Click for SpamPal's Homepage
Contents > How to Optimise

Here are a few things you can try, if you find that SpamPal is too slow, or isn't catching enough spam:

Quick Index

1. Optimise tips

2. Checking DNSBL Effectiveness

2.1 Checking DNSBL Effectiveness - Using the Status Screen
2.2 Checking DNSBL Effectiveness - Using Headers to treat spam that gets through

3. Improving SpamPal's Effectiveness

3.1 Improving SpamPal's Effectiveness: DNSBL lookup
3.2 Improving SpamPal's Effectiveness: Using DNSBL Cache
3.3 Improving SpamPal's Effectiveness: Using Plugins to catch more spam
3.4 Improving SpamPal's Effectiveness: Slow down checks for new mail
3.5 Improving SpamPal's Effectiveness: Adding Extra DNSBL Definitions

4. Slow DNSBL Lookups

1. Optimise tips

Note: some simple speed tips
  • Whitelist every email address you know you want. If you have a big list of email addresses and you want to sort them, the best way is to go to this online whitelist sorter
  • Don't use more DNSBLs (Public Blacklists) than you need.
  • Some email programs, such as Outlook have a Junk Mail facility which will blacklist email address, it's normally a good idea to disable this feature (which will give you a small speed boost) and just use SpamPal to do the work.
  • Use the ignore- list feature to ignore the IP addresses of your own ISP mail servers
  • You can also tune the number of connections SpamPal makes; go to the advanced settings and increase the Maximum Simultaneous DNSBL queries to 50 (if you are on broadband/cable/adsl)
  • Don't set the caching times too low


2.1 Checking DNSBL Effectiveness: Using the Status Screen

By using the SpamPal Status page (right click on the Systray Umbrella and select Status), you'll be able to see which of DNSBLs you are using and how effective they have been during a recent session.

If you look at the statistics on SpamPal's status screen, it will show you the hit rates being achieved by the various DNSBLs you are using for recent queries. You will probably notice that some of the DNSBLs regularly give high numbers, 20-50%, and others may be very low, or even zero hits.

Deselecting the ones with low hit rates will probably improve speed without affecting your spam detection capability.

For example, in the screen below, it looks like DSBL, Composite Blocking list and VISI have detected little spam in this session and therefore may be a good idea to deselect these from your list of DNSBLs (public blacklists), in order to save time.

You can also see that SORBS has a slightly higher Average Response time (0.421s) than the other DNSBL's and also doesn't detect as much spam as Easynet, so may also be a candidate for removal.

Note 1: Filtering Operations Summary
In the left window, note the words filtering operations summary. This isn't the same as number of messages; if your email program (Outlook Express is one example) fetches a preview of your message first and then the message itself, that's two filtering operations, so it counts twice.
Note 2: Recent DNSBL Queries
In the right window, note the words Recent DNSBL Queries. these numbers will get reset to zero every time you restart SpamPal, e.g. when you reboot your machine.


2.2 Checking DNSBL Effectiveness: Using Headers to treat spam that gets through

Obviously SpamPal won't get 100% of all your spam, so perhaps reading this page on what to expect from SpamPal will be a good place to look at first.

When you have an email which is clearly spam to you but has slipped though SpamPal, you can use the following procedure, to see if there are other DNSBLs which would have caught this spam.

Get the full mail headers from your mail. How you do that varies from email program to email program but see this section for more detail about view full mail headers

The full mail headers means you need to be able to view the Received: from lines, e.g.

Return-Path: <>
Received: from sender244 ( [])
by (8.11.6/8.11.6) with ESMTP id h6888HN06418
for <>; Tue, 8 Jul 2003 09:08:18 +0100
Message-Id: <200307080808.h6888HN06418@xxxxx.xx.xx>

Now, go to and do a lookup on the IP address (

Wait for your address to be processed and look out for the following line:

Results: Positive=9, Negative=23

If you look for the DNSBL's in Red you could add one of those to SpamPal's current list of DNSBL's in order to try to improve performance of the DNSBL checks.

If none are Positive then adding more DNSBLs to the list in SpamPal... isn't likely to have caught the spam as it wasn't listed in the major DNSBLs at the time you checked your mail.

You can further investigate an IP numbers by going to this section of the manual


3.1 Improving SpamPal's Effectiveness: DNSBL lookup

These settings can be found in the Advanced panel of SpamPal's options. On the same page, you should have a DNSBL time out setting of 10 to 20 seconds, and a maximum number of simultaneous DNSBL queries of about 25 should be a good choice for most people.


3.2 Improving SpamPal's Effectiveness: Using DNSBL Cache

You should also look at the cache times on DNSBL checks. The caching improves speed but may lead to slightly less accurate results. Unless speed is a problem for your connection, the best results will come from setting SpamPal to remember positive (Spam) results for three days, and negative (legitimate mail) results for zero days, twelve hours. These settings can be found in the Advanced panel of SpamPal's options.

On the same page, you should have a DNSBL time out setting of 10 to 20 seconds, and a maximum number of simultaneous DNSBL queries of about 25 should be a good choice for most people.


3.3 Improving SpamPal's Effectiveness: Using Plugins to catch more spam

If you are still not catching enough spam then you are better trying alternative strategies, not just piling on more DNSBLs. Look at the available plugins.

There is one called URLbody which will apply DNSBL checks on the websites listed in the spam mails. Although spammers can disguise their email address and send the mail through circuitous routes, they still need to advertise their website in the spam they send you, so this plugin can be very effective at trapping them.

RegEx will examine the body of mails for a whole mess of different phrases and other good solid indicators of spam, and both of those should pick up lots of spam, although I think there is a slightly higher risk of false positives with RegEx patterns. However, the latest version uses a combined scoring system which should greatly improve its discrimination sensitivity. Some people have reported catching well over 90% of the spam just using RegEx and no DNSBLs at all.

The MX blocker is used to detect mails which are sent through desktop MX programs on dial-up lines, a common tactic of spammers. You may find this mops up lots of spam which is escaping the DNSBLs. However, use with caution initially as desktop MX is a legitimate tool which is used for legitimate purposes so you may find you need to whitelist a few regular correspondents.

There is also a Bayesian plugin which takes a completely different approach to detecting spam, although the nature of it means it is perhaps more likely to get false positives to begin with and it does need a period of training to learn the patterns in your email.

As with DNSBLs, do not just install everything at once because it will just be overkill.

Try the plugins one at a time and find out what is working best for you.


3.4 Improving SpamPal's Effectiveness: Slow down checks for new mail

A more likely cause of poor DNSBL performance is that you are checking your mail too often.

We have found that from the time a wave of spam starts, it takes about 30 minutes before the culprit IP numbers start appearing on the DNSBLs. If you are checking your mail at one minute intervals then you are probably downloading the spam before the DNSBLs have had a chance to react.

Change the settings in your mail program to only download mail at 30 minute intervals or longer, or even just to download manually, and you should find a big improvement in DNSBL performance.

Despite what people often think, the world will not end if you don't get your emails within a minute of someone sending it.


3.5 Adding Extra DNSBL Definitions

You can further improve SpamPal's dnsbl detection by adding one or two of the following extra dnsbls. For further information on how to add them to SpamPal, see this page.
Extra DNSBL 1: FiveTen
NAME Fiveten
DESCRIPTION Lists individual spam sources, bulk mailers, multistage open relays, single stage open relays, networks that refuse to remove their spammers, and free mail providers.
RESULT_CODE # Individual spam sources
RESULT_CODE # Bulk mailers
RESULT_CODE # Multistage
RESULT_CODE # Single stage open relays that are not listed on ORDB yet.
RESULT_CODE # Networks that refuse to remove their spammers
RESULT_CODE # Free mail providers with no abuse address
Extra DNSBL 2: MessageLabs VBL
NAME MessageLabs VBL
DESCRIPTION The VBL is a list of IP addresses that MessageLabs have found to send a known trojan dropping virus in the past 48 hours.
NAME Passive Spam Block List
DESCRIPTION An easy-on, easy-off blacklist that doesn't rely on testing and should reduce false positives because any user can remove their ISP's mail server from the list
RESULT_CODE # Your server sent spam to trap-server recently
NAME Distributed Realtime Block List [Vote]
DESCRIPTION DRBL stands for Distributed Realtime Black List.
RESULT_CODE # Your server sent spam to trap-server recently
NAME Distributed Server Boycott [Unconfirmed]
DESCRIPTION Distributed Server Boycott List unconfirmed
RESULT_CODE # Your server sent spam to trap-server recently
Extra DNSBL 6: CBL
NAME Composite Blocking List
DESCRIPTION The CBL takes its source data from very large spamtraps, and only lists IPs exhibiting characteristics which are specific to open proxies of various sorts
Extra DNSBL 7: Five-Ten-SG
NAME Blackholes 5-10-SG
DESCRIPTION five-ten-sg Blackholes - except dial up equivalents
RESULT_CODE # spam source
RESULT_CODE # confirmed bulk mailer
RESULT_CODE # multistage open relay
RESULT_CODE # single stage open relay
RESULT_CODE # spam supporting network
RESULT_CODE # insecure formmail.cgi
RESULT_CODE # tcpa violators
RESULT_CODE # ignores abuse complaints
Extra DNSBL 8: ahbl
NAME AHBL - The Abusive Hosts Block List
DESCRIPTION <insert your own description here>
RESULT_CODE # Open Relay
RESULT_CODE # Open Proxy
RESULT_CODE # Spam Source
RESULT_CODE # Real time block (to be removed)
RESULT_CODE # Formail Spam
RESULT_CODE # Spam Support
RESULT_CODE # Spam Support (indirect)
RESULT_CODE # Shoot On SIght
RESULT_CODE # Non-RFC compliant (missong postmaster or abuse)
RESULT_CODE # Does not properly handle 5xx errors
RESULT_CODE # Other Non-RFC Compliant
To block specific countries, you can tick the various DNSBLs listed in the country section of SpamPal but this can be inefficient if you need to block a lot of countries. It is also a problem if you want to block a country not on the list. An alternative is to use your own definiton to make a single dnsbl call to and block according to the result.

The following is an example of the text you would need in Advanced/Extra DNSBL Definitions to block Russia, Hungary and Italy, (for example).

NAME Untrusted countries
DESCRIPTION Excludes unwanted countries
RESULT_CODE # Russia RU 643
RESULT_CODE # Hungary HU 348
RESULT_CODE # Italy IT 380

To use countries other than the ones listed above, select the lines required from the following list I've compiled of all country codings that are currently in use (to the best of my knowledge)

RESULT_CODE # Afghanistan AF 4
RESULT_CODE # Albania AL 8
RESULT_CODE # Algeria DZ 12
RESULT_CODE # American Samoa AS 16
RESULT_CODE # Andorra AD 20
RESULT_CODE # Angola AO 24
RESULT_CODE # Anguilla AI 660
RESULT_CODE # Antarctica AQ 10
RESULT_CODE # Antigua and Barbuda AG 28
RESULT_CODE # Argentina AR 32
RESULT_CODE # Armenia AM 51
RESULT_CODE # Aruba AW 533
RESULT_CODE # Australia AU 36
RESULT_CODE # Austria AT 40
RESULT_CODE # Azerbaijan AZ 31
RESULT_CODE # Bahamas BS 44
RESULT_CODE # Bahrain BH 48
RESULT_CODE # Bangladesh BD 50
RESULT_CODE # Barbados BB 52
RESULT_CODE # Belarus BY 112
RESULT_CODE # Belgium BE 56
RESULT_CODE # Belize BZ 84
RESULT_CODE # Benin BJ 204
RESULT_CODE # Bermuda BM 60
RESULT_CODE # Bhutan BT 64
RESULT_CODE # Bolivia BO 68
RESULT_CODE # Bosnia and Herzegovina BA 70
RESULT_CODE # Botswana BW 72
RESULT_CODE # Bouvet Island BV 74
RESULT_CODE # Brazil BR 76
RESULT_CODE # British Indian Ocean Territory IO 86
RESULT_CODE # British Southern and Antarctic Territories 80
RESULT_CODE # Brunei Darussalam BN 96
RESULT_CODE # Bulgaria BG 100
RESULT_CODE # Burkina Faso BF 854
RESULT_CODE # Burundi BI 108
RESULT_CODE # Cambodia KH 116
RESULT_CODE # Cameroon CM 120
RESULT_CODE # Canada CA 124
RESULT_CODE # Cape Verde CV 132
RESULT_CODE # Cayman Islands KY 136
RESULT_CODE # Central African Republic CF 140
RESULT_CODE # Chile CL 152
RESULT_CODE # China CN 156
RESULT_CODE # Christmas Island CX 162
RESULT_CODE # Cocos Islands CC 166
RESULT_CODE # Colombia CO 170
RESULT_CODE # Comoros KM 174
RESULT_CODE # Congo CG 178
RESULT_CODE # Congo CD 180
RESULT_CODE # Cook Islands CK 184
RESULT_CODE # Costa Rica CR 188
RESULT_CODE # Cote d'Ivoire CI 384
RESULT_CODE # Croatia HR 191
RESULT_CODE # Cyprus CY 196
RESULT_CODE # Czech Republic CZ 203
RESULT_CODE # Denmark DK 208
RESULT_CODE # Djibouti DJ 262
RESULT_CODE # Dominica DM 212
RESULT_CODE # Dominican Republic DO 214
RESULT_CODE # Ecuador EC 218
RESULT_CODE # Egypt EG 818
RESULT_CODE # El Salvador SV 222
RESULT_CODE # Equatorial Guinea GQ 226
RESULT_CODE # Eritrea ER 232
RESULT_CODE # Estonia EE 233
RESULT_CODE # Ethiopia ET 231
RESULT_CODE # Falkland Islands FK 238
RESULT_CODE # Faroe Islands FO 234
RESULT_CODE # Finland FI 246
RESULT_CODE # France FR 250
RESULT_CODE # French Guiana GF 254
RESULT_CODE # French Polynesia PF 258
RESULT_CODE # French Southern Territories TF 260
RESULT_CODE # Gabon GA 266
RESULT_CODE # Gambia GM 270
RESULT_CODE # Georgia GE 268
RESULT_CODE # Germany DE 276
RESULT_CODE # Ghana GH 288
RESULT_CODE # Gibraltar GI 292
RESULT_CODE # Greece GR 300
RESULT_CODE # Greenland GL 304
RESULT_CODE # Grenada GD 308
RESULT_CODE # Guadeloupe GP 312
RESULT_CODE # Guatemala GT 320
RESULT_CODE # Guinea GN 324
RESULT_CODE # Guinea-bissau GW 624
RESULT_CODE # Guyana GY 328
RESULT_CODE # Haiti HT 332
RESULT_CODE # Heard and McDonald Islands HM 334
RESULT_CODE # Honduras HN 340
RESULT_CODE # Hong Kong HK 344
RESULT_CODE # Hungary HU 348
RESULT_CODE # Iceland IS 352
RESULT_CODE # India IN 356
RESULT_CODE # Indonesia ID 360
RESULT_CODE # Ireland IE 372
RESULT_CODE # Israel IL 376
RESULT_CODE # Italy IT 380
RESULT_CODE # Jamaica JM 388
RESULT_CODE # Japan JP 392
RESULT_CODE # Jordan JO 400
RESULT_CODE # Kazakhstan KZ 398
RESULT_CODE # Kenya KE 404
RESULT_CODE # Kiribati KI 296
RESULT_CODE # Korea North KP 408
RESULT_CODE # Korea South KR 410
RESULT_CODE # Kuwait KW 414
RESULT_CODE # Kyrgyzstan KG 417
RESULT_CODE # Latvia LV 428
RESULT_CODE # Lebanon LB 422
RESULT_CODE # Lesotho LS 426
RESULT_CODE # Liberia LR 430
RESULT_CODE # Libya LY 434
RESULT_CODE # Liechtenstein LI 438
RESULT_CODE # Lithuania LT 440
RESULT_CODE # Luxembourg LU 442
RESULT_CODE # Macao MO 446
RESULT_CODE # Macedonia MK 807
RESULT_CODE # Madagascar MG 450
RESULT_CODE # Malawi MW 454
RESULT_CODE # Malaysia MY 458
RESULT_CODE # Maldives MV 462
RESULT_CODE # Malta MT 470
RESULT_CODE # Marshall Islands MH 584
RESULT_CODE # Martinique MQ 474
RESULT_CODE # Mauritania MR 478
RESULT_CODE # Mauritius MU 480
RESULT_CODE # Mayotte YT 175
RESULT_CODE # Mexico MX 484
RESULT_CODE # Micronesia FM 583
RESULT_CODE # Moldova MD 498
RESULT_CODE # Monaco MC 492
RESULT_CODE # Mongolia MN 496
RESULT_CODE # Montserrat MS 500
RESULT_CODE # Morocco MA 504
RESULT_CODE # Mozambique MZ 508
RESULT_CODE # Myanmar MM 104
RESULT_CODE # Namibia NA 516
RESULT_CODE # Nauru NR 520
RESULT_CODE # Nepal NP 524
RESULT_CODE # Netherlands NL 528
RESULT_CODE # Netherlands Antilles AN 530
RESULT_CODE # New Caledonia NC 540
RESULT_CODE # New Zealand NZ 554
RESULT_CODE # Nicaragua NI 558
RESULT_CODE # Niger NE 562
RESULT_CODE # Nigeria NG 566
RESULT_CODE # Norfolk Island NF 574
RESULT_CODE # Northern Mariana Islands MP 580
RESULT_CODE # Norway NO 578
RESULT_CODE # Pakistan PK 586
RESULT_CODE # Palau PW 585
RESULT_CODE # Palestinian Authority PS 275
RESULT_CODE # Panama PA 591
RESULT_CODE # Papua New Guinea PG 598
RESULT_CODE # Paraguay PY 600
RESULT_CODE # Philippines PH 608
RESULT_CODE # Pitcairn PN 612
RESULT_CODE # Poland PL 616
RESULT_CODE # Portugal PT 620
RESULT_CODE # Puerto Rico PR 630
RESULT_CODE # Qatar QA 634
RESULT_CODE # Reunion RE 638
RESULT_CODE # Romania RO 642
RESULT_CODE # Russia RU 643
RESULT_CODE # Rwanda RW 646
RESULT_CODE # Samoa WS 882
RESULT_CODE # San Marino SM 674
RESULT_CODE # Sao Tome and Principe ST 678
RESULT_CODE # Saudi Arabia SA 682
RESULT_CODE # Senegal SN 686
RESULT_CODE # Serbia and Montenegro YU 891
RESULT_CODE # Seychelles SC 690
RESULT_CODE # Sierra Leone SL 694
RESULT_CODE # Singapore SG 702
RESULT_CODE # Slovakia SK 703
RESULT_CODE # Slovenia SI 705
RESULT_CODE # Solomon Islands SB 90
RESULT_CODE # Somalia SO 706
RESULT_CODE # South Africa ZA 710
RESULT_CODE # South Georgia GS 239
RESULT_CODE # Spain ES 724
RESULT_CODE # Sri Lanka LK 144
RESULT_CODE # St Helena SH 654
RESULT_CODE # St Kitts and Nevis KN 659
RESULT_CODE # St Lucia LC 662
RESULT_CODE # St Pierre and Miquelon PM 666
RESULT_CODE # St Vincent and the Grenadines VC 670
RESULT_CODE # Sudan SD 736
RESULT_CODE # Suriname SR 740
RESULT_CODE # Svalbard and Jan Mayen Islands SJ 744
RESULT_CODE # Swaziland SZ 748
RESULT_CODE # Sweden SE 752
RESULT_CODE # Switzerland CH 756
RESULT_CODE # Syria SY 760
RESULT_CODE # Taiwan TW 158
RESULT_CODE # Tajikistan TJ 762
RESULT_CODE # Tanzania TZ 834
RESULT_CODE # Thailand TH 764
RESULT_CODE # Timor Leste TL 626
RESULT_CODE # Tokelau TK 772
RESULT_CODE # Tonga TO 776
RESULT_CODE # Trinidad and Tobago TT 780
RESULT_CODE # Tunisia TN 788
RESULT_CODE # Turkey TR 792
RESULT_CODE # Turkmenistan TM 795
RESULT_CODE # Turks and Caicos Islands TC 796
RESULT_CODE # Tuvalu TV 798
RESULT_CODE # Uganda UG 800
RESULT_CODE # Ukraine UA 804
RESULT_CODE # United Arab Emirates AE 784
RESULT_CODE # United Kingdom GB 826
RESULT_CODE # United States minor outlying islands UM 581
RESULT_CODE # Uruguay UY 858
RESULT_CODE # Uzbekistan UZ 860
RESULT_CODE # Vanuatu VU 548
RESULT_CODE # Vatican City VA 336
RESULT_CODE # Venezuela VE 862
RESULT_CODE # Viet Nam VN 704
RESULT_CODE # Virgin Islands (British) VG 92
RESULT_CODE # Virgin Islands (US) VI 850
RESULT_CODE # Wallis and Futuna Islands WF 876
RESULT_CODE # Western Sahara EH 732
RESULT_CODE # Yemen YE 887
RESULT_CODE # Yugoslavia YU 891
RESULT_CODE # Zambia ZM 894
RESULT_CODE # Zimbabwe ZW 716


4. Slow DNSBL lookups

See this page, if you are getting slow dnsbl lookups or you are using Spybot Search and Destroy's ad-blocking hosts file.



Users can now annoate manual pages with their own hints and tips. To share your insights with your fellow SpamPal users, you can use the form of the bottom of the page.

Annotate this page

Unfortunately, owing to a high volume of attempted abuse, new annotations are no longer being accepted for this page. Please accept my apologies for any inconvenience caused.