Debugging SA SURBL

[Raymond Dijkxhoorn]

<x-flowed>
Hi!

> Received another one line + image spam mail. The header as created by
> MS+SA says this:
>
> X-gw-MailScanner-SpamCheck: spam, SpamAssassin (score=7.982, required 6,
>       BAYES_99 1.89, HTML_90_100 0.02, HTML_IMAGE_ONLY_04 3.30,
>       HTML_IMAGE_RATIO_02 0.02, HTML_MESSAGE 0.00, MIME_BASE64_BLANKS
> 1.47,
>       MPART_ALT_DIFF 0.07, RCVD_IN_BL_SPAMCOP_NET 1.22)
>
> Which does not mention any SURBL.
>
> When I do a lookup on http://www.rulesemporium.com/cgi-bin/uribl.cgi

>
> peachcasino.com is 62.73.174.136 [  rbl lookup  ]
> domain registered: ..............: Mon, Jul 14, 2003 [ full whois ]

Was the domain mentioned in the body of the mail, or a sending header?
The checks done in SA3 are inside body, and also with a certain pattern,
it has to have http and so on.

We are talking on the SA dev list to get that last behaviour changed btw.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>