I'm not anxious to use whitelisting -- it always stuck me as a double-edged sword. Right now, I think that we've narrowed it down to a mis-typed address that ended up looking like spam. There's no way to guard against that.
Ben ----- Original Message ----- From: "Marc Catuogno" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 10, 2003 11:30 AM Subject: RE: [IMail Forum] vanishing message > I didn't catch what version of Imail you are running, but I *think* that the > Whitelist Auth in 8+ might be able to help you in this case. > > Marc > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of IMail Admin > Sent: Wednesday, December 10, 2003 01:48 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] vanishing message > > > Thanks Scott, my wisdom grows by the second, along with more grey hairs. A > couple more questions: I expected Declude to filter incoming spam, but not > outgoing email. We have a small client list and I'm not worried about any > of them spamming. I do understand about relaying, but I thought we had that > covered with the IMail no-relay option. So do we really need to filter > email going out from our clients? If not, how do we stop it? > > Also, I don't see the percent sign in the to-addresses. Here's how it shows > up in the IMail log: > > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] MAIL FROM: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <Mike krueger > (E-mail)> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: > <[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] RCPT TO: <:[EMAIL PROTECTED]> > 12:09 18:08 SMTPD(10D50148) [206.29.173.128] > D:\IMAIL\spool\D800d10d501486618.SMD 2851 > > The address to Mike krueger doesn't look like it will work, but I still > don't see the percent. I found the message being held and pulled the > header, but that doesn't help much either. If you're wondering how come the > rcpt to lines look funny (like Mike krueger), it's because these people were > using Exchange/Outlook before switching to IMail/Outlook Express. Here is > the mail header: > > Received: from MIKE2 [206.29.173.128] by ipswheat.com with ESMTP > (SMTPD32-7.15) id A00D10D50148; Tue, 09 Dec 2003 18:08:13 -0800 > Message-ID: <[EMAIL PROTECTED]> > From: "Mike at MK Commodities" <[EMAIL PROTECTED]> > To: "Alberts \(E-mail\)" <[EMAIL PROTECTED]>, > "Clark & Mary Jean Limb \(E-mail\)" <[EMAIL PROTECTED]>, > "Coery & Julie Giles \(E-mail\)" <[EMAIL PROTECTED]>, > "Dave & Theresa Reed \(E-mail\)" <[EMAIL PROTECTED]>, > "Dave Reed \(E-mail\)" <[EMAIL PROTECTED]>, > "David & Kim Dahlquist \(E-mail\)" <[EMAIL PROTECTED]>, > "Jody & Wendy Draney \(E-mail\)" <[EMAIL PROTECTED]>, > "Joey Joy \(E-mail\)" <[EMAIL PROTECTED]>, > "John & Miriam Rasmussen \(E-mail\)" <[EMAIL PROTECTED]>, > "John Rasmussen \(E-mail\)" <[EMAIL PROTECTED]>, > "Kathy Krueger \(E-mail\)" <[EMAIL PROTECTED]>, > "Marshalls \(E-mail\)" <[EMAIL PROTECTED]>, > <Mike krueger (E-mail)>, > "Niel Marshall \(E-mail\)" <[EMAIL PROTECTED]>, > <:[EMAIL PROTECTED]> > Subject: AAU BBall > Date: Tue, 9 Dec 2003 18:08:24 -0800 > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="----=_NextPart_000_002A_01C3BE7F.703AC690" > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1158 > X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 > X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 206.29.173.128 > with no reverse DNS entry. > X-RBL-Warning: WEIGHT10: Weight of 14 reaches or exceeds the limit of 10. > X-Declude-Sender: [EMAIL PROTECTED] [206.29.173.128] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for > spam. > > This is a multi-part message in MIME format. > > ****************************************************** > Thanks, > > Ben > > ----- Original Message ----- > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 10, 2003 10:11 AM > Subject: Re: [IMail Forum] vanishing message > > > > > > >You had the right idea, but I need more explanation. We use Declude, of > > >course, for both AV and Spam. I found the relevant log info in the spam > > >log, but I don't quite understand how this worked out. I've included the > > >log info below. > > > > >12/09/2003 18:08:18 Q800d10d501486618 Msg failed PERCENT (). Action=HOLD. > > > > This means that the E-mail failed the PERCENT test, and it was quarantined > > (the HOLD action). > > > > >This was outgoing mail from one of our clients (virtual IMail domain); > how > > >did it get filtered? And why was it filtered? > > > > It got blocked because it failed the PERCENT test, which is used to get > > around a situation where mail can be relayed through a backup mailserver. > > > > >This was just a meeting announcement for a dozen or so people, so what > > >happened? > > > > Most likely, the problem is that an invalid address was used, such as > > "[EMAIL PROTECTED]". It's technically legal, but very > > outdated, and causes huge problems (IE spammers can relay). > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > > Declude Virus: Catches known viruses and is the leader in mailserver > > vulnerability detection. > > Find out what you've been missing: Ask about our free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail scanned for viruses by Declude Virus] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
