I apologize for the wrong list posting and thank you for your suggestion. -motty
On Mon, Jul 29, 2013 at 9:47 AM, Simon B <simon.buongio...@gmail.com> wrote: > > On 29 Jul 2013 18:38, "motty cruz" <motty.c...@gmail.com> wrote: > > > > Hello, users in my domain are getting lots of spam emails from facebook > such as this update+zj4o40c2_...@facebookmail.com > > > > here is the header: > > Return-Path: <no-re...@facebook.com> > > X-Original-To: u...@domain.com > > Delivered-To: user@domain > > Received: from spamfilter.domain.com (spamfilter.domain.com[xx.xx.xx.xx]) > > by mail.domain.com (Postfix) with ESMTP id 4B11A8A03E; > > Mon, 29 Jul 2013 08:25:27 -0700 (PDT) > > Received: from spamfilter.domain.com (localhost [127.0.0.1]) > > by spamfilter.domain.com (Postfix) with ESMTP id 493644562FC; > > Mon, 29 Jul 2013 08:25:35 -0700 (PDT) > > X-Virus-Scanned: amavisd-new at domain.com > > X-Spam-Flag: NO > > X-Spam-Score: -89.515 > > X-Spam-Level: > > X-Spam-Status: No, score=-89.515 tagged_above=-999 required=5.3 > > tests=[BAYES_99=4.5, DKIM_ADSP_ALL=0.8, HTML_MESSAGE=0.001, > > RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_BRBL_LASTEXT=1.449, > > RCVD_IN_XBL=0.375, RDNS_NONE=2.013, USER_IN_WHITELIST=-100] > > This is an amavis question, not a postfix one. If you didn't have > USER_IN_WHITELIST=-100 > In your config this mail would be trapped, or at least marked. > > The postfix solution would be to use the spamcop rbl (since these mails > get logged pretty quick. YMMV. > > Simon > > > autolearn=no > > Received: from spamfilter.domain.com ([127.0.0.1]) > > by spamfilter.domain.com ( [127.0.0.1]) (amavisd-new, port 10024) > > with ESMTP id HYefbh5IrXzZ; Mon, 29 Jul 2013 08:25:33 -0700 (PDT) > > Received: from facebook.com (unknown [173.200.156.65]) > > by spamfilter.domain.com (Postfix) with ESMTP id CBE9B4562E5; > > Mon, 29 Jul 2013 08:25:32 -0700 (PDT) > > Received: from obpabqbbaahjoeoaocj (192.168.1.61) by > obpabqbbaahjoeoaocj. (173.200.156.65) with Microsoft SMTP Server id > 8.0.685.24; Mon, 29 Jul 2013 10:25:46 -0500 > > Message-ID: <51f67c1d.203...@facebook.com> > > Date: Mon, 29 Jul 2013 10:25:46 -0500 > > From: "Facebook" <update+zj4o40c2_...@facebookmail.com> > > User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.9) > Gecko/20101112 Thunderbird/3.1.4 > > MIME-Version: 1.0 > > To: <u...@domain.com>, > > <u...@domain.com> > > Subject: Sara Queen wants to be friends with you on Facebook. > > Content-Type: multipart/alternative; > > boundary="------------07010800404040908030205" > > > > > > Thanks in advance, > > >
