> After I posted, I went to put them on my local blacklist and saw that > I had done this previously. I wonder why it was not caught. A > Cron job does sa-update twice a day, so it is unlikely not to have > been read. > Don't forget that spamd is stopped and restarted during the daily update. Could the message's arrival coincide with this?
Is your local blacklist also taken down while it is being updated and/or backed up? Mine isn't because I implement it with what I call a 'portmanteau rule', a single rule with several hundred alternative patterns. In this case the rule is looking for URI matches in message bodies because it was written to clean the message stream from a spam-laden mailing list: blacklists etc simply don't work in this situation because the headers relate to messages sent from the listserv. Martin
