https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7362
Bug ID: 7362
Summary: in 25_uribl.cf, URIBL_SBL is misleading
Product: Spamassassin
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P2
Component: Rules
Assignee: [email protected]
Reporter: [email protected]
URIBL is an rhsbl which is misleading. Perhaps it should be SPAMHAUS_SBL_NS
and SPAMHAUS_SBL_A?
And secondly, the header message needs to contained the IP address looking up
in SpamHaus. Suggestion:
* 0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist
* [URIs: blabla.example.com 1.2.3.4]
* 4.9 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist
* [URIs: blabla.example.com 1.2.3.4]
There are 2 reasons you should include the IP address:
1) spammers love to change ip addresses, by the time someone does forensic
analysis on the message, the address of blabla.example.com has changed and
2) (and this is a true story):
Once upon a time, a message was which contained a domain name from a competing
block list of an address which was on that rbl which resolved to 127.0.0.2.
127.0.0.2 is on the SpamHaus SBL list. This caused the message to gain
sufficient points to be rejected. Finger-pointing ensued. It was not
immediately obvious what was going on. At first we thought that one blocklist
was blocking the other block list! If the IP address was in the URIs: line, it
would have been more clear what was going on and saved several hours.
--
You are receiving this mail because:
You are the assignee for the bug.
