Hi, >>>> This one wasn't blocked at the time it was received, but somehow is now. >>>> >>>> https://pastebin.com/inS6qiiG >>>> >>>> I noticed despite there being no actual URI that I can see in the >>>> body, it still hits __BODY_URI_ONLY. Even if I remove the div tags it >>>> still hits. Just what does SA consider to be a URI? >>>> >>>> meta __BODY_URI_ONLY __BODY_TEXT_LINE < 3 && __HAS_ANY_URI >>>> && !__SMIME_MESSAGE >>>> uri __HAS_ANY_URI /./ >>>> >>>> Running the message through debug doesn't show me what it considered >>>> to be the URI in this message. >>> >>> >>> Add this to your test environment: >>> >>> uri __ALL_URI /.+/ >>> >>>> dbg: rules: ran uri rule __DOS_HAS_ANY_URI ======> got hit: "g" >> >> >> ran uri rule __ALL_URI ======> got hit: "gmail.com" >> >> Is it from the From or Message-ID? > > It shouldn't be from either. > > Is your local test message *exactly* what you uploaded to pastebin? Because > that does not hit URIs here, at all. > > If you edited your local test message, check to verify you didn't > accidentally add a blank line in the middle of the message headers that > could potentially have pushed message header(s) down into the body. Apart > from that, I have no ideas.
I worked with John off-list and discovered that the URI that's hitting is the gmail.com located in the DKIM signature. Can someone else confirm this? John was unable to reproduce it on his system, but I just installed the latest svn 3.4.2 branch and it's doing it here. I'd appreciate if someone could help me figure out if this is a bug, a local misconfiguration or otherwise... https://pastebin.com/inS6qiiG Thanks, Alex
