> OK, so that's supposed to happen. Is there any way to have the entire
> host checked? I've seen a good volume of junk where the domain is clean,
> but if I do a manual lookup on the entire hostname in the spam it is
> indeed listed.
I *suspect* what is happening here is that the domain isn't in surbl when
the mail comes through, but it is 15 minutes later when you check.
The alternative is that there is a difference in the two-level/three-level
split decision between SA 3.0.4 and surbl. Neither works with the full
domain; that was a decision from the start at surbl. The split is based on
the tail of the domain name. It is (I think) a little more than the TLD
that goes into the decision, but that is the basic concept.
For instance, dribble.spammy.com will only check "spammy.com".
dribble.spammy.co.uk will check "spammy.co.uk". The idea is to find the
real host name denuded of any directory names.
Sometimes this will deliberately miss a spamsite. For instance,
myspamsite.yahoo.com will not be listed, because yahoo.com isn't a pure spam
host. Instead, a request will be sent to Yahoo to get the site removed.
Jeff will likely be along sooner or later and can give considerably more
detail on how all of this really works.
Loren
