Re: RCVD_IN_DNSWL
On Wed, May 18, 2022 at 08:16:15AM +0300, Henrik K wrote: > On Fri, May 13, 2022 at 05:42:04PM -0400, Jeff Koch wrote: > > > > Hi: > > > > We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I > > check > > these IP's (193.106.175.39, for example) at [1]https://www.dnswl.org they > > are > > NOT listed. > > > > * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at [2]https:// > > www.dnswl.org/, high > > * trust > > * [193.106.175.39 listed in list.dnswl.org] > > The test_log() function in 3.4, which produces the "listed in" line you see > is quite broken. I suspect you are simply seeing results for wrong test, > 193.106.175.39 is listed in SORBS. > > To see what is queried, check the debug log for some message: > spamassassin -t -D async < message 2>&1 | grep dnswl.org > > Don't forget that it's reversed: > > 4.3.2.1.list.dnswl.org = 1.2.3.4 Never mind, I think the log text itself should always be correct, the IP and listname should not get mixed up.. Doesn't hurt to always check the debug output, use "-D all" to find everything.
Re: RCVD_IN_DNSWL
On Fri, May 13, 2022 at 05:42:04PM -0400, Jeff Koch wrote: > > Hi: > > We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I check > these IP's (193.106.175.39, for example) at [1]https://www.dnswl.org they are > NOT listed. > > * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at [2]https:// > www.dnswl.org/, high > * trust > * [193.106.175.39 listed in list.dnswl.org] The test_log() function in 3.4, which produces the "listed in" line you see is quite broken. I suspect you are simply seeing results for wrong test, 193.106.175.39 is listed in SORBS. To see what is queried, check the debug log for some message: spamassassin -t -D async < message 2>&1 | grep dnswl.org Don't forget that it's reversed: 4.3.2.1.list.dnswl.org = 1.2.3.4
Re: RCVD_IN_DNSWL
On 5/13/22 23:42, Jeff Koch wrote: Hi: We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I check these IP's (193.106.175.39, for example) at https://www.dnswl.org they are NOT listed. * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/, high * trust * [193.106.175.39 listed in list.dnswl.org] How can I fix this? I've run sa-update and it does not help. TIA - Jeff My case: https://www.mail-archive.com/users@spamassassin.apache.org/msg108935.html Yours may or may not be the same. Regards, Łukasz