Hi Scott: Sorry to be the bearer of bad news. But after working since the interims release from last week, the official 1.3.0 has broken the WEIGHT feature again. Can we please get this re-fixed again.
Look at the following DEBUG log: a) The summary claims: SPAMHEADERS:3 SPAMROUTING:4 HEUR9:4 . Total weight = 11 - which should BOUNCE the mail with WEIGHT10. b) But the listing of the individual tests only triggers: Msg failed SPAMHEADERS (This E-mail has headers consistent with spam [60004103].). Msg failed SPAMROUTING (This E-mail was routed in a poor manner consistent with spam [60004103].). It does NOT fail HEUR9 or WEIGHT10. Here the detailed log entries: 12/18/2001 17:37:12 CFG: Setting LOG_OK level to NONE 12/18/2001 17:37:12 CFG: Set hop to 0 and hophigh to 0. 12/18/2001 17:37:12 Console turned OFF 12/18/2001 17:37:12 CFG: Setting XINHEADER to X-Declude-Note: Processed by Declude %VERSION%; remote host %REVDNS%. 12/18/2001 17:37:12 CFG: Setting XOUTHEADER to X-Note: Report any abuse to [EMAIL PROTECTED] 12/18/2001 17:37:12 CFG: Bypassing IP 63.107.174.32. 12/18/2001 17:37:12 CFG: Setting XSENDER to ON 12/18/2001 17:37:12 CFG: Setting XSPOOLNAME to ON 12/18/2001 17:37:12 CFG: Whitelisting ANYWHERE [EMAIL PROTECTED] 12/18/2001 17:37:12 CFG: Whitelisting IP 63.107.174.. 12/18/2001 17:37:12 CFG: Whitelisting FROM hm-software.com. 12/18/2001 17:37:12 CFG: Whitelisting IP 128.192.1.101. 12/18/2001 17:37:12 CFG: Whitelisting IP 130.160.4.249. 12/18/2001 17:37:12 CFG: Whitelisting IP 199.232.158.102. 12/18/2001 17:37:12 CFG: Whitelisting FROM nytimes.com. 12/18/2001 17:37:12 CFG: Whitelisting IP 148.100.1.2. 12/18/2001 17:37:12 CFG: Whitelisting IP 64.65.65.2. 12/18/2001 17:37:12 CFG: Whitelisting FROM lists.cnn.com. 12/18/2001 17:37:12 CFG: Whitelisting FROM timeinc.com. 12/18/2001 17:37:12 CFG: Whitelisting FROM deepmetrix.com. 12/18/2001 17:37:12 CFG: Whitelisting FROM uni.de. 12/18/2001 17:37:12 CFG: Whitelisting IP 206.242.213.5. 12/18/2001 17:37:12 CFG: Whitelisting FROM stellenmarkt.de. 12/18/2001 17:37:12 Declude v1.30 12/18/2001 17:37:12 Setting HOLD directory to: D:\IMAIL\spool\spam. 12/18/2001 17:37:12 Qc5162d6 Setting DNS server to IMail's 63.107.174.65. 12/18/2001 17:37:12 Qc5162d6 Declude JunkMail Standard Version Registered 12/18/2001 17:37:12 Qc5162d6 Start 12/18/2001 17:37:12 Qc5162d6 Locking D:\IMAIL\spool\Qc5162d6.SMD. 12/18/2001 17:37:12 Qc5162d6 D:\IMAIL\spool\Qc5162d6.SMD locked. 12/18/2001 17:37:12 Qc5162d6 Getting message envelope 12/18/2001 17:37:12 Qc5162d6 Starting locality check 12/18/2001 17:37:12 Qc5162d6 CL Opening HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains 12/18/2001 17:37:12 Qc5162d6 [EMAIL PROTECTED] [0] is local domain2 12/18/2001 17:37:12 Qc5162d6 Done getting message envelope 12/18/2001 17:37:12 Qc5162d6 Getting headers 12/18/2001 17:37:12 Qc5162d6 Mid-headers 12/18/2001 17:37:12 Qc5162d6 Done getting headers 12/18/2001 17:37:12 Qc5162d6 Done getting envelope and headers 12/18/2001 17:37:13 Qc5162d6 Ver=20 verflag=0 12/18/2001 17:37:13 Qc5162d6 About to run spam tests 12/18/2001 17:37:13 Qc5162d6 Going through datafile 12/18/2001 17:37:13 Qc5162d6 211.73.11.3] by mail.webhost.hm-software.com with ESMTP (SMTPD32-7.04) id A51685702D6; Tue, 18 Dec 2001 17:37:10 -0500 12/18/2001 17:37:13 Qc5162d6 SPAMROUTING processing IPb 211.73.11.3] by . 12/18/2001 17:37:13 Qc5162d6 Handling Received: header 12/18/2001 17:37:13 Qc5162d6 Setting remote IP address to 211.73.11.3 12/18/2001 17:37:13 Qc5162d6 3.11.73.211.in-addr.arpa ... other processes logged entries ... 12/18/2001 17:37:44 Qc5162d6 Timeout. 12/18/2001 17:37:44 Qc5162d6 Hop 0: Checking IP Address 211.73.11.3. 12/18/2001 17:37:44 Qc5162d6 3.11.73.211.bl.spamcop.net IS listed in ORDB. 12/18/2001 17:37:54 Qc5162d6 12.64.1.66]) by ms.etechnet.com.tw (8.11.6/linuxconf) with ESMTP id fBIMRvM02363; Wed, 19 Dec 2001 06:27:58 +0800 12/18/2001 17:37:54 Qc5162d6 SPAMROUTING processing IPa 12.64.1.66]) by . 12/18/2001 17:37:54 Qc5162d6 Handling Received: header 12/18/2001 17:37:54 Qc5162d6 Skipping received line (hop 1) 12/18/2001 17:37:54 Qc5162d6 Last line of headers: X-Mailer: : Microsoft Outlook 12/18/2001 17:37:54 Qc5162d6 TEST: 10 heur=0.999021 t[]domain=10 12/18/2001 17:37:54 Qc5162d6 TEST: 9 heur=0.999021 t[]domain=9 12/18/2001 17:37:54 Qc5162d6 TEST: 8 heur=0.999021 t[]domain=8 12/18/2001 17:37:54 Qc5162d6 SPAMHEADERS:3 SPAMROUTING:4 HEUR9:4 . Total weight = 11 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 3 [EMAIL PROTECTED] 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 63.107.174. 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (63.107.174.) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 hm-software.com 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 128.192.1.101 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (128.192.1.101) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 130.160.4.249 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (130.160.4.249) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 199.232.158.102 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (199.232.158.102) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 nytimes.com 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 148.100.1.2 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (148.100.1.2) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 64.65.65.2 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (64.65.65.2) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 lists.cnn.com 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 timeinc.com 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 deepmetrix.com 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 uni.de 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 2 206.242.213.5 12/18/2001 17:37:54 Qc5162d6 IP 211.73.11.3 not in whitelist (206.242.213.5) 12/18/2001 17:37:54 Qc5162d6 Testing whitelist 1 stellenmarkt.de 12/18/2001 17:37:54 Qc5162d6 Looping... 12/18/2001 17:37:54 Qc5162d6 S<[EMAIL PROTECTED]> 12/18/2001 17:37:54 Qc5162d6 Looking up MX/A record for earthlink.net at 63.107.174.65. 12/18/2001 17:37:54 Qc5162d6 Done with MX/A record 12/18/2001 17:37:54 Qc5162d6 Opening HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains 12/18/2001 17:37:54 Qc5162d6 Domain name = jjgold.com, User name = joseph. 12/18/2001 17:37:54 Qc5162d6 Using CFG file global.cfg. 12/18/2001 17:37:54 Qc5162d6 .............X.....XX..X.XX 12/18/2001 17:37:54 Qc5162d6 Test #13 [ORDB weight=0] triggered; action = 0 12/18/2001 17:37:54 Qc5162d6 Test #19 [SPAMHEADERS weight=3] triggered; action = 4 12/18/2001 17:37:54 Qc5162d6 Msg failed SPAMHEADERS (This E-mail has headers consistent with spam [60004103].). 12/18/2001 17:37:54 Qc5162d6 Test #20 [SPAMROUTING weight=4] triggered; action = 4 12/18/2001 17:37:54 Qc5162d6 Msg failed SPAMROUTING (This E-mail was routed in a poor manner consistent with spam [60004103].). 12/18/2001 17:37:54 Qc5162d6 Test #23 [HEUR9 weight=4] triggered; action = 0 12/18/2001 17:37:54 Qc5162d6 Test #25 [WEIGHT10 weight=10] triggered; action = 0 12/18/2001 17:37:54 Qc5162d6 Test #26 [WEIGHT8 weight=8] triggered; action = 0 12/18/2001 17:37:54 Qc5162d6 X-Declude-Note: Processed by Declude 1.30; remote host (timeout) 12/18/2001 17:37:54 Qc5162d6 AlterMessage 12/18/2001 17:37:54 Qc5162d6 Subject: Increase Your Size And Performance NOW 28138 12/18/2001 17:37:54 Qc5162d6 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 12/18/2001 17:37:54 Qc5162d6 Looping... 12/18/2001 17:37:54 Qc5162d6 Done Looping 12/18/2001 17:37:54 Qc5162d6 Final action=0. 12/18/2001 17:37:54 Qc5162d6 D:\IMAIL\spool\Qc5162d6.SMD 12/18/2001 17:37:54 Qc5162d6 Unlocked D:\IMAIL\spool\Qc5162d6.SMD. 12/18/2001 17:37:54 Qc5162d6 Passing to SMTP3: D:\IMAIL\SMTP32.EXE "D:\IMAIL\spool\Qc5162d6.SMD". 12/18/2001 17:37:54 Qc5162d6 Total Time: 1860ms Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Andy Schmidt Sent: Tuesday, December 18, 2001 05:10 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] ORBL still in your Config sample Importance: High Scott: Every so often I match my config files to your samples. I see that you added ORBL back in - but your IP4r page claims it no longer exists. Who is right? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
$default$.junkmail
Description: Binary data
Global.cfg
Description: Binary data
