<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 2012-12-20 8:09 PM, Augie Schwer
wrote:<br>
</div>
<blockquote
cite="mid:CA+fq9b9n-Dwt=MBt5mopT4ADyVnAVr8dsVGiOzUE1iHMMbB5vQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Overall the RPZ zones have little impact on traffic.</div>
<div><br>
</div>
<div>I captured three hours of traffic across three of our most
popular DNS</div>
<div>hosts for a total of 755,938 queries. Of those queries only
1403 queries</div>
<div>generated an RPZ hit -- for a ratio of 0.18%.</div>
</div>
</blockquote>
<br>
try the trick i described here:<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.circleid.com/posts/using_domain_filtering_to_effect_ip_address_filtering/">http://www.circleid.com/posts/using_domain_filtering_to_effect_ip_address_filtering/</a><br>
<br>
this may give you a higher hit rate.<br>
<br>
<blockquote
cite="mid:CA+fq9b9n-Dwt=MBt5mopT4ADyVnAVr8dsVGiOzUE1iHMMbB5vQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>The most effective RPZ zone was the <a
moz-do-not-send="true" href="http://rpz.spamhaus.org">rpz.spamhaus.org</a>
zone; accounting</div>
<div>for 61.9% of the RPZ hits; <a moz-do-not-send="true"
href="http://rpz.surbl.org">rpz.surbl.org</a> accounted for
the remaining hits.</div>
</div>
</blockquote>
<br>
order matters. you should give each one a chance to be first in the
subscription list. otherwise the things that either one would have
stopped will be logged only as matching the first one in the
subscription list.<br>
<br>
<blockquote
cite="mid:CA+fq9b9n-Dwt=MBt5mopT4ADyVnAVr8dsVGiOzUE1iHMMbB5vQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div style="">This is in an ISP environment.</div>
</div>
</blockquote>
<br>
755K / 3 servers / 3 hours is ~100K/hour. that's... a very small ISP
in the grand scheme of things. you may not have a large enough
customer base to be a good statistical sample for any RPZ, no matter
what order you're trying them in.<br>
<br>
paul<br>
</body>
</html>