This article applies to:

• Trustwave MailMarshal (SEG)
• Spamhaus DNS Blocklists/Reputation Services

Question:

• Do I need to pay to use Spamhaus with MailMarshal?
• What are the options for using Spamhaus?
• How can I reduce the number of queries I make to Spamhaus?
• How can I speed up Spamhaus query results?

Information:

Spamhaus offers a limited ‘Free Use’ service to the general public. As a MailMarshal user, there are several limitations you should take into consideration when using Spamhaus. The Spamhaus ‘free use’ limitations are outlined in the Spamhaus usage FAQ. and the Data Query Service Free Use FAQ. For the best information, contact Spamhaus directly.

It can be difficult to determine exactly how many queries you are making to Spamhaus. However, the free use amount is generally adequate only for fairly small organizations.

If you are likely to exceed the daily query limit or traffic volume limit allowed under ‘Free Use,’ then you should consider the ‘Professional Use’ option. Spamhaus reserves the right to deny free service if you do not respect the limitations.

Spamhaus also offers a Data Feed service that allows you to speed up results and to gain full control of DNSBL queries. This service provides you with an updated local copy of the Spamhaus database.

Calculating and minimizing volume

Bear in mind that your volume of queries is dependant on several factors, beyond the number of messages:

• Do you query Spamhaus for every incoming connection?
• Do you query Spamhaus before or after SpamCensor / SpamProfiler filtering?
• Are your Spamhaus rules generating several queries per message (e.g. checking all IP addresses in the header, or querying Spamhaus with URLCensorIP)?
• What sort of cached result hitrate are you achieving with your DNSBL lookups?

You can greatly reduce the volume of queries to Spamhaus with a few simple strategies. You may even be able to eliminate the need to upgrade to the ‘Professional Use’ service.

• Use SpamProfiler and block at the Receiver (available in version 6.4 and above)
  • Any messages blocked at the Receiver by SpamProfiler will not pass through any Engine rules, and will not incur any DNSBL queries at the Engine.
• Use a DNS caching-enabled version of MailMarshal (version 6.2 and above)
  • DNSBL queries, like other DNS queries, are cached - so multiple messages from the same location will not incur multiple queries. You can check the overall cache rate using the MMLookup.exe tool found in the MailMarshal install folder.
• Place your Spamhaus rule(s) after other spam filtering takes place

Notes:

If you provide MailMarshal filtering as a paid service, and if part of that service is Spamhaus filtering, you must use the ‘Professional Use’ service.

For tips on setting up a data feed, see Trustwave Knowledgebase article: Q12010.