surbl {
    .include(try=true,priority=1) "${DBDIR}/dynamic/surbl.conf"
    whitelist = "file://$CONFDIR/surbl-whitelist.inc";
    exceptions = "file://$CONFDIR/2tld.inc";

    rule {
        suffix = "multi.surbl.org";
        symbol = "SURBL_MULTI";
        bits {
            CRACKED_SURBL = 128; # From February 2016
            ABUSE_SURBL = 64;
            MW_SURBL_MULTI = 16;
            PH_SURBL_MULTI = 8;
            WS_SURBL_MULTI = 4;
            SURBL_BLOCKED = 1;
        }
    }
    rule {
        suffix = "multi.uribl.com";
        symbol = "URIBL_MULTI";
        bits {
            URIBL_BLOCKED = 1;
            URIBL_BLACK = 2;
            URIBL_GREY = 4;
            URIBL_RED = 8;
        }
    }
    rule {
        suffix = "uribl.rambler.ru";
        symbol = "RAMBLER_URIBL";
    }
    rule {
        suffix = "dbl.spamhaus.org";
        symbol = "DBL";
        no_ip = true;
        ips = {
            # spam domain
            DBL_SPAM = "127.0.1.2";
            # phish domain
            DBL_PHISH = "127.0.1.4";
            # malware domain
            DBL_MALWARE = "127.0.1.5";
            # botnet C&C domain
            DBL_BOTNET = "127.0.1.6";
            # abused legit spam
            DBL_ABUSE = "127.0.1.102";
            # abused spammed redirector domain
            DBL_ABUSE_REDIR = "127.0.1.103";
            # abused legit phish
            DBL_ABUSE_PHISH = "127.0.1.104";
            # abused legit malware
            DBL_ABUSE_MALWARE = "127.0.1.105";
            # abused legit botnet C&C
            DBL_ABUSE_BOTNET = "127.0.1.106";
            # error - IP queries prohibited!
            DBL_PROHIBIT = "127.0.1.255";
        }
    }
    rule {
        suffix = "zen.spamhaus.org";
        symbol = "ZEN_URIBL";
        resolve_ip = true;
        ips {
            URIBL_SBL = "127.0.0.2";
        }
    }
    rule {
        suffix = "uribl.spameatingmonkey.net";
        symbol = "SEM_URIBL_UNKNOWN";
        bits {
            SEM_URIBL = 2;
        }
        no_ip = true;
    }
    rule {
        suffix = "fresh15.spameatingmonkey.net";
        symbol = "SEM_URIBL_FRESH15_UNKNOWN";
        bits {
            SEM_URIBL_FRESH15 = 2;
        }
        no_ip = true;
    }
}