Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » False SPAM Positives in Outlook 2007
  •  
revmark

Messages: 23
Karma: 0
Send a private message to this user
No matter how many times that a user gets an email from certain senders, they end up in the SPAM folder. Each time they click on the email and click NOT SPAM in Outlook 2007 and whether or not I have a custom rule for a particular domain or email address Outlook still marks certain emails as spam.

How can I fix this?
  •  
TorW

Messages: 769
Karma: 9
Send a private message to this user
Marking something as ham will usually only lower the possibility that something similar is considered ham in the future, and the sender is only one of the very few things the bayesian filter considers when it makes a decision. Whitelist the sender (with whitelist_from_rcvd) in local.cf and be done with it.

Is the address in the From: field actually the same as the envelope sender? KMS works with the envelope sender, not the From: field. Check the logs ...
  •  
revmark

Messages: 23
Karma: 0
Send a private message to this user
I have the OSX Server version, Where is local.cf file and how do recognize the piec in the log?
  •  
TorW

Messages: 769
Karma: 9
Send a private message to this user
Local.cf is the SpamAssassin config file. You'll find the location with "locate local.cf" in a terminal window.

The SpamAssassin keyword whitelist_from_rcvd whitelists (i.e. gives a -100 score) mail where both the envelope address and the sending server matches.

The Envelope sender and the address in the From: field is usually the same, but it doesn't have to be. The easiest way to find the SMTP envelope sender is to look for the "Return-Path" line in the message source. Mail servers that follow the RFC2821 specifications should record the envelope sender in that header field. KMS seems to do this. In your case, Return-Path and From might be different. That's often the case for (clued-in) mailing lists and newsletters (and spammers).

Note that the Reply-To, Return-Path and From fields can all have different addresses. Don't get them confused!

If you don't have the message handy (say, it was for a user), you could always check the .eml file in the users /INBOX/#msgs and fish out the Return-Path. Legal stuff may apply if you do that, so think twice before you read other peoples messages. It's not allowed at all in e.g. Germany, I think.

Next, you'll need the host name of the sender that sent the mail. It's recorded in the topmost Received: field in the message.

Then, add this to the bottom of local.cf

whitelist_from_rcvd address<_a.t_>example.com senderhost.example.com

Then restart the keriomailserver daemon. I don't know how you do that on OS X though.

[Updated on: Sat, 14 February 2009 19:35]

Previous Topic: Kerio password needs to be reset every few hours
Next Topic: Reindexing: Update
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Sun Nov 19 06:13:26 CET 2017

Total time taken to generate the page: 0.00523 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.