Hi Scott: Here are three relevant lines of the WEIGHTFILTER.TXT:
#16: #17:REVDNS 4 ENDSWITH .in-addr.arpa #18: DNSStuff reports a valid REVDNS: 12.29.228.5 PTR record: oldtfw04.pearsontc.com. [TTL 86400s] [A=12.29.228.5] Yet, the mail failed WEIGHTFILTER at line 17. See the log filter - the ONLY place where I see the string "in-addr.arpa" is in your "ID:" field - behind some apparent garbled caharacters. Is there a problem with the REVDNS ENDSWITH filter, e.g., some "buffer overrun"? 06/05/2003 17:51:09 Qbb4535320128b6b9 HELOBOGUS:3 HEUR10:4 WEIGHTFILTER:4 . Total weight = 11 06/05/2003 17:51:09 Qbb4535320128b6b9 Msg failed HELOBOGUS (Domain oldtms705.pearsontc.com has no MX or A records.). Action=WARN. 06/05/2003 17:51:09 Qbb4535320128b6b9 Msg failed HEUR10 (Heuristic spam detection level 10 [1.000000]). Action=IGNORE. 06/05/2003 17:51:09 Qbb4535320128b6b9 Msg failed WEIGHTFILTER (Message failed WEIGHTFILTER test (17)). Action=IGNORE. 06/05/2003 17:51:09 Qbb4535320128b6b9 Msg failed WEIGHTREPORT (Total weight between 11 and 15.). Action=ALERT. 06/05/2003 17:51:09 Qbb4535320128b6b9 Msg failed WEIGHT10 (Total weight between 10 and 19.). Action=SUBJECT. 06/05/2003 17:51:09 Qbb4535320128b6b9 Subject: Screen shots: Merrill Lynch store 06/05/2003 17:51:09 Qbb4535320128b6b9 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 12.29.228.5 ID: <[EMAIL PROTECTED] 5.228.29.12.in-addr.arpa Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
