNSWL_7 net
score DNSWL_7 0.30
#
header DNSWL_8 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.8\.\d+$')
describe DNSWL_8 dnswl.org - Category 8 (Public sector/governments)
tflags DNSWL_8 net
score DNSWL_8 0.00
#
header DNSWL_9 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.9\.\d+$')
describe DNSWL_9 dnswl.org - Category 9 (Media and Tech companies)
tflags DNSWL_9 net
score DNSWL_9 0.30
#
header DNSWL_10 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.10\.\d+$')
describe DNSWL_10 dnswl.org - Category 10 (some special cases)
tflags DNSWL_10 net
score DNSWL_10 0.00
#
header DNSWL_11 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.11\.\d+$')
describe DNSWL_11 dnswl.org - Category 11 (Education, academic)
tflags DNSWL_11 net
score DNSWL_11 0.50
#
header DNSWL_12 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.12\.\d+$')
describe DNSWL_12 dnswl.org - Category 12 (Healthcare)
tflags DNSWL_12 net
score DNSWL_12 0.00
#
header DNSWL_13 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.13\.\d+$')
describe DNSWL_13 dnswl.org - Category 13 (Manufacturing/Industrial)
tflags DNSWL_13 net
score DNSWL_13 0.00
#
header DNSWL_14 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.14\.\d+$')
describe DNSWL_14 dnswl.org - Category 14 (Retail/Wholesale/Services)
tflags DNSWL_14 net
score DNSWL_14 0.00
#
header DNSWL_15 eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.15\.\d+$')
describe DNSWL_15 dnswl.org - Category 15 (Email Marketing Providers)
tflags DNSWL_15 net
score DNSWL_15 3.50

[ovizii]

Would you care to share your SA rule hits regarding these rules please? Just curios to see some numbers.

[nicola.piazzi]

DNSWL is a whitelist system so Category 15 (Email Marketing Providers) hits someone that is not a spammer but a legitimate marketing provider that send annoiing messages, so is difficoult to say if a message is a hit

[ovizii]

I understand, I just want to see how many hits each of your categories have accumulated for each of the return codes: https://www.dnswl.org/?page_id=15#returncodes

if you don't mind sharing...