OK, I uninstalled SA 3.0.0 and did a clean install of 3.0.3, downloaded new
SARE rules and tried again. I am still not getting any URI results. Can any one
explain what happens in the
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x2982e68) implements
'check_post_dnsbl'
section below. The 'check_tick section seems to show that, yes, this url is
listed in 4 of the SBL's. Does the 'check_post_dnsbl" do a second lookup, which
seems to be failing (even when I increase the time for the lookup to complete)?
Scott
-----------------------------------------------------------------------------
debug: registering glue method for check_uridnsbl (Mail::SpamAssassin::Plugin::U
RIDNSBL=HASH(0x2982e68))
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x2982e68) implements '
check_tick'
debug: URIDNSBL: domain "kogko.com" listed (URIBL_AB_SURBL): 127.0.0.118
debug: URIDNSBL: domain "kogko.com" listed (URIBL_WS_SURBL): 127.0.0.118
debug: URIDNSBL: domain "kogko.com" listed (URIBL_OB_SURBL): 127.0.0.118
debug: URIDNSBL: domain "kogko.com" listed (URIBL_SC_SURBL): 127.0.0.118
debug: URIDNSBL: query for kogko.com took 2 seconds to look up
(multi.surbl..org.
:kogko.com)
debug: URIDNSBL: queries completed: 2 started: 2
debug: URIDNSBL: queries active: at Mon May 16 14:34:15 2005
debug: running raw-body-text per-line regexp tests; score so far=7
debug: running full-text regexp tests; score so far=7
debug: DCCifd is not available: no r/w dccifd socket found.
debug: Running tests for priority: 500
debug: URIDNSBL: queries completed: 2 started: 2
debug: URIDNSBL: queries active: at Mon May 16 14:34:15 2005
debug: RBL: success for 1 of 1 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x2982e68) implements '
check_post_dnsbl'
debug: URIDNSBL: queries completed: 0 started: 0
debug: URIDNSBL: queries active: DNSBL=2 at Mon May 16 14:34:15 2005
debug: waiting 30 seconds for URIDNSBL lookups to complete
debug: URIDNSBL: queries completed: 0 started: 0
debug: URIDNSBL: queries active: DNSBL=2 at Mon May 16 14:34:15 2005
debug: running meta tests; score so far=7
debug: running header regexp tests; score so far=7
debug: running body-text per-line regexp tests; score so far=7
debug: running uri tests; score so far=7
debug: running raw-body-text per-line regexp tests; score so far=7
debug: running full-text regexp tests; score so far=7
debug: Running tests for priority: 1000
debug: running meta tests; score so far=7
debug: running header regexp tests; score so far=7
debug: running body-text per-line regexp tests; score so far=7
debug: running uri tests; score so far=7
debug: URIDNSBL: queries completed: 0 started: 0
debug: URIDNSBL: queries active: DNSBL=2 at Mon May 16 14:34:16 2005
debug: running raw-body-text per-line regexp tests; score so far=7
debug: running full-text regexp tests; score so far=7
debug: auto-learn: currently using scoreset 3, recomputing score based on scores
et 1.
debug: auto-learn: message score: 7, computed score for autolearn: 0
debug: auto-learn? ham=0.1, spam=12, body-points=0, head-points=0, learned-point
s=7
debug: auto-learn? no: scored as ham but learner indicated spam (7 > 1)
debug: is spam? score=7 required=7
debug: tests=BAYES_99
debug: subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__HAS_SUBJECT,__
MIME_VERSION,__SARE_BODY_BLNK_5_100,__SARE_HTML_HAS_MSG,__SARE_HTML_HAS_TO,__SAR
E_META_MURTY3,__SARE_URI_ANY
MAIL FROM: <[EMAIL PROTECTED]>
RCPT TO: <[EMAIL PROTECTED]>
X-GWIA: Mon, 16 May 2005 13:47:48 -0600; pcp916103pcs.brndml01.va.comcast.net([1
92.168.100.100])
Received: from pcp916103pcs.brndml01.va.comcast.net
([192.168.100.100])
by owzw.com; Mon, 16 May 2005 13:47:48 -0600
X-MIME-Autoconverted: Yes
Discarded-X400-MTS-Extensions: Yes
Alternate-Recipient: Allowed
Xref: efzhwexjrrmcpmbcwair
Reply-To: "Mckinley Olga" <[EMAIL PROTECTED]>
From: "Mckinley Olga" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: *****SPAM***** Someone has requested a date
Date: Mon, 16 May 2005 20:50:49 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--ISFZPFFBLWQAYUTQT"
X-Spam-Prev-Subject: Someone has requested a date
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on Guinevere
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.0 required=7.0 tests=BAYES_99 autolearn=no version=3
..0.3
X-Spam-Report: * 7.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100% *
[score: 1.0000]
----ISFZPFFBLWQAYUTQT
Content-Type: text/plain;
charset="iso-1898-6"
Content-Transfer-Encoding: 7Bit
Meet hot dates today.
Free signup:
- http://www.kogko.com/go.html
if you like to be lonely, then :
- http://www.kogko.com/nothanks/nothanks.php
----ISFZPFFBLWQAYUTQT--
Spam detection software, running on the system "Guinevere", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
[EMAIL PROTECTED] for details.
Content preview: Meet hot dates today. Free signup: -
http://www.kogko.com/go.html if you like to be lonely, then : -
http://www.kogko.com/nothanks/nothanks.php [...]
Content analysis details: (7.0 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
7.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
Scott Schaffer
Systems & Network Administrator
Olive Waller Zinkhan & Waller
1000 - 2002 Victoria Avenue
Regina, SK S4P 0R7
Ph: 306-347-2108
Fx: 306-352-0771
Email: [EMAIL PROTECTED]
This e-mail message is intended only for the use of the individual or entity to
which it is addressed, and may contain information that is privileged,
confidential and exempt from disclosure under applicable law. Any other
distribution, copying or disclosure is strictly prohibited. If you have
received this message in error, please notify us immediately by telephone (306)
347-2108 and reply to the sender via e-mail, confirming deletion of the
original e-mail and any attachment(s).
>>> "Scott Schaffer" <[EMAIL PROTECTED]> 05/13/05 09:47AM >>>
So why do they work on one machine and not the other? Both machines are SA
3.0.0. and are virtually identical in setup.
>>> Jeff Chan <[EMAIL PROTECTED]> 05/13/05 09:34AM >>>
On Friday, May 13, 2005, 8:19:57 AM, Scott Schaffer wrote:
> SA 3.0.0 on both machines
One thing to note is that the URIDNSBL rules in 3.0.0 are type
"header" while they're type "body" in later versions. If you're
using rules quoted for URIDNSBL for example on the SURBL site,
they usually mention type "body" which won't work with 3.0.0 .
A newer version is probably better to use, BTW.
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
