Scott, Okay so I checked the logs again and found two emails with the same subject for this person. The other email with the weight of 17 should have been deleted because I have a blacklisted the .pn01.com domain... Why didn't it catch it?
Here are the logs for both emails... 10/06/2003 00:27:34 Qef1a1d8 MAILPOLICE-BULK:40 SPAMCHK:17 . Total weight = 57 10/06/2003 00:27:34 Qef1a1d8 Msg failed MAILPOLICE-BULK (This E-mail came from 22.pn01.com, a potential spam source listed in MAILPOLICE-BULK.). Action=WARN. 10/06/2003 00:27:34 Qef1a1d8 Msg failed SPAMCHK (Message failed SPAMCHK: 17.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT10 (Weight of 57 reaches or exceeds the limit of 10.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT14 (Weight of 57 reaches or exceeds the limit of 14.). Action=ATTACH. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT16 (Weight of 57 reaches or exceeds the limit of 16.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT20 (Weight of 57 reaches or exceeds the limit of 20.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT26 (Weight of 57 reaches or exceeds the limit of 26.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT30 (Weight of 57 reaches or exceeds the limit of 30.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT40 (Weight of 57 reaches or exceeds the limit of 40.). Action=DELETE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT50 (Weight of 57 reaches or exceeds the limit of 50.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] 10/06/2003 00:27:34 Qef1a1d8 Subject: RE: Christian Single? 10/06/2003 00:27:34 Qef1a1d8 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 69.6.28.29 ID: PAA18749 10/06/2003 13:00:11 Q9f791da SPAMCHK:17 . Total weight = 17 10/06/2003 13:00:11 Q9f791da Msg failed SPAMCHK (Message failed SPAMCHK: 17.). Action=IGNORE. 10/06/2003 13:00:11 Q9f791da Msg failed WEIGHT10 (Weight of 17 reaches or exceeds the limit of 10.). Action=IGNORE. 10/06/2003 13:00:11 Q9f791da Msg failed WEIGHT14 (Weight of 17 reaches or exceeds the limit of 14.). Action=ATTACH. 10/06/2003 13:00:11 Q9f791da Msg failed WEIGHT16 (Weight of 17 reaches or exceeds the limit of 16.). Action=IGNORE. 10/06/2003 13:00:11 Q9f791da L1 Message OK 10/06/2003 13:00:11 Q9f791da Subject: RE: Christian Single? 10/06/2003 13:00:11 Q9f791da From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 69.6.28.28 ID: CAA09196 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, October 07, 2003 9:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Strange Email getting past checks >I have this email a user forwarded to me that he received yesterday. By all >indications in the logs the message should have been deleted because of all >the tests it failed. I delete emails with a weight of 40 or more. Are you *positive* that the user received the same E-mail that the log file entries refer to? >10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT40 (Weight of 141 reaches or >exceeds the limit of 40.). Action=DELETE. This one shows that the DELETE action was going to be used on this E-mail, unless a WHITELIST entry was there to override it. >10/05/2003 12:12:24 Q42df204 Deleting spam from >[EMAIL PROTECTED] to >[EMAIL PROTECTED] And this one shows that Declude JunkMail deleted it. I'm guessing these log file entries were for a different E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---------------------------------------------------------------------------- -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] ------------------------------------------------------------------------------ [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
