Re: spamassassin RCVD_IN_DNSWL_HI false positive

[Sergei Poselenov <sposelenov@xxxxxxxxxxx>]

Hello Matthias,


On Tue, 27 Aug 2024 10:05:43 +0200 Matthias Leisi <matthias@xxxxxxxxx> wrote:

> > * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/, high           
> > *      trust                                                                         
> > *      [184.154.95.157 listed in list.dnswl.org]   
> > ...
> > 
> > Checking 184.154.95.157 on https://www.dnswl.org/?page_id=72 shows that IP is not whitelisted.
> > 
> > Does somebody have any explanation of that?  
> 
> The most likely explanation: You may be using a DNS resolver which has been blocked for excessive use. After some time of excessive use (and if the previous actions like returning explicit „you are over-using resources“-reply or empty replies to DNS queries did not result in a reduced load), you may get HI responses.
>

Thanks for replying, but I doubt this is the case. In such cases, when spamd request to a service is blocked due to limitation, it scores the rule as 0 and prints something like:
 *  0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL
 *      was blocked.  See
 *      http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for
 *      more information.
 *      [209.85.216.44 listed in list.dnswl.org]

Regards,
Sergei
> Matthias
> 
>