Thanks, Scott. Ok, one more: here is the scoring system I use: BADHEADERS badheaders x x 8 0 BASE64 base64 x x 4 0 CMDSPACE cmdspace x x 8 0 COMMENTS comments x x 7 0 HELOBOGUS helovalid x x 5 0 IPNOTINMX ipnotinmx x x 0 -3 MAILFROM envfrom x x 12 0 NOLEGITCONTENT nolegitcontent x x 0 -5 PERCENT percent x x 10 0 REVDNS revdnsexists x x 4 0 ROUTING spamrouting x x 2 0 SPAMHEADERS spamheaders x x 3 0 SPFPASS spf pass x -3 0 SPFFAIL spf fail x 3 0 LOCALCMDSPACE filter D:\IMail\Declude\cmdspace.txt x 0 0
According to the log entry, the message should get 8 for failing CMDSPACE, 0 for failing IPNOTINMX, 0 for failing NOLEGITCONTENT, 3 for failing SPFFAIL, and 0 for failing LOCALCMDSPACE. It gets 0 points for passing all of the remaining tests. So that totals to 11, not 5. So how am I misreading this? Also, how can I find out why it failed the SPFFAIL test? Since this was for an internal message, I expected to pass the SPF tests (we have an SPF record). Thanks again, Ben ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, October 19, 2004 3:25 PM Subject: Re: [Declude.JunkMail] understanding JM scores > > >So what does the "=IGNORE" mean in the logs? Such as this: > > > >CMDSPACE=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE SPFFAIL=IGNORE > >LOCALCMDSPACE=IGNORE WEIGHT5=SUBJECT WEIGHT5r=MAILBOX CATCHALLMAILS=IGNORE > > Those are the actions that are taken. So the subject was modified since > the E-mail failed the WEIGHT5 test, and the E-mail was re-routed to another > mailbox since it failed the WEIGHT5r test, but no other actions were taken > due to the E-mail failing other tests. > > >And if this is only a list of tests that failed, then is there no list of > >tests the passed? > > Correct. The E-mail passed any tests that you have defined, but that are > not listed. The only other option would be for Declude JunkMail to log > every single test for every single E-mail, which could make for large log > file entries. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
