[Rspamd-Users] SURBL timeouts in symbols (SURBL_MULTI_FAIL)

[Nihad @ RSPAMD maillist]

Hello,

I have a question, that I have tried to find an answer to on my own, but failed.
So have decided to ask here, in hope that someone can clarify it for me.

A little bit on my system.
It’s a personal email server, getting under 100 mails a day. So it’s not high usage mail server by any means.
Running rspamd 2.7 on debian 10 and with unbound as DNS resolver.

So, to the "issue".

Some mails, not all, are having SURBL_MULTI_FAIL added, followed by list og domain(s) and "timeout" as status. I have never seen SURBL_MULTI_* symbols apart from SURBL_MULTI_FAIL.

SURBL_MULTI_FAIL (0.02) [findmydate.xyz:query timed out]

I do not have this symbol specified in my customised configuration files. So it is something rspamd does as default. I can see it is mentioned in modules.d/rbl.conf file.

So my question is as following;

• How do I read this symbol (SURBL_MULTI_FAIL)?
    • DNS resolution failed / DNS error of some sort
    • domain IS on the list and therefore results in FAIL symbol?
• Is my rspamd setup broken somehow. I have no errors and all works "fine" as far as I can see.
    • But then again, not all mails with links have this symbol. So if error was in my setup i would assume all mails would be scanned and have this symbol.
    • Or if I have consumed all my "free lookups" on the list and my lookups are being blocked. This is again not logical, as mails arriving later, do not have this symbol.

Also, when I do manual resolution of the domain (findmydate.xyz.multi.surbl.org) on my own DNS server or big public DNS servers, it does not return anything. "A" section is blank, and "SOA" has "dev.null.". So this also looks like my server is not at fault. As other servers return same result set, as my own. So sanity check is SUCCESS, I think :D

So if rspamd and unbound are both correct, it must be my understanding what this symbol represents/means and I have no idea how to read it properly.


I tried to keep this simple, I am not sure this can be called simple, but here it is, as it is.

Thanks in advanced for all possible suggestions.

/Nihad