Hi, >> I received an email that was tagged with KHOP_SPAMHAUS_DROP, which >> means it was listed in the "Spamhaus Don't Route Or Peer List". >> However, I've checked every IP and domain in the email, and none are >> listed on any spamhaus list, even as of a minute ago. What is it in >> this message that is being tagged? >> >> http://pastebin.com/qPq9ah7P >> >> > First, I'll disclaim I'm a bit rusty here... It's been a year or two > since I've had time to contribute to SpamAssassin much. But perhaps I > can be of some help. > > The SPAMHAUS_DROP list is only available from them as a text file or as > a BGP feed.. it is not a live DNS query like their other lists. > > http://www.spamhaus.org/drop/drop.txt > > However, I agree none of the IPs seem to be in the drop list. > > It looks like the rule in question is published by khopesh.com, not the > SA core ruleset... I'm assuming you are using an update channel from > http://khopesh.com/wiki/Anti-spam.
Yes, that's exactly it. I should have made it more clear this was from Adam's rules. Your comments were very helpful, thanks. It looks like he's just updated his rules to reflect the latest DROP list. Thanks again, Alex
