On 26/03/17 14:12, David Jones wrote:
From: Sebastian Arcus <[email protected]>
Sent: Sunday, March 26, 2017 4:23 AM
To: [email protected]
Subject: Dns Blocklists always returning 0 records
I have a server with SA where I just can't seem to get DNS based block
lists / RBL working. I have tested the same email message against
another server, and it gets hits from DNS block lists. But on this
particular server they just don't seem to work - but the dns queries are
not blocked either.
1. Both servers are on SA 3.4.1
2. I've ran sa-update on both of them.
3. Both servers have Perl Net::DNS installed
4. Both servers have Bind configured locally and running fine as a
caching name server.
5. On the problematic server, the dns based checks are being run, not
being blocked, but always returning 0 records.
What else can I check in the SA config or more widely on the server?
What could possible cause this? Any suggestions would be much appreciated.
I attach below a snippet of spamassassin -D output from the problem
server - but I'm happy to enclose here, or upload the whole thing
somewhere else if it helps:
#spamassassin -D 2>&1 < /test_email.eml | grep -i -A 3 "answer records"
</snip>
Mar 26 10:12:39.060 [7061] dbg: async: calling callback on key
dns:A:109.150.73.212.bb.barracudacentral.org
Mar 26 10:12:39.062 [7061] dbg: dns: dns reply 61164 is OK, 0 answer records
Mar 26 10:12:39.062 [7061] dbg: async: calling callback on key
dns:A:109.150.73.212.zen.spamhaus.org
Mar 26 10:12:39.064 [7061] dbg: dns: dns reply 20939 is OK, 0 answer records
Mar 26 10:12:39.064 [7061] dbg: async: calling callback on key
dns:TXT:109.150.73.212.sa-accredit.habeas.com
Mar 26 10:12:39.066 [7061] dbg: dns: dns reply 56465 is OK, 0 answer records
Mar 26 10:12:39.066 [7061] dbg: async: calling callback on key
dns:A:109.150.73.212.iadb.isipp.com
Mar 26 10:12:39.069 [7061] dbg: dns: dns reply 19262 is OK, 0 answer records
</snip>
I get this response on my working SA servers for the IP address above:
;; ANSWER SECTION:
109.150.73.212.zen.spamhaus.org. 300 IN A 127.0.0.4
What does the output of this commnd say on your SA server?
dig test.dbl.spamhaus.org
Compare the output on both servers. I suspect this will point you in
the right direction. For example, "SERVER:" should point to 127.0.0.1.
On the problem server, if I run:
#dig 109.150.73.212.zen.spamhaus.org
I get:
;; ANSWER SECTION:
109.150.73.212.zen.spamhaus.org. 337 IN A 127.0.0.4
And I can also see it is using 127.0.0.1 as the server.
I can even see in the SA debug output (on the problem server):
Mar 27 10:25:12.173 [23914] dbg: dns: hit
<dns:109.150.73.212.zen.spamhaus.org> 127.0.0.4
And yet, no dns block lists make it to the final scores.
