More on this, I think I've discovered what prompted the question in the
first place. Unfortunately I had logging set to low, so I can't provide a
lot of details.
We're using the setting in global.cfg of:
WHITELIST REVDNS hotmail.com
And it doesn't seem to be catching the Email coming in from forged hotmail
domains, here's the headers of one that came in recently...
Received: from hotmail.com [4.64.66.107] by kendra.com
(SMTPD32-6.06) id A3152830252; Thu, 06 Feb 2003 23:41:09 -0800
Message-ID: <001300c1aa42$ecc55054$[EMAIL PROTECTED]>
From: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Re: Here ya go!
Date: Thu, 06 Feb 2003 20:01:36 +1200
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
X-Priority: 3
X-Mailer: OutLook Xpress 3.0
Importance: Normal
X-RBL-Warning: DSBL: http://dsbl.org/listing.php?4.64.66.107
X-Spam-Tests-Failed: DSBL, IPNOTINMX
X-Note: This E-mail was sent from
lsanca2-ar16-4-64-066-107.lsanca2.dsl-verizon.net ([4.64.66.107]).
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 1272
Status: U
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Thursday, February 06, 2003 12:02 AM
To: [EMAIL PROTECTED]
Subject: Re: Here ya go!
And the log file entry...
02/06/2003 23:40:55 Q6305252 E-mail whitelisted - automatically passing all
spam tests [hotmail.com]
02/06/2003 23:40:55 Q6305252 Subject: Fwd: Really cool....
02/06/2003 23:40:55 Q6305252 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]
02/06/2003 23:41:12 Q6315252 DSBL:6 . Total weight = 6
02/06/2003 23:41:12 Q6315252 Msg failed DSBL
(http://dsbl.org/listing.php?4.64.66.107). Action=WARN.
02/06/2003 23:41:12 Q6315252 Subject: Re: Here ya go!
02/06/2003 23:41:12 Q6315252 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]
--------------
Rich Griebel
[EMAIL PROTECTED]
http://www.kendra.com
Scanned for Viruses using Declude and F-Prot
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
