Tom H wrote: > Matt Kettler wrote: >> Tom H wrote: >> >>> Hi, >>> >>> I was getting hit by a great deal of spam that only hits the BAYES_99 >>> >>> I would be grateful for any ideas on this... >>> >> Sounds like the message contains a URI that is now listed in many of the >> SURBL and URIBL lists. >> >> It may be that this got listed after you got the spam, but do you have >> network tests enabled? >> >> >> > There is a url in the domain that definitely hits some of the URIBLs > (results from the SURBL+ Checker on rulesemporium ) > > * RBL: skipping uri lookups on ip-based RBLs > * URIBL: multi.surbl.org: *listed* [Blocked, > madesucxxxntiondexxxxtunhadesu.com on lists [ab][jp][ob][sc][ws], > See: http://www.surbl.org/lists.html] > * URIBL: multi.uribl.com: *listed* [Blacklisted, see > http://lookup.uribl.com/?domain=madesuntioxxxndetunxxxhadesu.com > <http://lookup.uribl.com/?domain=madesuntiondetunhadesu.com>] > > However I don't seem to get any score for those, even though > spamassassin is clearly running the network tests, as I can see from > the debug output; > > [EMAIL PROTECTED] ~]# spamassassin -t -D -p /etc/mail/sa-mimedefang.cf < > /usr/share/doc/spamassassin-3.1.4/sample-spam.txt > Is there any chance your init.pre is missing from /etc/mail/spamassassin? Or does it have the URIBL plugin commented out?
It looks like you have working network test,s but not working URIBLs. The most common cause would be the plugin isn't being loaded by init.pre. The other possibility is your Net::DNS is too old to support URIBLs, but new enough to handle normal RBLs, however, the -D output would complain if this was the case.
