Re: .link TLD spammer haven?

2014-10-22 Thread Ken Bass
On 10/22/2014 2:40 PM, Jesse Stroik wrote: I noticed URLs from the TLD .link aren't properly classified on my mail server. I wrote a simple URI rule to recognize that TLD which never matched. I wrote a similar body rule, which did properly match. Interestingly, I do see DNS queries going out f

Re: SA skipping URI processing

2014-10-15 Thread Ken Bass
On 10/15/2014 6:50 PM, Kevin A. McGrail wrote: I'd have to dig into it to find out more but there are different modules used for different tests so deviation in behavior is not something that alarms me. If you replace your RegistrarBoundaries.pm and it still has issues, please let us know. I a

Re: SA skipping URI processing

2014-10-15 Thread Ken Bass
On 10/15/2014 6:12 PM, Martin Gregorie wrote: I'm certain KAM is right and here's why. ...snip... IOW, uri rules depend on matching the terminal part of the domain name with an entry in SA's built-in TLD list and my version, installed from the Fedora repo, doesn't yet include .link. I reverted

Re: SA skipping URI processing

2014-10-15 Thread Ken Bass
On 10/15/2014 4:52 PM, Kevin A. McGrail wrote: The TLDs are hardcoded in SA 3.3.2. We are working on not having them hard-coded in 3.4.1. I found Bug 6782, which I think you are referring to. I don't quite understand the details of it. But are saying that the 'uri' and uridnsbl rules rely on

Re: SA skipping URI processing

2014-10-15 Thread Ken Bass
On 10/15/2014 4:52 PM, Kevin A. McGrail wrote: On 10/15/2014 4:49 PM, Ken Bass wrote: 1) My local.cf has a rule to address the new .link domain which spammers appear to be using recently: uri LR_LINK_TLD /^(?:https?:\/\/|mailto:)[^\/]+\.link(?:\/|$)/i describe LR_LINK_TLD Contains a URL in

SA skipping URI processing

2014-10-15 Thread Ken Bass
I'm using Centos 7, which means SA version 3.3.2. I am encountering several emails that are not being processed correctly when checking against URI rules. 1) My local.cf has a rule to address the new .link domain which spammers appear to be using recently: uri LR_LINK_TLD /^(?:https?:\/\/|m