Hi;
With Scott's help I finally think the reason Declude is not being seen in our case, in rare occasions, is understood.
It just happened that we found a trend that matched exactly our update cycle for the filters.
In our system we have an auto-update of filters from our database to the IMail directory. In the update process we copy all the filters to the filter directory and copy the Kill list to the IMail directory. Then (here is the problem..) we stop the SMTP and then start the SMTP all in one batch file.
This is done every other hour at 1/2 past the hour.
All spams that were not having Declude headers were somehow showing a x:30 in their time stamp..
So..
It seems like if an email is being processed and during the SPAM processing by IMail one stops the SMTP then all bets are off and the email will be delivered.
Lesson learned: Too much automation could be hazardous to your spam fighting system. :)
Regards,
Kami
