SpamAssassin blocking legitimate email with "RCVD_IN_VALIDITY_RPBL_BLOCKED RBL"

Symptoms

SpamAssassin is blocking legitimate emails, and messages similar to the following can be found in maillog.

CONFIG_TEXT: Jun 4 18:27:52 serveur spamd[4139205]: check: dns_block_rule RCVD_IN_VALIDITY_CERTIFIED_BLOCKED hit, creating /root/.spamassassin/dnsblock_sa-trusted.bondedsender.org (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny sa-trusted.bondedsender.org" to disable queries)

Description

SpamAssassin uses multiple RBLs by default, one of which is the Validity RBL, which requires an account at validity.com to be created for the RBL to be checked from the server. If an account is not created, you will see the above response in the SpamAssassin Headers as checks to this block list fail. This does not indicate a server error; it only indicates that your server is not authorized to query these block lists. You can address this by creating a custom configuration file for SpamAssassin. The custom file can have almost any name if it has the .cf suffix to indicate that it is a configuration file.

Workaround

1. Access the server's command line as the root user via SSH or "Terminal" in WHM.

2. Create the custom.cf file.

   # touch /etc/mail/spamassassin/custom.cf

3. Open the file in your preferred text editor.

4. Add the following lines to the file.

   CONFIG_TEXT: dns_query_restriction deny sa-trusted.bondedsender.org
   dns_query_restriction deny sa-accredit.habeas.com
   dns_query_restriction deny bl.score.senderscore.com

5. Save the changes and exit the text editor.

6. Run the following command to verify that the SpamAssassin configuration is valid.

   # /usr/local/cpanel/3rdparty/bin/spamassassin --lint

7. Restart the spamd service.

   # /usr/local/cpanel/scripts/restartsrv_spamd

Additional Resources

How to Make a Custom Configuration file for SpamAssassin