Whitelist issue

[Vivek Mittal]

Sorry, if some people receive this twice.  I sent this yesterday and
have not seen it show up in the list yet.

------------Previous message-----------------

Hi,

We have been using MailScanner for about 6 months now and it is
working really well.  We have seen that 70% of our incoming mail is
spam and of that, 80% is classed as High Spam, so it is helping us
filtering a large part of our mail.

In the last six months, we have noticed that even the mail classed as
Low Spam is 99.99% spam.  The 0.01% that is not spam is due to
documents scanned and emailed from our printer.  We have tried to
whitelist the address, but it does not work.  I hope someone can help
in determining the cause.

My spam.whitelist.rules file contains the following entries

From:           *@*.abc.com     yes
From:           *@*.xyz.com.au   yes

where xyz.com.au is our firm.  Now, emails from abc.com are
whitelisted, but emails from our printer (printer at xyz.com.au) are not.
 Below is a sample header as stored in the Mailscanner archives (with
some stuff modified)

V8
T1170549349
K0
N0
P170442
Fbs
$_mx05.syd.isp.net.au [210.41.30.235]
$rESMTP
$smx05.syd.isp.net.au
${daemon_flags}
${if_addr}10.1.10.10
S<>
rRFC822; vivek at xyz.com.au
RPFD:<vivek at xyz.com.au>
H?P?Return-Path: <~Ag>
H??Received: from mx05.syd.isp.net.au (mx05.syd.isp.net.au [210.41.30.235])
        by ap.xyz.com.au (8.13.4/8.13.4) with ESMTP id l140Znb5009886
        for <vivek at xyz.com.au>; Sun, 4 Feb 2007 11:35:49 +1100
H?D?Date: Sun, 4 Feb 2007 11:35:49 +1100
H??Received: from 114.090.dsl.mel.isp.net.au ([211.26.244.114])
  by mx05.syd.isp.net.au with SMTP; 04 Feb 2007 11:34:12 +1100
H??X-IronPort-AV: i="4.13,277,1167570000";
   d="pdf'?scan'208"; a="29083045:sNHT433197450"
H??From: "XYZ PTY LTD" <printer at xyz.com.au>
H??To: <vivek at xyz.com.au>
H??Subject: 2feb
H??Message-ID: <24331418>
H??MIME-Version: 1.0
H??Content-Type: multipart/mixed;
        boundary="__59453boundry__"

When looking at the source of the delivered message, you can see

X_XYZ_MAILSCANNER_INFORMATION='Please contact the ISP for more
information',X_XYZ_MAILSCANNER='Found to be
clean',X_XYZ_MAILSCANNER_SPAMCHECK='spam, SpamAssassin (not
cached,\tscore=7.37, required 6, AWL -0.09, HELO_DYNAMIC_HCC
3.28,\tINVALID_MSGID 1.71, MSGID_SHORT 2.46),
X_XYZ_MAILSCANNER_SPAMSCORE='7',X_XYZ_MAILSCANNER_FROM='',X_SPAM_STATUS='Yes'

When comparing the header with email froms abc.com, they just say
X_XYZ_MAILSCANNER_SPAMCHECK='not spam (whitelisted),\tSpamAssassin
(not cached, score=-2.454, required 6,\tautolearn=not spam,
ADVANCE_FEE_1 0.00, ALL_TRUSTED -1.44, AWL -1.15,\tHTML_MESSAGE 0.00,
MPART_ALT_DIFF 0.14)

So there must either be something wrong with my whitelists file or
something that is completely non-obvious to me.

I searched for others with similar problems and the only one that I
found was to change
From:           *@xyz.com.au   yes

to

From:           *@*.xyz.com.au   yes

but that has not worked either.

I hope someone can help.

Regards,
Vivek