Re: AskDNS with a DNAME

[John Hardin <jh...@impsec.org>]

On Sun, 28 Feb 2021, RW wrote:

> On Sun, 28 Feb 2021 07:42:42 -0800 (PST)
> John Hardin wrote:
>
>> On Sun, 28 Feb 2021, Michael Grant wrote:
>>
>>> I've traced through the AskDNS plugin and it's definitely only
>>> looking at the first response that gets returned in this case.  I
>>> also tried a regex submatch like:
>>>
>>> askdns   RBL_SENDGRID_ID _SENDGRIDID_.sendgrid-id.localhost A
>>> /127.0.0.2/
>>>
>>> and still not working.  The AskDNS code which loops through the
>>> result only looks at the alias result that's returned.
>>
>> I would indeed characterize that as a bug in the AskDNS plugin. The
>> fact that it is an alias is not useful information to the evaluation
>> of the message's spamminess, and the information that *is* useful -
>> critical, in fact - is being discarded.
>>
>> Please open a bugzilla ticket for this.
>
> There is already a very similar one:
>
> https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7875

There are a bunch of code changes to AskDNS on trunk, so the suggested fix 
in 7875 is only relevant to the 3.4 branch.

The latest 3.4 release is still pending :( - do we want to try to squeeze 
this in too?


-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org                         pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Are you a mildly tech-literate politico horrified by the level of
   ignorance demonstrated by lawmakers gearing up to regulate online
   technology they don't even begin to grasp? Cool. Now you have a
   tiny glimpse into a day in the life of a gun owner.   -- Sean Davis
-----------------------------------------------------------------------
  14 days until Albert Einstein's 142nd Birthday