David, Thanks for the explanation! However, I have yet to see a message with SMTP headers in the body if I remove Declude and send mail directly into Exchange. Maybe Exchange will just not deliver?
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of David Barker > Sent: Tuesday, October 25, 2005 3:27 PM > To: [email protected] > Subject: RE: [Declude.JunkMail] Headers showing up in the > body on 3.05.10 > > In every instance that we have observed so far the headers in > the body are caused by broken mail clients. This is not only > an issue for Declude but for mail servers as well. To > illustrates the difficulty coming up with a single algorithm > that will detect all instances of these broken emails to > prevent headers from appearing at the end of a message or > within the body of a message. > > RFC dictates all lines must end with a CR/LF sequence, with a > double sequence CR/LF/CR/LF separating the headers from the > body. Technically, that would be a 0D 0A 0D 0A sequence. > > In the byte sequence below, the sixth line contains: > > 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 > > where a single 0A is followed by a space and then the > required 0D 0A sequence. When this problem was first > reported, changes were made in the source to detect a simple > 0A as a line terminator, followed by another line terminator > sequence. > > However, this example would not get detected because they > inserted a space, which is invisible, between the two line > termination sequences. They could have inserted a tab (09) > also, so checking only for a space would not have caught all > possibilities. > > In addition, checking only for spaces at the beginning of a > line would not solve the problem because certain header lines > can be continued on the next line, which requires spaces and > then non-blank characters prior to the next line termination sequence. > > 30 38 3A 35 37 3A 31 33-20 2D 30 35 30 30 0D 0A 4D 49 4D 45 > 2D 56 65 72-73 69 6F 6E 3A 20 31 2E 30 0D 0A 43 6F 6E 74 > 65-6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 70 6C-61 69 6E > 3B 0D 0A 09 63 > 68 61 72 73 65 74 3D 22-75 73 2D 61 73 63 69 69 > 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 > 61 76 69 6E 67 20 61 6E-20 61 66 66 61 69 72 20 > 77 69 74 68 20 61 20 79-6F 75 6E 67 65 72 2C 20 > > Often from the outset these issues look extremely simple. > However, because all eventualities that have to be covered it > becomes quite complex. I am providing this example because > things are rarely as simple as they may at first appear. > > With all that said we are looking into providing a solution > for this problem. > > David B > www.declude.com > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Matt > Sent: Monday, October 24, 2005 9:07 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] Headers showing up in the > body on 3.05.10 > > This looks like Declude was expecting to see an occurrence of > Blank Folding, but it is making the mistake of detecting > headers in the MIME segments or the body as a continuation of > the real headers, either that or they changed the code that > detects where to throw in the Declude generated headers in > order to handle Blank Folding. IMO, Declude should just > throw the headers just before the location of the first > <CRLF><CRLF> or possibly following a mistaken <LF><LF>. > > I haven't seen any Declude headers in the body using 2.0.6.16 > and earlier. > > Matt > > > > Robert Grosshandler wrote: > > >This has been a problem for awhile (happened with the move > to the new > >architecture, but Declude says it's not connected.) > > > >The headers are "bad" when they make it to Declude, and > Declude doesn't > >handle them right. > > > >Fortunately, in our setup, they all still get treated as > very heavily > >weighted spam, so they never make it to users. > > > >Rob > > > >-----Original Message----- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith > >Sent: Monday, October 24, 2005 6:17 PM > >To: [email protected] > >Subject: [Declude.JunkMail] Headers showing up in the body on 3.05.10 > > > >Ever since I went to 3.05.10 (now on 3.05.11) I've been receiving > >hundreds of complaints of spam making it to my users. > >After inspection, Declude is subject line marking the > messages but it's > >moving the SMTP headers to the body of the email. This results in > >user's Outlook rules not firing on the subject line keywords. > > > >Here's an example of the ACTUAL MESSAGE BODY. > > > >Anyone else seeing this? > > > >-0- > > > > > >-----Original Message----- > >From: Jon Addison [mailto:[EMAIL PROTECTED] > >Sent: Monday, October 24, 2005 6:06 AM > >To: Smith, Mark E. > >Subject: Re: Hello. > > > >You've seen it on "60 Minutes" and read the BBC News report > -- now find > >out just what everyone is talking about. > >Message-Id: <[EMAIL PROTECTED]> > >Subject: [WARNING-SPAM]:[333]: > >X-RBL-Warning: CATCHALLMAILS: > >X-RBL-Warning: FIVETEN-SPAM: > 225.72.226.221.blackholes.five-ten-sg.com. > >X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" > >X-RBL-Warning: SORBS-DUL: "Dynamic IP Addresses See: > >http://www.sorbs.net/lookup.shtml?221.226.72.225"; > >X-RBL-Warning: IPNOTINMX: > >X-RBL-Warning: NOLEGITCONTENT: No content unique to > legitimate E-mail > >detected. > >X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA > >221.226.72.225 with no reverse DNS entry. > >X-RBL-Warning: MS-SNAKEOIL: Message failed MS-SNAKEOIL: 52. > >X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 3. > >X-RBL-Warning: SPAMDOMAINS: Spamdomain '@yahoo.' found: Address of > >[EMAIL PROTECTED] sent from invalid [No Reverse DNS]. > >X-RBL-Warning: FALSE-YAHOO: Message failed FALSE-YAHOO test (line 2, > >weight > >30) > >X-RBL-Warning: WEIGHT120349CP: Total weight between 120 and 349. > >X-Declude-Sender: [EMAIL PROTECTED] [221.226.72.225] > >X-Declude-Spoolname: Ddba001ae000099e2.smd > >X-Note: > >X-Note: > >================================================================== > >X-Note: Spam Score: 333 [SUBJECT STRING ON 120-349 & DELETED ON 350+] > >X-Note: Scan Time: 09:03:36 on 24 Oct 2005 > >X-Note: Spool File: Ddba001ae000099e2.smd > >X-Note: Server Name: netrends.com > >X-Note: SMTP Sender: [EMAIL PROTECTED] > >X-Note: Reverse DNS & IP: [No Reverse DNS] [221.226.72.225] > >X-Note: Organization: popmail.netrends.com > >X-Note: Recipient(s): [EMAIL PROTECTED] > >X-Note: Country Chain: CHINA->destination > >X-Note: Tests Failed: CATCHALLMAILS [0], FIVETEN-SPAM [30], NOABUSE > >[10], SORBS-DUL [50], IPNOTINMX [0], NOLEGITCONTENT [0], > REVDNS [40], > >MS-SNAKEOIL [150], SPAMCHK [3], SPAMDOMAINS [20], FALSE-YAHOO [30], > >WEIGHT120349 [120], WEIGHT120349CP [120] > >X-Note: In or Out: outgoing > >X-Note: > >================================================================== > >X-Note: This E-mail was scanned & filtered > >X-Note: filter [3.0.5.10] for SPAM & virus. > >X-Note: > >================================================================== > >X-Note: > > > ># Suppress your appetite and feel full and satisfied all day long # > >Increase your energy levels # Lose excess weight # Increase your > >metabolism # Burn body fat # Burn calories # Attack obesity > And more.. > > > >http://coolhoodia.com/ > > > ># Suitable for vegetarians and vegans > ># MAINTAIN your weight loss > ># Make losing weight a sure guarantee > ># Look your best during the summer months > > > >http://coolhoodia.com/ > > > >Regards, > >Dr. Jon Addison > > > > > > > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > >"unsubscribe Declude.JunkMail". The archives can be found at > >http://www.mail-archive.com. > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > > > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > >"unsubscribe Declude.JunkMail". The archives can be found at > >http://www.mail-archive.com. > > > > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
