MailScanner MailWatch Multi-Domain SPAM issue

[Hugo van der Kooij]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

mmcintosh wrote:
> On Fri, 2008-12-12 at 07:35 +0100, Hugo van der Kooij wrote:
> mmcintosh wrote:
> 
>>>> I have an issue with people from the same domain xxx at example.com sending
>>>> to yyy at example.com sending mail to each other and the mail being listed
>>>> as spam. I am not sure at this point if this is a mailwatch or
>>>> mailscanner issue. How do I assure that this does not happen??? I have
>>>> not had this issue before with any other domain. This is a newly added
>>>> domain but nothing has changed I am on centos 5.2 mailscanner version
>>>> 4.71.10 MailWatch 1.04 
> Why bother scanning local traffic?
> 
>>>> Is it possible or advisable to whitelist domains within my list to be
>>>> auto white listed ??
> If you like spam. Then by all means. But I get plenty of spam send in
> that claims to be either from me or someone else in my domain.
> 
>>>> why from the same doamin would a piece of mail come up as spam (just
>>>> text mail no attachments) ??
> You are the person to answer that. You got the messages with headers.
> You got the logs.

> I am including one of the headers and as can be seen it comes up as not
> spam.

> I agree I do not want to be scanning local traffic. I also don't want
> spam or anything like it. I pulled out the book looked for ways to skip
> scanning outbound from local. 

> I am still at a loss as to what is causing this I have turned on the
> rule for spamassassin loging on rule hits. Any other ideas would be
> appreciated


> Mark McIntosh

> In my MailScanner/rules/spam.whitelist.rules

> From:	127.0.0.1	yes
> From:	xxx.xxx.xxx.xxx	yes (ip address of mail server)
> FromOrTo:	defualt	no

This line will not work. Try using "default" instead.

But are you actually calling on this rules file in the MailScanner
config itself? If you only changed this file then nothing will happen.

> I also changed Always Include SpamAssassin Report = yes to no


> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>     boundary="----=_NextPart_000_058A_01C956B8.50EFE500"
> X-Mailer: Microsoft Office Outlook 11
> Thread-Index: AclW4jdeL+xf8wkPQ2KxGuEEua7A4w==
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
> X-Snakehill-MailScanner-Information: Please contact the ISP for more
> information
> X-Snakehill-MailScanner-ID: A833C14C001.B5DC0
> X-Snakehill-MailScanner: Found to be clean
> X-Snakehill-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
>     score=0.001, required 5, autolearn=not spam, BAYES_50 0.00,
>     HTML_MESSAGE 0.00, SPF_PASS -0.00)
> X-Snakehill-MailScanner-From: xxx at example.com
> X-Snakehill-MailScanner-Watermark: 1229090604.01629 at G833yJfZg
> +9N0EPryIIXqg
> X-Spam-Status: No

Well this clearly is not listed as spam by MailScanner. If it is listed
as spam im MailWatch you need to address the issue on the MailWatch
mailinglist but I suggest you include relevant details like version
info, config details, log sample, .....

Hugo.

- --
hvdkooij at vanderkooij.org               http://hugo.vanderkooij.org/
PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

	A: Yes.
	>Q: Are you sure?
	>>A: Because it reverses the logical flow of conversation.
	>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.

Nid wyf yn y swyddfa ar hyn o bryd. Anfonwch unrhyw waith i'w gyfieithu.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFJQ3K3BvzDRVjxmYERAkntAJ0dx/9MxtTwPYmYXQFVsM3PGC7u3ACeJTvH
6yD3v5KRZMu3nfUWiOPOBuw=
=CyUa
-----END PGP SIGNATURE-----