|
Hi Corby,
The best way to determine explicitly what it's
using is to add custom header to the email. There are several you may find
useful, but the one I'm referring to can be added by adding a line
like
XINHEADER X-Note: FROM:
%MAILFROM%
to your Global.cfg file. We add several
headers for diagnostic purposes...
XINHEADER X-Note: Total spam weight of this
E-mail is %WEIGHT%.
XINHEADER X-Note: Spam Tests Failed: %TESTSFAILEDWITHWEIGHTS% XINHEADER X-Note: REMOTEIP: %REMOTEIP% XINHEADER X-Note: REVDNS: %REVDNS% XINHEADER X-Note: FROM: %MAILFROM% XINHEADER X-Note: TO: %RECIPHOST% The FROM address that will be reported there
is exactly what Declude would use when checking against your
whitelists.
REVDNS is almost always a different domain than the
sending address, since most email domains are hosted on common servers.
While you may have reason to block or whitelist on REVDNS, which would be a
different test completely, the FROM whitelist would only need the two entries
you specify.
BTW, though we've been calling it whitelisting, it
is generally recommended to use the "whitelists" as negative weights instead of
true whitelists. That way if something is really bad (i.e. bad enough that
your negative weight doesn't keep it from being tagged, held, or deleted), then
it is still detected. True whitelisting would let it through no matter how
bad it was.
We hold on a weight of 100 and delete on 300, and
have three FROM "whitelists" defined like
FROMWHITELIST_LOW fromfile C:\IMail\Declude\fromwhitelist_low.txt x -100 0
FROMWHITELIST_MED fromfile C:\IMail\Declude\fromwhitelist_med.txt x -200 0 FROMWHITELIST_HIGH fromfile C:\IMail\Declude\fromwhitelist_high.txt x -500 0 We also have FROM blacklists, IP white and black
lists, content-based white and black lists, and test-specific counterweights
that match against MAILFROM and/or REVDNS. We favor adding to
the counterweight tests first, then FROM whitelists, and finally IP whitelists,
though you could argue the order of the last two.
Just another list
member..been using IMail for 5 years or so, and Declude for about 3.5 years
now.
Thanks, man.
Darin. ----- Original Message -----
From: Agid, Corby
Sent: Friday, September 02, 2005 3:03 PM
Subject: RE: [Declude.JunkMail] What Header does Whitelist file
use? Darin,
I'm still confused on what part of the message
converstation would be compared to the whitelist entry. A message
often has a different values for the From Header and the envelope (not
sure if I'm using the correct terms). The Reverse DNS is also different
from the other two. Using the format of .sub.domain.com and
@sub.domain.com, I would have to make six entries to cover all the bases, when
probably the correct two would take care of it.
Suggestions?
BTW,
are you with Declude or a helpful bystander?
Thanks
again for your help and hope you are feeling better.
Corby
|
Title: What Header does Whitelist file use?
- Re: [Declude.JunkMail] What Header does Whitelist file use? Darin Cox
