Scott: >> This could be caused by the same problem as with the last message (the global.cfg file being used), if it is set to just "WARN" without any custom text. <<
You seem to be right on this point. Out of 15 spam messages that had SPAMHEADERS/BADHEADERS that were allowed to pass through, I finally found ONLY ONE that had the correct customized headers. However - this really seems to be a NEW problem that has been introduced in this NEW release. I have a 15:1 FAILURE ratio from what I can say. A lot of SPAM is getting through! I have a hard time believing that a problem of THAT extent existed all along and could have slipped past me. You know that I've been spending quite some time analyzing log files and catching these bugs. Best Regards Andy -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, December 18, 2001 07:29 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Verison 1.3.0 - Custom Warnings Broken >Now, look at the following SMTP header and notice that my custom text does >NOT appear at all? > >X-RBL-Warning: This E-mail was sent from a broken mail client [a0020103]. >X-RBL-Warning: This E-mail was routed in a poor manner consistent with >spam [a0020103]. >X-RBL-Warning: This E-mail was sent from a mail server [No Reverse DNS] >with no reverse DNS entry. This could be caused by the same problem as with the last message (the global.cfg file being used), if it is set to just "WARN" without any custom text. >Problem 2: In addition, the DECLUDE.LOG shows: > >12/18/2001 17:55:21 Qc94b1d8 OSRELAY:6 BADHEADERS:5 SPAMROUTING:4 REVDNS:5 >HEUR10:4 . Total weight = 24 >12/18/2001 17:55:21 Qc94b1d8 Msg failed BADHEADERS (This E-mail was sent >from a broken mail client [a0020103].). >12/18/2001 17:55:21 Qc94b1d8 Msg failed SPAMROUTING (This E-mail was >routed in a poor manner consistent with spam [a0020103].). >12/18/2001 17:55:21 Qc94b1d8 Msg failed REVDNS (This E-mail was sent from >a mail server [No Reverse DNS] with no reverse DNS entry.). >12/18/2001 17:55:21 Qc94b1d8 Subject: Nu Electric - Stock Alert >12/18/2001 17:55:21 Qc94b1d8 From: ><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] To: ><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] >a) So with a total weight of I should not even be LOOKING at this message! >b) Look back at the headers and notice that the WARN action for OSRELAY >and HEUR10 was not performed. That, too, sounds like the same problem; the WEIGHT10 test, OSRELAY, and HEUR10 actions were taken from the global.cfg file rather than the $default$.JunkMail file. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
