Phil.Udel at SalemCorp.com
Wed Sep 23 14:14:18 IST 2009
Phil Udel wrote:
> Well... That's my point. It should have been handled by the
> "High-Scoring Spam Actions" but is was not, it was whitelisted instead.
>My bet would be you have put something like this in the whitelist:
>FromOrTo: att.blackberry.net OK
>FromOrTo: xxxx at salemcorp.net OK
>Remember - if you have multiple recipients in a message and one of them
whitelists; then MailScanner will whitelist >for all. That, and you need to
be very specific with white/black entries - FromOrTo: for a recipient
address or >>>domain should be considered dangerous....
Ya. I thought the same thing. I have no FromOrTo Only From's. I checked
again today and found another.
BTW I XXX out the Names
Return-Path: < g>
Received: from 200-49-7-146.static.impsat.net.ar
(200-49-7-146.static.impsat.net.ar [220.127.116.11] (may be forged))
by mail.salemcorp.com (8.13.8/8.13.8) with ESMTP id n8MKV2Ci006602
for <XXX.XXX at salemcorp.com>; Tue, 22 Sep 2009 16:31:03 -0400
Received: from 18.104.22.168 by ASPMX.L.GOOGLE.com; Tue, 22 Sep 2009 17:29:09
Message-ID: <000d01ca3bc3$56fa0d90$6400a8c0 at caviledb>
From: "Roxie Yang" <caviledb at researchtalk.com>
To: <XXX.XXX at salemcorp.com>
Subject: Cheap designer watches have appeared on the market.
Date: Tue, 22 Sep 2009 17:29:09 -0300
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Spam: N Action(s): deliver, header, "X-SalemCorp-Spam-Status:, No"
High Scoring Spam: N
SpamAssassin Spam: N
Listed in RBL: N
Spam Whitelisted: Y
Spam Blacklisted: N
SpamAssassin Autolearn: Y (spam)
SpamAssassin Score: 22.86
Neither the Domain or the IP are in the Whitelist. I should say that this
happens maybe once out of every 500 correct whitelisting's and it seems to
be the same Domains but different IP's. I can make my WL Available but not
on a Open List. And it
More information about the MailScanner