WhiteList Error

[Phillip Udel]

These are all my entries for the whitelist.  I do use Mailscanner SQL option
12.174.5.10 
12.42.160.10 
intouchmail.com 
kleinschmidt.com 
listserv.nai.com 
kdifacility.com 
170.2.52.140 
freightliner.com 
beartransolutions.com 
64.143.96.55 
peoplenetonline.com 
208.137.6.130 
63.247.194.242  
worknotice at nuvox.net   
bravocustoms.com   
postmaster at localhost  
hanson.biz 
ronhlder at aol.com

I started looking deeper and any mail that is in the white list shows up as
a matching rule "whitelisted" and no spam score.  Where as this mail had a
SA USER_IN_WHITELIST hit.  It is also interesting to note that I only have 3
USER_IN_WHITELIST hits in a week. I do not use the SA Whitelist (I don't
think) but my spam.assassin.prefs.conf does have use_auto_whitelist 0 set.  
It seems to me this was done by SA and not MS but don’t understand why.


-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
Field
Sent: Wednesday, July 26, 2006 1:28 PM
To: MailScanner discussion
Subject: Re: WhiteList Error

It has an empty sender address. Make sure you aren't inadvertently 
whitelisting blank sender addresses.

Phillip Udel wrote:
> Today I saw a strange error.   A mail was whitelisted even though it was
not
> in the white list.  I assume it is because of the 127.0.0.1 but that is
not
> in the white listed either. 
> 
> MS 4.54.6-1
> SA 3.1.3
> MailWatch 1.0.3
> Sendmail 8.12
> 
> Here is the header
> Return-Path: <g>
> Received: from cnnimail15.cnn.com (cnnimail15.cnn.com [64.236.25.105])
>      by cat.salemcarriers.com (8.12.8/8.12.8) with SMTP id k6QHTTJK025481
>      for <steve.ward at SALEMCARRIERS.COM>; Wed, 26 Jul 2006 13:29:29 -0400
> Received: from cnnimail12 (cnnimail12.turner.com) by cnnimail15.cnn.com
> (LSMTP for Windows NT v1.1b) with SMTP id
<13.00001B16 at cnnimail15.cnn.com>;
> Wed, 26 Jul 2006 13:08:13 -0400
> Received: from CNNIMAIL12.CNN.COM by CNNIMAIL12.CNN.COM (LISTSERV-TCP/IP
> release 1.8d) with spool id 6010446 for
> TEXTBREAKINGNEWS at CNNIMAIL12.CNN.COM; Wed, 26 Jul 2006 13:05:05 -0400
> Approved-By: listeditor at EMA8ADM1.TURNER.COM
> Received: from 10.165.130.62 by CNNIMAIL12.CNN.COM (SMTPL release 1.0d)
with
> TCP; Wed, 26 Jul 2006 13:04:58 -0400
> Received: from ema8adm1.turner.com (localhost [127.0.0.1]) by
> ema8adm1.turner.com (8.12.10/8.12.10) with ESMTP id k6QH64wx017955
> for <textbreakingnews at cnnimail12.cnn.com>; Wed, 26 Jul 2006 13:06:04
> -0400 (EDT)
> Received: (from listapprover at localhost) by ema8adm1.turner.com
> (8.12.10/8.12.11/Submit) id k6QH63Xh017944 for
> textbreakingnews at cnnimail12.cnn.com; Wed, 26 Jul 2006 13:06:03 -0400
> (EDT)
> Message-ID: <200607261706.k6QH63Xh017944 at ema8adm1.turner.com>
> Date: Wed, 26 Jul 2006 13:06:03 -0400
> Reply-To: newseditor at MAIL.CNN.COM
> Sender: BreakingNews at MAIL.CNN.COM
> From: CNN Breaking News <BreakingNews at MAIL.CNN.COM>
> Subject: CNN Breaking News
> To: TEXTBREAKINGNEWS at CNNIMAIL12.CNN.COM
> 
> Spam Assassin Info
> cached not   
>  score=-102.598   
> 6 required   
> spam autolearn=not   
> -2.60 	BAYES_00 Bayesian spam probability is 0 to 1% 
> 0.00 	UNPARSEABLE_RELAY Informational: message has unparseable relay lines
> 
> -100.00 USER_IN_WHITELIST From: address is in the user's white-list
> 
> 
> 
> 
> 
> 
> Phillip Udel
> Senior Systems Administrator
> Admin at SalemCorp.com
> (800) 877-2536 Ext 212
> Rules To Live By:
> 1) On the keyboard of life, always keep one finger on the escape key.
> 2) There are absolutely no absolutes.
> 3) Artificial Intelligence is no match for natural stupidity 
> 4) Information is not Knowledge, Knowledge is not Wisdom, and Wisdom is
not
> Truth
> 
> 
> 

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.