I could be on the wrong track here but if you use the 'Whitelist To' function on your domain, then if a spammer sends an email to the user that is whitelist to'd, all other users that appear on the TO address line of that email will also receive the 'Whitelist To' behavior.
Example: UserB is upset because he feels your anti-spam measures are restrictive and asks you to turn them off for just him. You do this using 'Whitelist To [EMAIL PROTECTED]' in global.cfg. A spammer then sends an email to [EMAIL PROTECTED], [EMAIL PROTECTED] and [EMAIL PROTECTED] Normally, for example's sake, this spam would have been caught with a high weight. However, because of the 'Whitelist To', all three users(a, b, and c) will get the spam, and in the headers, you will see only 'Whitelisted(0)' Just a thought. -----Original Message----- From: Keith Purtell [mailto:[EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list I've double-checked the logs for something like that; no luck. I'm mystified. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Monday, December 01, 2003 2:07 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Finding reason for white list > > > > >Recently we got much spam from one source. When I examined > the headers to > >find out why, all > >indicated the items had been white listed. I have three > methods of white > >listing: from (full address > >or domain), to (recipients who want everything) and anywhere > (about 20 > >special text strings). So I > >began checking each but couldn't find a match between the > spam samples and > >my white lists. I > >suspected it was one of the white list entries in my global.cfg file > >because the weight was always > >zero, but that theory didn't bear fruit either. If this has > been asked > >before I don't remember > >seeing it: How can I find out exactly what Declude used to > white list an > >email? > > There should be a log file entry that has the text that was used to > whitelist the E-mail (such as "E-mail whitelisted - > automatically passing > all spam tests [EMAIL PROTECTED]", where "[EMAIL PROTECTED]" > was the text > used to whitelist the E-mail). > > -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
