One user whitelisted, everyone gets the spam...

[DAve]

mailscanner at herald.co.uk wrote:
> Hi folks,
> 
> MailScanner 4.60.8 using ClamAV...
> 
> For various long and dull reasons, we have a single user whose mail is 
> not filtered by MailScanner; this is done by a "deliver" rule in a 
> ruleset attached to Spam Actions.
> 
> Annoyingly (to the other users...) this is causing spam to leak through 
> to them, if mail's sent to a bunch of people including this user (where 
> a "bunch" is fewer than 20, that being what "Ignore Spam Whitelist If 
> Recipients Exceed" is currently set to). The worst example I've seen so 
> far is a spam scoring 165 getting through... our usual "delete" 
> threshold is 12.
> 
> I thought about reducing the "Ignore Spam Whitelist" setting, but we do 
> legitimately get emails in addressed to more users than these spams have 
> been (12 - 15 users; the spams have been addressed to around 8 or so)
> 
> Is there a relatively straightforward way of stopping this user's 
> settings from affecting anyone else? (Politics sadly dictates that 
> insisting on filtering his mail in the same way as everyone else's is 
> not a viable way forward.) 

We were faced with exactly the same situation as you and solved the 
problem by splitting each multi-recipient message prior to the inqueue.
Check the wiki for instructions on how to do that.

for sendmail,
http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:sendmail:how_to:split_mails_per_recipient

for postfix
http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:postfix:how_to:split_mails_per_recipient

DAve


-- 
Three years now I've asked Google why they don't have a
logo change for Memorial Day. Why do they choose to do logos
for other non-international holidays, but nothing for
Veterans?

Maybe they forgot who made that choice possible.