What I did was use the suggestion
here
I added one line above the 'nobody@cert.org' => -3.0 ::
'reports.spamcop.net' => -100.0,
Restarted amavis with zmamavisdctl
All mail from *@reports.spamcop.net still hit the Junk box. I'll check my logs to determine what is happening. The two different techniques mentioned in that post seem redundant. They both appear to be able to whitelist / blacklist entire domains and individual senders but one uses a score, the other uses a list.
I assume that if it actually worked, I would want to use the :
read_hash(\%whitelist_sender, '/etc/zimbra/whitelist');
Here is a header from the 'spam'
Code:
X-Spam-Flag: YES
X-Spam-Score: 7.77
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.77 tagged_above=-10 required=4
tests=[BAYES_50=0.001, DATE_IN_PAST_12_24=0.992,
FORGED_MUA_MOZILLA=2.696, FROM_STARTS_WITH_NUMS=1.499,
SPF_PASS=-0.001, URIBL_OB_SURBL=1.5, URIBL_RHS_DOB=1.083]
In this case, it would make more sense to use a distinct header that I know spamcop uses - like :
X-SpamCop-sourceip: -or- X-Mailer: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) via
SpamCop.net - Beware of cheap imitations v647
But it still would be nice to see the whitelist by domain name or sender working.