Kevin_Miller at CI.JUNEAU.AK.US
Fri Jul 8 16:31:46 IST 2005
Julian Field wrote:
> In which case just change the From: to To: in the whitelist.
Huh? How's that work? The mail is addressed To: user at ci.juneau.ak.us,
pretending to be From: user at monster.com.
In spam.whitelist.rules I have
From: *@monster.com yes
so that any mail from there is allowed in. Wouldn't using To: basically
mean that any internal originating mail was allowed out?
Or am I just being dense?
> On 7 Jul 2005, at 22:30, Kevin Miller wrote:
>> A couple of spam messages are coming through because they're
>> whitelisted. Problem is, that they're not from where they purport to
>> be. This is a message that came through claiming to be from
>> monster.com (which is in the whitelist) although it's obvious that
>> it didn't come from there. Wouldn't it make more sense to whitelist
>> on the envelope To: instead? Or do
>> I just
>> have something set wrong somewhere?
>> Return-Path: <(tm)g>
>> Received: from monster.com
>> (dial81-135-244-94.in-addr.btopenworld.com [220.127.116.11]) by
>> mxl.ci.juneau.ak.us (8.13.3/8.13.3/SuSE Linux 0.7) with
>> SMTP id
>> for <joe_blow at ci.juneau.ak.us>; Thu, 7 Jul 2005 12:48:39 -0800
>> Date: Thu, 7 Jul 2005 12:48:24 -0800
>> Message-Id: <200507072048.j67KmOkW025458 at mxl.ci.juneau.ak.us>
>> From: Andrew Welch <arielreps at surimail.com>
>> To: Joe Blow <joe_blow at ci.juneau.ak.us>
>> Subject: Ariel reps wanted
>> X-Priority: 3
>> X-MSMail-Priority: Normal
>> Reply-To: Andrew Welch <arielreps at surimail.com>
>> mime-version: 1.0
>> content-type: multipart/mixed;
>> (The original recipient was changed to joe_blow - all else is a
>> straight cut and paste from Mailwatch)
Kevin Miller Registered Linux User No: 307357
CBJ MIS Dept. Network Systems Admin., Mail Admin.
155 South Seward Street ph: (907) 586-0242
Juneau, Alaska 99801 fax: (907 586-4500
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner