Overall, they seem to work well together. It's reduced my spam to just a few per week. I wanted to only use RBLs that were free, and had easy removal policies. A rogue RBL is just as bad as a spammer IMO.
Barracuda does require registration but it takes just a few minutes and is totally worth it. It was the last one added, and seems to have been the "finishing touch" needed to call this project done.
One final thought is I have noticed that Lashback does filter some legitimate marketing emails. In particular, it seems to block emails from LinkedIn, but who really reads that stuff anyway?
I'm not sure how to configure WHM. I can see there is a setting at Service Configuration » Exim Configuration Manager » Manage Custom RBLs.
Let's say I want to add GBUdb. Would I enter something like:
RBL Name: GBUdb
RBL Info URL: [WHT stopped me from entering the full URL]/truncateTidbits.jsp
DNS List: truncate.gbudb.net
I gather the first fields two aren't important.
Then back in Exim Configuration Manager, do you set "Reject mail at SMTP time if the sender host is in the RBUdb RBL" to "Yes" or "No"? I assume if it is yes, I will never see the email. Until I test this, I THINK I would prefer the mail to come through and get tagged somehow so I can write a filter rule. If that's the correct thinking, is something added to the headers that I can use to filter?
Using sane RBLs is very important. I only use Spamhaus and SpamCop because of their delisting policies and also how sane their blacklisting is.
For instance, the OP mentions they use UCEPROTECT, which is also in cohoots with backscatterer (a known extortion list). UCEPROTECT will also leave ranges blacklisted for no apparent reason, and charges an "express" delist fee (read: they delist you when they want, unless you give them cash). I would suggest removing that list ASAP.
Even good lists go bad sometimes (see: SORBS). I would highly recommend using the least amount of RBLs as possible and verifying the RBLs you're using are known, reputable lists.
My question remains - how do I set these up in WHM? When they are added in WHM, does something get added to the headers that I can then filter in each individual mailbox? Or do most people use "Reject mail at SMTP time" option which I assume bounces the email before I even see it?