Whitelisted

[Ken Anderson]

Can't help you without information. Post your whitelist rules, post your
maillogs & msg headers for the messages that were mysteriously
whitelisted. Try running mailscanner in debug mode? (I have never tried
this, so I can't really help here)
Ken A.


Kris Zabriskie wrote:

> If this continues, I think I am going to have to change products, which I
> really do not want to do.
>
>
> ----- Original Message -----
> From: "Steve Douglas" <steve.douglas at SBIINCORPORATED.COM>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Tuesday, July 22, 2003 1:14 PM
> Subject: Re: Whitelisted
>
>
>
>>I pretty well have given up on trying to figure out this too.  I have
>>numerous address in my spam.whitelist.rules and they just get plain
>
> ignored.
>
>>This statement is invoked by the "Is Definitely Not Spam" statement in the
>>MS conf file.
>>
>>SD
>>:-)
>>
>>
>>
>>>-----Original Message-----
>>>From: Kris Zabriskie [mailto:zabriskw at ITECH.NET]
>>>Sent: Tuesday, July 22, 2003 9:20 AM
>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>Subject: Whitelisted
>>>
>>>I know this has come up several times on the MailScanner mailing list,
>
> but
>
>>>I
>>>have not seen a clear cut answer on why this happends and I know several
>>>people are having the same problem.  Our spam has gone through the roof
>>>recently.  A good portion of it is spam, that SpamAssassin has
>
> identified
>
>>>as
>>>spam, but in the header it says "not spam (whitelisted)".  OK.
>
> Obviously
>
>>>somewhere it says, that this e-mail address is ok.  So I continue to
>
> look
>
>>>around.  No mentionment of the address in spam.whitelist.rules for
>>>mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
>>>address is not in there, in fact I delete all of the addresses.  I then,
>>>jump over to the MailScanner conf, and take a look in there to make sure
>
> I
>
>>>am not using SA for whitelisting.  In the MailScanner conf it says:
>>>SpamAssassin Auto Whitelist = no
>>>
>>>I have NO idea what is going on here!  Below is just an example of one
>>>that
>>>got through.
>>>
>>>This is everything from mail.log pertaining to the example message:
>>>
>>>Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
>>>from=<7hd29nsrepo at springfieldrealty.com>, size=2700, class=0, nrcpts=17,
>>>msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms at 7pjel.x.vy5>, proto=SMTP,
>>>daemon=MTA,
>>>relay=_Crystal at c66.110.164-221.clta.globetrotter.net [66.110.164.221]
>>>Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
>>>
>
> to=<bmyers at itech.net>,<bmcnamee at itech.net>,<blue1 at itech.net>,<blshu at itech.
>
>>>ne
>>>
>
> t>,<bknipple at itech.net>,support,<brandon at itech.net>,<bobs at itech.net>,<bigo
>
>>>pi
>>>
>
> mp at itech.net>,<bassman at itech.net>,<baron at itech.net>,<bigbro at itech.net>,<be
>
>>>rr
>>>
>
> ier at itech.net>,<bergman at itech.net>,<bentley at itech.net>,<bearden at itech.net>
>
>>>,<
>>>bbani at itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local,
>>>pri=600558,
>>>dsn=2.0.0, stat=Sent
>>>
>>>This is the header of the email:
>>>
>>>X-Priority: 3
>>>X-MSMail-Priority: Normal
>>>X-MailScanner-Information: Please contact the ISP for more information
>>>X-MailScanner: Found to be clean
>>>X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin
>
> (score=8.2,
>
>>>required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80, HTML_FONT_BIG,
>>>HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE,
>
> MIME_HTML_ONLY,
>
>>>MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT,
>>>PENIS_ENLARGE2)
>>>
>>>Any help would be greatly appreciated.  I am trying to stop little kids
>>>from
>>>getting bombarded with Penis Enlargement e-mails.  Thanks in advance.
>>>
>>>
>>>Kris Zabriskie
>>>Network Admin / Consultant
>>>I-Tech Inc.
>>>zabriskw at itech.net
>>>717-657-3035
>>
>
>