Whitelist issue

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Vivek Mittal wrote:
> Sorry, if some people receive this twice.  I sent this yesterday and
> have not seen it show up in the list yet.
>
> ------------Previous message-----------------
>
> Hi,
>
> We have been using MailScanner for about 6 months now and it is
> working really well.  We have seen that 70% of our incoming mail is
> spam and of that, 80% is classed as High Spam, so it is helping us
> filtering a large part of our mail.
>
> In the last six months, we have noticed that even the mail classed as
> Low Spam is 99.99% spam.  The 0.01% that is not spam is due to
> documents scanned and emailed from our printer.  We have tried to
> whitelist the address, but it does not work.  I hope someone can help
> in determining the cause.
>
> My spam.whitelist.rules file contains the following entries
>
> From:           *@*.abc.com     yes
> From:           *@*.xyz.com.au   yes
>
> where xyz.com.au is our firm.  Now, emails from abc.com are
> whitelisted, but emails from our printer (printer at xyz.com.au) are not.
> Below is a sample header as stored in the Mailscanner archives (with
> some stuff modified)
You need to whitelist *@xyz.com.au and not *@*.xyz.com.au as that won't 
match your printer's email address.
>
> V8
> T1170549349
> K0
> N0
> P170442
> Fbs
> $_mx05.syd.isp.net.au [210.41.30.235]
> $rESMTP
> $smx05.syd.isp.net.au
> ${daemon_flags}
> ${if_addr}10.1.10.10
> S<>
> rRFC822; vivek at xyz.com.au
> RPFD:<vivek at xyz.com.au>
> H?P?Return-Path: <~Ag>
> H??Received: from mx05.syd.isp.net.au (mx05.syd.isp.net.au 
> [210.41.30.235])
>        by ap.xyz.com.au (8.13.4/8.13.4) with ESMTP id l140Znb5009886
>        for <vivek at xyz.com.au>; Sun, 4 Feb 2007 11:35:49 +1100
> H?D?Date: Sun, 4 Feb 2007 11:35:49 +1100
> H??Received: from 114.090.dsl.mel.isp.net.au ([211.26.244.114])
>  by mx05.syd.isp.net.au with SMTP; 04 Feb 2007 11:34:12 +1100
> H??X-IronPort-AV: i="4.13,277,1167570000";
>   d="pdf'?scan'208"; a="29083045:sNHT433197450"
> H??From: "XYZ PTY LTD" <printer at xyz.com.au>
> H??To: <vivek at xyz.com.au>
> H??Subject: 2feb
> H??Message-ID: <24331418>
> H??MIME-Version: 1.0
> H??Content-Type: multipart/mixed;
>        boundary="__59453boundry__"
>
> When looking at the source of the delivered message, you can see
>
> X_XYZ_MAILSCANNER_INFORMATION='Please contact the ISP for more
> information',X_XYZ_MAILSCANNER='Found to be
> clean',X_XYZ_MAILSCANNER_SPAMCHECK='spam, SpamAssassin (not
> cached,\tscore=7.37, required 6, AWL -0.09, HELO_DYNAMIC_HCC
> 3.28,\tINVALID_MSGID 1.71, MSGID_SHORT 2.46),
> X_XYZ_MAILSCANNER_SPAMSCORE='7',X_XYZ_MAILSCANNER_FROM='',X_SPAM_STATUS='Yes' 
>
>
> When comparing the header with email froms abc.com, they just say
> X_XYZ_MAILSCANNER_SPAMCHECK='not spam (whitelisted),\tSpamAssassin
> (not cached, score=-2.454, required 6,\tautolearn=not spam,
> ADVANCE_FEE_1 0.00, ALL_TRUSTED -1.44, AWL -1.15,\tHTML_MESSAGE 0.00,
> MPART_ALT_DIFF 0.14)
>
> So there must either be something wrong with my whitelists file or
> something that is completely non-obvious to me.
>
> I searched for others with similar problems and the only one that I
> found was to change
> From:           *@xyz.com.au   yes
>
> to
>
> From:           *@*.xyz.com.au   yes
>
> but that has not worked either.
>
> I hope someone can help.
>
> Regards,
> Vivek

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014)
Charset: ISO-8859-1

wj8DBQFGjLttEfZZRxQVtlQRAqntAJ9Tu4EUfamTLv+R5g6d8vszU74HhwCgxmC0
dn0MmHAKypMHILHsQxklPos=
=S1OE
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk