Hi!

I have noticed, that some mail from my whitelist had ended to held folder. It seems, that SpamAssasin operates before whitelist operator, because these messages have been validated as spam by SA.

Could the mailing system work in different order and the whitelist rule would come first?

Tero

I have had messages whitelisted with high SA scores. I don't have any currently in my inbox, however. When I get home, I will work on finding the most recent example I have.

Is it possible that the whitelist entry has problems? Can you post the headers of the message or submit the message for parsing then cancel the report and provide the Tracking URL here so we can see what we are dealing with? Also posting the whitelist entry you have that you think will match may be helpful.

The entry for the whitelist is *.fi. Finns sell so few spam, that I can handle it personaly.

Here's a heading from a blocked .fi -message and I can't figure out, why it has been blocked.


Return-Path: <johanna.kurela[at]kolumbus.fi>
Delivered-To: spamcop-net-tmuhonnen[at]spamcop.net
Received: (qmail 23912 invoked from network); 22 Sep 2006 12:24:00 -0000
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on blade1
X-Spam-Level:
X-Spam-Status: hits=0.8 tests=HTML_MESSAGE,J_CHICKENPOX_21,TW_SY,TW_YY
version=3.1.1
Received: from unknown (192.168.1.103)
by blade1.cesmail.net with QMQP; 22 Sep 2006 12:24:00 -0000
Received: from fe11.mail.saunalahti.fi (62.142.5.26)
by mx53.cesmail.net with SMTP; 22 Sep 2006 12:23:48 -0000
Received: from fep01-app.kolumbus.fi (fep01-0.kolumbus.fi [193.229.0.41])
by fe11.mail.saunalahti.fi (Postfix) with ESMTP id 24E436B0002
for <Tero.Muhonen[at]3angle.fi>; Fri, 22 Sep 2006 15:23:48 +0300 (EEST)
Received: from yournhtv55f634 ([81.197.18.126]) by fep01-app.kolumbus.fi
with SMTP
id <20060922122345.FQAC10406.fep01-app.kolumbus.fi[at]yournhtv55f634>;
Fri, 22 Sep 2006 15:23:45 +0300
Message-ID: <000901c6de41$f5874000$02ffa8c0[at]yournhtv55f634>
From: "Johanna Kurela" <johanna.kurela[at]kolumbus.fi>
To: "Heikki Lahelma" <heikki.lahelma[at]luukku.com>,
"Ilmari Homanen" <ilmari.homanen[at]kolumbus.fi>,
"Pasi Ritoniemi" <pasi.ritoniemi[at]kolumbus.fi>,
"Pekka Mauranen" <pekka.mauranen[at]netti.fi>,
"Ritva Kivi" <ritva.kivi[at]karjalansivistysseura.fi>,
"Sakari Vuoristo" <sakari.vuo[at]phnet.fi>,
"Tero Muhonen" <Tero.Muhonen[at]3angle.fi>
Subject: Yhteenveto juhlasta
Date: Fri, 22 Sep 2006 15:23:49 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0005_01C6DE5B.1A78EA80"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-SpamCop-Checked: 192.168.1.103 62.142.5.26 193.229.0.41 81.197.18.126
X-SpamCop-Disposition: Blocked list.dsbl.org

I may be wrong but I think the entry should be simply

fi

No * or .

That should pick any Email address ending in fi

That said, looks like this example was not trapped by SpamAssassion but by a listing in list.dsbl.org

Andrew

Look at these last two lines:

X-SpamCop-Checked: 192.168.1.103 62.142.5.26 193.229.0.41 81.197.18.126
X-SpamCop-Disposition: Blocked list.dsbl.org

The last IP on the "Checked" line is listed on the "Open relays" list at DSBL.org, and in your SpamCop email settings, you have selected that list (I recommend against it, as I get false positives with that list). In my SpamCop settings, I don't use the "DSBL open relays" or the "SORBS DNSbl."

More important, however, is that you're using a "wildcard" asterisk in your whitelist entry, but you shouldn't. Remove that entry and replace it with this:

fi

Even if you don't remove the "list.dsbl.org" from your settings, mail sent from that source will be whitelisted, and you'll then see this in the headers:

X-SpamCop-Whitelisted: fi

One more unrelated thing....you've used your actual email address as a forum username, but due to web-crawlers, spammers, etc., that's not a good idea. Perhaps Wazoo (the forum admin) can alter your login to protect you?

DT

Spammers love Forum name = e-mail address .. title changed a time or two, still ignored by many ....
SECTION 7 - Change of Username also ignored by many ....

I only do requests .... trying to PM these folks ended up having the Forum-sent notifications of a new PM being reported as spam by way too many people ... others would receive my PM, which pointed to the Announcement which pointed to the FAQ and then decide to give Don/Deputies a hard time ... others stated that they "wanted" their address out there in the glare so they would get more spam .... I soon tired of trying to be proactive about this ....

Which makes perfect sense. Hopefully, our friend from Finland will be back soon and ask you to change the user name.

DT

As stated elsewhere, and in the description on the whitelist page, the whitelist entry should be fi

Thank everyone to find the right form to my whitelist.

My spamcop adress is not the final adress I have and the mail goes thru the same filtering as all my public mail will do. I do not consider it as a problem - as long the mail is filtered.

Tero

Maybe we're being too subtle. Tero, the reason we recommend that you change your username here is that you will probably receive a LOT more spam at that address if it remains unprotected. No matter how good your filters are, some will get through, so it's wise to take the simple step of asking Wazoo to change your username.

DT

Hmmmm ... I consider it an issue, that's why the FAQ entry, the Announcement posting ... JT would rather not have the much un-needed extra traffic coming into his servers .... more spam, more filtering, more storage translates into more processing power, more drive space needed to offset the user complaints of 'slow' service .... so I'm suspecting that it's an issue for him also ...

PM received today

Initial action: finally got around to doing a bit of an update to SECTION 7 - Change of Username .. had meant to this back when I received an 'official' response from IPB staff that adding in code to handle the 'embedded' instances wasn't going to happen.

ok, so then went to look for the remaining instances of the previous username in the Topics/Discussions that tmuhonnen was involved with, as the 'underlined description' was not in fact a link. went through all posts, looking for the usual "quoted", the salutations, etc .... couldn't find any that I had missed previously ....

so then, started looking at content .... gee whiz .... this topic includes an e-mail header, which includes many e-mail addresses ....ok, so now .. 10 months after the fact ....although the ming action did it's thing here ... should this next edit also include deleting of all the (other prople's exposed) matrerial that has been sitting here all this time? Simply noting that by now, it has also been picked up, indexed, and stored in numerous seravh engine listings/databases .....

PM sent with a ponter to 'here' in Reply.

And, while thinking about it, modified the Title/Description of this Topic