On 08/03/2011 4:54 PM, dar...@chaosreigns.com wrote:
Looks like that would be something like this?
urirhssub URIBL_DBL_REDIRECTOR dbl.spamhaus.org. A 127.0.1.3
body URIBL_DBL_REDIRECTOR eval:check_uridnsbl('URIBL_DBL_SPAM')
describe URIBL_DBL_REDIRECTOR Contains a URL listed in the DBL as a
spammed redirector domain
tflags URIBL_DBL_REDIRECTOR net domains_only
score URIBL_DBL_REDIRECTOR 0.1
Anybody know of a domain that hits this?
Close.
I believe that you should be using this
eval:check_uridnsbl('URIBL_DBL_REDIRECTOR')
Instead of this
eval:check_uridnsbl('URIBL_DBL_SPAM')
So the correct rule would be
urirhssub URIBL_DBL_REDIRECTOR dbl.spamhaus.org. A 127.0.1.3
body URIBL_DBL_REDIRECTOR
eval:check_uridnsbl('URIBL_DBL_REDIRECTOR')
describe URIBL_DBL_REDIRECTOR Contains a URL listed in the DBL
as a spammed redirector domain
tflags URIBL_DBL_REDIRECTOR net domains_only
score URIBL_DBL_REDIRECTOR 0.1
Regards,
Lawrence