Re: Non-blocklisted embedded URLs are getting hits on URIBL_AB_SURBL and URIBL_PH_SURBL in SpamAssassin 3.1.5

[Justin Mason <jm...@jmason.org>]

David Ulevitch writes:
>On Sep 30, 2006, at 3:30 AM, Justin Mason wrote:
>
>> David Ulevitch writes:
>>>
>>> Donald,
>>>
>>> We handle DNSBLs but not URIBLs, at the moment.  Passing along to
>>> Noah to see what he can do.  Sorry you had this happen to your
>>> SpamAssassin scoring. (Time to check mine... :-) )
>>>
>>> You can resolve this behavior by turning off typo correction in your
>>> preferences page and it'll work again with us returning NXDOMAIN
>>> (RCODE=3) instead of doing the typo correction service.  Hopefully we
>>> can get more granular with that in the future.
>>>
>>> If you are on a dynamic IP, well, just sit tight for a couple more
>>> weeks or email me to start beta testing some code this week to handle
>>> dynamic IPs (and that offer is for anyone).
>>
>> David --
>>
>> Thanks for commenting, and good to hear it doesn't affect traditional
>> DNSBL lookups.   It sounds like we should probably add a temporary
>> SpamAssassin FAQ entry for this?
>>
>
>Justin,
>
>That sounds like a good idea.  Want me to write one up for you in the  
>style of the SA FAQ or is there enough in my post above to toss one  
>in until we are better able to address URIBLs?

David --

if you could add it to the FAQ at

  http://wiki.apache.org/spamassassin/FixingErrors

that'd be great -- it's a wiki, so editing is easy.  I'm not quite
sure of all the details, so I'd prefer if someone with more knowledge
could write it up.  cheers ;)

--j.

Re: Non-blocklisted embedded URLs are getting hits on URIBL_AB_SURBL and URIBL_PH_SURBL in SpamAssassin 3.1.5

[Jeff Chan <je...@surbl.org>]

If it helps, here's what I wrote for the SURBL FAQ:

  http://www.surbl.org/faq.html#opendns


I'm using OpenDNS and getting wrong answers to SURBL DNS queries

OpenDNS is a service that changes the responses to some DNS
queries in order to prevent users from visiting spam, phishing,
etc., sites. It also has a "typo correction" feature that directs
mistyped domain names to custom sites controlled by OpenDNS
instead of sites controlled by typosquatters, phishers, etc.

When using SURBLs with an OpenDNS nameserver it's important to
disable the typo correction feature, or the responses to
non-matching SURBL queries will be incorrect to a SURBL
application. The reason is that the OpenDNS nameservers return an
IP address of their own web site in those cases, and that
modified IP address will have an incorrect effect on SURBL list
identification that depends on where the bit patterns happen to
be in the modified response. 

SURBLs will work with OpenDNS if their typo correction feature is
disabled on servers or clients doing SURBL queries.
Alternatively, consider using non-OpenDNS nameservers on those
systems. 

Note also that SURBL applications may be incompatible with other
DNS modification or proxy services that change the DNS query
results of non-matches (NXDOMAIN results).


Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/