Strange whitelist issue

[Julian Field]

At 09:22 20/11/2003, you wrote:
>I have a spam that is getting through to many users with a -19 score,
>the reports says it is
>
>-15.00
>USER_IN_DEF_WHITELIST
>From: address is in the default white-list

That's the SpamAssassin whitelist.

>My whitelist contains only this entries
>
>From:           127.0.0.1       yes             #to allow release from
>quarantine with mailwatch
>FromOrTo:       default         no

That's the MailScanner whitelist.


>Headers for the messages are this
>
>Received: from irpta50.nix.paypal.com (irpta50.nix.paypal.com
>[64.4.240.76])
>by mail01.mydoimain.com.au (Postfix) with SMTP id E231933D20
>for <myuser at mydomain.com.au>; Thu, 20 Nov 2003 20:01:16 +1100 (EST)
>Received: from paypal.com (10.192.73.9)
>by irpta50.nix.paypal.com with QMQP; 20 Nov 2003 00:42:10 -0800
>Date: 20 Nov 2003 08:52:07 -0000
>Message-ID: <20031120085207.15682.qmail at bullhorn.nix.paypal.com>
>From: <announcements-account at paypal.com>
>Subject: Shop safely this Holiday Season
>To: "My User" <myuser at mydomain.com.au>
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
>boundary="=_PayPalMessageSegment-A20031120014492_="
>X-Mailer: PayPal Mail Service (2.0.3)
>
>Mailscanner.conf has
>SpamAssassin Auto Whitelist = no
>Required SpamAssassin Score = 5
>High SpamAssassin Score = 15
>
>Any ideas whats going on here? Rh9/postfix2.16/ms4.24-5/clamav.6
>
>Thanks in advance
>Pete

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC  7222 11F6 5947 1415 B654