On 29 Jul 2013 18:38, "motty cruz" <[email protected]> wrote: > > Hello, users in my domain are getting lots of spam emails from facebook such as this [email protected] > > here is the header: > Return-Path: <[email protected]> > X-Original-To: [email protected] > Delivered-To: user@domain > Received: from spamfilter.domain.com (spamfilter.domain.com [xx.xx.xx.xx]) > by mail.domain.com (Postfix) with ESMTP id 4B11A8A03E; > Mon, 29 Jul 2013 08:25:27 -0700 (PDT) > Received: from spamfilter.domain.com (localhost [127.0.0.1]) > by spamfilter.domain.com (Postfix) with ESMTP id 493644562FC; > Mon, 29 Jul 2013 08:25:35 -0700 (PDT) > X-Virus-Scanned: amavisd-new at domain.com > X-Spam-Flag: NO > X-Spam-Score: -89.515 > X-Spam-Level: > X-Spam-Status: No, score=-89.515 tagged_above=-999 required=5.3 > tests=[BAYES_99=4.5, DKIM_ADSP_ALL=0.8, HTML_MESSAGE=0.001, > RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_BRBL_LASTEXT=1.449, > RCVD_IN_XBL=0.375, RDNS_NONE=2.013, USER_IN_WHITELIST=-100]
This is an amavis question, not a postfix one. If you didn't have USER_IN_WHITELIST=-100 In your config this mail would be trapped, or at least marked. The postfix solution would be to use the spamcop rbl (since these mails get logged pretty quick. YMMV. Simon > autolearn=no > Received: from spamfilter.domain.com ([127.0.0.1]) > by spamfilter.domain.com ( [127.0.0.1]) (amavisd-new, port 10024) > with ESMTP id HYefbh5IrXzZ; Mon, 29 Jul 2013 08:25:33 -0700 (PDT) > Received: from facebook.com (unknown [173.200.156.65]) > by spamfilter.domain.com (Postfix) with ESMTP id CBE9B4562E5; > Mon, 29 Jul 2013 08:25:32 -0700 (PDT) > Received: from obpabqbbaahjoeoaocj (192.168.1.61) by obpabqbbaahjoeoaocj. (173.200.156.65) with Microsoft SMTP Server id 8.0.685.24; Mon, 29 Jul 2013 10:25:46 -0500 > Message-ID: <[email protected]> > Date: Mon, 29 Jul 2013 10:25:46 -0500 > From: "Facebook" <[email protected]> > User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.9) Gecko/20101112 Thunderbird/3.1.4 > MIME-Version: 1.0 > To: <[email protected]>, > <[email protected]> > Subject: Sara Queen wants to be friends with you on Facebook. > Content-Type: multipart/alternative; > boundary="------------07010800404040908030205" > > > Thanks in advance, >
