[Rspamd-Users] Phishing email mark as legit with very low score

Tim Harman tim at muppetz.com
Mon Jul 29 19:08:07 UTC 2019

On 29/07/2019 9:19 pm, Gabriele Nencioni wrote:
> Hi all,
> A low number of symbols have been triggered, I expected at least
> something like "Symbol: PHISHING [dada.eu-><snip>.xyz]" but it
> didn't happen.
> Which could be the reason why?

Do you know for sure it was listed in a surbl at the time you received 

Are you sure your DNS is working correctly? You're not querying a large 
public DNS server are you? Most RBLs tend to block queries from them.

Your message was marked as Spam for me, due to the URL you included. It 
triggered bother RSPAMD_URIBL and URIBL_BLACK

So either

a) It wasn't in the RBLs at the time you got the message
b) Your DNS isn't working correctly, or is talking to a DNS server 
that's blacklisted by the URIBLs
c) You have some other config error that's stopping the SURBL module 
d) Some other thing I haven't though of


More information about the Users mailing list