Curious about USER_IN_WHITELIST

[Matt Kettler]

At 02:20 PM 1/20/2005, Denis Beauchemin wrote:
> >0.00     AWL
> >0.82     NO_REAL_NAME         From: does not include a real name
> >0.50     RCVD_IN_ORBS         Received via a relay in orbs.dorkslayers.com
> >-100.00  USER_IN_WHITELIST    From: address is in the user's white-list
> >
> >Especially from service at paypal.com which always makes me cautious.
> >
> >Where is this being checked?
> >
> >
> >
>Diane,
>
>The auto whitelist is not to be used with MS.  You should turn it off in
>spam.assassin.prefs.conf with:
>use_auto_whitelist 0

While this is more-or-less true this is a side issue from the
USER_IN_WHITELIST problem.

The AWL does not cause USER_IN_WHITELIST hits.

Dhawal Doshy wrote:

>Umm no.. actually just 'grep -il' for paypal in /usr/share/spamassassin/* or

I'd also point out that it's not likely due to anything in
/usr/share/spamassassin either, unless you've added rules there which you
should not. All of the default whitelist entries should show up as
USER_IN_DEF_WHITELIST in modern versions of SA (2.6x and 3.0).


USER_IN_WHITELIST will ONLY result from matching a whitelist_from or
whitelist_from_rcvd command. SpamAssassin, as shipped in 2.60 and higher,
contains none of these and they must be added by the end user. You'll need
to check /etc/mail/spamassasin/*.cf and
/etc/MailScanner/spam.assassin.prefs.conf

Also bear in mind that SA evaluates ALL sender based addresses, not just
the From: header. You need to look at the Return-Path, Sender, Resent-From
and other address bearing headers. So double-check. The message might be
"From: service at paypal.com" but might also have "Return-Path:
Denis.Beauchemin at USHERBROOKE.CA".

  If that's the case, the message will correctly match "whitelist_from
*@userbrooke.ca".

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!