# Disabling invalid Validity DNSBL scores in SpamAssassin after query limit exceeded **URL:** \ **Category:** Mail\ **Created:** [May 17, 2025, 4:56am UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008 "2025-05-17T04:56:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sahsanu](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/sahsanu/32/9318_2.png) [@sahsanu](https://forum.hestiacp.com/u/sahsanu)\ **Post date:** [May 17, 2025, 4:56am UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008/1 "2025-05-17T04:56:42Z")
Hello, Today I noticed that an email which was clearly spam ended up in my Inbox. Looking at the SpamAssassin report, I saw these scores corresponding to DNSBL checks managed by [validity.com](http://validity.com) ```auto 1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL, https://senderscore.org/blocklistlookup/ [185.67.36.65 listed in bl.score.senderscore.com] -3.0 RCVD_IN_VALIDITY_CERTIFIED RBL: Sender in Validity Certification - Contact certification@validity.com [Excessive Number of Queries | ] -2.0 RCVD_IN_VALIDITY_SAFE RBL: Sender in Validity Safe - Contact certification@validity.com [Excessive Number of Queries | ] ``` `VALIDITY_RPBL` adds **1.3** points, `VALIDITY_CERTIFIED` and `VALIDITY_SAFE` subtract **3** and **2** points respectively. All three scores are incorrect, and the cause is that my server has exceeded the query limit to their DNSBL (10 000 queries per rolling month). Although the `VALIDITY_RPBL` entry doesn’t specify this in the report, the issue is the same: the query limit has been exceeded, and it always returns the same score for all IPs. This seems to be a recent change in Validity policies and SpamAssassin does not account for this scenario, applying the predefined scores to these checks even when they don’t return correct results (all three lists always return `127.255.255.255` for any query, which means the limit has been exceeded). For other DNSBLs, SpamAssassin does have rules in place to ignore such checks when this happens, but since this is likely new, it’s not accounted for yet. The rules in SpamAssassin are located at `/usr/share/spamassassin/20_dnsbl_tests.cf`: ```auto # --------------------------------------------------------------------------- # Validity (née Return Path, SenderScore) reputation DNSBLs # https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6247 # Certified: # https://www.validity.com/resource-center/fact-sheet-certification/ # (replaces RCVD_IN_BSP_TRUSTED, RCVD_IN_BSP_OTHER, RCVD_IN_SSC_TRUSTED_COI, RCVD_IN_RP_CERTIFIED) header RCVD_IN_VALIDITY_CERTIFIED eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.') describe RCVD_IN_VALIDITY_CERTIFIED Sender in Validity Certification - Contact certification@validity.com tflags RCVD_IN_VALIDITY_CERTIFIED net nice publish reuse RCVD_IN_VALIDITY_CERTIFIED RCVD_IN_RP_CERTIFIED # Safe: # https://www.validity.com/resource-center/fact-sheet-certification/ # (replaces HABEAS_ACCREDITED_COI, HABEAS_ACCREDITED_SOI, HABEAS_CHECKED, RCVD_IN_RP_SAFE) header RCVD_IN_VALIDITY_SAFE eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.') describe RCVD_IN_VALIDITY_SAFE Sender in Validity Safe - Contact certification@validity.com tflags RCVD_IN_VALIDITY_SAFE net nice publish reuse RCVD_IN_VALIDITY_SAFE RCVD_IN_RP_SAFE # Validity RPBL (née Return Path Reputation Network Blacklist - RNBL): # https://www.senderscore.org/blocklistlookup/ # (replaces RCVD_IN_RP_RNBL) header RCVD_IN_VALIDITY_RPBL eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.') describe RCVD_IN_VALIDITY_RPBL Relay in Validity RPBL, https://senderscore.org/blocklistlookup/ tflags RCVD_IN_VALIDITY_RPBL net publish reuse RCVD_IN_VALIDITY_RPBL RCVD_IN_RP_RNBL ``` And the scores assigned are in `/usr/share/spamassassin/50_scores.cf`: ```t score RCVD_IN_VALIDITY_RPBL 0 1.284 0 1.310 # n=0 n=2 score RCVD_IN_VALIDITY_CERTIFIED 0.0 -3.0 0.0 -3.0 score RCVD_IN_VALIDITY_SAFE 0.0 -2.0 0.0 -2.0 ``` That said, since I don’t want every email I receive to get **3.7 points subtracted** (-3 + -2 + 1.3) for no reason, I’ve disabled the resolution of these three lists. ```auto cat < /etc/spamassassin/disable-validity.cf dns_query_restriction deny sa-trusted.bondedsender.org dns_query_restriction deny sa-accredit.habeas.com dns_query_restriction deny bl.score.senderscore.com EOF systemctl restart spamd ``` I hope this helps someone facing the same issue. ---
**Author:** ![nu01](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/nu01/32/7639_2.png) [@nu01](https://forum.hestiacp.com/u/nu01)\ **Post date:** [May 17, 2025, 5:59am UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008/2 "2025-05-17T05:59:36Z")
I have been getting regular spam as well. But was never able to figure out why. Will check my server and hopefully if similar, this will help. BTW, SpamAsssassin team is very egoistic (5 different time experience) and they do not like to hear their system is incorrect. Anyways , no more offtopic. ---
**Author:** ![Sapsalinov](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/sapsalinov/32/8765_2.png) [@Sapsalinov](https://forum.hestiacp.com/u/Sapsalinov)\ **Post date:** [September 11, 2025, 11:33am UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008/3 "2025-09-11T11:33:31Z")
Hi @sahsanu Thanks for great solution here. I just dig more, The [Validity.com](http://Validity.com) folks asking to create an free account on _[https://my.validity.com/zone/sign-up](https://my.validity.com/zone/sign-up)_ and register the email server IP address there to remove this query limit. I already did that and I can confirm it’s still returning 127.255.255.255 so your solution is the best workaround at least for now. tnx again * * * Update: It’s now working after 24H. So registering the email server IPv4 in the free panel will remove this query limit. ---
**Author:** ![sahsanu](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/sahsanu/32/9318_2.png) [@sahsanu](https://forum.hestiacp.com/u/sahsanu)\ **Post date:** [September 11, 2025, 12:27pm UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008/4 "2025-09-11T12:27:49Z")
Hi @Sapsalinov Thanks for sharing it. ---
**Author:** ![mih](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/m/b782af/32.png) [@mih](https://forum.hestiacp.com/u/mih)\ **Post date:** [September 11, 2025, 6:28pm UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008/5 "2025-09-11T18:28:56Z")
I share the same idea. I haven’t been able to stop the spam. ---
**Author:** ![bestperson](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/b/c2a13f/32.png) [@bestperson](https://forum.hestiacp.com/u/bestperson)\ **Post date:** [September 11, 2025, 8:54pm UTC](https://forum.hestiacp.com/t/disabling-invalid-validity-dnsbl-scores-in-spamassassin-after-query-limit-exceeded/19008/6 "2025-09-11T20:54:44Z")
I have removed more spam from the logs such as [multi.uribl.com](http://multi.uribl.com) ```auto dns_block_rule URIBL_BLOCKED hit, creating /root/.spamassassin/dnsblock_multi.uribl.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny multi.uribl.com" to disable queries) ``` Total ```auto cat < /etc/spamassassin/disable-validity.cf dns_query_restriction deny sa-trusted.bondedsender.org dns_query_restriction deny sa-accredit.habeas.com dns_query_restriction deny bl.score.senderscore.com dns_query_restriction deny multi.uribl.com dns_query_restriction deny list.dnswl.org EOF systemctl restart spamd echo "Ready! Added restrictions for 5 DNS servers and restarted spamd" ```