- -1.204 AWL From: address is in the auto white-list
- -15.000 USER_IN_DEF_WHITELIST From: address is in the default white-
list
- -100.000 USER_IN_WHITELIST From: address is in the user's white-list
- -100.000 USER_IN_SPF_WHITELIST From: address is in the user's SPF
whitelist
Says here you have the sender in four different local whitelists.
Whitelists don't come with the normal SA install, and while there is a SARE
whitelist, it didn't hit. I don't know where these four whitelists came
from, but they are assuredly the reason that the message is making it to
you, despite Bayes thinking it is spam.
FWIW, it appears that this mail is legitimately from who it says it is, or
at least SPF seems to think so.
Loren
BTW, I'm not familiar with openproject, but SARE rules come from
RulesEmporium. www.rulesemporium.com.
----- Original Message -----
From: "David Morton" <[EMAIL PROTECTED]>
To: <users@spamassassin.apache.org>
Sent: Friday, December 08, 2006 10:37 PM
Subject: efax spam being marked as -212 ???
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I've been getting an occasional efax spam that registers -212... I'm
using SA 3.1.7 and SARE rules from openprotect:
/var/lib/spamassassin/3.001007/saupdates_openprotect_com/
70_sare_whitelist.cf
/var/lib/spamassassin/3.001007/updates_spamassassin_org/60_whitelist.cf
/usr/local/share/spamassassin/60_whitelist.cf
3.500 BAYES_99 Bayesian spam probability is 99 to 100%
0.135 FORGED_RCVD_HELO Received: contains a forged HELO
0.001 HTML_MESSAGE HTML included in message
- -0.001 SPF_PASS SPF: sender matches SPF record
- -1.204 AWL From: address is in the auto white-list
- -15.000 USER_IN_DEF_WHITELIST From: address is in the default white-
list
- -100.000 USER_IN_WHITELIST From: address is in the user's white-list
- -100.000 USER_IN_SPF_WHITELIST From: address is in the user's SPF
whitelist
FROM: "eFax" <[EMAIL PROTECTED]>
TO: [EMAIL PROTECTED]
SUBJECT: eFax from unknown - 1 page(s)
Doesn't this seem just a little bit extreme? Or flat out WRONG? :)
David Morton
Maia Mailguard http://www.maiamailguard.com
[EMAIL PROTECTED]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iD8DBQFFelmxUy30ODPkzl0RAmfrAJ9NqOr+L06Jyp/SE/oOdOrOiftlfgCfXIf9
B0A34cE/K9emDm4J1ZTIXAE=
=lL5N
-----END PGP SIGNATURE-----
