SURBL provides reputation data about web sites that appear inunsolicited messages to the world’s leading webmail providers, mail filter and security vendors, ISPs and organizations of all types large through small. SURBL data are used to help evaluate web site reputation in commercial and open source mail filters, security appliances,and a wide range of mail and web applications and systems.

What is SURBL?

SURBLs are lists of web sites that have appeared in unsolicited messages. Unlike most blacklists, SURBLs are not lists of mail senders.

Why use SURBL?

Web sites seen in unsolicited messages tend to be more stable than the rapidly changing botnet IP addresses used to send the vast majority of them. Sender lists like zen.spamhaus.org can be used in a first stage filter to help identify 80% to 90% of unsolicited messages. SURBLs can help find about 75% of the otherwise difficult, remaining unsolicited messages in a second stage filter. Used together with sender lists, SURBLs have proven to be a highly-effective way to detect 95% of unsolicited messages.

How to use SURBL

A sender blacklist like spamhaus.org is commonly used as a first-stage to detect about 80% to 90% of unsolicited messages at the MTA. After the MTA, asecond-stage mail filter checks message body web sites against SURBLs. SURBLsenable the mail filter to detect more than 75%* of the remaining unsolicited messages. Together they can detect more than 95%* of unsolicited messages. SURBLs should be used along with multiple, weighted factors to classify messages, as SpamAssassin does.

SURBL data are typically accessed using DNS queries. Small to medium-sizedorganizations may use the free public DNS servers, while large organizations ofmore than 1,000 users should retrieve the data by rsync and serve it from a localDNS mirror or other internal database. When used in combination with Spamhaus,SURBLs can detect more than 95% of unsolicited messages.

Price

SURBLs are free to use via public DNS query for organizations with fewer than1,000 users or processing fewer than 250,000 messages per day.

Performance

SURBL lists help detect more than 75%* of unsolicited messages with falsepositive rates in the 0.05% to 0.01% range. Used with Spamhaus, 95%* can bedetected.