Woke up, and a few minutes later, my milter did its first SPF evaluation.
I decided to care about body scanning later, lets have some easy wins first.
22
Replies
·
0
Boosts
This is a nice easy win.
I quickly turned the trace into <details>, because that's nicer.
And now I can do DNS Blocklist (& allowlist) lookups too. Almost at a point where I feel like I can direct one of my less important domains here.
I am very proud of myself.
![Report for tmp/email/html-and-attachment.eml
The email scored 14, and the following checks contributed to this:
SPF_NONE (0)
Caused by: unknown
Trace (details collapsed)
DNSBL_FOUND[bl.mailspike.net] (5)
158.94.209.56 found in blocklist: bl.mailspike.net
Causes
- 1785076442|(E)DROP https://www.spamhaus.org/sbl/query/SBL686264
DNSBL_SPAMHAUS_FOUND (9)
158.94.209.56 found in Spamhaus ZEN blocklist
Causes
- Listed by SBL, see https://check.spamhaus.org/sbl/query/SBL686264
- Listed by DROP, see https://check.spamhaus.org/sbl/query/SBL686264
- Listed by XBL, see https://check.spamhaus.org/query/ip/158.94.209.56
Score contributors
- Found in Spamhaus DROP/EDROP Data (5.0)
- Found in CBL Data (2.0)
- Found in Spamhaus SBL Data (2.0)](https://come-from.mad-scientist.club/fileserver/01G93WTH6KZY3Y5M42ECBBX3YJ/attachment/original/01KYFE5589GA6WA5MZ7KFZTCYG.png)
Need a way to extract the domain part of an email, look up its IP addresses, and then run DNSBL checks on that, too.
@algernon what would that tell?
@zhenech Sometimes the email used in mail from resolves to a different domain/ip than what the sender is connecting from, and looking at the reputation of the mail from IP can, therefore, be beneficial.
Case in point, one spam my rspamd rejected connected from 158.94.209.56, which is in the Mailspike blocklist (and 3 spamhaus lists), but there's no entry for it in the mailspike reputation list.
On the other hand, the envelope domain resolves to 58.26.40.48, which is in the reputation list, and I can adjust the score accordingly.
@algernon do useful dns blocklists still exist?
