Karen, This is something that I brought up on the list awhile back with how to avoid this. As we were getting hammered with spam getting to the end user cause they were tagging the whitelisted postmaster account to it.
We do not whitelist the postmaster account, instead you setup a "filter" test that contains an "allrecips" for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a "routeto" back to the postmasters account. What this does is the following [1] Allows all messages regardless of how many spam tests they fail to always be routed to the postmaster [2] If the message contains a user account other than the postmaster the mail will be delivered to the user if the message is under your spam threshold and if it is over your spam threshold whatever action you have specified will then be enacted on that message. Darrell ----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Karen Oland Sent: Thursday, May 29, 2003 12:57 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelist and mult rcpt We've been getting a lot of spam in the last week or so that bypasses all our spam filters -- they are all copied to the postmaster@ account for our domain. Apparently, they are taking advantage of the common practice of whitelisting the postmaster and the inability of spam filtering programs to separate actions on messages sent to multiple users. No doubt, it won't be long before most messages do the same, rendering both your postmaster account and spam filters useless. I know it has been asked for before and said to be "impossible" (programmer speak, for don't want to do it -- I know, being one), but PLEASE consider creating multiple copies of messages that arrive for multiple recipients, so that the spam filters can operate (yes, this means some complications, but a little trickery could reduce problems -- for example, only making a copy for the recipient(s) that are whitelisted). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
