Re: spamhaus fp

Matija Nalis skrev den 2025-05-07 17:21:
> On Wed, May 07, 2025 at 04:44:18PM +0200, Benny Pedersen via users 
> wrote:
>> Yes, score=5.513 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1,
>> DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
>> FILL_THIS_FORM_SHORT=1, HTML_FONT_LOW_CONTRAST=0.001, 
>> HTML_MESSAGE=0.001,
>> HTTPS_HTTP_MISMATCH=0.1, KAM_BODY_MARKETINGBL_PCCC=0.001,
>> KAM_MARKETINGBL_PCCC=0.5, RELAYCOUNTRY_GREY=0.1, SPF_HELO_NONE=3,
>> SPF_PASS=-0.1, T_FILL_THIS_FORM_SHORT=0.01, URI_HEX=1.1] autolearn=no
>> autolearn_force=no
> 
> What did you mean to convey by this message, it is unclear to me?
> Is it about blacklists from  https://www.spamhaus.org/ ?
> 
> Also, at least SPF_HELO_NONE and URI_HEX are significantly lower in my
> /var/lib/spamassassin/3.004006/updates_spamassassin_org/50_scores.cf:
> score SPF_HELO_NONE 0.001
> score URI_HEX 0.1
> 
> have you perhaps changed their score locally?

mx ~ # grep -r URI_HEX /etc/mail/spamassassin/
/etc/mail/spamassassin/zz_scores.cf:score URI_HEX (1) (1) (1) (1)

so yes, but imho SPF_HELO_NONE should be SPF_HELO_PASS from an spamhaus 
server, just to pick back of strictness :)

DKIM-Signature: v=1; s=hs2; d=5652833t.service.spamhaus.com;
         [email protected];
         
h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id:list-unsubscribe-post;
         a=rsa-sha256; c=relaxed/relaxed;
         bh=omY7FmFC2rsvp+qTCuoC1VZAC6mTLUYgnEnSamTsFsA=;
         b=nRrMtRzGDziQW3o0+TNuP2P8YFfIGFjKv37GRo1PBL5J48L0SEzYqwg7zHWMFQ
          4/dZNMSSHXKuJtMvABPkqfzQg2GKl4jCiClYN3jQed5nwOlZaSdDvssUYSUXgeF
          f1qdediNReNtv48HLIIKEz3SNQN5dlhqHZSjZTIAzalX8MNakoN20YxyuMXWhKX
          RcMLUJX+IySQ64e6TVPskP9+qGcpmEMfUWIjeNpdq02Qzp/LvDfZTy52LPyv9K7
          ul/E5u5QK5knlNISsPCBwBz6Oaq/C4n6kCP9ypQshxZhCY2B9XClkRkYvGOZ0Fz
          gLFFZEKNJS3z4OCA7t0CD6YAWatg==; q=dns/txt; t=1746624730;
         x=1746887530;
DKIM-Signature: v=1; s=hs1-5652833; d=service.spamhaus.com;
         [email protected];
         
h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id:list-unsubscribe-post;
         a=rsa-sha256; c=relaxed/relaxed;
         bh=omY7FmFC2rsvp+qTCuoC1VZAC6mTLUYgnEnSamTsFsA=;
         b=XWCkY3VOhkUbEmZe73VWMsITq58A7bFBwg2kuSzqHA4aE2FABJ6JNXntPxYHbg
          zYq30nphS5WlCaLzbkGrJsI/3TxLElaKsEy+qeH4vOD9taZxIPHNB6JEGIZxgC6
          YZbKDS5YLAHG9e5P/asWMu97rMbIZSifp/XckrEkTzud0D/o7H4WrhpVTvjcpta
          3NmL4u3Y5eQIEuG5kOHf/7weeNsW30y4dY8S3zMipjNJTqla6SvKmexCgkUjBwM
          rvoNhwosXSZiBDboBWzo7ln2N6EEEGGVMQmXLc0smoVhaqpq8N45gbPTVQSihe7
          euYtgyhVqgODMrRLMFh+NdiPkoNA==; q=dns/txt; t=1746624730;
         x=1746887530;

could there dkim be add to whitelist by pmc members ?

Received: from bid47go.5652833t.service.spamhaus.com 
(bid47go.5652833t.service.spamhaus.com [158.247.22.118])
	by mx.junc.eu (Postfix) with ESMTPS id DF0667F8CD
	for <[email protected]>; Wed, 07 May 2025 15:32:14 +0200 (CEST)

in dns

bid47go.5652833t.service.spamhaus.com TXT "v=spf1 a -all"

solved if spamhaus listen here