SpamAssassin – Resolving URIBL_BLOCKED Despite Caching Nameserver

bindspamassassin

I run a mail server for two people, Ubuntu 10.04 LTS. I have Spamassassin running via Amavis/Postfix. In many messages, I am getting URIBL_BLOCKED in the X-Spam-Status headers, which indicates that the request is coming from a source that makes too many requests to URIBL's servers.[1] URIBL and Spamassassin both state that running a caching nameserver should fix this for low volume users, since the likely cause is that the DNS request is coming from the ISP's server, which makes lots of requests.[1][2] I would like URIBL to work.

So I installed bind9, and added the following lines to named.conf.options:

acl goodclients {
    localhost;
    127.0.0.1;
};

and within "options" I added

 recursion yes;
 allow-query { goodclients; };

I set RESOLVCONF=yes in /etc/default/bind and restarted bind9.

URIBL provides a test point, as described at http://www.uribl.com/about.shtml#abuse. In a terminal for my mail server, when I type

host -tA 2.0.0.127.multi.uribl.com

the response is 

2.0.0.127.multi.uribl.com has address 127.0.0.14

which is what URIBL says is the response meaning "Not Blocked". But I'm still getting spam with URIBL_BLOCKED in the X-Spam-Status headers. I've also run 'rudc flush' to clear any previous records in bind; and restarted Amavis and Postfix in case they somehow were caching DNS info.

Why would the command-line test to uribl pass, but requests from within amavis/spamassassin fail?

[1] http://www.uribl.com/about.shtml#abuse, last sentence under "Abuse": "If you use your ISP Nameservers for resolution, and they are blocked, consider running your own caching nameserver."

[2] https://wiki.apache.org/spamassassin/CachingNameserver

Best Answer

I had this problem and resolved it by simply restarting spamd. Apparently it needed a reboot to update the name server it was connecting to.

Also ensure you've told your system to use your new local nameserver by configuring /etc/resolv.conf with:

nameserver 127.0.0.1

And in case it is helpful, here is my /etc/named.conf file: http://pastebin.com/r0RYawGj

Related Topic