I've got a strange situation with one of our users. He keeps getting mail from a porn
spammer even though I've set up a specific test just for him to attempt to get rid of
all mail from 3 specific domains.
I've defined a test in the global.cfg file called PERMBLACKLIST with a weight of 10.
The $default$.junkmail file is set to WARN on all defined test, except for the
WEIGHT10 test which is set to DELETE.
This particular user is still getting mail from the domains listed in PERMBLACKLIST
txt file. The headers show that the mail is indeed failing the PERMBLACKLIST test,
but for some reason the WEIGHT10 test is not being triggered. Here is a copy of the
header info from one of these messages (with redactions to protect both the guilty and
the innocent):
Received: from pmail23.impulsive.com
by mail.qsl.net (8.11.6/8.11.6) with ESMTP id g7L7HrC04636
for <[EMAIL PROTECTED]>; Wed, 21 Aug 2002 03:17:54 -0400
Received: from absolutefreesmt.com (localhost [127.0.0.1])
by pmail23.impulsive.com (Postfix) with ESMTP id 4A45C7DB59
for <[EMAIL PROTECTED]>; Wed, 21 Aug 2002 03:15:33 -0400 (EDT)
To: [EMAIL PROTECTED]
From: "Nikki" <[EMAIL PROTECTED]>
Subject: ANAL BLISS
X-Priority: 3 (Normal)
Importance: Normal
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Reply-To: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
Content-type: text/html
Message-Id: <[EMAIL PROTECTED]>
Date: Wed, 21 Aug 2002 03:15:33 -0400 (EDT)
X-RBL-Warning: PERMBLACKLIST: hardcore porn spammer
X-Declude-Sender: [EMAIL PROTECTED] [63.238.179.181]
X-Declude-Spoolname: D3dc994a6008694a5.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: PERMBLACKLIST
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 326893399
This email is originally hitting his account at qsl.net which forwards to his account
here at stic.net. Is that somehow creating a problem? I've doublechecked to see if
his account is using a .junkmail file other than the default, but it isn't. I suppose
I can create a separate .junkmail for his mailbox that associates the PERMBLACKLIST
test with the DELETE action, but I'd like to first figure out why these messages are
not failing the WEIGHT10 test.
Thank you,
Bart Lackorn
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
