Re: whitelist_auth return_path / from

On Wed, 3 Jul 2024, Simon Wilson via users wrote:

> Does whitelist_auth work on From header, or Return-Path? Reason I ask:
>
> 
> 
> I have two emails from “support .at. wasabi.com”. Due to their emails usually triggering KAM rules I have (in
> /etc/mail/spamassassin/local.cf):
>
> 
> 
> ## Whitelist Wasabi, subject to passing of auth
> whitelist_auth [email protected]
[snip..]

> The other is not triggering whitelist_auth and is marked as spam due to the KAM rule fails. It has:
> 
> Return-Path: <[email protected]>
> ... <snip>
> From: Wasabi <[email protected]>
> ... <snip>
> Reply-To: [email protected]
> 
> Despite passing SPF and DKIM, not whitelisted:
> 
> X-Spam-Score: 20.212
> X-Spam-Level: ********************
> X-Spam-Status: Yes, score=20.212 tagged_above=-999 required=6.2
>  tests=[BAYES_00=-1.9, DCC_CHECK=1.1, DCC_REPUT_99_100=1.4, DKIM_INVALID=0.1,
>  DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, KAM_BODY_MARKETINGBL_PCCC=0.001,
>  KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9, KAM_MARKETINGBL_PCCC=1,
>  KAM_REALLYHUGEIMGSRC=0.5, LR_DMARC_PASS=-0.1, SPF_HELO_NONE=0.001,
>  SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01]
>  autolearn=no autolearn_force=no
[snip]
> 
> Thanks.
> Simon.

You say "passing SPF and DKIM" however in the SA rules report it clearly says:
  DKIM_SIGNED=0.1, DKIM_INVALID=0.1

So eventho you think 'passed DKIM' SA clearly does NOT think it does. That 
DKIM_INVALID will prevent the whitelist_auth from firing, thus you need to 
investigate what's going wrong there.


-- 
Dave Funk                               University of Iowa
<dbfunk (at) engineering.uiowa.edu>     College of Engineering
319/335-5751   FAX: 319/384-0549        1256 Seamans Center, 103 S Capitol St.
Sys_admin/Postmaster/cell_admin         Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{