MailScanner at ecs.soton.ac.uk
Fri Jul 8 16:36:04 IST 2005
Can someone else post some thoughts on this one please?
I'm having a Friday-afternoon-brain-mush moment.
On 8 Jul 2005, at 16:31, Kevin Miller wrote:
> Julian Field wrote:
>> In which case just change the From: to To: in the whitelist.
> Huh? How's that work? The mail is addressed To:
> user at ci.juneau.ak.us,
> pretending to be From: user at monster.com.
> In spam.whitelist.rules I have
> From: *@monster.com yes
> so that any mail from there is allowed in. Wouldn't using To:
> mean that any internal originating mail was allowed out?
> Or am I just being dense?
>> On 7 Jul 2005, at 22:30, Kevin Miller wrote:
>>> A couple of spam messages are coming through because they're
>>> whitelisted. Problem is, that they're not from where they purport to
>>> be. This is a message that came through claiming to be from
>>> monster.com (which is in the whitelist) although it's obvious that
>>> it didn't come from there. Wouldn't it make more sense to whitelist
>>> on the envelope To: instead? Or do
>>> I just
>>> have something set wrong somewhere?
>>> Return-Path: <(tm)g>
>>> Received: from monster.com
>>> (dial81-135-244-94.in-addr.btopenworld.com [126.96.36.199]) by
>>> mxl.ci.juneau.ak.us (8.13.3/8.13.3/SuSE Linux 0.7) with
>>> SMTP id
>>> for <joe_blow at ci.juneau.ak.us>; Thu, 7 Jul 2005 12:48:39 -0800
>>> Date: Thu, 7 Jul 2005 12:48:24 -0800
>>> Message-Id: <200507072048.j67KmOkW025458 at mxl.ci.juneau.ak.us>
>>> From: Andrew Welch <arielreps at surimail.com>
>>> To: Joe Blow <joe_blow at ci.juneau.ak.us>
>>> Subject: Ariel reps wanted
>>> X-Priority: 3
>>> X-MSMail-Priority: Normal
>>> Reply-To: Andrew Welch <arielreps at surimail.com>
>>> mime-version: 1.0
>>> content-type: multipart/mixed;
>>> (The original recipient was changed to joe_blow - all else is a
>>> straight cut and paste from Mailwatch)
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner