Whitelist wildcards not working as expected?

ahardy42

I am creating a whitelist entry for every email from a domain, e.g. zen.co.uk which is my broadband / telecoms provider

However my attempt to catch everything isn’t working.

I thought that

*@*zen.co.uk

would catch info@zen.co.uk as well as marketing@e.zen.co.uk

But the latter gets filtered into my spam folder. What’s the correct approach please?

DocFraggle

Never used that before, but maybe you have to add a 2nd entry like

*@*.zen.co.uk
(add a ‘.’ after the second wildcard)

to catch the subdomains as well. Not sure how the matching is done in this case. And change the 1st entry to

*@zen.co.uk

ahardy42

I’ve probably got 50 domains configured that way - it would be good to know for sure!

Also it seems that the *@*zen.co.uk pattern seems to work for some domains (with the correct domain obviously). However I am still doing spam filtering at level 3, so maybe it is time for me to switch from “3” to “0” and rely entirely on my whitelist, just as a test for a day (he says bravely).

ahardy42

Will any of the mailcow dev team see this thread, or is it worth raising an issue in the bug tracker?

I’m still seeing this error and in this case, just for @zen.co.uk it seems. I will monitor and see if @domain.com generally is impacted.

ahardy42

Seeing it on a second domain with this style of @domain.tld pattern

Seems the wildcards are not following the obvious matching mechansim, whatever that is.

ahardy42

Email to me from my internet provider zen.co.uk is still suffering the curse of the killer spam filter, despite my two entries in the whitelist:

@zen.co.uk
@.zen.co.uk

Any suggestions?

esackbauer

It would be helpful if you look at the smtp headers of such mails…

ahardy42

DocFraggle

Unfortunately this is a shared mail server so I don’t have access to that bit.

esackbauer I can just post the whole lot here - but is any of it stuff I shouldn’t post in public? I assume it’s all OK since it was unencrypted email out in the wild earlier on, I’m just not sure.

DocFraggle

Better add it to

System -> Configuration -> Global filter maps

Check the box at “I will be careful!” and head over to “Header-From: Allowlist”

Add the domain like

/.+zen\.co\.uk/i

Click “Validate” and then “Save changes”

esackbauer

ahardy42 I assume it’s all OK since it was unencrypted email out in the wild earlier on, I’m just not sure.

You should know what the SMTP headers of an email look like and what you find there. It helps analysing any problems, because spam information by postfix and rspamd will be put to the headers.
Probably most private thing is the email address of the sender and receiver.

ahardy42

Unfortunately my addled senior brain has long since stopped absorbing useful information such as what my SMTP headers are telling me. Gemini tells me that Zen should know better than to use a different domain in their sender and return-path.

Maybe I should put *@bounce.e.zen.co.uk in my whitelist?

Here it is though, emails duly obfuscated:

From marketing@e.zen.co.uk Sat Jul 25 09:16:45 2026
Return-Path: <bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk>
Delivered-To: zaphod.beeblebrox@cyberspaceroad.com
Received: from mail.webarch.email ([172.22.1.253])
	by a12f9dde529c with LMTP
	id yLnsCe1wZGoRrwUA4TOD+g
	(envelope-from <bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk>)
	for <zaphod.beeblebrox@cyberspaceroad.com>; Sat, 25 Jul 2026 09:16:45 +0100
X-Original-To: trillian@ecocore.org
Received: from afz163.mta.exacttarget.com (mta.e.zen.co.uk [159.92.158.163])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(No client certificate requested)
	by mail.webarch.email (Postcow) with ESMTPS id 921E51A87381
	for <trillian@ecocore.org>; Sat, 25 Jul 2026 09:16:43 +0100 (BST)
Authentication-Results: mail.webarch.email;
	dkim=pass header.d=e.zen.co.uk header.s=51dkim1 header.b=kbwK7zOd;
	dkim=pass header.d=s51.y.mc.salesforce.com header.s=fbldkim51 header.b=Uz8gQ92t;
	dmarc=pass (policy=reject) header.from=e.zen.co.uk;
	spf=pass (mail.webarch.email: domain of bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk designates 159.92.158.163 as permitted sender) smtp.mailfrom=bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ecocore.org;
	s=20190710; t=1784967403;
	h=from:from:reply-to:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:mime-version:mime-version:
	 content-type:content-type:list-unsubscribe:list-unsubscribe-post:
	 dkim-signature; bh=p1Zrgpq/poCiZiB6F0U6SDCmjryVhmfR+K6E+Zh5sX4=;
	b=YnsMHBNfQjBSLXnvlsholYiXfXaj9VfkifO69Woh8rm9TpLrnfV3b+a6O/POenX8bCd3Xt
	Uv0QMt67oPbD4jL4RXI5a75ax6+gCyUx7zT7XIq1YOoreD+Gq+u6HmlmATAtYOdXwR/R2Y
	owvLIXNMpzuolgPXVTY+YgsVuGTs0L8=
ARC-Seal: i=1; a=rsa-sha256; d=ecocore.org; s=20190710; cv=none; t=1784967403;
	b=WRvQYupleM7cNQW2D0rA3w4sErQj5Z/UOTyeqxBOE0RhCi08y4+9SJVm0cBUTuvPLxDvGk
	7FydFzXu0NfFDXOtDQqpjNSjt747/2Fs0x730L6QWUelgG8zQkdDByvq7TseMFDxFel/1z
	q6PsXw4QPg2tw59yWrqhpY2By+Ff49k=
ARC-Authentication-Results: i=1;
	mail.webarch.email;
	dkim=pass header.d=e.zen.co.uk header.s=51dkim1 header.b=kbwK7zOd;
	dkim=pass header.d=s51.y.mc.salesforce.com header.s=fbldkim51 header.b=Uz8gQ92t;
	dmarc=pass (policy=reject) header.from=e.zen.co.uk;
	spf=pass (mail.webarch.email: domain of bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk designates 159.92.158.163 as permitted sender) smtp.mailfrom=bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=51dkim1; d=e.zen.co.uk;
 h=From:To:Subject:Date:List-Unsubscribe:List-Unsubscribe-Post:MIME-Version:
 Reply-To:Message-ID:Content-Type; i=marketing@e.zen.co.uk;
 bh=p1Zrgpq/poCiZiB6F0U6SDCmjryVhmfR+K6E+Zh5sX4=;
 b=kbwK7zOdFftVl6/MGmCnFOr1W6GUogrBEGzsUOfuBsL+JwlkvgeOPfCfvh7YxhvQXQrz0vJ1eFEz
   lvS+KvSS7zTX8wB/z5fnFhNrX9oGEyryszQxMubjDGEtuoN45oj3H8nJNLFSIyC5hftRw2Xl3aJj
   nZ1tpHumuvjamy5sXo/VDs+hGDG1Kf5Zj9NKAzqOG2npx+0M54oVmN7yogQsYfHAm+HDKNG3p3mh
   A8/eSDq+p043Gm1H7JVlrcz2OXERctXSgeq+fJwTPKwCQpzwed3cQbar6Q7shRicrgyriZUsYOE7
   zMF8zPifbscw1gq/t23ZmB3mguw7FMsuLsiNEA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=fbldkim51; d=s51.y.mc.salesforce.com;
 h=From:To:Subject:Date:List-Unsubscribe:List-Unsubscribe-Post:MIME-Version:
 Reply-To:Message-ID:Content-Type;
 bh=p1Zrgpq/poCiZiB6F0U6SDCmjryVhmfR+K6E+Zh5sX4=;
 b=Uz8gQ92tKG6VZ8Gg5uXv2praKY2Z1417B+BgET7fqseLDv+XRQVNTerMwCrAbllrTONUGPZPH6xJ
   ix3SEbH4vR98seGlmID4tKGucJ6sQpN0cfGZV3tsRMQ3qAyzGfTrVRbozwylqLpoyx7t7m7bZG7A
   yrpQWz3ylxaciw3rD6oYZHoh0/fvl2d/nvgfXcW8vOY2rhEDDn4l11aRSIRwXrFsvN8BQuGF6IPh
   ZPVu2RHWugPMnGIesUP0UZciXSztLZ+io0Ogy30Lk7MqqUwyuyF4vBxyI05RM7Azsi7ZHHbAZAjM
   9vWizj7NrRNMdcKHH5AKK45ccxi95f3+lgBZFA==
Received: by afz163.mta.exacttarget.com id hchoem39mjcf for <trillian@ecocore.org>; Sat, 25 Jul 2026 08:01:41 +0000 (envelope-from <bounce-CGIT5QIX2RBEDGEPKHT42IUEJM.510005@bounce.e.zen.co.uk>)
From: "Zen Internet" <marketing@e.zen.co.uk>
To: <trillian@ecocore.org>
Subject: Have you voted yet?
Date: Sat, 25 Jul 2026 02:01:41 -0600
List-Unsubscribe: <https://click.e.zen.co.uk/subscription_center.aspx?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtaWQiOiI1MzYwMDE2NDgiLCJzIjoiNzQwOTI5MDMiLCJsaWQiOiIyNzYiLCJqIjoiNDk0Njg2IiwiamIiOiIxNTkiLCJkIjoiNTEwMDA1In0.J97m_QIgYhHnuvukLtXrT67YeIzgJwYUAjIErV-dOfA>, <mailto:leave-4BW2CY66I6JEXNNVDVI53BNYNM.510005@leave.e.zen.co.uk>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
MIME-Version: 1.0
Reply-To: "Zen Internet" <reply-4KNO7OBL3IJURCND4KKHMUPUKU.510005@e.zen.co.uk>
X-SFMC-Stack: 51
x-job: 536001648_494686
Message-ID: <7b125a12-b4d6-493b-b4c0-535d6e65f664@cdg3s51mta0677.xt.local>
Content-Type: multipart/alternative;
	boundary="MopjLDovKi5Y=_?:"
X-Last-TLS-Session-Version: TLSv1.3
X-Rspamd-Queue-Id: 921E51A87381
X-Spamd-Result: default: False [11.40 / 32.00];
	FORGED_SENDER(6.31)[marketing@e.zen.co.uk,bounce-cgit5qix2rbedgepkht42iuejm.510005@bounce.e.zen.co.uk];
	HAS_GOOGLE_FIREBASE_URL(2.00)[];
	EXT_CSS(1.00)[];
	URI_COUNT_ODD(1.00)[29];
	SUBJECT_ENDS_QUESTION(1.00)[];
	FROM_NEQ_ENVFROM(0.50)[marketing@e.zen.co.uk,bounce-cgit5qix2rbedgepkht42iuejm.510005@bounce.e.zen.co.uk];
	DMARC_POLICY_ALLOW(-0.50)[e.zen.co.uk,reject];
	MANY_INVISIBLE_PARTS(0.40)[5];
	IP_REPUTATION_HAM(-0.39)[asn: 14340(-0.38), country: US(-0.00), ip: 159.92.158.163(0.00)];
	ZERO_FONT(0.30)[4];
	R_SPF_ALLOW(-0.20)[+ip4:159.92.158.0/24];
	ONCE_RECEIVED(0.20)[];
	R_DKIM_ALLOW(-0.20)[e.zen.co.uk:s=51dkim1,s51.y.mc.salesforce.com:s=fbldkim51];
	BAD_WORDS(0.10)[];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	HAS_LIST_UNSUB(-0.01)[];
	MX_GOOD(-0.01)[];
	RCPT_MAILCOW_DOMAIN(0.00)[ecocore.org];
	GREYLIST(0.00)[pass,body];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	FUZZY_RATELIMITED(0.00)[rspamd.com];
	ARC_SIGNED(0.00)[ecocore.org:s=20190710:i=1];
	ARC_NA(0.00)[];
	FROM_HAS_DN(0.00)[];
	DKIM_TRACE(0.00)[e.zen.co.uk:+,s51.y.mc.salesforce.com:+];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DNSWL_BLOCKED(0.00)[159.92.158.163:from];
	NEURAL_HAM(-0.00)[-1.000];
	ALIAS_RESOLVED(0.00)[];
	REPLYTO_DOM_EQ_FROM_DOM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[trillian@ecocore.org];
	RCVD_TLS_LAST(0.00)[];
	TO_DN_NONE(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	REPLYTO_DN_EQ_FROM_DN(0.00)[];
	ASN(0.00)[asn:14340, ipnet:159.92.0.0/16, country:US];
	HAS_REPLYTO(0.00)[reply-4KNO7OBL3IJURCND4KKHMUPUKU.510005@e.zen.co.uk];
	MISSING_XM_UA(0.00)[];
	REPLYTO_DOM_NEQ_TO_DOM(0.00)[];
	RBL_SENDERSCORE_REPUT_BLOCKED(0.00)[159.92.158.163:from]
X-Spam-Flag: YES
X-Spam: Yes

This is a multi-part message in MIME format.

--MopjLDovKi5Y=_?:
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: 8bit