You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ilya Vishnyakov <il...@edpausa.com> on 2007/04/05 17:54:59 UTC
whitelisting question
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello Spamassassin Gurus!
I have the spam email, showing that it was sent from our user (from
ersin@edpausa.com to ersin@edpausa.com) How do I whitelist the spam
email like this one?
I copied the header for you convenience.
*Return-Path:* <ersin_elitas@hotmail.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin_elitas%40hotmail.com>>
*Received:* from murder ([unix socket])
by skywalker.edpausa.com (Cyrus v2.3.8) with LMTPA;
Thu, 05 Apr 2007 11:34:17 -0400
*X-Sieve:* CMU Sieve 2.3
*Received:* from localhost (localhost.edpausa.com [127.0.0.1])
by skywalker.edpausa.com (Postfix) with ESMTP id F2BE9C965F
for <ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>>;
Thu, 5 Apr 2007 11:34:16 -0400 (EDT)
*X-Virus-Scanned:* amavisd-new at edpausa.com
*X-Spam-Score:* -88.681
*X-Spam-Level:*
*X-Spam-Status:* No, score=-88.681 tagged_above=-150 required=3
tests=[AWL=-12.769, BAYES_60=1, DIGEST_MULTIPLE=0.765,
DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708, HTML_90_100=0.113,
HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=1.082,
MIME_HTML_ONLY=0.001,
PYZOR_CHECK=3.5, RAZOR2_CF_RANGE_51_100=0.5,
RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=3.5,
SARE_FROM_SPAM_WORD3=0.1, SPF_SOFTFAIL=1.384, URIBL_JP_SURBL=4.087,
URIBL_OB_SURBL=3.008, URIBL_SBL=1.639, USER_IN_WHITELIST=-100]
*Received:* from skywalker.edpausa.com ([127.0.0.1])
by localhost (skywalker.edpausa.com [127.0.0.1]) (amavisd-new,
port 10024)
with ESMTP id 3N5cyk-F-MZN for <ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>>;
Thu, 5 Apr 2007 11:33:58 -0400 (EDT)
*Received:* from ORDENADOR3 (153.Red-217-126-212.staticIP.rima-tde.net
[217.126.212.153])
by skywalker.edpausa.com (Postfix) with SMTP id 62E98C9A05
for <ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>>;
Thu, 5 Apr 2007 11:33:29 -0400 (EDT)
*MIME-Version:* 1.0
*X-Originating-IP:* [57.0.4.739]
*X-Originating-Email:* [ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>]
*X-Sender:* ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>
*Received:* (qmail 3473 by uid 846); Thu, 5 Apr 2007 05:33:35 +0100
*Message-Id:* <20...@ORDENADOR3>
*To:* <ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>>
*Subject:* Online MedHelp
*From:* MensHealth Online <ersin@edpausa.com
<http://mail.edpausa.com/webmail/src/compose.php?send_to=ersin%40edpausa.com>>
*MIME-Version:* 1.0
*Importance:* High
*Content-Type:* text/html
*Date:* Thu, 5 Apr 2007 11:33:29 -0400 (EDT)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGFRvTUZGmaUWxLn8RAvjMAKCIIgfzVmt4vUAwbrNv5IuhkuFI7QCguG0U
E9CXpDDX4IkHQNLDAWCPsTU=
=GK70
-----END PGP SIGNATURE-----
Re: whitelisting question
Posted by Ilya Vishnyakov <il...@edpausa.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
thank you.
Matt Kettler wrote:
> Ilya Vishnyakov wrote:
>> Hello Spamassassin Gurus! I have the spam email, showing that it
>> was sent from our user (from ersin@edpausa.com to
>> ersin@edpausa.com) How do I whitelist the spam email like this
>> one?
> I suspect you mean how do you not whitelist the spam.
>
> The answer is simple. do not use whitelist_from, for anything. It
> is particularly important to not do this for your own domain.
>
> Use whitelist_from_rcvd instead, which takes a second parameter
> that checks a substring of the server name in the Received:
> headers. This makes it reasonably resistant to forgery.
>
> see man Mail::SpamAssassin::Conf for more details on
> whitelist_from_rcvd and its syntax.
>
> If that's not clear, please feel free to ask further questions on
> the list.
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGFlVVUZGmaUWxLn8RAib3AJ9p+q1ImXO+Qfbb9R8RM8yRhkpkXgCgkAZG
S3T5145k82KrNyTzmyx9ads=
=OlDf
-----END PGP SIGNATURE-----
Re: whitelisting question
Posted by Matt Kettler <mk...@verizon.net>.
Ilya Vishnyakov wrote:
> Hello Spamassassin Gurus!
> I have the spam email, showing that it was sent from our user (from
> ersin@edpausa.com to ersin@edpausa.com) How do I whitelist the spam
> email like this one?
I suspect you mean how do you not whitelist the spam.
The answer is simple. do not use whitelist_from, for anything. It is
particularly important to not do this for your own domain.
Use whitelist_from_rcvd instead, which takes a second parameter that
checks a substring of the server name in the Received: headers. This
makes it reasonably resistant to forgery.
see man Mail::SpamAssassin::Conf for more details on whitelist_from_rcvd
and its syntax.
If that's not clear, please feel free to ask further questions on the list.