Hi Scott:
take a look at these headers. The user is sending FROM a RIPE IP range
assigned to the Netherlands to an SMTP server with an IP also assigned by
RIPE for Netherlands - yet, it triggers the SPAMROUTING test. Even worse,
BOTH IP addresses have reverse DNS defined resolving to the ".nl" top-level
domain.
I can't come any more "plain dutch" (pun intended) that THIS:
Received: from smtp03.wxs.nl [195.121.6.37] by hm-software.com with ESMTP
(SMTPD32-7.04) id AB1410203EE; Sat, 01 Dec 2001 11:53:40 -0500
Received: from pcedwinhome ([80.60.182.216]) by smtp03.wxs.nl
(Netscape Messaging Server 4.15) with SMTP id GNOC9F00.VX4 for
<[EMAIL PROTECTED]>; Sat, 1 Dec 2001 17:53:39 +0100
From: "Edwin van Nes" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Email forwarding
Date: Sat, 1 Dec 2001 17:49:26 +0100
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
X-RBL-WARNING: Suspected SPAM. This E-mail was routed in a poor manner
consistent with spam [20000103].
X-Declude-Sender: [EMAIL PROTECTED] [195.121.6.37]
X-Declude-Spoolname: D0b143ee.SMD
X-Declude-Note: Processed by Declude 1.28; remote host smtp03.wxs.nl.
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 301718581
Best Regards
Andy Schmidt
H&M Systems Software, Inc.
600 East Crescent Avenue
Suite 203
Upper Saddle River, NJ 07458-1846
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
http://www.hm-software.com/
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
