Re: [External] SA 4.0.1 - util_rb_3tld

On Fri, 10 Jan 2025, Matus UHLAR - fantomas wrote:

> On 09.01.25 16:06, Max Erenburg via users wrote:
>> Yeah not trying to welcome them entirely, more so like other well-known 
>> domains that are commonly seen and will not be blacklisted (e.g. 
>> docs.google.com ).
>> 
>> I will try out:
>> uridnsbl_skip_domain ct.sendgrid.net
>
> Tell me please if it works, I'm afraid it won't exactly because of the 
> util_rb_3tld    ct.sendgrid.net
>
> which seems to cause not finding ct.sendgrid.net in lists of domains to skip:
> https://marc.info/?l=spamassassin-users&m=172320987309970&w=2

That's a side-effect of util_rb_Xtld - the listed domain itself is not 
looked up, only subdomains

As Matus said:

>>  That command makes it so that RBL lookups treat that as a 3rd level
>>  domain.
>>
>>  So say you had xyz.ct.sendgrid.net and you want to list it on an RBL
>>  but not list pdq.ct.sendgrid.net, you would set ct.sendgrid.net as a
>>  3TLD and then you can list the xyz or pdk individually.

This is to allow punishing abusive sendgrid accounts via URIBLs 
*individually*, rather than punishing all of sendgrid for the (hopefully 
few) abusive accounts.

Listing ct.sendgrid.net as abusive in a URIBL regardless of subdomain is 
an excessively broad response.

FYI, ct.sendgrid.net has been in the base ruleset util_rb_3tld since April 
2021.



-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  [email protected]                         pgpk -a [email protected]
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   As a Turkish general once remarked, the trouble with having the
   Americans as friends is that you can never be sure when they will
   turn around and stab themselves in the back.       -- Bernard Lewis
-----------------------------------------------------------------------
  6 days until Benjamin Franklin's 319th Birthday