1.CBL不能作为首选，因为其局限性较大，如果单独采用RSYNC来同步数据，速度相当慢！并且你无法最先知道其更新内容。所以如果要单纯通过IP来判断，你需要建立一个自己的黑名单。这应该是一个数据库，以便后期开发client mai servr 获取黑名单的数据来源，这方面的工作，我做过一些，但是效果非常不理想，效率极其的低。
Received: from localhost by mail-dns-server
with SpamAssassin (version 3.0.1);
Tue, 05 Feb 2008 07:18:52 +0800
From: =?GB2312?B?wfXdvA==?= <liujing@sina.com>
To: webmaster@supresoft.com
Subject: [SPAM] =?GB2312?B?usO+w7K7vPvE48HLLLu5vMe1w87SwvA/?=
Date: Tue, 5 Feb 2008 06:40:14 +0800
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on mail-dns-server
X-Spam-Status: Yes, score=11.9 required=5.0 tests=CN_BODY_7,CN_SUBJECT_245,
FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_60_70,
HTML_IMAGE_ONLY_08,HTML_MESSAGE,HTML_TEXT_AFTER_BODY,
HTML_TEXT_AFTER_HTML,MIME_8BIT_HEADER,MIME_HTML_ONLY,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_XBL autolearn=no version=3.0.1
X-Spam-Level: ***********
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_47A79D5C.28FA0000"
经过过滤后的邮件内容
Spam detection software, running on the system "mail-dns-server", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see http://spam.newhi.net for details.
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 CN_SUBJECT_245 Subject contains "好久"
0.2 CN_BODY_7 BODY: Body contains "网站"
0.0 HTML_60_70 BODY: Message is 60% to 70% HTML
0.2 HTML_TEXT_AFTER_BODY BODY: HTML contains text after BODY close tag
1.2 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.2 HTML_TEXT_AFTER_HTML BODY: HTML contains text after HTML close tag
2.0 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?221.203.168.147>]
2.5 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[221.203.168.147 listed in sbl-xbl.spamhaus.org]
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.3 MIME_8BIT_HEADER Message header contains 8-bit character
3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.