White lists.

Julian Field MailScanner at ecs.soton.ac.uk
Thu May 6 14:25:37 IST 2010



On 06/05/2010 14:09, Richard Mealing wrote:
>
> Hi everyone,
>
> I’ve had a couple of instances where a user has sent out a mail shot, 
> but copied themselves in and received their email back, but as spam.
>
> The problem is, this particular domain is not being scanned for spam, 
> nor has the domain got a white list (we use white lists per domain in 
> a flat file).
>
> I see in the logs, something like this –
>
> o45ID9D6093076 from 212.**.191.99 (info at thedomain.com 
> <mailto:info at thedomain.com>) ignored whitelist, had 138 recipients (>20)
>
> May 5 19:14:45 mailfilter9 MailScanner[47546]: Message o45ID9D6093076 
> from 212.**.191.99 (info at thedomain.com <mailto:info at thedomain.com>) to 
> ….. Then all the recipients.
>
> It does not say anything about the email being caught as spam, nor 
> does it say it delivered it as an attachment, I guess because they 
> have nothing set in my forwarding rules and the domain is not in the 
> scanning rules.
>
> I can tell them to send out through a non mailscanner relay server, 
> also I have only seen this twice in the last few months. Maybe because 
> it’s only been reported to me twice.
>
> I just wondered has anyone seen anything like this before, or would 
> you know why the sender would get their email back with the spam tag? 
> As far as I can see the emails they sent out are fine.
>
Have you seen this in MailScanner.conf:

# Spammers have learnt that they can get their message through by sending
# a message with lots of recipients, one of which chooses to whitelist
# everything coming to them, including the spammer.
# So if a message arrives with more than this number of recipients, ignore
# the "Is Definitely Not Spam" whitelist.
Ignore Spam Whitelist If Recipients Exceed = 20

?

> I’m running FreeBSD 7.2 (all upgraded), I’m using the latest 
> Mailscanner Beta 4.80.4. Latest Clamd and SpamAssassin.
>
> Many thanks
>
> Rich
>

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



More information about the MailScanner mailing list