I wonder if someone could be so kind and help me analyze a header from a message. The message is from a mailing list and I have WHITELIST the original IP address. However I don't understand why X-Declude-Sender has 2 different IP addresses and it doesn't look like the original sender is whitelisted because the messages still fails. The first one is the whitelisted IP address that the message originated from (68.173.225.12). The second is the IP address of the recipient (our customer at 63.209.65.179). I have IPBYPASS the C block that belongs to our customer because most of the IP addresses in that block belongs to web sites and some form submissions failed Declude. We have 2 Imgate gateways (mx3 and mx4) and both of those IP addresses are IPBYPASS. Here is the header:
Received: from MX4.NetWood.net [209.247.184.2] by netwood.net with ESMTP (SMTPD32-7.15) id AF9C189800F8; Sun, 19 Oct 2003 04:03:56 -0700 Received: from centurymedia.com (mail.centurymedia.com [63.209.65.179]) by MX4.NetWood.net (Postfix) with ESMTP id AF8613EE426 for <[EMAIL PROTECTED]>; Sun, 19 Oct 2003 04:02:57 -0700 (PDT) (envelope-from [EMAIL PROTECTED]) Received: from MX3.NetWood.net [209.247.184.13] by centurymedia.com with ESMTP (SMTPD32-7.15) id A02D15013A; Sun, 19 Oct 2003 04:06:21 -0700 Received: from k1s3k2 (68-173-225-12.nyc.rr.com [68.173.225.12]) by MX3.NetWood.net (Postfix) with SMTP id ECDAE40E61 for <[EMAIL PROTECTED]>; Sun, 19 Oct 2003 04:03:48 -0700 (PDT) (envelope-from [EMAIL PROTECTED]) From: "goregiasticrecords.com" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: POSSIBLE SPAM:Pre-Order NOW: New PUSTULATED, SAPROFFAGO, IMPURE & CAEDERE! Sender: "goregiasticrecords.com" <[EMAIL PROTECTED]> Mime-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Date: Sun, 19 Oct 2003 07:02:05 -0400 Message-Id: <[EMAIL PROTECTED]> X-RBL-Warning: EASYNET-DYNA: 12.225.173.68.dynablock.easynet.nl. X-RBL-Warning: HELOBOGUS: Domain k1s3k2 has no MX or A records. X-Declude-Sender: [EMAIL PROTECTED] [68.173.225.12] <<<<<<<<<<<<<<< X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: EASYNET-DYNA, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, WEIGHT10, WEIGHT12 [14] X-Declude-Sender: [EMAIL PROTECTED] [63.209.65.179] <<<<<<<<<<<<<<<< X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] <<<<<<<<<<<<<<<<<<<<<<<<<<< X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 366374215 Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
