Spam from whitelisted senders

[Jack Gostl <go...@argoscomp.com>]

-----BEGIN PGP SIGNED MESSAGE-----

I'm looking for a suggestion on this. I have a customer that is a large
company. I put an entry in my whitelist of the form        

        whitelist_from    *@reallybigcompany.com

Now I get a constant trickle of spam from addresses like
slkfday@reallybigcompany.com

Adding individuals to the whitelist is the only thing I can think of, but
when I get mail from someone new at "reallybigcompany" it could easily get
trapped. That would be ugly enough for me to be willing to accept the
trickle of spam.

The amount of spam is manageable, but I'm worried it could grow, so I'm
looking for any suggestions.

Thanks

Jack



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.3 (Build 5003)

wpUDBQFHQCglFhDacYjJc7UBAcU1A/wI/t496IyaSMjSwpS6ytq4KeoU9gN1yDTK
b1A1PDgFZVlSwYaQr0lICMGxmfxT1O7X2nSBF6ECedJ6j8jyZkywyoUQTrTQmbMQ
huyVLqFm8VdICRLH/w9sq4ti0gl0kDX0SPtqJgVX+P25PSxfqbQyrP/zEoCZifP8
VRxnlqyT/g==
=EMF4
-----END PGP SIGNATURE-----

Re: Spam from whitelisted senders

[Bob Proulx <bo...@proulx.com>]

Jack Gostl wrote:
> I'm looking for a suggestion on this. I have a customer that is a large
> company. I put an entry in my whitelist of the form        
> 
>         whitelist_from    *@reallybigcompany.com
> 
> Now I get a constant trickle of spam from addresses like
> slkfday@reallybigcompany.com

whitelist_from is available because it is sometimes useful but it
ignores the large problem of forged email.  If possible you should
always avoid using whitelist_from because of the problem of forged
email.

> Adding individuals to the whitelist is the only thing I can think of, but
> when I get mail from someone new at "reallybigcompany" it could easily get
> trapped. That would be ugly enough for me to be willing to accept the
> trickle of spam.

If you trust the company not to generate spam itself then use the
whitelist_from_rcvd form instead.

  whitelist_from_rcvd user123@example.com mail.example.com
  whitelist_from_rcvd *@example.com mail.example.com
  whitelist_from_rcvd user123@example.com mail.mail-relay.com

Bob

RE: Spam from whitelisted senders

[Giampaolo Tomassoni <g....@libero.it>]

> From: Jack Gostl [mailto:gostl@argoscomp.com] 
> Sent: Sunday, November 18, 2007 12:55 PM
> To: users@spamassassin.apache.org
> Subject: Spam from whitelisted senders
>
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> I'm looking for a suggestion on this. I have a customer that is a large
> company. I put an entry in my whitelist of the form        
> 
>        whitelist_from    *@reallybigcompany.com
> 
> Now I get a constant trickle of spam from addresses like
> slkfday@reallybigcompany.com
> 
> Adding individuals to the whitelist is the only thing I can think of, but
> when I get mail from someone new at "reallybigcompany" it could easily get
> trapped. That would be ugly enough for me to be willing to accept the
> trickle of spam.
> 
> The amount of spam is manageable, but I'm worried it could grow, so I'm
> looking for any suggestions.

If you know the outgoing mail servers the big company is using, you may
better use whitelist_from_rcvd or, even better, if they use SPF or DKIM,
whitelist_from_spf.

Have a look at the Mail::SpamAssassin::Conf perldoc to learn how to use
these whitelist keywords.

Giampaolo


> 
> Thanks
> 
> Jack

RE: Spam from whitelisted senders

[Michael Scheidell <sc...@secnap.net>]

Find out why that company sends messy spams.
Help them fix it. 
 
But, don't whitelist from.  you will get forged spam.
 
use the 'received', spf or dkim versions.
 
--
Michael Scheidell, CTO
Office: 561-999-5000 x 1259
Direct: 561-939-7259
Real time security alerts: http://www.secnap.com/news
 

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm). 
For Information please see http://www.spammertrap.com
_________________________________________________________________________