gafaith at asdm.net
Mon Jan 7 14:03:14 GMT 2013
Finally, getting close to figuring this out but I could really use some help here. I figured out part of the issues was spamassassin was caching data and I had to delete the cache to get it to process the rules for this message.
I created these three spamassassin rules:
# Rule to find Whitelist Blackberry mail
header FROM_BLACKBERRY From =~ /\.*\.us\.blackberry\.com/
score FROM_BLACKBERRY -10
describe FROM_BLACKBERRY email From blackberry user
header COM_DOMAIN_MAIL From =~ /\.com/i
score COM_DOMAIN_MAIL 0.1
header NET_DOMAIN_MAIL From =~ /\.net/i
score NET_DOMAIN_MAIL 0.1
Here is the problem now. The meessage is being sent
From: srs0=jc450o=la=mydomain.net=gafaith at srs.bis6.us.blackberry.com
and in the Spam report, I get:
-0.50BAYES_00Bayesian spam probability is 0 to 1%
1.53RATWARE_EFROMBulk email fingerprint (envfrom) found
-0.00SPF_PASSSPF: sender matches SPF record
It should match the FROM_BLACKBERRY and the COM_DOMAIN_MAIL rule but instead it matches the NET_DOMAIN_MAIL rule. It looks like it is matching on the first instance of a domain instead of what is after the @ sign.
Maybe with this information someone can tell me why it is doing this and what I can do to have it match the us.blackberry.com.
Thanks in advance,
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the MailScanner