Whitelisting problems
Gary Faith
gafaith at asdm.net
Sat Jan 5 22:16:14 GMT 2013
These entries
>> @srs.bis6.us.blackberry.com default
>> *@*.*.us.blackberry.com default
>> 74.82.85. default
were cut and pasted from the mailwatch whitelist. Something went wrong
when I pasted the info from the spam.whitelist.rules. It should have
been this. Sorry for the confusion.
# If you are basing a blacklist on this then you can refer to
# a null (empty) sender address with "/^$/" as the address to match.
#
# This is where you can build a Spam WhiteList
# Addresses matching in here, with the value
# "yes" will never be marked as spam.
#From: 152.78. yes
#From: 130.246. yes
#From: host:soton.ac.uk yes # Note this is slower than using
the IP
From: 74.82.85. yes
FromOrTo: default no
After testing, I realized that I use either the SQL whitelist or the
file based rules.
#Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
Is Definitely Not Spam = &SQLWhitelist
I finally figured out the entry to whitelist in the
spam.whitelist.rules works but the entry to whitelist in the SQL
whitelist doesn't. So maybe there is something wrong with the SQL
table. Not sure, need to test some more.
Gary
>>> Alex Neuman <alex at vidadigital.com.pa> 1/4/2013 12:43 PM >>>
Plus you have the syntax wrong.
From: .blackberry.com yes
... in /etc/MailScanner/rules/spam.whitelist.rules should work.
I don't know why you think "from something default" makes any sense,
"from something yes" as an answer to the question "is this
whitelisted" makes more sense, since the default is "no".
On Fri, Jan 4, 2013 at 11:10 AM, Scott Silva <ssilva at sgvwater.com>
wrote:
> on 1/4/2013 6:49 AM Gary Faith spake the following:
>> I am attempting to whitelist e-mail from blackberry servers but not
having any
>> success. Since I read that MailScanner bases the whtelist on the
envelope,
>> here is the envelope (I changed the e-mail address):
>>
>> EHLO smtp02.bis6.us.blackberry.com
>> MAIL
FROM:<SRS0=+AiNi2=K5=mydomain.net=user at srs.bis6.us.blackberry.com
>>
<mailto:SRS0=+AiNi2=K5=mydomain.net=user at srs.bis6.us.blackberry.com>>
SIZE=876
>> RCPT TO:user at mydomain.net <mailto:TO:user at mydomain.net>(
mailto:user at mydomain.net)
>> Return-Path: <Â g>
>> Received: from smtp07.bis6.us.blackberry.com
(smtp07.bis6.us.blackberry.com
>> [74.82.85.7])
>> by mscan.asdmonline.net (8.13.6/8.13.6/SuSE Linux 0.8) with
ESMTP id
>> r04EPuc6025687
>>
>> I have tried whitelisting via Mailwatch:
>>
>> @srs.bis6.us.blackberry.com default
>> *@*.*.us.blackberry.com <mailto:*@*.*.us.blackberry.com>
default
>> 74.82.85. default
>>
>> with no success. I even tried to whitelist in the MailScanner rule
file
>> (spam.whitelist.rules):
>>
>> mscan:/etc/MailScanner/rules # cat spam.whitelist.rules
>> # If you are basing a blacklist on this then you can refer to
>> # a null (empty) sender address with "/^$/" as the address to
match.
>> #
>> # This is where you can build a Spam WhiteList
>> # Addresses matching in here, with the value
>> # "yes" will never be marked as spam.
>> #From: 152.78. yes
>> #From: 130.246. yes
>> #From: host:soton.ac.uk yes # Note this is slower than
using the IP
>> @srs.bis6.us.blackberry.com default
>> *@*.*.us.blackberry.com <mailto:*@*.*.us.blackberry.com>
default
>> 74.82.85. default
>> FromOrTo: default no
>>
>> and the message keep getting scanned and blocked:
>>
>>
>> Score Matching Rule Description
>> -0.50 BAYES_00 Bayesian spam probability is 0 to 1%
>> 2.00 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
>> 2.00 DIGEST_MULTIPLE Message hits more than one network
digest check
>> 2.50 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
>> 1.53 RATWARE_EFROM Bulk email fingerprint (envfrom) found
>> -0.00 SPF_PASS SPF: sender matches SPF record
>>
>>
>>
>> I am running MailScanner version 4.83.4 on SLES 10 64-bit. I don't
know where
>> to go from here.
>>
>> Gary
>>
>>
> You can try something like this in spam.assassin.prefs.com;
>
> header FROM_BLACKBERRY From =~ /\@blackberry\./
> describe FROM_BLACKBERRY email From blackberry user
> score FROM_BLACKBERRY -20
>
>
> adjust the score accordingly. You might have to play with the regex a
little
> til it works for you.
>
>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
--
--
Alex Neuman van der Hans
Reliant Technologies / Vida Digital
http://vidadigital.com.pa/
+507-6781-9505
+507-832-6725
+1-440-253-9789 (USA)
Follow @AlexNeuman on Twitter
http://facebook.com/vidadigital
-- So-called "legal disclaimers" are not legally binding, so don't
bother. A cute graphic saying "save the planet, don't print this" can
potentially create more CO2, not less, so don't bother either.
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130105/393018a5/attachment.html
More information about the MailScanner
mailing list