![]() Use this script to understand what files to copy in your SpamAssassin config directory. ![]() We provide a simple script to help you verify whether your DQS key is HBL enabled or not. In this file we override some of SA's default rule scoring This file contains lookup redefinitions and will need to be edited (see below) This is a dedicated SA plugin written by SH that overcomes some of SA's limitations A script that helps you know if your DQS key is HBL enabled Instructions on how to install this plugin on MDaemon servers Within it you will find the following files: Remote: Total 11 (delta 0), reused 11 (delta 0), pack-reused 0Ī subdirectory called spamassassin-dqs will be created. Remote: Compressing objects: 100% (9/9), done. Whenever you see the box below, it means that you need to enter the command on your shell:.Depending on your distribution it may be /etc/spamassassin or /etc/mail/spamassassin or something else. configuration directory: whenever you find these italic words, we are referring to SA's configuration directory.We are going to use some abbreviations and placeholders: To correctly install SpamAssassin, please refer to instructions applicable to your SpamAssassin distribution. These instructions do not cover the initial SpamAssassin installation. ![]() You need a DQS key along with an existing SpamAssassin 3.4.1+ installation on your system. After you register an account, go to this page and you'll find the DQS key under section "1.0 Datafeed Query Service". Just go here and complete the registration procedure. If you have a free DQS subscription and would like to trial HBL, please send an email to including your customer ID, and you will be contacted by one of our representative to activate a 30 day trial. With a paid subscription there is no query limit, and access to HBL (the new zone that deals with cryptovalues, emails and malware) is included.Īll the technical information about HBL is available here With free DQS you have access to ZRD and AuthBL, and you must abide by the free usage policy limits What is the difference between paid-for and free DQS? The usage terms are the same as the terms for our public mirrors, meaning that if you already use our public mirrors you are entitled to a free DQS key. While we know that every scenario is different, our in the field observations made using the Virus Bulletin spam feed shows that including HBL in your antispam setup could roughly boost spam detection from 0,3% up to slightly more than 1% NOTE: Results on VBSpam are achieved by using only the DQS dataset, meaning that if you just add an antivirus to your email filtering setup you can potentially reach the same performance as other commercial antispam products. ![]() The difference between them is that DQS catches up to 42% more spam than our public mirrors. We are independently tested by Virus Bulletin, a company that tests both DQS and public mirror performances. HBL is a zone dedicated to deal with sextortions/scam cryptowallets, dropbox emails and malicious files. If one of your customers gets their credentials stolen, AuthBL greatly mitigates the ability of botnets to abuse the account, and keeps your MTAs safe from collateral damage. It is a list of IPs that are known to host bots that use stolen credentials to spam. ![]() It also gives return codes that indicate the age of the domain (in hours) since first detection.ĪuthBL is primarily designed for use by anyone operating a submission SMTP server. ZRD automatically adds newly-registered as well as previously-dormant domains to a block list for 24 hours. Paid-for DQS users will also get access to the Hash BlockList (HBL). Sixty seconds doesn't seem like much, but when dealing with hailstormers they are crucial: the increase in catch rate between the public mirrors and DQS is mostly due to the real time updates.Īlong with the above advantage, free DQS users will also get two new zones to query, Zero Reputation Domains (ZRD) and AuthBL. With DQS, Spamhaus provides real time updates instead of the one-minute-delayed updates that are used by the public mirrors and the RSYNC feed.
0 Comments
Leave a Reply. |