Whitelist Issue

[Scott Silva]

on 9-22-2009 10:06 AM Phil Udel spake the following:
>  -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Scott Silva
> Sent: Tuesday, September 22, 2009 12:26 PM
> To: mailscanner at lists.mailscanner.info
> Subject: Re: Whitelist Issue
> 
> on 9-22-2009 6:15 AM Phil Udel spake the following:
>> Hi. I am running Sendmail with MailScanner 4.65.3. I use the 
>> spam.whitelist.rules table to store my entries.
>> Every once and awhile I will get a Mail that has a high SA score and 
>> should be blocked but it is white listed instead.
>> There are no entries for the IP or the domain in the table that would 
>> allow this email to be whitelisted but it gets white listed anyway.
>> Any ideas Why? 
>>
>>  
>> Show a complete set of log entries for one of these and we will try to
> explain it.
> 
> Here is the Maillog
> Sep 21 10:06:35 mail MailScanner[30006]: Message n8LE6QRn025223 from
> 200.159.85.
> 82 (soliditytj4 at researchtalk.com) to salemcorp.com is not spam
> (whitelisted), Sp
> amAssassin (not cached, score=34.648, required 2, autolearn=spam, BAYES_99
> 3.50,
>  FH_HELO_EQ_D_D_D_D 0.00, HELO_DYNAMIC_IPADDR2 4.39, HTML_MESSAGE 0.50,
> RAZOR2_C
> F_RANGE_51_100 0.50, RAZOR2_CF_RANGE_E4_51_100 1.50, RAZOR2_CHECK 0.50,
> RCVD_IN_
> BL_SPAMCOP_NET 5.00, RCVD_IN_SORBS_WEB 2.00, RCVD_IN_XBL 3.03, RDNS_DYNAMIC
> 2.00
> , TVD_RCVD_IP 1.93, URIBL_BLACK 5.00, URIBL_JP_SURBL 1.50, URIBL_PH_SURBL
> 1.79, 
> URIBL_WS_SURBL 1.50)
> Sep 21 10:06:35 mail MailScanner[30006]: Virus and Content Scanning:
> Starting
> Sep 21 10:07:23 mail sendmail[25485]: n8LE6QRn025223:
> to=XXXXXXXXXX at Salemcorp.com,
>  delay=00:00:55, xdelay=00:00:01, mailer=local, pri=122627, dsn=2.0.0,
> stat=Sent
> Sep 21 10:07:23 mail sendmail[25485]: n8LE6QRn025223:
> to=XXXXXXX at att.blackberr
> y.net, delay=00:00:55, xdelay=00:00:00, mailer=esmtp, pri=122627,
> relay=mx04.bis
> .na.blackberry.com. [216.9.248.35], dsn=2.0.0, stat=Sent (ok:  Message
> 118378703
>  accepted)
> 
> Neather the IP 200.159.85.82 or Domain name researchtalk.com are in the
> whitelist table.
> 
> 
> 
Do you have the spamassassin auto whitelist on?


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 259 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090922/126dc08b/signature.bin