whitelisting

[Julian Field]

Can someone else post some thoughts on this one please?
I'm having a Friday-afternoon-brain-mush moment.

On 8 Jul 2005, at 16:31, Kevin Miller wrote:

> Julian Field wrote:
>
>> In which case just change the From: to To: in the whitelist.
>>
>
> Huh?  How's that work?  The mail is addressed To:  
> user at ci.juneau.ak.us,
> pretending to be From: user at monster.com.
>
> In spam.whitelist.rules I have
>
>   From:  *@monster.com    yes
>
> so that any mail from there is allowed in.  Wouldn't using To:  
> basically
> mean that any internal originating mail was allowed out?
>
> Or am I just being dense?
>
>
>
>
>> On 7 Jul 2005, at 22:30, Kevin Miller wrote:
>>
>>
>>> A couple of spam messages are coming through because they're
>>> whitelisted. Problem is, that they're not from where they purport to
>>> be.  This is a message that came through claiming to be from
>>> monster.com (which is in the whitelist) although it's obvious that
>>> it didn't come from there. Wouldn't it make more sense to whitelist
>>> on the envelope To: instead?  Or do
>>> I just
>>> have something set wrong somewhere?
>>>
>>> Return-Path: <(tm)g>
>>> Received: from monster.com
>>>      (dial81-135-244-94.in-addr.btopenworld.com [81.135.244.94]) by
>>> mxl.ci.juneau.ak.us (8.13.3/8.13.3/SuSE Linux 0.7) with
>>> SMTP id
>>> j67KmOkW025458
>>>      for <joe_blow at ci.juneau.ak.us>; Thu, 7 Jul 2005 12:48:39 -0800
>>> Date: Thu, 7 Jul 2005 12:48:24 -0800
>>> Message-Id: <200507072048.j67KmOkW025458 at mxl.ci.juneau.ak.us>
>>> From: Andrew Welch <arielreps at surimail.com>
>>> To: Joe Blow <joe_blow at ci.juneau.ak.us>
>>> Subject: Ariel reps wanted
>>> X-Priority: 3
>>> X-MSMail-Priority: Normal
>>> Reply-To: Andrew Welch <arielreps at surimail.com>
>>> mime-version: 1.0
>>> content-type: multipart/mixed;
>>>      boundary="qzsoft_directmail_seperator"
>>>
>>> (The original recipient was changed to joe_blow - all else is a
>>> straight cut and paste from Mailwatch)

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!