You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael Hallager <mi...@nettrust.nz> on 2016/11/08 06:49:51 UTC
Spam Assassin multiple URI RBL's (amended)
I have deployed Spam Assassin between Postfix and Dovecot. It works
except for a weird problem.
I use a custom URI RBL in addition to the default ones. This works with
a test URL in the body of an email message, however with real spam URL's
- which are listed with other URI RBL's - Spam Assassin is scoring on
those and not on the custom one.
Local configuration:
urirhssub URIBL_CUSTOM rbl.myrbl.tld. A 2
Note: I am not sure which of the following is correct but they both work
and don't work as described above.
#body URIBL_CUSTOM eval:check_uridnsbl('URIBL_BLACK_NS')
body URIBL_CUSTOM eval:check_uridnsbl('URIBL_CUSTOM')
describe URIBL_CUSTOM Body contains a URL listed in our URI
RBL
tflags URIBL_CUSTOM net
score URIBL_CUSTOM 5.0
I am not sure what this does so I commented it out.
#reuse URIBL_CUSTOM
The format of the RBL zone records is:
spammyhost.spamdomain.tld.rbl.myrbl.tld
A
127.0.0.2
To reiterate - it does work, but not all the time.
Help much appreciated, thanks.
Re: Spam Assassin multiple URI RBL's (amended)
Posted by Michael Hallager <mi...@nettrust.nz>.
Response below.
On 2016-11-09 01:49, Axb wrote:
> On 11/08/2016 07:49 AM, Michael Hallager wrote:
>> I have deployed Spam Assassin between Postfix and Dovecot. It works
>> except for a weird problem.
>>
>> I use a custom URI RBL in addition to the default ones. This works
>> with
>> a test URL in the body of an email message, however with real spam
>> URL's
>> - which are listed with other URI RBL's - Spam Assassin is scoring on
>> those and not on the custom one.
>>
>> Local configuration:
>>
>> urirhssub URIBL_CUSTOM rbl.myrbl.tld. A 2
>>
>> Note: I am not sure which of the following is correct but they both
>> work
>> and don't work as described above.
>>
>> #body URIBL_CUSTOM eval:check_uridnsbl('URIBL_BLACK_NS')
>> body URIBL_CUSTOM eval:check_uridnsbl('URIBL_CUSTOM')
>>
>> describe URIBL_CUSTOM Body contains a URL listed in our URI
>> RBL
>> tflags URIBL_CUSTOM net
>> score URIBL_CUSTOM 5.0
>>
>> I am not sure what this does so I commented it out.
>> #reuse URIBL_CUSTOM
>>
>> The format of the RBL zone records is:
>>
>> spammyhost.spamdomain.tld.rbl.myrbl.tld
>> A
>> 127.0.0.2
>>
>> To reiterate - it does work, but not all the time.
>>
>> Help much appreciated, thanks.
>
> URIBL plugin does lookups for spamdomain.tld
>
> spammyhost will only be looked up if you make a 2tld definition for
> spamdomain.tld which seldom makes sense unless you see a large amount
> of spam and legit subdomain URIs as for example in SA's
>
> util_rb_2tld tumblr.com
Thanks for that.
Using the above example, does this mean I need 2 DNS entries like this?
spamdomain.tld.rbl.myrbl.tld - A - 127.0.0.2
spammyhost.spamdomain.tld.rbl.myrbl.tld - A - 127.0.0.2
Re: Spam Assassin multiple URI RBL's (amended)
Posted by Axb <ax...@gmail.com>.
On 11/08/2016 07:49 AM, Michael Hallager wrote:
> I have deployed Spam Assassin between Postfix and Dovecot. It works
> except for a weird problem.
>
> I use a custom URI RBL in addition to the default ones. This works with
> a test URL in the body of an email message, however with real spam URL's
> - which are listed with other URI RBL's - Spam Assassin is scoring on
> those and not on the custom one.
>
> Local configuration:
>
> urirhssub URIBL_CUSTOM rbl.myrbl.tld. A 2
>
> Note: I am not sure which of the following is correct but they both work
> and don't work as described above.
>
> #body URIBL_CUSTOM eval:check_uridnsbl('URIBL_BLACK_NS')
> body URIBL_CUSTOM eval:check_uridnsbl('URIBL_CUSTOM')
>
> describe URIBL_CUSTOM Body contains a URL listed in our URI RBL
> tflags URIBL_CUSTOM net
> score URIBL_CUSTOM 5.0
>
> I am not sure what this does so I commented it out.
> #reuse URIBL_CUSTOM
>
> The format of the RBL zone records is:
>
> spammyhost.spamdomain.tld.rbl.myrbl.tld
> A
> 127.0.0.2
>
> To reiterate - it does work, but not all the time.
>
> Help much appreciated, thanks.
URIBL plugin does lookups for spamdomain.tld
spammyhost will only be looked up if you make a 2tld definition for
spamdomain.tld which seldom makes sense unless you see a large amount of
spam and legit subdomain URIs as for example in SA's
util_rb_2tld tumblr.com