spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From redtailjason <>
Subject Configuration Help Request: Spoofed Email Being Whitelisted
Date Wed, 30 Mar 2016 13:23:18 GMT
Hello. We are seeing an issue where spoofed spam is being whitelisted to our
domain. We host over 10,000 mailboxes but the issue is only occurring to
within our corporate domain. I have checked all local configs on our eight
scanners and do not show that our domain has been whitelisted. 

Our primary SpamAssassin technician left the company unexpectedly and I am
working to learn the ins and outs of SA. Our system uses Symantec Secure
Messaging Gateway as our gateway. It then hands off the email to SA for

I believe this may be related to a particular configuration within
SpamAssassin, Amavis, or Postfix but I am having trouble isolating it. Any
help you may be able to provide would be greatly appreciated. 

Below is an excerpt from the headers of an example. Please let me know what
additional information you may need to know. 

Received: from (LHLO 
 ( by with LMTP; Wed, 30 Mar 2016 
 04:50:54 -0700 (PDT) 
Received: from (localhost []) 
        by (Postfix) with ESMTPS id 8D1AC241E6 
        for <>; Wed, 30 Mar 2016 04:50:54
-0700 (PDT) 
Received: from (localhost []) 
        by (Postfix) with ESMTPS id 60A7E2419F 
        for <>; Wed, 30 Mar 2016 04:50:54
-0700 (PDT) 
Received: from (unknown []) 
        by (Postfix) with ESMTP id 0D46E23040 
        for <>; Wed, 30 Mar 2016 04:50:54
-0700 (PDT) 
Received: from localhost (localhost []) 
        by (Postfix) with ESMTP id
        for <>; Wed, 30 Mar 2016 04:50:54
-0700 (PDT) 
X-Virus-Scanned: Debian amavisd-new at 
X-Spam-Flag: NO 
X-Spam-Score: 0 
X-Spam-Status: No, score=x tagged_above=-999 required=6 WHITELISTED tests=[] 
Received: from ([IPv6:::ffff:]) 
        by localhost ( [::ffff:])
(amavisd-new, port 10024) 
        with ESMTP id d8lTFWK8x7HI for <>; 
        Wed, 30 Mar 2016 04:50:54 -0700 (PDT) 
Received: from (unknown
        by (Postfix) with ESMTP id
        for <>; Wed, 30 Mar 2016 04:50:54 -0700
X-AuditID: c0a805fa-f79cd6d000005f93-77-56fbbd9dffc7 
Received: from [] (Unknown_Domain []) 
        by (Symantec Messaging
Gateway) with SMTP id 69.3E.24467.E9DBBF65; Wed, 30 Mar 2016 04:50:54 -0700
From: EPSON <>
To: "" <>
Subject: Emailing: docment_445.tiff 
Thread-Topic: Emailing: docment_445.tiff 
Thread-Index: AdF19gcy1pI0QqthRiW4cvvoSHimaQ== 
Date: Wed, 30 Mar 2016 17:20:47 +0530 
Message-ID: <> 
Accept-Language: en-US 
Content-Language: en-US 
X-MS-Has-Attach: yes 
x-originating-ip: [] 
Content-Type: multipart/mixed; 
MIME-Version: 1.0 
X-MXScan-Scan: Scanned by MxScan 2.7.501.0 for WIN-3EAMS8MV18J 
X-MXScan-Msgid: 11014316981197995070449318587208_ 
X-MXScan-License: {Unregistered Version} Only for personal and
non-commercial use. Commercial use is PROHIBITED and requires a license. 
X-MXScan-AntiVirus: ClamAV devel-clamav-0.97-408-ge11f7cc/21435/Wed, 30 Mar
2016 17:20:47 +0530 [Clean] 
X-MXScan-SpamScore: 0 
X-MXScan-ProcessingTime: 5.063 sec(s) 
X-ME-Bayesian: 0.000000

View this message in context:
Sent from the SpamAssassin - Users mailing list archive at

View raw message