Here is the Imail 8 log:
01:07 13:13 SMTPD(d15f7804014ea63d) [63.107.174.14] connect 67.132.45.18 port 2525
01:07 13:13 SMTPD(d15f7804014ea63d) [67.132.45.18] EHLO mail.dollardays.com
01:07 13:13 SMTPD(d15f7804014ea63d) [67.132.45.18] MAIL FROM:...
I set up a filter to simpify reporting on mail coming from a certain gateway:
REMOTEIP -1 IS 67.132.45.18 HEADERS -2 CONTAINS X-Virus-Scanned: SpammerTrap HELO -4 CONTAINS mail.dollardays.com
Do you have %HELO% in the headers anywhere? If so, that should show you what Declude JunkMail is looking at.
Remember, Declude JunkMail looks at the HELO/EHLO of the remote mailserver, based on IPBYPASS/HOP settings, so it may not be the same as what IMail sees (but should always be the same if IPBYPASS/HOP is not being used).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
