MIMEDefang, SpamAssassin and URIDNSBLs

[Tim Boyer <ti...@denmantire.com>]

I'm not quite sure where to begin debugging this one.

I'm running MIMEDefang 2.44 with SpamAssassin 3, and everything is
working great - except SpamAssassin's 'look up URLs against DNS
blocklists' feature.

The odd part is that it seems to be working when I run SpamAssassin in
debug mode, but not when it's called from MIMEDefang.  For instance, I
just got spam advertising compprog.biz, listed in the SBL list.  It
originally got to me with only a score of 4.249 (but note the
'BIZ_TLD' check, which at least tells me it's scanning the body):

X-Spam-Score: 4.249 (****) BIZ_TLD,FORGED_HOTMAIL_RCVD2,LOTS_OF_STUFF
X-Scanned-By: MIMEDefang 2.44

When I copied the whole message to test2.email and ran
'spamassassin -D -t<test2.email', however, I got a score just a _bit_
different:

X-Spam-Level: ************************
X-Spam-Status: Yes, score=24.8 required=8.0 tests=BIZ_TLD,
        FORGED_HOTMAIL_RCVD2,LOTS_OF_STUFF,RCVD_IN_BL_SPAMCOP_NET,

RCVD_IN_DSBL,RCVD_IN_XBL,URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_SBLXBL,
        URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=spam version=3.0.0-rc5

Why the heck would I get one score when called from MIMEDefang, and
another when done 'by hand'?

Here's what I've done to try to debug it.

1.  Yes, I've got loadplugin Mail::SpamAssassin::Plugin::URIDNSBL in
init.pre.

2.  Am I reading different versions of the .cf file?  Nope; I added a
line that says

score BIZ_TLD 3.141

into sa-mimedefang.cf.  Both the 'by hand' and the mimedefang version
score a .biz as 3.1, so I know they're both seeing it.  I've got
/etc/mail/sa-mimedefang.cf, /etc/mail/spamassassin/sa-mimedefang.cf,
and /etc/mail/spamassassin/local.cf all linked together.

3.  Do I have DNS lookup enabled?  Yup:

# Enable or disable network checks
dns_available yes
skip_rbl_checks         0
rbl_timeout             15

Can't think of anything else to try.  If I knew how to make MIMEDefang
call SpamAssassin with the debug switch, that might point me in the
right direction.

Thanks much for any help!

--
Tim Boyer
Director
Information Systems and Engineering Projects
Denman Tire Corporation
tim@denmantire.com


-- 
Tim Boyer
tim@denmantire.com

RE: MIMEDefang, SpamAssassin and URIDNSBLs

[Tim Boyer <ti...@denmantire.com>]

>
> Tim Boyer wrote to users@spamassassin.apache.org:
>
> > 3.  Do I have DNS lookup enabled?  Yup:
> >
> > # Enable or disable network checks
> > dns_available yes
> > skip_rbl_checks         0
> > rbl_timeout             15
> >
> > Can't think of anything else to try.
>
> Do you have
>
>      # If boolean true, skip SA network tests
>      $SALocalTestsOnly = 1;
>
> in your mimedefang-filter? Make sure you set $SALocalTestsOnly to zero.
> For whatever reason, MIMEDefang decided they would override this *one*
> SA option within mimedefang-filter. ;-)
>

Yup:

$AdminAddress = 'postmaster@denmantire.com';
$AdminName = "Tim Boyer";
$SALocalTestsOnly = 0;


> If that doesn't help, get a bigger hammer, or maybe ask on the
> MIMEDefang list.
>

I've posted substantially the same message there - with substantially the
same results.

> > If I knew how to make MIMEDefang call SpamAssassin with the debug
> > switch, that might point me in the right direction.
>
> MIMEDefang uses the SA libs directly... which means, so can you, in
> mimedefang-filter. :-) I've never tried it, but you should be able to
> enable debugging output before calling the SA check in filter_end().
>

I'll give it a try in the morning.  Thanks much...

--
Tim Boyer
Director
Information Systems and Engineering Projects
Denman Tire Corporation
tim@denmantire.com

Re: MIMEDefang, SpamAssassin and URIDNSBLs

[Ryan Thompson <ry...@sasknow.com>]

Tim Boyer wrote to users@spamassassin.apache.org:

> 3.  Do I have DNS lookup enabled?  Yup:
>
> # Enable or disable network checks
> dns_available yes
> skip_rbl_checks         0
> rbl_timeout             15
>
> Can't think of anything else to try.

Do you have

     # If boolean true, skip SA network tests
     $SALocalTestsOnly = 1;

in your mimedefang-filter? Make sure you set $SALocalTestsOnly to zero.
For whatever reason, MIMEDefang decided they would override this *one*
SA option within mimedefang-filter. ;-)

If that doesn't help, get a bigger hammer, or maybe ask on the
MIMEDefang list.

> If I knew how to make MIMEDefang call SpamAssassin with the debug
> switch, that might point me in the right direction.

MIMEDefang uses the SA libs directly... which means, so can you, in
mimedefang-filter. :-) I've never tried it, but you should be able to
enable debugging output before calling the SA check in filter_end().

- Ryan

-- 
   Ryan Thompson <ry...@sasknow.com>

   SaskNow Technologies - http://www.sasknow.com
   901-1st Avenue North - Saskatoon, SK - S7K 1Y4

         Tel: 306-664-3600   Fax: 306-244-7037   Saskatoon
   Toll-Free: 877-727-5669     (877-SASKNOW)     North America