Whitelisted

Tue Jul 22 18:42:01 IST 2003

Here is everything:

Contents:
mail.log is the sendmail mail.log (ONLY information pertaining to the
message in question)
mail.header is the header of the e-mail
spam.whitelist.rules is exactly what it says
MailScanner.conf is exactly what it is =)

Any help will greatly be appreciated!!!  Thanks again to everyone for their
help, and patience!

----- Original Message -----
From: "Ken Anderson" <ka at PACIFIC.NET>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 1:29 PM
Subject: Re: Whitelisted

> Can't help you without information. Post your whitelist rules, post your
> maillogs & msg headers for the messages that were mysteriously
> whitelisted. Try running mailscanner in debug mode? (I have never tried
> this, so I can't really help here)
> Ken A.
>
>
> Kris Zabriskie wrote:
>
> > If this continues, I think I am going to have to change products, which
I
> > really do not want to do.
> >
> >
> > ----- Original Message -----
> > From: "Steve Douglas" <steve.douglas at SBIINCORPORATED.COM>
> > To: <MAILSCANNER at JISCMAIL.AC.UK>
> > Sent: Tuesday, July 22, 2003 1:14 PM
> > Subject: Re: Whitelisted
> >
> >
> >
> >>I pretty well have given up on trying to figure out this too.  I have
> >>numerous address in my spam.whitelist.rules and they just get plain
> >
> > ignored.
> >
> >>This statement is invoked by the "Is Definitely Not Spam" statement in
the
> >>MS conf file.
> >>
> >>SD
> >>:-)
> >>
> >>
> >>
> >>>-----Original Message-----
> >>>From: Kris Zabriskie [mailto:zabriskw at ITECH.NET]
> >>>Sent: Tuesday, July 22, 2003 9:20 AM
> >>>To: MAILSCANNER at JISCMAIL.AC.UK
> >>>Subject: Whitelisted
> >>>
> >>>I know this has come up several times on the MailScanner mailing list,
> >
> > but
> >
> >>>I
> >>>have not seen a clear cut answer on why this happends and I know
several
> >>>people are having the same problem.  Our spam has gone through the roof
> >>>recently.  A good portion of it is spam, that SpamAssassin has
> >
> > identified
> >
> >>>as
> >>>spam, but in the header it says "not spam (whitelisted)".  OK.
> >
> > Obviously
> >
> >>>somewhere it says, that this e-mail address is ok.  So I continue to
> >
> > look
> >
> >>>around.  No mentionment of the address in spam.whitelist.rules for
> >>>mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
> >>>address is not in there, in fact I delete all of the addresses.  I
then,
> >>>jump over to the MailScanner conf, and take a look in there to make
sure
> >
> > I
> >
> >>>am not using SA for whitelisting.  In the MailScanner conf it says:
> >>>SpamAssassin Auto Whitelist = no
> >>>
> >>>I have NO idea what is going on here!  Below is just an example of one
> >>>that
> >>>got through.
> >>>
> >>>This is everything from mail.log pertaining to the example message:
> >>>
> >>>Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
> >>>from=<7hd29nsrepo at springfieldrealty.com>, size=2700, class=0,
nrcpts=17,
> >>>msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms at 7pjel.x.vy5>, proto=SMTP,
> >>>daemon=MTA,
> >>>relay=_Crystal at c66.110.164-221.clta.globetrotter.net [66.110.164.221]
> >>>Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
> >>>
> >
> >
to=<bmyers at itech.net>,<bmcnamee at itech.net>,<blue1 at itech.net>,<blshu at itech.
> >
> >>>ne
> >>>
> >
> >
t>,<bknipple at itech.net>,support,<brandon at itech.net>,<bobs at itech.net>,<bigo
> >
> >>>pi
> >>>
> >
> >
mp at itech.net>,<bassman at itech.net>,<baron at itech.net>,<bigbro at itech.net>,<be
> >
> >>>rr
> >>>
> >
> >
ier at itech.net>,<bergman at itech.net>,<bentley at itech.net>,<bearden at itech.net>
> >
> >>>,<
> >>>bbani at itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local,
> >>>pri=600558,
> >>>dsn=2.0.0, stat=Sent
> >>>
> >>>This is the header of the email:
> >>>
> >>>X-Priority: 3
> >>>X-MSMail-Priority: Normal
> >>>X-MailScanner-Information: Please contact the ISP for more information
> >>>X-MailScanner: Found to be clean
> >>>X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin
> >
> > (score=8.2,
> >
> >>>required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80,
HTML_FONT_BIG,
> >>>HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE,
> >
> > MIME_HTML_ONLY,
> >
> >>>MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT,
> >>>PENIS_ENLARGE2)
> >>>
> >>>Any help would be greatly appreciated.  I am trying to stop little kids
> >>>from
> >>>getting bombarded with Penis Enlargement e-mails.  Thanks in advance.
> >>>
> >>>
> >>>Kris Zabriskie
> >>>Network Admin / Consultant
> >>>I-Tech Inc.
> >>>zabriskw at itech.net
> >>>717-657-3035
> >>
> >
> >
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner.conf
Type: application/octet-stream
Size: 43011 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/MailScanner.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: spam.whitelist.rules
Type: application/octet-stream
Size: 2248 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/spam.whitelist.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mail.header
Type: application/octet-stream
Size: 1352 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/mail.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mail.log
Type: application/octet-stream
Size: 737 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/mail-0001.obj