Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » What black lists does NST use
What black lists does NST use [message #556] Wed, 27 April 2005 13:57
eastwood
Messages: 37
Registered: July 2004
Member
I had a email that got tagged as spam and the header showed it had come from a blacklisted ip, it looked like this :

tests=AWL,BAYES_99,
DNS_FROM_AHBL_RHSBL,
HTML_80_90,
HTML_MESSAGE,
SPF_HELO_SOFTFAIL,
USER_IN_WHITELIST
autolearn=no version=3.0.2

I traced the IP address of th sender back as I guesses the line that says DNS_FROM_AHBL_RHSBL means the ip is blacklisted

But

I cant find a record for the IP address by looking at dnsstuff.com or spam cop.

Where does NST do its blacklist lookup?

Thanks
Re: What black lists does NST use [message #557 is a reply to message #556] Wed, 27 April 2005 17:05 Go to previous message
support
Messages: 918
Registered: April 2004
Senior Member
Look in SpamAssassin report for the mail, or in SpamAssassin's rules.

The blacklist in this case is dnsbl.ahbl.org. The score of this rule is less than 0.3, so I think the main contributors to the overall score are BAYES_99 and SPF_HELO_SOFTFAIL.



Customer Support
Byteplant GmbH
Re: What black lists does NST use [message #558 is a reply to message #556] Wed, 27 April 2005 17:29 Go to previous message
eastwood
Messages: 37
Registered: July 2004
Member
what is a SPF_HELO_SOFTFAIL

is there a place I can find what all these different types mean exactly...
Re: What black lists does NST use [message #559 is a reply to message #558] Wed, 27 April 2005 19:31 Go to previous message
support
Messages: 918
Registered: April 2004
Senior Member
As I said, you can search for the rule names (like SPF_HELO_SOFTFAIL) in the sa\ruleset subdirectory of your installation (find files containing this word). It is simpler to look at the text explanations in the SpamAssassin's report added to the mail in question.

Good places to look for information are also the SpamAssassin home page, and the SpamAssassin Wiki:

http://spamassassin.apache.org

In this case, SPF (Sender Policy Framework) has its very own website:

http://spf.pobox.com/



Customer Support
Byteplant GmbH
Previous Topic: spamcopuri in NST 2.0.5.1?
Next Topic: Remove auto whitelist entry?
Goto Forum:
  


Current Time: Wed Sep 28 08:51:14 CEST 2016