The next thing I would do is track back the message id to the imail logs and
verify the user indeed did auth. If they did not auth they still would be
able to send that message since it was destined to a local domain for that
mail server.
Darrell
-------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI
integration, MRTG Integration, and Log Parsers.
----- Original Message -----
From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, October 13, 2005 1:04 AM
Subject: Re: [Declude.JunkMail] Local Users Should be Whitelisted, right?
8.21
BTW - thanks for your help Darrell.
Darrell ([EMAIL PROTECTED]) wrote:
Assuming you are running a version of Imail 8.x. Are you running an
older version of Imail?
Darrell
-------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring,
SURBL/URI integration, MRTG Integration, and Log Parsers.
----- Original Message ----- From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, October 12, 2005 6:48 PM
Subject: Re: [Declude.JunkMail] Local Users Should be Whitelisted, right?
I'm checking to see if they use our server to send. If they did, they
had to AUTH. And we do use whitelist auth. We don't whitelist the IP
they are coming from. If they used a different outgoing server, then it
would be treated just like any other email address, right? But if they
did send from our server, it should've been whitelisted. At least
that's my understanding.
Darrell ([EMAIL PROTECTED]) wrote:
It all depends on how you have your software configured. Did the user
auth? Do you have whitelist auth? Are you whitelisting the IP address
they came from?
Let us know how you are configured.
Darrell
-------------------------------------------
invURIBL - Intelligent URI Filtering. Stops the SPAM that RBL's don't
catch.
Download a copy today - http://www.invariantsystems.com
----- Original Message ----- From: "Kevin Rogers"
<[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, October 12, 2005 6:22 PM
Subject: [Declude.JunkMail] Local Users Should be Whitelisted, right?
We have a user on one of our domains who sent an email to someone else
at the same domain. Shouldn't this message automatically be
whitelisted?
Here's a log snippet:
10/11/2005 10:39:38 QF8BA0821000093B2 CMDSPACE:8 SPAMHEADERS:3 .
Total weight = 11.
10/11/2005 10:39:38 QF8BA0821000093B2 Using [incoming] CFG file
C:\IMail\Declude\$default$.junkmail.
10/11/2005 10:39:38 QF8BA0821000093B2 Msg failed CMDSPACE (Space found
in RCPT TO: command.). Action=WARN.
10/11/2005 10:39:38 QF8BA0821000093B2 Msg failed SPAMHEADERS (This
E-mail has headers consistent with spam [4000020e].). Action=IGNORE.
10/11/2005 10:39:38 QF8BA0821000093B2 Msg failed WEIGHT10 (Weight of
11 reaches or exceeds the limit of 10.). Action=MAILBOX.
10/11/2005 10:39:38 QF8BA0821000093B2 L1 Message OK
10/11/2005 10:39:38 QF8BA0821000093B2 Subject: FW: Partners in
Practice - Request For Voluntary Dental Quotes
10/11/2005 10:39:38 QF8BA0821000093B2 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED] IP: 71.101.16.48 ID:
10/11/2005 10:39:38 QF8BA0821000093B2 Tests failed [weight=11]:
CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE
SPAMHEADERS=IGNORE WEIGHT10=MAILBOX
10/11/2005 10:39:38 QF8BA0821000093B2 Action(s) taken for
[EMAIL PROTECTED] = IGNORE WARN MAILBOX [LAST ACTION=MAILBOX]
10/11/2005 10:39:38 QF8BA0821000093B2 Cumulative action(s) taken on
this email = IGNORE WARN MAILBOX [LAST ACTION=MAILBOX]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses.]
---
[This E-mail was scanned for viruses.]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
