<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hello everyone,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have had some strangeness happening on our whitelists per
domain. A few weeks ago I turned this on (from a global list) and it’s
been working great. Unfortunately I’ve just seen this – <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Sep 10 09:15:53 mailfilter7 sm-mta-in[14176]: n8A8FpvA014176:
from=<<a href="mailto:geoff.**@example1.co.uk">geoff.**@example1.co.uk</a>>,
size=92755, class=0, nrcpts=2, msgid=<<a
href="mailto:200909100815.n8A8FpvA014176@mailfilter7.**">200909100815.n8A8FpvA014176@mailfilter7.**</a>>,
proto=ESMTP, daemon=IPv4, relay=adsl-** [**] (may be forged)<o:p></o:p></p>
<p class=MsoNormal>Sep 10 09:15:53 mailfilter7 sm-mta-in[14176]:
n8A8FpvA014176: to=<<a href="mailto:spares@example2.com">spares@example2.com</a>>,
delay=00:00:01, mailer=esmtp, pri=152755, stat=queued<o:p></o:p></p>
<p class=MsoNormal>Sep 10 09:15:53 mailfilter7 sm-mta-in[14176]:
n8A8FpvA014176: to=<<a href="mailto:joe.tavani@example1.co.uk">joe.tavani@example1.co.uk</a>>,
delay=00:00:01, mailer=esmtp, pri=152755, stat=queued<o:p></o:p></p>
<p class=MsoNormal>Sep 10 09:15:54 mailfilter7 MailScanner[83390]: Message
n8A8FpvA014176 from ** (<a href="mailto:geoff.***@example1.co.uk">geoff.***@example1.co.uk</a>)
to example1.co.uk,example2.com is spam, SpamAssassin (not cached, score=6.561,
required 3.5, autolearn=disabled, DYN_RDNS_AND_INLINE_IMAGE 0.00,
EXTRA_MPART_TYPE 1.00, HTML_IMAGE_ONLY_12 2.25, HTML_IMAGE_RATIO_02 0.55,
HTML_MESSAGE 0.00, MIME_BOUND_EQ_REL 0.84, MIME_QP_LONG_LINE 1.82, RDNS_DYNAMIC
0.10)<o:p></o:p></p>
<p class=MsoNormal>Sep 10 09:15:57 mailfilter7 MailScanner[83390]: Spam
Actions: message n8A8FpvA014176 actions are <a
href="mailto:spam@example1.co.uk,forward">spam@example1.co.uk,forward</a><o:p></o:p></p>
<p class=MsoNormal>Sep 10 09:15:58 mailfilter7 sendmail[14377]: n8A8FpvA014176:
to=<<a href="mailto:spam@example1.co.uk">spam@example1.co.uk</a>>,
delay=00:00:06, xdelay=00:00:00, mailer=esmtp, pri=242755,
relay=mail.example1.co.uk. [****], dsn=2.0.0, stat=Sent (n8A8FvcY083874 Message
accepted for delivery)<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>My whitelist – <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>grep example1 /**/customer_rulesets/spam.bydomain/whitelist/example1.co.uk<o:p></o:p></p>
<p class=MsoNormal><a href="mailto:*@example1.co.uk">*@example1.co.uk</a><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>(I’ve replaced some things but you get the point..)<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Basically, most of the time this works great, some of the time
I see stuff getting through, not being whitelisted etc. When I grep for
whitelist in the maillog it shows as stopping and starting all the time. For
example here is the period that mailscanner should have found the whitelist entry
– <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Sep 11 09:15:39 mailfilter7 MailScanner[44048]: Closing down
by-domain spam whitelist<o:p></o:p></p>
<p class=MsoNormal>Sep 11 09:15:40 mailfilter7 MailScanner[40706]: Starting up
by-domain spam whitelist, reading from /**/customer_rulesets/spam.bydomain/whitelist<o:p></o:p></p>
<p class=MsoNormal>Sep 11 09:15:46 mailfilter7 MailScanner[66736]: Message
n8B8Feab040736 from 15***** (craig.**@**.com) is whitelisted<o:p></o:p></p>
<p class=MsoNormal>Sep 11 09:15:53 mailfilter7 MailScanner[40706]: Read
whitelist for 1165 domains<o:p></o:p></p>
<p class=MsoNormal>Sep 11 09:16:13 mailfilter7 MailScanner[59788]: Message
n8B8G8Oo041572 from *** (havant@**.co.uk) is whitelisted<o:p></o:p></p>
<p class=MsoNormal>Sep 11 09:16:27 mailfilter7 MailScanner[36105]: Message
n8B8GLKM042076 from *** (yourmessages@**.co.uk) is whitelisted<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’ve been searching and this whitelist works usually
for my entry, I can see other email addresses being white listed fine from the
same domain. This leaves me to believe it’s something to do with the
stopping and starting of the by-domain spam white list.? <o:p></o:p></p>
<p class=MsoNormal>Does anyone else see this in their logs? <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Rich<o:p></o:p></p>
</div>
</body>
</html>