On Monday 22 January 2007 11:39, you wrote: > Sherman Lilly wrote: > > I have spam getting through that would get filtered if they were not > > getting -100 because of the USER_IN_WHITELIST rule. I do have a whitelist > > but no of these spam email have anything close to my whitelist. > > Yes they do, otherwise you wouldn't see USER_IN_WHITELIST hitting. > > It's probably hitting on whatever the envelope from address is (found in > the Return-Path header). Most of the time this happens when people > whitelist their own domain using whitelist_from. > > > Daryl
Daryl, You are completely right. I have whitelisted my domain and when I remove that rule from my cf the bad emails get blocked. Here is the header of an email that is getting through. It should have failed. The rule is WHITELIST_FROM [EMAIL PROTECTED] Here is the header. Return-Path: <[EMAIL PROTECTED]> Delivered-To: unknown Received: from 10.155.0.68 (10.155.0.68) by imap.knoxcounty.org with POP3; 22 Jan 2007 13:02:37 -0000 X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on mail.knoxcounty.org X-Spam-Level: X-Spam-Status: No, score=-80.4 required=4.6 tests=EXTRA_MPART_TYPE, HELO_DYNAMIC_DHCP,HELO_DYNAMIC_IPADDR,HTML_FONT_BIG, HTML_IMAGE_ONLY_08,HTML_MESSAGE,MY_CID_AND_CLOSING,MY_CID_AND_STYLE, PART_CID_STOCK,PART_CID_STOCK_LESS,RCVD_IN_SORBS_DUL,SARE_GIF_ATTACH, SARE_GIF_STOX,TVD_FW_GRAPHIC_ID1,UNPARSEABLE_RELAY,USER_IN_WHITELIST autolearn=disabled version=3.1.7 Received: from winserv-dp-9880 ([10.155.0.69]) by mail.knoxcounty.org (8.13.8/8.11.6) with SMTP id l0LGfODE015790 for <[EMAIL PROTECTED]>; Sun, 21 Jan 2007 11:41:32 -0500 Received: from dsl-189-136-76-104.prod-infinitum.com.mx ([189.136.76.104]) by winserv-dp-9880 (SMSSMTP 4.0.0.59) with SMTP id M2007012111435603309 for <[EMAIL PROTECTED]>; Sun, 21 Jan 2007 11:43:56 -0500 Received: from el-molino.com (port=15590 helo=hsjyatbrlvpmk) by dsl-189-136-76-104.prod-infinitum.com.mx with smtp id 1dKU-cxFT-JI for [EMAIL PROTECTED]; Sun, 21 Jan 2007 10:41:25 -0600 Message-ID: <[EMAIL PROTECTED]> From: "John" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: work: thou shalt see not hold of before the race is I: will make Date: Sun, 21 Jan 2007 10:41:25 -0600 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000B_01C73D48.AF3EDA20" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-Length: 17836 X-UID: 2691 Thank You, Sherman
