Whitelisted sender still getting flagged as spam

[virtualmike]

I receive mail from a list called "Daily Free Books." Each email lists Kindle books that are free today. The emails are sent from <mailinglist@vps.dailyfreebooks.com>.

About once a week, a mailing gets flagged as spam. For example, today's was, with this analysis:

Code: Select all

Content analysis details:   (6.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/,
                            no trust
                            [46.32.254.77 listed in list.dnswl.org]
 2.3 FIN_FREE               BODY: Freedom of a financial nature
 0.0 HTML_MESSAGE           BODY: HTML included in message
 1.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 3.0 SNF4SA                 Message Sniffer

I understand why the FIN_FREE rule got triggered (one of the books in today's mail refers to financial services). I don't know why the SNF4SA rule would get triggered.

However, I have a whitelist entry for this sender:

Code: Select all

Whitelist From

    Your entries:
    @*.dailyfreebooks.com 	

I made sure to copy the entries to the mailbox where these messages are going.

Why are these messages flagged as spam even though I have the whitelist entry?

[tikvah]

I am less concerned about the rules being triggered than I am the fact that you whitelisted this address but it got held as spam anyway.

Are you sure the sender didn't change the from address? In my experience, there are small changes all the time. They may not even be aware if it, if they use a newsletter program (and even if they don't).

@*.dailyfreebooks.com may no longer be the correct address. Maybe @dailyfreebooks.com or @*dailyfreebooks.com will work better. Take a close look.

[goetsch]

How about adding a "splat" in front of the "at?" I've got whitelisted entries that look like more like: *@apple.com and *@*.costco.com

[virtualmike]

Good catch, @goetsch! Sure enough, I was missing the initial wildcard. (I haven't heard anyone use "splat" in a long, long time! -- thanks for the memory!)

@tikvah, indeed, I checked the address. I'd tried to whitelist the domain, but I Ieft out one crucial character.

Thanks to both!