RE: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Sharyn Schmidt 
Based on the headers and the logs this was a retransmission.  Something
happened in the initial send that caused it to be aborted.  They did not
attempt the resend until today.  That's a very long retransmission interval.
As Kevin said earlier these kinds of things happen from time to time.  In
reality a 2 day retransmission interval is pretty odd.  Most servers will
retry several hours later.  Now what caused the connection to be dropped you
will probably never know - I would not be too terribly concerned unless you
start seeing a pattern with this (i.e. an issue on your end causing the
dropped connections).

Thanks for everyone's help. Normally this type of occurrence doesn't concern
me, however, this email came from one of our bigger customers to one of our
customer service representatives. Missing emails from these ppl IS of major
concern, due to the importance (and size) of their account.
 
Appreciate it! :)
 
Sharyn



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Darrell \([EMAIL PROTECTED]) 
MessageBased on the headers and the logs this was a retransmission.  Something 
happened in the initial send that caused it to be aborted.  They did not 
attempt the resend until today.  That's a very long retransmission interval.  
As Kevin said earlier these kinds of things happen from time to time.  In 
reality a 2 day retransmission interval is pretty odd.  Most servers will retry 
several hours later.  Now what caused the connection to be dropped you will 
probably never know - I would not be too terribly concerned unless you start 
seeing a pattern with this (i.e. an issue on your end causing the dropped 
connections).

Darrell


Check out http://www.invariantsystems.com for utilities for Declude And Imail.  
IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.
  - Original Message - 
  From: Sharyn Schmidt 
  To: declude.junkmail@declude.com 
  Sent: Thursday, January 25, 2007 12:43 PM
  Subject: RE: [Declude.JunkMail] Weird email problem


  Regarding your issue, it would be best to share the headers from the E-mail 
with the Received lines intact.

   
  Here are the headers from the original email:

  Received: from WDL.wilsondaniels.com [64.168.89.133] by cruzaninc.com with 
ESMTP
(SMTPD-9.10) id A2950324; Thu, 25 Jan 2007 00:39:33 -0500
  Received: from WilsonDaniels-DOM-MTA by WDL.wilsondaniels.com
   with Novell_GroupWise; Tue, 23 Jan 2007 07:28:54 -0800
  Message-Id: <[EMAIL PROTECTED]>
  X-Mailer: Novell GroupWise Internet Agent 7.0.1 
  Date: Tue, 23 Jan 2007 07:28:28 -0800
  From: "Johnna Cooledge" <[EMAIL PROTECTED]>
  To: "'Judith Taylor'" <[EMAIL PROTECTED]>
  Subject: Good Morning
  Mime-Version: 1.0
  Content-Type: text/plain; charset=US-ASCII
  Content-Transfer-Encoding: quoted-printable
  Content-Disposition: inline
  X-Declude-Sender: [EMAIL PROTECTED] [64.168.89.133]
  X-Declude-Spoolname: D429526d4aecd.smd
  X-Declude-RefID: 
  X-Declude-Note: Scanned by Declude 4.3.23 for spam. 
"http://www.declude.com/x-note.htm";
  X-Declude-Scan: Incoming Score [0] at 00:39:45 on 25 Jan 2007
  X-Declude-Fail: Whitelisted
  X-Country-Chain: 
  X-RCPT-TO: <[EMAIL PROTECTED]>
  Status:  
  X-UIDL: 465367379
  X-IMail-ThreadID: 429526d4aecd
   

  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Sharyn Schmidt 

 

The headers show conclusively that your server didn't receive this message
until almost two days after it was sent.  It was stuck on the sender's own
server and not yours.

 
Thanks, that's what I thought when I looked at it too, but wanted to make
sure before I went and "blamed" someone else.
 
Sharyn 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Matt 
The headers show conclusively that your server didn't receive this 
message until almost two days after it was sent.  It was stuck on the 
sender's own server and not yours.


Matt



Sharyn Schmidt wrote:
Regarding your issue, it would be best to share the headers from the 
E-mail with the Received lines intact.


 
Here are the headers from the original email:
 
Received: from WDL.wilsondaniels.com [64.168.89.133] by cruzaninc.com 
with ESMTP

  (SMTPD-9.10) id A2950324; Thu, 25 Jan 2007 00:39:33 -0500
Received: from WilsonDaniels-DOM-MTA by WDL.wilsondaniels.com
 with Novell_GroupWise; Tue, 23 Jan 2007 07:28:54 -0800
Message-Id: <[EMAIL PROTECTED] 
>

X-Mailer: Novell GroupWise Internet Agent 7.0.1
Date: Tue, 23 Jan 2007 07:28:28 -0800
From: "Johnna Cooledge" <[EMAIL PROTECTED] 
>
To: "'Judith Taylor'" <[EMAIL PROTECTED] 
>

Subject: Good Morning
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
X-Declude-Sender: [EMAIL PROTECTED] 
 [64.168.89.133]

X-Declude-Spoolname: D429526d4aecd.smd
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.3.23 for spam. 
"http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [0] at 00:39:45 on 25 Jan 2007
X-Declude-Fail: Whitelisted
X-Country-Chain:
X-RCPT-TO: <[EMAIL PROTECTED] >
Status: 
X-UIDL: 465367379

X-IMail-ThreadID: 429526d4aecd
 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Sharyn Schmidt 
Regarding your issue, it would be best to share the headers from the E-mail
with the Received lines intact.

 
Here are the headers from the original email:
 
Received: from WDL.wilsondaniels.com [64.168.89.133] by cruzaninc.com with
ESMTP
  (SMTPD-9.10) id A2950324; Thu, 25 Jan 2007 00:39:33 -0500
Received: from WilsonDaniels-DOM-MTA by WDL.wilsondaniels.com
 with Novell_GroupWise; Tue, 23 Jan 2007 07:28:54 -0800
Message-Id: <[EMAIL PROTECTED]>
X-Mailer: Novell GroupWise Internet Agent 7.0.1 
Date: Tue, 23 Jan 2007 07:28:28 -0800
From: "Johnna Cooledge" <[EMAIL PROTECTED]>
To: "'Judith Taylor'" <[EMAIL PROTECTED]>
Subject: Good Morning
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
X-Declude-Sender: [EMAIL PROTECTED] [64.168.89.133]
X-Declude-Spoolname: D429526d4aecd.smd
X-Declude-RefID: 
X-Declude-Note: Scanned by Declude 4.3.23 for spam.
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [0] at 00:39:45 on 25 Jan 2007
X-Declude-Fail: Whitelisted
X-Country-Chain: 
X-RCPT-TO: <[EMAIL PROTECTED]>
Status:  
X-UIDL: 465367379
X-IMail-ThreadID: 429526d4aecd
 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Kevin Bilbee 
Looks to me there was a problem with the original transmission and the message 
was resent after a timeout period. If it was the same message then the queue 
numbers would be the same.

 

 

I would not worry too much about it unless you see a pattern. These things 
happen from time to time.

 

 

 

Kevin Bilbee

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt
Sent: Thursday, January 25, 2007 8:24 AM
To: Imail_Forum@list.ipswitch.com
Cc: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Weird email problem

 

I'm having a REALLY WEIRD email problem, makes me feel like I'm in the twilight 
zone… 

One of my users reported that she did not receive an email from [EMAIL 
PROTECTED] until TODAY, but the email was sent on Tuesday, 1/23, at 10:28am. 
She forwarded me a copy of the email. The following is from my Imail log from 
1/23...

 

01:23 10:31 SMTPD(2a4b22aaf903) [24.73.160.163] connect 64.168.89.133 port 
23634 

01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] EHLO WDL.wilsondaniels.com 

01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] MAIL FROM:<[EMAIL 
PROTECTED]> 

01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] RCPT TO:<[EMAIL PROTECTED]> 

After this line, there is NOTHING else. The whole process for this email just 
seems to stop. In the IMAIL log for that day, I did a search for the 
d2a4b22aaf903.smd and the q2a4b22aaf903.smd, but turned up absolutely 
nothing.

I did searches in both my Declude Junkmail and virus logs for the q and d files 
as well, nothing. I did searches in my logs on 1/24 and still turned up 
nothing. In the 1/23 Junkmail log, I even used the email address, [EMAIL 
PROTECTED], and came up with nothing.

Then, I looked in todays log, at the time that the user finally received the 
message. Here is the log entry from Imail: 

 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] EHLO WDL.wilsondaniels.com 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] MAIL FROM:<[EMAIL 
PROTECTED]> 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] RCPT TO:<[EMAIL PROTECTED]> 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] 
D:\IMAIL\spool\Dac2c2766c9d4.SMD 958 

01:25 08:10 SMTPD(ac2c2766c9d4) performing antispam checks 

That's it for the log entry in Imail. I checked the Declude Junkmail log, and 
found the following, below. Please note that the entire @wilsondaniels.com 
domain is whitelisted. Also, my user DID indeed receive this message, today, 2 
days later. Going by the subject line (Good morning), it looks like the message 
that was send on Tues, even though the spool file names are different. Can 
anyone clue me in on what is going on here? This isnt the only message from 
wilsondaniels that was sent on Tues and received today. I just havent gotten 
the log entries for the other ones yet.

 

Rec'd the message on 1/25, log entry in Declude Junkmail log: 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(63.246.13.90).  nm= 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(192.168.100.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(192.168.110.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(192.168.120.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(192.168.130.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(192.168.140.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(192.168.150.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(10.10.100.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in whitelist 
(24.73.160.164).  nm= 
01/25/2007 08:10:18.125 qac2c2766c9d4.smd Filter URLfilter: Not skipping 
E-mail due to current weight  of 20. 
01/25/2007 08:10:18.156 qac2c2766c9d4.smd Filter InBodyFilter: Not skipping 
E-mail due to current  weight of 20. 
01/25/2007 08:10:18.171 qac2c2766c9d4.smd Filter InHeadersFilter: Not 
skipping E-mail due to current  weight of 20. 
01/25/2007 08:10:18.187 qac2c2766c9d4.smd Filter FILTER-ADULT: Not skipping 
E-mail due to current  weight of 20. 
01/25/2007 08:10:18.203 qac2c2766c9d4.smd Filter FILTER-MEDICAL: Not 
skipping E-mail due to current  weight of 20. 
01/25/2007 08:10:18.218 qac2c2766c9d4.smd FROMNOMATCH:3 HELOBOGUS:5 
MAILFROM:12 .  Total weight = 20. 
01/25/2007 08:10:18.218 qac2c2766c9d4.smd Tests failed [weight=20]: 
CATCHALLMAILS=IGNORE[0]  NOLEGITCONTENT=IGNORE[0] IPNOTINMX=IGNORE[0] 
FROMNOMATCH=IGNORE[3] HELOBOGUS=IGNORE[5]  MAILFROM=IGNORE[12] 
WEIGHT10=IGNORE[10] WEIGHT12=IGNORE[12] 

01/25/2007 08:10:18.218 qac2c2766c9d4.smd

RE: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Sharyn Schmidt 
My apologies, I was unsure if this was a Declude issue or an Imail issue.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Thursday, January 25, 2007 12:05 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Weird email problem


Sharyn,

I'm not the 'list police', but it is proper etiquette not to post the same
thing in multiple lists at the same time, especially when many from one list
are on the other.  This has in fact caused confusion in the past with your
posts because one conversation starts in one place and is simultaneously
being discussed in another, and in part by the same people.

I would suggest that you post it in the most appropriate list, and only post
it elsewhere if you can't find resolution there.

Regarding your issue, it would be best to share the headers from the E-mail
with the Received lines intact.

Good luck,

Matt



Sharyn Schmidt wrote: 

I'm having a REALLY WEIRD email problem, makes me feel like I'm in the
twilight zone. 

One of my users reported that she did not receive an email from
[EMAIL PROTECTED] until TODAY, but the email was sent on Tuesday,
1/23, at 10:28am. She forwarded me a copy of the email. The following is
from my Imail log from 1/23...


01:23 10:31 SMTPD(2a4b22aaf903) [24.73.160.163] connect 64.168.89.133
port 23634 

01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] EHLO
WDL.wilsondaniels.com 

01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] MAIL FROM:
<mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> 

01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] RCPT TO:
<mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> 

After this line, there is NOTHING else. The whole process for this email
just seems to stop. In the IMAIL log for that day, I did a search for the
d2a4b22aaf903.smd and the q2a4b22aaf903.smd, but turned up
absolutely nothing.

I did searches in both my Declude Junkmail and virus logs for the q and d
files as well, nothing. I did searches in my logs on 1/24 and still turned
up nothing. In the 1/23 Junkmail log, I even used the email address,
[EMAIL PROTECTED], and came up with nothing.

Then, I looked in todays log, at the time that the user finally received the
message. Here is the log entry from Imail: 


01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] EHLO
WDL.wilsondaniels.com 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] MAIL FROM:
<mailto:[EMAIL PROTECTED]>
<[EMAIL PROTECTED]> 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] RCPT TO:
<mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]> 

01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133]
D:\IMAIL\spool\Dac2c2766c9d4.SMD 958 

01:25 08:10 SMTPD(ac2c2766c9d4) performing antispam checks 

That's it for the log entry in Imail. I checked the Declude Junkmail log,
and found the following, below. Please note that the entire
@wilsondaniels.com domain is whitelisted. Also, my user DID indeed receive
this message, today, 2 days later. Going by the subject line (Good morning),
it looks like the message that was send on Tues, even though the spool file
names are different. Can anyone clue me in on what is going on here? This
isnt the only message from wilsondaniels that was sent on Tues and received
today. I just havent gotten the log entries for the other ones yet.



Rec'd the message on 1/25, log entry in Declude Junkmail log: 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (63.246.13.90).  nm= 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (192.168.100.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (192.168.110.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (192.168.120.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (192.168.130.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (192.168.140.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (192.168.150.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (10.10.100.0/24).  nm=ff00 
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in
whitelist (24.73.160.164).  nm= 
01/25/2007 08:10:18.125 qac2c2766c9d4.smd Filter URLfilter: Not skipping
E-mail due to current weight  of 20. 
01/25/2007 08:10:18.156 qac2c2766c9d4.smd Filter InBodyFilter: Not
skipping E-mail due to current  weight of 20. 
01/25/2007 08:10:18.171 qac2c2766c9d4.smd Filter InHeadersFilter: Not
skipping E-mail due to current  weight of 20. 
01/25/2007 08:10:18.187 qac2c2766c9d4.smd Filter FILTER-ADULT: Not
skipping E-mail due to current  weight of 20. 
01/25/2007 08:10:18.203 qa

Re: [Declude.JunkMail] Weird email problem

2007-01-25 Thread Matt 

Sharyn,

I'm not the 'list police', but it is proper etiquette not to post the 
same thing in multiple lists at the same time, especially when many from 
one list are on the other.  This has in fact caused confusion in the 
past with your posts because one conversation starts in one place and is 
simultaneously being discussed in another, and in part by the same people.


I would suggest that you post it in the most appropriate list, and only 
post it elsewhere if you can't find resolution there.


Regarding your issue, it would be best to share the headers from the 
E-mail with the Received lines intact.


Good luck,

Matt



Sharyn Schmidt wrote:


I'm having a REALLY WEIRD email problem, makes me feel like I'm in the 
twilight zone...


One of my users reported that she did not receive an email from 
[EMAIL PROTECTED] until TODAY, but the email was sent on 
Tuesday, 1/23, at 10:28am. She forwarded me a copy of the email. The 
following is from my Imail log from 1/23...



01:23 10:31 SMTPD(2a4b22aaf903) [24.73.160.163] connect 
64.168.89.133 port 23634


01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] EHLO 
WDL.wilsondaniels.com


01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] MAIL 
FROM:<[EMAIL PROTECTED]>


01:23 10:31 SMTPD(2a4b22aaf903) [64.168.89.133] RCPT 
TO:<[EMAIL PROTECTED]>


After this line, there is NOTHING else. The whole process for this 
email just seems to stop. In the IMAIL log for that day, I did a 
search for the d2a4b22aaf903.smd and the q2a4b22aaf903.smd, 
but turned up absolutely nothing.


I did searches in both my Declude Junkmail and virus logs for the q 
and d files as well, nothing. I did searches in my logs on 1/24 and 
still turned up nothing. In the 1/23 Junkmail log, I even used the 
email address, [EMAIL PROTECTED], and came up with nothing.


Then, I looked in todays log, at the time that the user finally 
received the message. Here is the log entry from Imail:



01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] EHLO 
WDL.wilsondaniels.com


01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] MAIL 
FROM:<[EMAIL PROTECTED]>


01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] RCPT 
TO:<[EMAIL PROTECTED]>


01:25 08:10 SMTPD(ac2c2766c9d4) [64.168.89.133] 
D:\IMAIL\spool\Dac2c2766c9d4.SMD 958


01:25 08:10 SMTPD(ac2c2766c9d4) performing antispam checks

That's it for the log entry in Imail. I checked the Declude Junkmail 
log, and found the following, below. Please note that the entire 
@wilsondaniels.com domain is whitelisted. Also, my user DID indeed 
receive this message, today, 2 days later. Going by the subject line 
(Good morning), it looks like the message that was send on Tues, even 
though the spool file names are different. Can anyone clue me in on 
what is going on here? This isnt the only message from wilsondaniels 
that was sent on Tues and received today. I just havent gotten the log 
entries for the other ones yet.




Rec'd the message on 1/25, log entry in Declude Junkmail log:
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (63.246.13.90).  nm=
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (192.168.100.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (192.168.110.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (192.168.120.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (192.168.130.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (192.168.140.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (192.168.150.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (10.10.100.0/24).  nm=ff00
01/25/2007 08:10:10.125 qac2c2766c9d4.smd IP 64.168.89.133 not in 
whitelist (24.73.160.164).  nm=
01/25/2007 08:10:18.125 qac2c2766c9d4.smd Filter URLfilter: Not 
skipping E-mail due to current weight  of 20.
01/25/2007 08:10:18.156 qac2c2766c9d4.smd Filter InBodyFilter: Not 
skipping E-mail due to current  weight of 20.
01/25/2007 08:10:18.171 qac2c2766c9d4.smd Filter InHeadersFilter: 
Not skipping E-mail due to current  weight of 20.
01/25/2007 08:10:18.187 qac2c2766c9d4.smd Filter FILTER-ADULT: Not 
skipping E-mail due to current  weight of 20.
01/25/2007 08:10:18.203 qac2c2766c9d4.smd Filter FILTER-MEDICAL: 
Not skipping E-mail due to current  weight of 20.
01/25/2007 08:10:18.218 qac2c2766c9d4.smd FROMNOMATCH:3 
HELOBOGUS:5 MAILFROM:12 .  Total weight = 20.
01/25/2007 08:10:18.218 qac2c2766c9d4.smd Tests failed 
[weight=20]: CATCHALLMAILS=IGNORE[0]  NOLEGITCONTENT=IGNORE[0] 
IPNOTINMX=IGNORE[0] FROMNOMATCH=IGNORE[3] HELOBOGUS=IGNORE[5]  
MAILFROM=IGNORE[12] WEIGHT10=IGNORE[10] WEIGHT12=IGNORE[12]


01/25/200