Using SpamCopURI, ws.surbl.org FP'ed some mail from Fedora-List. http://dirk-wendland.deMUNGED.vu/ (a personal webpage in a sig).
WS contains deMUNGED.vu. But they're a registrar. (.vu is Vanuatu.) So perhaps SURBL should whitelist de.vu and check at third level?