Whitelist Issue

[Phil Udel]

Phil Udel wrote:
> Well... That's my point. It should have been handled by the 
> "High-Scoring Spam Actions" but is was not, it was whitelisted instead.

>My bet would be you have put something like this in the whitelist:

>FromOrTo:  att.blackberry.net    OK

>or

>FromOrTo:  xxxx at salemcorp.net  OK

>Remember - if you have multiple recipients in a message and one of them
whitelists; then MailScanner will whitelist >for all.  That, and you need to
be very specific with white/black entries - FromOrTo: for a recipient
address or >>>domain should be considered dangerous....

Ya. I thought the same thing. I have no FromOrTo Only From's.  I checked
again today and found another.
BTW I XXX out the Names

Return-Path: < g>
Received: from 200-49-7-146.static.impsat.net.ar
(200-49-7-146.static.impsat.net.ar [200.49.7.146] (may be forged))
     by mail.salemcorp.com (8.13.8/8.13.8) with ESMTP id n8MKV2Ci006602
     for <XXX.XXX at salemcorp.com>; Tue, 22 Sep 2009 16:31:03 -0400
Received: from 200.49.7.146 by ASPMX.L.GOOGLE.com; Tue, 22 Sep 2009 17:29:09
-0300
Message-ID: <000d01ca3bc3$56fa0d90$6400a8c0 at caviledb>
From: "Roxie Yang" <caviledb at researchtalk.com>
To: <XXX.XXX at salemcorp.com>
Subject: Cheap designer watches have appeared on the market.
Date: Tue, 22 Sep 2009 17:29:09 -0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
     boundary="----=_NextPart_000_0007_01CA3BC3.56FA0D90"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

Spam:  N   Action(s): deliver, header, "X-SalemCorp-Spam-Status:, No" 
High Scoring Spam:  N  
SpamAssassin Spam:  N  
Listed in RBL:  N  
Spam Whitelisted:  Y  
Spam Blacklisted:  N  
SpamAssassin Autolearn:  Y  (spam) 
SpamAssassin Score: 22.86 

Neither the Domain or the  IP are in the Whitelist.  I should say that this
happens maybe once out of every 500 correct whitelisting's and it seems to
be the same Domains but different IP's.  I can make my WL Available but not
on a Open List.  And it