Fedora 12 MailScanner 4.77.10 Postfix 2.6.2 Whitelist issues

[Glenn Steen]

On 16 February 2011 16:42, Adam Laye <postal.janitor at gmail.com> wrote:
> Fedora 12
> MailScanner 4.77.10
> SpamAssassin 3.2.5
> Postfix 2.6.2
>
> Resumes at example.com
> contactus at example.com
>
> These two addresses were removed from my spam.whitelist.conf weeks ago. I
> have restarted MailScanner rebooted the machine, disabled auto-whitelist in
> both SpamAssassin and the MailScanner.conf  and yet Email to these addresses
> still show up.  I have greped the entire MailScanner directory to verify
> there were no rouge instances of these names and yet I still get the
> following when Email arrives to these addresses.
>
> X-mail03bigcenter-MailScanner-SpamCheck: not spam (whitelisted),
>  SpamAssassin (not cached, score=31.453, required 3.5,
>  autolearn=disabled, FILL_THIS_FORM 0.00,
>
> I am at a loss... any idea's would be appreciated.
>
>
> [root at mail]# egrep -r -i '(resume|contactus)' /etc/MailScanner/
> /etc/MailScanner/MailScanner.conf.rpmnew:# If the value contains
> 'foobar.customi[zs]e' then the value is presumed to
> /etc/MailScanner/phishing.bad.sites.conf.old:www.howtowriteresume.info
> /etc/MailScanner/phishing.bad.sites.conf:www.howtowriteresume.info
> /etc/MailScanner/phishing.bad.sites.conf.rpmnew:25resumes.com
>
Perhaps you whitelist the sending servers IP? Or you might have some
easily spoofed envelope sender addresses/domains, that isn't mentioned
in the actual email headers (very common)?

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se