<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16735" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=647034609-31102008><FONT face=Arial
color=#0000ff size=2>Hi</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=647034609-31102008><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=647034609-31102008><FONT face=Arial
color=#0000ff size=2>there was a fix for watermarking in 4.71.6, but as Julian's
about to pop out a new stable in the 48 hours mught be worth hanging on for
that,.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=647034609-31102008><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=647034609-31102008><FONT face=Arial
color=#0000ff size=2>also I don't see the watermark in the header that
messagelabs rejected. looks like they are bouncing not
rejecting..</FONT></SPAN></DIV>
<DIV> </DIV><!-- Converted from text/plain format -->
<P><FONT size=2>--<BR>Martin Hepworth<BR>Snr Systems Administrator<BR>Solid
State Logic<BR>Tel: +44 (0)1865 842300</FONT> </P>
<DIV> </DIV><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B>
mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of </B>BlaaT
0001<BR><B>Sent:</B> 31 October 2008 09:39<BR><B>To:</B> MailScanner
discussion<BR><B>Subject:</B> {Disarmed} Watermarking not
working<BR></FONT><BR></DIV>
<DIV></DIV>Hello all,<BR><BR>I'm still having problems using watermarking. My
MailScanner settings related to watermarking are:<BR><BR>Use Watermarking =
yes<BR>Add Watermark = %rules-dir%/add.watermark.rules<BR>Check Watermarks
With No Sender = %rules-dir%/check.watermarks.with.no.sender.rules<BR>Treat
Invalid Watermarks With No Sender as Spam = 20<BR>Check Watermarks To Skip
Spam Checks = no<BR>Watermark Secret = ***************<BR>Watermark Lifetime =
604800<BR>Watermark Header = X-%org-name%-WM:<BR><BR>We add a watermark on
outgoing mail, and we check incoming mail on watermarks (using the
rulesets).<BR><BR>Every "no sender" mail gets marked by the watermarking
feature, from the logfile:<BR><BR>Oct 31 08:39:31 mailscan02
MailScanner[26686]: Message 720DF48F44B.05390 had bad watermark, added 20 to
spam score<BR>Oct 31 08:39:31 mailscan02 MailScanner[26686]: Message
720DF48F44B.05390 from <A href="http://194.106.220.35"><FONT
color=red><B>MailScanner warning: numerical links are often
malicious:</B></FONT> 194.106.220.35</A> () to ourdomain.tld is spam (no
watermark or sender address), SpamAssassin (score=0, vereist 20,
autolearn=disabled)<BR><BR>This was a legit bounce mail, a response to a mail
send from our MailScanner machine with a watermark attached. <BR><BR>This is
the full
message:<BR><BR>----------------------------------------------------------------<BR><BR>Received:
from <A href="http://mail91.messagelabs.com">mail91.messagelabs.com</A> (<A
href="http://mail91.messagelabs.com">mail91.messagelabs.com</A> [<A
href="http://194.106.220.35"><FONT color=red><B>MailScanner warning: numerical
links are often malicious:</B></FONT>
194.106.220.35</A>])<BR> by
mailscan02.ourdomain.tld (Postfix) with ESMTP id
720DF48F44B<BR> for
<ra.user@ourdomain.tld>; Fri, 31 Oct 2008 08:39:26 +0100
(CET)<BR>X-VirusChecked: Checked<BR>X-Msg-Ref: <A
href="http://server-7.tower-91.messagelabs.com">server-7.tower-91.messagelabs.com</A>!1225438765!40564331!1<BR>X-StarScan-Version:
5.5.12.14.2; banners=-,-,-<BR>X-Originating-IP: [<A
href="http://77.94.249.25"><FONT color=red><B>MailScanner warning: numerical
links are often malicious:</B></FONT> 77.94.249.25</A>]<BR>X-SpamReason: No,
hits=0.0 required=7.0 tests=<BR>Received: (qmail 30403 invoked from network);
31 Oct 2008 07:39:25 -0000<BR>Received: from <A
href="http://net3-nl-smtp-01.vevida.net">net3-nl-smtp-01.vevida.net</A> (HELO
<A href="http://net3-nl-smtp-01.vevida.net">net3-nl-smtp-01.vevida.net</A>)
(<A href="http://77.94.249.25"><FONT color=red><B>MailScanner warning:
numerical links are often malicious:</B></FONT> 77.94.249.25</A>)<BR> by
<A
href="http://server-7.tower-91.messagelabs.com">server-7.tower-91.messagelabs.com</A>
with AES256-SHA encrypted SMTP; 31 Oct 2008 07:39:25 -0000<BR>Received: from
<A href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A> (<A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A> [<A
href="http://77.94.249.24"><FONT color=red><B>MailScanner warning: numerical
links are often malicious:</B></FONT>
77.94.249.24</A>])<BR> by <A
href="http://net3-nl-smtp-01.vevida.net">net3-nl-smtp-01.vevida.net</A>
(Postfix) with ESMTP id
3976B2EC542<BR> for
<ra.user@ourdomain.tld>; Fri, 31 Oct 2008 08:39:25 +0100
(CET)<BR>Received: by <A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A>
(Postfix, from userid 8)<BR> id
3793E35002B; Fri, 31 Oct 2008 08:39:25 +0100 (CET)<BR>Message-ID: <<A
href="mailto:dovecot-1225438765-217569-0@net3-nl-mail-02.vevida.net">dovecot-1225438765-217569-0@net3-nl-mail-02.vevida.net</A>><BR>Date:
Fri, 31 Oct 2008 08:39:25 +0100<BR>From: Mail Delivery Subsystem <<A
href="mailto:postmaster@vevida.net">postmaster@vevida.net</A>><BR>To:
<ra.user@ourdomain.tld><BR>MIME-Version: 1.0<BR>Content-Type:
multipart/report;
report-type=disposition-notification;<BR>
boundary="21397/<A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A>"<BR>Subject:
Automatically rejected mail<BR>Auto-Submitted: auto-replied
(rejected)<BR>Precedence: bulk<BR><BR>This is a MIME-encapsulated
message<BR><BR>--21397/<A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A><BR>Content-Type:
text/plain; charset=utf-8<BR>Content-Disposition:
inline<BR>Content-Transfer-Encoding: 8bit<BR><BR>Your message to <<A
href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A>> was
automatically rejected:<BR>Quota exceeded<BR>--21397/<A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A><BR>Content-Type:
message/disposition-notification<BR><BR>Reporting-UA: <A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A>;
Dovecot Mail Delivery Agent<BR>Final-Recipient: rfc822; <A
href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A><BR>Original-Message-ID:
<F5C8BFB7A516F643817E53C49577255F01164454@EXCHANGE3.internal.domain><BR>Disposition:
automatic-action/MDN-sent-automatically; deleted<BR><BR>--21397/<A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A><BR>Content-Type:
message/rfc822<BR><BR>Return-Path:
<ra.user@ourdomain.tld><BR>Delivered-To: <A
href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A><BR>Received: from <A
href="http://net3-nl-mx-03.vevida.net">net3-nl-mx-03.vevida.net</A> (<A
href="http://net3-nl-mx-03.vevida.net">net3-nl-mx-03.vevida.net</A> [<A
href="http://77.94.249.31"><FONT color=red><B>MailScanner warning: numerical
links are often malicious:</B></FONT>
77.94.249.31</A>])<BR> by <A
href="http://net3-nl-mail-02.vevida.net">net3-nl-mail-02.vevida.net</A>
(Postfix) with ESMTP id
332F8350029<BR> for <<A
href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A>>; Fri, 31 Oct
2008 08:39:25 +0100 (CET)<BR>X-Virus-Scanned: amavisd-new at <A
href="http://vevida.net">vevida.net</A><BR>X-Spam-Status: No, score=0.202
required=5
tests=[ANY_BOUNCE_MESSAGE=0.1,<BR>
HTML_MESSAGE=0.001, UNPARSEABLE_RELAY=0.001, VBOUNCE_MESSAGE=0.1]<BR>Received:
from mail.ourdomain.tld (mail.ourdomain.tld
[our.ip.add.ress])<BR> by <A
href="http://net3-nl-mx-03.vevida.net">net3-nl-mx-03.vevida.net</A> (Postfix)
with ESMTP id 38DB8976BC<BR> for
<<A href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A>>; Fri, 31
Oct 2008 08:39:24 +0100 (CET)<BR>Received: from sgmg.ourdomain.tld
(sgmg.ourdomain.tld [<A href="http://10.2.10.109"><FONT
color=red><B>MailScanner warning: numerical links are often
malicious:</B></FONT>
10.2.10.109</A>])<BR> by
mailscan02.ourdomain.tld (Postfix) with ESMTP id B76B148F448<BR>Received:
(from <A href="mailto:smtpd@127.0.0.1">smtpd@127.0.0.1</A>) by <A
href="http://sgmg.prdf.nl">sgmg.prdf.nl</A>
(8.13.8/8.13.8)<BR> id
m9V7dJj1022834 for <<A
href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A>>; Fri, 31 Oct
2008 08:39:19 +0100<BR>Received: from unknown [<A
href="http://10.2.10.114"><FONT color=red><B>MailScanner warning: numerical
links are often malicious:</B></FONT> 10.2.10.114</A>] by gateway id
/processing/kwlCeRw3; Fri Oct 31 08:39:19 2008<BR>MIME-Version:
1.0<BR>X-MimeOLE: Produced By Microsoft Exchange V6.5<BR>Subject: Out of
Office AutoReply: RaaR - muziek op zondag - Jazz au Foyer<BR>Date: Fri,
31 Oct 2008 08:39:18 +0100<BR>Message-ID:
<F5C8BFB7A516F643817E53C49577255F01164454@EXCHANGE3.internal.domain><BR>X-MS-Has-Attach:<BR>X-MS-TNEF-Correlator:<BR>Thread-Topic:
RaaR - muziek op zondag - Jazz au Foyer<BR>Thread-Index:
Ack7K8SpBsNSNiAkRmq5jBTFlWpQiwAAAOPO<BR>From: "User, R"
<ra.user@ourdomain.tld><BR>To: "RaaR eten & drinken" <<A
href="mailto:newz@raar-nieuws.nl">newz@raar-nieuws.nl</A>><BR>Content-class:
urn:content-classes:message<BR>X-ORG-WM:
1226043563.0392@OUzi9liSBFaJtjtI7nMePQ<BR>X-ORG:
Clean<BR>----------------------------------------------------------------<BR><BR>We're
using a third party to scan our email and forward it to us. We use MailScanner
to filter out marked messages (spam header), we don't do much spam-scanning
ourselves, just the default SpamAssassin ruleset without any dns checks. All
our outgoing mail is relayed through the MailScanner machine and then
delivered directly to the receiver's mailserver. <BR><BR>We're using Postfix
2.5.1 as a MTA on an OpenBSD 4.3 machine.<BR><BR>-bash-3.2#
/opt/MailScanner/bin/MailScanner -v<BR>Running on<BR>OpenBSD
mailscan02.ourdomain.tld 4.3 GENERIC#698 i386<BR>This is Perl version 5.008008
(5.8.8)<BR><BR>This is MailScanner version 4.70.7<BR>Module versions
are:<BR>1.00 AnyDBM_File<BR>1.23
Archive::Zip<BR>0.21 bignum<BR>1.04
Carp<BR>2.008 Compress::Zlib<BR>1.119
Convert::BinHex<BR>0.17
Convert::TNEF<BR>2.121_08
Data::Dumper<BR>2.27 Date::Parse<BR>1.00
DirHandle<BR>1.05 Fcntl<BR>2.74
File::Basename<BR>2.09 File::Copy<BR>2.01
FileHandle<BR>1.08 File::Path<BR>0.19
File::Temp<BR>0.90 Filesys::Df<BR>1.35
HTML::Entities<BR>3.56
HTML::Parser<BR>2.37
HTML::TokeParser<BR>1.23 IO<BR>1.14
IO::File<BR>1.13 IO::Pipe<BR>2.02
Mail::Header<BR>1.86 Math::BigInt<BR>0.19
Math::BigRat<BR>3.07 MIME::Base64<BR>5.425
MIME::Decoder<BR>5.425 MIME::Decoder::UU<BR>5.425
MIME::Head<BR>5.425 MIME::Parser<BR>3.07
MIME::QuotedPrint<BR>5.425 MIME::Tools<BR>0.11
Net::CIDR<BR>1.25 Net::IP<BR>0.16
OLE::Storage_Lite<BR>1.04
Pod::Escapes<BR>3.05 Pod::Simple<BR>1.09
POSIX<BR>1.19 Scalar::Util<BR>1.78
Socket<BR>2.16 Storable<BR>1.4
Sys::Hostname::Long<BR>0.18
Sys::Syslog<BR>1.26 Test::Pod<BR>0.7
Test::Simple<BR>1.9707 Time::HiRes<BR>1.02
Time::localtime<BR><BR>Optional module versions are:<BR>1.36
Archive::Tar<BR>0.21 bignum<BR>missing
Business::ISBN<BR>missing Business::ISBN::Data<BR>missing
Data::Dump<BR>1.814 DB_File<BR>1.14
DBD::SQLite<BR>1.59 DBI<BR>1.14
Digest<BR>1.01 Digest::HMAC<BR>2.36
Digest::MD5<BR>2.11 Digest::SHA1<BR>missing
Encode::Detect<BR>missing Error<BR>missing ExtUtils::CBuilder<BR>missing
ExtUtils::ParseXS<BR>2.36 Getopt::Long<BR>missing
Inline<BR>1.08 IO::String<BR>1.08
IO::Zlib<BR>missing IP::Country<BR>missing
Mail::ClamAV<BR>3.002004
Mail::SpamAssassin<BR>missing
Mail::SPF<BR>1.999001
Mail::SPF::Query<BR>missing Module::Build<BR>0.20
Net::CIDR::Lite<BR>0.63 Net::DNS<BR>missing
Net::DNS::Resolver::Programmable<BR>missing Net::LDAP<BR>missing
NetAddr::IP<BR>missing Parse::RecDescent<BR>missing
SAVI<BR>2.64 Test::Harness<BR>missing
Test::Manifest<BR>1.95
Text::Balanced<BR>1.35 URI<BR>missing version<BR>missing
YAML<BR><BR>What could be causing this? Why isn't watermarking working
properly?<BR>Any help is much
appreciated!<BR><BR>Cheers.<BR></BLOCKQUOTE><font size="1"><br />**********************************************************************
<br />Confidentiality : This e-mail and any attachments are intended for the
<br />addressee only and may be confidential. If they come to you in error
<br />you must take no action based on them, nor must you copy or show them
<br />to anyone. Please advise the sender by replying to this e-mail
<br />immediately and then delete the original from your computer.
<br />Opinion : Any opinions expressed in this e-mail are entirely those of
<br />the author and unless specifically stated to the contrary, are not
<br />necessarily those of the author's employer.
<br />Security Warning : Internet e-mail is not necessarily a secure
<br />communications medium and can be subject to data corruption. We advise
<br />that you consider this fact when e-mailing us.
<br />Viruses : We have taken steps to ensure that this e-mail and any
<br />attachments are free from known viruses but in keeping with good
<br />computing practice, you should ensure that they are virus free.
<br />
<br />Red Lion 49 Ltd T/A Solid State Logic
<br />Registered as a limited company in England and Wales
<br />(Company No:5362730)
<br />Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
<br />United Kingdom
<br />**********************************************************************</font>
</BODY></HTML>