I know you are busy with viruses - but I can't figure THIS one out. I have thousands of emails in the log file, where SORBS-DUHL is discovered, logged and treated properly. But at least this ONE got through and I have no explanation.
The issue here isn't that the test wasn't logged -- Declude JunkMail doesn't think that the E-mail failed the test at all.
SORBS ip4r dnsbl.sorbs.net * SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 0 0
c) Yet - Declude never logs SORBS-DUHL!?
03/19/2004 08:26:38 Qf50b5b900020628c SPAMCOP:7 nNOLEGITCONTENT:-3 . Total weight = 4.
03/19/2004 08:26:38 Qf50b5b900020628c Subject: Lower your m ortgage today!
03/19/2004 08:26:38 Qf50b5b900020628c From: <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] To: <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] IP: 69.47.96.104 ID:
03/19/2004 08:26:38 Qf50b5b900020628c Tests failed [weight=4]: SPAMCOP=WARN SORBS=WARN IPNOTINMX=IGNORE
In this case, the E-mail failed the SORBS test, but not the SORBS-DUHL test. It does indeed appear that it should have failed the SORBS-DUHL test, given the current information, but it is possible that it wasn't listed correctly yesterday (which would explain what happened). dnsbl.sorbs.net definitely did return *something* -- but what it returned is a mystery.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
