I was able to figure this out. By suggestion of Kevin, I ran the debug again 
without my whitelist configs and there was no match to my whitelist. I then 
broke up my whitelist configs until it found a match. I was then able to see 
that I had a config as "*@ domain.com" so even though the line did not end with 
the @ symbol, part of the line did which is how it found was able to match it.

From: Erickarlo Porro [mailto:[email protected]]
Sent: Friday, August 14, 2015 11:01 AM
To: [email protected]
Subject: sender shows up in whitelist even though they aren't

I had an email come in that passed a whitelist check even though I do not have 
that email address as a whitelist_from.

The From header shows: From: <Suzanne.Noble@>
Re-running the message through debug shows:
dbg: eval: all '*From' addrs: Suzanne.Noble@
dbg: rules: address suzanne.noble@ matches whitelist or blacklist regexp: ^.*\@$
dbg: rules: ran eval rule USER_IN_WHITELIST ======> got hit (1)

So it appears that because the from header had nothing after the @ sign, it was 
whitelisted. But I searched all of my configs and I don't have anything that 
looks like "noble@" or "*@" so how did this message get through? Any ideas?

I am on version 3.3.1 in case this might be a bug that was already fixed in the 
newer versions.

Thanks,
Eric

Reply via email to