Current test results

nobaloney

nobaloney

NoBaloney Internet Svcs - In Memoriam †
Joined
Jun 16, 2003
Messages
26,113
Location
California
Currently my private test copy of SpamBlocker3 is running the following blocklists with the following results:
Code: 
SPAMHAUS	sbl.spamhaus.org	5947	88.23%
NJABL		dnsbl.njabl.org		  25	 0.37%
CBL		cbl.abuseat.org		   9	 0.13%
SORBS		safe.dnsbl.sorbs.net	 381	 5.65%
DSBL		list.dsbl.org		  14	 0.21%
SPAMCOP		bl.spamcop.net		 209	 3.10%
SPAMCANNIBAL	bl.spamcannibal.org	 155	 2.30%
					====	======
TOTAL REJECTED BY BLOCKLISTS		6740	99.99%
TOTAL REJECTED FOR OTHER REASONS       36215	80.41%
TOTAL EMAILS DELIVERED			8821	19.59%
TOTAL EMAILS REJECTED OR DELIVERED     45036	100%
Based on these results I've just removed both SORBS and SPAMCOP (since they're both considered controversial) and will have some new results in about 48 hours for comparison purposes.

We're moving along.

Should be done real soon now.

Jeff
 
Jeff do you have a script that produces that output? I know I could write one myself grep'ing the log but I thought I would cheat if I could.
 
jlasman said:
Based on these results I've just removed both SORBS and SPAMCOP (since they're both considered controversial) and will have some new results in about 48 hours for comparison purposes.
Jeff
Click to expand...

For those of us that are using spamblocker2 ... can we also stop using SORBS and SPAMCOP be commenting out the lines:

# deny using sorbs smtp list
deny message = Email blocked by SORBS - to unblock see http://www.example.com/
# only for domains that do want to be tested against RBLs
domains = +use_rbl_domains
dnslists = dnsbl.sorbs.net=127.0.0.5

# deny using spamcop
deny message = Email blocked by SPAMCOP - to unblock see http://www.example.com/
hosts = !+relay_hosts
domains = +use_rbl_domains
!authenticated = *
dnslists = bl.spamcop.net

Thanks

Thom
 
floyd said:
Jeff do you have a script that produces that output? I know I could write one myself grep'ing the log but I thought I would cheat if I could.
Click to expand...
Nope; I just do some greps:
Code: 
# Local Deliveries
grep "T=virtual_localdelivery" mainlog | grep "2007-05-24" --count

# Local Rejected in rejectlog
[root@da12 exim]# grep "2007-05-24" rejectlog --count

# Local Rejected per blocklist
grep BLOCKLIST rejectlog | grep 2007-05-24 --count
and then a bit of cutting/pasting into my kwrite window (windows users can use notepad :) ).

Jeff
 
Sure (be sure to restart exim), but results were mixed; see my post on details for 26-Jan-2007 below.

And Thom, don't you just love how much easier exim.conf is to manage then sendmail.cf ?

Jeff
 
don't you just love how much easier exim.conf is to manage then sendmail.cf
Click to expand...

I know I do. Exim can be tough for me at times but at least its more readable text than special symbols.
 
The previous results were for 24-May-2007. Here are the results for 26-May-2007:
Code: 
SPAMHAUS	sbl.spamhaus.org	5749	95.61%
NJABL		dnsbl.njabl.org		  25	 0.42%
CBL		cbl.abuseat.org		   4	 0.07%
SORBS		safe.dnsbl.sorbs.net	NOT IN USE
DSBL		list.dsbl.org		  51	 0.85
SPAMCOP		bl.spamcop.net		NOT IN USE
SPAMCANNIBAL	bl.spamcannibal.org	 184	 3.06
					====	======
TOTAL REJECTED BY BLOCKLISTS		6013	100.01%
TOTAL REJECTED FOR OTHER REASONS       36206	86.58%
TOTAL EMAILS DELIVERED			6543	13.42
TOTAL EMAILS REJECTED OR DELIVERED     48762	100%
Please feel free to comment on what you think the results show.

Jeff
 
jlasman said:
Sure (be sure to restart exim), but results were mixed; see my post on details for 26-Jan-2007 below.

And Thom, don't you just love how much easier exim.conf is to manage then sendmail.cf ?

Jeff
Click to expand...

Sure do....Sendmail was "interesting" to say the least.

Thom
 
Here are the test results for May 27th. This is a bit more full a listing; I had made a few shortcuts in the above listing which made them a bit unspecific.
Code: 
blocklist catch for 2007-05-27:
======================================================
SPAMHAUS	sbl.spamhaus.org	5875	96.58%
NJABL		dnsbl.njabl.org		  26	 0.43%
CBL		cbl.abuseat.org		   2	 0.03%
SORBS		safe.dnsbl.sorbs.net	NOT IN USE
DSBL		list.dsbl.org		  32	 0.53%
SPAMCOP		bl.spamcop.net		NOT IN USE
SPAMCANNIBAL	bl.spamcannibal.org	 148	 2.43%
					====	======
TOTAL REJECTED BY BLOCKLISTS		6083	100.00%
======================================================
TOTAL REJECTED BY BLOCKLISTS		6083	13.42%
TOTAL REJECTED FOR OTHER REASONS       39261	86.58%
					====	======
TOTAL REJECTED			       45344	100.00%
======================================================
TOTAL REJECTED			       45344	87.14%
TOTAL EMAILS DELIVERED			6692	12.86%
======================================================
TOTAL EMAILS REJECTED OR DELIVERED     52036	100.00%
Note that I'm still waiting for comments.

Jeff
 
jlasman said:
Here are the test results for May 27th. This is a bit more full a listing; I had made a few shortcuts in the above listing which made them a bit unspecific.
Code: 
blocklist catch for 2007-05-27:
======================================================
SPAMHAUS	sbl.spamhaus.org	5875	96.58%
 				====	======
======================================================
TOTAL REJECTED BY BLOCKLISTS		6083	13.42%
TOTAL REJECTED FOR OTHER REASONS       39261	86.58%
					====	======
TOTAL REJECTED			       45344	100.00%
======================================================
TOTAL REJECTED			       45344	87.14%
TOTAL EMAILS DELIVERED			6692	12.86%
======================================================
TOTAL EMAILS REJECTED OR DELIVERED     52036	100.00%
/
Looks like SPAMHAUS catches most of the blcoklist stuff

What are the "Other Reasons" ? Open Relay? Malformed Headers?

I'm sure it's not proactical, but it would be interesting to know how many of the 6692 delivered messages might be classified as spam by a human.

Amazing, 87% garbage!

Thom
Click to expand...
Click to expand...
 
My results show that CBL is the major source for blocking email at about 40%. I have about 15% to 18% email being delivered. I just added SPAMCANNIBAL today to see what that does to the stats. We've been using nolisting for the last month and have noticed about 25% less log volume.
 
byteman, did you change the order of the blocklists? Which version of SpamBlocker are you using? I'm using a private beta version of SpamBlocker3. And yes, I also use nolisting on this server. My savings were a lot more than 25%.

Thom, other reasons are as you surmised.

I can't tell you how many of these emails might be classified as spam by a human because this server manages a lot of domains besides my own, but I find approximately 40 or so spams in my inboxes every day; about 10% of my personal incoming email is still spam.

Jeff
 
No I didn't change the order of the black lists... Spamhaus comes before CBL.

The Spamblocker is version 3.0beta which I obtained from you.

Best,
Tom
 
Here are the results for 28-May-2007. They're for Monday, which was a holiday in the U.S. The first test I ran was for 24-May-2007. The results for Tuesday, 29-May-2007 will be a better comparison because they're both non-holiday weekdays.

However, the results for 31-May-2007, which will be the same weekday as well, will be the best comparison; I'll post it on 1-June-2007.

Here are the results for 28-May-2007:
Code: 
blocklist catch for 2007-05-28:
======================================================
SPAMHAUS	sbl.spamhaus.org	6019	96.24%
NJABL		dnsbl.njabl.org		  22	 0.35%
CBL		cbl.abuseat.org		   2	 0.03%
SORBS		safe.dnsbl.sorbs.net	NOT IN USE
DSBL		list.dsbl.org		  43	 0.69%
SPAMCOP		bl.spamcop.net		NOT IN USE
SPAMCANNIBAL	bl.spamcannibal.org	 168	 2.69%
					====	======
TOTAL REJECTED BY BLOCKLISTS		6254	100%
======================================================
TOTAL REJECTED BY BLOCKLISTS		6254	12.14%
TOTAL REJECTED FOR OTHER REASONS       45255	87.84%
					====	======
TOTAL REJECTED			       51519	100%
======================================================
TOTAL REJECTED			       51519	87.48%
TOTAL EMAILS DELIVERED			7376	12.52%
======================================================
TOTAL EMAILS REJECTED OR DELIVERED     58895	100%

While I'll wait until the first to make a decision, I think we'll be putting safe.dnsbl.sorbs.net back into the mix.

Jeff
 
Can I ask a silly question, since zen.spamhaus.org is a combination of the follow, couldn't that be used instead. ( re: http://www.spamhaus.org/zen/ )

ie: sbl.spamhaus.org + dnsbl.njabl.org + cbl.abuseat.org = zen.spamhaus.org

which should result in less queries ?

jlasman said:
Here are the results for 28-May-2007. They're for Monday, which was a holiday in the U.S. The first test I ran was for 24-May-2007. The results for Tuesday, 29-May-2007 will be a better comparison because they're both non-holiday weekdays.

However, the results for 31-May-2007, which will be the same weekday as well, will be the best comparison; I'll post it on 1-June-2007.

Here are the results for 28-May-2007:
Code: 
blocklist catch for 2007-05-28:
======================================================
SPAMHAUS	sbl.spamhaus.org	6019	96.24%
NJABL		dnsbl.njabl.org		  22	 0.35%
CBL		cbl.abuseat.org		   2	 0.03%
SORBS		safe.dnsbl.sorbs.net	NOT IN USE
DSBL		list.dsbl.org		  43	 0.69%
SPAMCOP		bl.spamcop.net		NOT IN USE
SPAMCANNIBAL	bl.spamcannibal.org	 168	 2.69%
					====	======
TOTAL REJECTED BY BLOCKLISTS		6254	100%
======================================================
TOTAL REJECTED BY BLOCKLISTS		6254	12.14%
TOTAL REJECTED FOR OTHER REASONS       45255	87.84%
					====	======
TOTAL REJECTED			       51519	100%
======================================================
TOTAL REJECTED			       51519	87.48%
TOTAL EMAILS DELIVERED			7376	12.52%
======================================================
TOTAL EMAILS REJECTED OR DELIVERED     58895	100%

While I'll wait until the first to make a decision, I think we'll be putting safe.dnsbl.sorbs.net back into the mix.

Jeff
Click to expand...
 
Using zen results in less queries.

Using consolidated lists always results in making less queries.

Remember, this is all DNS-based, so anything already in the local DNS server (because of previous queries) doesn't go any further. If you get 100 hits from the same server, your local DNS resolver will get 100 hits, but the upstream blocklist DNS server only the first.

Jeff
 
I would like to make a suggestion that any lists you plan on removing to just comment out so those who do want to continue using them may simply uncomment them.
 
It's an interesting suggestion. I'm not going to take it because it's just too easy to use lists that shouldn't be used in combination for one reason or another. Of course you can make any changes you want.

And you can even convince the folk at DA to not follow my lead but to write their own set, if that's what they want to do; that's the beauty of open-source code.

Jeff
 
Here's my results for May 29th:
Code: 
blocklist catch for 2007-05-29:
======================================================
SPAMHAUS	sbl.spamhaus.org	6453	97.26%
NJABL		dnsbl.njabl.org		  20	 0.30%
CBL		cbl.abuseat.org		   3	 0.05%
SORBS		safe.dnsbl.sorbs.net	NOT IN USE
DSBL		list.dsbl.org		  26	 0.39%
SPAMCOP		bl.spamcop.net		NOT IN USE
SPAMCANNIBAL	bl.spamcannibal.org	 133	 2.00%
					====	======
TOTAL REJECTED BY BLOCKLISTS		6635	100%
======================================================
TOTAL REJECTED BY BLOCKLISTS		6635	15.26%
TOTAL REJECTED FOR OTHER REASONS       36855	84.74%
					====	======
TOTAL REJECTED			       43490	100%
======================================================
TOTAL REJECTED			       43490	83.07%
TOTAL EMAILS DELIVERED			8864	16.93
======================================================
TOTAL EMAILS REJECTED OR DELIVERED     52354	100%
Jeff
 
The majority of my spam is blocked by spamcop. What is controversial about spamcop? I actually find their algorithm and the fact that it is based on user reports to be pretty sophisticated and accurate.
 
You must log in or register to reply here.
Back
Top