RE: [Declude.JunkMail] Why was this message delivered?
JunkMail Pro (demo), iMail 7.04. Almost all other mail is being delivered to the mailboxes, it just one or two that we've spotted so far that have been delivered with more then 15 weight. I don't think it was white listed, the headers / logs don't say anything about that. And I haven't manually white listed anything yet. The only thing that gets white listed is users' iMail address books, and this definitely wouldn't be the case here. ~Brad -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Tuesday, November 25, 2003 10:23 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Why was this message delivered? What version of JunkMail (Pro or Standard) and what version of Imail? MAILBOX is only available in JunkMail Pro. Could that message have been White Listed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of T. Bradley Dean Sent: Tuesday, November 25, 2003 6:50 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Why was this message delivered? A message was delivered with a weight of 38. The logs show this: 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the limit of 15.). Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). Action=IGNORE. $default$.junkmail shows this: WEIGHT10 WARN WEIGHT15 MAILBOX Spam #WEIGHT20 IGNORE WEIGHT40 DELETE Why was the WEIGHT20 IGNORE rule followed, even when it had the # comment marker before it? ~Brad --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why was this message delivered?
Brad, The WEIGHT20 Ignore rule was ignored. When something is ignored, it is still logged. I suspect that your WEIGHT15 test is configured as a weightrange and doesn't have a weightrange that reaches up to 39 and that's why this is getting delivered. Check your configuration for WEIGHT15 test in your Global.cfg, and post all of your weight based tests from that file in the event that you still haven't figured it out. Matt T. Bradley Dean wrote: JunkMail Pro (demo), iMail 7.04. Almost all other mail is being delivered to the mailboxes, it just one or two that we've spotted so far that have been delivered with more then 15 weight. I don't think it was white listed, the headers / logs don't say anything about that. And I haven't manually white listed anything yet. The only thing that gets white listed is users' iMail address books, and this definitely wouldn't be the case here. ~Brad -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Tuesday, November 25, 2003 10:23 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Why was this message delivered? What version of JunkMail (Pro or Standard) and what version of Imail? MAILBOX is only available in JunkMail Pro. Could that message have been White Listed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of T. Bradley Dean Sent: Tuesday, November 25, 2003 6:50 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Why was this message delivered? A message was delivered with a weight of 38. The logs show this: 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the limit of 15.). Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). Action=IGNORE. $default$.junkmail shows this: WEIGHT10WARN WEIGHT15MAILBOX Spam #WEIGHT20 IGNORE WEIGHT40DELETE Why was the WEIGHT20 IGNORE rule followed, even when it had the # comment marker before it? ~Brad --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why was this message delivered?
A message was delivered with a weight of 38. The logs show this: 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the limit of 15.). Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). Action=IGNORE. This E-mail should have been moved to the recipient's Spam mailbox. Is the E-mail to that account forwarded to another account (in which case the MAILBOX action would not apply)? Is it always happening for the same user(s), or just randomly? Why was the WEIGHT20 IGNORE rule followed, even when it had the # comment marker before it? That's because the default action, if no action is defined, is IGNORE. So if you had had #WEIGHT20 HOLD, you would still have seen Action=IGNORE. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Why was this message delivered?
Is the E-mail to that account forwarded to another account (in which case the MAILBOX action would not apply)? I didn't even think of that, yes it is. Why does the MAILBOX action not apply? Is it always happening for the same user(s), or just randomly? So far it's just me and one other user seeing it - but most users wouldn't know how to look for it. The other user has two accounts, User.Office and User.Home. The User.Office account is the main account and forwards like this: ., [EMAIL PROTECTED]. A spam came in with a score of 32 address to User.Office. It was sent to the Spam mailbox of User.Office but delivered to the inbox of User.Home. What is Declude doing is this case? That's because the default action, if no action is defined, is IGNORE. Ah, that makes a lot of sense. Thanks! ~Brad -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, November 26, 2003 4:40 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Why was this message delivered? A message was delivered with a weight of 38. The logs show this: 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the limit of 15.). Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). Action=IGNORE. This E-mail should have been moved to the recipient's Spam mailbox. Is the E-mail to that account forwarded to another account (in which case the MAILBOX action would not apply)? Is it always happening for the same user(s), or just randomly? Why was the WEIGHT20 IGNORE rule followed, even when it had the # comment marker before it? That's because the default action, if no action is defined, is IGNORE. So if you had had #WEIGHT20 HOLD, you would still have seen Action=IGNORE. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Why was this message delivered?
Is the E-mail to that account forwarded to another account (in which case the MAILBOX action would not apply)? I didn't even think of that, yes it is. Why does the MAILBOX action not apply? Because Declude JunkMail doesn't know that the E-mail is going to be forwarded. Declude tells IMail to send the E-mail to [EMAIL PROTECTED] -- but then IMail forwards it to [EMAIL PROTECTED]. Declude isn't involved in that process. If the E-mail address that it is being forwarded to is on a non-IMail server, the MAILBOX action wouldn't even be possible (unless the mailserver happens to use the same technique as IMail for using mailboxes). If you change the account to an alias, it would work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Why was this message delivered?
What version of JunkMail (Pro or Standard) and what version of Imail? MAILBOX is only available in JunkMail Pro. Could that message have been White Listed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of T. Bradley Dean Sent: Tuesday, November 25, 2003 6:50 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Why was this message delivered? A message was delivered with a weight of 38. The logs show this: 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). Action=WARN. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or exceeds the limit of 15.). Action=MAILBOX. 11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). Action=IGNORE. $default$.junkmail shows this: WEIGHT10 WARN WEIGHT15 MAILBOX Spam #WEIGHT20 IGNORE WEIGHT40 DELETE Why was the WEIGHT20 IGNORE rule followed, even when it had the # comment marker before it? ~Brad --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
