First need to say, I'm from Germany, so my set would not fit all as my selection fits best to spam seen in Germany. Looking at e.g. importing spam to quick-start bayesian filter, I just realized, that "my spam" is not "others spam", so I don't recommend to import "foreign" spam to quick-start bayesian filter. I also don't really recommend (although the idea is interesting) catch-all (worst) or self-placed (better, but still different) spam honeypots to learn the bayesian filter, maybe could be used to setup a blacklist, but for bayes it's still different to learn stupid spam waves instead of spam directly sent to an user.
So best spam protection is spam, which is already rejected on connection, e.g. most effective with postscreen. If a spam mail with content filter has a very high spam score, maybe would also be great to reject (reject, not block, blocking is suppression, that's not allowed in Germany), but currently not possible with PMG. Whitelists are also a good idea (usually), but I recently saw in the statistics very much false-positives (spammers, which are whitelisted), similar they also already recognized, that SPF and DKIM are measure for non-spam, so they try to use SPF-mail server nodes and try to DKIM-sign the messages, so that's no good signal for non-spam.
My current setup is a blacklist threshold of 2, so I have first tier and second tier blacklists. First tier are ones, which are absolutely trust, second tier are ones, which recently failed, so there is the need of matching two of them to get blacklisted.
First tier is:
zen.spamhaus.org (almost standard)
bl.spamcop.net (same and I also use it often to report/list spam)
psbl.surriel.com (tested for about 10+ years without any problems)
spamrbl.imp.ch (same as above)
noptr.spamrats.com (very few records and had no problems for years)
escalations.dnsbl.sorbs.net (same as above, all other sorbs have very much false-positives (fp))
Second tier is:
ix.dnsbl.manitu.net (recently was first tier, but in the past had increasing fp)
b.barracudacentral.org (in my recent setup 10+ years ago I used BRBL, but removed it because of fp)
db.wpbl.info (same as above)
I currently now test additional blacklists. How I got them? I use
http://multirbl.valli.org/ with recent spam and checked, on which blacklists they are listed. My current set is:
Additional candidates for first tier:
spam.dnsbl.anonmails.de
bl.score.senderscore.com
dnsrbl.swinog.ch
Additional candidates for second tier:
bl.blocklist.de
truncate.gbudb.net
ubl.unsubscore.com
spam.spamrats.com
hostkarma.junkemailfilter.com=127.0.0.2
No decision yet:
bl.spameatingmonkey.net
dnsbl.dronebl.org
wormrbl.imp.ch
dbl.suomispam.net
Any ideas, experiences, tipps, ... on my setup?
Regards,
Christian
