Re: {SPAM} Spoofing, whitelist, whitelist_from_rcvd

[Matt Kettler <mk...@evi-inc.com>]

At 02:57 PM 3/10/2004, Ragnar Paulson wrote:

>There's been an lot of discussion lately about detection of forgeries ... 
>however I wonder why the existing mechanisms don't work! In
>the e-mail below this message apparently was "whitelisted" by the default 
>"whitelist_from_rcvd" rules for amazon.com.  I do not
>have "amazon.com", nor "sun.com" in my personal whitelist.    Yet from the 
>2nd line of the message it is apparent that this message
>did not come "amazon.com" at all.  It came from 
>"va-hopewell2-15.adelphia.net".   Why was this message given a -100 score?
>
>Ragnar

<snip>

>X-Spam-Status: No, hits=-90.0 required=3.0
>  tests=ADULT_SITE,BASE64_ENC_TEXT,BAYES_70,CLICK_BELOW,
>        COMPLETELY_FREE,HARDCORE_PORN,HTML_10_20,MIME_HTML_ONLY,
>        MISSING_MIMEOLE,OPT_IN_CAPS,PRIORITY_NO_NAME,TSG_WHITELIST,
>        USER_IN_WHITELIST
>  version=2.54-sentinet

I hate to be blunt.. but you are running a seriously old version of SA, one 
which has a well known bug in whitelist_from_rcvd that was fixed quite a 
long time ago with the release of 2.60...

http://bugzilla.spamassassin.org/show_bug.cgi?id=846

Perhaps you should consider upgrading. After all, the SA-devs can fix bugs 
all they want and it does you no good if you don't download current 
versions of SA.