Milter-greylist

On Fri, Sep 26, 2008 at 09:47:09AM -0700, Mark Walker wrote:
> I've been having a lot of multiple attempt spam that's coming from 
> domain names that have been created in the last 2 months. 
> 
> Is there any way to look up a domain name to see when the name was 
> created?  Whois services will only let you look up a few names before 
> blocking you.
> 
> I'm thinking of making either a patch for milter-greylist or else a new 
> milter to block domains that have been created within a configurable 
> time period.  The theory is that the domain names will be dropped and/or 
> the ips will be blacklisted before the end of your expiry period.  
> Legitimate new domains will have to either wait or be white listed. 
> 
> Does milter-greylist deal with this issue already somehow?  Does anybody 
> know of any other solution to this problem?  I think that spammers are 
> getting more and more keen to the greylisting technique, and finding 
> various workarounds.  I have large and ever increasing personal 
> blacklist.  I think 90% of it involves recently created domains, though. 

SpamAssassin can do this and since Emmanuel checked in SA-support into
CVS today, you're very welcome to test the code and tweak the following
checks in your local.cf:

	score DNS_FROM_DOB  5.0
	score RCVD_IN_DOB   5.0
	score URIBL_RHS_DOB 5.0


See http://spamassassin.apache.org/tests_3_2_x.html


HTH,

Petar