John's semi right. Forgive me for not using plain text...but
I've colored the lines red and put ** by it. The first line is imail whitelist,
the next 2 are declude. Does declude understand when imail
whitelists?
Maybe I got it - under trusted addresses ameripride.org and
our other domain WERE in there - I've removed it.
----- Original Message -----
Sent: Thursday, February 24, 2005 4:29
PM
Subject: RE: [IMail Forum] odd
behavior
No it is not. Look
at the log line again. It is in the Imail log and that line is on the SMTPD
line. Declude does not log to the Imail log.
John
Tolmachoff
Engineer/Consultant/Owner
eServices For
You
-----Original
Message----- From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of E. Shanbrom
(Ipswitch) Sent:
Thursday, February 24,
2005 12:48
PM To:
IMail_Forum@list.ipswitch.com Subject: Re: [IMail Forum] odd
behavior
Says ameripride.org is on the
whitelist (decludes not IMail's)
----- Original Message -----
Sent:
Thursday, February 24,
2005 3:03
PM
Subject: Re:
[IMail Forum] odd behavior
Trying to figure out why it's white listed.
02:22 07:40 SMTPD(3664039604421990) [192.168.0.135] connect
221.127.179.32 port 1194 02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] HELO
67.130.17.126 02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] MAIL FROM:
<[EMAIL PROTECTED]> 02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] RCPT TO:
<[EMAIL PROTECTED]> 02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] RCPT TO:
<[EMAIL PROTECTED]> 02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] RCPT TO:
<[EMAIL PROTECTED]> 02:22 07:41 SMTPD(3664039604421990) [221.127.179.32]
d:\IMail\spool\D3664039604421990.SMD 201 02:22 07:41 SMTP-(3664039604421990) processing
d:\IMail\spool\Q3664039604421990.SMD **
02:22
07:41 SMTPD(3664039604421990)
[ameripride.org] in white list 02/22/2005 07:41:11 Q3664039604421990 Scanned: Virus Free
02/22/2005 07:41:14 Q3664039604421990 L1 Message
OK 02/22/2005 07:41:14 Q3664039604421990 Tests failed [weight=25]:
BADHEADERS=WARN CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE
REVDNS=WARN TLD=WARN COUNTRY=WARN WEIGHT10PLUS=SUBJECT CATCHALLMAILS=IGNORE
02/22/2005 07:41:14 Q3664039604421990 L2 Message
OK 02/22/2005 07:41:14 Q3664039604421990 Tests failed [weight=25]:
BADHEADERS=WARN CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE
REVDNS=WARN TLD=WARN COUNTRY=WARN WEIGHT10PLUS=SUBJECT CATCHALLMAILS=IGNORE
** 02/22/2005 07:41:14 Q3664039604421990 Skipping4
E-mail from [EMAIL PROTECTED];
whitelisted [EMAIL PROTECTED] **
02/22/2005
07:41:14 Q3664039604421990 Skipping4
E-mail from [EMAIL PROTECTED];
whitelisted [EMAIL PROTECTED] 02/22/2005 07:41:14 Q3664039604421990 L3 Message
OK 02/22/2005 07:41:14 Q3664039604421990 Tests failed [weight=0]:
CATCHALLMAILS=IGNORE 02:22 07:41 SMTP-(3664039604421990) ldeliver
mail.ameripride.org maria.snyder-main (1) [EMAIL PROTECTED]
972 02:22 07:41 SMTP-(3664039604421990) ldeliver
mail.ameripride.org reggie.licari-main (1) [EMAIL PROTECTED]
972 02:22 07:41 SMTP-(3664039604421990) ldeliver
mail.ameripride.org richard.boudreau-main (1) [EMAIL PROTECTED]
972 02:22 07:41 SMTP-(3664039604421990) finished
d:\IMail\spool\Q3664039604421990.SMD status=1
----- Original Message -----
Sent:
Thursday, February 24,
2005 1:09
PM
Subject: RE:
[IMail Forum] odd behavior
What do the logs
show you?
T
I have the following type of email showing
up...basically blank.
I'm trying to figure out if our imail server is
hacked or something - because it's coming from local
host.
Any ideas here? Got 8.15 and the most current
release of declude running.
Received: from 67.130.17.126 [221.127.179.32] by
mail.ameripride.org (SMTPD32-8.15) id A66D3960442;
Tue, 22 Feb
2005
07:41:01 -0600 Received: from localhost (HELO localhost
[127.0.0.1]) by acts X-RBL-Warning: BADHEADERS: This E-mail
was sent from a broken mail client [8c200001]. X-RBL-Warning: CMDSPACE:
Space found in RCPT TO: command. X-RBL-Warning: REVDNS: This E-mail was
sent from a MUA/MTA 221.127.179.32 with no reverse DNS
entry. X-RBL-Warning: TLD: Message failed TLD test (line 14, weight
0) X-RBL-Warning: COUNTRY: Message failed COUNTRY test (line 116,
weight 6) X-Declude-Sender: [EMAIL PROTECTED]
[221.127.179.32] X-Declude-Spoolname: D3664039604421990.SMD X-Note:
This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam. X-Spam-Tests-Failed: Whitelisted [0] X-Country-Chain:
HONG
KONG->destination X-Note: This E-mail was sent
from [No Reverse DNS] ([221.127.179.32]). From: [EMAIL PROTECTED] Date:
Tue, 22 Feb
2005
07:41:15 -0600 X-RCPT-TO: <[EMAIL PROTECTED]> Status:
U X-UIDL: 377156391
*Scanned for viruses by Declude
Virus*
|