RE: [Declude.JunkMail] odd behavior

Fri, 25 Feb 2005 08:05:06 -0800

So it looks like BOTH Imail (via trusted addresses) and Declude (via Autowhitelist) were whitelisting this message.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Friday, February 25, 2005 9:32 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] odd behavior

Hi John,
 
I think you missed a thread Doug and I exchanged.  He explained that he combined the IMail and Declude logs below to show everything in regards to the message.  The following two lines are from his Declude logs showing that the message was whitelisted by Declude:
 
02/22/2005 07:41:14 Q3664039604421990 Skipping4 E-mail from [EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]
02/22/2005 07:41:14 Q3664039604421990 Skipping4 E-mail from [EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]

Darin.
 
 
----- Original Message -----
Sent: Friday, February 25, 2005 3:08 AM
Subject: RE: [Declude.JunkMail] odd behavior

I’ll repost here what I posted on the Imail list. The problem is within Imail, not Declude. Declude does not log a line using SMTPD, Imail does. The line showing the whitelisting is a Imail SMTPD line, end of story as far as Declude is concerned.

 

John Tolmachoff

Engineer/Consultant/Owner

eServices For You

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Thursday, February 24, 2005 6:41 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] [IMail Forum] odd behavior

 

Doug,

It is likely that this is due to the AUTOWHITELIST ON setting and the recipient having their own E-mail address listed in their Web mail address book.  Either that or something that says [EMAIL PROTECTED] (Declude's version of a wildcard match for that domain).

Matt



Doug Anderson wrote:

That's the thing, I have one white list file (hate whitelists) and ameripride is not in it....

Did anything change in declude junkmail lately in reguards to whitelists (I just upgrade 2 nights ago)?

All I have for references to whitelist are :

 

$default.junkmail

WHITELISTFILE D:\Imail\Declude\AWHITELST.txt

#note AWhitelst.txt does not include ameripride.org

 

Global.cfg

CODE            ########

LOGFILE         d:\declude\logfiles\dec####.log
LOGLEVEL        LOW
HOP             0
HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT
XINHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%]
XINHEADER X-Country-Chain: %COUNTRYCHAIN%
XOUTHEADER X-Note: E-mail scanned by Declude-JunkMail for spam by CRC.
XSENDER  ON
XSPOOLNAME ON
XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]).
PREWHITELIST ON
AUTOWHITELIST   ON
WHITELIST AUTH

.

.

WHITELIST IP 192.168.0.182
WHITELIST IP 192.168.0.85
WHITELIST IP 192.168.0.86

#Servers on local network (not exposed to public) that send emails (status reports)

 

----- Original Message -----

Sent: Thursday, February 24, 2005 2:48 PM

Subject: Re: [IMail Forum] odd behavior

 

Says ameripride.org is on the whitelist (decludes not IMail's)

 

Eric S

----- Original Message -----

Sent: Thursday, February 24, 2005 3:03 PM

Subject: Re: [IMail Forum] odd behavior

 

Trying to figure out why it's white listed.

 

02:22 07:40 SMTPD(3664039604421990) [192.168.0.135] connect 221.127.179.32 port 1194
02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] HELO 67.130.17.126
02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] MAIL FROM: <[EMAIL PROTECTED]>
02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] RCPT TO: <[EMAIL PROTECTED]>
02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] RCPT TO: <[EMAIL PROTECTED]>
02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] RCPT TO: <[EMAIL PROTECTED]>
02:22 07:41 SMTPD(3664039604421990) [221.127.179.32] d:\IMail\spool\D3664039604421990.SMD 201
02:22 07:41 SMTP-(3664039604421990) processing d:\IMail\spool\Q3664039604421990.SMD
02:22 07:41 SMTPD(3664039604421990) [ameripride.org] in white list
02/22/2005 07:41:11 Q3664039604421990 Scanned: Virus Free
02/22/2005 07:41:14 Q3664039604421990 L1 Message OK
02/22/2005 07:41:14 Q3664039604421990 Tests failed [weight=25]: BADHEADERS=WARN CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE REVDNS=WARN TLD=WARN COUNTRY=WARN WEIGHT10PLUS=SUBJECT CATCHALLMAILS=IGNORE
02/22/2005 07:41:14 Q3664039604421990 L2 Message OK
02/22/2005 07:41:14 Q3664039604421990 Tests failed [weight=25]: BADHEADERS=WARN CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE REVDNS=WARN TLD=WARN COUNTRY=WARN WEIGHT10PLUS=SUBJECT CATCHALLMAILS=IGNORE
02/22/2005 07:41:14 Q3664039604421990 Skipping4 E-mail from [EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]
02/22/2005 07:41:14 Q3664039604421990 Skipping4 E-mail from [EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]
02/22/2005 07:41:14 Q3664039604421990 L3 Message OK
02/22/2005 07:41:14 Q3664039604421990 Tests failed [weight=0]: CATCHALLMAILS=IGNORE
02:22 07:41 SMTP-(3664039604421990) ldeliver mail.ameripride.org maria.snyder-main (1) [EMAIL PROTECTED] 972
02:22 07:41 SMTP-(3664039604421990) ldeliver mail.ameripride.org reggie.licari-main (1) [EMAIL PROTECTED] 972
02:22 07:41 SMTP-(3664039604421990) ldeliver mail.ameripride.org richard.boudreau-main (1) [EMAIL PROTECTED] 972
02:22 07:41 SMTP-(3664039604421990) finished d:\IMail\spool\Q3664039604421990.SMD status=1

----- Original Message -----

From: Travis Rabe

Sent: Thursday, February 24, 2005 1:09 PM

Subject: RE: [IMail Forum] odd behavior

 

What do the logs show you?

T

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Doug Anderson
Sent: Thursday, February 24, 2005 11:04 AM
To: IMail_Forum@list.ipswitch.com
Subject: [IMail Forum] odd behavior

I have the following type of email showing up...basically blank.

I'm trying to figure out if our imail server is hacked or something - because it's coming from local host.

Any ideas here? Got 8.15 and the most current release of declude running.

Received: from 67.130.17.126 [221.127.179.32] by mail.ameripride.org
  (SMTPD32-8.15) id A66D3960442; Tue, 22 Feb 2005 07:41:01 -0600
Received: from localhost (HELO localhost [127.0.0.1])
 by acts
X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c200001].
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 221.127.179.32 with no reverse DNS entry.
X-RBL-Warning: TLD: Message failed TLD test (line 14, weight 0)
X-RBL-Warning: COUNTRY: Message failed COUNTRY test (line 116, weight 6)
X-Declude-Sender: [EMAIL PROTECTED] [221.127.179.32]
X-Declude-Spoolname: D3664039604421990.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
X-Spam-Tests-Failed: Whitelisted [0]
X-Country-Chain: HONG KONG->destination
X-Note: This E-mail was sent from [No Reverse DNS] ([221.127.179.32]).
From: [EMAIL PROTECTED]
Date: Tue, 22 Feb 2005 07:41:15 -0600
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 377156391

*Scanned for viruses by Declude Virus*

 



-- 
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================

Reply via email to