-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith
Sent: Tuesday, October 25, 2005 4:54 PM
To: [email protected]
Subject: RE: [Declude.JunkMail] Headers showing up in the body on
3.05.10
David,
Thanks for the explanation!
However, I have yet to see a message with SMTP headers in the body if
I remove Declude and send mail directly into Exchange.
Maybe Exchange will just not deliver?
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
David Barker
> Sent: Tuesday, October 25, 2005 3:27 PM
> To: [email protected]
> Subject: RE: [Declude.JunkMail] Headers showing up in the body on
> 3.05.10
>
> In every instance that we have observed so far the headers
in the body
> are caused by broken mail clients. This is not only an issue for
> Declude but for mail servers as well. To illustrates the difficulty
> coming up with a single algorithm that will detect all instances of
> these broken emails to prevent headers from appearing at
the end of a
> message or within the body of a message.
>
> RFC dictates all lines must end with a CR/LF sequence, with
a double
> sequence CR/LF/CR/LF separating the headers from the body.
> Technically, that would be a 0D 0A 0D 0A sequence.
>
> In the byte sequence below, the sixth line contains:
>
> 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68
>
> where a single 0A is followed by a space and then the
required 0D 0A
> sequence. When this problem was first reported, changes
were made in
> the source to detect a simple 0A as a line terminator, followed by
> another line terminator sequence.
>
> However, this example would not get detected because they
inserted a
> space, which is invisible, between the two line termination
sequences.
> They could have inserted a tab (09) also, so checking only
for a space
> would not have caught all possibilities.
>
> In addition, checking only for spaces at the beginning of a
line would
> not solve the problem because certain header lines can be
continued on
> the next line, which requires spaces and then non-blank characters
> prior to the next line termination sequence.
>
> 30 38 3A 35 37 3A 31 33-20 2D 30 35 30 30 0D 0A 4D 49 4D 45
2D 56 65
> 72-73 69 6F 6E 3A 20 31 2E 30 0D 0A 43 6F 6E 74 65-6E 74 2D
54 79 70
> 65 3A 20 74 65 78 74 2F 70 6C-61 69 6E 3B 0D 0A 09 63
> 68 61 72 73 65 74 3D 22-75 73 2D 61 73 63 69 69
> 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68
> 61 76 69 6E 67 20 61 6E-20 61 66 66 61 69 72 20
> 77 69 74 68 20 61 20 79-6F 75 6E 67 65 72 2C 20
>
> Often from the outset these issues look extremely simple.
> However, because all eventualities that have to be covered
it becomes
> quite complex. I am providing this example because things
are rarely
> as simple as they may at first appear.
>
> With all that said we are looking into providing a solution
for this
> problem.
>
> David B
> www.declude.com
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Matt
> Sent: Monday, October 24, 2005 9:07 PM
> To: [email protected]
> Subject: Re: [Declude.JunkMail] Headers showing up in the body on
> 3.05.10
>
> This looks like Declude was expecting to see an occurrence of Blank
> Folding, but it is making the mistake of detecting headers
in the MIME
> segments or the body as a continuation of the real headers, either
> that or they changed the code that detects where to throw in the
> Declude generated headers in order to handle Blank Folding. IMO,
> Declude should just throw the headers just before the
location of the
> first <CRLF><CRLF> or possibly following a mistaken <LF><LF>.
>
> I haven't seen any Declude headers in the body using 2.0.6.16 and
> earlier.
>
> Matt
>
>
>
> Robert Grosshandler wrote:
>
> >This has been a problem for awhile (happened with the move
> to the new
> >architecture, but Declude says it's not connected.)
> >
> >The headers are "bad" when they make it to Declude, and
> Declude doesn't
> >handle them right.
> >
> >Fortunately, in our setup, they all still get treated as
> very heavily
> >weighted spam, so they never make it to users.
> >
> >Rob
> >
> >-----Original Message-----
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith
> >Sent: Monday, October 24, 2005 6:17 PM
> >To: [email protected]
> >Subject: [Declude.JunkMail] Headers showing up in the body
on 3.05.10
> >
> >Ever since I went to 3.05.10 (now on 3.05.11) I've been receiving
> >hundreds of complaints of spam making it to my users.
> >After inspection, Declude is subject line marking the
> messages but it's
> >moving the SMTP headers to the body of the email. This results in
> >user's Outlook rules not firing on the subject line keywords.
> >
> >Here's an example of the ACTUAL MESSAGE BODY.
> >
> >Anyone else seeing this?
> >
> >-0-
> >
> >
> >-----Original Message-----
> >From: Jon Addison [mailto:[EMAIL PROTECTED]
> >Sent: Monday, October 24, 2005 6:06 AM
> >To: Smith, Mark E.
> >Subject: Re: Hello.
> >
> >You've seen it on "60 Minutes" and read the BBC News report
> -- now find
> >out just what everyone is talking about.
> >Message-Id: <[EMAIL PROTECTED]>
> >Subject: [WARNING-SPAM]:[333]:
> >X-RBL-Warning: CATCHALLMAILS:
> >X-RBL-Warning: FIVETEN-SPAM:
> 225.72.226.221.blackholes.five-ten-sg.com.
> >X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
> >X-RBL-Warning: SORBS-DUL: "Dynamic IP Addresses See:
> >http://www.sorbs.net/lookup.shtml?221.226.72.225";
> >X-RBL-Warning: IPNOTINMX:
> >X-RBL-Warning: NOLEGITCONTENT: No content unique to
> legitimate E-mail
> >detected.
> >X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA
> >221.226.72.225 with no reverse DNS entry.
> >X-RBL-Warning: MS-SNAKEOIL: Message failed MS-SNAKEOIL: 52.
> >X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 3.
> >X-RBL-Warning: SPAMDOMAINS: Spamdomain '@yahoo.' found: Address of
> >[EMAIL PROTECTED] sent from invalid [No Reverse DNS].
> >X-RBL-Warning: FALSE-YAHOO: Message failed FALSE-YAHOO
test (line 2,
> >weight
> >30)
> >X-RBL-Warning: WEIGHT120349CP: Total weight between 120 and 349.
> >X-Declude-Sender: [EMAIL PROTECTED] [221.226.72.225]
> >X-Declude-Spoolname: Ddba001ae000099e2.smd
> >X-Note:
> >X-Note:
> >==================================================================
> >X-Note: Spam Score: 333 [SUBJECT STRING ON 120-349 &
DELETED ON 350+]
> >X-Note: Scan Time: 09:03:36 on 24 Oct 2005
> >X-Note: Spool File: Ddba001ae000099e2.smd
> >X-Note: Server Name: netrends.com
> >X-Note: SMTP Sender: [EMAIL PROTECTED]
> >X-Note: Reverse DNS & IP: [No Reverse DNS] [221.226.72.225]
> >X-Note: Organization: popmail.netrends.com
> >X-Note: Recipient(s): [EMAIL PROTECTED]
> >X-Note: Country Chain: CHINA->destination
> >X-Note: Tests Failed: CATCHALLMAILS [0], FIVETEN-SPAM
[30], NOABUSE
> >[10], SORBS-DUL [50], IPNOTINMX [0], NOLEGITCONTENT [0],
> REVDNS [40],
> >MS-SNAKEOIL [150], SPAMCHK [3], SPAMDOMAINS [20], FALSE-YAHOO [30],
> >WEIGHT120349 [120], WEIGHT120349CP [120]
> >X-Note: In or Out: outgoing
> >X-Note:
> >==================================================================
> >X-Note: This E-mail was scanned & filtered
> >X-Note: filter [3.0.5.10] for SPAM & virus.
> >X-Note:
> >==================================================================
> >X-Note:
> >
> ># Suppress your appetite and feel full and satisfied all
day long #
> >Increase your energy levels # Lose excess weight # Increase your
> >metabolism # Burn body fat # Burn calories # Attack obesity
> And more..
> >
> >http://coolhoodia.com/
> >
> ># Suitable for vegetarians and vegans # MAINTAIN your
weight loss #
> >Make losing weight a sure guarantee # Look your best during the
> >summer months
> >
> >http://coolhoodia.com/
> >
> >Regards,
> >Dr. Jon Addison
> >
> >
> >
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list. To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> >"unsubscribe Declude.JunkMail". The archives can be found at
> >http://www.mail-archive.com.
> >---
> >[This E-mail scanned for viruses by Declude Virus]
> >
> >
> >---
> >[This E-mail scanned for viruses by Declude Virus]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list. To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> >"unsubscribe Declude.JunkMail". The archives can be found at
> >http://www.mail-archive.com.
> >
> >
> >
> >
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail". The archives can be found at
> http://www.mail-archive.com.
>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
