On Wed, Nov 29, 2006 at 10:22:11AM -0500, Stas Khromoy wrote: > *keep getting the following spam > which spamassassin for some reason > give a scrore of -100 or - 70 > keeps saying the user is in whitelist > > > > Subject:* both of those that is of the people, of the Lord your words of > subject :me: a certain man that hear O house of man from among the land > of our > or other of similar context .. they look like quotes from the bible :) > > > with offers to buy some crap from > s a b a n z e n dot com > > X-Spam-Status: No, score=-74.498 tagged_above=-150 required=3 > tests=[BAYES_80=2, EXTRA_MPART_TYPE=1.091, HELO_DYNAMIC_IPADDR2=3.818, > HTML_IMAGE_ONLY_08=3.126, HTML_MESSAGE=0.001, RCVD_IN_DYNABLOCK=1, > RCVD_IN_NJABL_DUL=1.946, RCVD_IN_SBL_XBL=1.5, RCVD_IN_SORBS=1, > RCVD_IN_SORBS_DUL=2.046, RCVD_IN_XBL=3.897, SARE_GIF_ATTACH=0.75, > SARE_GIF_STOX=1.66, SARE_RECV_SPAM_DOMN0b=1.666, > UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] > > > i can't think of anything at this point aside from getting rid of the > old whitelist and starting a new one. >
Hi Stas, I am betting that the "envelope-sender" is the user that is in the whitelist and you are looking at the "from" address and thinking that the "from" address is not in the whitelist. We have run into a fair amount of the above situation on our system. I think it might be a good idea to make USER_IN_WHITELIST have a score of ~ -15 instead of ~100. --Greg
