Debugging SA SURBL

[Remco Barendse]

<x-flowed>
On Tue, 14 Sep 2004, Raymond Dijkxhoorn wrote:

> Hi!
>
>> Received another one line + image spam mail. The header as created by
>> MS+SA says this:
>>
>> X-gw-MailScanner-SpamCheck: spam, SpamAssassin (score=7.982, required 6,
>> BAYES_99 1.89, HTML_90_100 0.02, HTML_IMAGE_ONLY_04 3.30,
>> HTML_IMAGE_RATIO_02 0.02, HTML_MESSAGE 0.00, MIME_BASE64_BLANKS
>> 1.47,
>> MPART_ALT_DIFF 0.07, RCVD_IN_BL_SPAMCOP_NET 1.22)
>>
>> Which does not mention any SURBL.
>>
>> When I do a lookup on http://www.rulesemporium.com/cgi-bin/uribl.cgi
>
>>
>> peachcasino.com is 62.73.174.136 [  rbl lookup  ]
>> domain registered: ..............: Mon, Jul 14, 2003 [ full whois ]
>
> Was the domain mentioned in the body of the mail, or a sending header?
> The checks done in SA3 are inside body, and also with a certain pattern,
> it has to have http and so on.

The domain was mentioned in the body, so it should have been caught I
guess.... The domain was the only line in the e-mail.

Thanx!


> We are talking on the SA dev list to get that last behaviour changed btw.
>
> Bye,
> Raymond.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>