Is Definitely Not Spam and Ignore Spam Whitelist If Recipients Exceed Options oddity

[Rose, Bobby]

FYI I'm not sure but I think this is resolved since I haven't seen it happen again.  The only thing I did was change the spaces to tabs in the whitelist rules file for that rule which consisted of 2 FROM (one subnet and one domain).  I didn't think it mattered but it seemed to resolve this issue.

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Rose, Bobby
Sent: Sunday, August 02, 2009 11:35 AM
To: MailScanner discussion
Subject: RE: Is Definitely Not Spam and Ignore Spam Whitelist If Recipients Exceed Options oddity

I've been trying to duplicate this without success.  The issue is that there is this domain and network segment that is in my whitelist rules file.  If that domain send an email with more than 20 recipients, the whitelist is ignore which I know is the way it works and I'm fine with that.  But what is odd is that the email is just labeled as blacklisted, no SA checks or anything, just blacklisted.   But neither the domain or the IP nor the sender is any blacklist rules file nor in a per-user blacklist entry in the mailwatch blacklist table.

I don't have access to the remote mailsystem which is on our class-B network here at the university.  But the tests that I've done on my own have been to disable the whitelist rule and sent an email with a single recipient with a return address from that domain.  It's scanned and isn't blacklisted.  During this time of having them out of the whitelist, my domain has received a couple emails (single recipients) from their domain/senders and the same server and they aren't blacklisted either.

I also lowered the Ignore Spam Whitelist If Recipients Exceed option to 1 and tried sending to two addesses in my domain using a return address from that domain and that test email goes thru fine and also isn't blacklisted)

I'm not using any spam lists checks in MailScanner since that's either done by the MTA or SA.  But even if I was, I would have seen blacklisted for them while I had them unwhitelisted.





-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jules Field
Sent: Sunday, August 02, 2009 7:49 AM
To: MailScanner discussion
Subject: Re: Is Definitely Not Spam and Ignore Spam Whitelist If Recipients Exceed Options oddity



On 01/08/2009 03:42, Rose, Bobby wrote:
>
> I have a ruleset for Is Definitely Not Spam and everything works fine
> except if that that address sends a message with more recipients than
> what is set for Ignore Spam Whitelist If Recipients Exceed. In that
> case, the message seems to get blacklisted. If the entry is removed
> from the whitelist ruleset, then the issue doesn't occur (but I'll
> still see the log entry saying that ignored whitelist.
>
So you're saying that the "Is Definitely Not Spam" is ignored if the
message has more recipients than set in "Ignore Spam Whitelist If
Recipients Exceed"? In that case, that is exactly what it is meant to
do. "Is Definitely Not Spam" is the "Spam Whitelist" the other option is
talking about.

> Has anyone else noticed this or is it just me and I have to keep
> digging for the reason?
>
> Thanks
>
> -=Bobby
>
>
> ------------------------------------------------------------------------
> This document may include proprietary and confidential information of
> Wayne State University Physician Group and may only be read by those
> person(s) to whom it is addressed. If you have received this e-mail
> message in error, please notify us immediately. This document may not
> be reproduced, copied, distributed, published, modified or furnished
> to third parties, without prior written consent of Wayne State
> University Physician Group. Thank you.

Jules

--
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you.

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you.