found to be clean when not scanned

[Julian Field]

At 15:20 06/05/2002, you wrote:
>To test MailScanner off-line I duplicate all mail me to an address in
>the domain test.utwente.nl.
>
>The relevant parts (I think) of mailscanner.conf are
>Mail Header = X-MailScanner:
>Virus Scanning     = yes
>Virus Scanner      = f-prot
>Sweep = /opt/f-prot/f-protwrapper
>Scan All Messages = yes
>Scanning By Domain = yes
>Domains To Scan = /opt/mailscanner/etc/domains.to.scan.conf
>Sign Unscanned Messages = no
>
>In /opt/mailscanner/etc/domains.to.scan.conf I don't include
>test.utwente.nl. So when I send a message to address at test.utwente.nl I
>don't expect an X-MailScanner: header to appear. But it does with the
>text "Found to be clean". For the recipient it looks as if the mail is
>scanned and no virus was detected.

But is the domain you are sending *from* in domains.to.scan.conf?


>In the maillog I see
>May  6 15:31:47 netlx803 mailscanner[20465]: Forwarding 1 clean
>messages, 27328 bytes
>
>When I include test.utwente.nl I get
>May  6 16:11:51 netlx803 mailscanner[20666]: Scanning 1 messages, 4174
>bytes
>May  6 16:11:51 netlx803 mailscanner[20666]: Scanned 1 messages, 4174
>bytes in 0 seconds
>
>And ofcourse with an X-MailScanner: header.
>
>--
>Peter Peters
>senior netwerkbeheerder,  Centrum voor Informatievoorziening,
>Universiteit Twente,   Postbus 217,  7500 AE  Enschede
>telefoon: +31 53 489 2301, fax:+31 53 489 2383, http://www.utwente.nl/civ

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ