White lists. {Scanned}

[Richard Mealing]

Hi Scott,

-----Original Message-----
From: Scott Silva [mailto:ssilva at sgvwater.com] 
Sent: 06 May 2010 21:54
To: MailScanner discussion
Cc: Richard Mealing
Subject: Re: White lists. {Scanned}

on 5-6-2010 7:21 AM Richard Mealing spake the following:
> Hi Jules,
> 
> 
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
> Field
> Sent: 06 May 2010 14:26
> To: MailScanner discussion
> Subject: Re: White lists.
> 
> 
> 
> On 06/05/2010 14:09, Richard Mealing wrote:
>>
>> Hi everyone,
>>
>> I've had a couple of instances where a user has sent out a mail shot, 
>> but copied themselves in and received their email back, but as spam.
>>
>> The problem is, this particular domain is not being scanned for spam, 
>> nor has the domain got a white list (we use white lists per domain in 
>> a flat file).
>>
>> I see in the logs, something like this -
>>
>> o45ID9D6093076 from 212.**.191.99 (info at thedomain.com 
>> <mailto:info at thedomain.com>) ignored whitelist, had 138 recipients
> (>20)
>>
>> May 5 19:14:45 mailfilter9 MailScanner[47546]: Message o45ID9D6093076 
>> from 212.**.191.99 (info at thedomain.com <mailto:info at thedomain.com>) to
> 
>> ..... Then all the recipients.
>>
>> It does not say anything about the email being caught as spam, nor 
>> does it say it delivered it as an attachment, I guess because they 
>> have nothing set in my forwarding rules and the domain is not in the 
>> scanning rules.
>>
>> I can tell them to send out through a non mailscanner relay server, 
>> also I have only seen this twice in the last few months. Maybe because
> 
>> it's only been reported to me twice.
>>
>> I just wondered has anyone seen anything like this before, or would 
>> you know why the sender would get their email back with the spam tag? 
>> As far as I can see the emails they sent out are fine.
>>
> Have you seen this in MailScanner.conf:
> 
> # Spammers have learnt that they can get their message through by
> sending
> # a message with lots of recipients, one of which chooses to whitelist
> # everything coming to them, including the spammer.
> # So if a message arrives with more than this number of recipients,
> ignore
> # the "Is Definitely Not Spam" whitelist.
> Ignore Spam Whitelist If Recipients Exceed = 20
> 
> ?
> 
>> I'm running FreeBSD 7.2 (all upgraded), I'm using the latest 
>> Mailscanner Beta 4.80.4. Latest Clamd and SpamAssassin.
>>
>> Many thanks
>>
>> Rich
>>
> 
> Jules
> 
> 
> ......
> 
> I did read that, but should they be getting a spam tagged email if they
> are not being scanned in the first place?
> 
> I also have this set in MailScanner.conf - 
> 
> # Do you want to check messages to see if they are spam?
> # Note: If you switch this off then *no* spam checks will be done at
> all.
> #       This includes both MailScanner's own checks and SpamAssassin.
> #       If you want to just disable the "Spam List" feature then set
> #       "Spam List =" (i.e. an empty list) in the setting below.
> # This can also be the filename of a ruleset.
> Spam Checks = %rules-dir%/spam.scanning.rules
> 
> In this file I have - To:     default         no
> 
> 
> Then I have a list of domains that I want to scan, but the domain below
> is not in this file, so should not be scanned at all.
> 
> 
Are any of the ppl in the list in domains that are scanned?

...

Maybe, I guess that would do it, there are 138 domains though so it might take me a while to get back to you..! 


-- 
 
This message has been scanned for viruses and
dangerous content by the San Gabriel Valley Water Co.
MailScanner, and is believed to be clean.