Thanks Scott, my wisdom grows by the second, along with more grey hairs. A couple more questions: I expected Declude to filter incoming spam, but not outgoing email. We have a small client list and I'm not worried about any of them spamming. I do understand about relaying, but I thought we had that covered with the IMail no-relay option. So do we really need to filter email going out from our clients? If not, how do we stop it?
Also, I don't see the percent sign in the to-addresses. Here's how it shows up in the IMail log: 12:09 18:08 SMTPD(10D50148) [206.29.173.128] MAIL FROM: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <Mike krueger (E-mail)> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <:[EMAIL PROTECTED]> 12:09 18:08 SMTPD(10D50148) [206.29.173.128] D:\IMAIL\spool\D800d10d501486618.SMD 2851 The address to Mike krueger doesn't look like it will work, but I still don't see the percent. I found the message being held and pulled the header, but that doesn't help much either. If you're wondering how come the rcpt to lines look funny (like Mike krueger), it's because these people were using Exchange/Outlook before switching to IMail/Outlook Express. Here is the mail header: Received: from MIKE2 [206.29.173.128] by ipswheat.com with ESMTP (SMTPD32-7.15) id A00D10D50148; Tue, 09 Dec 2003 18:08:13 -0800 Message-ID: <[EMAIL PROTECTED]> From: "Mike at MK Commodities" <[EMAIL PROTECTED]> To: "Alberts \(E-mail\)" <[EMAIL PROTECTED]>, "Clark & Mary Jean Limb \(E-mail\)" <[EMAIL PROTECTED]>, "Coery & Julie Giles \(E-mail\)" <[EMAIL PROTECTED]>, "Dave & Theresa Reed \(E-mail\)" <[EMAIL PROTECTED]>, "Dave Reed \(E-mail\)" <[EMAIL PROTECTED]>, "David & Kim Dahlquist \(E-mail\)" <[EMAIL PROTECTED]>, "Jody & Wendy Draney \(E-mail\)" <[EMAIL PROTECTED]>, "Joey Joy \(E-mail\)" <[EMAIL PROTECTED]>, "John & Miriam Rasmussen \(E-mail\)" <[EMAIL PROTECTED]>, "John Rasmussen \(E-mail\)" <[EMAIL PROTECTED]>, "Kathy Krueger \(E-mail\)" <[EMAIL PROTECTED]>, "Marshalls \(E-mail\)" <[EMAIL PROTECTED]>, <Mike krueger (E-mail)>, "Niel Marshall \(E-mail\)" <[EMAIL PROTECTED]>, <:[EMAIL PROTECTED]> Subject: AAU BBall Date: Tue, 9 Dec 2003 18:08:24 -0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_002A_01C3BE7F.703AC690" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 206.29.173.128 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 14 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [206.29.173.128] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. This is a multi-part message in MIME format. ****************************************************** Thanks, Ben ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 10, 2003 10:11 AM Subject: Re: [IMail Forum] vanishing message > > >You had the right idea, but I need more explanation. We use Declude, of > >course, for both AV and Spam. I found the relevant log info in the spam > >log, but I don't quite understand how this worked out. I've included the > >log info below. > > >12/09/2003 18:08:18 Q800d10d501486618 Msg failed PERCENT (). Action=HOLD. > > This means that the E-mail failed the PERCENT test, and it was quarantined > (the HOLD action). > > >This was outgoing mail from one of our clients (virtual IMail domain); how > >did it get filtered? And why was it filtered? > > It got blocked because it failed the PERCENT test, which is used to get > around a situation where mail can be relayed through a backup mailserver. > > >This was just a meeting announcement for a dozen or so people, so what > >happened? > > Most likely, the problem is that an invalid address was used, such as > "[EMAIL PROTECTED]". It's technically legal, but very > outdated, and causes huge problems (IE spammers can relay). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
