Whitelisting problems

[Gary Faith]

I attempted this rule but while it passes the regex test, it doesn't
every show up on the spamassasin list as matching.
 
# Rule to find Whitelist Blackberry mail
header    FROM_BLACKBERRY       From =~ /\.*\.us\.blackberry\.com/
score     FROM_BLACKBERRY       -10
describe  FROM_BLACKBERRY       email From blackberry user
Gary

>>> Scott Silva <ssilva at sgvwater.com> 1/4/2013 11:10 AM >>>
on 1/4/2013 6:49 AM Gary Faith spake the following:
> I am attempting to whitelist e-mail from blackberry servers but not
having any
> success.  Since I read that MailScanner bases the whtelist on the
envelope,
> here is the envelope (I changed the e-mail address):
> 
> EHLO smtp02.bis6.us.blackberry.com
> MAIL
FROM:<SRS0=+AiNi2=K5=mydomain.net=user at srs.bis6.us.blackberry.com
> <mailto:SRS0=+AiNi2=K5=mydomain.net=user at srs.bis6.us.blackberry.com>>
SIZE=876
> RCPT TO:user at mydomain.net <mailto:TO:user at mydomain.net>(
mailto:user at mydomain.net)
> Return-Path: <Â g>
> Received: from smtp07.bis6.us.blackberry.com
(smtp07.bis6.us.blackberry.com
> [74.82.85.7])
>      by mscan.asdmonline.net (8.13.6/8.13.6/SuSE Linux 0.8) with
ESMTP id
> r04EPuc6025687
> 
> I have tried whitelisting via Mailwatch:
> 
> @srs.bis6.us.blackberry.com     default
> *@*.*.us.blackberry.com <mailto:*@*.*.us.blackberry.com>          
default
> 74.82.85.                                 default
> 
> with no success.  I even tried to whitelist in the MailScanner rule
file
> (spam.whitelist.rules):
> 
> mscan:/etc/MailScanner/rules # cat spam.whitelist.rules
> # If you are basing a blacklist on this then you can refer to
> # a null (empty) sender address with "/^$/" as the address to match.
> #
> # This is where you can build a Spam WhiteList
> # Addresses matching in here, with the value
> # "yes" will never be marked as spam.
> #From:          152.78.         yes
> #From:          130.246.        yes
> #From:          host:soton.ac.uk yes # Note this is slower than using
the IP
> From:           74.82.85.       yes
> FromOrTo:       default         no
> 
> and the message keep getting scanned and blocked:
> 
> 
> Score Matching Rule Description
> -0.50 BAYES_00 Bayesian spam probability is 0 to 1%
> 2.00 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
> 2.00 DIGEST_MULTIPLE Message hits more than one network digest check
> 2.50 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
> 1.53 RATWARE_EFROM Bulk email fingerprint (envfrom) found
> -0.00 SPF_PASS SPF: sender matches SPF record
> 
>  
>  
> I am running MailScanner version 4.83.4 on SLES 10 64-bit.  I don't
know where
> to go from here.
>  
> Gary
> 
> 
You can try something like this in spam.assassin.prefs.com;

header    FROM_BLACKBERRYFrom =~ /\@blackberry\./
describe  FROM_BLACKBERRYemail From blackberry user
score  FROM_BLACKBERRY-20


adjust the score accordingly. You might have to play with the regex a
little
til it works for you.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130105/3d428966/attachment.html