Another 2 cents... I see all too often that mail comes (and goes out) to hosts pointed to by MX records that are not the lowest. Either some SMTP servers take the value of the MX record as a *suggestion*, or their DNS is broken, and take the first MX listed, regardless of the value.
I suspect that the definition of "is the primary functional" is too hard to nail down, and the test possibly too slow, for the value it brings to spam detection. In particular because declude.exe runs and terminates, runs and terminates for each message, that it makes stateful tests difficult. The only way that I could suggest implementing this is to make it an external test of your own design that simply checks the current time against the last e-mail that came directly through the primary mail server. You would then have to decide how long a window qualifies as "primary is down". Andrew. -----Original Message----- From: Paul Navarre [mailto:[EMAIL PROTECTED] Sent: Thursday, October 02, 2003 10:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Backup MX / Spam ************ You could write a filter that searches the headers for your backup server's IP address. HEADERS 3 CONTAINS x.x.x.x Matt ************ The problem with this is if your primary does go down (rebooting for a patch for example), these points will be added to *all* email until your primary is back up. I posted just a few days ago asking if it was possible for Declude to check that primary was functional. If so, there could be a test that would add points for any mail sent to the secondary when the primary is functional. I realize that this would require a new version of Declude, but I think it could be really worthwhile. Nobody responded to my last post, so I wasn't sure if there is some reason why this wouldn't work or would be too difficult. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
