Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: domain of dfs@roaringpenguin.com
 designates 70.38.112.54 as permitted sender)
Date: Thu, 7 Jul 2011 09:09:40 -0400
From: "David F. Skoll" <dfs@roaringpenguin.com>
To: users@spamassassin.apache.org
Subject: Re: TTL and DNSBLs (was Re: SpamTips.org: Why run your own DNS
 server?)
Message-ID: <20110707090940.43f76681@hydrogen.roaringpenguin.com>
In-Reply-To: <20110707123948.GA14431@fantomas.sk>
References: <4E1199F7.9010908@gmail.com>
	<4E11A960.6010305@gmail.com>
	<20110704092419.36e1936d@hydrogen.roaringpenguin.com>
	<20110705102018.GL4017@michelle1>
	<20110705163714.677a975b@hydrogen.roaringpenguin.com>
	<20110707095044.GA12105@fantomas.sk>
	<20110707082629.586dfdb5@shishi.roaringpenguin.com>
	<20110707123948.GA14431@fantomas.sk>
Organization: Roaring Penguin Software Inc.
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Thu, 7 Jul 2011 14:39:48 +0200
Matus UHLAR - fantomas <uhlar@fantomas.sk> wrote:

> On 07.07.11 08:26, David F. Skoll wrote:
> >The point is that by definition, you can't have a per-IP
> >negative-cache TTL.

> We can have per-IP positive cache and per-zone negative cache.

That does not help.

> And in case of repeating the same IP's (which happens especially with 
> remote mailservers) the negative cache helps much.

No, it does not.  I have run experiments on real mail servers.  I'm not
just making this up.  If you like, I can send you my log analysis code
so you can run the same experiments on your own mail servers.

> In fact, I think that DNSBL's operators should provide the same TTL
> for both positive and negative answers, that can be even as big as
> 12-24h for dynamic/policy block lists.

As I mentioned, it's not in their interests to do that (if they sell access
to heavy users.)  Additionally, though I haven't experimented very extensively,
my tests show that cache effectiveness is not very sensitive to TTL.  Real
mail servers tend to be hit by a *lot* of different IP addresses, many of which
don't repeat for hours (if ever).

Regards,

David.