Nick,
Are you still using a copy of our snowshoe netblocks?
If so, I think I see the problem, SA is using -ANY in its lookup, not
the A that you want (I'm guessing without looking into code, I'm just
back from holidays so bit busy at home), postfix ns4 has an IP in a /24
list from HOSTI-20 173.244.206.0/24 which was added 4 weeks ago by looks
of it, its marked "spam multiple junk domains"
So it seems SA's eval code does have an error.
(You moving back to Brisbane? We have to catch up for drinks if so)
Cheers
On 30/12/2015 18:00, Nick Edwards wrote:
Hey there,
In my final hours (34) at job X before moving back home to Australia
to start job Y next week, I would love to solve an issue I've been
seeing for a few weeks now, some domains in eval are wrongfully
hitting.
Take postfix.org for example, it has no A record, so this check should
return NXDOMAIN and therefore not score the mail with a positive
value.
However, it does, so, I either screwed up something in the rule :
uridnsbl ATQ_URI2 snowshoers.int. A
body ATQ_URI2 eval:check_uridnsbl('ATQ_URI2')
describe ATQ_URI2 URL's domain A record listed in snowshoe
netblocks
score ATQ_URI2 3.0
tflags ATQ_URI2 net a
or spamassassins lookup is over bearing?
The list in snowshoers.int contains about 400 /24's so removing one
at a time is not feasable, but, as indicated, postifx.org has no A
record so this shojldnt be an issue, I did check the IP's of
www.postifx.org both of them are not in any netblock.
So how can it be it gets tagged as being in it?
It can not be a nxdomain false in code, since undernet.org has no A
records and it passes fine without tagging/scoring.
TIA
--
If you have the urge to reply to all rather than reply to list, you best
first read http://members.ausics.net/qwerty/
