Am 12.09.2016 um 15:37 schrieb David Jones:
Has RCVD_IN_SORBS_WEB been considered for adjustment as well? It's
hitting a lot more ham than spam here, including mail from facebook.
You should be safely whitelisting any major senders like Facebook at
the MTA level and in SA:
whitelist_auth *@amazonses.com
for sure *not* since that would whitelist anything hosted on the amazon
cloud instances which is *not* amazon stuff itself
don't confuse major good senders with hosted crap of endcustomers
@amazonses.com != @amazon.com
the same for "whitelist_auth *@icloud.com"
[root@mail-gw:~]$ cat maillog | grep
01000157007004fc-dd484ffc-155c-48dc-8a7d-b9fbc51b7094-000...@email.amazonses.com
Sep 6 18:58:47 mail-gw postfix/cleanup[5554]: 3sTCVH11mDz9bQ:
message-id=<01000157007004fc-dd484ffc-155c-48dc-8a7d-b9fbc51b7094-000...@email.amazonses.com>
Sep 6 18:58:52 mail-gw spamd[1086]: spamd: result: Y 14 -
BAYES_99,BAYES_999,BOGOFILTER_SPAM,CUST_DNSBL_19_SPAMCANN,CUST_DNSWL_5_ORG_N,CUST_DNSWL_8_TL_N,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,RCVD_IN_MSPIKE_H2,RP_MATCHES_RCVD,SPF_PASS,T_OBFU_ATTACH_MISSP,URIBL_LOCAL
scantime=5.0,size=13908,user=sa-milt,uid=189,required_score=5.5,rhost=localhost,raddr=127.0.0.1,rport=/run/spamassassin/spamassassin.sock,mid=<01000157007004fc-dd484ffc-155c-48dc-8a7d-b9fbc51b7094-000...@email.amazonses.com>,bayes=1.000000,autolearn=disabled,shortcircuit=no
