Mailing List Message #13240
From: Bill Cole <>
Subject: Re: SPEWS and
Date: Fri, 25 Jul 2003 19:55:21 -0400
To: SIMS Discussions <>
At 8:37 AM -0700 7/25/03, Warren Michelsen imposed structure on a stream of electrons, yielding:
I read recently, on another list, that is a
composite list that includes SPEWS.

I recall readying elsewhere that SPEWS is too aggressive and (I
think) I recall too that someone else said that
does not include SPEWS.

What's the truth of the matter? is a composite list. The FAQ says:


What are all these zones?

* contains all zones, except for outputs and blocktest. Effectively, itís the master list containing the minimum casualties subzones.
* contains only insecure mail servers.
* contains only sources of direct-to-mx spam which are obviously in dynamic IP pools.
* contains only sites from
* contains only sites from
* contains only sites from
* is a stand-alone zone. It's meant to block testers from testing a site or netblock for many different reasons and has no practical value. It's not to be interpreted any other way than to prevent test software from testing other sites.
* will also be a stand-alone zone, and even though it will be created, it should only be used to warn the servers listed.


There is also a poorly-documented zone, included in the composite, that returns like the SPEWS listings but is locally maintained at Osirusoft.

In my opinion, the fact that SPEWS list is escalatory and often includes large chunks of network space around single addresses whose connection to spam is frequently secondary (e.g. a nameserver which is a primary for a domain of an URL advertised in spam can result in a listing for the entire ARIN-allocated block that it lives in) the use of SPEWS in a simple way (i.e. in SIMS, as opposed to some more subtle system like SpamAssassin) is a bad idea for anyone who cares about false positives (rejections of non-spam as if it were spam.)

In case anyone is interested in a little deeper discussion of DNSBL's, I have one up at which is really aimed at people listed on them (particularly SPEWS) but might be useful for reading by mail admins as well.

Bill Cole                        

Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster