This mystery turned out to be postmaster error. We had white listed our own domain name (I know some people don't think that's a good idea), and neglected to include the "@" symbol. So incoming mail appeared to be white listed because a spammer was sending us garbage from "[EMAIL PROTECTED]". I'm posting this embarrassing fact for the benefit of anyone who encounters a similar problem.
Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Monday, December 01, 2003 5:31 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Finding reason for white list > > > > > > What is the exact message in the E-mail headers saying that > > > it was whitelisted? > > > >X-Tests-Failed: Whitelisted > > > > > > > > Are you using WHITELIST AUTH or AUTOWHITELIST? > > > >No and yes. In the case of the particular user whose incoming mail I > >extracted the spam from, none > >of the spammer addresses where in her address book. I also > checked her > >AutoWhite list. > > This looks like a case for the DEBUG mode. > > To use the debug mode, you can change the "LOGLEVEL LOW" line in > \IMail\Declude\global.cfg to "LOGLEVEL DEBUG". Then, after > this problem > occurs again, you can then switch back to "LOGLEVEL LOW" (the > debug mode > adds huge amounts of information to the log file). You can > then E-mail me > the \IMail\spool\dec####.log file (as an attachment, NOT sent > from web > messaging), and I can take a look at it to see what is happening. > > -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
