Mailing List Archive

another problem in disable in spamassassin
Hi
I have problem with disabled spamhaus.org in spamassassin:

In local.cf I disable check like:
...
dns_query_restriction deny spamhaus.org
dns_query_restriction deny zen.spamhaus.org
dns_query_restriction deny dbl.spamhaus.org
...

But in mail.log I fund still checking RCVD_IN_PBL, URIBL_CSS_A,
URIBL_DBL_SPAM
mail.log
Apr 12 06:04:48 amavis5 amavis[3060074]: (3060074-10) spam-tag,
<james@payday.holiday> -> <xxxx@xxxxx.ltd>, Yes, score=26.884
tagged_above=3.6 required=6 tests=[.AM.IP_BAD_62.133.61.198=1.8,
BAYES_50=0.8, DCC_CHECK=4, DCC_REPUT_99_100=1.4, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_MSPIKE_BL=0.001,
RCVD_IN_MSPIKE_ZBI=0.001, RCVD_IN_PBL=3.335, RCVD_IN_SBL_CSS=3.335,
RELAYCOUNTRY_BAD=2, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
URIBL_BLOCKED=0.2, URIBL_CSS_A=0.1, URIBL_DBL_SPAM=10] autolearn=no
autolearn_force=no


in /var/lib/spamassassin/3.004006/updates_spamassassin_org/20_dnsbl_tests.cf
...
# PBL is the Policy Block List: https://www.spamhaus.org/pbl/
header RCVD_IN_PBL              eval:check_rbl('zen-lastexternal',
'zen.spamhaus.org.', '^127\.0\.0\.1[01]$')
describe RCVD_IN_PBL            Received via a relay in Spamhaus PBL
tflags RCVD_IN_PBL              net
reuse  RCVD_IN_PBL
...

in /var/lib/spamassassin/3.004006/updates_spamassassin_org/25_uribl.cf
...
25_uribl.cf:urirhssub       URIBL_DBL_SPAM dbl.spamhaus.org.       A  
127.0.1.2
25_uribl.cf:body            URIBL_DBL_SPAM
eval:check_uridnsbl('URIBL_DBL_SPAM')
25_uribl.cf:describe        URIBL_DBL_SPAM       Contains a spam URL
listed in the Spamhaus DBL blocklist
25_uribl.cf:tflags          URIBL_DBL_SPAM       net domains_only notrim
25_uribl.cf:reuse           URIBL_DBL_SPAM
...

And I dont have idea how disable all check in spamhaus.org

--
Re: another problem in disable in spamassassin [ In reply to ]
On 12.04.24 10:50, natan wrote:
>I have problem with disabled spamhaus.org in spamassassin:
>
>In local.cf I disable check like:
>...
>dns_query_restriction deny spamhaus.org
>dns_query_restriction deny zen.spamhaus.org
>dns_query_restriction deny dbl.spamhaus.org


>But in mail.log I fund still checking RCVD_IN_PBL, URIBL_CSS_A,
>URIBL_DBL_SPAM
>mail.log
>Apr 12 06:04:48 amavis5 amavis[3060074]: (3060074-10) spam-tag,
><james@payday.holiday> -> <xxxx@xxxxx.ltd>, Yes, score=26.884
>tagged_above=3.6 required=6 tests=[.AM.IP_BAD_62.133.61.198=1.8,
>BAYES_50=0.8, DCC_CHECK=4, DCC_REPUT_99_100=1.4, DKIM_SIGNED=0.1,
>DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
>HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_MSPIKE_BL=0.001,
>RCVD_IN_MSPIKE_ZBI=0.001, RCVD_IN_PBL=3.335, RCVD_IN_SBL_CSS=3.335,
>RELAYCOUNTRY_BAD=2, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
>URIBL_BLOCKED=0.2, URIBL_CSS_A=0.1, URIBL_DBL_SPAM=10] autolearn=no
>autolearn_force=no

did you reload amavis after changing local.cf?

do they appear when you feed mail in to "spamassassin" commandline client?

It still can be amavis issue.

>in /var/lib/spamassassin/3.004006/updates_spamassassin_org/20_dnsbl_tests.cf
>...
># PBL is the Policy Block List: https://www.spamhaus.org/pbl/
>header RCVD_IN_PBL????????????? eval:check_rbl('zen-lastexternal',
>'zen.spamhaus.org.', '^127\.0\.0\.1[01]$')
>describe RCVD_IN_PBL??????????? Received via a relay in Spamhaus PBL
>tflags RCVD_IN_PBL????????????? net
>reuse? RCVD_IN_PBL
>...
>
>in /var/lib/spamassassin/3.004006/updates_spamassassin_org/25_uribl.cf
>...
>25_uribl.cf:urirhssub?????? URIBL_DBL_SPAM dbl.spamhaus.org.?????? A??
>127.0.1.2
>25_uribl.cf:body??????????? URIBL_DBL_SPAM
>eval:check_uridnsbl('URIBL_DBL_SPAM')
>25_uribl.cf:describe??????? URIBL_DBL_SPAM? ???? Contains a spam URL
>listed in the Spamhaus DBL blocklist
>25_uribl.cf:tflags????????? URIBL_DBL_SPAM? ???? net domains_only notrim
>25_uribl.cf:reuse?????????? URIBL_DBL_SPAM
>...
>
>And I dont have idea how disable all check in spamhaus.org
>
>--

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Spam = (S)tupid (P)eople's (A)dvertising (M)ethod