[Rspamd-Users] Phishing email mark as legit with very low score

[Tim Harman]

On 29/07/2019 9:19 pm, Gabriele Nencioni wrote:
> Hi all,
<snip>
> A low number of symbols have been triggered, I expected at least
> something like "Symbol: PHISHING [dada.eu-><snip>.xyz]" but it
> didn't happen.
> 
> Which could be the reason why?

Do you know for sure it was listed in a surbl at the time you received 
it?

Are you sure your DNS is working correctly? You're not querying a large 
public DNS server are you? Most RBLs tend to block queries from them.

Your message was marked as Spam for me, due to the URL you included. It 
triggered bother RSPAMD_URIBL and URIBL_BLACK

So either

a) It wasn't in the RBLs at the time you got the message
b) Your DNS isn't working correctly, or is talking to a DNS server 
that's blacklisted by the URIBLs
c) You have some other config error that's stopping the SURBL module 
working.
d) Some other thing I haven't though of

Tim