Whitelisting again (unmodified code)

[Steve Evans]

Aah, so that's how it works.  It just seems to me that if I whitelist
the reply-to I get it every time while the from doesn't always work.  I
guess I'll just check the logs now.

 
Steve Evans
Computing Services
(619) 594-0653
 


-----Original Message-----
From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK] 
Sent: Tuesday, July 30, 2002 12:57 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Whitelisting again (unmodified code)


At 22:45 29/07/2002, you wrote:
>Here's what I have in spam.whitelist.conf
>
>From: reports at marketwatchmail.com
>
>Here's the header from the Mailscanner processed message.  Why isn't 
>the whitelisting not working.  If I remove the "From:" it's still not 
>whitelisted.

MailScanner doesn't use the headers at all for this, it uses the
envelope. So either take a guess at what the envelope "From" address is
(it might be the same as the return-path address) or take a look in your
mail logs to determine the real envelope "From" address. At a guess the
envelope From address will vary for every message from this list, so you
may have to whitelist the whole domain using
         From:   marketwatchmail.com

>Microsoft Mail Internet Headers Version 2.0
>Received: from med.core01.med.wayne.edu ([146.9.19.198] RDNS failed) by

>MED-CORE06.med.wayne.edu with Microsoft SMTPSVC(5.0.2195.4905);
>          Mon, 29 Jul 2002 17:18:21 -0400
>Received: from eeyore.med.wayne.edu ([146.9.19.19]) by 
>med.core01.med.wayne.edu with Microsoft SMTPSVC(5.0.2195.4905);
>          Mon, 29 Jul 2002 17:18:21 -0400
>Received: from q3.marketwatchmail.com (q3.marketwatchmail.com
>[206.146.143.88])
>         by eeyore.med.wayne.edu (8.12.2/8.12.2) with SMTP id 
>g6TL6p9S019213
>         for <jscochin at med.wayne.edu>; Mon, 29 Jul 2002 17:07:03 -0400
>(EDT)
>Message-Id: <200207292107.g6TL6p9S019213 at eeyore.med.wayne.edu>
>Received: (qmail 29205 invoked from network); 29 Jul 2002 21:07:48 
>-0000
>Received: from unknown (206.146.143.85)
>   by q3.marketwatchmail.com with QMQP; 29 Jul 2002 21:07:48 -0000
>Mailing-List: contact reports at marketwatchmail.com
>X-No-Archive: yes
>List-Help: <mailto:afterthebell-html-help at marketwatchmail.com>
>List-Unsubscribe:
><mailto:afterthebell-html-unsubscribe at marketwatchmail.com>
>List-Subscribe:
<mailto:afterthebell-html-subscribe at marketwatchmail.com>
>From: CBS MarketWatcher <reports at marketwatchmail.com>
>To: jscochin at med.wayne.edu
>Delivered-To: mailing list afterthebell-html at marketwatchmail.com
>Delivered-To: moderator for afterthebell-html at marketwatchmail.com
>Received: (qmail 28581 invoked from network); 29 Jul 2002 21:01:09
-0000
>Date: Mon, 29 Jul 2002 21:01:09 (GMT)
>X-MSMail-Priority: Normal
>X-mailer: AspMail 3.53 (SMTP546388)
>Subject: {SPAM?} CBSMW After The Bell Report: Wall Street gets a bull
>stampede
>Mime-Version: 1.0
>Content-Type: text/html
>Content-Transfer-Encoding: quoted-printable
>X-DCC-servers-Metrics: eeyore 1049; Body=1 Fuz1=1 Fuz2=1
>X-MailScanner: Found to be clean
>X-MailScanner-SpamCheck: SpamAssassin (score=8.8, required 5, FWD_MSG,
>         INVALID_DATE, FORGED_RCVD_FOUND, COPYRIGHT_CLAIMED, OPT_IN,
>         CLICK_BELOW, ONLY_COST, HTML_WITH_BGCOLOR, MIME_LONG_LINE_QP,
>         WEIRD_PORT, CTYPE_JUST_HTML, MSG_ID_ADDED_BY_MTA_2,
>MISSING_MIMEOLE,
>         MISSING_OUTLOOK_NAME, AWL)
>Return-Path:
>afterthebell-html-return-466-jscochin=med.wayne.edu at marketwatchmail.com
>X-OriginalArrivalTime: 29 Jul 2002 21:18:21.0747 (UTC)
>FILETIME=[77880830:01C23745]

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ