> Which RBLs are you using?
I did no configuration here, the file /usr/share/spamassassin/20_dnsbl_tests.cf contains the following entries (default setup):
-------------------- snip -------------------- RCVD_IN_BL_SPAMCOP_NET RCVD_IN_BSP_OTHER RCVD_IN_BSP_TRUSTED RCVD_IN_DSBL RCVD_IN_DYNABLOCK RCVD_IN_MAPS_DUL RCVD_IN_MAPS_NML RCVD_IN_MAPS_RBL RCVD_IN_MAPS_RSS RCVD_IN_NJABL RCVD_IN_NJABL_CGI RCVD_IN_NJABL_DIALUP RCVD_IN_NJABL_MULTI RCVD_IN_NJABL_PROXY RCVD_IN_NJABL_RELAY RCVD_IN_NJABL_SPAM RCVD_IN_OPM RCVD_IN_OPM_HTTP RCVD_IN_OPM_HTTP_POST RCVD_IN_OPM_ROUTER RCVD_IN_OPM_SOCKS RCVD_IN_OPM_WINGATE RCVD_IN_RFCI RCVD_IN_SBL RCVD_IN_SORBS RCVD_IN_SORBS_BLOCK RCVD_IN_SORBS_HTTP RCVD_IN_SORBS_MISC RCVD_IN_SORBS_SMTP RCVD_IN_SORBS_SOCKS RCVD_IN_SORBS_SPAM RCVD_IN_SORBS_WEB RCVD_IN_SORBS_ZOMBIE -------------------- snip --------------------
> What kind of email is being marked incorrectly?
Dialups with dynamic IP addresses, e. g. T-Online customers.
