|
Markus, in the sample two headers you posted here,
you could whitelist buongiorno.com (not that I would recommend doing so,
however). What Declude JM looks at is the "X-Declude-Sender" address, and
in this case both examples you posted end with buongiorno.com.
What I would recommend doing, if you are running a
version that supports the weighting system, is to use something like the
following in a mailfrom filter file:
MAILFROM -25 CONTAINS .buongiorno.com
or
MAILFROM -25 ENDSWITH
.buongiorno.com
That way you can apply just enough of a
negative weight to the message so that it can be delivered, however, if a
spammer tries to use "buongiorno.com" as a forged sender address, you still have
a fighting chance to block the message with your other spam tests. If you
whitelist the domain, then anything any spammer happens to send to your users
will get delivered if the sender address is forged to be [EMAIL PROTECTED].
Bill
----- Original Message -----
Sent: Thursday, July 03, 2003 2:22
PM
Subject: [Declude.JunkMail] How to
whitelist this?
What's the best
way to whitelist emails like the following two?
Yesterday I've
posted something about buongiorno.com and that they send out a lot of (legit?)
newsletter following the opt-in principle.
whitelisting the
from-domain does not work, because in some of this newsletters the from-domain
it's not buongiorno.com (see second header example below)
As you can see the
messages can come also from different IP's (the first from their italian, the
second one from the austrian Mailer, and I don't know if there are also
others)
Is there anything
else in the header that I can use to reliable whitelist this
messages?
Markus
================
Header 1 ================
Received: from be3a.com [217.27.90.132] by
mail.zcom.it
(SMTPD32-7.15) id A9052AC00C0; Thu, 03 Jul 2003
22:58:45 +0200
Error-To: [EMAIL PROTECTED]Reply-To: CustomerCare <[EMAIL PROTECTED]>
Date: Thu, 3 Jul 2003 17:13:00 CEST
From:
B!Direct <[EMAIL PROTECTED]>
To: info@domain.itSubject: [s241] [03/07] - ProProteggi la tua rete.
Ora.
Content-Type:
multipart/alternative;
boundary="______BoundaryOfDocument______"
MIME-Version:
1.0
Content-Transfer-Encoding: 7bit
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?217.27.90.132X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]X-RBL-Warning:
BADHEADERS: This E-mail was sent from a broken mail client
[c040020f].
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent
with spam [c040020f].
X-RBL-Warning: SPAMCHK: Message failed
SPAMCHK: 105.
X-Declude-Sender:
[EMAIL PROTECTED] [217.27.90.132]
X-Spam-Tests-Failed: SPAMCOP, NOABUSE,
BADHEADERS, SPAMHEADERS, NOLEGITCONTENT, SPAMCHK, WHTLST_DOMAIN, WEIGHT75,
WEIGHT100 [141]
X-Note: Sent from
[EMAIL PROTECTED] - teng1.be3a.com ([217.27.90.132]).
X-Spam-Prob: 0.999833
================
Header 2 ================
Received: from be3a.com [212.239.56.2] by
mail.zcom.it
(SMTPD32-7.15) id A22249200B0; Thu, 03 Jul 2003
21:21:06 +0200
Error-To: [EMAIL PROTECTED]Reply-To: [EMAIL PROTECTED]Date: Thu, 3 Jul 2003 12:00:00 CEST
From: Der Spekulant
<[EMAIL PROTECTED]>
To: info@domain.itSubject: [s106] Bank Austria interessant
Content-Type:
multipart/alternative;
boundary="______BoundaryOfDocument______"
MIME-Version:
1.0
Content-Transfer-Encoding: 7bit
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?212.239.56.2X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]X-RBL-Warning:
BADHEADERS: This E-mail was sent from a broken mail client
[c040020f].
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent
with spam [c040020f].
X-RBL-Warning: SPAMCHK: Message failed
SPAMCHK: 35.
X-Declude-Sender:
[EMAIL PROTECTED] [212.239.56.2]
X-Spam-Tests-Failed: SPAMCOP, NOABUSE,
BADHEADERS, SPAMHEADERS, HEUR10, NOLEGITCONTENT, SPAMCHK, WEIGHT75, WEIGHT100
[106]
X-Note: Sent from [EMAIL PROTECTED] - eng6.be3a.com ([212.239.56.2]).
X-Spam-Prob:
0.999833
|
