Whitelist?? Working

[Antony Stone]

On Sunday 14 September 2003 11:14 am, Chan Min Wai wrote:

> spam.whitelist.rules
> From:           samheng at pd.jaring.my    yes
> FromOrTo:       gifts at amtb-m.org.my     yes
> From:           *@amtb*         yes
> (the above are all NOT SPAM)

Okay, so these are the addresses you want to whitelist:

Anything from samheng at pd.jaring.my
Anything from gifts at amtb-m.org.my
Anything to gifts at amtb-m.org.my
Anything from *@amtb*

(This last one looks a little too general to me, but anyway...)

> >  - the syslog entries when a problem mail gets processed
>
> Sep  7 11:55:53 Amitabhasrv fetchmail[10733]: 1 message for
> gifts/amtb-m.org.my
> at pop.amtb-m.org.my (1747 octets).
> Sep  7 11:55:53 Amitabhasrv fetchmail[10733]: reading message
> gifts/amtb-m.org.my at pop.amtb-m.org.my:1 of 1 (1747 octets)
> Sep  7 11:55:53 Amitabhasrv sendmail[15405]: h873tr3W015405:
> from=<amtbbudd at fnsrvlx4.fnbs.net.my>, size=1785, class=0, nrcpts=1,

Okay, so the From address is amtbbudd at fnsrvlx4.fnbs.net.my - that doesn't
match any of your rules, so it can only be whitelisted if the To envelope
address is gifts at amtb-m.org.my

Please can you show us the *full* headers for this email, because I suspect
that the way you are using fetchmail means the To envelope address is not
macthing your whitelist rule.

> SpamAssassin (score=11.7, required 5, FROM_ENDS_IN_NUMS 0.74,
> HEADER_8BITS 1.18, HTML_10_20 1.36, HTML_MESSAGE 0.10,
> MAILTO_TO_SPAM_ADDR 0.38, MIME_HTML_ONLY 0.10, RCVD_IN_OSIRUSOFT_COM
> 0.55, SUBJ_FULL_OF_8BITS 4.30, X_OSIRU_OPEN_RELAY 2.90)

You should remove Osirusoft from yur RBL list - they are no longer in
operation and will label *everything* as spam now.

Basically I think it is fetchmail which is causing your problems.   Note that
MailScanner's From and To rules match on the SMTP *envelope* addresses, not
the addresses in the From: and To: headers inside the email.

Hope this helps,

Antony.

--

90% of network problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.