sare rules

[Richard Frovarp]

Jeff A. Earickson wrote:
> On Tue, 15 Jul 2008, Richard Frovarp wrote:
>
>> Date: Tue, 15 Jul 2008 11:56:17 -0500
>> From: Richard Frovarp <richard.frovarp at sendit.nodak.edu>
>> Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
>> To: MailScanner discussion <mailscanner at lists.mailscanner.info>
>> Subject: Re: sare rules
>>
>> mailsysteam at googlemail.com wrote:
>>> Hi,
>>>
>>> I have followed Julian's instructions "HOWTO: Adding extra rulesets 
>>> to SpamAssassin" from July 2007 and I am a bit lost. Can someone 
>>> help please?
>>>
>>> I am using his /etc/mail/spamassassin/jkf-channel-list.txt to list 
>>> the channels I want, but the update doesn't work, I am not getting 
>>> any new cf files.
>>>
>>> If I run
>>> /usr/bin/sa-update -D --channelfile 
>>> /etc/mail/spamassassin/jkf-channel-list.txt --gpgkey 856AA88A
>>>
>>> I get dns errors like:
>>> dns: query failed: 
>>> 4.1.3.99_sare_fraud_post25x.cf.sare.sa-update.dostech.net 
>>> <http://4.1.3.99_sare_fraud_post25x.cf.sare.sa-update.dostech.net> 
>>> => NXDOMAIN
>>> channel: no updates available, skipping channel
>>>
>>> I am using MailScanner version 4.70.6
>>>
>>> Can someone point me in the right direction please?
>>>
>>> Steve
>> It should work. What happens when you run
>>
>> dig +short -t txt 
>> 4.1.3.99_sare_fraud_post25x.cf.sare.sa-update.dostech.net
>>
>> You should get back: "200506020000"
>
> I ran this and that's what I got back.  What does this mean?  That the
> rules at dostech haven't changed since 6/2/2005?  ???

No, it means that particular ruleset for that particular version of SA 
hasn't changed since 2005-06-02. Other rule sets would be more recent 
and I don't know how much dostech is doing about SA versions. As is 
indicated on the website, they aren't currently being updated. The cost 
is a DNS lookup for each ruleset you are checking.