[Summy]

A customer of mine has disabled the "Server Wide Spam Scanning" from within the custom RV page that allows this option.

I can see the domain added to the rv_spam_receiver_domain_whitelist file.

However, when I check the exim mainlog, I am still seeing the error messages that indicate spam scanning is still enabled for this domain name.

Checking the ACL section I notice there is no mention of the receiver whitelist? Is this correct?

I am running the auto blacklist on my server as well... Here is the relevant ACL section:

CODE

#############
# spam protection

# Accept Sender that usually send a lot of emails to minimize spamd load
accept senders = +rv_spam_sender_address_whitelist
accept hosts = @[]
accept hosts = +rv_relay_hosts
accept authenticated = *

# Messages larger than 150k are accepted without spam scanning to reduce spamd load
accept condition = ${if >{$message_size}{150k}{true}}

##
# Reject spam messages with score over 10.5.
# Keep in mind that $spam_score_int is the messages score multiplied by ten.
##
deny message = Spam score too high ($spam_score)

# Bypass Sender that usually send a lot of emails to reduce spamd load
    !senders = +rv_spam_sender_address_whitelist
    spam = mailnull:true/defer_ok
# If emails get high score coming into the server from the same host address
# more than 3 times within Last 60 seconds. Sender's server will be blocked for 1 hours
    condition = ${run{/etc/eximSpamDeny.pl $sender_host_address $spam_score_int $sender_address }{yes}{yes}}

    condition = ${if >{$spam_score_int}{105}{1}{0}}

##
# Add a warning header if email scored between 9.5 and 10.5.
# Delete email in the System Filter File, if sender or receiver is not listed in the whitelists.
##
warn message = X-Exiscan-SA-Spam: Yes
# Bypass Sender that usually send a lot of emails to reduce spamd load
    !senders = +rv_spam_sender_address_whitelist
    spam = mailnull:true/defer_ok
    condition = ${if >{$spam_score_int}{95}{1}{0}}

##
# Rewrite subject if email scored between 9.0 and 10.5.
##
# Always put X-Spam-Score header in the message.
# It looks like this:
# X-Exiscan-SA-Score: 6.6 (++++++)
# When a MUA cannot match numbers, it can match for an
# equivalent number of '+' signs.
warn message = X-Exiscan-SA-Score: $spam_score ($spam_bar)\
# Put X-Spam-Report header in the message.
# This is a multiline header that informs the user
# which tests a message has "hit", and how much a
# test has contributed to the score.
               \nX-Exiscan-SA-Report: $spam_report\
# For the subject tag, we prepare a new subject header in the
# ACL, then swap it with the original Subject in the system filter.
               \nX-Exiscan-SA-New-Subject: *SPAM* $h_subject:
# Bypass Sender that usually send a lot of emails to reduce spamd load
    !senders = +rv_spam_sender_address_whitelist
    spam = mailnull:true/defer_ok
    condition = ${if >{$spam_score_int}{90}{1}{0}}




accept

[pairote]

This file used in the EXIM system filter. If you follow all my tutorial, you can file the system filter at /usr/local/cpanel/base/eximacl/antivirusspam.exim.

The whitelist is in fact not 100% whitelist. The SA still scan the message and reject the email if score over 15. But will route mail sent to the whitelist domain if score below 15.

[Summy]

This file used in the EXIM system filter. If you follow all my tutorial, you can file the system filter at /usr/local/cpanel/base/eximacl/antivirusspam.exim.

The whitelist is in fact not 100% whitelist. The SA still scan the message and reject the email if score over 15. But will route mail sent to the whitelist domain if score below 15.

Thanks for the quick response.

I have the system filter in place. Followed your guide and have been blocking around 20k spam per day, thank you very much

So the whitelist is redundent then? What is the point in having a whitelist, if the email still gets rejected if it scores over 15?

How can I change it so that email over 15, and with the receiver email domain whitelisted, will still get delivered, i.e. not be scanned by SA?

I think this would be a better way for it to work... Thats how I thought it should work in any case.

Some stats:

CODE

  Total mail blocked:............................................................................
.....   20214
  Verify sender at SMTP time:..........................................................................     512
  Spam mail blocked by manual blacklist sender at the SMTP time:.......................................       0
  Spam mail blocked by manual blacklist host address at the SMTP time:.................................       0
  Spam mail blocked by auto black list SA high score at the SMTP time:.................................    1147
  Spam mail blocked by invalid HELO at the SMTP time:..................................................     205
  Spam mail blocked by setting default address to :fail: at the SMTP time:.............................     205
  Spam mail blocked by auto black list after dictionary attack the SMTP time:..........................     126
  Spam mail blocked by RBL at the SMTP time:...........................................................   14093
  ...........................................bl.spamcop.net:...................................    6718
  ...........................................list.dsbl.org:....................................    1163
  ...........................................sbl-xbl.spamhaus.org:.............................    6209
  ...........................................relays.ordb.org:..................................       3
  Spam mail blocked by illegal File extension at the SMTP time and discarded after recieving email:....       3
  Spam mail blocked by virus scanner at the SMTP time or discarded after recieving email:..............       6
  Spam mail blocked by SA at the SMTP time or discarded after recieving email:.........................    3917
  Spam mail discared by SA high score (10.5+) after recieving email:...................................      61