The short/direct answer is: Declude gets it from the header. It doesn't "watch" the SMTP conversation.
That information is inserted by Imail (or a server you trust by specifying IPBYPASS) by copying it from the HELO string. It only makes sense once I thought about it. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Saturday, January 08, 2005 11:05 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] HELO Filter not Working? > >Both, actually. Declude JunkMail gets the "HELO" from the real > >HELO/EHLO from the SMTP envelope. The method Declude JunkMail uses > >to obtain the HELO, however, is the headers. > >Ok, this is clear as mud....which is it, envelope or headers? The SMTP envelope contains information about the E-mail that may or may not appear in the headers. The most common information is the true sender ("MAIL FROM") and the actual recipients (as they may be Bcc:s). There are several SMTP envelopes as the E-mail passes from computer to computer, but you can only access the true SMTP envelope on the current server. However, some of the information from the SMTP envelope does go into the headers. The HELO/EHLO will appear in the Received: header. So it *is* as clear as mud. :) The information is obtained from the headers, and is added to the headers from information that comes from the SMTP envelope. So the information Declude JunkMail gets is the same as the information in the SMTP envelope, but Declude JunkMail gets it from somewhere else. It's kind of like asking "Did you get Joe's number from the phone company?" -- it kind of a silly question, the answer to which would not be obvious (no, you got the number from Joe, but he got it from the phone company). >Or is there a precedence, so in some circumstances it uses one and in >others uses the >other? It's a moot point, really, except for scholars. Declude JunkMail will get the same information from the SMTP envelope as it gets from the headers, unless a trusted mailserver lies (in which case you have bigger problems), or if an error occurs on the mailserver creating the headers (in which case you also have bigger problems). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. ---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
