Hi, >> Remember, Declude JunkMail looks at the HELO/EHLO of the remote mailserver, based on IPBYPASS/HOP <<
Uh - that's the answer. Thanks for clearing this up. So the "HELO" is not necessarily taken from the HELO, but from the HEADER. That certainly explains it. Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 http://www.HM-Software.com/ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, January 07, 2005 03:32 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] HELO Filter not Working? >Here is the Imail 8 log: > >01:07 13:13 SMTPD(d15f7804014ea63d) [63.107.174.14] connect >67.132.45.18 >port 2525 >01:07 13:13 SMTPD(d15f7804014ea63d) [67.132.45.18] EHLO mail.dollardays.com >01:07 13:13 SMTPD(d15f7804014ea63d) [67.132.45.18] MAIL FROM:... > >I set up a filter to simpify reporting on mail coming from a certain >gateway: > >REMOTEIP -1 IS 67.132.45.18 >HEADERS -2 CONTAINS X-Virus-Scanned: SpammerTrap >HELO -4 CONTAINS mail.dollardays.com Do you have %HELO% in the headers anywhere? If so, that should show you what Declude JunkMail is looking at. Remember, Declude JunkMail looks at the HELO/EHLO of the remote mailserver, based on IPBYPASS/HOP settings, so it may not be the same as what IMail sees (but should always be the same if IPBYPASS/HOP is not being used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. ---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
