> -----Original Message-----
> From: Ragnar Paulson [mailto:ragnar@wanware.com]
> Sent: Wednesday, March 10, 2004 2:57 PM
> To: spamassassin-users@incubator.apache.org
> Subject: *****SPAM***** Spoofing, whitelist, whitelist_from_rcvd
>
>
>
> There's been an lot of discussion lately about detection of
> forgeries ... however I wonder why the existing mechanisms
> don't work! In
> the e-mail below this message apparently was "whitelisted" by
> the default "whitelist_from_rcvd" rules for amazon.com. I do not
> have "amazon.com", nor "sun.com" in my personal whitelist.
> Yet from the 2nd line of the message it is apparent that this message
> did not come "amazon.com" at all. It came from
> "va-hopewell2-15.adelphia.net". Why was this message given
> a -100 score?
>
> Ragnar
>
>
> version=2.54-sentinet
> X-Spam-Level:
> X-Spam-Checker-Version: SpamAssassin 2.54-sentinet
*snip*
It is a built in WL for that version of SA. SA 2.54 was considered a poor
release when it came to negative scores. They have been, and continue to be,
abused like a redheaded stepchild. Many people prefered to go back to 2.4x
instead of the 2.5x series.
--chris
> From: Ragnar Paulson [mailto:ragnar@wanware.com]
> Sent: Wednesday, March 10, 2004 2:57 PM
> To: spamassassin-users@incubator.apache.org
> Subject: *****SPAM***** Spoofing, whitelist, whitelist_from_rcvd
>
>
>
> There's been an lot of discussion lately about detection of
> forgeries ... however I wonder why the existing mechanisms
> don't work! In
> the e-mail below this message apparently was "whitelisted" by
> the default "whitelist_from_rcvd" rules for amazon.com. I do not
> have "amazon.com", nor "sun.com" in my personal whitelist.
> Yet from the 2nd line of the message it is apparent that this message
> did not come "amazon.com" at all. It came from
> "va-hopewell2-15.adelphia.net". Why was this message given
> a -100 score?
>
> Ragnar
>
>
> version=2.54-sentinet
> X-Spam-Level:
> X-Spam-Checker-Version: SpamAssassin 2.54-sentinet
*snip*
It is a built in WL for that version of SA. SA 2.54 was considered a poor
release when it came to negative scores. They have been, and continue to be,
abused like a redheaded stepchild. Many people prefered to go back to 2.4x
instead of the 2.5x series.
--chris