Thanks for the fast response! Here is the declude log for the email in question:
06/06/2003 11:13:28 Qaf97002e0138490a Msg failed MX; testing A (mail.networkorlando.com) [1 1 0 ] 06/06/2003 11:13:28 Qaf97002e0138490a BLACKLIST:8 . Total weight = 8 06/06/2003 11:13:28 Qaf97002e0138490a Using [incoming] CFG file d:\IMail\Declude\$default$.junkmail. 06/06/2003 11:13:28 Qaf97002e0138490a Msg failed BLACKLIST (). 06/06/2003 11:13:28 Qaf97002e0138490a Subject: Curry Ford / Alafaya 06/06/2003 11:13:28 Qaf97002e0138490a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] SMTP Imail log: 06:06 11:13 SMTPD(007A0120) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(008B009A) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(00290138) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(0051014C) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(007A0120) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(008B009A) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(007A0120) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(0051014C) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(008B009A) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(0051014C) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(007A0120) [209.26.230.188] d:\IMail\spool\Daf7e007a0120e7fe.SMD 1775 06:06 11:13 SMTPD(008B009A) [209.26.230.188] d:\IMail\spool\Daf7f008b009ae80e.SMD 1396 06:06 11:13 SMTPD(0051014C) [209.26.230.188] d:\IMail\spool\Daf7f0051014ce83c.SMD 1186 06:06 11:13 SMTP-(00000464) processing d:\IMail\spool\Qaf7f0051014ce83c.SMD 06:06 11:13 SMTP-(00000F20) processing d:\IMail\spool\Qaf7f008b009ae80e.SMD 06:06 11:13 SMTP-(00000464) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 1299 06:06 11:13 SMTP-(00000464) finished d:\IMail\spool\Qaf7f0051014ce83c.SMD status=1 06:06 11:13 SMTP-(00000F20) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 1509 06:06 11:13 SMTP-(00000F20) finished d:\IMail\spool\Qaf7f008b009ae80e.SMD status=1 06:06 11:13 SMTP-(00000FA8) processing d:\IMail\spool\Qaf7e007a0120e7fe.SMD 06:06 11:13 SMTP-(00000FA8) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 1888 06:06 11:13 SMTP-(00000FA8) finished d:\IMail\spool\Qaf7e007a0120e7fe.SMD status=1 06:06 11:13 SMTPD(00290138) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(00290138) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(00290138) [209.26.230.188] d:\IMail\spool\Daf8400290138fb96.SMD 9563 06:06 11:13 SMTP-(00000ED0) processing d:\IMail\spool\Qaf8400290138fb96.SMD 06:06 11:13 SMTP-(00000ED0) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 9676 06:06 11:13 SMTP-(00000ED0) finished d:\IMail\spool\Qaf8400290138fb96.SMD status=1 Any ideas? The entire email header was sent over and there was no X-Declude-Sender. Also, What is the difference within the blacklist.txt file contain entries that begin with a period (.junkmail.com), @ (@junkmail.com), or just blank (junkmail.com) Maybe there is something wrong with my file. Thanks -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, June 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Blacklist False Positive Tests >Any ideas why would the following email headed be caught by my blacklist file? > >GLOBAL file: > >BLACKLIST fromfile d:\imail\Declude\blacklist.txt >x 8 0 This is a sender blacklist, which checks the return address of the E-mail. However, the headers that you supplied do not include the return address of the E-mail -- you can find it either in an X-Declude-Sender: header, or the IMail SMTP log file (in the MAIL FROM line). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
