Bob Keyes <[EMAIL PROTECTED]> writes:

> Just before I sent this I noticed that the reverse DNS seems to be fake
> and my domain. Hrm. Maybe qmail isn't doing a good job here?

qmail doesn't verify that any domain (reverse lookup or HELO string)
matches any IP address.

> From log:
> 
> Date: Sun Jul 13 06:38:46 EDT 2003
> Sndr: [EMAIL PROTECTED]
> From: jenna knowly
>   To: [EMAIL PROTECTED]
> Subj: Increase lean muscle mass
> Actn: OK (from-dbm /home/bob/.tmda/lists/whitelist.db accept) (1021)

You have either '[EMAIL PROTECTED]' or '[EMAIL PROTECTED]' or
'[EMAIL PROTECTED]' in your whitelist.db.  As Kyle Hasselbacher pointed
out, don't whitelist your address or domain.  Spammers use this trick
alot.

In reference to Kyle Hasselbacher's question, you can determine the
cause of this problem because the Actn: line tells you where TMDA
found a match and various other fields in the log entry tell you what
addresses TMDA looked at to find a match.  The addresses TMDA uses are
documented in FAQ 4.6.  It appears to be slightly out-of-date: the
X-Primary-Address: field is also examined, if it exists and is
different from the envelope sender.

http://tmda.net/faq.cgi?req=show&file=faq04.006.htp

TMDA lists the following addresses in the log:

X-Pri:  - X-Primary-Address:, if it exists
Sndr:   - envelope sender, if it exists and is different from From:
From:   - From:, if it exists
Rept:   - Reply-To:, if it exists

So one of those addresses is what matched.  Since, in the log above,
the only choices are 'jenna knowly' and '[EMAIL PROTECTED]', it must
have been one of those.


Tim
_____________________________________________
tmda-users mailing list ([EMAIL PROTECTED])
http://tmda.net/lists/listinfo/tmda-users

Reply via email to