Email Filtering

Spamhaus and SURBL – are considered by many to be integral part of the Best Practices Approach to fighting spam.

  • World’s Best IP and Domain Anti-Spam Datafeeds
  • Most effective, most accurate data
  • Best Technical and Financial Approach
  • Accurately and Effectively Stop Spam, Phishing, Malware
  • Highly Effective: near Zero False Positives (approaching 0.00%)
  • Fully Licensed, Fully Supported
  • SecurityZones is the Leading Distributor, and Technical Expert for both Spamhaus and SURBL… globally. 
  • Over 10 years experience working directly with the leading ISP’s, Security Vendors, Universities and Enterprises to deliver cutting edge datafeeds, threat intelligence and technical support. 

For Use By Case:

ISP’s, Email Filter Vendors, Universities
Feed into your Open Source email platforms – SpamAssasin, PostFix, SendGrid
Add to your appliances – Barracuda, Proofpoint, etc

Delivery Options:

  • Rsync Datafeed
  • Datafeed Query Service

Summary of Value provided by SecurityZONES, Spamhaus and SURBL:

  • absolutely the best available anti-spam data
  • greatly improve your coverage and effectiveness for mail traffic in US, Europe, South America, etc
  • LT partnership approach
  • ongoing meetings, consultation, to provide insight on new feeds, features and techniques.. as well as consultation on how to best utilize the data to address your objectives, and improve your products and services.
  • SecurityZONES, Spamhaus and SURBL - as an extension of your Technical and R&D team

Effective Spam Filtering

For most average Internet Service Providers and networks in North America, Europe or Australasia, today's incoming email traffic consists of approximately 90% spam and 10% normal legitimate email. [1] The main problem for mail system administrators is how to filter out the spam while not losing legitimate email, and how to keep mail queues flowing without spam-filter processes slowing the mail queue. The main problem for ISP executives is also how to do this cost- effectively.

2-Stage Filtering

Using only the Spamhaus DNS-based Blocklists (SBL, XBL and PBL) ISPs and internet networks can very safely reject 75% of inbound mail traffic outright, rejecting the vast majority of spam at SMTP connect time and before mail servers are burdened with it, or have to process or accept the messages.

Remaining spam that gets past the Spamhaus blocklist checks at SMTP connect time, should then be filtered by checking the IP addresses of web sites advertised in the spam against the SBL in a second stage called "URI SBL". [2]

Using the setup described below, UK ISP achieves a catch rate of 299 out of every 300 spams (99.6%) with zero false positives.

1st Stage

The first stage is to install the Spamhaus ZEN blocklist on your incoming mail relay(s). ZEN, which is a combination of Spamhaus's SBL, XBL and PBL blocklists, will identify and reject 75% of a normal mail relay's incoming mail traffic.

Incoming mail from servers listed on SBL, XBL or PBL at this first stage should be rejected at the RCPT TO command, terminating the SMTP transaction before the message body is accepted, sent or received.

This is cost effective - more than halving your incoming mail bandwidth and the subsequent mail queue - and is the safe way to handle message filtering, because in the event a legitimate Sender is ever blocked in error

they are immediately notified by the reject notice of the reason why their message could not be delivered as well as what to do and who to contact about it. [3]

email-filter-1  email-filter-2

2nd Stage

Over 60% of spam contains URLs of spammer web sites whose webserver IPs are listed on the Spamhaus SBL. [4] Therefore the second stage is to scan the 25% of mail which gets past first stage IP filtering, looking for URIs (web site addresses) in the message body and testing their host IPs against the SBL.

This is done by installing an application capable of scanning message bodies for URLs and checking them against the SBL.

There are a number of free/open source applications - such as SpamAssassin, SpamBouncer, and there is also a free Sendmail filter with this feature.

If using SpamAssassin, we recommend you increase the value of SpamAssassin's SBL-check feature, URIBL_SBL to at least 5 or 6 (by default it's set to 1 which in most cases is too low to trigger the spam flag).

Spamhaus lists the IPs of spammers' web servers and DNS servers, in addition to spam sources in the SBL for this purpose. Spammers may find fresh sources not yet on our DNSBLs, but they in most cases need to advertize a web site hosted somewhere.

Remaining spam, which should now be reduced to less than 7% of your total incoming email traffic, is taken care of easily by SpamAssassin's other filter components, including SURBL, with the result that the total spam catch rate should now average 99.6%, or 299 in every 300 spams.

Independent Test Results:  VB Spam: 

VB Spam (a very highly regarded independent testing source which has been considered one of the best independent anti spam tests, since 2009)

 a) results from a recent test in 2017

- Spamhaus ZEN scored 91.87% detection rate with 0.00% FP’s

 b) SURBL also tested by VB Spam.  

- SURBL scored 43.32% detection rate, with FP rate: 0.00%

- please note… SURBL is best used as a second tier filter - after the IP filter.

c) Total effectiveness of Spamhaus SURBL alone - exceeds 95%, with 0% FP's regularly.