[cobalt-users] mailscanner / spamassassin / raq 500

["> freitag lab. ag / nafroth" <seb@xxxxxxxxxx>]

hi there,

i upgraded mailscanner and spamassassin to a never version and it works
quite well, till now ALL viruses were cought with clamav/f-prot. nice!

the perl module of clamav is much faster...

i do spamchecks out of mailscanner, not spamd even it is faster but to me
quite strange to configure...

but i dont't know, RBL seems not to be working. i did the following:

Spam List = ORDB-RBL spamhaus.org SORBS-DNSBL SORBS-SMTP SORBS-WEB
SORBS-SPAM SORBS-BLOCK MAPS-RBL+ SBL+XBL spamcop.net NJABL Easynet-DNSBL
Easynet-Dynablock # MAPS-RBL+ costs money (except .ac.uk)

(they are all in spam.lists.conf)


and there are some connects (i think so)

[root MailScanner]# tcpdump | grep .org
tcpdump: listening on eth0
15:53:02.390770 ops.3f8h.net.34077 > dns.cyberlink.ch.domain:  6499+ A?
227.230.91.212.relays.ordb.org. (48) (DF)
15:53:02.396513 ops.3f8h.net.34077 > dns.cyberlink.ch.domain:  6500+ A?
227.230.91.212.sbl.spamhaus.org. (49) (DF)
15:53:17.455716 ops.3f8h.net.34079 > dns.cyberlink.ch.domain:  6507+ A?
227.230.91.212.sbl-xbl.spamhaus.org. (53) (DF)
15:53:17.595298 ops.3f8h.net.34079 > dns.cyberlink.ch.domain:  6509+ A?
227.230.91.212.dnsbl.njabl.org. (48) (DF)
15:53:17.892125 ops.3f8h.net.34079 > dns.cyberlink.ch.domain:  32603+ A?
227.230.91.212.relays.ordb.org. (48) (DF)
15:53:17.898291 ops.3f8h.net.34079 > dns.cyberlink.ch.domain:  32604+ A?
227.230.91.212.sbl.spamhaus.org. (49) (DF)
15:53:32.965562 ops.3f8h.net.34081 > dns.cyberlink.ch.domain:  32611+ A?
227.230.91.212.sbl-xbl.spamhaus.org. (53) (DF)
15:53:33.091878 ops.3f8h.net.34081 > dns.cyberlink.ch.domain:  32613+ A?
227.230.91.212.dnsbl.njabl.org. (48) (DF)
15:56:04.019415 ops.3f8h.net.34083 > dns.cyberlink.ch.domain:  44515+ A?
4.136.12.62.relays.ordb.org. (45) (DF)
15:56:04.080437 ops.3f8h.net.34083 > dns.cyberlink.ch.domain:  44516+ A?
4.136.12.62.sbl.spamhaus.org. (46) (DF)
15:56:19.175573 ops.3f8h.net.34084 > dns.cyberlink.ch.domain:  44523+ A?
4.136.12.62.sbl-xbl.spamhaus.org. (50) (DF)
15:56:19.273929 ops.3f8h.net.34084 > dns.cyberlink.ch.domain:  44525+ A?
4.136.12.62.dnsbl.njabl.org. (45) (DF)
15:56:44.638811 ops.3f8h.net.34086 > dns.cyberlink.ch.domain:  21008+ A?
227.230.91.212.relays.ordb.org. (48) (DF)
15:56:44.687448 ops.3f8h.net.34088 > dns.cyberlink.ch.domain:  21009+ A?
227.230.91.212.sbl.spamhaus.org. (49) (DF)
15:56:45.519358 ops.3f8h.net.34091 > dns.cyberlink.ch.domain:  3308+ A?
227.230.91.212.relays.ordb.org. (48) (DF)


but not a single message header shows some spam-points using this RBLs...

any ideas??

thanks!

seb