In the past week I've seen a lot of mail whitelisted that shouldn't be. We have
autowhitelist and whitelist - auth enabled. I understand that should white list
mail that is sent using SMTP auth or if the sender is in the users SmarterMail
address book. In every case I've seen SMTP auth was not used and the sender is
not listed in the recipient's address book.
Can anyone help out? Below is a sample header. We've had several complaints,
all from different domains, and in each case the headers look similar. The from
and to address are the same and in every case the emails have a X-Rcpt-To field
pointing to another user within the domain.
--
Return-Path: <k...@domainremoved.com>
Received: from 189104007058.user.veloxzone.com.br [189.104.7.58] by
mx2.pacificonline.com with SMTP;
Sun, 28 Jun 2009 12:06:38 -0700
Message-ID: <gxiqtzknkqjrskpel...@notimexico.com>
From: "Medicines" <k...@domainremoved.com>
Reply-To: "Medicines" <k...@domainremoved.com>
To: k...@domainremoved.com
Subject: Useful potions, approved pilules
Date: Mon, 29 Jun 2009 02:05:33 +0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="-----=549_9341_6L951C50.68SC114N"
X-Priority: 3
X-MSMail-Priority: Normal
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: CBL: "Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=189.104.7.58";
X-RBL-Warning: SPAMCOP: "Blocked - see
http://www.spamcop.net/bl.shtml?189.104.7.58";
X-RBL-Warning: UCEPROTECT-1: "IP 189.104.7.58 is UCEPROTECT-Level 1 listed. See
http://www.uceprotect.net/rblcheck.php?ipr=189.104.7.58";
X-RBL-Warning: UCEPROTECT-2: "Net 189.104.0.0/19 is UCEPROTECT-Level2 listed
because 552 abusers are hosted by Telecomunicacoes da Bahia S.A./AS7738 there.
See: http://www.uceprotect.net/rblcheck.php?ipr=189.104.7.58";
X-RBL-Warning: UCEPROTECT-3: "Your ISP Telecomunicacoes da Bahia S.A./AS7738 is
UCEPROTECT-Level3 listed for hosting a total of 100857 abusers. See:
http://www.uceprotect.net/rblcheck.php?ipr=189.104.7.58";
X-RBL-Warning: BCC: 13 Bcc:'s detected.
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-Declude-Sender: k...@domainremoved.com [189.104.7.58]
X-Declude-RefID: str=0001.0A010204.4A47BD36.0135,ss=4,sh,fgs=0
X-Declude-Note: Incoming Msg Scanned by Declude 4.6.35
X-Declude-Score: [0]
X-Declude-Fail: Whitelisted
X-Country-Chain: BRAZIL->destination
X-Rcpt-To: <dli...@domainremoved.com >
X-SmarterMail-Spam: DK_None, Declude: 0
X-SmarterMail-TotalSpamWeight: 0
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
