Aram Mirzadeh <[EMAIL PROTECTED]> [2002-10-13 11:59:01 -0400]: > I have a piece of SPAM that is jumping from 0.8 to 5.0 and back to 0.8 > each time I ran a (-t) test without any modifications to my pref file. > > The offending rules that change are: X_OSIRU_SPAMWARE_SITE to > X_OSIRU_SPAM_SRC and back.
It looks like the network tests are getting different results at different times. When you run the message through SA it will send a network query asking if the IP addresses in the message are in the lists of known spammers or not. The result can be a network timeout failure to retrieve any information or it can be yes or it can be no, etc. Therefore the result depends upon the information retrieved from the network at the moment that you look it up. The network query is really a DNS lookup. DNS is a wonderful distributed database and it is overloaded to provide this information too. Is your DNS working reliably? Run spamassassin with the -Dt options and see what it says. The -D is debug and will provide some more information here. Also, you could look up the addresses in the message yourself and see what value of response you receive. I find the rblcheck program takes the manual drudgery out of doing this. http://rblcheck.sourceforge.net/ Bob
msg08794/pgp00000.pgp
Description: PGP signature
