Woke up, and a few minutes later, my milter did its first SPF evaluation.
I decided to care about body scanning later, lets have some easy wins first.
22
Replies
·
0
Boosts
This is a nice easy win.
I quickly turned the trace into <details>, because that's nicer.
And now I can do DNS Blocklist (& allowlist) lookups too. Almost at a point where I feel like I can direct one of my less important domains here.
I am very proud of myself.
![Report for tmp/email/html-and-attachment.eml
The email scored 14, and the following checks contributed to this:
SPF_NONE (0)
Caused by: unknown
Trace (details collapsed)
DNSBL_FOUND[bl.mailspike.net] (5)
158.94.209.56 found in blocklist: bl.mailspike.net
Causes
- 1785076442|(E)DROP https://www.spamhaus.org/sbl/query/SBL686264
DNSBL_SPAMHAUS_FOUND (9)
158.94.209.56 found in Spamhaus ZEN blocklist
Causes
- Listed by SBL, see https://check.spamhaus.org/sbl/query/SBL686264
- Listed by DROP, see https://check.spamhaus.org/sbl/query/SBL686264
- Listed by XBL, see https://check.spamhaus.org/query/ip/158.94.209.56
Score contributors
- Found in Spamhaus DROP/EDROP Data (5.0)
- Found in CBL Data (2.0)
- Found in Spamhaus SBL Data (2.0)](https://come-from.mad-scientist.club/fileserver/01G93WTH6KZY3Y5M42ECBBX3YJ/attachment/original/01KYFE5589GA6WA5MZ7KFZTCYG.png)
Need a way to extract the domain part of an email, look up its IP addresses, and then run DNSBL checks on that, too.
In a somewhat related note: I now tested Roto's const: I can create a dnsbl.Resolver at script compile time, and use it at runtime.
I'll be able to do the same with #iocaine matchers, and thus, will be able to get rid of the double compilation, and the split between init and main modules. Which, in turn, will greatly simplify iocaine's Roto scripts.
I'm also experimenting with using modules for stdlib parts, for better organization.
I'm even considering putting everything related to the tool under the ryoms module, so that they don't conflict with other things.
Maybe I should decouple the score from the tag name. The problem with that, is that some of my checks have variable score, and I like that.
I don't have different symbols/tags/whatever for "found in spamhaus zen's DROP list" and "found in spamhaus zen's SBL". I have the one DNSBL_SPAMHAUS_FOUND, and the score increases if the IP is found on multiple lists.
Also... the report. I'm currently generating markdown. But it has HTML parts, to make it look better rendered. Maybe I should directly generate HTML instead, and if I need a textual report, I can lynx -dump or pandoc it.
On the other hand, markdown-with-html-snippets is a whole lot easier to emit.
I think I found a neat way to handle adjusting scores.
I can provide a ryoms.score.update(<category>, <tag>, <score-adjustment>) function. Category is something like DNSBL_MAILSPIKE_FOUND, tag is something like REPUTATION_L5.
The Rust-side function can check if there's a custom on_score_update function, and if there is, dispatch there. If that function doesn't return a modified score, use the original one.
Ugh. Okay, that's not so easy doing such circular calling.
I have a cursed idea.
@algernon do useful dns blocklists still exist?
