Regardless, this isn't the fault of Bonded Sender, you are scanning on multiple hops and the spammer forged the headers to trick you into crediting it points. Bonded Sender needs to be named BONDEDSENDER(DUL) in your Global.cfg to prevent it from scanning past the last hop. That will correct the issue.
I've mentioned this before and will again since this is the proper context...it would be nice if Declude could add some additional columns to the DSNBL tests so that you could specify how many hops to scan per test, and which hop to start on (two columns). This way we could score things according to how deep they are in the list, noting the fact that zombies are now being used to relay through other servers, and they are also responsible for an occasional FP when the legit sender is using the same computer for sending real E-mail. I have no immediate expectations for this, though I see such a thing as inevitable down the road. The naming trick like I showed above allows you to work around this limitation for now. Credit the trick to Andrew.
Matt
Paul Fuhrmeister wrote:
Looking on the bondedsender.com web site, I see no where to report things like this:
Received: from adsl-68-78-114-74.dsl.emhril.ameritech.net (adsl-68-78-114-74.dsl.emhril.ameritech.net [68.78.114.74]) Received: from ebay.com (data.ebay.com [66.135.195.180]) From: eBay Service <[EMAIL PROTECTED]> Subject: Ebay Account Update X-RAV-AntiVirus: This message has been scanned for viruses on adsl-68-78-114-74.dsl.emhril.ameritech.net X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.78.114.74 X-RBL-Warning: SORBS-DUHL: Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.78.114.74 X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?68.78.114.74 X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: BONDEDSENDER: IronPort Bonded Sender - http://www.bondedsender.com X-RBL-Warning: SPAM-DOMAINS: Spamdomain '@ebay.com' found: Address of [EMAIL PROTECTED] sent from invalid adsl-68-78-114-74.dsl.emhril.ameritech.net. X-Declude-Sender: [EMAIL PROTECTED] [68.78.114.74]
[EMAIL PROTECTED]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
