Chris wrote: > I've got an FN that showed up in my inbox, the above tag with -15 for a > score is keeping it from being tagged as spam. I've ran spamassassin -R and > spamassassin --remove-addr-from-whitelist= That command only affects the AWL. It does not affect the real whitelists. > however the its still got the > tag. Where is the default whitelist and how can I remove this address? > it's in /usr/share/spamassassin/60_whitelist.cf.
Also, if your false-positive is a forged email, make sure your trusted_networks is set properly. If SA is mis-trusting headers, it may cause whitelist_from_rcvd type rules to match for forgeries. http://wiki.apache.org/spamassassin/TrustPath Note: that page mentions whitelist_from_rcvd not matching as a symptom.. this is true, but trust path problems can also go the other way and cause it to match more than it should. I would also suggest that if there is an entry there that's causing you problems, and it's not caused by mis-parsing, let us know about it.
