sender maps and whitelisting

[Alex]

HI,

On Mon, Apr 22, 2024 at 10:13 AM Damian <amavis at arcsin.de> wrote:

> I've just started using sender_maps instead of the welcomelist in
> spamassassin directly and have a few questions. Here is my current
> sender_map:
>
> Is this `@score_sender_maps`?
>

Yes, correct.


>    '.gtenney.com' => [{ '.*@send.undone.com'                     => -100.0,
>                         '.*@mg-d0.substack.com'      => -100.0,
>                         '.*@mg-d1.substack.com'       => -100.0,
>                         ....
> First, can you confirm it is only the envelope from that yo can whitelist
> using this method?
>
> Amavis checks envelope-from as well as header-from.
>

Okay, great, thanks.


> @score_sender_maps = ({
>     '.gtenney.com' => [
>         new_RE(
>            [ qr'=gtenney\.com at send\.undone\.com'    => -100],
>            [ qr'=gtenney\.com at mg-d0\.substack\.com' => -100],
>            [ qr'=gtenney\.com at mg-d1\.substack\.com' => -100],
>         ),
>     ],
> });
>
> I was using the hash-type arrays. Would something like this work for the
hash array to represent any sender at this domain?

                         '.email.avi-8.com'                      => -100.0,

> Apr 19 17:21:23 xavier amavis[679593]: (679593-18)
> {"@timestamp":"2024-04-19T21:21:22.452Z","action":["DISCARD","PASS"],"actions_performed":"DiscardedInbound
> RelayedInbound Quarantined","attached_file_names":["message.msg"],"author":"watchrecon.com at gmail.com"]
>
> Looks like a multi-recipient mail, where one of the recipients triggered a
> Discard+Quarantine and the other a Pass.
>

Ah, yes, that looks like the case. I have an always_bcc user being used
here, but it never used to be quarantined, even when the other recipient
was.

I traced the message to the final recipient, and he did receive it, but the
bcc-user did not. What could have changed?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.amavis.org/pipermail/amavis-users/attachments/20240422/fbcdcccd/attachment.htm>