Here is the full header. But also the local.cf has around 12000 entries, is that a problem.
Received: from nyclns01.languageworks.com ([192.168.20.60])
by NYCDML02.languageworks.com (Lotus Domino Release 7.0.3)
with ESMTP id 2008031109551545-44621 ;
Tue, 11 Mar 2008 09:55:15 -0400
Received: from smtp1.citigroup.com ([199.67.179.116]
helo=mail.citigroup.com)
by nyclns01.languageworks.com with esmtps
(TLSv1:AES256-SHA:256)
(Exim 4.66)
(envelope-from <[EMAIL PROTECTED]>)
id 1JZ4xk-0008OC-Om
for [EMAIL PROTECTED]; Tue, 11 Mar 2008 09:56:25
-0400
Received: from imbarc-nj01.nj.ssmb.com (imbarc-nj01-2 [150.110.115.169])
by imbaspam-nj03.iplex.ssmb.com
(8.13.8/8.13.8/SSMB_EXT/ev: 16778 $) with ESMTP id m2BDuCkL008560
for <[EMAIL PROTECTED]>; Tue, 11 Mar 2008 13:56:15
GMT
Received: from mailhub-nj04-1.nj.ssmb.com (mailhub-nj04-2.nj.ssmb.com
[150.110.236.237])
by imbarc-nj01.nj.ssmb.com (8.13.8/8.13.8/SSMB_QQQ_IN/1.1)
with ESMTP id m2BDu7hi010772
for <[EMAIL PROTECTED]>; Tue, 11 Mar 2008 13:56:07
GMT
Received: from exnmdsm03.nam.nsroot.net (EXNMDSM03.nam.nsroot.net
[169.193.142.69])
by mailhub-nj04-1.nj.ssmb.com (8.13.8/8.13.8/CG_HUB) with
ESMTP id m2BDu1Qx017430
for <[EMAIL PROTECTED]>; Tue, 11 Mar 2008 13:56:07
GMT
Received: from extxmb09.nam.nsroot.net ([165.203.15.26]) by
exnmdsm03.nam.nsroot.net with Microsoft SMTPSVC(5.0.2195.6713);
Tue, 11 Mar 2008 09:55:48 -0400
X-MimeOLE: Produced By Microsoft Exchange V6.0.6619.12
MIME-Version: 1.0
Disposition-Notification-To: "Brown, Vicci [GCG-CFNA]"
<[EMAIL PROTECTED]>
Subject: RE: ESTIMATE - WI #80272(7/96)
Date: Tue, 11 Mar 2008 08:55:46 -0500
Message-ID:
<[EMAIL PROTECTED]>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: ESTIMATE - WI #80272(7/96)
Thread-Index: AciDfpUqgb/6PeTNR9KYDZKznHoijgAAVcNw
From: "Brown, Vicci " <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 11 Mar 2008 13:55:48.0027 (UTC)
FILETIME=[9BEEE8B0:01C8837F]
X-Scanned-By: MIMEDefang 2.52 on 199.67.177.247
X-Spam-Score: 5.7 (+++++)
X-Spam-Report: Spam detection software, running on the system
"nyclns01.languageworks.com", has
identified this incoming email as possible spam. The
original message
has been attached to this so you can view it (if it isn't
spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: I have faxed back the authorized quote,
please confirm receipt
_____ From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Sent:
Tuesday, March 11, 2008 8:47 AM To: Brown, Vicci
[GCG-CFNA] Cc: Beaudette,
Kathleen M [GCG-CFNA]; Yasmin Menon Subject: ESTIMATE - WI
#80272(7/96) [...]
Content analysis details: (5.7 points, 10.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at
http://www.dnswl.org/, medium
trust
[199.67.179.116 listed in list.dnswl.org]
1.0 EXTRA_MPART_TYPE Header has extraneous
Content-type:...type= entry
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.8 SUBJ_ALL_CAPS Subject is all capitals
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 SARE_GIF_ATTACH FULL: Email has a inline gif
1.5 MY_CID_AND_ARIAL2 SARE CID and Arial2
4.0 SARE_FORGED_CITI Message appears to be forged,
(citibank.com)
X-MIMETrack: Itemize by SMTP Server on
NYCDML02/Server/LanguageWorks(Release 7.0.3|September
26, 2007) at 03/11/2008 09:55:15 AM,
Serialize by Notes Client on Brett
Hyatt/LanguageWorks(Release 7.0.2|September
26, 2006) at 03/11/2008 10:51:18 AM
content-class: urn:content-classes:message
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----_=_NextPart_001_01C8837F.9AE5BBA2"
------_=_NextPart_001_01C8837F.9AE5BBA2
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01C8837F.9AE5BBA2"
------_=_NextPart_002_01C8837F.9AE5BBA2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
Jeremy Davila
Systems Administrator
Direct: 646-205-2136
The LanguageWorks, Inc.
1123 Broadway, Suite 201
New York, NY 10010
The LanguageWorks, Inc. is an ISO 9001:2000 certified company which:
"Facilitates global communication by providing foreign language
translation, editing, proofreading, and cultural analysis. Additional
services include on-site interpreting and document review, foreign
language page layout, conversion of web sites into multiple languages, and
multilingual voice-overs for radio spots and video productions."
CONFIDENTIALITY NOTICE:
The information in this E-Mail may be confidential and may be legally
privileged. It is intended solely for the addressee(s). If you are not the
intended recipient, any disclosure, copying, distribution or any action
taken or omitted to be taken in reliance on this E-Mail, is prohibited and
may be unlawful. If you have received this E-Mail message in error, notify
the sender by reply E-Mail and delete the message.
Randy Ramsdell <[EMAIL PROTECTED]>
03/11/2008 05:22 PM
To
users@spamassassin.apache.org
cc
Subject
Re: Whitelist Question
[EMAIL PROTECTED] wrote:
>
> Here is the header info. What is the alternate solution to using
> whitelist_from ? I been also trying to setup AWL via MySQL.....no
> luck on that.
> I use Exim for mail then , it relays to Lotus Domino.....if that helps.
>
>
> Content analysis details: (5.7 points, 10.0 required)
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at
> http://www.dnswl.org/, medium
> trust
> [199.67.179.116 listed in list.dnswl.org]
> 1.0 EXTRA_MPART_TYPE Header has extraneous
> Content-type:...type= entry
> -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
> 1.8 SUBJ_ALL_CAPS Subject is all capitals
> -0.0 SPF_PASS SPF: sender matches SPF
record
> 0.0 HTML_MESSAGE BODY: HTML included in
message
> 1.4 SARE_GIF_ATTACH FULL: Email has a inline gif
> 1.5 MY_CID_AND_ARIAL2 SARE CID and Arial2
>
>
This isn't the full header. A full header will show exactly what to
whitelist.
1. Did you restart spamd or amavis/spamd?
>
> On Tue, 11 Mar 2008, [EMAIL PROTECTED] wrote:
>
> > I add users to whitelist in the local.cf file "whitelist_from
> > [EMAIL PROTECTED]" but they still get tagged as Spam, is there a
> > altnerative solution.
>
> (2) Post *all* the headers from a message that was incorrectly marked as
> spam, as well as the whitelist command you put in that you think should
> have whitelisted that message.
>
<<image/gif>>
<<image/gif>>
<<image/gif>>
