How to block some whitelisted in spamassassin
by mfoley from LinuxQuestions.org on (#5EA5C)
I'm having a problem blocking a spammer. The original sender is acgnyc.org. I have this sender listed in my blacklist_from, but it continues to make it through. The problem is that this message is forwarded from a domain that is white_listed, ohprs.org. It seems that the white_list takes precedent over the black_list.
I've also set "shortcircuit ALL_TRUSTED off" hoping that would help, but it does not (assuming plugin Mail::SpamAssassin::Plugin::Shortcircuit is loaded. How would I check that?)
"shortcircuit USER_IN_WHITELIST" is still "on".
Below is the header from the offending email.
Do I have any way of solving this? Is there a way of specifying blacklist-before-whitelist?
Code:From hprsadmin@ohprs.org Wed Feb 17 10:10:32 2021
Authentication-Results: server.novatec-inc.com;
dkim=pass (1024-bit key) header.d=acgnyc.org header.i=events@acgnyc.org header.b=oJensLuq
Authentication-Results: spf=pass (sender IP is 209.18.70.10)
smtp.mailfrom=send.acgnyc.org; ohprs.org; dkim=pass (signature was verified)
header.d=acgnyc.org;ohprs.org; dmarc=bestguesspass action=none
header.from=acgnyc.org;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=rmagnet; d=acgnyc.org;
h=Date:From:To:Subject:Reply-To:MIME-Version:Content-Type:Message-ID;
i=events@acgnyc.org;
bh=3k3VA9pz1N0uIrY6pbwBNb+ZpbcEql8asshfHtgFkJc=;
b=oJensLuq5bJ1Gu39opXP7OPxljRqN7sH86KyKWIeyQm2c6RMB/9c6sU8mhplEhYyYkRN8i9/rjPP
h3ruGVHMEKRxzeLNTsQcuyq7bpWUHRJNhjCbt7cN9fSqrYAp6a5x/+MvaCnmZ2ZMjX0Z6gQ919G6
vC0HmsvnITZacpYz71s=
Date: Wed, 17 Feb 2021 10:07:51 -0500
From: "ACG New York" <events@acgnyc.org>
To: <mark@ohprs.org>
Subject: What past attendees have to say about ACG NY's Annual Women of Leadership Summit
X-Spam-Status: No, score=-91.8 required=5.0 tests=BAYES_50,
HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,LOCAL_HPRS_PORTAL,
MIME_QP_LONG_LINE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=no autolearn_force=no
version=3.4.4-_revision__1.0__
X-Spam-Report:
* -0.0 USER_IN_WELCOMELIST user is listed in 'welcomelist_from'
* -100 USER_IN_WHITELIST DEPRECATED: See USER_IN_WELCOMELIST
I've also set "shortcircuit ALL_TRUSTED off" hoping that would help, but it does not (assuming plugin Mail::SpamAssassin::Plugin::Shortcircuit is loaded. How would I check that?)
"shortcircuit USER_IN_WHITELIST" is still "on".
Below is the header from the offending email.
Do I have any way of solving this? Is there a way of specifying blacklist-before-whitelist?
Code:From hprsadmin@ohprs.org Wed Feb 17 10:10:32 2021
Authentication-Results: server.novatec-inc.com;
dkim=pass (1024-bit key) header.d=acgnyc.org header.i=events@acgnyc.org header.b=oJensLuq
Authentication-Results: spf=pass (sender IP is 209.18.70.10)
smtp.mailfrom=send.acgnyc.org; ohprs.org; dkim=pass (signature was verified)
header.d=acgnyc.org;ohprs.org; dmarc=bestguesspass action=none
header.from=acgnyc.org;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=rmagnet; d=acgnyc.org;
h=Date:From:To:Subject:Reply-To:MIME-Version:Content-Type:Message-ID;
i=events@acgnyc.org;
bh=3k3VA9pz1N0uIrY6pbwBNb+ZpbcEql8asshfHtgFkJc=;
b=oJensLuq5bJ1Gu39opXP7OPxljRqN7sH86KyKWIeyQm2c6RMB/9c6sU8mhplEhYyYkRN8i9/rjPP
h3ruGVHMEKRxzeLNTsQcuyq7bpWUHRJNhjCbt7cN9fSqrYAp6a5x/+MvaCnmZ2ZMjX0Z6gQ919G6
vC0HmsvnITZacpYz71s=
Date: Wed, 17 Feb 2021 10:07:51 -0500
From: "ACG New York" <events@acgnyc.org>
To: <mark@ohprs.org>
Subject: What past attendees have to say about ACG NY's Annual Women of Leadership Summit
X-Spam-Status: No, score=-91.8 required=5.0 tests=BAYES_50,
HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,LOCAL_HPRS_PORTAL,
MIME_QP_LONG_LINE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=no autolearn_force=no
version=3.4.4-_revision__1.0__
X-Spam-Report:
* -0.0 USER_IN_WELCOMELIST user is listed in 'welcomelist_from'
* -100 USER_IN_WHITELIST DEPRECATED: See USER_IN_WELCOMELIST