Spamassassin: hele lage score spammails (op andere VPS hele andere score)

[pippen]

We hebben 2 VPS servers, waarvan op 1 de Spamassassin score van alle mails veel te laag is. Veel spam komt daardoor gewoon door de test. Wanneer ik eenzelfde tekstbestand test met "spamassassin -t < tekstbestand.txt" krijg ik 2 totaal verschillende waardes:

VPS1:
Analyse details: (-3.3 punten, 5.0 vereist)

pnt regel naam omschrijving
---- ---------------------- -------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: satellitemagazine.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[185.52.150.120 listed in list.dnswl.org]
-0.4 RCVD_IN_IADB_LISTED RBL: Participates in the IADB system
[185.52.150.120 listed in iadb.isipp.com]
-0.2 RCVD_IN_IADB_DK RBL: IADB: Sender publishes Domain Keys record
-0.0 RCVD_IN_IADB_SPF RBL: IADB: Sender publishes SPF record
-0.0 RCVD_IN_IADB_SENDERID RBL: IADB: Sender publishes Sender ID record
-0.2 RCVD_IN_IADB_RDNS RBL: IADB: Sender has reverse DNS record
-2.1 RCVD_IN_IADB_OPTIN RBL: IADB: All mailing list mail is opt-in
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
-1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: HTML opgenomen in het bericht
0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid


VPS2:
Analyse details: (4.5 punten, 5.0 vereist)

pnt regel naam omschrijving
---- ---------------------- -------------------------------------------------
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URIs: managesubscriber-185.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[185.52.150.120 listed in list.dnswl.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[185.52.150.120 listed in bb.barracudacentral.org]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
-1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URIs: managesubscriber-185.com]
-0.4 RCVD_IN_IADB_LISTED RBL: Participates in the IADB system
[185.52.150.120 listed in iadb.isipp.com]
-0.2 RCVD_IN_IADB_RDNS RBL: IADB: Sender has reverse DNS record
-0.0 RCVD_IN_IADB_SENDERID RBL: IADB: Sender publishes Sender ID record
-0.2 RCVD_IN_IADB_DK RBL: IADB: Sender publishes Domain Keys record
-2.1 RCVD_IN_IADB_OPTIN RBL: IADB: All mailing list mail is opt-in
-0.0 RCVD_IN_IADB_SPF RBL: IADB: Sender publishes SPF record
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: managesubscriber-185.com]
0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: HTML opgenomen in het bericht
0.0 AC_BR_BONANZA RAW: Too many newlines in a row... spammy template
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid


Op beide servers is "sa-update" uitgevoerd.

Beide servers draaien op CentOS en:
SpamAssassin version 3.4.1 running on Perl version 5.10.1

Heeft iemand enig idee waar dit aan zou kunnen liggen?

[CharlieRoot]

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked

Ik zou daar beginnen.

[pippen]

Dat heeft betrekking tot een link die in de mail staat. Als ik die link weghaal, is die melding ook weg maar is er nog steeds een hele lage score op de eerste VPS.

[Dreas]

SURBL is alleen gratis tot een bepaalde hoeveel queries (http://www.surbl.org/usage-policy), wellicht ben je geblokkeerd bij ze?

[CharlieRoot]

Dat heeft betrekking tot een link die in de mail staat. Als ik die link weghaal, is die melding ook weg maar is er nog steeds een hele lage score op de eerste VPS.
Het gaat om dat laatste stukje zoals Dreas ook vermeld:
The query to URIBL was blocked

[pippen]

De melding zie ik bij andere mails niet (meer). Volgens deze pagina http://www.configserver.com/techfaq/faqlist.php?catid=5&faqid=51&page=5 moeten er nog 3 poorten open in de firewall. Nu die open staan is de score van de mails al iets hoger.