You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by to...@absi.be on 2006/09/20 17:03:20 UTC
rbl checks from 20_dnsbl_tests.cf won't work after upgrading to 3.1.5
Hi,
We have fully reinstalled one of our 2 mailrelays to solaris 10 /
mimedefang / spamassassin 3.1.5 / clamav.
since the upgrade, i've noticed that the checks from 20_dnsbl_tests.cf
don't work anymore.
the file used is the one from version 3.1.5 (it has this line in it:
require_version 3.001005)
when I do spamassassin --lint -D everything seems fine:
(this is run with the defang user that also run's mimedefang):
I'll insert the relevant lines from the --lint:
[15859] dbg: dns: is Net::DNS::Resolver available? yes
[15859] dbg: dns: Net::DNS version: 0.58
[15859] dbg: diag: perl platform: 5.008004 solaris
[15859] dbg: diag: module installed: Digest::SHA1, version 2.11
[15859] dbg: diag: module installed: LWP::UserAgent, version 2.033
[15859] dbg: diag: module installed: HTTP::Date, version 1.47
[15859] dbg: diag: module installed: Archive::Tar, version 1.30
[15859] dbg: diag: module installed: IO::Zlib, version 1.04
[15859] dbg: diag: module installed: MIME::Base64, version 3.07
[15859] dbg: diag: module installed: HTML::Parser, version 3.55
[15859] dbg: diag: module installed: DB_File, version 1.814
[15859] dbg: diag: module installed: Net::DNS, version 0.58
[15859] dbg: diag: module installed: Net::SMTP, version 2.29
[15859] dbg: diag: module not installed: Mail::SPF::Query ('require'
failed)
[15859] dbg: diag: module not installed: IP::Country::Fast ('require'
failed)
[15859] dbg: diag: module installed: Razor2::Client::Agent, version 2.82
[15859] dbg: diag: module not installed: Net::Ident ('require' failed)
[15859] dbg: diag: module not installed: IO::Socket::INET6 ('require'
failed)
[15859] dbg: diag: module not installed: IO::Socket::SSL ('require'
failed)
[15859] dbg: diag: module installed: Time::HiRes, version 1.9
[15859] dbg: diag: module installed: DBI, version 1.52
[15859] dbg: diag: module installed: Getopt::Long, version 2.35
...
[15859] dbg: config: read file
/usr/perl5/5.8.4/share/spamassassin/20_dnsbl_tests.cf
...
[15859] dbg: config: read file
/usr/perl5/5.8.4/etc/mail/spamassassin/sa-mimedefang.cf
[15859] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from
@INC
[15859] dbg: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x82499a4)
[15859] dbg: dns: name server: 193.110.158.169, family: 2, ipv6: 0
[15859] dbg: dns: testing resolver nameservers: 193.110.158.169,
193.110.158.168
[15859] dbg: dns: trying (3) cingular.com...
[15859] dbg: dns: looking up NS for 'cingular.com'
[15859] dbg: dns: NS lookup of cingular.com using 193.110.158.169
succeeded => DNS available (set dns_available to over
ride)
[15859] dbg: dns: is DNS available? 1
[15859] dbg: metadata: X-Spam-Relays-Trusted:
[15859] dbg: metadata: X-Spam-Relays-Untrusted:
[15859] dbg: metadata: X-Spam-Relays-Internal:
[15859] dbg: metadata: X-Spam-Relays-External:
[15859] dbg: message: no encoding detected
[15859] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x82499a4)
implements 'parsed_metadata'
[15859] dbg: uridnsbl: domains to query:
[15859] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set
sblxbl-lastexternal
[15859] dbg: dns: checking RBL sa-accredit.habeas.com., set
habeas-firsttrusted
[15859] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl
[15859] dbg: dns: checking RBL sa-other.bondedsender.org., set
bsp-untrusted
[15859] dbg: dns: checking RBL combined.njabl.org., set njabl-lastexternal
[15859] dbg: dns: checking RBL combined.njabl.org., set njabl
[15859] dbg: dns: checking RBL combined-HIB.dnsiplists.completewhois.com.,
set whois
[15859] dbg: dns: checking RBL list.dsbl.org., set dsbl-lastexternal
[15859] dbg: dns: checking RBL bl.spamcop.net., set spamcop
[15859] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
bsp-firsttrusted
[15859] dbg: dns: checking RBL combined-HIB.dnsiplists.completewhois.com.,
set whois-lastexternal
[15859] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-lastexternal
[15859] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
[15859] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
[15859] dbg: check: running tests for priority: 0
[15859] dbg: rules: running header regexp tests; score so far=0
[15859] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
in /etc/mail/mimedefang-filter i've got
$SALocalTestsOnly = 0;
en in /usr/perl5/5.8.4/etc/mail/spamassassin/sa-mimedefang.cf i've got:
skip_rbl_checks 0
actually, this is as far as i can tell exactly the same setup as on our
other mailrelay, but on the other one, i see lots of hits like SPAMCOP and
RCVD_IN_XBLand the like, but not one such entry in the new setup.
How can I debug this further ? the server has the same ip address and
network config as before the upgrade...
Can I run a manual test of this .cf file to see what it does ? if so, how
?
thx,
tom.
...
---------------------------------------------------------------------------
Tom Van Overbeke - ABSI Service Delivery Coordinator
email: tomvo@absi.be
Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60
website: http://www.absi.be
---------------------------------------------------------------------------
Re: 70_sare_spoof.cf False Pos - Bank of America
Posted by Loren Wilton <lw...@earthlink.net>.
"Legit" in this particular instance is open to interpretation. :-(
The mail isn't from BofA. The mail is from CheckFree Inc.
Which is a legit banking company, but it isn't BofA.
So they are lying in the From address about who they are. In that sense,
the mail is a spoof.
On the other hand, it doubtless relates to some transaction on a BofA
account, and in that sense is somewhat legit. And they probably used the
BofA in the From so Joe Average would "know" that it was a legit mail, and
not from some company he never heard of.
Sigh.
Loren
----- Original Message -----
From: "qqqq" <qq...@usermail.com>
To: "Kelson Vibber" <ke...@speed.net>; "SpamAssassin Users"
<us...@spamassassin.apache.org>
Sent: Thursday, September 21, 2006 7:40 PM
Subject: Re: 70_sare_spoof.cf False Pos - Bank of America
>> *sigh* Assuming this really is legit... I hate it when prime phishing
>> targets decide to make things easier for the phishers by making their
>> own mail look suspicious, thereby training users to ignore warning signs.
>>
>> My "favorite" (and I use that term loosely) is Symantec -- a computer
>> security company -- which sends things like upgrade offers through
>> bluehornet.com.
>>
>
> Yea..it's legit. I checked the links and it was certainly them and the
> numbers in the emailing matched my info.
>
> B
Re: 70_sare_spoof.cf False Pos - Bank of America
Posted by qqqq <qq...@usermail.com>.
> *sigh* Assuming this really is legit... I hate it when prime phishing
> targets decide to make things easier for the phishers by making their
> own mail look suspicious, thereby training users to ignore warning signs.
>
> My "favorite" (and I use that term loosely) is Symantec -- a computer
> security company -- which sends things like upgrade offers through
> bluehornet.com.
>
Yea..it's legit. I checked the links and it was certainly them and the
numbers in the emailing matched my info.
B
Re: 70_sare_spoof.cf False Pos - Bank of America
Posted by Kelson Vibber <ke...@speed.net>.
qqqq wrote:
> Looks like they are no longer using:
> Received =~ /\.bankofamerica\.com/i
<snip>
> Received: from outbd-pstfx.customercenter.net (outbd-pstfx.customercenter.net [208.235.248.20])
*sigh* Assuming this really is legit... I hate it when prime phishing
targets decide to make things easier for the phishers by making their
own mail look suspicious, thereby training users to ignore warning signs.
My "favorite" (and I use that term loosely) is Symantec -- a computer
security company -- which sends things like upgrade offers through
bluehornet.com.
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
70_sare_spoof.cf False Pos - Bank of America
Posted by qqqq <qq...@usermail.com>.
Looks like they are no longer using:
Received =~ /\.bankofamerica\.com/i
Return-Path: <bi...@billpay.bankofamerica.com>
X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on san.MUNGED.com
X-Spam-Status: Yes, score=5.3 required=5.2 tests=DNS_FROM_RFC_WHOIS=0.879,
HTML_MESSAGE=0.001,MIME_HTML_ONLY=0.001,NO_REAL_NAME=0.55,
SARE_FORGED_BANKOFA=3,SARE_HELO_EQ_CUST=0.122,X_MAILER_SPAM=0.72
autolearn=disabled version=3.1.4
X-Spam-Report:
* 0.1 SARE_HELO_EQ_CUST SARE_HELO_EQ_CUST
* 0.7 X_MAILER_SPAM X-Mailer: header is bulk email fingerprint
* 0.6 NO_REAL_NAME From: does not include a real name
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.9 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org
* 3.0 SARE_FORGED_BANKOFA SARE_FORGED_BANKOFA
Received: from gateway.MUNGED.com (mailgateway.MUNGED.com [216.x.x.x])
by imap.MUNGED.com (8.13.2/8.13.2) with ESMTP id k8LCS66W000351
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 06:28:06 -0600
X-ASG-Debug-ID: 1158841685-73ed03500000-213ZTq
X-Barracuda-URL: http://216.150.205.179:8000/cgi-bin/mark.cgi
X-Barracuda-Connect: outbd-pstfx.customercenter.net[208.235.248.20]
X-Barracuda-Start-Time: 1158841685
Received: from outbd-pstfx.customercenter.net (outbd-pstfx.customercenter.net [208.235.248.20])
by gateway.MUNGED.com (Spam Firewall) with ESMTP id E7C9529B429
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 06:28:05 -0600 (MDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by outbd-pstfx.customercenter.net (Postfix) with ESMTP id 5145D214279
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:27:17 -0400 (EDT)
X-Virus-Scanned: ClamAV 0.88.3/1918/Thu Sep 21 02:58:53 2006 on imap.MUNGED.com
X-Virus-Scanned: by amavisd-new at customercenter.net
Received: from prod-mail.customercenter.net (elpemh04.nc.customercenter.net [10.30.26.54])
by outbd-pstfx.customercenter.net (Postfix) with ESMTP id B0513214253
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:27:16 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by prod-mail.customercenter.net (Postfix) with ESMTP id 3E8DD2680F3
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:28:04 -0400 (EDT)
X-Virus-Scanned: by amavisd-new at customercenter.net
Received: from elpgts03.nc.checkfree.com (elpgts03.nc.checkfree.com [10.30.44.143])
by prod-mail.customercenter.net (Postfix) with ESMTP id B86BD2680F1
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:28:03 -0400 (EDT)
Message-ID: <15...@ewaexe01.nc.checkfree.com>
Date: Thu, 21 Sep 2006 08:28:03 -0400 (EDT)
From: billpay@billpay.bankofamerica.com
Reply-To: billpay.reply@billpay.bankofamerica.com
To: qqqq@MUNGED.com
X-ASG-Orig-Subj: You have a new bill from Bank of America Credit Card
Subject: POTENTIAL SPAM You have a new bill from Bank of America Credit Card
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Priority: 2 (Normal)
X-Mailer: cdasend
Re: rbl checks from 20_dnsbl_tests.cf won't work after upgradingto 3.1.5
Posted by to...@absi.be.
Hi,
Brilliant.
I had a stray sa-mimedefang.cf in /etc/mail !!!
Thanks so much, I can finally go home now :-)
T.
---------------------------------------------------------------------------
Tom Van Overbeke - ABSI Service Delivery Coordinator
email: tomvo@absi.be
Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60
website: http://www.absi.be
---------------------------------------------------------------------------
Jonas Eckerman <jo...@frukt.org>
21/09/2006 18:54
Please respond to jonas
To: users@spamassassin.apache.org
cc:
Subject: Re: rbl checks from 20_dnsbl_tests.cf won't work
after upgradingto 3.1.5
tomvo@absi.be wrote:
> So my question is: why would these checks (they're all in the
> 20_dnsbl_tests.cf file) work when I run them from the commandline, but
not
> via mimedefang ?
Probably because you've set $SALocalTestsOnly to 1 in mimedefang-filter or
because MIMEDefang uses it's own user config file and site dir for
SpamAssassin (on our FreeBSD system it's the file
"/usr/local/etc/mimedefang/sa-mimedefang.cf" and the directory
"/usr/local/etc/mimedefang/spamassassin" for example).
/Jonas
--
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/
Re: rbl checks from 20_dnsbl_tests.cf won't work after upgradingto
3.1.5
Posted by Jonas Eckerman <jo...@frukt.org>.
tomvo@absi.be wrote:
> So my question is: why would these checks (they're all in the
> 20_dnsbl_tests.cf file) work when I run them from the commandline, but not
> via mimedefang ?
Probably because you've set $SALocalTestsOnly to 1 in mimedefang-filter or because MIMEDefang uses it's own user config file and site dir for SpamAssassin (on our FreeBSD system it's the file "/usr/local/etc/mimedefang/sa-mimedefang.cf" and the directory "/usr/local/etc/mimedefang/spamassassin" for example).
/Jonas
--
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/
Re: rbl checks from 20_dnsbl_tests.cf won't work after upgradingto 3.1.5
Posted by to...@absi.be.
Hi,
I did as you suggested (I modified one of the Received headers with an ip
that was in one of the RBL lists) and yes, I did get several hits.
I first switched to the user "defang" which is the owner of the
mimedefang process, just to make sure i imitated the production
environment as much as possible.
So my question is: why would these checks (they're all in the
20_dnsbl_tests.cf file) work when I run them from the commandline, but not
via mimedefang ?
Does anyone know of a way to debug mimedefang/spamassassin so I can see
the output of each spamassassin scan ?
do I need to write some code in mimedefang.pl somewhere ? is there an
easier option ?
regards,
Tom.
---------------------------------------------------------------------------
Tom Van Overbeke - ABSI Service Delivery Coordinator
email: tomvo@absi.be
Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60
website: http://www.absi.be
---------------------------------------------------------------------------
mouss <us...@free.fr>
21/09/2006 01:39
Please respond to mouss
To: users@spamassassin.apache.org
cc:
Subject: Re: rbl checks from 20_dnsbl_tests.cf won't work
after upgradingto 3.1.5
tomvo@absi.be wrote:
> Hi,
>
> We have fully reinstalled one of our 2 mailrelays to solaris 10 /
> mimedefang / spamassassin 3.1.5 / clamav.
>
> since the upgrade, i've noticed that the checks from 20_dnsbl_tests.cf
> don't work anymore.
> the file used is the one from version 3.1.5 (it has this line in it:
> require_version 3.001005)
>
> when I do spamassassin --lint -D everything seems fine:
>
> (this is run with the defang user that also run's mimedefang):
>
> I'll insert the relevant lines from the --lint:
>
> [15859] dbg: dns: is Net::DNS::Resolver available? yes
> [15859] dbg: dns: Net::DNS version: 0.58
> [15859] dbg: diag: perl platform: 5.008004 solaris
> [15859] dbg: diag: module installed: Digest::SHA1, version 2.11
> [15859] dbg: diag: module installed: LWP::UserAgent, version 2.033
> [15859] dbg: diag: module installed: HTTP::Date, version 1.47
> [15859] dbg: diag: module installed: Archive::Tar, version 1.30
> [15859] dbg: diag: module installed: IO::Zlib, version 1.04
> [15859] dbg: diag: module installed: MIME::Base64, version 3.07
> [15859] dbg: diag: module installed: HTML::Parser, version 3.55
> [15859] dbg: diag: module installed: DB_File, version 1.814
> [15859] dbg: diag: module installed: Net::DNS, version 0.58
> [15859] dbg: diag: module installed: Net::SMTP, version 2.29
> [15859] dbg: diag: module not installed: Mail::SPF::Query ('require'
> failed)
> [15859] dbg: diag: module not installed: IP::Country::Fast ('require'
> failed)
> [15859] dbg: diag: module installed: Razor2::Client::Agent, version 2.82
> [15859] dbg: diag: module not installed: Net::Ident ('require' failed)
> [15859] dbg: diag: module not installed: IO::Socket::INET6 ('require'
> failed)
> [15859] dbg: diag: module not installed: IO::Socket::SSL ('require'
> failed)
> [15859] dbg: diag: module installed: Time::HiRes, version 1.9
> [15859] dbg: diag: module installed: DBI, version 1.52
> [15859] dbg: diag: module installed: Getopt::Long, version 2.35
>
> ...
>
>
> [15859] dbg: config: read file
> /usr/perl5/5.8.4/share/spamassassin/20_dnsbl_tests.cf
>
> ...
>
>
> [15859] dbg: config: read file
> /usr/perl5/5.8.4/etc/mail/spamassassin/sa-mimedefang.cf
> [15859] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from
> @INC
> [15859] dbg: plugin: registered
> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x82499a4)
> [15859] dbg: dns: name server: 193.110.158.169, family: 2, ipv6: 0
> [15859] dbg: dns: testing resolver nameservers: 193.110.158.169,
> 193.110.158.168
> [15859] dbg: dns: trying (3) cingular.com...
> [15859] dbg: dns: looking up NS for 'cingular.com'
> [15859] dbg: dns: NS lookup of cingular.com using 193.110.158.169
> succeeded => DNS available (set dns_available to over
> ride)
> [15859] dbg: dns: is DNS available? 1
> [15859] dbg: metadata: X-Spam-Relays-Trusted:
> [15859] dbg: metadata: X-Spam-Relays-Untrusted:
> [15859] dbg: metadata: X-Spam-Relays-Internal:
> [15859] dbg: metadata: X-Spam-Relays-External:
> [15859] dbg: message: no encoding detected
> [15859] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x82499a4)
> implements 'parsed_metadata'
> [15859] dbg: uridnsbl: domains to query:
> [15859] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set
> sblxbl-lastexternal
> [15859] dbg: dns: checking RBL sa-accredit.habeas.com., set
> habeas-firsttrusted
> [15859] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl
> [15859] dbg: dns: checking RBL sa-other.bondedsender.org., set
> bsp-untrusted
> [15859] dbg: dns: checking RBL combined.njabl.org., set
njabl-lastexternal
> [15859] dbg: dns: checking RBL combined.njabl.org., set njabl
> [15859] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com.,
> set whois
> [15859] dbg: dns: checking RBL list.dsbl.org., set dsbl-lastexternal
> [15859] dbg: dns: checking RBL bl.spamcop.net., set spamcop
> [15859] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
> bsp-firsttrusted
> [15859] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com.,
> set whois-lastexternal
> [15859] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-lastexternal
> [15859] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
> [15859] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
> [15859] dbg: check: running tests for priority: 0
> [15859] dbg: rules: running header regexp tests; score so far=0
> [15859] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
>
>
> in /etc/mail/mimedefang-filter i've got
> $SALocalTestsOnly = 0;
> en in /usr/perl5/5.8.4/etc/mail/spamassassin/sa-mimedefang.cf i've got:
>
> skip_rbl_checks 0
>
>
> actually, this is as far as i can tell exactly the same setup as on our
> other mailrelay, but on the other one, i see lots of hits like SPAMCOP
and
> RCVD_IN_XBLand the like, but not one such entry in the new setup.
>
> How can I debug this further ? the server has the same ip address and
> network config as before the upgrade...
> Can I run a manual test of this .cf file to see what it does ? if so,
how
> ?
>
"build" a message with Received headers that contain hops listed in some
rbls, and do
# spamassassin -D -t < message.eml 2>&1 |more
Re: rbl checks from 20_dnsbl_tests.cf won't work after upgrading
to 3.1.5
Posted by mouss <us...@free.fr>.
tomvo@absi.be wrote:
> Hi,
>
> We have fully reinstalled one of our 2 mailrelays to solaris 10 /
> mimedefang / spamassassin 3.1.5 / clamav.
>
> since the upgrade, i've noticed that the checks from 20_dnsbl_tests.cf
> don't work anymore.
> the file used is the one from version 3.1.5 (it has this line in it:
> require_version 3.001005)
>
> when I do spamassassin --lint -D everything seems fine:
>
> (this is run with the defang user that also run's mimedefang):
>
> I'll insert the relevant lines from the --lint:
>
> [15859] dbg: dns: is Net::DNS::Resolver available? yes
> [15859] dbg: dns: Net::DNS version: 0.58
> [15859] dbg: diag: perl platform: 5.008004 solaris
> [15859] dbg: diag: module installed: Digest::SHA1, version 2.11
> [15859] dbg: diag: module installed: LWP::UserAgent, version 2.033
> [15859] dbg: diag: module installed: HTTP::Date, version 1.47
> [15859] dbg: diag: module installed: Archive::Tar, version 1.30
> [15859] dbg: diag: module installed: IO::Zlib, version 1.04
> [15859] dbg: diag: module installed: MIME::Base64, version 3.07
> [15859] dbg: diag: module installed: HTML::Parser, version 3.55
> [15859] dbg: diag: module installed: DB_File, version 1.814
> [15859] dbg: diag: module installed: Net::DNS, version 0.58
> [15859] dbg: diag: module installed: Net::SMTP, version 2.29
> [15859] dbg: diag: module not installed: Mail::SPF::Query ('require'
> failed)
> [15859] dbg: diag: module not installed: IP::Country::Fast ('require'
> failed)
> [15859] dbg: diag: module installed: Razor2::Client::Agent, version 2.82
> [15859] dbg: diag: module not installed: Net::Ident ('require' failed)
> [15859] dbg: diag: module not installed: IO::Socket::INET6 ('require'
> failed)
> [15859] dbg: diag: module not installed: IO::Socket::SSL ('require'
> failed)
> [15859] dbg: diag: module installed: Time::HiRes, version 1.9
> [15859] dbg: diag: module installed: DBI, version 1.52
> [15859] dbg: diag: module installed: Getopt::Long, version 2.35
>
> ...
>
>
> [15859] dbg: config: read file
> /usr/perl5/5.8.4/share/spamassassin/20_dnsbl_tests.cf
>
> ...
>
>
> [15859] dbg: config: read file
> /usr/perl5/5.8.4/etc/mail/spamassassin/sa-mimedefang.cf
> [15859] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from
> @INC
> [15859] dbg: plugin: registered
> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x82499a4)
> [15859] dbg: dns: name server: 193.110.158.169, family: 2, ipv6: 0
> [15859] dbg: dns: testing resolver nameservers: 193.110.158.169,
> 193.110.158.168
> [15859] dbg: dns: trying (3) cingular.com...
> [15859] dbg: dns: looking up NS for 'cingular.com'
> [15859] dbg: dns: NS lookup of cingular.com using 193.110.158.169
> succeeded => DNS available (set dns_available to over
> ride)
> [15859] dbg: dns: is DNS available? 1
> [15859] dbg: metadata: X-Spam-Relays-Trusted:
> [15859] dbg: metadata: X-Spam-Relays-Untrusted:
> [15859] dbg: metadata: X-Spam-Relays-Internal:
> [15859] dbg: metadata: X-Spam-Relays-External:
> [15859] dbg: message: no encoding detected
> [15859] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x82499a4)
> implements 'parsed_metadata'
> [15859] dbg: uridnsbl: domains to query:
> [15859] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set
> sblxbl-lastexternal
> [15859] dbg: dns: checking RBL sa-accredit.habeas.com., set
> habeas-firsttrusted
> [15859] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl
> [15859] dbg: dns: checking RBL sa-other.bondedsender.org., set
> bsp-untrusted
> [15859] dbg: dns: checking RBL combined.njabl.org., set njabl-lastexternal
> [15859] dbg: dns: checking RBL combined.njabl.org., set njabl
> [15859] dbg: dns: checking RBL combined-HIB.dnsiplists.completewhois.com.,
> set whois
> [15859] dbg: dns: checking RBL list.dsbl.org., set dsbl-lastexternal
> [15859] dbg: dns: checking RBL bl.spamcop.net., set spamcop
> [15859] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
> bsp-firsttrusted
> [15859] dbg: dns: checking RBL combined-HIB.dnsiplists.completewhois.com.,
> set whois-lastexternal
> [15859] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-lastexternal
> [15859] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
> [15859] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
> [15859] dbg: check: running tests for priority: 0
> [15859] dbg: rules: running header regexp tests; score so far=0
> [15859] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
>
>
> in /etc/mail/mimedefang-filter i've got
> $SALocalTestsOnly = 0;
> en in /usr/perl5/5.8.4/etc/mail/spamassassin/sa-mimedefang.cf i've got:
>
> skip_rbl_checks 0
>
>
> actually, this is as far as i can tell exactly the same setup as on our
> other mailrelay, but on the other one, i see lots of hits like SPAMCOP and
> RCVD_IN_XBLand the like, but not one such entry in the new setup.
>
> How can I debug this further ? the server has the same ip address and
> network config as before the upgrade...
> Can I run a manual test of this .cf file to see what it does ? if so, how
> ?
>
"build" a message with Received headers that contain hops listed in some
rbls, and do
# spamassassin -D -t < message.eml 2>&1 |more