--On Thursday, March 13, 2014 1:48 PM -0700 John Hardin
<jhar...@impsec.org> wrote:
On Thu, 13 Mar 2014, Quanah Gibson-Mount wrote:
In looking at why some spam is still making it through, it appears that
Pyzor errors block URIBL lookups:
I'm working with someone who seems to be having the same problem in 3.3.1
- thanks for noting this, I will take a closer look.
Thanks. The scoring can vary depending on when the pyzor callback fails.
For example, in another run, the pyzor error doesn't come back until after
more of the URI checks are done:
Mar 13 15:40:12.090 [6070] dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL
DNSBL:1.192.124.98:zen.spamhaus.org
Mar 13 15:40:12.091 [6070] dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL_A
DNSBL:1.193.124.98:sbl.spamhaus.org
Mar 13 15:40:12.091 [6070] dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL
DNSBL:1.193.124.98:zen.spamhaus.org
Mar 13 15:40:12.843 [6070] warn: pyzor: check failed: internal error,
python traceback seen in response
Mar 13 15:40:15.683 [6070] dbg: uridnsbl: complete_dnsbl_lookup aborted
URIBL_BLACK DNSBL:macrotermbed.com:multi.uribl.com
Mar 13 15:40:15.683 [6070] dbg: uridnsbl: complete_dnsbl_lookup aborted
URIBL_RED DNSBL:macrotermbed.com:multi.uribl.com
Mar 13 15:40:15.683 [6070] dbg: uridnsbl: complete_dnsbl_lookup aborted
URIBL_GREY DNSBL:macrotermbed.com:multi.uribl.com
Mar 13 15:40:15.683 [6070] dbg: uridnsbl: complete_dnsbl_lookup aborted
URIBL_BLOCKED DNSBL:macrotermbed.com:multi.uribl.com
So I get a much higher score:
Yes, score=10.1 required=5.0
Run it again, it fails earlier, and I get:
Yes, score=8.1 required=5.0
Run it again, it fails later, and I get:
Yes, score=12.8 required=5.0
etc. I.e., the scoring is completely erratic based on where URIBL
processing is when the pyzor callback fails.
--Quanah
--
Quanah Gibson-Mount
Architect - Server
Zimbra, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
