SpamAssassin, The query to URIBL was blocked.

Everyone using linode's DNS servers has this problem and linode has decided not to address the issue.

Basically, the URIBL service is free for a few emails (like personal use), but anything above that requires some kind of payment. Linode does not want to pay for such a service to offer to us, so any requests to URIBL (via spamassassin or other similar tool) fail with URIBL_BLOCKED.

There are two things you can do:

1) Keep using linode's DNS servers and just ignore URIBL (you can even disable the check in spamassassin)

2) Setup your own DNS servers, if you have a normal amount of emails then you'll get free service from URIBL, but if you exceed their threshold then you will also be blocked.

Hi,

Thanks for the reply. Mmm yeah, not too sure I like the idea of setting up my own DNS server. Seems a bit of a faff :( Maybe I will just have to deal with it then.

What is confusing me though, is why these both match, but don't hold any "score" ?

  0.0 LOTS_OF_MONEY          Huge... sums of money
  0.0 T_DKIM_INVALID         DKIM-Signature header exists but is not valid

I would have thought the fact that they matched, would mean it needs to give them some kind of negative score.

Cheers

Andy

Some tests match only to give output in the headers. I assume this is for people to filter on matched text in their email clients.

Indeed as the above user mentioned, some are matched but do not have a score. For example, if you are a banker and talk about "huge sums of money" then you may not want a negative score on your emails.

TDKIMINVALID is there to tell people that their DKIM implementation is broken. In my servers I always reject emails with an invalid DKIM. In addition, I don't use spamassassin for DKIM checking, but I prefer the check to happen earlier in the process via OpenDKIM milter during postfix processing. Thus, emails will be rejected earlier and spamassassin will have to do less work.

If you want, you can give TDKIMINVALID a score of 100 to just block those broken emails.

In OpenDKIM I use the following settings:

On-BadSignature        reject
On-KeyNotFound        reject
On-Security        reject

Thanks everyone. Where would I go about editing the score for TDKIMINVALID? I'm assuming its part of the core, so I would need to overwrite it in local.cf maybe?

Cheers

Andy

Yes, you can edit the local.cf, in CentOS its under /etc/mail/spamassassin and add a line like:

score TDKIMINVALID 100

In CentOS, you can look at the rules under /var/lib/spamassassin/

Awesome, thanks :)