On 09/12/2016 01:40 PM, li...@rhsoft.net wrote:
>
>
> Am 12.09.2016 um 20:34 schrieb thomas cameron:
>> On 09/12/2016 01:06 PM, John Hardin wrote:
>>> On Mon, 12 Sep 2016, thomas cameron wrote:
>>>
>>> Make sure you have a local recursing (**NOT** forwarding) DNS server
>>> that your MTA and SA are configured to use. Reason: if you're forwarding
>>> your MTA DNS requests to your ISP's DNS server, the aggregated traffic
>>> of you plus all the other ISP clients can exceed the various DNSBL and
>>> URIBL free-usage limits, rendering those tools useless.
>>
>> [root@mail-west ~]# grep recurs /etc/named.conf
>> allow-recursion { 127.0.0.1; };
>>
>>> A clear
>>> indicator this is happening: URIBL_BLOCKED hits.
>>
>> I see "URIBL_BLACK Contains an URL listed in the URIBL blacklist" in the
>> headers of many of the messages that got through. Is that what you mean?
>
> no that means the message had a hit and so it seems your are using only
> 127.0.0.1 as nameserver and that nameserver does *not* forwarding
Ah, OK. I actually just changed my resolv.conf to do DNS lookups from
127.0.0.1. Before, it was using public DNS servers.
> it would be really helpful if you just post the full report-header of
> such a message, otherwise you are at your own
Sure, I didn't want to bomb the list with crud, sorry. Here's the header
of the latest spam to slip through.
Return-Path: <paula.fie...@westbegalssc.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
mail-west.camerontech.com
X-Spam-Level: ***
X-Spam-Status: No, score=4.0 required=5.0 tests=BAYES_99,DIET_1,
HTML_FONT_LOW_CONTRAST,HTML_IMAGE_RATIO_02,HTML_MESSAGE,SPF_PASS,
T_HTML_TAG_BALANCE_CENTER,T_REMOTE_IMAGE autolearn=no autolearn_force=no
version=3.4.0
Received: from substantiate.westbegalssc.com
(91-239-125-145.thinkdedicated.com [91.239.125.145] (may be forged))
by mail-west.camerontech.com (8.14.7/8.14.7) with ESMTP id
u8CIX42I002741
for <thomas.came...@camerontech.com>; Mon, 12 Sep 2016 18:33:29 GMT
To: <thomas.came...@camerontech.com>
Date: Mon, 12 Sep 2016 13:33:01 -0500
From: "Paula Fields" <paula.fie...@westbegalssc.com>
Reply-To: <ps.fie...@westbegalssc.com>
Message-ID: <VA1C.G5KTp'jmi5891...@substantiate.westbegalssc.com>
Subject: Great Science: Shred lbs while you sit in your cublicle.
Mime-Version: 1
Content-Type: multipart/alternative;
boundary="897htfNCA6B4duDQ193OAjlzRH078d7wF"
X-Greylist: Sender passed SPF test, not delayed by
milter-greylist-4.5.16 (mail-west.camerontech.com [104.131.155.84]);
Mon, 12 Sep 2016 18:33:36 +0000 (UTC)
