Hello,
I'm getting a bunch of spam from [EMAIL PROTECTED]
I've attempted to blacklist it via
blacklist_from [EMAIL PROTECTED]
but the messages are not getting blacklisted.
Mar 23 11:25:24 urim sendmail[6285]: i2NGPOmx006285: from=<[EMAIL PROTECTED]>, size=9856, class=0, nrcpts=1, msgid=<q6Lv10,[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=ursa.calvin.edu [153.106.4.1]
Any ideas why?
Alton, you're looking at the sendmail logs, which contain the ENVELOPE from.. however, spamassassin never gets a copy of the envelope..
Thus, blacklist_from winds up matching the actual From: line in the message itself, unless your MTA inserts envelope senders into the message headers before SA is called (not all do this).
Check the messages in question, does the From: header match the envelope from?
