I think I've solved this one, but am curious how it could have happened...

I had an employee receive a spam which should have been labeled as spam but was not. My setup has a $default.$JunkMail at the root of Declude which only warns. Then I have a $default.$JunkMail for the domain which labels spam as [Spam?]. All this has been working fine for years.

It's as though this message was treated by the root's $default$JunkMail, not the domain's. Perhaps it has something do with the message addressed to [EMAIL PROTECTED] with the rest of the recipients as BCCs. But, the postmaster was for mydomain so it should have been using the domain's $default.$JunkMail.

Either way, I set the root $default.$JunkMail to label spam instead of just warning, so this shouldn't happen again.

But, as I said, I'm just curious how this would happen. I didn't think any messages used the root's $default.$JunkMail if all my domain's have their own.

Thanks,
D.
Here's the gory details:
Reply-To: "Matthewson Jackson"<[EMAIL PROTECTED]>
From: "Matthewson Jackson"<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: =?ISO-8859-3?B?cG9zdG1hc3RlcixTYW1wbGUgb2Ygd2VpZ2h0IGxvc3MgcHJvZHVjdCEg?=
Date: Fri, 13 Jun 2003 01:38:33 GMT
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
X-RBL-Warning: ORDB: This mail was handled by an open relay - please visit <http://ORDB.org/lookup/?host=211.91.4.14>
X-RBL-Warning: OSRELAY: This entry was last confirmed open on 6/11/2003
X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?211.91.4.14
X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: REVDNS: This E-mail was sent from a mail server 211.91.4.14 with no reverse DNS entry.
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000120f].
X-RBL-Warning: WEIGHT10: Weight of 37 reaches or exceeds the limit of 10.
X-Declude-Spoolname: Df609128.SMD
X-Spam-Tests-Failed: ORDB, OSRELAY, SPAMCOP, NOABUSE, NOPOSTMASTER, REVDNS, SPAMHEADERS, WEIGHT10



Reply via email to