SpamAssassin 3.1.7 – Too Many False Positives
Thursday, November 30th, 2006I just updated SpamAssassin to 3.1.7 on my Fedora Core 6 (FC6) installation and started receiving too many False Positives – in fact, any email that contained a URL would generate a false positive. Each email starts with a rating of 5.5:
2.2 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: ebayrtm.com ebayobjects.com]
3.3 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: ebayrtm.com ebayobjects.com]
I am using OpenDNS as my DNS server and have enabled typo correction.
The problem is the typo correction interferes with URIDNSBL plugin. The method used to check if any of the URIs are from known spammers is to check the results of a DNS query of [uri].multi.surbl.org. If the URI is not blacklisted, a NXDOMAIN response would typically be returned; instead, with OpenDNS’s typo correction, an A record pointing back to one of the OpenDNS.com servers is returned. If the URI is blacklisted, an A record with a value of 127.0.0.x is returned (where x is a bitmask of the various types of blacklists). Since the OpenDNS response does not match 127.0.0.x, the new version of SpamAssassin decides the URI is blacklisted.
Here are two solutions:
- Turn off typo correction for the mail server. This is done by:
- Go to your account page on OpenDNS
- Sign in or create an account
- Select Manage for your Network
- Turn off Enable type correction.
- Revert back to an earlier version of URIDNSBL.pm. This is what I chose to do because I still want typo correction on my mail server. This is accomplished by:
- Download the earlier working version (Revision 392950) of URIDNSBL.pm. This can be done by right-clicking on the previous link and saving it to a file.
- Make a backup of URIDNSBL.pm and save the earlier version in the same location:
[rick@chocolate ~] $ locate URIDNSBL.pm /usr/lib/perl5/venfor_perl/5.8.8/Mail/SpamAssassin/Plugin/URIDNSBL.pm [rick@chocolate ~] $ cd /usr/lib/perl5/venfor_perl/5.8.8/Mail/SpamAssassin/Plugin [rick@chocolate ~] $ sudo mv URIDNSBL.pm{,.orig} [rick@chocolate ~] $ sudo cp /tmp/URIDNSBL.pm . - Restart sendmail, spamassassin, mimedefang or whatever is providing this service. My installation uses ClamAV and MIMEDefang so I do the following:
[rick@chocolate ~] $ sudo /sbin/service mimedefang restart [rick@chocolate ~] $ sudo /sbin/service sendmail restart
Refer to Apache Subversion for history and information about the URIDNSBL.pm file.



