[Declude.JunkMail] Troubleshooting "FROMFILE" Configuration Issue

[Dan Geiser]

Hello, All, I'm having an issue with Declude ignoring a test and I can't seem to figure out where my configuration problem lies so I thought I'd send it to the list for some additional troubleshooting.   Our mail system received the following message Friday Night...   ---- Received: from tempus.getresponse.com [207.8.198.43] by american-ape.com   (SMTPD32-6.06) id A6B2180027A; Fri, 17 Sep 2004 22:00:18 -0400 Received: (qmail 81325 invoked by uid 1003); 18 Sep 2004 01:58:34 -0000 Date: 18 Sep 2004 01:58:34 -0000 Message-ID: <[EMAIL PROTECTED]> From: "BestYellow.com" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: "Submitter" <[EMAIL PROTECTED]> X-Mailer: GetResponse X-Complaints-To: [EMAIL PROTECTED] Response-id: r-bestyellow-rid-336878-bid-100291 X-Remove-Address: [EMAIL PROTECTED] X-Responder-ID: 336878 Subject: =?utf-8?b?SGVscCAtIEh1cnJpY2FuZSBSZWxpZWYgUGFja2FnZQ==?= Content-Type: text/html; charset="UTF-8" X-Declude-Sender: [EMAIL PROTECTED] [207.8.198.43] X-Note: This E-mail was scanned & filtered by Declude [1.79] for SPAM & viruses. X-Country-Chain: UNITED STATES->destination X-Note: Recipient(s):  [EMAIL PROTECTED] X-Note: Sent with HELO [tempus.getresponse.com] from Reverse DNS [tempus.getresponse.com] X-Spam-Tests-Failed: NOABUSE, IPNOTINMX, NOLEGITCONTENT, WEIGHT-HOLD, AHBL-RHSBL-RELAY, IPFILE-BAD-24 [199] ----   One of these tests that I have configured did not get noted in the X-Spam-Tests-Failed line.   I have the following entry in GLOBAL.CFG...   ---- FROMFILE-OTHER  fromfile D:\iMail\declude\JunkMail.08.FromFile.Other.txt  x 50 0 ----   and the following entry in "JunkMail.08.FromFile.Other.txt"...   ---- # // JunkMail.08.FromFile.Other.txt //   # ================================ # == Add Points To Total Weight == # ================================   # -- Strings In User Names   -COM@ -return@ .com@ .com- .com. .com? ----   This message should have had an additional 50 points added to it because it has the string ".com@" in the "Sender" field but it didn't.   I isolated the entries for this message in the Declude JunkMail Log...   ---- 09/17/2004 22:00:37 Q96b227a NOABUSE:24 AHBL-RHSBL-RELAY:25 IPFILE-BAD-24:150 .  Total weight = 199. 09/17/2004 22:00:37 Q96b227a Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">09/17/2004 22:00:37 Q96b227a Msg failed WEIGHT-HOLD (Total weight between 100 and 299.). Action="">09/17/2004 22:00:37 Q96b227a Msg failed AHBL-RHSBL-RELAY ("Domain used in spam.  Access is not allowed."). Action="">09/17/2004 22:00:37 Q96b227a Msg failed IPFILE-BAD-24 (# [US]). Action="">09/17/2004 22:00:37 Q96b227a R1 Message OK 09/17/2004 22:00:37 Q96b227a Subject: =?utf-8?b?SGVscCAtIEh1cnJpY2FuZSBSZWxpZWYgUGFja2FnZQ==?= 09/17/2004 22:00:37 Q96b227a From: [EMAIL PROTECTED] To:  IP: 207.8.198.43 ID: 09/17/2004 22:00:37 Q96b227a Tests failed [weight=199]: NOABUSE=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE CATCHALLMAILS=IGNORE WEIGHT-HOLD=IGNORE AHBL-RHSBL-RELAY=IGNORE IPFILE-BAD-24=IGNORE 09/17/2004 22:00:37 Q96b227a Using [incoming] CFG file d:\iMail\Declude\american-ape.com\$default$.junkmail. 09/17/2004 22:00:37 Q96b227a Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action="">09/17/2004 22:00:37 Q96b227a Msg failed WEIGHT-HOLD (Total weight between 100 and 299.). Action="">09/17/2004 22:00:37 Q96b227a Msg failed AHBL-RHSBL-RELAY ("Domain used in spam.  Access is not allowed."). Action="">09/17/2004 22:00:37 Q96b227a Msg failed IPFILE-BAD-24 (# [US]). Action="">09/17/2004 22:00:37 Q96b227a Subject: =?utf-8?b?SGVscCAtIEh1cnJpY2FuZSBSZWxpZWYgUGFja2FnZQ==?= 09/17/2004 22:00:37 Q96b227a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]  IP: 207.8.198.43 ID: 09/17/2004 22:00:37 Q96b227a Tests failed [weight=199]: NOABUSE=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE CATCHALLMAILS=IGNORE WEIGHT-HOLD=HOLD AHBL-RHSBL-RELAY=IGNORE IPFILE-BAD-24=IGNORE 09/17/2004 22:00:37 Q96b227a Last action = "">----   but still no mention of the FROMFILE-OTHER test.   Does anyone have an idea what might be going on here?   Thanks In Advance, Dan Geiser [EMAIL PROTECTED]