You'll need to check the logs then.
Darin.
----- Original Message -----
From: Imail Admin
To: declude.junkmail@declude.com
Sent: Friday, May 25, 2007 9:54 AM
Subject: Re: [Declude.JunkMail] accidental whitelisting
Well, it's spam from outside, so I'm not sure that I would ever see or know
about BCC recipients. The headers just show the message addressed to me, with
the from line from me, but with someone else's IP address. It's probably the
oldest spam trick in the book to just forge the >From line.
Ben
----- Original Message -----
From: Darin Cox
To: declude.junkmail@declude.com
Sent: Friday, May 25, 2007 6:32 AM
Subject: Re: [Declude.JunkMail] accidental whitelisting
Anyone on the BCC line? If there's an address there that is being
whitelisted, then the entire email gets whitelisted to all recipients.
Darin.
----- Original Message -----
From: Imail Admin
To: declude.junkmail@declude.com
Sent: Friday, May 25, 2007 9:01 AM
Subject: Re: [Declude.JunkMail] accidental whitelisting
Hi David,
Yup, that was my first check. The address book in question is the web
address book, which you access from the web interface, right? I checked it and
it was empty -- not surprising because I mainly use Outlook Express in IMAP
mode. I did try turning it off briefly anyway, but then decided it couldn't be
the cause of the problem and turned it back on.
Someone else suggested putting Declude in Debug mode, and I could try that
next. Thing is, I'm not getting a lot of these types of spam, just a handful
in the last couple of days. So I'm concerned about how big the log files will
grow while I wait for another occurrence.
Thanks,
Ben
----- Original Message -----
From: David Barker
To: declude.junkmail@declude.com
Sent: Friday, May 25, 2007 5:46 AM
Subject: RE: [Declude.JunkMail] accidental whitelisting
AUTOWHITELIST ON checks your user address book make sure you don’t have
your own address in your address book.
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Imail Admin
Sent: Thursday, May 24, 2007 8:42 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] accidental whitelisting
Hi All,
We're in the process of tesing JM 4.x as an upgrade and I ran into what I
am sure is a minor mis-configuration.
I find that I occassionally get messages that are clearly spam, but are
whitelisted. The common characteristic is that they are sent with a from line
that is my own email address, such as the following:
X-Declude-Sender: [EMAIL PROTECTED] [77.85.117.187]
X-Declude-Spoolname: D29db019e00002105.smd
X-Declude-Note: Scanned by Declude 4.2.20 for spam.
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [0] at 17:12:28 on 24 May 2007
X-Declude-Fail: Whitelisted, ZEROHOUR [0]
Now, I checked and I don't see why this is being whitelisted. We only
whitelist a handful of IP addresses, and this isn't one of them. The whitelist
settings in the global.cfg file are:
#========================================= WHITELISTS
=======================================
#WHITELIST HABEAS
#DOMAINWHITELISTS OFF
PREWHITELIST ON
WHITELIST AUTH
AUTOWHITELIST ON
# ----- Domain Example -----
#WHITELIST FROM @declude.com
# ----- User Example -----
#WHITELIST FROM [EMAIL PROTECTED]
# ----- IP Example -----
WHITELIST IP 63.246.31.248
# ----- REVDNS Example -----
WHITELIST REVDNS .declude.com
These are pretty much the defaults. The Autowhitelist ON command uses
addresses in the web address book, so I checked those and found nothing (no
addresses at all). I'm sure this is something really obvious, but could
someone point it out to me?
Thanks,
Ben
BC Web
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
