This is weird.. I don't know if it has something to do with the problem but since Aug 12, I don't see any SURBL hits on maillog anymore...
Has anythiung changed? Here is my SURBL ruleset, Im just updated to Mail::SpamAssassin 3.0.4 [EMAIL PROTECTED] spamassassin]# cat 25_uribl.cf # SpamAssassin - URIDNSBL rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Copyright 2004 Apache Software Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Requires the Mail::SpamAssassin::Plugin::URIDNSBL plugin be loaded. # Note that this plugin defines a new config setting, 'uridnsbl', # which lists the zones to look up in advance. The rules will # not hit unless each rule has a corresponding 'uridnsbl' line. ifplugin Mail::SpamAssassin::Plugin::URIDNSBL # URI-DNSBL lookups can take a *maximum* of this many seconds past the # normal DNSBL lookups. uridnsbl_timeout 2 uridnsbl URIBL_SBL sbl.spamhaus.org. TXT body URIBL_SBL eval:check_uridnsbl('URIBL_SBL') describe URIBL_SBL Contains an URL listed in the SBL blocklist tflags URIBL_SBL net urirhssub URIBL_SC_SURBL multi.surbl.org. A 2 body URIBL_SC_SURBL eval:check_uridnsbl('URIBL_SC_SURBL') describe URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist tflags URIBL_SC_SURBL net urirhssub URIBL_WS_SURBL multi.surbl.org. A 4 body URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL') describe URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist tflags URIBL_WS_SURBL net urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 body URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL') describe URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist tflags URIBL_PH_SURBL net urirhssub URIBL_OB_SURBL multi.surbl.org. A 16 body URIBL_OB_SURBL eval:check_uridnsbl('URIBL_OB_SURBL') describe URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist tflags URIBL_OB_SURBL net urirhssub URIBL_AB_SURBL multi.surbl.org. A 32 body URIBL_AB_SURBL eval:check_uridnsbl('URIBL_AB_SURBL') describe URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist tflags URIBL_AB_SURBL net urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist tflags URIBL_JP_SURBL net # Top 125 domains whitelisted by SURBL uridnsbl_skip_domain yahoo.com w3.org msn.com com.com yimg.com uridnsbl_skip_domain hotmail.com doubleclick.net flowgo.com ebaystatic.com aol.com uridnsbl_skip_domain akamai.net yahoogroups.com ebay.com classmates.com akamaitech.net uridnsbl_skip_domain incredimail.com tiscali.co.uk google.com chtah.com ediets.com uridnsbl_skip_domain directtrack.com microsoft.com paypal.com jexiste.fr amazon.com uridnsbl_skip_domain nytimes.com unitedoffers.com sitesolutions.it m0.net hyperpc.co.jp uridnsbl_skip_domain terra.com.br macromedia.com ed10.net earthlink.net citibank.com uridnsbl_skip_domain sourceforge.net marketwatch.com comcast.net messagelabs.com mcafee.com uridnsbl_skip_domain grisoft.com geocities.com yourfreedvds.com smileycentral.com ual.com uridnsbl_skip_domain monster.com e-trend.co.jp cnn.com cnet.com bfi0.com uridnsbl_skip_domain atdmt.com sportsline.com rs6.net rr.com redhat.com uridnsbl_skip_domain partner2profit.com joingevalia.com hotbar.com advertising.com topica.com uridnsbl_skip_domain rm04.net ed4.net dsbl.org extm.us edgesuite.net uridnsbl_skip_domain debian.org click-url.com bbc.co.uk adobe.com gte.net uridnsbl_skip_domain go.com weatherbug.com speedera.net sbcglobal.net ientrymail.com uridnsbl_skip_domain ibm.com att.net apple.com 5iantlavalamp.com verizon.net uridnsbl_skip_domain plaxo.com pandasoftware.com p0.com mediaplex.com gmail.com uridnsbl_skip_domain exacttarget.com constantcontact.com sf.net roving.com netflix.com uridnsbl_skip_domain moveon.org cc-dt.com xmr3.com spamcop.net postdirect.com uridnsbl_skip_domain norman.com netatlantic.com mail.com investorplace.com hitbox.com uridnsbl_skip_domain citizensbank.com chase.com bridgetrack.com apache.org washingtonpost.com uridnsbl_skip_domain si.com shockwave.com sears.com quickinspirations.com prserv.net uridnsbl_skip_domain mac.com myweathercheck.com dsi-enews.net cheaptickets.com bravenet.com uridnsbl_skip_domain arcamax.com afa.net 4at1.com yahoo.co.uk uclick.com uridnsbl_skip_domain suntrust.com sun.com ups.com pcmag.com mycomicspage.com endif # Mail::SpamAssassin::Plugin::URIDNSBL Why did it suddenly stop showing SURBL hits? |-----Original Message----- |From: jdow [mailto:[EMAIL PROTECTED] |Sent: Viernes, 19 de Agosto de 2005 05:21 p.m. |To: [email protected] |Subject: Re: Sudden Increase in Spam Mails | |SURBL, tweaked scores for image only, and some custom |recipient rules have kept it to virtually zero here. |{^_^} |----- Original Message ----- |From: "Bruno S. Delbono" <[EMAIL PROTECTED]> |To: "Anton Krall" <[EMAIL PROTECTED]>; |<[email protected]> |Sent: 2005 August, 19, Friday 11:37 |Subject: Re: Sudden Increase in Spam Mails | | |> Anton Krall wrote: |>> Im getting very low scores.. Smapm emails are passing thru, |>> containing just |>> 1 big jpg inside or text with one html link... These spam could |>> easily be confused with normal email... Which files would I |need to post here? |> |> - The mail with full content headers + sa score |> - SA version |> - OS |> - Bayes if any |> - spamassassin --lint -D |> - Setup of mailserver | | |
