On Fri, May 13, 2022 at 05:42:04PM -0400, Jeff Koch wrote: > > Hi: > > We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I check > these IP's (193.106.175.39, for example) at [1]https://www.dnswl.org they are > NOT listed. > > * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at [2]https:// > www.dnswl.org/, high > * trust > * [193.106.175.39 listed in list.dnswl.org]
The test_log() function in 3.4, which produces the "listed in" line you see is quite broken. I suspect you are simply seeing results for wrong test, 193.106.175.39 is listed in SORBS. To see what is queried, check the debug log for some message: spamassassin -t -D async < message 2>&1 | grep dnswl.org Don't forget that it's reversed: 4.3.2.1.list.dnswl.org = 1.2.3.4
