On Thu, Oct 19, 2017 at 6:22 PM, Bill Cole <sausers-20150...@billmail.scconsult.com> wrote: > On 19 Oct 2017, at 17:59 (-0400), Alex wrote: > >> Hi, >> >> On Thu, Oct 19, 2017 at 4:04 PM, Bill Cole >> <sausers-20150...@billmail.scconsult.com> wrote: >>> >>> On 19 Oct 2017, at 15:38 (-0400), Alex wrote: >>> >>>> Third day, third set of false-negatives (20 this time) whitelisted >>>> through mailchimp >>>> >>>> https://pastebin.com/6vkxNXxX >>>> >>>> I had removed the mcsv.net but forgot mcdlv.net. It's still not being >>>> tagged properly without the whitelisting. >>> >>> >>> >>> That one hit USER_IN_SPF_WHITELIST, so you're still whitelisting it. Did >>> you >>> restart amavisd after changing the rules? >> >> >> As I mentioned just above the link in this message, yes, the domain >> was whitelisted. I've since removed it from the whitelist, but the >> email still is not tagged by spamassassin. > > > So, do you have an example of a message that didn't hit > USER_IN_SPF_WHITELIST? One you got AFTER removing your whitelisting rule? > I ask because the sample message also shows a SHORTCIRCUIT hit, which is > probably due to your USER_IN_SPF_WHITELIST rule being short-circuited but > maybe due to something else. SHORTCIRCUIT does as it is documented to do: if > there are pending DNS queries for evil URLs in a message when a > short-circuited rule is hit, their answers are ignored.
Why wouldn't you just run the sample I provided through spamassassin again? My apologies if it wasn't clear that I've run the message through spamassassin after having removed mailchimp from the whitelist and it still is not properly tagged as spam. I've reported all of them to mailchimp and added some basic body rules that are specific to this message, but it seems to me this represents a larger problem. There were others received that were tagged properly and not whitelisted because they involved my specific body rules.
