Hi Mark,
The only thing I can figure is that for some reason NoXMail cannot send the
message via SMTP. Whenever it "sends" something, whether a hold message,
re-routing a message, etc., it uses SMTP and does not use the IMail queue.
What could happen it that for some reason, IMail did not accept the message.
The fact that you had one where 7 of them were re-routed and 1 got through,
and the fact that the headers were modified, leads me to believe that this may
be the case. In the event of any failure, such as an SMTP failure, the message
is not deleted, it is simply left in the spool folder. That could be why the
message was apparently processed but delivered anyway.
When sending anything via SMTP it only tries once. So if for some reason the
server does not respond, the sending process is aborted. This is to avoid
endless loops in the event of a misconfiguration or if the SMTP service is
stopped and processor time being gobbled up.
The next version I will post has some additional error reporting. Technically,
it is called "exception trapping" and I have added numerous error messages to
the exception traps where there were no messages before. Ideally you should
never see an error message, so my style is to typically leave many of the
error messages out until one of the last steps.
About the only thing I can suggest is that you inspect your IMail log at about
the same time and see if there are any unusual entries. Unless there is
something there that indicates a specific error condition, I am willing to bet
that the SMTP service simply did not respond.
-Brian
On 01/28/03 3:09pm you wrote...
>Brian,
>
>Since last Thurs or so, noxmail seems to be allowing some adult & spam
>e-mails to go through. I received a couple of calls from users on Friday
>that they had received some porn e-mails. I double-checked all settings on
>Sat and finally stopped/restarted the IMail SMTP service. This seemed to
>fix the problem for the moment. However, yesterday I saw some more
>adult/spam messages slip through and I rebooted our e-mail server, again
>after checking everything first. That seemed to cause the filtering to
>work properly again. This morning, I thought I saw some more e-mails slip
>through but I sent myself a couple (one "adult" and one "spam") from an
>off-campus address and they were filtered correctly. I currently have all
>adult & spam e-mail sent to a spam account. This account is getting
>messages but some are apparently still slipping through. I just received a
>spam e-mail from e-bay. Below are the spam e-mail header and log snippet
>from noxmail. I can send you the .nox config file or other files if
>needed. I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 to
>the e-bay message should have been routed. The spam mailbox did catch this
>same e-mail to 7 other recipients (however, the total weight was 40 instead
>of 45).
>
>Any suggestions?
>
>Thanks.
>
>Mark
>
>
>NOXMAIL log snippet:
>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores -
>Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM:
><[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a
>fortune, mseagroves!
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 penalty
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent
>with SPAM: 1 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables:
>5 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image
>links: 14 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD -
>Matched: (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms -
>Msg Size: 19300 bytes
>
>
>
>
>Mail Header:
>
>To: [EMAIL PROTECTED]
>Subject: [S] Don't spend a fortune, mseagroves!
>From: "eBay" <[EMAIL PROTECTED]>
>Date: Tue, 28 Jan 2003 11:29:04 -0800
>Reply-To: "eBay" <[EMAIL PROTECTED]>
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 18)
>Tot: 45 (Req: 20)
>X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
>X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
>X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
>[4000020e].
>X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
>X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
>X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-Declude-Spoolname: Dda50019700ce4425.SMD
>X-Note: This E-mail was scanned for spam.
>X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT10, WEIGHT20,
>CYBERSITTER
>X-Note: This E-mail was sent from (Private IP) ([10.1.1.10]).
>X-RCPT-TO: <[EMAIL PROTECTED]>
>
>
>
>Mark Seagroves voice: (865) 471-3506
>Dir, Campus Computing fax: (865) 471-3555
>Asst Prof, Computer Science e-mail: [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
---
[This E-mail scanned for viruses by Solid Oak Software]
Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]
