Hi Matheus
Thanks a lot for your help! What I dont understand is why I have to specify
domains, subdomains... Cant I just query the DNSBL and if it has a URI that
hits, then consider it?
Or else, it might just be easier to create a rule rawbody/body with certain
spamvertised URLs to catch, when we cant block by IP.
For example, further on one example you advised on.
Consider this rule
urirhssub SPFBL_GREY dnsbl.spfbl.net. A 2
body SPFBL_GREY eval:check_uridnsbl('SPFBL_GREY')
describe SPFBL_GREY Contains an URL listed in the SPFBL greylist
tflags SPFBL_GREY net
score SPFBL_GREY 0.1
If you check here: http://matrix.spfbl.net/dnsbl/conteudo.nibo.com.br
You will see that it is listed.
But my SA rule doesn't catch emails that have such subdomain in the body. We
want to block just conteudo.nibo.com.br not any other .nibo.com.br subdomain
just exactly that one.
.com.br afaik is TLD
nibo.com.br is a 2tld
conteudo.nibo.com.br a 3tld
You said .com.br is in the 20_aux_tlds file, but I dont see it. Only .br I
see is just blogspot.com.br in 3tld at the end of the file.
So I have to add conteudo.nibo.com.br to the file, 3ld section, right?
why you say to add util_rb_3tld nibo.com.br?
Isnt nibo.com.br 2tld?
I think I understand reading here again
http://www.gossamer-threads.com/lists/spamassassin/users/194077
subdomains -> "Using the URIBL plugin you can't unless you use util_rb_2tld
/ util_rb_3tld to create pseudo TLDs."
Oh, I see so youre like faking the system, since it only understands
TLD/2tld, for example nibo.com.br, you tell the system that its a 3rd level
domain so it understands conteudo.nibo.com.br which itself is the 3tld and
only that, nibo.com.br wouldnt be considered?
I could perhaps auto generate some file via DNSBL data... But Im thinking it
might be easier to create body rules that check URIs/hosts/subdomains
explicitly, not best in terms of processing though and updates.
Thanks!
--
View this message in context:
http://spamassassin.1065346.n5.nabble.com/eval-check-uridnsbl-to-check-subdomains-tp121922p122018.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
