I should also mention, we have a gateway mail server hence the extra
header. the spam scanning is done on the first header, so for proof this
is pasted below.
Regards,
>From [EMAIL PROTECTED] Wed Mar 28 08:48:11 2007
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Received: from [195.110.64.125] (helo=smtp.uk.colt.net)
by mail.hopkins.co.uk with esmtp (Exim 4.63)
(envelope-from <[EMAIL PROTECTED]>)
id 1HWSt4-0005FR-5z
for [EMAIL PROTECTED]; Wed, 28 Mar 2007 08:48:11 +0100
Received: from mail.pdcmltd.co.uk (unknown [213.86.218.37])
by smtp.uk.colt.net (Postfix) with ESMTP
id 721B2126151; Wed, 28 Mar 2007 08:42:47 +0100 (BST)
Content-Class: urn:content-classes:message
Content-Transfer-Encoding: 7bit
Subject: Bury St Edmunds - Unit SU34
Importance: normal
Priority: normal
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7710E.58A560A4"
Date: Wed, 28 Mar 2007 08:54:43 +0100
Message-ID: <[EMAIL PROTECTED]>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.607
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Bury St Edmunds - Unit SU34
thread-index: AcdxDTLGeReHjG9FQsG+HfB3+1kiMg==
From: "Guy Graham" <[EMAIL PROTECTED]>
To: "James Stonard" <[EMAIL PROTECTED]>,
"Steve Sawyer" <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>,
"Lindsay,Peter" <[EMAIL PROTECTED]>,
"Tony White" <[EMAIL PROTECTED]>
Cc: "Ivan Stephenson" <[EMAIL PROTECTED]>
X-Redirect-To: [EMAIL PROTECTED]
X-Spam-Score: 40
X-Spam-Report: hits=4.0 required=5.0 test=NO_RDNS,VOWEL_FROM_7
This is a multi-part message in MIME format.
On Thu, Mar 29, 2007 at 03:11:15PM +0100, Mark Adams wrote:
> Ok, Fair enough.. I will change this listing to a whitelist_from_rcvd as
> I assume this list is farmed by spammers. (Should be using that always
> of course!)
>
> Header below.
>
> Envelope-to: [EMAIL PROTECTED]
> Received: from hopnet.hopkins.co.uk ([10.0.0.23] helo=mail.hopkins.co.uk)
> by hopkins.co.uk with esmtp (Exim 4.63)
> (envelope-from <[EMAIL PROTECTED]>)
> id 1HWSt9-0005j0-CG
> for [EMAIL PROTECTED]; Wed, 28 Mar 2007 08:48:11 +0100
> Received: from [195.110.64.125] (helo=smtp.uk.colt.net)
> by mail.hopkins.co.uk with esmtp (Exim 4.63)
> (envelope-from <[EMAIL PROTECTED]>)
> id 1HWSt4-0005FR-5z
> for [EMAIL PROTECTED]; Wed, 28 Mar 2007 08:48:11 +0100
> Received: from mail.pdcmltd.co.uk (unknown [213.86.218.37])
> by smtp.uk.colt.net (Postfix) with ESMTP
> id 721B2126151; Wed, 28 Mar 2007 08:42:47 +0100 (BST)
> Content-Class: urn:content-classes:message
> Content-Transfer-Encoding: 7bit
> Subject: Bury St Edmunds - Unit SU34
> Importance: normal
> Priority: normal
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="----_=_NextPart_001_01C7710E.58A560A4"
> Date: Wed, 28 Mar 2007 08:54:43 +0100
> Message-ID: <[EMAIL PROTECTED]>
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.607
> X-MS-Has-Attach:
> X-MS-TNEF-Correlator:
> Thread-Topic: Bury St Edmunds - Unit SU34
> thread-index: AcdxDTLGeReHjG9FQsG+HfB3+1kiMg==
> From: "Guy Graham" <[EMAIL PROTECTED]>
> To: "James Stonard" <[EMAIL PROTECTED]>,
> "Steve Sawyer" <[EMAIL PROTECTED]>,
> <[EMAIL PROTECTED]>,
> <[EMAIL PROTECTED]>,
> "Lindsay,Peter" <[EMAIL PROTECTED]>,
> "Tony White" <[EMAIL PROTECTED]>
> Cc: "Ivan Stephenson" <[EMAIL PROTECTED]>
> X-Spam-Score: 40
> X-Spam-Report: hits=4.0 required=5.0 test=NO_RDNS,VOWEL_
> X-Original-Recipient: [EMAIL PROTECTED]
>
> This is a multi-part message in MIME format.
>
> ....
>
>
> On Thu, Mar 29, 2007 at 03:03:10PM +0100, Anthony Peacock wrote:
> > Hi,
> >
> > Because, more often than not, the reason that whitelisting is not
> > matching is that the headers you think are matching are not. Or there
> > is a type in the whitelist.cf file.
> >
> > By not allowing us to see the entire header, you are making us guess.
> >
> > Mark Adams wrote:
> > >Thanks for you reply.
> > >
> > >Why would this make any difference?
> > >
> > >"The headers checked for whitelist addresses are as follows: if
> > >"Resent-From" is set, use that; otherwise check all addresses taken from
> > >the following set of headers:
> > >
> > >Envelope-Sender
> > >Resent-Sender
> > >X-Envelope-From
> > >From
> > >"
> > >
> > >The only header that matches is "From:" which is the header I posted
> > >below.
> > >
> > >It seems as if it is not reading the whitelist_from entries at all. Or
> > >whitelisting is somehow disabled, is that possible?
> > >
> > >On Thu, Mar 29, 2007 at 02:19:06PM +0100, Anthony Peacock wrote:
> > >>Hi,
> > >>
> > >>I would think we need to see the FULL headers of this example email
> > >>before anyone can comment.
> > >>
> > >>Mark Adams wrote:
> > >>>Hi,
> > >>>
> > >>>I have changed my reporting so it provides more information, and run
> > >>>--test-mode with a message marked as spam, that should be whitelisted
> > >>>
> > >>>whitelist.cf contents:
> > >>>
> > >>>whitelist_from [EMAIL PROTECTED]
> > >>>
> > >>>when running spamassassin -D --lint, I see the following line
> > >>>
> > >>>[18351] dbg: config: read file /etc/spamassassin/whitelist.cf
> > >>>
> > >>>But when running test mode I still do not get any reports on it being
> > >>>hit by the whitelist.
> > >>>
> > >>>Help!
> > >>>
> > >>>On Wed, Mar 28, 2007 at 03:51:43PM +0100, Mark Adams wrote:
> > >>>>On Thu, Mar 22, 2007 at 04:40:27PM -0400, Bowie Bailey wrote:
> > >>>>>Mark Adams wrote:
> > >>>>>>On Fri, Mar 02, 2007 at 10:06:51AM -0500, Bowie Bailey wrote:
> > >>>>>>>Is it scoring the whitelist lower or is it just not hitting?
> > >>>>>>>
> > >>>>>>>Can you post your whitelist rule and the headers from an example
> > >>>>>>>message?
> > >>>>>And why do you think this message should have hit the whitelist? Show
> > >>>>>me the "From" line in the email.
> > >>>>Hi, Header excerpt below. Once again help appreciated.
> > >>>>
> > >>>>From: Guy Graham <[EMAIL PROTECTED]>
> > >>>>X-Spam-Score: 40
> > >>>>X-Spam-Report: hits=4.0 required=5.0 test=NO_RDNS,VOWEL_FROM_7
> > >>>>X-Original-Recipient: [EMAIL PROTECTED]
> > >>>>
> > >>>
> > >>
> > >>--
> > >>Anthony Peacock
> > >>CHIME, Royal Free & University College Medical School
> > >>WWW: http://www.chime.ucl.ac.uk/~rmhiajp/
> > >>"If you have an apple and I have an apple and we exchange apples
> > >>then you and I will still each have one apple. But if you have an
> > >>idea and I have an idea and we exchange these ideas, then each of us
> > >>will have two ideas." -- George Bernard Shaw
> > >
> > >
> >
> >
> > --
> > Anthony Peacock
> > CHIME, Royal Free & University College Medical School
> > WWW: http://www.chime.ucl.ac.uk/~rmhiajp/
> > "If you have an apple and I have an apple and we exchange apples
> > then you and I will still each have one apple. But if you have an
> > idea and I have an idea and we exchange these ideas, then each of us
> > will have two ideas." -- George Bernard Shaw
