Cornerstone Software Ltd

This was very frustrating - so I’m writing this in case someone else uses Google to find the answer, and finds me. My problem: RBL checks in my mail gateway weren’t working, and a missing Net::DNS turned out to be the cause.

I had been for a while wondering why our mail gateway (a Debian server running Postfix) was having such poor catch rates with Spam. Without a lot of time to devote to this, a lot of spam messages were making it through to people’s mail clients to be caught by the junk-mail filters there (eg Thunderbird’s junk mail feature, SpamBayes etc).

After a bit of trolling through the mail logs, I determined that none of the real-time blacklist (RBL) features were working properly. I did a lot of searching with Google, and following hyperlinks, between the Spamassassin website, the wiki ..

The most promising lead I had was this gem on the SURBL website:

… make sure that you have a recent Net::DNS installed. Too old versions of Net::DNS seems to be a common reason for RBL checks not working …

But what was Net::DNS? How do I tell what version I’ve got? Which version? I’ve got Net::Domain (in the file /usr/share/perl/5.8.4/Net/Domain.pm) - is that the same thing? I installed everything in this computer via apt-get, so that would have brought in all the dependencies, surely?

Well, no. Net::Domain is not the same as Net::DNS, which was clearly not in my system. It is available in the Debian package libnet-dns-perl, and was installed in seconds with the command apt-get insatll libnet-dns-perl, and then a quick /etc/init.d/amavis restart for good measure.

According to packages.debian.org, this is a dependency of SpamAssassin, so I’m not sure why it wasn’t there. It is also a bit annoying that my Amavis/SpamAssassin configuration clearly enabled the network tests, but I didn’t see any sign in the log files that something important was missing - except no mention of the RBL tests at all. But then on our system /var/log/mail.log is constantly being added to, so I could have missed something subtle.

I sent myself a quick email message referring to a banned URL, and sure enough it all works now, I can see this in the headers:

X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at cornerstone.co.nz
X-Spam-Status: No, hits=4.9 tagged_above=0.0 required=6.3 tests=AWL,
	HTML_MESSAGE, URIBL_AB_SURBL, URIBL_OB_SURBL, URIBL_PH_SURBL,
	URIBL_SC_SURBL, URIBL_WS_SURBL
X-Spam-Level: ****

So that is excellent. And our spam levels should drop again!

This entry was posted on Friday, September 22nd, 2006 at 1:12 pm and is filed under Linux. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.