I saw something like this happen a couple months back in another
thread. There were two things going on there. For one, the messages
were being double processed due to a configuration issue. There was
also a typo in an XINHEADER or XOUTHEADER that was causing a double
line break so when the message was processed the second time, it was
placing the Declude generated headers in the body of the message (after
the first double line break).
This is almost definitely a configuration issue since it isn't
happening to anyone else around here that I have heard about. If you
could get the full source for one of these messages so that the real
headers are shown, that would potentially help out a great bit. It
would also help to share your Global.cfg and $Default$.junkmail on the
list if things aren't apparent from the full headers.
Matt
Mike Hyslip wrote:
WEIGHT10 weight x x 10 0
WEIGHT14 weight x x 14 0
WEIGHT20 weight x x 20 0
Note - this only happens here and there. 99% of the messages are flagged and show up correctly, just a couple a day seem to be showing up like these where the headers are somehow stuck inside the body of the message.
Mike
---------- Original Message ----------------------------------
From: "Darrell \([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
Reply-To: [email protected]
Date: Tue, 12 Jul 2005 14:35:18 -0400
In your global config how is it configured?
Darrell
--------------------------------------------
invURIBL - Intelligent URI filtering. Stops 85%+ of SPAM with the default
configuration... http://www.invariantsystems.com
Mike Hyslip writes:
WEIGHT10 SUBJECT **SPAM:
WEIGHT14 SUBJECT **SPAM:
WEIGHT20 SUBJECT **SPAM:
There's not weightrange option configured far as I can tell.
The headers that get stuck in the body show it is marked -
Hello,
Message-Id: <[EMAIL PROTECTED]>
Subject: **SPAM:
So not sure where else to look.
Thanks for your reply :-)
Mike
---------- Original Message ----------------------------------
From: "Darrell \([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
Reply-To: [email protected]
Date: Tue, 12 Jul 2005 13:07:49 -0400
What are the actions you have configured for WEIGHT10 and WEIGHT14. Also,
are those configured as WEIGHT's or WEIGHTRANGE?
Darrell
-------------------------------------------------------------
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.
http://www.invariantsystems.com
Mike Hyslip writes:
I am having random emails it seems showing up in my inbox unmarked as spam, yet the body of the message is containing all the headers showing it as spam. Not sure if this is just a bug, or spam circumventing spam protection in some way. Below is an example.
The email -
>From sender
To me
subject: haunted by your past?
Hello,
Message-Id: <[EMAIL PROTECTED]>
Subject: **SPAM:
X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?62.179.66.83"
X-RBL-Warning: FIVETENSRC: 83.66.179.62.blackholes.five-ten-sg.com.
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f].
X-Declude-Sender: [EMAIL PROTECTED] [62.179.66.83]
X-Declude-Spoolname: DD6A9018D00004C8F.SMD
X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam.
X-Declude-Scan: Score [15] at 10:41:54 on 12 Jul 2005
X-Declude-Tests: SORBS-DUHL, FIVETENSRC, NOABUSE, CMDSPACE, ROUTING, WEIGHT10, WEIGHT14
X-Country-Chain: [Unknown]->AUSTRIA->destination
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 371243910
X-IMail-ThreadID: d6a9018d00004c8f
You have been chosen to participate in an invitation only limited time event!
Are you currently paying over 3% for your mortgage? STOP! We can help you lower that today!
Answer only a few questions and we can give you an approval in under 30 seconds – it’s that simple!
Stop fighting for lenders – let them fight for you! Make them work for your business by giving you the lowest rates around!
$230,000 loans are available for only $340/month! WE’RE PRACTICALLY GIVING AWAY MONEY!
Think your credit is too bad to get a deal like this? THINK AGAIN! We will have you saving your money in no time!
Are you ready to save your money?
http://p8t.the-h00d.com/p1.asp
Update records on site.
Regards,
Martin Christie
-----
Here is the declude log for this message -
07/12/2005 10:41:54 QD6A9018D00004C8F nNOLEGITCONTENT:-5 SORBS-DUHL:4 FIVETENSRC:4 NOABUSE:2 CMDSPACE:8 ROUTING:2 . Total weight = 15.
07/12/2005 10:41:54 QD6A9018D00004C8F L1 Message OK
07/12/2005 10:41:54 QD6A9018D00004C8F Subject: Haunted by your past?
07/12/2005 10:41:54 QD6A9018D00004C8F From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 62.179.66.83 ID: j980FEKr454861
07/12/2005 10:41:54 QD6A9018D00004C8F Tests failed [weight=15]: CATCHALLMAILS=IGNORE IPNOTINMX=IGNORE SORBS-DUHL=WARN FIVETENSRC=WARN NOABUSE=WARN CMDSPACE=WARN ROUTING=WARN WEIGHT10=SUBJECT WEIGHT14=SUBJECT
07/12/2005 10:41:54 QD6A9018D00004C8F Action(s) taken for [[EMAIL PROTECTED]] = IGNORE WARN SUBJECT [LAST ACTION=""
07/12/2005 10:41:54 QD6A9018D00004C8F Cumulative action(s) taken on this email = IGNORE WARN SUBJECT [LAST ACTION=""
Any ideas, or another piece of information I'm missing? I can see the subject is marked in the headers stuck in the body of the email, but ideas on how this is stuck in the body and not where it should be?
I am running Imail 8.20, and the declude version is in the email headers above.
Mike
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
------------------------------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
------------------------------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
|
