Based on this I would agree then that the %TESTSFAILEDWITHWEIGHTS% variable is inserting a double CRLF instead of a single one, and this would seem to explain everything else that I was commenting on as it would seem to follow that the other things were merely effects of this, and complicated/obfuscated by the double-processing that isn't present in this example.

Maybe you could try one thing; retype that line from scratch after deleting it just to make sure there are not garbage non-printing characters showing up at the end of the line.  Beyond that, I would imagine that someone at Declude has been listening and will shortly confirm the issue, or maybe someone else that has already installed 2.0.6 could set up an account to forward using this header variable in their config and check to see if the same behavior repeats itself on other systems.

Matt



Frederick Samarelli wrote:
Mike/Matt (thanks for your help) You should be able to duplicated by just forwarding an email to an outside account using the problem line at the bottom.
 
As not to confuse things I simplified the process.
 
Send an email from [EMAIL PROTECTED] =>>> [EMAIL PROTECTED] (forwarded to) =>>> [EMAIL PROTECTED]
 
This run through only one server on my network.
 
 
Header from My AOL account.
Return-Path: <[EMAIL PROTECTED]>
Received: from  rly-xm04.mx.aol.com (rly-xm04.mail.aol.com [172.20.83.105]) by air-xm03.mail.aol.com (v105.26) with ESMTP id MAILINXM31-606425d743d132; Wed, 13 Apr 2005 15:34:25 -0400
Received: from  bks.tcbinc.com (bks.tcbinc.com [64.124.117.196]) by rly-xm04.mx.aol.com (v105.26) with ESMTP id MAILRELAYINXM42-606425d743d132; Wed, 13 Apr 2005 15:34:21 -0400
Received: from SMTP32-FWD by bks.tcbinc.com
  (SMTP32) id A741100040470EC67; Wed, 13 Apr 2005 15:33:42
Received: from web51806.mail.yahoo.com [206.190.38.237] by bks.tcbinc.com
  (SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 15:33:37 -0400
Received: (qmail 50369 invoked by uid 60001); 13 Apr 2005 19:34:12 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuKoj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE=  ;
Message-ID: <[EMAIL PROTECTED]>
Received: from [64.124.117.139] by web51806.mail.yahoo.com via HTTP; Wed, 13 Apr 2005 12:34:12 PDT
Date: Wed, 13 Apr 2005 12:34:12 -0700 (PDT)
From: Frederick Samarelli <[EMAIL PROTECTED]>
Subject: test10
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-RBL-Warning: SNIFFERZERO: Message failed SNIFFERZERO: 0.
X-Declude-Sender: [EMAIL PROTECTED] [206.190.38.237]
X-Declude-Spoolname: D741100040470EC67.SMD
X-Note: Total spam weight of this E-mail is 0.
X-RBL-Warning: Total weight: 0
X-Note: This E-mail was scanned & filtered by TCB [2.0.6] for SPAM & virus.
X-Spam-Tests-Failed: SNIFFERZERO
Message Body (should only be the word test10)
X-Spam-Tests-Failed Weight: SNIFFERZERO [0]
X-Spam-Time:15:33:42
X-Weight: 0
X-Mailfrom: samarelli.yahoo.com
X-Note: Sent from: [EMAIL PROTECTED]
X-Note: Sent from Reverse DNS:  web51806.mail.yahoo.com ([206.190.38.237])
X-Hello: web51806.mail.yahoo.com
X-Note: Recipient(s):  [EMAIL PROTECTED]
X-Country-Chain: UNITED STATES->destination
X-AOL-IP: 64.124.117.196
X-AOL-SCOLL-SCORE:0:0:0:
X-AOL-SCOLL-URL_COUNT:0
test10
 
Culprit:
XINHEADER  X-Spam-Tests-Failed Weight: %TESTSFAILEDWITHWEIGHTS%

-- 
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================


Reply via email to