Introduction: SURBL - Spam URI Realtime Blocklists
For more information: http://www.surbl.org/
SURBLs are DNS RBLs (blacklists) of domains. They are very useful for detecting known spammy websites in Spam, while not requiring large rulesets containing list of spammer domains (such as sa-blacklist by WilliamStearns).
SURBLs and SpamAssassin 2.6x
Using SURBLs with SpamAssassin 2.6x requires a patch to Mail::SpamAssassin::Conf be installed (it's available on CPAN) - the name of the CPAN distribution is Mail::SpamAssassin::SpamCopURI. A new version of Mail::SpamAssassin::SpamCopURI is released for every new release of SpamAssassin 2.6x. Remember to update Mail::SpamAssassin::SpamCopURI everytime you update SpamAssassin.
More details instructions are available from the SURBL homepage.
SURBLs and SpamAssassin 3.x
SpamAssassin 3.0 and higher come with SURBL support.
sc.surbl.org - SpamCop spamvertised sites
ws.surbl.org - This is the SURBL of WilliamStearns sa-blacklist.cf. Using this in favour of the ruleset will significantly reduce your spamd memory usage!
ob.surbl.org - OutBlaze spamvertised sites
- jp.surbl.org - jwSpamSpy and Prolocation spam URI data
- ph.surbl.org - Phishing spam URI data from a variety of sources
multi.surbl.org - Preferred combined list of all of the above. Some data sources are only available in multi. Please use multi with urirhssub, as is the default in SpamAssassin 3.X.
Individual lists deprecated, use multi
SpamAssassin 3.0 and newer use multi.surbl.org instead of individual lists such as sc.surbl.org. This is preferred since a single query to multi will get results for all of the individual lists. As of March 1, 2009, public DNS service for the individual lists is disabled, and only multi.surbl.org is served. Therefore please use multi, as is the default for SpamAssassin 3.0 and newer versions. Said another way, if you are using SpamAssassin 3.0 or newer with the default SURBL rules, then no changes are needed. However anyone using SpamAssassin 2.6 should upgrade to 3.X.