On 02/21, Michelle Konzack wrote: > There are arround 30 IPs which are in this RCVD_IN_DNSWL_MED. The first > one is <http://www.electronica.tamay-dogan.net/spamassassin/1297982870>. > and it has started arround 3 weeks ago.
One of your users subscribed to the debian-m...@lists.debian.org mailing list. You should add that IP (82.195.75.100, liszt.debian.org) address to your spamassassin trusted_networks so, as Matthias said, your network tests like DNSWL and zen (blacklists) are testing the IP address that delivered the email to liszt.debian.org, because in this case, liszt.debian.org is a trusted relay, which your user has requested mail from. And if you're getting that much spam from them, you may want to contact the Debian folks about their spam forwarding problem. This problem really needs to be documented better. Or something. Maybe add some IPs to a default trusted_networks? -- "Go forth, and be excellent to one another." - http://www.jhuger.com/fredski.php http://www.ChaosReigns.com
