I wouldn't add anything to the score because it's very common (specially for larger organizations) to have dedicated outbound servers, while all MX records point to their anti-spam/anti-virus gateways!
The better approach would be to REDUCE the weight score if you receive mail from a mail server hat also DOES appear in the domain's MX records. This way you give credit for a more "tight" configuration without penalizing perfectly valid/common configurations. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry vanderzand Sent: Tuesday, February 03, 2009 11:15 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] DNS lookup fail, yet e-mail passes spam tests I would agree. However if a record exists but the server does not, I would want to add a bit to my weight score. It certainly shows that something is not right However, thank you for the explanation Thank you Harry Vanderzand Intown Internet 117 Ruskview Road Kitchener, ON, N2M 4S1 519-741-1222 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Tuesday, February 03, 2009 10:57 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] DNS lookup fail, yet e-mail passes spam tests Some email server has the task of sending out email and not receiving email, (eg. An online order system) it would not require and MX record as it does not need to receive email, therefore the fact that an MX record does not exist is not a good indicator for spam. David B From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry vanderzand Sent: Tuesday, February 03, 2009 10:28 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] DNS lookup fail, yet e-mail passes spam tests Sorry but I am not sure what you mean by outbound in the sample below. I also do not know what specific test should be triggered other than something should be. Here I have mail coming in from a domain. DNS lookup on their MX record fails. Is that not a big flag that this is likely Spam? Maybe I am misunderstanding something here. In the sample below we got mail from an orderlinenews address and the MX record does not exist Thank you Harry Vanderzand Intown Internet 117 Ruskview Road Kitchener, ON, N2M 4S1 519-741-1222 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Tuesday, February 03, 2009 10:11 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] DNS lookup fail, yet e-mail passes spam tests Hi Harry, As far as I know mail servers that are strictly outbound don't need to use an MX record. What test do you think this should trigger ? David B From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry vanderzand Sent: Tuesday, February 03, 2009 10:03 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] DNS lookup fail, yet e-mail passes spam tests Anyone have any ideas on this topic? Thank you Harry Vanderzand Intown Internet 117 Ruskview Road Kitchener, ON, N2M 4S1 519-741-1222 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry vanderzand Sent: Friday, January 30, 2009 4:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] DNS lookup fail, yet e-mail passes spam tests Please see the log entry below. The DNS lookup for the MA and A record failed. Why would that not add weight to any of my tests. Am I missing some? Seems to me that if these fail that it should be weighted as spam 01/30/2009 08:21:53.312 qfeea02ad00006d67.smd XXXXStart: doprewhitelist 01/30/2009 08:21:53.312 qfeea02ad00006d67.smd XXXXEND: doprewhitelist 01/30/2009 08:21:55.265 qfeea02ad00006d67.smd WARNING: DNS server nnn.nnn.nnn.nnn returned a SERVER FAILURE error for MX or A for mail.orderlinenews.ca. 01/30/2009 08:22:01.265 qfeea02ad00006d67.smd WARNING: DNS server nnn.nnn.nnn.nnn returned a SERVER FAILURE error for MX or A for orderline.ca. 01/30/2009 08:22:03.437 qfeea02ad00006d67.smd Tests failed [weight=0]: FILTER-COUNTRY=IGNORE[0] CATCHALLMAILS=IGNORE[0] 01/30/2009 08:22:03.437 qfeea02ad00006d67.smd Action(s) taken for [x...@domain.com] = IGNORE [LAST ACTION=IGNORE] 01/30/2009 08:22:03.437 qfeea02ad00006d67.smd Cumulative action(s) on this email = IGNORE [LAST ACTION=IGNORE] Thank you Harry Vanderzand Intown Internet 117 Ruskview Road Kitchener, ON, N2M 4S1 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
