|
The
message is NOT whitelisted (see log and header), so the bypass whitelisting
WORKED. The log and headers look differently, if whilelisting is
effective.
The
purpose of the bypass whitelisting is:
if
weight >= 12 and recipients >= 6 -> bypass the
whitelist
if
weight >= 14 and recipients >= 4 -> bypass the
whitelist
if
weight >= 19 and recipients >= 1 -> bypass the
whitelist
It
fulfilled the last two conditions.
(It
should have fulfilled the first one - since there WERE 6 recipients, but that's
a minor problem of GREATER vs. GREATER THAN).
Once
again, I have NO per-user configuration!
Best
Regards
Andy Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
Maybe a bug/config issue with the bypass
whitelisting. Here's something that caught my eye:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Bypassing whitelisting
of E-mail with weight >=19 (21) and at least 1 recipients
(6).
03/02/2005 19:42:43 Q5d7c1cc602a2951d Bypassing whitelisting
of E-mail with weight >=14 (21) and at least 4 recipients
(6).
03/02/2005 19:42:43 Q5d7c1cc602a2951d NOT bypassing
whitelisting of E-mail with weight >=12 (21) and at least 6
recipients (6).
That doesn't seem to make much sense to me,
but I'm also not a bypass whitelist user. Maybe this was recoded and no
longer acts the same way as before under these conditions. Also, this
message actually failed more tests than what scored 21, but I assume that it
excludes external tests and custom filters in the calculation used for bypass
whitelisting. Since those other scores weren't added in according to
your headers, I am assuming that the bypass whitelisting setting took over and
preempted the other tests from adding points and delivered the message
regardless of what the logs suggest (DELETE).
Note that with the change
in the DELETE action being per-user instead of per-message, it might be
possible to abandon the bypass whitelisting config for a per-user
config.
Matt
Andy Schmidt wrote:
I
don't have actions for different recipients.
So
in my case all recipients have the SAME action.
Except that now ROUTETO outranks DELETE.
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
There was a change that will affect some
configurations. IMO, this was a major change, for better or for
worse, and everyone should review their configurations for the potential
of issues.
http://www.declude.com/Articles.asp?ID=122
|
JM |
FIX |
Changes DELETE action to only delete the E-mail for
recipients using the DELETE action (so it will deliver to any other
recipients) |
Matt
Andy
Schmidt wrote:
Hm,
I may have an idea...
I have the
feeling the problem may be with the "POSTMASTER" filter. The idea
behind it is - if any of the recipients are my [EMAIL PROTECTED] account,
then "drop" all other recipients and ROUTETO that email ONLY to the
postmaster address. This will prevent spam that includes the
Postmaster address to reach all other mailboxes.
However, I
suspect that somehow "ROUTETO" suddenly outweighs the DELETE
action?
Best Regards
Andy
Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
Hi,
As
promised, I will submit this case to Declude
support.
This
message has a weight of 21 and should have been DELETEd and it's way
PAST my HOLD weight of 10. It also is beyond my BYPASS WHITELISTING
weight of 19.
Yet, this
message was delivered to my mailbox!
03/02/2005
19:42:43 Q5d7c1cc602a2951d SPAMCOP:7 SENDERDB-SUSP:1 XBL-DYNA:7 BCC4:2
SPAMDOMAINS:4 . Total weight = 21.
03/02/2005 19:42:43
Q5d7c1cc602a2951d Bypassing whitelisting of E-mail with weight >=19
(21) and at least 1 recipients (6).
03/02/2005 19:42:43
Q5d7c1cc602a2951d Bypassing whitelisting of E-mail with weight >=14
(21) and at least 4 recipients (6).
03/02/2005 19:42:43
Q5d7c1cc602a2951d NOT bypassing whitelisting of E-mail with weight
>=12 (21) and at least 6 recipients (6).
03/02/2005 19:42:43
Q5d7c1cc602a2951d L1 Message OK
03/02/2005 19:42:43
Q5d7c1cc602a2951d Subject: Get V1AGRA Anonymously!
03/02/2005
19:42:43 Q5d7c1cc602a2951d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
IP: 82.127.69.49 ID:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Tests
failed [weight=21]: BYPASS19=IGNORE BYPASS14=IGNORE DSBLSINGLE=WARN
SPAMCOP=WARN BLITZEDALL=LOG NJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG
SENDERDB-SUSP=IGNORE XBL-DYNA=IGNORE IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE BCC4=IGNORE SNIFFER=LOG INV-URIBL=LOG
POSTMASTER=ROUTETO SPAMDOMAINS=IGNORE WEIGHTKILL=DELETE
ACTIONDELETE=DELETE
03/02/2005 19:42:43 Q5d7c1cc602a2951d L2
Message OK
03/02/2005 19:42:43 Q5d7c1cc602a2951d Subject: Get
V1AGRA Anonymously!
03/02/2005 19:42:43 Q5d7c1cc602a2951d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED]
IP: 82.127.69.49 ID:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Tests
failed [weight=21]: BYPASS19=IGNORE BYPASS14=IGNORE DSBLSINGLE=WARN
SPAMCOP=WARN BLITZEDALL=LOG NJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG
SENDERDB-SUSP=IGNORE XBL-DYNA=IGNORE IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE BCC4=IGNORE SNIFFER=LOG INV-URIBL=LOG
POSTMASTER=ROUTETO SPAMDOMAINS=IGNORE WEIGHTKILL=DELETE
ACTIONDELETE=DELETE
03/02/2005 19:42:43 Q5d7c1cc602a2951d L3
Message OK
03/02/2005 19:42:43 Q5d7c1cc602a2951d Subject: Get
V1AGRA Anonymously!
03/02/2005 19:42:43 Q5d7c1cc602a2951d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED] IP:
82.127.69.49 ID:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Tests
failed [weight=21]: BYPASS19=IGNORE BYPASS14=IGNORE DSBLSINGLE=WARN
SPAMCOP=WARN BLITZEDALL=LOG NJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG
SENDERDB-SUSP=IGNORE XBL-DYNA=IGNORE IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE BCC4=IGNORE SNIFFER=LOG INV-URIBL=LOG
POSTMASTER=ROUTETO SPAMDOMAINS=IGNORE WEIGHTKILL=DELETE
ACTIONDELETE=DELETE
03/02/2005 19:42:43 Q5d7c1cc602a2951d R4
Message OK
03/02/2005 19:42:43 Q5d7c1cc602a2951d Subject: Get
V1AGRA Anonymously!
03/02/2005 19:42:43 Q5d7c1cc602a2951d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] IP:
82.127.69.49 ID:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Tests
failed [weight=21]: BYPASS19=IGNORE BYPASS14=IGNORE DSBLSINGLE=WARN
SPAMCOP=WARN BLITZEDALL=LOG NJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG
SENDERDB-SUSP=IGNORE XBL-DYNA=IGNORE IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE BCC4=IGNORE SNIFFER=LOG INV-URIBL=LOG
POSTMASTER=IGNORE SPAMDOMAINS=IGNORE WEIGHTKILL=DELETE
ACTIONDELETE=DELETE
03/02/2005 19:42:43 Q5d7c1cc602a2951d L5
Message OK
03/02/2005 19:42:43 Q5d7c1cc602a2951d Subject: Get
V1AGRA Anonymously!
03/02/2005 19:42:43 Q5d7c1cc602a2951d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
IP: 82.127.69.49 ID:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Tests
failed [weight=21]: BYPASS19=IGNORE BYPASS14=IGNORE DSBLSINGLE=WARN
SPAMCOP=WARN BLITZEDALL=LOG NJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG
SENDERDB-SUSP=IGNORE XBL-DYNA=IGNORE IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE BCC4=IGNORE SNIFFER=LOG INV-URIBL=LOG
POSTMASTER=ROUTETO SPAMDOMAINS=IGNORE WEIGHTKILL=DELETE
ACTIONDELETE=DELETE
03/02/2005 19:42:43 Q5d7c1cc602a2951d L6
Message OK
03/02/2005 19:42:43 Q5d7c1cc602a2951d Subject: Get
V1AGRA Anonymously!
03/02/2005 19:42:43 Q5d7c1cc602a2951d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED]
IP: 82.127.69.49 ID:
03/02/2005 19:42:43 Q5d7c1cc602a2951d Tests
failed [weight=21]: BYPASS19=IGNORE BYPASS14=IGNORE DSBLSINGLE=WARN
SPAMCOP=WARN BLITZEDALL=LOG NJABLDYNA=LOG SORBS=WARN SORBS-DUHL=LOG
SENDERDB-SUSP=IGNORE XBL-DYNA=IGNORE IPNOTINMX=IGNORE
NOLEGITCONTENT=IGNORE BCC4=IGNORE SNIFFER=LOG INV-URIBL=LOG
POSTMASTER=ROUTETO SPAMDOMAINS=IGNORE WEIGHTKILL=DELETE
ACTIONDELETE=DELETE
03/02/2005 19:42:43 Q5d7c1cc602a2951d Last
action = "">
Received: from SMTP32-FWD by
Mail.Webhost.HM-Software.com
(SMTP32) id A5D7C1CC602A2951D;
Wed, 2 Mar 2005 19:42:44 -0500
Received: from argosoft.com
[82.127.69.49] by hm-software.com
(SMTPD32-8.15) id
AD7F1CC602A2; Wed, 02 Mar 2005 19:42:39 -0500
To: <[EMAIL PROTECTED]>
From:
"John" <[EMAIL PROTECTED]>
Date:
Thu, 03 Mar 2005 03:13:10 GMT
Message-Id: <[EMAIL PROTECTED]>
Sender:
[EMAIL PROTECTED]
Subject:
Get V1AGRA Anonymously!
Content-Type: text/html;
X-RBL-Warning:
Suspected SPAM. 82.127.69.49 found in list.dsbl.org. "http://dsbl.org/listing?82.127.69.49"
X-RBL-Warning:
Suspected SPAM. "Blocked - see http://www.spamcop.net/bl.shtml?82.127.69.49"
X-RBL-Warning:
Suspected SPAM. "Dynamic IP Addresses See: http://www.dnsbl.sorbs.net/lookup.shtml?82.127.69.49"
X-Declude:
Version 2.0.4.2; D5d7c1cc602a2951d.SMD from
lneuilly-152_21-6-49.w82-127.abo.wanadoo.fr
[82.127.69.49]
X-Declude: Triggered [21] BYPASS19, BYPASS14,
DSBLSINGLE, SPAMCOP, BLITZEDALL, NJABLDYNA, SORBS-DUHL, SENDERDB-SUSP,
XBL-DYNA, BCC4, SNIFFER, INV-URIBL, POSTMASTER, SPAMDOMAINS,
WEIGHTKILL
X-Countries: FRANCE->destination
Return-Path:
<[EMAIL PROTECTED]>
X-RCPT-TO:
<[EMAIL PROTECTED]>
Status:
U
X-UIDL: 409773234
Best Regards
Andy
Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
|
