On Sat, 20 Jun 2026, Alex wrote:
SpamAssassin 4.0.3 appears to incorrectly promote a URL query
parameter value into a standalone URI hostname and then performs
URIDNSBL lookups against the generated domain.
Observed behavior:
Input message contains only the following URI:
https://substack.com/signup?r=to8ex
Debug output shows SpamAssassin correctly parsing the original URI:
Jun 20 17:04:48.788 dbg: uri: canonicalizing parsed uri:
https://substack.com/signup?r=to8ex
Jun 20 17:04:48.788 dbg: uri: cleaned uri: https://substack.com/signup?r=to8ex
Jun 20 17:04:48.788 dbg: uri: added host: substack.com domain: substack.com
Immediately afterward, SpamAssassin creates a second URI which does
not exist in the message:
Jun 20 17:04:48.821 dbg: uri: canonicalizing parsed uri: http://to8ex
Jun 20 17:04:48.822 dbg: uri: cleaned uri: http://to8ex
Jun 20 17:04:48.822 dbg: uri: cleaned uri: http://www.to8ex.com
Jun 20 17:04:48.822 dbg: uri: added host: www.to8ex.com domain: to8ex.com
I cannot reproduce this in my sandbox:
jhardin@davinci ~/develop/spamassassin/testing $ grep uri: result
Jun 20 19:42:00.009 [3067949] dbg: uri: canonicalizing parsed uri:
https://substack.com/signup?r=to8ex
Jun 20 19:42:00.009 [3067949] dbg: uri: cleaned uri:
https://substack.com/signup?r=to8ex
Jun 20 19:42:00.009 [3067949] dbg: uri: added host: substack.com domain:
substack.com
Jun 20 19:42:02.035 [3067949] dbg: uri: running uri_detail __URI_DOTCN_SPOOF:
https://substack.com/signup?r=to8ex
Jun 20 19:42:02.039 [3067949] dbg: uri: running uri_detail
T_MXG_BING_REDIR_SUSP: https://substack.com/signup?r=to8ex
Jun 20 19:42:02.043 [3067949] dbg: uri: running uri_detail
__ALL_URIDETAIL_TEXT: https://substack.com/signup?r=to8ex
Jun 20 19:42:02.044 [3067949] dbg: uri: running uri_detail __MXG_UNSUB_LINK01:
https://substack.com/signup?r=to8ex
Jun 20 19:42:02.051 [3067949] dbg: uri: running uri_detail MXG_EMAIL_FRAG:
https://substack.com/signup?r=to8ex
Jun 20 19:42:02.201 [3067949] dbg: uri: canonicalizing parsed uri:
https://substack.com/signup?r=to8ex
Jun 20 19:42:02.201 [3067949] dbg: uri: cleaned uri:
https://substack.com/signup?r=to8ex
Jun 20 19:42:02.201 [3067949] dbg: uri: added host: substack.com domain:
substack.com
jhardin@davinci ~/develop/spamassassin/testing $
Do you have a locally-defined redirector rule? There is one for substack
in the base ruleset but it does not match that pattern:
jhardin@davinci ~/develop/spamassassin/svn/trunk $ grep -r substack rules*
rules/25_url_redirectors.cf: url_redirector substack.com/redirect/
jhardin@davinci ~/develop/spamassassin/svn/trunk $
There are no `redirector_pattern` rules for substack in the base ruleset.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
614 days since SpaceX caught the SuperHeavy booster on the first try
