Message rules don't work, but if message forwarded, it does???

[Chris Barber]

>> Hi All,
>>
>> Having a strange issue, maybe someone has seen this before. I have
> some
>> spam emails that are getting through the server. If a user then
> forwards
>> that spam message to me, going through the server again, it does get 
>> caught.
>>
>> A specific example is this:
>> Message comes through and hit no rules at all.
>> Message is forwarded and hits two URIBL rules for a URL in the
> message.
>> Strange thing is that the URL was in the message originally so it
> should
>> have hit the rule.
>>
>> Can anyone help me shed some light onto this?
>>
>> Running MailScanner 4.72.5-1 on CentOS 5
>>
>> Thanks,
>> Chris
> 
>> Hi Chris,
>>
>> you wouldn't be whitelisting by email address alone, now would you?
>> That would indeed explain such a thing....;-) When you look at it (in 
>> the logs etc), make sure you are looking at the envelope 
>> sender/recipient(s), since those are the ones MS use...
>> Not the From:/To: headers...
>>
>> Cheers
>> --
>> -- Glenn
>> email: glenn < dot > steen < at > gmail < dot > com
>> work: glenn < dot > steen < at > ap1 < dot > se
> 
> 
> Glenn,
> 
> Thanks for the reply. You had me scared for a second there, but no 
> there was no white listing going on. I verified the envelope 
> addresses. This issue seems to happen randomly a least a couple times 
> a day to some users.
> 
> Any other ideas?
> 
> Thanks,
> Chris
> 
>>Do these messages have anything in common like being posted to many users at once?

No not really. There have only ever been a couple that went to multiple users and came back for me to see. I know not all users would forward them to me, but they are all supposed to.