How good is cbl.abuseat.org?

I have recently added the following to my sendmail.mc:

FEATURE(`dnsbl', `cbl.abuseat.org', `550 Message from $&{client_addr}
rejected as spam - see http://cbl.abuseat.org')dnl

... because spam was getting through.

Now circulars from a "legitimate" site are being blocked thus:

Sep 12 09:33:06 debian sm-mta[28535]: ruleset=check_relay,
arg1=firewall-eth0.myob.com.au, arg2=127.0.0.2,
relay=firewall-eth0.myob.com.au [203.34.100.2], reject=550 5.7.1
Message from 203.34.100.2 rejected as spam - see http://cbl.abuseat.org

Is cbl.abuseat.org recognised as giving false positives and should I
continue to use it?

Re: How good is cbl.abuseat.org?

robert.spam.me.senseless@gmail.com writes:

> I have recently added the following to my sendmail.mc:
>
> FEATURE(`dnsbl', `cbl.abuseat.org', `550 Message from $&{client_addr}
> rejected as spam - see http://cbl.abuseat.org')dnl
>
> .. because spam was getting through.
>
> Now circulars from a "legitimate" site are being blocked thus:
>
> Sep 12 09:33:06 debian sm-mta[28535]: ruleset=check_relay,
> arg1=firewall-eth0.myob.com.au, arg2=127.0.0.2,
> relay=firewall-eth0.myob.com.au [203.34.100.2], reject=550 5.7.1
> Message from 203.34.100.2 rejected as spam - see http://cbl.abuseat.org
>
> Is cbl.abuseat.org recognised as giving false positives and should I
> continue to use it?

CBL lists IP addresses that have send messages to CBL's spamtraps.

It means that some types of IP with reasonable spam/ham ratio may be
frequently listed (and relisted some time after listing expire) by CBL
e.g.
* big free mailboxes services
* NAT firewalls of medium+ networks shared by multiple organizations/individuals

Such IPs are unlikely to deliver "zero spam", well managed may deliver
very low spam/ham ratio => they are likely to be listed frequently by
cbl.abuseat.org.

*In short*: IMHO CBL.abuseat.org is not fit for use without whitelisting
some IP addresses in most installations.

P.S. XBL.spamhaus.org (composite) list contains CBL.abuseat.org
listings => I suggest very similar precautions.

--
Andrzej [en:Andrew] Adam Filip anfi@priv.onet.pl anfi@xl.wp.pl
http://www.sendmail.org/faq/ http://anfi.homeunix.net/sendmail/

Re: How good is cbl.abuseat.org?

robert.spam.me.senseless@gmail.com wrote:

>
> Is cbl.abuseat.org recognised as giving false positives and should I
> continue to use it?

It came up very well in my "Quantitative Evaluation of DNSBLs" posted
at .

Since a DNSBL rejects rather than discards, there is no lost mail
anyway. The sender knows that the mail was not recieved so that there
are no hard feelings about being ignored.

Daniel Feenberg
feenberg isat nber dotte org