Message rules don't work, but if message forwarded, it does???

[Scott Silva]

on 11-5-2008 12:38 PM Chris Barber spake the following:
> 2008/11/5 Chris Barber <cbarber at techquility.net>:
>> Hi All,
>>
>> Having a strange issue, maybe someone has seen this before. I have
> some
>> spam emails that are getting through the server. If a user then
> forwards
>> that spam message to me, going through the server again, it does get
>> caught.
>>
>> A specific example is this:
>> Message comes through and hit no rules at all.
>> Message is forwarded and hits two URIBL rules for a URL in the
> message.
>> Strange thing is that the URL was in the message originally so it
> should
>> have hit the rule.
>>
>> Can anyone help me shed some light onto this?
>>
>> Running MailScanner 4.72.5-1 on CentOS 5
>>
>> Thanks,
>> Chris
> 
>> Hi Chris,
>>
>> you wouldn't be whitelisting by email address alone, now would you?
>> That would indeed explain such a thing....;-)
>> When you look at it (in the logs etc), make sure you are looking at
>> the envelope sender/recipient(s), since those are the ones MS use...
>> Not the From:/To: headers...
>>
>> Cheers
>> -- 
>> -- Glenn
>> email: glenn < dot > steen < at > gmail < dot > com
>> work: glenn < dot > steen < at > ap1 < dot > se
> 
> 
> Glenn,
> 
> Thanks for the reply. You had me scared for a second there, but no there
> was no white listing going on. I verified the envelope addresses. This
> issue seems to happen randomly a least a couple times a day to some
> users. 
> 
> Any other ideas?
> 
> Thanks,
> Chris
> 
Do these messages have anything in common like being posted to many users at once?



-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081105/24e5e195/signature.bin