[Declude.JunkMail] Perplexed -- false positives on HELOBOGUS AND CATCHALLMAILS

[Katie La Salle-Lowery]

Title: Message

As of today I've got something odd going on with our Declude Junkmail.  Any assistance would be great appreciated!

 

A great many emails are failing HELOBOGUS and CATCHALLMAILS (which is commented out in my default junkmail file).

 

Here is one example header:

 

Received: from eciexchange.ECI [63.160.64.141] by mail.centric.net with ESMTP
  (SMTPD32-8.05) id A3421E7500AE; Tue, 10 Feb 2004 10:22:10 -0700
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
 charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: test message at 10:20
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Date: Tue, 10 Feb 2004 10:24:41 -0700
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: test message at 10:20
Thread-Index: AcPv+sQ9Ad5U9lRhT8C4qVudgOLZJw==
From: "Ken DeCosta" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
X-RBL-Warning: HELOBOGUS: Domain eciexchange.ECI has no MX or A records.
X-Note: This E-mail was scanned by Centric Internet Services for spam.
X-Spam-Tests-Failed: HELOBOGUS, CATCHALLMAILS
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 349899319

 

Here's my default config (I just changed action on HELOBOGUS  from delete to warn a few minutes ago):

 

DSBL  DELETE
ORDB  DELETE
SPAMCOP  DELETE
DSN  DELETE
NOABUSE  WARN
NOPOSTMASTER WARN
BADHEADERS SUBJECT
HELOBOGUS WARN
MAILFROM        WARN
PERCENT  DELETE
REVDNS  WARN
SPAMHEADERS SUBJECT
AHBL  DELETE
DSBLMULTI DELETE
NJABL  DELETE
RSL  DELETE
SBL  DELETE
SORB-SMTP DELETE

 

#SNIFFER BOUNCE

 

WEIGHT10 DELETE
#WEIGHT15 DELETE
#WEIGHT20 DELETE

 

#
# The following tests are commented out by default because they are not commonly
# used (or require a subscription).
#

 

#BADWHOIS WARN
#BLARS  WARN
#CATCHALLMAILS WARN
#COMPU  WARN
#DEVNULL WARN
#DORKS  WARN
#DORKZTL WARN
#DSBLALL WARN
#DUL            WARN
#FIVETENDUL WARN
#FIVETENOPTIN WARN
#FIVETENOTHER WARN
#FIVETENSRC WARN
#FLOWGO  WARN
#GUARDBLOCK WARN
#GUARDBULK WARN
#GUARDDUL WARN
#GUARDMULTI WARN
#GUARDSINGLE WARN
#GUARDSRC WARN
#HEUR  WARN
#INTERSIL WARN
#IPWHOIS WARN
#NJABL  WARN
#NJABLDUL WARN
#POSTFIXGATE WARN
RBL  WARN
#RSS  WARN
#SELWERD WARN
SPAMBAG  WARN
#SPAMTR  WARN
#SUMMIT  WARN
#V6NET  WARN
#VISI  WARN
#WIREHUB-DNSBL WARN
#WIREHUB-DYNA WARN
#ZTA  WARN

 

#RBL  WARN
#DUL  WARN
#RBL+DUL WARN
#RSS  WARN
#RBL+RSS WARN
#DUL+RSS WARN
#MAPSALL WARN