I am against subtracting points from and email based on an exturnal test. We only add weight unless we are counterweighting a known issue with valid email.
Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry > Sent: Friday, March 19, 2004 1:47 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] SPFPASS (Junk) > > > I have to agree with Matt. I am starting to see quite a few spam messages > from the same spammer that has now implemented SPF for the following three > domains: > > yfdvdsmail.com > freefamilydeals.com > americanfamilydeals.com > > I primarily now use SPF for adding negative weight for SPF fails. > > Bill > ----- Original Message ----- > From: "Matt" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, March 19, 2004 12:25 PM > Subject: Re: [Declude.JunkMail] SPFPASS (Junk) > > > > So zombie spamers forge Habeas, and ROKSO spammers give themselves SPF > > records. Not a surprise. > > > > You can't stop them from doing this, so I might suggest not crediting > > any points to those that pass. > > > > Matt > > > > > > > > Frederick Samarelli wrote: > > > > > > This is the offending header. > > > > > > > > Received: from mail13.americanfamilydeals.com ([69.56.11.46]) > > > > by DNS2.tcbinc.net (SAVSMTP 3.1.3.37) with SMTP id M2004031909522726515 > > > > for <mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]>; > > Fri, 19 Mar 2004 09:52:29 -0500 > > > > Message-ID: > > > > > > <mailto:[EMAIL PROTECTED] > > als.com> > > <[EMAIL PROTECTED] > > > > > > > Date: Fri, 19 Mar 2004 08:52:30 -0600 (CST) > > > > From: "Point.com" > > > > <mailto:[EMAIL PROTECTED]> > > <[EMAIL PROTECTED]> > > > > Reply-To: American Family Deals > > > > <mailto:[EMAIL PROTECTED]> > > <[EMAIL PROTECTED]> > > > > To: Nancy Gladwell <mailto:[EMAIL PROTECTED]> > > <[EMAIL PROTECTED]> > > > > Subject: [~23]Cell Phone, Accessories & Shipping at NO Cost > > > > Mime-Version: 1.0 > > > > Content-Type: multipart/alternative; > > > > boundary="----=_Part_1277094_8887513.1079707950959" > > > > X-nb: zspttavsabivfviftpfnfnnn maifvvbmwpmfifmpa pmfwstssn > > > > X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail > > > > detected. [2-3-1800] > > > > X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. [2-6-3000] > > > > X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. [2-17-8800] > > > > X-RBL-Warning: MAILPOLICE-BULK: This E-mail came from > > > > mxllvniqnx.americanfamilydeals.com, a potential spam source listed in > > > > MAILPOLICE-BULK. [2-26-d000] > > > > X-RBL-Warning: SBL-XBL: > > > > "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9613"; > > <http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9613> [2-33-10800] > > > > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 426, > > weight 3) > > > > [2-57-1c800] > > > > X-Declude-Sender: > > [EMAIL PROTECTED] > > <mailto:[EMAIL PROTECTED]> > > > > [69.56.11.46] > > > > X-Declude-Spoolname: D09300e8a005e2c5b.SMD > > > > X-RBL-Warning: Total weight: 23 > > > > X-Note: Sent from: > > [EMAIL PROTECTED] > > <mailto:[EMAIL PROTECTED]> > > > > X-Note: Sent from Reverse DNS: mail13.americanfamilydeals.com > > > > ([69.56.11.46]). > > > > X-Note: This E-mail was scanned by TCB [1.78i21] for virus. > > > > > > > > ------=_Part_1277094_8887513.1079707950959 > > > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Content-Transfer-Encoding: quoted-printable > > > > > > > > This message contains an HTML formatted message but your email client > > does = > > > > not support the display of HTML. Please view this message in a different > > ma= > > > > il client or forward this email to a web-based mail system. > > > > > > > > ------=_Part_1277094_8887513.1079707950959 > > > > Content-Type: text/html; charset=ISO-8859-1 > > > > Content-Transfer-Encoding: quoted-printable > > > > ----- Original Message ----- > > > > From: "R. Scott Perry" <mailto:[EMAIL PROTECTED]> > > <[EMAIL PROTECTED]> > > > > To: <mailto:[EMAIL PROTECTED]> > > <[EMAIL PROTECTED]> > > > > Sent: Friday, March 19, 2004 11:46 AM > > > > Subject: Re: [Declude.JunkMail] SPFPASS (Junk) > > > > > > > > > > > > > > > > What do we do when we find Junkmail passing the SPF Test. > > > > > > > > Is there a place to report it. > > > > > > > > It should be treated the same way as regular spam that you would report, > > > > but there is a big exception here: you can almost certainly find > > someone > > > > responsible that allowed the spam through. > > > > > > > > If you have the headers, feel free to post them here. > > > > > > > > -Scott > > > > --- > > > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > > > > since 2000. > > > > Declude Virus: Ultra reliable virus detection and the leader in > > mailserver > > > > vulnerability detection. > > > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > > > > > --- > > > > [This E-mail was scanned for viruses by Declude Virus > > > > > > > > ( http://www.declude.com <http://www.declude.com> )] > > > > > > > > --- > > > > This E-mail came from the Declude.JunkMail mailing list. To > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED] > > <mailto:[EMAIL PROTECTED]> , and > > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > > at http://www.mail-archive.com <http://www.mail-archive.com> . > > > > > > > > > > > > > > > > --- > > > > [This E-mail was scanned for viruses by Declude Virus ( > > http://www.declude.com <http://www.declude.com> )] > > > > > > > > --- > > > > This E-mail came from the Declude.JunkMail mailing list. To > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED] > > <mailto:[EMAIL PROTECTED]> , and > > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > > at http://www.mail-archive.com <http://www.mail-archive.com> . > > > > > > > > > > > > > > > > > > -- > > > > ===================================================== > > > > MailPure custom filters for Declude JunkMail Pro. > > > > http://www.mailpure.com/software/ <http://www.mailpure.com/software/> > > > > ===================================================== > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
