RBL - spamcop legit mta

[shanna leonard]

fed1mtao04.cox.net [68.6.19.241] is a legitimate MX host used by some of
our home users.

am I reading headers correctly that the mail has been tagged {Spam?}
because this MTA was found in spamcop?

I guess I read MailScanner.conf incorrectly. I would like to have
MailScanner take an action (i.e. tag as spam ) _only_ if the connecting
MTA was found in more than one RBL.  If it is found in just one RBL I
would like it to pass the message on to spamassassin.

is this possible?

besides fed1mtao04.cox.net all dns names have been changed to protect
the guilty :)

> From ardin at sender.dnsname.edu Thu Apr  1 06:24:40 2004
> Received: from peyote.test.our.dnsname.edu (test.our.dnsname.edu
> [1.2.3.2])
>         by agave.foo.dnsname.edu (8.12.8/8.12.8) with ESMTP id
> i31DOYKf007118
>         for <aat at sender.dnsname.edu>; Thu, 1 Apr 2004 06:24:34 -0700 (MST)
> Received: from fed1mtao04.cox.net (fed1mtao04.cox.net [68.6.19.241])
>         by peyote.test.our.dnsname.edu (8.12.2+Sun/8.12.2) with ESMTP
> id i31DOP9M029516
>         for <aat at sender.dnsname.edu>; Thu, 1 Apr 2004 06:24:25 -0700 (MST)
> Received: from cleo ([68.231.144.21]) by fed1mtao04.cox.net
>           (InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with SMTP
>           id <20040401132413.QEOY2428.fed1mtao04.cox.net at cleo>;
>           Thu, 1 Apr 2004 08:24:13 -0500
> From: "Cleo ardin" <ardin at sender.dnsname.edu>
> To: "Harvey " <Harvey at aemrc.dnsname.edu>,
>    "Dale " <Dale at aemrc.dnsname.edu>,
>    "Andy " <aat at sender.dnsname.edu>,
>    "John" <John at aemrc.dnsname.edu>,
>    "Steve" <sbrigham at another.zone.edu>, "Kevin "
> <kcraven at another.zone.edu>
> Cc: <dmorris at email.dnsname.edu>
> Subject: {Spam?}-3 RE: ED expansion and Children's Services
> Date: Thu, 1 Apr 2004 06:23:52 -0700
> Message-ID: <BCELKFLHGEMPKKDNELDOIEFPCCAA.ardin at sender.dnsname.edu>
> MIME-Version: 1.0
> Content-type: multipart/report; boundary="======28915==6472======"
> X-Priority: 3 (Normal)
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
> Importance: Normal
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> In-Reply-To:
> <3AE404565E615D4B96025D6154E984620556D2 at mail.EmergencyMed.dnsname.edu>
> X-AHSC-MailScanner-Information: Please contact email at our.dnsname.edu
> for more information
> X-AHSC-MailScanner: Found to be clean
> X-AHSC-MailScanner-SpamCheck: spam, spamcop.net
> X-MailScanner-From: ardin at sender.dnsname.edu
> Content-Length: 7849
> Status: RO
> X-Status:
> X-Keywords:


--
----
MHO
---
shanna leonard
arizona health sciences library
626-2923
----------------------------------