Running SA 3.4.6 on RH8.
Does whitelist_auth work on From header, or Return-Path? Reason I ask:
I have two emails from “support .at. wasabi.com”. Due to their emails usually
triggering KAM rules I have (in /etc/mail/spamassassin/local.cf):
## Whitelist Wasabi, subject to passing of auth
whitelist_auth supp...@wasabi.com
First email triggers whitelist_auth and is passed as expected. It
has:Return-Path: <supp...@wasabi.com>
... <snip>
From: Wasabi Support <supp...@wasabi.com>X-Spam-Score: -182.112
X-Spam-Level:
X-Spam-Status: No, score=-182.112 tagged_above=-999 required=6.2
tests=[BAYES_00=-1.9, DCC_CHECK=1.1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HELO_STATIC_HOST=-0.001,
HTML_MESSAGE=0.001, KAM_BODY_MARKETINGBL_PCCC=0.001, KAM_BODY_URIBL_PCCC=9,
KAM_FROM_URIBL_PCCC=9, KAM_MARKETINGBL_PCCC=1, LR_DMARC_PASS=-0.1,
RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001,
SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01,
USER_IN_DKIM_WELCOMELIST=-0.01, USER_IN_DKIM_WHITELIST=-100,
USER_IN_SPF_WELCOMELIST=-0.01, USER_IN_SPF_WHITELIST=-100]
The other is not triggering whitelist_auth and is marked as spam due to the KAM
rule fails. It has:Return-Path:
<bounces+35259635-6e5a-simon=simonandkate....@mmemail.wasabi.com>
... <snip>
From: Wasabi <supp...@wasabi.com>
... <snip>
Reply-To: supp...@wasabi.com
Despite passing SPF and DKIM, not whitelisted:X-Spam-Score: 20.212
X-Spam-Level: ********************
X-Spam-Status: Yes, score=20.212 tagged_above=-999 required=6.2
tests=[BAYES_00=-1.9, DCC_CHECK=1.1, DCC_REPUT_99_100=1.4, DKIM_INVALID=0.1,
DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, KAM_BODY_MARKETINGBL_PCCC=0.001,
KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9, KAM_MARKETINGBL_PCCC=1,
KAM_REALLYHUGEIMGSRC=0.5, LR_DMARC_PASS=-0.1, SPF_HELO_NONE=0.001,
SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01]
autolearn=no autolearn_force=no
Received: from mail.simonandkate.net ([127.0.0.1])
by localhost (amavis.simonandkate.net [127.0.0.1]) (amavis, port 10024)
with LMTP id 0dPigJ_ugPPb for <simon@mail.local>;
Wed, 3 Jul 2024 07:48:51 +1000 (AEST)
Authentication-Results: mail.simonandkate.net;
spf=none smtp.helo=o562.ptr9861.wasabi.com;
spf=pass smtp.mailfrom=mmemail.wasabi.com
Authentication-Results: mail.simonandkate.net; dmarc=pass (p=quarantine
dis=none) header.from=wasabi.com
Authentication-Results: mail.simonandkate.net; arc=none
smtp.remote-ip=159.183.86.216
Authentication-Results: mail.simonandkate.net;
dkim=pass (2048-bit key, unprotected) header.d=wasabi.com
header.i=@wasabi.com header.a=rsa-sha256 header.s=mmd header.b=uhRSt2r0
Received: from o562.ptr9861.wasabi.com (o562.ptr9861.wasabi.com
[159.183.86.216])
by mail.simonandkate.net (Postfix) with ESMTPS id C105157044
for <si...@simonandkate.net>; Wed, 3 Jul 2024 07:48:47 +1000 (AEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wasabi.com;
h=content-type:from:mime-version:subject:reply-to:to:list-unsubscribe:
list-unsubscribe-post:cc:content-type:from:subject:to;
s=mmd; bh=cy4eC8HJMJh8b6CwYtOAzArbHod4C/sAQkNIrkSQFPA=;
b=uhRSt2r0lE9yE6sSCc7+QA90N0PCyzA0FNP0bOo2ApH/U+u6yCpjvt0KZJ+VO2MfDKuh
xmzJPFgaHNvajQDOyqfLCfF4xwTrxYyBaKTMf/qinqP6JHpFsKVaDNykv96ZIac/SwRbha
SO4yPkPl1NO5k4ENyD5va2J9LftRyQ0te+awrnbjypQAKJiJ0yPoqNTFCJZGdQSCuJOZG8
ASnJcPZRoL2J83FEJCMPZdS5Wpf0GAgHp7aEpzAFf7TEpfJA8IMsbRSlRs3ptdZtYvwKMR
K6oi/d+w3UBSdFGRpRFZlgFeVjNIp/xCz5pDGf7109C0A+QSjn4zZ3edrOjF1JPg==
Received: by filterdrecv-6576d68dbc-fxxdn with SMTP id
filterdrecv-6576d68dbc-fxxdn-1-668475B6-1
2024-07-02 21:48:38.112531956 +0000 UTC m=+1292691.168998080
Received: from MzUyNTk2MzU (unknown)
by geopod-ismtpd-4 (SG) with HTTP
id X_mTOosARsSFXqinaxYfEw
Tue, 02 Jul 2024 21:48:38.008 +0000 (UTC)
Content-Type: multipart/mixed;
boundary=75633f0201749d47c1ba5a273d403dbaa85162228d469a5e23d94a668c10
Date: Tue, 02 Jul 2024 21:48:38 +0000 (UTC)
From: Wasabi <supp...@wasabi.com>
Mime-Version: 1.0
Message-ID: <X_mTOosARsSFXqinaxYfEw@geopod-ismtpd-4>
Subject: [SPAM] Wasabi Technologies LLC Invoice
Reply-To: supp...@wasabi.com
Do I need to add the return-path, i.e.:
## Whitelist Wasabi, subject to passing of auth
whitelist_auth supp...@wasabi.com
whitelist_auth *@mmemail.wasabi.com
?
Thanks.
Simon.
