<div dir="ltr"><div dir="ltr">HI,<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 22, 2024 at 10:13 AM Damian <<a href="mailto:amavis@arcsin.de">amavis@arcsin.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>

  
    
  
  <div>
    <blockquote type="cite">
      <pre>I've just started using sender_maps instead of the welcomelist in
spamassassin directly and have a few questions. Here is my current
sender_map:</pre>
    </blockquote>
    Is this `@score_sender_maps`?</div></blockquote><div><br></div><div>Yes, correct.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
    <blockquote type="cite">
      <pre>   '.<a href="http://gtenney.com" target="_blank">gtenney.com</a>' => [{ '.*@<a href="http://send.undone.com" target="_blank">send.undone.com</a>'                     => -100.0,
                        '.*@<a href="http://mg-d0.substack.com" target="_blank">mg-d0.substack.com</a>'      => -100.0,
                        '.*@<a href="http://mg-d1.substack.com" target="_blank">mg-d1.substack.com</a>'       => -100.0,
                        ....
First, can you confirm it is only the envelope from that yo can whitelist
using this method?
</pre>
    </blockquote>
    Amavis checks envelope-from as well as header-from.<br></div></blockquote><div><br></div><div>Okay, great, thanks.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
    <p>
      </p><blockquote type="cite">@score_sender_maps = ({<br>
            '.<a href="http://gtenney.com" target="_blank">gtenney.com</a>' => [<br>
                new_RE(<br>
                   [ qr'=gtenney\.com@send\.undone\.com'    => -100],<br>
                   [ qr'=gtenney\.com@mg-d0\.substack\.com' => -100],<br>
                   [ qr'=gtenney\.com@mg-d1\.substack\.com' => -100],<br>
                ),<br>
            ],<br>
        });<br></blockquote></div></blockquote><div>I was using the hash-type arrays. Would something like this work for the hash array to represent any sender at this domain?<br><br></div><div>                         '.<a href="http://email.avi-8.com">email.avi-8.com</a>'                      => -100.0,</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><blockquote type="cite"><pre>Apr 19 17:21:23 xavier amavis[679593]: (679593-18)
{"@timestamp":"2024-04-19T21:21:22.452Z","action":["DISCARD","PASS"],"actions_performed":"DiscardedInbound
RelayedInbound Quarantined","attached_file_names":["message.msg"],"author":"
<a href="mailto:watchrecon.com@gmail.com" target="_blank">watchrecon.com@gmail.com</a>"]
</pre>
    </blockquote>
    Looks like a multi-recipient mail, where one of the recipients
    triggered a Discard+Quarantine and the other a Pass.<br></div></blockquote><div><br></div><div>Ah, yes, that looks like the case. I have an always_bcc user being used here, but it never used to be quarantined, even when the other recipient was.</div><div><br></div><div>I traced the message to the final recipient, and he did receive it, but the bcc-user did not. What could have changed?</div><div><br></div><div><br></div><div><br></div><div><br></div><div> </div></div></div>