Whitelisted

[Kris Zabriskie]

I know this has come up several times on the MailScanner mailing list, but I
have not seen a clear cut answer on why this happends and I know several
people are having the same problem.  Our spam has gone through the roof
recently.  A good portion of it is spam, that SpamAssassin has identified as
spam, but in the header it says "not spam (whitelisted)".  OK.  Obviously
somewhere it says, that this e-mail address is ok.  So I continue to look
around.  No mentionment of the address in spam.whitelist.rules for
mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
address is not in there, in fact I delete all of the addresses.  I then,
jump over to the MailScanner conf, and take a look in there to make sure I
am not using SA for whitelisting.  In the MailScanner conf it says:
SpamAssassin Auto Whitelist = no

I have NO idea what is going on here!  Below is just an example of one that
got through.

This is everything from mail.log pertaining to the example message:

Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
from=<7hd29nsrepo at springfieldrealty.com>, size=2700, class=0, nrcpts=17,
msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms at 7pjel.x.vy5>, proto=SMTP, daemon=MTA,
relay=_Crystal at c66.110.164-221.clta.globetrotter.net [66.110.164.221]
Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
to=<bmyers at itech.net>,<bmcnamee at itech.net>,<blue1 at itech.net>,<blshu at itech.ne
t>,<bknipple at itech.net>,support,<brandon at itech.net>,<bobs at itech.net>,<bigopi
mp at itech.net>,<bassman at itech.net>,<baron at itech.net>,<bigbro at itech.net>,<berr
ier at itech.net>,<bergman at itech.net>,<bentley at itech.net>,<bearden at itech.net>,<
bbani at itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local, pri=600558,
dsn=2.0.0, stat=Sent

This is the header of the email:

X-Priority: 3
X-MSMail-Priority: Normal
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=8.2,
required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80, HTML_FONT_BIG,
HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE, MIME_HTML_ONLY,
MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT, PENIS_ENLARGE2)

Any help would be greatly appreciated.  I am trying to stop little kids from
getting bombarded with Penis Enlargement e-mails.  Thanks in advance.


Kris Zabriskie
Network Admin / Consultant
I-Tech Inc.
zabriskw at itech.net
717-657-3035