Hi Mark, Are you certain the user does not have their own address in their webmail address book?
This looks like a typical problem where users have their own email address in the address book. Removing their email address and explaining to them why they should avoid putting in their own address (i.e. forging spam often forges the address being sent to as the FROM address as well) usually fixes it. Darin. ----- Original Message ----- From: "Mark Strother" <mstrot...@pacificonline.com> To: <declude.junkmail@declude.com> Cc: "Mark Strother" <mstrot...@pacificonline.com> Sent: Monday, July 06, 2009 7:13 PM Subject: [Declude.JunkMail] Whitelisting Bug? In the past week I've seen a lot of mail whitelisted that shouldn't be. We have autowhitelist and whitelist - auth enabled. I understand that should white list mail that is sent using SMTP auth or if the sender is in the users SmarterMail address book. In every case I've seen SMTP auth was not used and the sender is not listed in the recipient's address book. Can anyone help out? Below is a sample header. We've had several complaints, all from different domains, and in each case the headers look similar. The from and to address are the same and in every case the emails have a X-Rcpt-To field pointing to another user within the domain. -- Return-Path: <k...@domainremoved.com> Received: from 189104007058.user.veloxzone.com.br [189.104.7.58] by mx2.pacificonline.com with SMTP; Sun, 28 Jun 2009 12:06:38 -0700 Message-ID: <gxiqtzknkqjrskpel...@notimexico.com> From: "Medicines" <k...@domainremoved.com> Reply-To: "Medicines" <k...@domainremoved.com> To: k...@domainremoved.com Subject: Useful potions, approved pilules Date: Mon, 29 Jun 2009 02:05:33 +0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="-----=549_9341_6L951C50.68SC114N" X-Priority: 3 X-MSMail-Priority: Normal X-RBL-Warning: IPNOTINMX: X-RBL-Warning: CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=189.104.7.58"; X-RBL-Warning: SPAMCOP: "Blocked - see http://www.spamcop.net/bl.shtml?189.104.7.58"; X-RBL-Warning: UCEPROTECT-1: "IP 189.104.7.58 is UCEPROTECT-Level 1 listed. See http://www.uceprotect.net/rblcheck.php?ipr=189.104.7.58"; X-RBL-Warning: UCEPROTECT-2: "Net 189.104.0.0/19 is UCEPROTECT-Level2 listed because 552 abusers are hosted by Telecomunicacoes da Bahia S.A./AS7738 there. See: http://www.uceprotect.net/rblcheck.php?ipr=189.104.7.58"; X-RBL-Warning: UCEPROTECT-3: "Your ISP Telecomunicacoes da Bahia S.A./AS7738 is UCEPROTECT-Level3 listed for hosting a total of 100857 abusers. See: http://www.uceprotect.net/rblcheck.php?ipr=189.104.7.58"; X-RBL-Warning: BCC: 13 Bcc:'s detected. X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-Declude-Sender: k...@domainremoved.com [189.104.7.58] X-Declude-RefID: str=0001.0A010204.4A47BD36.0135,ss=4,sh,fgs=0 X-Declude-Note: Incoming Msg Scanned by Declude 4.6.35 X-Declude-Score: [0] X-Declude-Fail: Whitelisted X-Country-Chain: BRAZIL->destination X-Rcpt-To: <dli...@domainremoved.com > X-SmarterMail-Spam: DK_None, Declude: 0 X-SmarterMail-TotalSpamWeight: 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
