No problem, Bennie. The MailPolice tests are RHSBL tests, which means that they test the domain name instead of of the IP address of the sender:
# For information on these tests, see http://rhs.mailpolice.com/ MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 10 0 You can set the weights according to your own traffic and your measure of trust in these lists. And of course you need a corresponding action like MAILPOLICE-BULK WARN in your global.cfg or your domain specific $default$.junkmail Also, the listing for the sending IP is still in the SORBS test I saw triggered, so perhaps you're not using all of the SORBS tests: # For more information on these tests, see http://www.dnsbl.sorbs.net/ # Hosts that send spam and netblocks of providers that support spammers # sometimes includes abused providers like Sympatico and AT&T SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 4 0 There are something like a dozen SORBS tests, and you may not be interested in all of them, and you may want to score them differently. For example, I use SORBS-SPAM but I give it a low weight, but I also use SORBS-ZOMBIE and give it a much higher weight. Andrew 8) -----Original Message----- From: Bennie [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Kill List not working..... Thanks for the help guys. Andrew.. I have the sorbs inplace but I see it did not fail those.. what is the line for mailpolice? Bennie ----- Original Message ----- From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, February 10, 2004 3:34 PM Subject: RE: [Declude.JunkMail] Kill List not working..... > Ah, perhaps you have more time to spend on your antispam system than I do! > > Andrew 8) > > -----Original Message----- > From: Jason [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 10, 2004 12:14 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Kill List not working..... > > > Ah, but the Kill.lst is an envelope rejection. It saves many more > resources this way. > > Jason > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Tuesday, February 10, 2004 2:03 PM > To: '[EMAIL PROTECTED]' > Subject: RE: [Declude.JunkMail] Kill List not working..... > > > Bennie, blocking spammers by their domain name only is a losing > proposition. You're already using SBL... I'd suggest that you also > implement the SORBS tests and the MAILPOLICE tests. > > Checking my own spam, we also received mail from this spammer, but we > caught it without having to check for their domain name du jeur. > > Andrew. > > -----Original Message----- > From: Bennie [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 10, 2004 3:18 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Kill List not working..... > > > Hello all. > > I was asked some time ago to add a domail to my kill list.. I added it. > But the customer is still recieving spam from this domail. They sent me > the headers (I have them listed below) and I see the domail in the > headers. but I never see where it failed the KillList. > > Headers------------------------------- > > Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net > (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 > Date: Mon, 09 Feb 2004 23:57:24 -0500 > Subject: Exclusive XXXXX-Soaked Model Photos > From: Budapest Bukkake <[EMAIL PROTECTED]> > To: > Return-Path: [EMAIL PROTECTED] > X-Sender: [EMAIL PROTECTED] > X-Mailer: Mailer Software (rev. 01/15/2004) > Message-Id: <[EMAIL PROTECTED]> > MIME-version: 1.0 > Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" > X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 > X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 > with no reverse DNS entry. > X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of > 10. > X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) > for spam. > X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 > [12] > X-Note: QueInControl: D6398669f014033a3.SMD (1) > X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 > [12] > X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] > X-Note: SMTP Real From: [EMAIL PROTECTED] > X-Note: SMTP Real To: > X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). > X-RBL-Warning: Total spam weight of this E-mail is 12. > X-RCPT-TO: > Status: U > X-UIDL: 374908735 > > Here is the entry in my killl list file > > .ramthehole.com ID-20040204-pep007 > > here is the line from my GLOBAL.CFG > > KFROM fromfile e:\imail\declude\fromfile.txt x > 15 0 > KFrom WARN > > Line from $DEFAULT$.JUNKMAIL > > KFROM WARN X-RBL-Warning: This E-mail failed the KILL File test > > Thanks > Bennie > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
