short.rbl.jp (for use with SpamAssassin)

When using short.rbl.jp with Sendmail (or whatever MTA) you can only refuse connections directly to your machine from an address which is registered in the RBL. The actual message headers are not analysed by Sendmail. However, when short.rbl.jp is used in conjunction with SpamAssassin the message header is analyzed and even mails which have been relayed through a machine registered in the RBL can be caught.

This works by checking all of the Received: headers in a message and if any of the addresses are found to be in short.rbl.jp then SpamAssassin adds the number of pre-configured SpamAssasin points (more about points below).

This feature is especially useful for spam which is relayed like forwarded mail.

Another great feature about using SpamAssassin is that you don't have to have administrative privileges on the mail server, you can configure it for a single user.

How to use

Add the following to your SpamAssassin's local.cf configuration file, or user_prefs for user-specific configuration:
header  RCVD_IN_SHORT_RBL_JP   eval:check_rbl_txt('rbl.jp', 'short.rbl.jp.')
describe RCVD_IN_SHORT_RBL_JP Received via a relay in short.rbl.jp
tflags RCVD_IN_SHORT_RBL_JP   net
score RCVD_IN_SHORT_RBL_JP 2.0
Then restart spamd.

The value of the 'score' setting relates to how many SpamAssassin points will be added to the final tally (other points come from other methods of determining whether or not the mail is spam). You can adjust this if you like (above configuration is for 2.0 points), of course the higher the score here the higher the chances are of a mail being deemed spam, even without points from other factors. By default a mail will be marked as spam if there is 5 more more SpamAssassin points.

You can see if your address is registered in short.rbl.jp here.

Confirming things are working

If you see something like the the following in a mail that SpamAssassin has marked as spam it means things are working.
2.0 RCVD_IN_SHORT_RBL_JP     RBL: Received via a relay in short.rbl.jp
                            [p7169-ipad52marunouchi.tokyo.ocn.ne.jp is listed]
                            [in short.rbl.jp.]
Warning: If you want to use both short.rbl.jp and virus.rbl.jp please refer to all.rbl.jp's information here for the appropriate configuration.


RBL.JP Services Top