Re: URIBL_RHS_DOB high hits

[Reindl Harald]

Am 12.10.2014 um 01:09 schrieb Karsten Bräckelmann:

On Sun, 2014-10-12 at 00:29 +0200, Reindl Harald wrote:

Am 12.10.2014 um 00:23 schrieb Reindl Harald:

Am 12.10.2014 um 00:18 schrieb Karsten Bräckelmann:

On Sat, 2014-10-11 at 23:40 +0200, Reindl Harald wrote:

it hits again and i doubt that sourceforge is a new domain
whatever the reason is - for me enough to disable it forever

Jumping to conclusions, aren't you?

yes - the conclusion is that it had way too much FP's recently

Arguably, tieman.se should be sufficiently old to not be listed.

as well as sourceforge

However, what I am much more annoyed about is your rambling, claiming
DOB would list sourceforge.net -- and by that, particularly with this
thread's topic, giving the impression of DOB again listing the world.
Which it doesn't.

it seems to hit randomly which is even more worse because listing the world is more obvious - i claim that it is not trustable currently, not more and not less, may anybody make his own decision, i told mine and there is nothing worng with that

Obviously, you did not check facts or investigate the issue at all.

don't get me wrong, there ist not much to investigate if it hits legit mailing-list messages

frankly it hitted even my own message you replied to
see at bottom

Yes, so will this one. DOB does NOT operate on sender or From header.
See for yourself:

   echo -e "\n tieman.se" | ./spamassassin

So yes, it hit on your mail. But no, it does not list your domain.

but why does it list "tieman.se"?

Oct 11 23:34:43 mail-gw spamd[28079]: spamd: result: . 0 -

FWIW, you can investigate and check any detail you want, because the
mail has been accepted by your SMTP server.

With a configuration of "add_header all Report _REPORT_", the listed
domain even is included in the report, without any need for manual
post-processing.

   *  0.3 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
   *      [URIs: tieman.se]

which is just not true - the domain is way older and the SBL hit because "support-intelligence.net" makes things not better URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist * [URIs: tieman.se.dob.sibl.support-intelligence.net]

signature.asc
Description: OpenPGP digital signature