I received 2 online pharmacy spams to my inbox (log snips and headers attached). One came in Saturday night at ~9:11, the other ~9:36. They were queued, then on Sunday at 3:32 AM, they were both delivered. They were never scanned by Declude.
I'm trying to figure out what happened. First of all, why is there such a delay? Second why were the queue files renamed from .SMD to .RMD? Third, why weren't they passed off to Declude? Here are the changes I made on Friday at ~2:00 PM: Upgraded to Declude 2.04 from 1.82 Commented out the SPAMCHK test in global.cfg. No changes have been made to Imail. There is a scheduled task that runs at 3:00 AM that reboots the Imail server. I suspect that the first queue run after reboot was when they were delivered. Thanks for any assistance.
NOTE: MX2.rmslink.net is my postfix gateway. Here is the Imail log MSG1: 20050211 211139 127.0.0.1 SMTPD (65db01d80148355c) [172.20.5.2] connect 68.118.154.7 port 54419 20050211 211139 127.0.0.1 SMTPD (65db01d80148355c) [68.118.154.7] EHLO mx2.rmslink.net 20050211 211139 127.0.0.1 SMTPD (65db01d80148355c) [68.118.154.7] MAIL FROM:<[EMAIL PROTECTED]> 20050211 211139 127.0.0.1 SMTPD (65db01d80148355c) [68.118.154.7] RCPT TO:<[EMAIL PROTECTED]> 20050211 211139 127.0.0.1 SMTPD (65db01d80148355c) [68.118.154.7] S:\imail\spool\D65db01d80148355c.SMD 4053 20050212 033231 127.0.0.1 SMTP (0000000000000000) Info - Adding Queue file S:\imail\spool\Q65db01d80148355c.RMD 20050212 033231 127.0.0.1 SMTP (65db01d80148355c) processing S:\imail\spool\Q65db01d80148355c.RMD 20050212 033232 127.0.0.1 SMTP (65db01d80148355c) forwarded message to [EMAIL PROTECTED] 20050212 033232 127.0.0.1 SMTP (65db01d80148355c) ldeliver mail.taisweb.net copyall-main (1) [EMAIL PROTECTED] 4053 20050212 033232 127.0.0.1 SMTP (65db01d80148355c) finished S:\imail\spool\Q65db01d80148355c.RMD status=1 And these are the headers of the email MSG1: Received: from SMTP32-FWD by mail.wilcoxtravel.com (SMTP32) id A65DB01D80148355C; Sat, 12 Feb 2005 03:32:32 Received: from mx2.rmslink.net [68.118.154.7] by mail.taisweb.net with ESMTP (SMTPD32-8.15) id A5DB1D80148; Fri, 11 Feb 2005 21:11:39 -0500 Received: from wilcoxtravel.com (c-24-118-16-119.mn.client2.attbi.com [24.118.16.119]) by mx2.rmslink.net (Postfix) with SMTP id 3DBC339836 for ; Fri, 11 Feb 2005 21:10:53 -0500 (EST) X-Message-Info: FqS6gQcHx77o1H7RqHr Received: from scfzubp1.msn.com ([189.113.6.171]) by q1-r.msn.com with Microsoft SMTPSVC(5.0.2195.6824); Sat, 12 Feb 2005 02:07:55 -0400 Received: from restrict qz25 (carpathia orgiastic originate fleawort sequester faulty oatmeal textile bindle bern orgy tat inventory aphorism whimsey deja malaria spool greenbriar algaecide macdonald parthenon athlete novo actinide bourbon bottleneck rivulet rudolf serf schizophrenia danzig scrupulosity pate calculable terrific auric relict yacht starve diagnostic sixtieth mobility patriotic missionary bassett rejoinder envoy mysterious uphill monarchic musk mausoleum crater intestate feasible morose impetuous nelson douse borderland ami washbasin abominable crosswort trencherman leander oceanography apropos croupier weasel typology pinkish endothermic gerundial trypsin concretion graveyard orphan limbo thrush snail hereford staunton degrade student winters fredericks fern convolute mall fare walnut graceful crease pod crypt meter vie marshall star indium aniline rightmost impolite hedgehog therapy granny megohm lackey fibration approach impeach boxy exert professor needham s old inbred resentful canton reinforce aperture pecuniary wert malraux geiger knickerbocker elinor schnapps benjamin brasilia dynamite hippopotamus astral conspiracy loose cluj vaudois missy chalet histochemistry skullduggery quintic terrible troop numerology occurrent inroad spitz grommet chigger bipartisan hokan waggle roustabout urine heel therewith promote roister corona triode shrewd ) From: "Emery U" To: "'%TO_NAME'" Subject: Emery invites you to a private med warehouse Date: Sat, 12 Feb 2005 02:08:22 +0000 Message-ID: <[EMAIL PROTECTED] repudiate [1-3]wf[1-3]38[1-3]70[1-3]> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_ED41F_153E1AFF.15E33A00" X-RCPT-TO: Status: U X-UIDL: 403220807 Here is the Imail log MSG2: 20050211 193657 127.0.0.1 SMTPD (4fa90132012c3072) [172.20.5.2] connect 68.118.154.7 port 64078 20050211 193657 127.0.0.1 SMTPD (4fa90132012c3072) [68.118.154.7] EHLO mx2.rmslink.net 20050211 193657 127.0.0.1 SMTPD (4fa90132012c3072) [68.118.154.7] MAIL FROM:<[EMAIL PROTECTED]> 20050211 193657 127.0.0.1 SMTPD (4fa90132012c3072) [68.118.154.7] RCPT TO:<[EMAIL PROTECTED]> 20050211 193657 127.0.0.1 SMTPD (4fa90132012c3072) [68.118.154.7] S:\imail\spool\D4fa90132012c3072.SMD 4126 20050212 033231 127.0.0.1 SMTP (0000000000000000) Info - Adding Queue file S:\imail\spool\Q4fa90132012c3072.RMD 20050212 033231 127.0.0.1 SMTP (4fa90132012c3072) processing S:\imail\spool\Q4fa90132012c3072.RMD 20050212 033232 127.0.0.1 SMTP (4fa90132012c3072) ldeliver mail.taisweb.net copyall-main (1) [EMAIL PROTECTED] 4126 20050212 033232 127.0.0.1 SMTP (4fa90132012c3072) forwarded message to [EMAIL PROTECTED] 20050212 033232 127.0.0.1 SMTP (4fa90132012c3072) ldeliver mail.taisweb.net dan-main (1) [EMAIL PROTECTED] 4126 20050212 033232 127.0.0.1 SMTP (4fa90132012c3072) finished S:\imail\spool\Q4fa90132012c3072.RMD status=1 Found '4fa90132012c3072' 8 time(s). And these are the headers of the email MSG2: Received: from mx2.rmslink.net [68.118.154.7] by mail.taisweb.net with ESMTP (SMTPD32-8.15) id AFA9132012C; Fri, 11 Feb 2005 19:36:57 -0500 Received: from taisweb.net (unknown [207.248.159.234]) by mx2.rmslink.net (Postfix) with SMTP id 055443988E for ; Fri, 11 Feb 2005 19:36:11 -0500 (EST) X-Message-Info: UjJ2oOpJg7r76E3JkAwq Received: from ragscif5.msn.com ([86.25.15.231]) by g06-aa.msn.com with Microsoft SMTPSVC(5.0.2195.6824); Sat, 12 Feb 2005 00:32:52 +0400 Received: from drink wo4 (brassy patriot ambrosia dispute surname detention offshoot qua dialect madrid vendetta banks libido sprint ally barth syntheses fayetteville neural cobblestone fairchild concede factory breastwork cardinal jesse ottawa litigant sawfly abyss transceiver handy steve distillery somers irate pursuant avail gimpy bertram grendel wreathe array apostate centennial virtual tailspin chinamen embeddable armstrong glue gunsling seed baptiste trigonal suburb maudlin veracity brewster administratrix amputee kaufman opinion locoweed toilet binocular junketeer shadflower hysterectomy bryozoa fifth nutshell descend jolla recess epimorphism cataclysm carolina cryptographer barber gestalt cozen lebesgue obsequy chinamen apex witchcraft pappas dollop essex hellfire possessive leonine visigoth dapple husbandman vermilion rubin kenney roustabout freeport buyer donahue busch freud jest stork parallel digital noise dignity dallas yaw shakespeare hieratic clubroom manometer disc commit grimace adolph pillage tremble serge deemphasize goldfish royal kenney mills ashmen desirous scheme glacis onerous alacrity loosen downright delivery guest elegiac connecticut siamese oatmeal desecrate leander lummox medea rout augustine excursion shift regimen wynn trigonal afloat phi wigging cottonwood fuel tradeoff golden shoal whitehead lubricate deaf bear could sri cycad view pepsi draftsmen hyperbola brute prevail staph conjectural pique climax lodgepole cinch dilogarithm somehow malignant cuckoo noodle emitting ) From: "Reid H" To: "'%TO_NAME'" Subject: Reid invites you to a private med warehouse Date: Sat, 12 Feb 2005 00:34:49 +0300 Message-ID: <[EMAIL PROTECTED] padlock [1-3]ip[1-3]4[1-3]47[1-3]> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_FB50F_0BFA4F36.3587CE78" X-RCPT-TO: Status: R X-UIDL: 403220806
