Forwarded spam is caught, original message is not

[Chris Barber]

<snip>
> 
> I do not have much experience with this, so if someone could assist me 
> I would be VERY grateful. I have attached a copy of one of these 
> messages from the MailScanner quarantine directory. There are two 
> files, one is the original, and the other is the forwarded message. 
> Any insight would be appreciated.
> 
> Regards,
> Chris
> 
> 
>A DNS timeout on the surbl hits could explain it. The first time the surbl list lookup comes in just at the timeout, then the forward hits >the cached lookup and is faster.
>
>Do you quarantine all your messages? If so you could pull the original out and retest it. If it still doesn't hit, it is probably an >encoding issue, it it does, it is a DNS issue.
>

Yes I quarantine all messages so this is a feasible test. I will post the results. Thanks for the suggestion.