MailScanner MailWatch Multi-Domain SPAM issue

mmcintosh mmcintosh at infowall.com
Fri Dec 12 18:29:26 GMT 2008


On Fri, 2008-12-12 at 07:35 +0100, Hugo van der Kooij wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> mmcintosh wrote:
> 
> > I have an issue with people from the same domain xxx at example.com sending
> > to yyy at example.com sending mail to each other and the mail being listed
> > as spam. I am not sure at this point if this is a mailwatch or
> > mailscanner issue. How do I assure that this does not happen??? I have
> > not had this issue before with any other domain. This is a newly added
> > domain but nothing has changed I am on centos 5.2 mailscanner version
> > 4.71.10 MailWatch 1.04 
> 
> Why bother scanning local traffic?
> 
> > Is it possible or advisable to whitelist domains within my list to be
> > auto white listed ??
> 
> If you like spam. Then by all means. But I get plenty of spam send in
> that claims to be either from me or someone else in my domain.
> 
> > why from the same doamin would a piece of mail come up as spam (just
> > text mail no attachments) ??
> 
> You are the person to answer that. You got the messages with headers.
> You got the logs.
> 
> Hugo.
> 
> - --
> hvdkooij at vanderkooij.org               http://hugo.vanderkooij.org/
> PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc
> 
> 	A: Yes.
> 	>Q: Are you sure?
> 	>>A: Because it reverses the logical flow of conversation.
> 	>>>Q: Why is top posting frowned upon?
> 
> Bored? Click on http://spamornot.org/ and rate those images.
> 
> Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> 
> iD8DBQFJQgYzBvzDRVjxmYERAtAHAJ9PYyNp4FdptAVxoDu5XXJPDU7QFQCgohVu
> S0poMQlcLckVsmWjFmokMoc=
> =IokE
> -----END PGP SIGNATURE-----
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
Thanks for the response. 


I am including one of the headers and as can be seen it comes up as not
spam.

I agree I do not want to be scanning local traffic. I also don't want
spam or anything like it. I pulled out the book looked for ways to skip
scanning outbound from local. 

I am still at a loss as to what is causing this I have turned on the
rule for spamassassin loging on rule hits. Any other ideas would be
appreciated


Mark McIntosh

In my MailScanner/rules/spam.whitelist.rules

From:	127.0.0.1	yes
From:	xxx.xxx.xxx.xxx	yes (ip address of mail server)
FromOrTo:	defualt	no

I also changed Always Include SpamAssassin Report = yes to no


MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_058A_01C956B8.50EFE500"
X-Mailer: Microsoft Office Outlook 11
Thread-Index: AclW4jdeL+xf8wkPQ2KxGuEEua7A4w==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-Snakehill-MailScanner-Information: Please contact the ISP for more
information
X-Snakehill-MailScanner-ID: A833C14C001.B5DC0
X-Snakehill-MailScanner: Found to be clean
X-Snakehill-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
    score=0.001, required 5, autolearn=not spam, BAYES_50 0.00,
    HTML_MESSAGE 0.00, SPF_PASS -0.00)
X-Snakehill-MailScanner-From: xxx at example.com
X-Snakehill-MailScanner-Watermark: 1229090604.01629 at G833yJfZg
+9N0EPryIIXqg
X-Spam-Status: No


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



More information about the MailScanner mailing list