How to properly whitelist.

[Julian Field]

MailScanner does *not* use the addresses in the header. It uses the
addresses in the envelope. From looking at the headers of the message, it is
quite possible that the envelope sender (which you can find by looking in
your mail logs) is something at something.exactis.com.

Quoting Remco Barendse <mailscanner at BARENDSE.TO>:
> It's really, strange because I've added the lines as per below and it's
> still not working. I think there may be a bug in the whitelist code.
>
> This is a message still being marked as spam as it appears in Pine:
> Date: Fri, 20 Dec 2002 10:52:59 UT
> From: KLM Highlights <highlights_dutch+692582.129462549.2 at lists.klm.com>
> To: xxxx at barendse.to
> Subject: {Spam?} Start de feestdagen in stijl op klm.nl!
>
>
> These are some snippets from the header:
> Received: from sender0004.lodo.exactis.com (sender0004.lodo.exactis.com
> [64.208.135.24])
<snip>
> Message-Id: <5.1349.5.0.0.1826.1040381926 at sender0004.lodo.exactis.com>
>
>
> This is what is included in my spam.whitelist.rules:
> From:           *@klm.com               yes
> From:           *@*.klm.com             yes
> From:           *@klm.nl                yes
> From:           *@*.klm.nl              yes
>
> Which should cover just about any possibility. Still I think the
> whitelist
> feature is looking at another or the wrong sender's domain. I could start
> whitelisting exactis.com but as I understood MailScanner should look at
> the address in the header which means that this shouldn't be necessary?
>
> Remco
>
>
> On Tue, 17 Dec 2002, Derek Winkler wrote:
>
> > You need to add:
> > From:           *@greenpeace.nl       yes
> >
> > You entry only covers hosts or subdomains at greenpeace.nl.
> >
> > Such as whoever at somehost.greenpeace.nl
> >
> >
> > -----Original Message-----
> > From: Remco Barendse [mailto:mailscanner at barendse.to]
> > Sent: Tuesday, December 17, 2002 5:07 PM
> > To: MAILSCANNER at jiscmail.ac.uk
> > Subject: Re: How to properly whitelist.
> >
> >
> > Aaaargh!! It's still not working as I would expect.
> >
> > I have this in MailScanner.conf
> > Is Definitely Not Spam = /etc/MailScanner/rules/spam.whitelist.rules
> > /etc/MailScanner/rules/spam.whitelist.rules contains:
> > From:           *@*.greenpeace.nl       yes
> > FromTo:         default                 no
> > (with TABS in between the columns)
> >
> > And this is what I got in pine:
> >
> > Date: Tue, 10 Dec 2002 14:39:44 +0100
> > From: "news at greenpeace.nl" <news at greenpeace.nl>
> > To:  <xxx at barendse.to>
> > Subject: {Spam?} E-mail actie: wrakke tankers uit de vaart!
> >
> > Where am I going wrong?
> >
> > When I start adding the domains that the message has gone through as
> they
> > appear in the maillog things sometimes seem to work. But adding the
> domain
> > of the e-mail address as presented to you doesn't do the trick. Could
> that
> > be a bug in MailScanner?
> >
> >
> >
> > On Mon, 9 Dec 2002, Julian Field wrote:
> >
> > > At 21:43 09/12/2002, you wrote:
> > > >Hmm, I still don't quite get it, now I'm totally lost :)
> > > >
> > > >I included the following line in my spam.whitelist.rules list:
> > > >From:           klm.com                 yes
> > > >Why doesn't this rule include any possible combination of e-mail
> > > >adresses and hosts within the klm.com domain? I'd think that by
> > > >whitelisting klm.com I would have whitelisted both whoever at klm.com
> > > >as well as whoever at wherever.klm.com
> > >
> > > No, "klm.com" is shorthand for
> > >          *@klm.com
> > > If you want to whitelist all hosts within the klm.com domain, then
> you
> > need
> > > to add a rule matching
> > >          *@*.klm.com
> > > as well.
> > >
> > > >What would I need to add to get a wildcard like *@*.klm.com ?
> > >
> > > Exactly that:
> > >          *@*.klm.com
> > >
> > > >Maybe it's a good idea to give ample examples in the rules list that
> is
> > > >included in mailscanner by default as there seem to be quite a few
> > > >questions about it?
> > >
> > > It's okay once you get the hang of it :-)
> > > But point taken. Have you read the "EXAMPLES" and "README" files in
> the
> > > rules directory provided in the distribution? Did they help? All
> > > contributions of things to add to these files would be most welcome.
> > > --
> > > Julian Field
> > > www.MailScanner.info
> > > MailScanner thanks transtec Computers for their support
> > >
> > >
> >
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> >
> > .
> >
> >
> >
> > This footnote also confirms that this email message has been swept by
> MIMEsweeper for the presence of computer viruses
> >
>
*****************************************************************************
******
> >
> >
> >
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>


--
Jules
jkf at ecs.soton.ac.uk
mailscanner at ecs.soton.ac.uk