Re: [Declude.JunkMail] Increased AOL, Hotmail, Yahoo, etc. false positives

[Matthew Bramble]

It's just you :) The From address is often forged.  The address that matters the most is the server from which the E-mail came, which is listed in the top of the headers, i.e. Received: from declude.com [24.107.232.14] by igaia.com with ESMTP (SMTPD32-7.13) id A78F250118; Thu, 04 Sep 2003 15:50:39 -0400 The information in that line in the messages you receive is what is responsible for tripping most of the tests you indicated (real AOL trips NOPOSTMASTER for instance).  If you reverse lookup the IPs that you find there, my bet is that they won't match the domains of the From addresses they are using.  The software and your filters are actually doing their job very well if those messages are failing. Matt Paul Hung wrote: Has anyone found that AOL, Hotmail, and Yahoo.com addresses have been failing on the following tests:  helobogus, nopostmaster, noabuse, revdns These e-mails usually fail these four tests, and thus trigger my Weight10 rule.  I performed a reverse DNS lookup on several of the IP addresses and found that there was no entry for reverse DNS. Any ideas?  Is it just me? - Paul