Since last Thurs or so, noxmail seems to be allowing some adult & spam e-mails to go through. I received a couple of calls from users on Friday that they had received some porn e-mails. I double-checked all settings on Sat and finally stopped/restarted the IMail SMTP service. This seemed to fix the problem for the moment. However, yesterday I saw some more adult/spam messages slip through and I rebooted our e-mail server, again after checking everything first. That seemed to cause the filtering to work properly again. This morning, I thought I saw some more e-mails slip through but I sent myself a couple (one "adult" and one "spam") from an off-campus address and they were filtered correctly. I currently have all adult & spam e-mail sent to a spam account. This account is getting messages but some are apparently still slipping through. I just received a spam e-mail from e-bay. Below are the spam e-mail header and log snippet from noxmail. I can send you the .nox config file or other files if needed. I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 to the e-bay message should have been routed. The spam mailbox did catch this same e-mail to 7 other recipients (however, the total weight was 40 instead of 45).
Any suggestions?
Thanks.
Mark
NOXMAIL log snippet:
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores - Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM: <[EMAIL PROTECTED]>
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a fortune, mseagroves!
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent with SPAM: 1 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 5 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image links: 14 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty points added.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Matched: (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms - Msg Size: 19300 bytes
Mail Header:
To: [EMAIL PROTECTED]
Subject: [S] Don't spend a fortune, mseagroves!
From: "eBay" <[EMAIL PROTECTED]>
Date: Tue, 28 Jan 2003 11:29:04 -0800
Reply-To: "eBay" <[EMAIL PROTECTED]>
X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 18) Tot: 45 (Req: 20)
X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000020e].
X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
X-Declude-Spoolname: Dda50019700ce4425.SMD
X-Note: This E-mail was scanned for spam.
X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT10, WEIGHT20, CYBERSITTER
X-Note: This E-mail was sent from (Private IP) ([10.1.1.10]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Dir, Campus Computing
Asst Prof, Computer Science
Carson-Newman College
