[Declude.JunkMail] Baffled???
I cannot figure out why messages from this particular participant on the SpamAssassin e-mail distribution list does not show any Declude JunkMail header entries. Here is the log info and headers for one of these messages: == IMail receive log entry: M:\grep 04FF0068 imail\spool\sys0912.txt == 09:12 14:48 SMTPD(04FF0068) [206.114.136.2] connect 204.189.38.4 port 46612 09:12 14:48 SMTPD(04FF0068) [204.189.38.4] EHLO gw1.pointshare.com 09:12 14:48 SMTPD(04FF0068) [204.189.38.4] MAIL FROM:[EMAIL PROTECTED] 09:12 14:48 SMTPD(04FF0068) [204.189.38.4] RCPT TO:[EMAIL PROTECTED] 09:12 14:48 SMTPD(04FF0068) [204.189.38.4] M:\IMail\spool\D3f4204ff00685847.SMD 6073 09:12 14:48 SMTPD(04FF0068) performing antispam checks Declude JunkMail log entries: M:\grep Q3f4204ff00685847 imail\spool\spam\log\dec0912.log 09/12/2003 14:49:09 Q3f4204ff00685847 nIPNOTINMX:-3 nNOLEGITCONTENT:-5 HELO-FILTER:-15 MAILFROM-FILTER:-15 REVDNS-FILTER:-15 SUBJECT-FILTER:-28 SPAMCHECK:5 . Total weight = -66 09/12/2003 14:49:09 Q3f4204ff00685847 Msg failed HEADERS-FILTER (Message failed HEADERS-FILTER test (58)). Action=WARN. 09/12/2003 14:49:09 Q3f4204ff00685847 Msg failed HELO-FILTER (Message failed HELO-FILTER test (148)). Action=WARN. 09/12/2003 14:49:09 Q3f4204ff00685847 Msg failed MAILFROM-FILTER (Message failed MAILFROM-FILTER test (50)). Action=WARN. 09/12/2003 14:49:09 Q3f4204ff00685847 Msg failed REVDNS-FILTER (Message failed REVDNS-FILTER test (89)). Action=WARN. 09/12/2003 14:49:09 Q3f4204ff00685847 Msg failed SUBJECT-FILTER (Message failed SUBJECT-FILTER test (130)). Action=WARN. 09/12/2003 14:49:09 Q3f4204ff00685847 Msg failed SPAMCHECK (Message failed SPAMCHECK: 5.). Action=WARN. 09/12/2003 14:49:09 Q3f4204ff00685847 L1 Message OK 09/12/2003 14:49:09 Q3f4204ff00685847 Subject: Re: [SAtalk] Clearing the database - messed up autolearn 09/12/2003 14:49:09 Q3f4204ff00685847 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 66.35.250.206 ID: 873D9ADE45 == IMail delivery log entries M:\grep 0A7817F3 imail\spool\sys0912.txt == 09:12 14:49 SMTP-(0A7817F3) processing M:\IMail\spool\Q3f4204ff00685847.SMD 09:12 14:49 SMTP-(0A7817F3) Trying pointshare.com (0) 09:12 14:49 SMTP-(0A7817F3) Connect pointshare.com [165.226.179.6:25] (1) 09:12 14:49 SMTP-(0A7817F3) 220 psmail02.pointshare.com ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2656.59) ready 09:12 14:49 SMTP-(0A7817F3) EHLO intramail01.pointshare.net 09:12 14:49 SMTP-(0A7817F3) 250-psmail02.pointshare.com Hello [intramail01.pointshare.net] 09:12 14:49 SMTP-(0A7817F3) 250-XEXCH50 09:12 14:49 SMTP-(0A7817F3) 250-HELP 09:12 14:49 SMTP-(0A7817F3) 250-ETRN 09:12 14:49 SMTP-(0A7817F3) 250-DSN 09:12 14:49 SMTP-(0A7817F3) 250-SIZE 0 09:12 14:49 SMTP-(0A7817F3) 250-AUTH LOGIN 09:12 14:49 SMTP-(0A7817F3) 250 AUTH=LOGIN 09:12 14:49 SMTP-(0A7817F3) MAIL FROM:[EMAIL PROTECTED] 09:12 14:49 SMTP-(0A7817F3) 250 OK - mail from [EMAIL PROTECTED] 09:12 14:49 SMTP-(0A7817F3) RCPT To:[EMAIL PROTECTED] 09:12 14:49 SMTP-(0A7817F3) 250 OK - Recipient [EMAIL PROTECTED] 09:12 14:49 SMTP-(0A7817F3) DATA 09:12 14:49 SMTP-(0A7817F3) 354 Send data. End with CRLF.CRLF 09:12 14:49 SMTP-(0A7817F3) . 09:12 14:49 SMTP-(0A7817F3) 250 OK 09:12 14:49 SMTP-(0A7817F3) rdeliver pointshare.com [EMAIL PROTECTED] (1) [EMAIL PROTECTED]7078 09:12 14:49 SMTP-(0A7817F3) QUIT 09:12 14:49 SMTP-(0A7817F3) 221 closing connection 09:12 14:49 SMTP-(0A7817F3) finished M:\IMail\spool\Q3f4204ff00685847.SMD status=1 Message headers: Received: from intramail01.pointshare.net ([206.114.136.2]) by psmail02.pointshare.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2656.59) id SX8KA8GS; Fri, 12 Sep 2003 14:49:10 -0700 Received: from gw1.pointshare.com [204.189.38.4] by intramail01.pointshare.net with ESMTP (SMTPD32-8.02) id AF424FF0068; Fri, 12 Sep 2003 14:48:50 -0700 Received: from sc8-sf-list2.sourceforge.net (lists.sourceforge.net [66.35.250.206]) by gw1.pointshare.com (Mail Gateway) with ESMTP id 873D9ADE45 for [EMAIL PROTECTED]; Fri, 12 Sep 2003 14:48:50 -0700 (PDT) Received: from sc8-sf-list1-b.sourceforge.net ([10.3.1.13] helo=sc8-sf-list1.sourceforge.net) by sc8-sf-list2.sourceforge.net with esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id 19xuyC-el-00; Fri, 12 Sep 2003 13:56:44 -0700 Received: from sc8-sf-mx1-b.sourceforge.net ([10.3.1.11] helo=sc8-sf-mx1.sourceforge.net) by sc8-sf-list1.sourceforge.net with esmtp (Cipher TLSv1:DES-CBC3-SHA:168) (Exim 3.31-VA-mm2 #1 (Debian)) id 19xuwu-0006LG-00 for [EMAIL PROTECTED]; Fri, 12 Sep 2003 13:55:24 -0700 Received: from eclectic.kluge.net ([66.92.69.221] ident=[r5EKpNlhkpzjQgOb4cjxr3NeoS5ixNli]) by sc8-sf-mx1.sourceforge.net with esmtp (TLSv1:DES-CBC3-SHA:168) (Exim 4.22) id 19xuwu-0001i4-4M for [EMAIL PROTECTED]; Fri, 12
RE: [Declude.JunkMail] Baffled???
Note the conspicuously missing Declude headers. Any idea what would be causing Declude to not add it's headers to this persons messages? Scott, if you would like me to run debug logging, I can, but who know how long before this person posts to the list again. Do you have Imgate striping them? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Baffled???
I cannot figure out why messages from this particular participant on the SpamAssassin e-mail distribution list does not show any Declude JunkMail header entries. Here is the log info and headers for one of these messages: This is very odd. Have you checked the source of the E-mail, to see if the headers may appear in the body somewhere? My guess is that there is something incorrect with the original E-mail (perhaps using a CR to end a line rather than CRLF). If you look at the end: List-Unsubscribe: https://lists.sourceforge.net/lists/listinfo/spamassassin-talk,mailto:spa [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 the IMail headers aren't on there, either (such as Status: and X-UIDL:). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Baffled???
-Date: 11 Sep 2003 21:09:38 -0700 Date: 11 Sep 2003 21:09:38 -0700 X-IMAIL-SPAM-VALFROM: (74448974) X-Alligate-In: FAILED - Score Adult: 0 (Req: 35) Spam: 34 (Req: 50) Tot: 34 (Req: 6) X-Alligate-Tracking: BB33C3D457780B7D X-Alligate-Signature: -1495166888 X-Alligate-SpoolFile: Dea560470004e9b89.SMD X-Alligate-Sender: [EMAIL PROTECTED] [66.35.250.206] X-RBL-Warning: HEADERS-FILTER: Message failed HEADERS-FILTER test (57) X-RBL-Warning: HELO-FILTER: Message failed HELO-FILTER test (148) X-RBL-Warning: MAILFROM-FILTER: Message failed MAILFROM-FILTER test (50) X-RBL-Warning: REVDNS-FILTER: Message failed REVDNS-FILTER test (89) X-RBL-Warning: SUBJECT-FILTER: Message failed SUBJECT-FILTER test (130) X-RBL-Warning: ALLIGATE-SPAM-L1: Message failed ALLIGATE-SPAM-L1: 34. X-RBL-Warning: ALLIGATE-SPAM-L2: Message failed ALLIGATE-SPAM-L2: 34. X-RBL-Warning: SPAMCHECK: Message failed SPAMCHECK: 6. X-Declude-Sender: [EMAIL PROTECTED] [66.35.250.206] X-Queue-File: Dea560470004e9b89.SMD - outgoing X-Note: This e-mail was scanned for viruses filtered for spam X-Note: Total spam test weight: -67 = Very strange... Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 12, 2003 3:36 PM Subject: RE: [Declude.JunkMail] Baffled??? Note the conspicuously missing Declude headers. Any idea what would be causing Declude to not add it's headers to this persons messages? Scott, if you would like me to run debug logging, I can, but who know how long before this person posts to the list again. Do you have Imgate striping them? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Baffled???
Scott, I deleted the other message, but I forwarded you a copy of another message from the same poster, as an attachment (so the entire message, including headers, are intact), to your personal e-mail address in case you wanted to review it. Bill - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 12, 2003 5:02 PM Subject: Re: [Declude.JunkMail] Baffled??? I cannot figure out why messages from this particular participant on the SpamAssassin e-mail distribution list does not show any Declude JunkMail header entries. Here is the log info and headers for one of these messages: This is very odd. Have you checked the source of the E-mail, to see if the headers may appear in the body somewhere? My guess is that there is something incorrect with the original E-mail (perhaps using a CR to end a line rather than CRLF). If you look at the end: List-Unsubscribe: https://lists.sourceforge.net/lists/listinfo/spamassassin-talk,mailto:sp a [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 the IMail headers aren't on there, either (such as Status: and X-UIDL:). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
