some SURBL hits that I don't understand

[Matt Kettler]

<x-flowed>
At 04:06 AM 10/7/2004, Niklas Olofsson wrote:
>Every days since we upgraded to SA 3 we get some email's that contain's
>no URL:s but still get scores from 3 different SURBL list's. I have some
>problems troubleshooting this because if I send these messeages thru the
>system again I get no SURBL hits, very strange....
>
>Any tip how on I can troubleshoot this would be appreciated.

Are you positive the message is in it's true original form with all
original mime sections? or are you using a forwarded copy that your
mailclient has had a chance to manhandle?

Many mailclients strip out mime sections they don't understand. Groupwise
(your MUA) and Eudora (mine) both tend to do this.

I suspect that you're not getting the full, original message with all it's
original mime sections when you run it through SA the second time, because
it's been "normalized" (aka stripped down) by Groupwise.

You *might* be able to get a complete message using groupwise's partially
hidden "mime.822" attachment. Right click the message, pick "view" instead
of "open". mime.822 should be in the list of attachments near the top. I'm
not sure if mime.822 has been mime-section-stripped or not, I don't use GW
that much, but I know it at least has full headers.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>