From the headers:
Spam assassin said... "USER_IN_WHITELIST" ... This gives your mail score
a fairly low spam rating. Anyone sending mail with a source email
address that is in your whitelist will generally get through
Spamassassin. (Thats the idea of a whitelist).
Solution:
1. Remove yourself from your whitelist.
2. To make sure your mail is not marked as spam.... start using another
method of sending mail outbound that bypasses your spamassassin. For
example. I use smtpauth. You can configure spamassassin to bypasses
scanning mail that has been authenticated to your local server.
Hope that helps...
--
+---------------------------------------------------------------------+
| / \ Greg Kuhnert, gkuhnert (at mark) compassnetworks.com.au |
| < o > Compass Networks - Pointing you in the right direction |
| \ / Check out our website for NuOnce module support. |
+---------------------------------------------------------------------+
Paul wrote:
> Guys,
>
> I seem to be flooded recently with lots of emails reporting to be from
> myself, however not really being from me. An example would be the following
> header coming into my in-box from my server...
>
> One of those wonderful "buy Viagra" mails that pop through every so often...
>
> Mail from : admin (at mark) viagra.com [paul (at mark) planetcentral.net]
>
>
> Return-Path: <paul (at mark) ple-communications.com>
> Received: from ppp-58-8-71-215.revip2.asianet.co.th
> (ppp-58-8-71-215.revip2.asianet.co.th [58.8.71.215])
> by www.planetcentral.net (8.13.1/8.13.1) with SMTP id n0K2n26H001003
> for <paul (at mark) planetcentral.net>; Tue, 20 Jan 2009 02:49:04 GMT
> Date: Tue, 20 Jan 2009 02:49:03 GMT
> X-Originating-IP: [78.43.7.50]
> X-Originating-Email: [paul (at mark) planetcentral.net]
> X-Sender: paul (at mark) planetcentral.net
> Received: from 79.24.7.63 (HELO ppp-58-8-71-215.revip2.asianet.co.th)
> (76.9.43.0) by 58.8.71.215 with SMTP; Sat, 17 Jan 2009 12:43:11 +0700
> Message-Id: <20090117194311.3956.qmail (at mark) ppp-58-8-71-215.revip2.asianet.co.th>
> To: <paul (at mark) planetcentral.net>
> From: "admin (at mark) viagra.com" <paul (at mark) planetcentral.net>
> MIME-Version: 1.0
> Importance: High
> Content-Type: text/html
> X-Spam-Status: No, score=-72.7 required=5.0 tests=BAYES_50,DCC_CHECK,
>
> DIGEST_MULTIPLE,FH_HELO_EQ_D_D_D_D,HELO_DYNAMIC_IPADDR,HTML_IMAGE_RATIO_04,
>
> HTML_MESSAGE,MIME_HTML_ONLY,MISSING_DATE,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100,
> RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,
>
> RCVD_IN_NJABL_PROXY,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC,URIBL_AB_SURB
> L,
> URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_WS_SURBL,
> USER_IN_WHITELIST autolearn=no version=3.2.4, No
> X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
> www.planetcentral.net
> X-www.planetcentral.net-MailScanner-Information: Please contact the ISP for
> more information
> X-MailScanner-ID: n0K2n26H001003
> X-www.planetcentral.net-MailScanner: Found to be clean
> X-www.planetcentral.net-MailScanner-From: paul (at mark) ple-communications.com
> Subject: {Disarmed} RE: Message
>
> Now these aren't sent from my box - i can tell that since the mail server is
> secure (have carried out several checks both on and offline). However i seem
> to get upwards of 100 per day. My better half has an account on the same box
> with a much less publicised email address, and has similar problems. They
> still come up as reporting to be from me in my inbox, or her in hers. I have
> spamassassin installed, along with mailscanner.
>
> Is there any way i can set up the box or spamassasin/mailscanner to block
> these at all? Or is there any way to block these on the box using other
> methods?
>
> Many thanks in advance for your help guys :)
>
> Paul
>
>