Whitelisting problems

Gary Faith gafaith at asdm.net
Mon Jan 7 14:03:14 GMT 2013

Finally, getting close to figuring this out but I could really use some help here.  I figured out part of the issues was spamassassin was caching data and I had to delete the cache to get it to process the rules for this message.
I created these three spamassassin rules:
# Rule to find Whitelist Blackberry mail
header    FROM_BLACKBERRY       From =~ /\.*\.us\.blackberry\.com/
score     FROM_BLACKBERRY       -10
describe  FROM_BLACKBERRY       email From blackberry user

header COM_DOMAIN_MAIL From =~ /\.com/i
header NET_DOMAIN_MAIL From =~ /\.net/i

Here is the problem now.  The meessage is being sent
From: srs0=jc450o=la=mydomain.net=gafaith at srs.bis6.us.blackberry.com

and in the Spam report, I get:

-0.50BAYES_00Bayesian spam probability is 0 to 1%
1.53RATWARE_EFROMBulk email fingerprint (envfrom) found
-0.00SPF_PASSSPF: sender matches SPF record
It should match the FROM_BLACKBERRY and the COM_DOMAIN_MAIL rule but instead it matches the NET_DOMAIN_MAIL rule.  It looks like it is matching on the first instance of a domain instead of what is after the @ sign.
Maybe with this information someone can tell me why it is doing this and what I can do to have it match the us.blackberry.com.
Thanks in advance,

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130107/418681e9/attachment.html 

More information about the MailScanner mailing list