<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head><title></title>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta http-equiv="Content-Style-Type" content="text/css">
<style type="text/css"><!--
body {
margin: 5px 5px 5px 5px;
background-color: #ffffff;
}
/* ---------- Text Styles ---------- */
hr { color: #000000}
body, table /* Normal text */
{
font-size: 9pt;
font-family: 'Courier New';
font-style: normal;
font-weight: normal;
color: #000000;
text-decoration: none;
}
span.rvts1 /* Heading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #0000ff;
}
span.rvts2 /* Subheading */
{
font-size: 10pt;
font-family: 'Arial';
font-weight: bold;
color: #000080;
}
span.rvts3 /* Keywords */
{
font-size: 10pt;
font-family: 'Arial';
font-style: italic;
color: #800000;
}
a.rvts4, span.rvts4 /* Jump 1 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
a.rvts5, span.rvts5 /* Jump 2 */
{
font-size: 10pt;
font-family: 'Arial';
color: #008000;
text-decoration: underline;
}
span.rvts6
{
font-weight: bold;
}
span.rvts7
{
font-weight: bold;
text-decoration: underline;
}
a.rvts8, span.rvts8
{
color: #0000ff;
text-decoration: underline;
}
a.rvts9, span.rvts9
{
font-weight: bold;
color: #0000ff;
text-decoration: underline;
}
/* ---------- Para Styles ---------- */
p,ul,ol /* Paragraph Style */
{
text-align: left;
text-indent: 0px;
padding: 0px 0px 0px 0px;
margin: 0px 0px 0px 0px;
}
.rvps1 /* Centered */
{
text-align: center;
}
--></style>
</head>
<body>
<p>i receive a lot of spam mask as internal email, as if someone within my network send it, but in fact is just spam, from outside.</p>
<p>i figure i could solve effectively just with spam.whitelist.rules and spam.blacklist.rules, for some reason i can't understand it only works with some emails.</p>
<p><br></p>
<p>here what i did, whitelist is checked first, if rule matches it skips the remaining rules and blacklist aswell:</p>
<p><br></p>
<p><span class=rvts7>on spam.whitelist.rules:</span></p>
<p><span class=rvts6><br></span></p>
<p><span class=rvts6>From: 192.168.10. yes</span></p>
<p><br></p>
<p><span class=rvts7>on spam.blacklist.rules:</span></p>
<p><br></p>
<p><span class=rvts6>From: </span><a class=rvts9 href="mailto:*@mydomain.com">*@mydomain.com</a><span class=rvts6> yes</span></p>
<p><br></p>
<p><br></p>
<p>any internal email will match the rule on Whitelist, so it never gets rejected in blacklist. if its fake, it wont match the ip address and it only matches the blacklist.</p>
<p>when i did this, almost all fake email was detected, however some aren't. is there something i miss in here? is there a better approach? </p>
<p>also regarding SPF records, mailscanner doesnt handle SPF? </p>
<p><br></p>
<p>thanks! </p>
<p>__</p>
<p>Jorge Costinha</p>
<p><br></p>
</body><br />--
<br />This message has been scanned for viruses and
<br />dangerous content by HCC Mailscanner software, and is
<br />believed to be clean.
</html>