virus.rbl.jp (for use with SpamAssassin)
When using virus.rbl.jp with Sendmail (or whatever MTA) you can only refuse connections directly to your machine from an address which is registered in the RBL. The actual message headers are not analysed by Sendmail. However, when virus.rbl.jp is used in conjunction with SpamAssassin the message header is analyzed and even mails which have been relayed through a machine registered in the RBL can be caught.
This works by checking all of the Received: headers in a message and if any of the addresses are found to be in virus.rbl.jp then SpamAssassin adds the number of pre-configured SpamAssasin points (more about points below).
This feature is especially useful for spam which is relayed like forwarded mail.
Another great feature about using SpamAssassin is that you don't have to have administrative privileges on the mail server, you can configure it for a single user.
How to use
Add the following to your SpamAssassin's local.cf configuration file, or user_prefs for user-specific configuration:
header RCVD_IN_VIRUS_RBL_JP eval:check_rbl_txt('rbl.jp', 'virus.rbl.jp.')
describe RCVD_IN_VIRUS_RBL_JP Received via a relay in virus.rbl.jp
tflags RCVD_IN_VIRUS_RBL_JP net
score RCVD_IN_VIRUS_RBL_JP 1.0
Then restart spamd.
The value of the 'score' setting relates to how many SpamAssassin points will be added to the final tally (other points come from other methods of determining whether or not the mail is spam). You can adjust this if you like (above configuration is for 1.0 points), of course the higher the score here the higher the chances are of a mail being deemed spam, even without points from other factors. By default a mail will be marked as spam if there is 5 more more SpamAssassin points.
You can see if your address is registered in virus.rbl.jp here.
Confirming things are working
If you see something like the the following in a mail that SpamAssassin has marked as spam it means things are working.
2.0 RCVD_IN_VIRUS_RBL_JP RBL: Received via a relay in virus.rbl.jp
[p7169-ipad52marunouchi.tokyo.ocn.ne.jp is listed]
Warning: If you want to use both short.rbl.jp and virus.rbl.jp please refer to all.rbl.jp's information here for the appropriate configuration.
RBL.JP Services Top