Return Path vs Received

[Brian Dowling <br...@generationz.com>]

Try this again...

I thought I read something about this somewhere but can't find it now. I've
massaged the whitelist_from and whitelist_from_rcvd and don't quite understand
the docs. I'd like to handle the scoring differently when the return path is
different than the received field. I whitelist all my domains and when I get
spoofed on the return path, the scoring will always be to low. This email should
never have been sent in my eyes, no email was sent from my box to cause this,
not spam either, I don't needs these kinds of messages, but thats all a
different deal...

Return-Path: <MA...@ns1.generationz.com>
Received: from brinker.com (smtp1.brinker.com [12.154.32.21])
     by ns1.generationz.com (8.11.6/8.11.6) with ESMTP id i4NGNv701150
     for <we...@ntreis.com>; Sun, 23 May 2004 11:23:57 -0500
Message-ID: <10...@brinker.com>
From: Brinker.Intl.Virus.Scan@ns1.generationz.com
To: "Undisclosed Recipient"@ns1.generationz.com
Subject: Virus detected in a recent e-mail
Date: Sun, 23 May 2004 11:23:43 -0500
MIME-Version: 1.0
Content-Type: text/plain;
     charset="us-ascii"
X-BDs-MailScanner-Information: Works pretty good!
X-BDs-MailScanner: Found to be clean
X-BDs-MailScanner-SpamCheck:
X-MailScanner-From:
X-MailScanner-To: webmaster@ntreis.com
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
     ns1.generationz.com
X-Spam-Status: No, hits=-91.1 required=5.0 tests=AWL,BAYES_00,
     FAKED_UNDISC_RECIPS,NO_REAL_NAME,USER_IN_WHITELIST autolearn=no
     version=2.60
X-Spam-Level: -91.1
        
I did upgrade to 2.63 today.

Any ideas or insight would be helpful.

Thanks

Re: Return Path vs Received

[Matt Kettler <mk...@comcast.net>]

At 08:52 AM 5/25/04 +0000, Brian  Dowling wrote:
>Try this again...

Why don't we try it one more time..

This time, post the relevant whitelist commands that you are using so that 
we can understand your problem.

Hard to speculate on what the problem may be when you only post the output, 
without posting the settings.

In general, if you're using "whitelist_from *@*.generationz.com" that's 
what I'd expect to happen.

>I thought I read something about this somewhere but can't find it now. I've
>massaged the whitelist_from and whitelist_from_rcvd and don't quite understand
>the docs.

Ok, what part don't you understand?

>I'd like to handle the scoring differently when the return path is 
>different than the received field.

Ok, technically nothing in SA is specific to the return path, but all the 
"from" commands will match from, return-path, and several other headers.

That said, you're going to have trouble with whitelist_from_rcvd because 
your Received: headers look strange. (you don't seem to have a domain going 
on in your Received: headers, nor any IP addresses, just a hostname). I 
don't think SA is going to parse that Received: header very well, but the 
following *might* work for you:

whitelist_from_rcvd  *@generationz.com  brian

This is the relevant Received: header from your list posting:

Received: from brian by adsl-66-138-81-105.dsl.rcsntx.swbell.net with local 
(Gmexim 0.1 (Debian))
         id 1AlnuQ-0007hv-00