I was able to figure this out. By suggestion of Kevin, I ran the debug again without my whitelist configs and there was no match to my whitelist. I then broke up my whitelist configs until it found a match. I was then able to see that I had a config as "*@ domain.com" so even though the line did not end with the @ symbol, part of the line did which is how it found was able to match it.
From: Erickarlo Porro [mailto:[email protected]] Sent: Friday, August 14, 2015 11:01 AM To: [email protected] Subject: sender shows up in whitelist even though they aren't I had an email come in that passed a whitelist check even though I do not have that email address as a whitelist_from. The From header shows: From: <Suzanne.Noble@> Re-running the message through debug shows: dbg: eval: all '*From' addrs: Suzanne.Noble@ dbg: rules: address suzanne.noble@ matches whitelist or blacklist regexp: ^.*\@$ dbg: rules: ran eval rule USER_IN_WHITELIST ======> got hit (1) So it appears that because the from header had nothing after the @ sign, it was whitelisted. But I searched all of my configs and I don't have anything that looks like "noble@" or "*@" so how did this message get through? Any ideas? I am on version 3.3.1 in case this might be a bug that was already fixed in the newer versions. Thanks, Eric
