You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Max Erenburg via users <us...@spamassassin.apache.org> on 2025/01/08 23:36:51 UTC
SA 4.0.1 - util_rb_3tld
Hello,
Looking to check if my understanding is correct or there is some sort of bug.
I have the following entry in my local.cf file:
util_rb_3tld ct.sendgrid.net
I would expect that ' *.ct.sendgrid.net ' would be excluded from any URI BL lookups?
However I see in my spamd log the following "URIBL, A/u14602141.ct.sendgrid.net.dob.sibl.support-intelligence.net, rules: URIBL_RHS_DOB"
I'm new to working with the product so not sure if the URIBL ".dob.sibl.support-intelligence.net" being in 72_active.cf versus 25_uribl.cf, process differently for which URI to check?
Please let me know when you have some time, thanks,
Max
Re: [External] SA 4.0.1 - util_rb_3tld
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>On 09.01.25 16:06, Max Erenburg via users wrote:
>>>Yeah not trying to welcome them entirely, more so like other
>>>well-known domains that are commonly seen and will not be
>>>blacklisted (e.g. docs.google.com ).
>>>
>>>I will try out:
>>>uridnsbl_skip_domain ct.sendgrid.net
>On Fri, 10 Jan 2025, Matus UHLAR - fantomas wrote:
>>Tell me please if it works, I'm afraid it won't exactly because of
>>the util_rb_3tld ct.sendgrid.net
>>
>>which seems to cause not finding ct.sendgrid.net in lists of domains to skip:
>>https://marc.info/?l=spamassassin-users&m=172320987309970&w=2
On 11.01.25 16:31, John Hardin wrote:
>That's a side-effect of util_rb_Xtld - the listed domain itself is not
>looked up, only subdomains
Yeah, but if we need to skip some domains at registry boundaries, it's
currently not possible.
Looks like Max needs the same feature.
Is there any reason to look up registry boundaries if one wants to disable
URIBL checking of a domain?
>As Matus said:
>
>>> That command makes it so that RBL lookups treat that as a 3rd level
>>> domain.
>>>
>>> So say you had xyz.ct.sendgrid.net and you want to list it on an RBL
>>> but not list pdq.ct.sendgrid.net, you would set ct.sendgrid.net as a
>>> 3TLD and then you can list the xyz or pdk individually.
>
>This is to allow punishing abusive sendgrid accounts via URIBLs
>*individually*, rather than punishing all of sendgrid for the
>(hopefully few) abusive accounts.
>
>Listing ct.sendgrid.net as abusive in a URIBL regardless of subdomain
>is an excessively broad response.
>
>FYI, ct.sendgrid.net has been in the base ruleset util_rb_3tld since
>April 2021.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Microsoft dick is soft to do no harm
Re: [External] SA 4.0.1 - util_rb_3tld
Posted by John Hardin <jh...@impsec.org>.
On Fri, 10 Jan 2025, Matus UHLAR - fantomas wrote:
> On 09.01.25 16:06, Max Erenburg via users wrote:
>> Yeah not trying to welcome them entirely, more so like other well-known
>> domains that are commonly seen and will not be blacklisted (e.g.
>> docs.google.com ).
>>
>> I will try out:
>> uridnsbl_skip_domain ct.sendgrid.net
>
> Tell me please if it works, I'm afraid it won't exactly because of the
> util_rb_3tld ct.sendgrid.net
>
> which seems to cause not finding ct.sendgrid.net in lists of domains to skip:
> https://marc.info/?l=spamassassin-users&m=172320987309970&w=2
That's a side-effect of util_rb_Xtld - the listed domain itself is not
looked up, only subdomains
As Matus said:
>> That command makes it so that RBL lookups treat that as a 3rd level
>> domain.
>>
>> So say you had xyz.ct.sendgrid.net and you want to list it on an RBL
>> but not list pdq.ct.sendgrid.net, you would set ct.sendgrid.net as a
>> 3TLD and then you can list the xyz or pdk individually.
This is to allow punishing abusive sendgrid accounts via URIBLs
*individually*, rather than punishing all of sendgrid for the (hopefully
few) abusive accounts.
Listing ct.sendgrid.net as abusive in a URIBL regardless of subdomain is
an excessively broad response.
FYI, ct.sendgrid.net has been in the base ruleset util_rb_3tld since April
2021.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
As a Turkish general once remarked, the trouble with having the
Americans as friends is that you can never be sure when they will
turn around and stab themselves in the back. -- Bernard Lewis
-----------------------------------------------------------------------
6 days until Benjamin Franklin's 319th Birthday
Re: [External] SA 4.0.1 - util_rb_3tld
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 09.01.25 16:06, Max Erenburg via users wrote:
>Yeah not trying to welcome them entirely, more so like other well-known domains that are commonly seen and will not be blacklisted (e.g. docs.google.com ).
>
>I will try out:
>uridnsbl_skip_domain ct.sendgrid.net
Tell me please if it works, I'm afraid it won't exactly because of the
util_rb_3tld ct.sendgrid.net
which seems to cause not finding ct.sendgrid.net in lists of domains to
skip:
https://marc.info/?l=spamassassin-users&m=172320987309970&w=2
if it doesn't work, I guess you could use something like:
dns_query_restriction deny ct.sendgrid.net.multi.uribl.com ct.sendgrid.net.multi.surbl.org ct.sendgrid.net.spamhaus.org ct.sendgrid.net.lookup.dkimwl.org
>From: Kevin A. McGrail <km...@apache.org>
>Sent: Thursday, January 9, 2025 9:10 AM
>To: users@spamassassin.apache.org
>Subject: Re: [External] SA 4.0.1 - util_rb_3tld
>
>Looking to check if my understanding is correct or there is some sort of bug.
>I have the following entry in my local.cf file:
>util_rb_3tld ct.sendgrid.net
>
> I would expect that ‘ *.ct.sendgrid.net ‘ would be excluded from any URI BL
> lookups?
>
> Hi Max, sorry, no. That command makes it so that RBL lookups treat that as
> a 3rd level domain. For example, say I have the domain
> somerandomexample.co.uk in my email. Without a setting that ".co.uk" is a
> 2TLD, then the look for the rbl is wrong. So say you had
> xyz.ct.sendgrid.net and you want to list it on an RBL but not list
> pdq.ct.sendgrid.net, you would set ct.sendgrid.net as a 3TLD and then you
> can list the xyz or pdk individually.
>
> To skip RBL lookups, you will likely want a welcomelist entry to/from if
> you receive or send emails with the domain in question [1] and to look at
> the config/user pref uridnsbl_skip_domain.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
WinError #98652: Operation completed successfully.
RE: [External] SA 4.0.1 - util_rb_3tld
Posted by Max Erenburg via users <us...@spamassassin.apache.org>.
Thanks Kevin,
Yeah not trying to welcome them entirely, more so like other well-known domains that are commonly seen and will not be blacklisted (e.g. docs.google.com ).
I will try out:
uridnsbl_skip_domain ct.sendgrid.net
-Max
From: Kevin A. McGrail <km...@apache.org>
Sent: Thursday, January 9, 2025 9:10 AM
To: users@spamassassin.apache.org
Subject: Re: [External] SA 4.0.1 - util_rb_3tld
Looking to check if my understanding is correct or there is some sort of bug.
I have the following entry in my local.cf file:
util_rb_3tld ct.sendgrid.net
I would expect that ‘ *.ct.sendgrid.net ‘ would be excluded from any URI BL lookups?
Hi Max, sorry, no. That command makes it so that RBL lookups treat that as a 3rd level domain. For example, say I have the domain somerandomexample.co.uk in my email. Without a setting that ".co.uk" is a 2TLD, then the look for the rbl is wrong. So say you had xyz.ct.sendgrid.net and you want to list it on an RBL but not list pdq.ct.sendgrid.net, you would set ct.sendgrid.net as a 3TLD and then you can list the xyz or pdk individually.
To skip RBL lookups, you will likely want a welcomelist entry to/from if you receive or send emails with the domain in question [1] and to look at the config/user pref uridnsbl_skip_domain.
Regards,
KAM
--
Kevin A. McGrail
KMcGrail@Apache.org<ma...@Apache.org>
Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171
Re: [External] SA 4.0.1 - util_rb_3tld
Posted by "Kevin A. McGrail" <km...@apache.org>.
> Looking to check if my understanding is correct or there is some sort
> of bug.
>
> I have the following entry in my local.cf file:
>
> util_rb_3tld ct.sendgrid.net
>
> I would expect that ‘ *.ct.sendgrid.net ‘ would be excluded from any
> URI BL lookups?
>
Hi Max, sorry, no. That command makes it so that RBL lookups treat that
as a 3rd level domain. For example, say I have the domain
somerandomexample.co.uk in my email. Without a setting that ".co.uk" is
a 2TLD, then the look for the rbl is wrong. So say you had
xyz.ct.sendgrid.net and you want to list it on an RBL but not list
pdq.ct.sendgrid.net, you would set ct.sendgrid.net as a 3TLD and then
you can list the xyz or pdk individually.
To skip RBL lookups, you will likely want a welcomelist entry to/from if
you receive or send emails with the domain in question [1] and to look
at the config/user pref uridnsbl_skip_domain.
Regards,
KAM
--
Kevin A. McGrail
KMcGrail@Apache.org
Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171