My apologies, I was unsure if this was a Declude issue or an Imail issue. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, January 25, 2007 12:05 PM To: [email protected] Subject: Re: [Declude.JunkMail] Weird email problem
Sharyn, I'm not the 'list police', but it is proper etiquette not to post the same thing in multiple lists at the same time, especially when many from one list are on the other. This has in fact caused confusion in the past with your posts because one conversation starts in one place and is simultaneously being discussed in another, and in part by the same people. I would suggest that you post it in the most appropriate list, and only post it elsewhere if you can't find resolution there. Regarding your issue, it would be best to share the headers from the E-mail with the Received lines intact. Good luck, Matt Sharyn Schmidt wrote: I'm having a REALLY WEIRD email problem, makes me feel like I'm in the twilight zone. One of my users reported that she did not receive an email from [EMAIL PROTECTED] until TODAY, but the email was sent on Tuesday, 1/23, at 10:28am. She forwarded me a copy of the email. The following is from my Imail log from 1/23... 01:23 10:31 SMTPD(2a4b22aa0000f903) [24.73.160.163] connect 64.168.89.133 port 23634 01:23 10:31 SMTPD(2a4b22aa0000f903) [64.168.89.133] EHLO WDL.wilsondaniels.com 01:23 10:31 SMTPD(2a4b22aa0000f903) [64.168.89.133] MAIL FROM: <mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> 01:23 10:31 SMTPD(2a4b22aa0000f903) [64.168.89.133] RCPT TO: <mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> After this line, there is NOTHING else. The whole process for this email just seems to stop. In the IMAIL log for that day, I did a search for the d2a4b22aa0000f903.smd and the q2a4b22aa0000f903.smd, but turned up absolutely nothing. I did searches in both my Declude Junkmail and virus logs for the q and d files as well, nothing. I did searches in my logs on 1/24 and still turned up nothing. In the 1/23 Junkmail log, I even used the email address, [EMAIL PROTECTED], and came up with nothing. Then, I looked in todays log, at the time that the user finally received the message. Here is the log entry from Imail: 01:25 08:10 SMTPD(ac2c27660000c9d4) [64.168.89.133] EHLO WDL.wilsondaniels.com 01:25 08:10 SMTPD(ac2c27660000c9d4) [64.168.89.133] MAIL FROM: <mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> 01:25 08:10 SMTPD(ac2c27660000c9d4) [64.168.89.133] RCPT TO: <mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> 01:25 08:10 SMTPD(ac2c27660000c9d4) [64.168.89.133] D:\IMAIL\spool\Dac2c27660000c9d4.SMD 958 01:25 08:10 SMTPD(ac2c27660000c9d4) performing antispam checks That's it for the log entry in Imail. I checked the Declude Junkmail log, and found the following, below. Please note that the entire @wilsondaniels.com domain is whitelisted. Also, my user DID indeed receive this message, today, 2 days later. Going by the subject line (Good morning), it looks like the message that was send on Tues, even though the spool file names are different. Can anyone clue me in on what is going on here? This isnt the only message from wilsondaniels that was sent on Tues and received today. I just havent gotten the log entries for the other ones yet. Rec'd the message on 1/25, log entry in Declude Junkmail log: 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (63.246.13.90). nm=ffffffff 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (192.168.100.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (192.168.110.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (192.168.120.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (192.168.130.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (192.168.140.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (192.168.150.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (10.10.100.0/24). nm=ffffff00 01/25/2007 08:10:10.125 qac2c27660000c9d4.smd IP 64.168.89.133 not in whitelist (24.73.160.164). nm=ffffffff 01/25/2007 08:10:18.125 qac2c27660000c9d4.smd Filter URLfilter: Not skipping E-mail due to current weight of 20. 01/25/2007 08:10:18.156 qac2c27660000c9d4.smd Filter InBodyFilter: Not skipping E-mail due to current weight of 20. 01/25/2007 08:10:18.171 qac2c27660000c9d4.smd Filter InHeadersFilter: Not skipping E-mail due to current weight of 20. 01/25/2007 08:10:18.187 qac2c27660000c9d4.smd Filter FILTER-ADULT: Not skipping E-mail due to current weight of 20. 01/25/2007 08:10:18.203 qac2c27660000c9d4.smd Filter FILTER-MEDICAL: Not skipping E-mail due to current weight of 20. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd FROMNOMATCH:3 HELOBOGUS:5 MAILFROM:12 . Total weight = 20. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Tests failed [weight=20]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=IGNORE[0] IPNOTINMX=IGNORE[0] FROMNOMATCH=IGNORE[3] HELOBOGUS=IGNORE[5] MAILFROM=IGNORE[12] WEIGHT10=IGNORE[10] WEIGHT12=IGNORE[12] 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed FROMNOMATCH (Env sender ([EMAIL PROTECTED]) From: ([EMAIL PROTECTED]) mismatch.). Action=IGNORE. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed HELOBOGUS (Domain WDL.wilsondaniels.com has no MX or A records [0301].). Action=IGNORE. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed MAILFROM (Domain WDL.wilsondaniels.com has no MX or A records [0301].). Action=IGNORE. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed WEIGHT10 (Weight of 20 reaches or exceeds the limit of 10.). Action=IGNORE. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed WEIGHT12 (Weight of 20 reaches or exceeds the limit of 12.). Action=IGNORE. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd R1 Message OK 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Subject: RE: Good Morning (Out of Office) 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd From: [EMAIL PROTECTED] To: IP: 64.168.89.133 ID: 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Action(s) taken for [copyall_account] = IGNORE [LAST ACTION=IGNORE] 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Tests failed [weight=20]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=IGNORE[0] IPNOTINMX=IGNORE[0] FROMNOMATCH=WARN[3] HELOBOGUS=WARN[5] MAILFROM=WARN[12] WEIGHT10=ATTACH[10] WEIGHT12=HOLD[12] 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed FROMNOMATCH (Env sender ([EMAIL PROTECTED]) From: ([EMAIL PROTECTED]) mismatch.). Action=WARN. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed HELOBOGUS (Domain WDL.wilsondaniels.com has no MX or A records [0301].). Action=WARN. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed MAILFROM (Domain WDL.wilsondaniels.com has no MX or A records [0301].). Action=WARN. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed WEIGHT10 (Weight of 20 reaches or exceeds the limit of 10.). Action=ATTACH. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Msg failed WEIGHT12 (Weight of 20 reaches or exceeds the limit of 12.). Action=HOLD. 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Subject: RE: Good Morning (Out of Office) 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 64.168.89.133 ID: 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN ATTACH HOLD [LAST ACTION=HOLD] 01/25/2007 08:10:18.218 qac2c27660000c9d4.smd Cumulative action(s) on this email = IGNORE WARN ATTACH HOLD [LAST ACTION=HOLD] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
