whitelisting

[Kevin Miller]

Julian Field wrote:
> In which case just change the From: to To: in the whitelist.

Huh?  How's that work?  The mail is addressed To: user at ci.juneau.ak.us,
pretending to be From: user at monster.com.  

In spam.whitelist.rules I have 

  From:  *@monster.com    yes

so that any mail from there is allowed in.  Wouldn't using To: basically
mean that any internal originating mail was allowed out?

Or am I just being dense?


 
> On 7 Jul 2005, at 22:30, Kevin Miller wrote:
> 
>> A couple of spam messages are coming through because they're
>> whitelisted. Problem is, that they're not from where they purport to
>> be.  This is a message that came through claiming to be from
>> monster.com (which is in the whitelist) although it's obvious that
>> it didn't come from there. Wouldn't it make more sense to whitelist
>> on the envelope To: instead?  Or do 
>> I just
>> have something set wrong somewhere?
>> 
>> Return-Path: <(tm)g>
>> Received: from monster.com
>>      (dial81-135-244-94.in-addr.btopenworld.com [81.135.244.94]) by
>> mxl.ci.juneau.ak.us (8.13.3/8.13.3/SuSE Linux 0.7) with 
>> SMTP id
>> j67KmOkW025458
>>      for <joe_blow at ci.juneau.ak.us>; Thu, 7 Jul 2005 12:48:39 -0800
>> Date: Thu, 7 Jul 2005 12:48:24 -0800
>> Message-Id: <200507072048.j67KmOkW025458 at mxl.ci.juneau.ak.us>
>> From: Andrew Welch <arielreps at surimail.com>
>> To: Joe Blow <joe_blow at ci.juneau.ak.us>
>> Subject: Ariel reps wanted
>> X-Priority: 3
>> X-MSMail-Priority: Normal
>> Reply-To: Andrew Welch <arielreps at surimail.com>
>> mime-version: 1.0
>> content-type: multipart/mixed;
>>      boundary="qzsoft_directmail_seperator"
>> 
>> (The original recipient was changed to joe_blow - all else is a
>> straight cut and paste from Mailwatch)
>> 
>> TIA...
>> 
>> ...Kevin



...Kevin
-- 
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!