On Wed, 17 Apr 2019 14:16:30 -0700 (MST) jandev wrote: > Hi all > > Yesterday our mail server received unwanted email from simpliv.com. > ... > Surprisingly the ip/domain is part of a SA shipped white list: Rule > USER_IN_DEF_SPF_WL gave it -7.5!
I was going to suggest you unwhitelist it yourself, but it doesn't seem to be possible. If I'm reading the code correctly only unwhitelist_from_rcvd applies to both the full and default (_DEF_) versions. The other unwhitelist_* entries only apply to the full whitelists, not the default.
