Whitelisted emails still get defanged (how to whitelist these?)
<[email protected]> Fri, 24 Oct 2025 17:27:16 -0400
| Newsgroups | gmane.mail.virus.mailscanner |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============2152506904950046251== Content-Type: multipart/alternative; boundary="----=_NextPart_000_03CE_01DC450B.71EB38F0" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_03CE_01DC450B.71EB38F0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit I am in beta with latest Mailscanner and Mailwatch with postfix and Spamassassin. Is there a way to keep whitelisted messages from being defanged? 2025-10-24T13:44:25.148402-07:00 sentry MailScanner[55478]: Message 8594084A4F.A876D from x.x.x.x (0100019a17f71a52-7031ce0b-b836-4d6f-89f8-c143d40cf11d-000000-TkF4y6iHqp8Y051M8ezPlA@public.gmane.org ws.example.com) is whitelisted 2025-10-24T13:44:25.428061-07:00 sentry MailScanner[55478]: Content Checks: Detected and have disarmed hidden tags in HTML message in 8594084A4F.A876D from 0100019a17f71a52-7031ce0b-b836-4d6f-89f8-c143d40cf11d-000000-TkF4y6iHqp8wVUSktUsVGQ@public.gmane.org s.example.com (That's the envelope-from , the From: is helpdesk-D4qZEMI14/jqlBn2x/[email protected]) Or is there another way to do this? Big picture: We use a third-party helpdesk provider. They send email from helpdesk-D4qZEMI14/jqlBn2x/[email protected] <mailto:helpdesk-D4qZEMI14/jqlBn2x/[email protected]> , via Amazon SES (with proper SPF and DKIM set up by us) I have spf.ses.auth.aws.example.com in spam.whitelist.rules. They add some custom URL's, like: X-Example-Account: mycompany I also know which URL's I'd want to exclude, if excluding specific URL's was possible For obvious reasons, I wouldn't want to whitelist From:helpdesk-D4qZEMI14/jqlBn2x/[email protected] or all of Amazon SES Any thoughts? Thanks very much Betsy -- MailWatch Version: 1.2.23 Operating System Version: Ubuntu 24.04.3 LTS (Noble Numbat) Postfix Version: 3.8.6 MailScanner Version: 5.5.3 ClamAV Version: 1.4.3 SpamAssassin Version: 4.0.0 PHP Version: 8.3.6 MySQL Version: 10.11.13-MariaDB-0ubuntu0.24.04.1 -- # grep Allow /etc/MailScanner/MailScanner.conf |grep -v ^# Allow Password-Protected Archives = no Allowed Sophos Error Messages = Allow Partial Messages = no Allow External Message Bodies = no Allow IFrame Tags = disarm Allow Form Tags = disarm Allow Script Tags = disarm Allow WebBugs = yes Allow Object Codebase Tags = disarm Allow Filenames = Allow Filetypes = Allow File MIME Types = Archives: Allow Filenames = Archives: Allow Filetypes = Archives: Allow File MIME Types = Allow Multiple HTML Signatures = no -- # cat /etc/MailScanner/rules/spam.whitelist.rules |grep -v ^# From: /[\@\.]example-outgoing\.mycompany\.com$/ yes From: /[\@\.]spf\.ses\.auth\.aws\.example\.com$/ yes FromOrTo: default no ------=_NextPart_000_03CE_01DC450B.71EB38F0 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 = (filtered medium)"><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif; mso-ligatures:standardcontextual;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style></head><body lang=3DEN-US link=3D"#0563C1" vlink=3D"#954F72" = style=3D'word-wrap:break-word'><div class=3DWordSection1><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>I am in beta with = latest Mailscanner and Mailwatch with postfix and Spamassassin. Is there = a way to keep whitelisted messages from being defanged? = <o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'>2025-10-24T13:44:25.148402-07:00 sentry = MailScanner[55478]: Message 8594084A4F.A876D from x.x.x.x = (0100019a17f71a52-7031ce0b-b836-4d6f-89f8-c143d40cf11d-000000-TkF4y6iHqp8FmTqzAmiQFQ@public.gmane.org= h.aws.example.com) is whitelisted<o:p></o:p></span></p><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'>2025-10-24T13:44:25.428061-07:00 sentry = MailScanner[55478]: Content Checks: Detected and have disarmed hidden = tags in HTML message in 8594084A4F.A876D from = 0100019a17f71a52-7031ce0b-b836-4d6f-89f8-c143d40cf11d-000000-TkF4y6iHqp/lxj2j/[email protected]= .aws.example.com <o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>(That’s the = envelope-from , the From: is = helpdesk-D4qZEMI14/jqlBn2x/[email protected])<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Or is there another way to do this? Big = picture:<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>We use a third-party = helpdesk provider. They send email from <a = href=3D"mailto:helpdesk-D4qZEMI14/jqlBn2x/[email protected]">helpdesk-D4qZEMI14/jqlBn2x/[email protected]</a> , via = Amazon SES (with proper SPF and DKIM set up by = us)<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>I have spf.ses.auth.aws.example.com in = spam.whitelist.rules. <o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>They add some custom = URL’s, like: X-Example-Account: = mycompany<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>I also know which URL’s I’d want = to exclude, if excluding specific URL’s was = possible<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>For obvious reasons, I wouldn’t want to = whitelist From:helpdesk-D4qZEMI14/jqlBn2x/[email protected] or all of Amazon = SES<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'><o:p> </o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>Any thoughts? = <o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Thanks very = much<br>Betsy<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>--<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>MailWatch Version: = 1.2.23<br>Operating System Version: Ubuntu 24.04.3 LTS (Noble = Numbat)<br>Postfix Version: 3.8.6<br>MailScanner Version: = 5.5.3<br>ClamAV Version: 1.4.3<br>SpamAssassin Version: 4.0.0<br>PHP = Version: 8.3.6<br>MySQL Version: = 10.11.13-MariaDB-0ubuntu0.24.04.1<o:p></o:p></span></p><p = class=3DMsoNormal><span = style=3D'font-size:11.0pt'>--<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'># grep Allow = /etc/MailScanner/MailScanner.conf |grep -v ^#<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>Allow = Password-Protected Archives =3D no<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>Allowed Sophos Error = Messages =3D<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow Partial Messages =3D = no<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow External Message Bodies =3D = no<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow IFrame Tags =3D = disarm<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow Form Tags =3D = disarm<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow Script Tags =3D = disarm<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow WebBugs =3D yes<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>Allow Object Codebase = Tags =3D disarm<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow Filenames =3D<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'>Allow Filetypes = =3D<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow File MIME Types = =3D<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Archives: Allow Filenames = =3D<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Archives: Allow Filetypes = =3D<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Archives: Allow File MIME Types = =3D<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>Allow Multiple HTML Signatures =3D = no<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>--<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt'># cat = /etc/MailScanner/rules/spam.whitelist.rules |grep -v = ^#<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>From: = /[\@\.]example-outgoing\.mycompany\.com$/ &n= bsp; yes<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>From: = /[\@\.]spf\.ses\.auth\.aws\.example\.com$/ &= nbsp; yes<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt'>FromOrTo: = default = no<o:p></o:p></span></p></div></body></html> ------=_NextPart_000_03CE_01DC450B.71EB38F0-- --===============2152506904950046251== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- MailScanner mailing list mailscanner-qhrM8SXbD5JTOyd/[email protected] http://lists.mailscanner.info/mailman/listinfo/mailscanner --===============2152506904950046251==--