[H-GEN] Spamassassin whitelist_from not working?

[Greg Black]

On 2009-02-13, David Duffy (AVD) wrote:

> OK, I've worked out what is happening. I was getting spam that had
> forged email addresses in our own domain. They were getting a large
> negative spam score applied which lets them pass as valid (not spam) emails.
> 
> I had zeroed the score for user_in_whitelist, forgetting that this would
> affect all the whitelist_from rules I had added.
> 
> So, how can I reject the emails with a forged email address (our domain)
> but still use the whitelist?

I reject all incoming mail that purports to be from my domains if it
comes from outside very early in my processing -- long before it gets to
any anti-spam tools such as SpamAssassin.  I can't tell you how to do
that in your case, as I don't recall your tool chain; but it should be
simple enough to handle with any half-decent MTA.

Greg