Re: white_list is not working.....HELP!

Tony Guadagno wrote:
> Bowie,
> thanks for your response. Here is the test message
>
>
> MAIL FROM:<xx@xx.com> SIZE=3803
> RCPT TO:<txx@gxxo.org>
> Received: from smtpgw02.fujifilmesys.net ([65.249.152.151])
> by mail.guadagno.org with ESMTP; Tue, 28 Aug 2007 21:13:23 -0400
> X-IronPort-AV: E=Sophos;i="4.19,319,1183348800";
<snip>
> From: "Tony Guadagno" <tguadagno@fujifilmesys.com>

Get rid of that MAIL FROM: and RCPT TO: junk at the top of the message. That's not normal content for an email message and is probably confusing the parser.

(email header names cannot contain spaces, and the MAIL FROM and RCPT TO are SMTP commands, not part of the message that SA would ordinarily receive when processing email. Generally the content of the MAIL FROM is copied into Return-Path at delivery time, and that's how SA would pick up on this data, unless it's added to the Received: header by your MTA. Generally speaking, SA has no idea at all who the RCPT To: is, unless it happens to match the To: header.)

Also note that the message didn't have any of your whitelisted domains in the From: header, so even if SA did parse the headers properly

whitelist_from *@sans.org 
whitelist_from *@mercury.com 
whitelist_from *@raymourflanigan.com 

 or is "whitelist_from *@fujifilmesys.com" part of your "etc" in your original post. Received on Wed Aug 29 22:11:21 2007