White lists.

[Richard Mealing]

Hi Jules,


-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
Field
Sent: 06 May 2010 14:26
To: MailScanner discussion
Subject: Re: White lists.



On 06/05/2010 14:09, Richard Mealing wrote:
>
> Hi everyone,
>
> I've had a couple of instances where a user has sent out a mail shot, 
> but copied themselves in and received their email back, but as spam.
>
> The problem is, this particular domain is not being scanned for spam, 
> nor has the domain got a white list (we use white lists per domain in 
> a flat file).
>
> I see in the logs, something like this -
>
> o45ID9D6093076 from 212.**.191.99 (info at thedomain.com 
> <mailto:info at thedomain.com>) ignored whitelist, had 138 recipients
(>20)
>
> May 5 19:14:45 mailfilter9 MailScanner[47546]: Message o45ID9D6093076 
> from 212.**.191.99 (info at thedomain.com <mailto:info at thedomain.com>) to

> ..... Then all the recipients.
>
> It does not say anything about the email being caught as spam, nor 
> does it say it delivered it as an attachment, I guess because they 
> have nothing set in my forwarding rules and the domain is not in the 
> scanning rules.
>
> I can tell them to send out through a non mailscanner relay server, 
> also I have only seen this twice in the last few months. Maybe because

> it's only been reported to me twice.
>
> I just wondered has anyone seen anything like this before, or would 
> you know why the sender would get their email back with the spam tag? 
> As far as I can see the emails they sent out are fine.
>
Have you seen this in MailScanner.conf:

# Spammers have learnt that they can get their message through by
sending
# a message with lots of recipients, one of which chooses to whitelist
# everything coming to them, including the spammer.
# So if a message arrives with more than this number of recipients,
ignore
# the "Is Definitely Not Spam" whitelist.
Ignore Spam Whitelist If Recipients Exceed = 20

?

> I'm running FreeBSD 7.2 (all upgraded), I'm using the latest 
> Mailscanner Beta 4.80.4. Latest Clamd and SpamAssassin.
>
> Many thanks
>
> Rich
>

Jules


......

I did read that, but should they be getting a spam tagged email if they
are not being scanned in the first place?

I also have this set in MailScanner.conf - 

# Do you want to check messages to see if they are spam?
# Note: If you switch this off then *no* spam checks will be done at
all.
#       This includes both MailScanner's own checks and SpamAssassin.
#       If you want to just disable the "Spam List" feature then set
#       "Spam List =" (i.e. an empty list) in the setting below.
# This can also be the filename of a ruleset.
Spam Checks = %rules-dir%/spam.scanning.rules

In this file I have - To:     default         no


Then I have a list of domains that I want to scan, but the domain below
is not in this file, so should not be scanned at all.


-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!