Bonno,
Due to your HOP setting you are checking multiple hops. Since you use a
multihop setting you should score the hops differently or run into
problems like you identified. I would suggest reducing it to 1. This
will score the last two hops.
Than you can modify your tests like the following. The first one only
checks the last ip recevied. The second one checks all of them. One
thing to keep in mind if the LAST test hits so will the ALL test. So
for example if you want the last hop (who connected to you) to have a
weight of 3 for the SORBS-SPAM test than you will want to make sure that
the sum of the two tests equal that weight.
SORBS-SPAM(LAST) dnsbl %IP4R%.dnsbl.sorbs.net 127.0.0.6
2 0
SORBS-SPAM(ALL) ip4r dnsbl.sorbs.net 127.0.0.6
1 0
So in the case above if the second hop was listed we would only assign a
score of "1" from the SORBS-SPAM(ALL) test. If the last hop was listed
than we would have a score of "3" since both the (LAST) and (ALL) test
would hit.
Let me know if this is not clear,
Darrell
----------------------------------
Check out http://www.invariantsystems.com for utilities for Declude,
Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring,
SURBL/URI integration, MRTG Integration, and Log Parsers.
Bonno Bloksma wrote:
Hi,
Maybe using the ZEN test isn't such a good idea. It is caching a DSL
line that is several hops down.
In Global.cfg I have Hophigh 2, should I maybe reduca that to 1? Is that
the cause? If so....
As far as I know my server is Hop 0, the smtp-4 should then be Hop 1,
the me-wanadoo.net should then be Hop 2.
So the hulsbeek.nl (adsl-dc-34529.... line) should be Hop 3 and not be
checked.
Why was that ip number checked?
----------<quote>--------------------
Received: from smtp-4.orange.nl [193.252.22.249] by student.tio.nl with
ESMTP (SMTPD-9.21) id A33707C8;
Mon, 30 Jul 2007 09:28:55 +0200
Received: from me-wanadoo.net (localhost [127.0.0.1])by
mwinf6301.orange.nl (SMTP Server) with ESMTP id E84957000084for
<[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>;
Mon, 30 Jul 2007 09:28:54 +0200 (CEST)
Received: from hulsbeek.nl (adsl-dc-34529.adsl.wanadoo.nl
[83.116.227.41])by mwinf6301.orange.nl (SMTP Server) with ESMTP id
AF5A97000082for <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>;
Mon, 30 Jul 2007 09:28:54 +0200 (CEST)
X-ME-UUID: [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>
Subject: [SPAM: 22]RE: 5 augustus
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7D27B.467F4FA9"
Date: Mon, 30 Jul 2007 09:28:50 +0200
Content-class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Message-ID:
<[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: 5 augustus
thread-index: AcfSClRkqB1y6CB4TkymtwIq3Exp3QAZtfQA
From: "Erve Hulsbeek" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
Sender: "Piet Heuvelmans" <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>>
To: "Nienke Koster" <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>>
X-RBL-Warning: FIVETEN-SRC: 41.227.116.83.blackholes.five-ten-sg.com.
X-RBL-Warning: MXRATE-BLOCK:
"http://www.mxrate.com/lookup/refused.asp?ipaddress=193.252.22.249";
X-RBL-Warning: ZEN: "http://www.spamhaus.org/query/bl?ip=83.116.227.41";
X-RBL-Warning: SPAMCANNIBAL: "blocked, See:
http://www.spamcannibal.org/cannibal.cgi?page=lookup&lookup=193.252.22.249
<http://www.spamcannibal.org/cannibal.cgi?page=lookup&lookup=193.252.22.249>"
X-RBL-Warning: FROMNOMATCH: Env sender ([EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>) From: ([EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>) mismatch.
X-Declude-Sender: [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> [193.252.22.249]
X-Declude-Spoolname: D933701b30000b7de.smd
X-Declude-RefID: str=0001.0A0B0204.46AD933D.0104,ss=1,fgs=0
X-Declude-Note: Scanned by Declude 4.3.46 for spam.
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [22] at 09:29:18 on 30 Jul 2007
X-Declude-Fail: FIVETEN-SRC [3], MXRATE-BLOCK [7], ZEN [7], SPAMCANNIBAL
[2], FROMNOMATCH [3], SPAMSUBJECT [12], SPAMHOLD [20], ZEROHOUR [0]
X-Country-Chain: NETHERLANDS->FRANCE->destination
X-fpReview-Weight: 22
----------<quote>--------------------
Met vriendelijke groet,
Bonno Bloksma
hoofd systeembeheer
tio hogeschool hotelmanagement en toerisme
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> / www.tio.nl
<http://www.tio.nl>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
--
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
