SpamAssassin Whitelisted E-mails not working

[ssgill]

Hello, i am having issues with receiving email from one particular email address only when there is an attachment. I am not sure what's the content of attachment but it's from known entity i would like to receive their email, so added their email address with wildcard in

SpamAssassin->Whitelist E-mail -> *@sendingdomain.com

Their email was still rejected with following error

2026-09-08 13:23:12 1x41PS-00000000000-2Rff H=mail-ww.outbound.protection.outlook.com (coo.outbound.protection.outlook.com) [11.111.11.11]
X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<[email protected]> rejected after DATA: Message for [email protected], [email protected] denied - virus of harmful content (YARA.SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE.UNOFFICIAL)

I understand mail was rejected because of suspected "YARA" error, but my question is if email domain was added to whitelist then email should have been received instead of rejected.

Thanks

 

[Richard G]

then email should have been received instead of rejected.

Not in this case. Spamassassin only handles spam signatures and does not overrule a virus scanner as Spamassassin does not check virus codes, so Spamassassin will allow the mail, but the virusscanner is blocking the mail.

Questen is which type of attachment is the sender trying to send you? If it's an .exe file it will be blocked anyway. For that to pass you might want to change your /etc/system_filter.exim file, there is a special method to do that.
Create directory's and copy your system_filter.exim file to the /usr/local/directadmin/custombuild/custom/exim directory. In that directory adjust to your needs and rebuild exim and exim.conf.

In any case it's better to pack executables into .zip or .rar files when sending as attachments.