Whitelisted when it shouldn't be

[Jeff Ellis]

Christian Rasmussen wrote:
> I'm running version 4.54.6/Sendmail on FC3 
>
> I'm seeing entries in my maillog showing whitelisted messages a couple
> of times a day from domains/IPs that I haven't whitelisted. Aside from
> the MailScanner/rules/spam.whitelist.rules (or any other file in that
> tree) is there anywhere else that MailScanner would get the idea that
> the message should be whitelisted? Everything else appears to be working
> just fine and the ones that are actually whitelisted do appear in the
> same manner.
>
> I can't find anyone else posting to the list with the same issue (no
> hits in the wiki either)
>
> Jun 19 05:59:36 mx1 sendmail[10599]: k5JCxNGc010599:
> from=<pqwpzr at schwarb.com>, size=2448, class=0, nrcpts=1,
> msgid=<qcjj2vq123cha30ny at schwarb.com>, proto=SM
> TP, daemon=MTA, relay=cei175.neoplus.adsl.tpnet.pl [83.30.184.175]
> Jun 19 05:59:36 mx1 sendmail[10599]: k5JCxNGc010599:
> to=<ensure at ONE_OF_MY_DOMAINS>, delay=00:00:04, mailer=relay, pri=32448,
> stat=queued
> Jun 19 05:59:38 mx1 MailScanner[6417]: New Batch: Found 2 messages
> waiting
> Jun 19 05:59:38 mx1 MailScanner[6417]: New Batch: Scanning 1 messages,
> 3003 bytes
> Jun 19 05:59:38 mx1 MailScanner[6417]: MCP Checks: Starting
> Jun 19 05:59:38 mx1 MailScanner[6417]: Spam Checks: Starting
> Jun 19 05:59:38 mx1 MailScanner[6417]: Expired 3 records from the
> SpamAssassin cache
> Jun 19 05:59:38 mx1 MailScanner[6417]: Message k5JCxNGc010599 from
> 83.30.184.175 (pqwpzr at schwarb.com) is whitelisted
>
> Any ideas/thoughts/pointers appreciated.
>
> Thanks,
>
> -Christian
>   
I chased down this issue earlier today on my server. Domains were
getting whitelisted from my "70_sare_whitelist_rcvd.cf" file. I had two
copies of the file -- one in
/etc/mail/spamassassin/70_sare_whitelist_rcvd.cf and one in
/etc/mail/spamassassin/RulesDuJour/70_sare_whitelist_rcvd.cf. Not sure
which it was hitting but renamed both files and those domains are no
longer whitelisted.

Jeff