On Fri, 05 Jun 2015 18:11:48 -0400 Bill Cole wrote: > On 5 Jun 2015, at 17:53, Larry Rosenman wrote: > > > I guess my question is why is it being called during sa-learn. > > You have yet to demonstrate that to be occurring. > > SA has a misfeature of attempting to de-obfuscate obfuscated URIs and > trusting the results of its inherently imperfect de-obfuscation to > provide putative domain names, which it may do various sorts of > resolution on. So if you have a message that contains a line like: > > To look up a domain at EnemiesList, prepend it to the DNS domain: > .sa.enemieslist.com > > then SA may pick up '.sa.enemieslist.com' as a domain name to be > examined. >
That's unlikely since (if I'm reading it correctly) the error lines are only seen when sa-learn is training on spam.
