Hello,
I'm facing a curious problem : for 3-4 days, one of my users have been
triggering all rbls each time a mail is sent.
It could not be that serious, weren't for the identity of this
particular user : the root user on our network filtering smtp gateway.
Basically, the daily report triggers the tests like this :
BIZ_TLD=2.013,
DOMAIN_4U2=1.994,
INFO_TLD=1.273,
MR_DEPOT_URI=0.3,
NORMAL_HTTP_TO_IP=0.175,
NO_RELAYS=-0.001,
SPOOF_OURI=0.104,
URIBL_JP_SURBL=4.087,
URIBL_OB_SURBL=3.008,
URIBL_WS_SURBL=2.14,
URI_4YOU=0.135,
URI_NOVOWEL=0.884
(carriage returns added for an easier reading)
Do you see why all those tests are triggered ?
My first guess was that they are because of all the returned mail sent
by the smtp filter, which makes the daily report by itself containing a
lot of "spammy" material, in terms of domain names/ips.
Thanks by advance,
--
François Conil
Administrateur Systèmes et Réseaux
<Pax> I wish my lawn was emo, so it would cut itself.
