Phil.Udel at SalemCorp.com
Tue Sep 22 20:20:42 IST 2009
Well... That's my point. It should have been handled by the "High-Scoring
Spam Actions" but is was not, it was whitelisted instead.
If I can get the downtime ,I think I will get current this weekend, and see
if that fixs the problem.
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jules Field
Sent: Tuesday, September 22, 2009 3:03 PM
To: MailScanner discussion
Subject: Re: Whitelist Issue
Looks like it is exceeding the "High SpamAssassin Score" and therefore
getting handled by the "High-Scoring Spam Actions" instead of the "Spam
Actions". There are by default 3 states a message can get into: normal, spam
and "high-spam". Check the path through your config actions for high-scoring
On 22/09/2009 18:06, Phil Udel wrote:
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Scott
> Sent: Tuesday, September 22, 2009 12:26 PM
> To: mailscanner at lists.mailscanner.info
> Subject: Re: Whitelist Issue
> on 9-22-2009 6:15 AM Phil Udel spake the following:
>> Hi. I am running Sendmail with MailScanner 4.65.3. I use the
>> spam.whitelist.rules table to store my entries.
>> Every once and awhile I will get a Mail that has a high SA score and
>> should be blocked but it is white listed instead.
>> There are no entries for the IP or the domain in the table that would
>> allow this email to be whitelisted but it gets white listed anyway.
>> Any ideas Why?
>> Show a complete set of log entries for one of these and we will try
> explain it.
> Here is the Maillog
> Sep 21 10:06:35 mail MailScanner: Message n8LE6QRn025223 from
> 82 (soliditytj4 at researchtalk.com) to salemcorp.com is not spam
> (whitelisted), Sp amAssassin (not cached, score=34.648, required 2,
> autolearn=spam, BAYES_99 3.50,
> FH_HELO_EQ_D_D_D_D 0.00, HELO_DYNAMIC_IPADDR2 4.39, HTML_MESSAGE
> 0.50, RAZOR2_C F_RANGE_51_100 0.50, RAZOR2_CF_RANGE_E4_51_100 1.50,
> RAZOR2_CHECK 0.50, RCVD_IN_ BL_SPAMCOP_NET 5.00, RCVD_IN_SORBS_WEB
> 2.00, RCVD_IN_XBL 3.03, RDNS_DYNAMIC 2.00 , TVD_RCVD_IP 1.93,
> URIBL_BLACK 5.00, URIBL_JP_SURBL 1.50, URIBL_PH_SURBL 1.79,
> URIBL_WS_SURBL 1.50) Sep 21 10:06:35 mail MailScanner: Virus
> and Content Scanning:
> Sep 21 10:07:23 mail sendmail: n8LE6QRn025223:
> to=XXXXXXXXXX at Salemcorp.com,
> delay=00:00:55, xdelay=00:00:01, mailer=local, pri=122627,
> dsn=2.0.0, stat=Sent Sep 21 10:07:23 mail sendmail:
> to=XXXXXXX at att.blackberr
> y.net, delay=00:00:55, xdelay=00:00:00, mailer=esmtp, pri=122627,
> relay=mx04.bis .na.blackberry.com. [126.96.36.199], dsn=2.0.0,
> stat=Sent (ok: Message
> Neather the IP 188.8.131.52 or Domain name researchtalk.com are in
> the whitelist table.
Julian Field MEng CITP CEng
Buy the MailScanner book at www.MailScanner.info/store
Need help customising MailScanner?
Need help fixing or optimising your systems?
Need help getting you started solving new requirements from your boss?
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me
at twitter.com/JulesFM and twitter.com/MailScanner
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.
MailScanner mailing list
mailscanner at lists.mailscanner.info
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
More information about the MailScanner