White lists. {Scanned}

Richard Mealing richard at fastnet.co.uk
Fri May 7 09:25:10 IST 2010


Hi Scott,

-----Original Message-----
From: Scott Silva [mailto:ssilva at sgvwater.com] 
Sent: 06 May 2010 21:54
To: MailScanner discussion
Cc: Richard Mealing
Subject: Re: White lists. {Scanned}

on 5-6-2010 7:21 AM Richard Mealing spake the following:
> Hi Jules,
> 
> 
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
> Field
> Sent: 06 May 2010 14:26
> To: MailScanner discussion
> Subject: Re: White lists.
> 
> 
> 
> On 06/05/2010 14:09, Richard Mealing wrote:
>>
>> Hi everyone,
>>
>> I've had a couple of instances where a user has sent out a mail shot, 
>> but copied themselves in and received their email back, but as spam.
>>
>> The problem is, this particular domain is not being scanned for spam, 
>> nor has the domain got a white list (we use white lists per domain in 
>> a flat file).
>>
>> I see in the logs, something like this -
>>
>> o45ID9D6093076 from 212.**.191.99 (info at thedomain.com 
>> <mailto:info at thedomain.com>) ignored whitelist, had 138 recipients
> (>20)
>>
>> May 5 19:14:45 mailfilter9 MailScanner[47546]: Message o45ID9D6093076 
>> from 212.**.191.99 (info at thedomain.com <mailto:info at thedomain.com>) to
> 
>> ..... Then all the recipients.
>>
>> It does not say anything about the email being caught as spam, nor 
>> does it say it delivered it as an attachment, I guess because they 
>> have nothing set in my forwarding rules and the domain is not in the 
>> scanning rules.
>>
>> I can tell them to send out through a non mailscanner relay server, 
>> also I have only seen this twice in the last few months. Maybe because
> 
>> it's only been reported to me twice.
>>
>> I just wondered has anyone seen anything like this before, or would 
>> you know why the sender would get their email back with the spam tag? 
>> As far as I can see the emails they sent out are fine.
>>
> Have you seen this in MailScanner.conf:
> 
> # Spammers have learnt that they can get their message through by
> sending
> # a message with lots of recipients, one of which chooses to whitelist
> # everything coming to them, including the spammer.
> # So if a message arrives with more than this number of recipients,
> ignore
> # the "Is Definitely Not Spam" whitelist.
> Ignore Spam Whitelist If Recipients Exceed = 20
> 
> ?
> 
>> I'm running FreeBSD 7.2 (all upgraded), I'm using the latest 
>> Mailscanner Beta 4.80.4. Latest Clamd and SpamAssassin.
>>
>> Many thanks
>>
>> Rich
>>
> 
> Jules
> 
> 
> ......
> 
> I did read that, but should they be getting a spam tagged email if they
> are not being scanned in the first place?
> 
> I also have this set in MailScanner.conf - 
> 
> # Do you want to check messages to see if they are spam?
> # Note: If you switch this off then *no* spam checks will be done at
> all.
> #       This includes both MailScanner's own checks and SpamAssassin.
> #       If you want to just disable the "Spam List" feature then set
> #       "Spam List =" (i.e. an empty list) in the setting below.
> # This can also be the filename of a ruleset.
> Spam Checks = %rules-dir%/spam.scanning.rules
> 
> In this file I have - To:     default         no
> 
> 
> Then I have a list of domains that I want to scan, but the domain below
> is not in this file, so should not be scanned at all.
> 
> 
Are any of the ppl in the list in domains that are scanned?

...

Maybe, I guess that would do it, there are 138 domains though so it might take me a while to get back to you..! 


-- 
 
This message has been scanned for viruses and
dangerous content by the San Gabriel Valley Water Co.
MailScanner, and is believed to be clean.





More information about the MailScanner mailing list