Whitelisting problems

[Scott Silva]

on 1/4/2013 6:49 AM Gary Faith spake the following:
> I am attempting to whitelist e-mail from blackberry servers but not having any
> success.  Since I read that MailScanner bases the whtelist on the envelope,
> here is the envelope (I changed the e-mail address):
> 
> EHLO smtp02.bis6.us.blackberry.com
> MAIL FROM:<SRS0=+AiNi2=K5=mydomain.net=user at srs.bis6.us.blackberry.com
> <mailto:SRS0=+AiNi2=K5=mydomain.net=user at srs.bis6.us.blackberry.com>> SIZE=876
> RCPT TO:user at mydomain.net <mailto:TO:user at mydomain.net>( mailto:user at mydomain.net)
> Return-Path: <g>
> Received: from smtp07.bis6.us.blackberry.com (smtp07.bis6.us.blackberry.com
> [74.82.85.7])
>      by mscan.asdmonline.net (8.13.6/8.13.6/SuSE Linux 0.8) with ESMTP id
> r04EPuc6025687
> 
> I have tried whitelisting via Mailwatch:
> 
> @srs.bis6.us.blackberry.com     default
> *@*.*.us.blackberry.com <mailto:*@*.*.us.blackberry.com>           default
> 74.82.85.                                 default
> 
> with no success.  I even tried to whitelist in the MailScanner rule file
> (spam.whitelist.rules):
> 
> mscan:/etc/MailScanner/rules # cat spam.whitelist.rules
> # If you are basing a blacklist on this then you can refer to
> # a null (empty) sender address with "/^$/" as the address to match.
> #
> # This is where you can build a Spam WhiteList
> # Addresses matching in here, with the value
> # "yes" will never be marked as spam.
> #From:          152.78.         yes
> #From:          130.246.        yes
> #From:          host:soton.ac.uk yes # Note this is slower than using the IP
> From:           74.82.85.       yes
> FromOrTo:       default         no
> 
> and the message keep getting scanned and blocked:
> 
> 
> Score 	Matching Rule 	Description
> -0.50 	BAYES_00 	Bayesian spam probability is 0 to 1%
> 2.00 	DCC_CHECK 	Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
> 2.00 	DIGEST_MULTIPLE 	Message hits more than one network digest check
> 2.50 	PYZOR_CHECK 	Listed in Pyzor (http://pyzor.sf.net/)
> 1.53 	RATWARE_EFROM 	Bulk email fingerprint (envfrom) found
> -0.00 	SPF_PASS 	SPF: sender matches SPF record
> 
>  
>  
> I am running MailScanner version 4.83.4 on SLES 10 64-bit.  I don't know where
> to go from here.
>  
> Gary
> 
> 
You can try something like this in spam.assassin.prefs.com;

header    FROM_BLACKBERRY	From =~ /\@blackberry\./
describe  FROM_BLACKBERRY	email From blackberry user
score	  FROM_BLACKBERRY	-20


adjust the score accordingly. You might have to play with the regex a little
til it works for you.