[sniffer] Whitelist HOW?

2013-11-28 Thread A
I want to set an ignore list in my MessageSniffer installation, so I can 
receive FBL complains from major ISP.


Right now I have

bypass
header name='To:' find='abuse@'/
/bypass

white
result code='1'/
header name='To:' find='abuse@'/
/white

However MessageSniffer keep tagging messages as SPAM.


thx
A


#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com



[sniffer] Re: Whitelist HOW?

2013-11-28 Thread Pete McNeil

On 2013-11-28 19:55, A wrote:
I want to set an ignore list in my MessageSniffer installation, so I 
can receive FBL complains from major ISP.




The directives you've set up will adjust GBUdb training, but SNF pattern 
rules will still tag messages if they match.


Normally if you want to globally white-list a particular sender or a 
particular mailbox on your system you would do that within other systems 
that you use to process the messages -- so, for example, you might add a 
rule to your SpamAssassin configuration to white-list all messages going 
to a particular address; or, if you're using SNF with a postfix 
filtering script then you would create some scripting to ignore SNF scan 
results when that mailbox is the recipient; or if you are using one of 
the many Windows based email platforms then you would enter an 
appropriate processing rule in the MTA to bypass all filtering rules etc...


If you want your SNF rulebase to have a custom white-rule then we can 
code that for you -- send a note to support@ describing the custom rule 
you want coded. Be aware, however, that custom white-rules often have 
unwanted side-effects including that they can be discovered and abused 
by attackers.


Hope this helps,

_M


--
Pete McNeil
Chief Scientist
ARM Research Labs, LLC
www.armresearch.com
866-770-1044 x7010
twitter/codedweller


#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com