Jon Etkins Sent: Thursday, May 06, 2004 1:08 AM > I received the following Nigerian scam today. What makes it > interesting is the fact that it picked up a -100 for supposedly being > in my whitelist, yet my whitelist contains nothing even remotely > resembling the FROM address used. I do, however, have a wildcard entry > for ebay.com (which I'll now go change); is it possible that this got > whitelisted because of the bogus Return-Path?
Check out whitelist_from_rcvd on http://useast.spamassassin.org/doc/Mail_SpamAssassin_Conf.html The idea is that you set a second config option that specifies what domain the IP that passes you messages from [EMAIL PROTECTED] should reverse to. Ebay.com is a good guess. That would have worked here because in this case the server handing off the message to you reverses to wanado.nl not ebay.com. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz
