"Is Definitely Spam" rule not working ?

[Pascal Maes]

Le 05-févr.-08 à 09:45, Glenn Steen a écrit :

> On 05/02/2008, Glenn Steen <glenn.steen at gmail.com> wrote:
>> On 05/02/2008, Pascal Maes <pascal.maes at elec.ucl.ac.be> wrote:
> (snip)
>>> Then Postfix puts the message in the HOLD queue where MailScanner
>>> takes it and puts it back into the Postfix queue.
>>>
>>> I'm pretty sure that MailScanner should see the 66.63.168.38 IP
>>> address otherwise why is the "Is Definitely Not Spam" rule working :
>>>
>>> Feb  5 09:21:07 smtp-1 MailScanner[14880]: Message E8686E9102.A7655
>>> from 127.0.0.1 (users-return-66855-pascal.maes=elec.ucl.ac.be at spamassassin.apache.org
>>> ) is whitelisted
>>>
>>>
>>> Regards
>> Anything happening to the message _after_ MailScaner doesn't hjave  
>> any
>> impact on your problem... What happens before though... You have to
>> make sure that your SA trust_path is OK, and all should be well. Why
>> do you use the ClamSMTP thing at all?
>>
>> Cheers
> Oh, sorry, not an sa issue... Still, yhe last client to handle this is
> the clamsmtp thing, which might just be the problem.
> Again, why do you use that? Theoretically MailScanner (through the
> batching, and using either clamavmodule or clamd) should be more
> efficient and less likely to be able to be DoS'd... That
> "not-really-part-of-SMTP-flow insulation" is ... golden.
>
> Cheers
> -- 
> -- Glenn
> email: glenn < dot > steen < at > gmail < dot > com
> work: glenn < dot > steen < at > ap1 < dot > se

One advantage of using ClamSMTP is the reject of the worm at the  
connection time.
As we receive a lot of mail per day, it's not negligible.

As MailScanner is using McAffe, we have two different AV to check the  
messages.

--
Pascal