Introduction: SURBL - Spam URI Realtime Blocklists

For more information: [http://www.surbl.org/]

SURBLs are DNS RBLs (blacklists) of domains. They are very useful for detecting known spammy websites in Spam, while not requiring large rulesets containing list of spammer domains (such as sa-blacklist by WilliamStearns).

Installing

SURBLs and SpamAssassin 2.6x

Using SURBLs with SpamAssassin 2.6x requires a patch to Mail::SpamAssassin::Conf be installed (it's available on CPAN) - the name of the CPAN distribution is Mail::SpamAssassin::SpamCopURI. A new version of Mail::SpamAssassin::SpamCopURI is released for every new release of SpamAssassin 2.6x. Remember to update Mail::SpamAssassin::SpamCopURI everytime you update SpamAssassin.

Once you've got Mail::SpamAssassin::SpamCopURI installed, all you need is a rules file tellling SpamAssassin what SURBL lists to query. Then you're off.

More details instructions are available from the SURBL homepage.

SURBLs and SpamAssassin 3.x

SpamAssassin 3.0 and higher come with SURBL support.

Rulesets

• sc.surbl.org - SpamCop spamvertised sites
• ws.surbl.org - This is the SURBL of WilliamStearns sa-blacklist.cf. Using this in favour of the ruleset will significantly reduce your spamd memory usage!
• ob.surbl.org - OutBlaze spamvertised sites
• ab.surbl.org - Top ~425 spamvertised sites from SpamCop plus AbuseButler additions
• jp.surbl.org - jwSpamSpy and Prolocation spam URI data
• ph.surbl.org - Phishing spam URI data from a variety of sources
• multi.surbl.org - Preferred combined list of all of the above. Some data sources are only available in multi. Please use multi with urirhssub, as is the default in SpamAssassin 3.X.
  

Individual lists deprecated, use multi

SpamAssassin 3.0 and higher use multi.surbl.org instead of individual lists. This is preferred since a single query to multi will get results for all of the individual lists. As of March 1, 2009, public DNS service for the individual lists is disabled, and only multi.surbl.org is served. Therefore please use multi as is the default for SpamAssassin 3.0 and newer versions.