URIBL_BLOCKED Message in SpamAssassin Logging and Headers ========================================================= .. contents:: How the Issue Manifests ----------------------- Logging stating ``URIBL_Blocked`` appears in both ``/var/log/maillog`` and the headers of messages that have been scanned by SpamAssassin. Examples: .. code-block:: Feb 22 15:13:18 ip-172-31-37-24 spamc[15752]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused Feb 22 15:13:18 ip-172-31-37-24 spamd[4239]: spamd: connection from 127.0.0.1 [127.0.0.1]:64777 to port 783, fd 5 Feb 22 15:13:18 ip-172-31-37-24 spamd[4239]: spamd: processing message for user@domain.com:241Feb 22 15:13:18 ip-172-31-37-24 spamd[4239]: dns: new_dns_packet: domain is utf8 flagged: ns.cloudflare.com Feb 22 15:13:18 ip-172-31-37-24 spamd[4239]: dns: new_dns_packet: domain is utf8 flagged: ns.cloudflare.com Feb 22 15:13:18 ip-172-31-37-24 spamd[4239]: spamd: clean message (1.2/5.0) for user@domain.com:241 in 0.3 seconds, 2265 bytes. Feb 22 15:13:18 ip-172-31-37-24 spamd[4239]: spamd: result: . 1 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,RDNS_NONE,SPF_HELO_NONE,TVD_SPACE_RATIO,URIBL_BLOCKED scantime=0.3,size=2265,user=user@domain.com,uid=241,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=64777,mid=,autolearn=no autolearn_force=no Feb 22 15:13:18 ip-172-31-37-24 spamd[4234]: prefork: child states: II .. code-block:: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server.com X-Spam-Level: * X-Spam-Status: No, score=1.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,RDNS_NONE,SPF_HELO_NONE,TVD_SPACE_RATIO,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.2 Received: (qmail 15733 invoked by uid 108); 22 Feb 2023 15:13:18 -0500 Received: by simscan 1.4.0 ppid: 15729, pid: 15731, t: 0.0748s scanners:none Cause of the Issue ------------------ The RBL servers are currently not allowing the DNS server to do an RBL request. For most RBL servers, as long as a given DNS server is not doing too many requests, those requests are allowed. However, if a DNS server is very busy and making too many requests, that DNS server no longer qualifies for the "free for some" method the RBL servers have in place. Because of this, it is blocked from making requests, as it would fall under a category where payment would be required. How to Resolve -------------- Adding 127.0.0.1 to ``/etc/resolv.conf`` and the restarting SpamAssassin will resolve the issue. #. Log in to the server at the CLI as root, either via SSH or from the terminal #. At the CLI, use a text editor to open ``/etc/resolv.conf`` for editing. The following example uses the Vim text editor: .. code-block:: vim /etc/resolv.conf #. Add the line following line: .. code-block:: nameserver 127.0.0.1 Example of how the file may look after editing--specific details, such as the "generated by" and "search" lines, and any other added nameservers will differ from this examples: .. code-block:: ; generated by /usr/sbin/dhclient-script search iwx.io nameserver 127.0.0.1 nameserver 8.8.8.8 nameserver 1.1.1.1 nameserver 1.0.0.1 #. Save and exit the text editor #. Restart SpamAssassin .. code-block:: systemctl restart spamassassin