Curious about USER_IN_WHITELIST

[Dhawal Doshy]

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler writes:
>
> I'd also point out that it's not likely due to anything in
> /usr/share/spamassassin either, unless you've added rules there which you
> should not. All of the default whitelist entries should show up as
> USER_IN_DEF_WHITELIST in modern versions of SA (2.6x and 3.0).
>
>
> USER_IN_WHITELIST will ONLY result from matching a whitelist_from or
> whitelist_from_rcvd command. SpamAssassin, as shipped in 2.60 and higher,
> contains none of these and they must be added by the end user. You'll need
> to check /etc/mail/spamassasin/*.cf and
> /etc/MailScanner/spam.assassin.prefs.conf
>
> Also bear in mind that SA evaluates ALL sender based addresses, not just
> the From: header. You need to look at the Return-Path, Sender, Resent-From
> and other address bearing headers. So double-check. The message might be
> "From: service at paypal.com" but might also have "Return-Path:
> Denis.Beauchemin at USHERBROOKE.CA".
>
>  If that's the case, the message will correctly match "whitelist_from
> *@userbrooke.ca".
>

While I do agree to the rest of your explanation.. paypal is there by
default as a "def_whitelist_from_rcvd" rule in SA 3.0.2 (atleast)

[root at myhost root]# grep -i paypal /usr/share/spamassassin/60_whitelist.cf
def_whitelist_from_rcvd  *@paypal.com                           paypal.com

[root at myhost root]# rpm -qf /usr/share/spamassassin/60_whitelist.cf
perl-Mail-SpamAssassin-3.0.2-1

 - dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!