spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Henrik K <h...@hege.li>
Subject Re: Hostkarma whitelist needs something..
Date Thu, 15 Oct 2009 06:05:21 GMT
On Thu, Oct 15, 2009 at 08:48:45AM +0300, Jari Fredriksson wrote:
>
>
> 15.10.2009 8:29, Henrik K kirjoitti:
>> On Thu, Oct 15, 2009 at 03:33:54AM +0200, Karsten Br├Ąckelmann wrote:
>>> On Thu, 2009-10-15 at 02:44 +0300, Jari Fredriksson wrote:
>>>> -1.0 RCVD_IN_HOSTKARMA_W    RBL: HostKarma: relay in white list (first pass)
>>>>                              [212.16.98.53 listed in hostkarma.junkemailfilter.com]
>>>
>>> $ host 212.16.98.53
>>> 53.98.16.212.in-addr.arpa domain name pointer jatkuu.iki.fi.
>>>
>>>>    3.0 RCVD_IN_BRBL_RELAY     RBL: received via a relay rated as poor by
Barracuda
>>>>                               [187.10.243.78 listed in bb.barracudacentral.org]
>>>
>>> Hmm, a different IP.
>>>
>>>>    4.0 BOTNET                 Relay might be a spambot or virusbot
>>>> [botnet0.8,ip=187.10.243.78,rdns=187-10-243-78.dsl.telesp.net.br,maildomain=resdat.com,baddns,client,ipinhostname,clientwords]
>>>
>>>>    0.1 RDNS_NONE              Delivered to trusted network by a host with
no rDNS
>>>
>>> Any chance your internal and trusted networks are incorrect? Any chance
>>> your Hostkarma WHITE is checking the wrong IPs?
>>>
>>> Hostkarma is supposed to check the lastexternal only. Given the above,
>>> something is *really* fishy here.
>>
>> iki.fi is a famous Finnish email forwarding service and as such should be
>> added as internal_networks, if you are using it. Things like this are hard
>> to know unless you really understand TruthPaths..
>>
>
> All right. I removed internal_networks which only contained my LAN  
> address. Now it should default to the defined trusted_networks, which  
> contains iki servers.

And it now also contains a lot more. You have to carefully review whether
you want all those entries to be SPF/DNSBL checkpoints etc.


Mime
View raw message