Print Page | Close Window

Valid mail blocked by URL Scan

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6595
Printed Date: 05 February 2025 at 1:06pm


Topic: Valid mail blocked by URL Scan
Posted By: sirrar
Subject: Valid mail blocked by URL Scan
Date Posted: 07 January 2009 at 3:58am

Hi.

 
When sending a mail with a link in it (signature) It says that its blacklisted by zen.spamhaus.org. When i do a manually check at http://www.spamhaus.org - www.spamhaus.org it states that this ip is not listed in any block list
 
Doesn't the query look wrong? The ip is typed backwards???
 
X-Rejection-Reason: 27 - URL in the email resolved to a blacklisted IP : ( http://www.com-it.dk - www.com-it.dk ) - 521 The IP 80.63.58.114 is Blacklisted by zen.spamhaus.org. http://www.spamhaus.org/query/bl?ip=114.58.63.80 - http://www.spamhaus.org/query/bl?ip=114.58.63.80 -- 521 The IP 80.63.58.114 is Blacklisted by pbl.spamhaus.org. http://www.spamhaus.org/query/bl?ip=114.58.63.80 - http://www.spamhaus.org/query/bl?ip=114.58.63.80 --
 
Please don't get confused when doing the wrong query (the query spamfilter performs) cause I have removed the wrong ip from the list (should'nt have done that) I thought at first that it was spamhaus which was wrong.
 
When i do a manually query at spamhaus it looks like this
http://www.spamhaus.org/query/bl?ip=80.63.58.114 - http://www.spamhaus.org/query/bl?ip=80.63.58.114
 
Running 4.1.2.796 Licensed


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA


Replies:
Posted By: LogSat
Date Posted: 07 January 2009 at 4:55pm
sirrar,

Can you please ensure that in your MAPS RBL list, you have a ",true" suffix in the entry:

zen.spamhaus.org, true

The "true" indicates that the RBL wants to receive the IP octet in reverse order. Please also note that most RBL blacklists have the same requirement, so most of your blacklist entries should have the ",true" suffix in them. If incorrect, this will cause spam emails to go undetected, and also will cause some legitimate emails to be blocked, as the query will be performed not on the correct IP, but on the one with the reversed octets.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: sirrar
Date Posted: 08 January 2009 at 11:50am
Thankyou very much
 
You were right.
 
Would it be possible to get a recommended update list?
 
Mine looks like this:
bl.spamcop.net, true
sbl-xbl.spamhaus.org, true
dnsbl.njabl.org, true
cbl.abuseat.org, true
bl.spamcop.net, true
zen.spamhaus.org, true
sbl-xbl.spamhaus.org, true
pbl.spamhaus.org, true
dnsbl.njabl.org, true
spam.dnsrbl.net, true
dnsbl.sorbs.net, true
relays.ordb.org, true
Thanks in advance


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA

Posted By: LogSat
Date Posted: 08 January 2009 at 6:21pm
Sirrar,

You have several duplicates in the list, along with one that we recommended a few weeks ago to be removed as it's no longer active.

I strongly recommend you replace your list with only the following entries:

bl.spamcop.net, true
cbl.abuseat.org, true
combined.njabl.org, true
dnsbl.sorbs.net, true
zen.spamhaus.org, true




-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: sirrar
Date Posted: 09 January 2009 at 3:25am
Thankyou very very much
 
I allways get perfect support here


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA


Print Page | Close Window