Our failover host is running on MailScanner-4.71.10-1 and is showing the exact same behaviour. The only difference between our primaire node and failover node is the MailScanner version.<br><br>The fix for watermarking has not made a difference on our machines unfortunately.<br>
<br>Thanks for the reply.<br><br><br><br><div class="gmail_quote">On Fri, Oct 31, 2008 at 10:48 AM, Martin.Hepworth <span dir="ltr"><<a href="mailto:martinh@solidstatelogic.com">martinh@solidstatelogic.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font color="#0000ff" size="2" face="Arial">Hi</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" size="2" face="Arial"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" size="2" face="Arial">there was a fix for watermarking in 4.71.6, but as Julian's
about to pop out a new stable in the 48 hours mught be worth hanging on for
that,.</font></span></div>
<div dir="ltr" align="left"><span><font color="#0000ff" size="2" face="Arial"></font></span> </div>
<div dir="ltr" align="left"><span><font color="#0000ff" size="2" face="Arial">also I don't see the watermark in the header that
messagelabs rejected. looks like they are bouncing not
rejecting..</font></span></div>
<div> </div>
<p><font size="2">--<br>Martin Hepworth<br>Snr Systems Administrator<br>Solid
State Logic<br>Tel: +44 (0)1865 842300</font> </p>
<div> </div><br>
<blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;">
<div dir="ltr" align="left" lang="en-us">
<hr>
<font size="2" face="Tahoma"><b>From:</b>
<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>
[mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>] <b>On Behalf Of </b>BlaaT
0001<br><b>Sent:</b> 31 October 2008 09:39<br><b>To:</b> MailScanner
discussion<br><b>Subject:</b> {Disarmed} Watermarking not
working<br></font><br></div>
<div></div>Hello all,<br><br>I'm still having problems using watermarking. My
MailScanner settings related to watermarking are:<br><br>Use Watermarking =
yes<br>Add Watermark = %rules-dir%/add.watermark.rules<br>Check Watermarks
With No Sender = %rules-dir%/check.watermarks.with.no.sender.rules<br>Treat
Invalid Watermarks With No Sender as Spam = 20<br>Check Watermarks To Skip
Spam Checks = no<br>Watermark Secret = ***************<br>Watermark Lifetime =
604800<br>Watermark Header = X-%org-name%-WM:<br><br>We add a watermark on
outgoing mail, and we check incoming mail on watermarks (using the
rulesets).<br><br>Every "no sender" mail gets marked by the watermarking
feature, from the logfile:<br><br>Oct 31 08:39:31 mailscan02
MailScanner[26686]: Message 720DF48F44B.05390 had bad watermark, added 20 to
spam score<br>Oct 31 08:39:31 mailscan02 MailScanner[26686]: Message
720DF48F44B.05390 from <a href="http://194.106.220.35" target="_blank"><font color="red"><b>MailScanner warning: numerical links are often
malicious:</b></font> 194.106.220.35</a> () to ourdomain.tld is spam (no
watermark or sender address), SpamAssassin (score=0, vereist 20,
autolearn=disabled)<br><br>This was a legit bounce mail, a response to a mail
send from our MailScanner machine with a watermark attached. <br><br>This is
the full
message:<br><br>----------------------------------------------------------------<br><br>Received:
from <a href="http://mail91.messagelabs.com" target="_blank">mail91.messagelabs.com</a> (<a href="http://mail91.messagelabs.com" target="_blank">mail91.messagelabs.com</a> [<a href="http://194.106.220.35" target="_blank"><font color="red"><b>MailScanner warning: numerical
links are often malicious:</b></font>
194.106.220.35</a>])<br> by
mailscan02.ourdomain.tld (Postfix) with ESMTP id
720DF48F44B<br> for
<ra.user@ourdomain.tld>; Fri, 31 Oct 2008 08:39:26 +0100
(CET)<br>X-VirusChecked: Checked<br>X-Msg-Ref: <a href="http://server-7.tower-91.messagelabs.com" target="_blank">server-7.tower-91.messagelabs.com</a>!1225438765!40564331!1<br>X-StarScan-Version:
5.5.12.14.2; banners=-,-,-<br>X-Originating-IP: [<a href="http://77.94.249.25" target="_blank"><font color="red"><b>MailScanner warning: numerical
links are often malicious:</b></font> 77.94.249.25</a>]<br>X-SpamReason: No,
hits=0.0 required=7.0 tests=<br>Received: (qmail 30403 invoked from network);
31 Oct 2008 07:39:25 -0000<br>Received: from <a href="http://net3-nl-smtp-01.vevida.net" target="_blank">net3-nl-smtp-01.vevida.net</a> (HELO
<a href="http://net3-nl-smtp-01.vevida.net" target="_blank">net3-nl-smtp-01.vevida.net</a>)
(<a href="http://77.94.249.25" target="_blank"><font color="red"><b>MailScanner warning:
numerical links are often malicious:</b></font> 77.94.249.25</a>)<br> by
<a href="http://server-7.tower-91.messagelabs.com" target="_blank">server-7.tower-91.messagelabs.com</a>
with AES256-SHA encrypted SMTP; 31 Oct 2008 07:39:25 -0000<br>Received: from
<a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a> (<a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a> [<a href="http://77.94.249.24" target="_blank"><font color="red"><b>MailScanner warning: numerical
links are often malicious:</b></font>
77.94.249.24</a>])<br> by <a href="http://net3-nl-smtp-01.vevida.net" target="_blank">net3-nl-smtp-01.vevida.net</a>
(Postfix) with ESMTP id
3976B2EC542<br> for
<ra.user@ourdomain.tld>; Fri, 31 Oct 2008 08:39:25 +0100
(CET)<br>Received: by <a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a>
(Postfix, from userid 8)<br> id
3793E35002B; Fri, 31 Oct 2008 08:39:25 +0100 (CET)<br>Message-ID: <<a href="mailto:dovecot-1225438765-217569-0@net3-nl-mail-02.vevida.net" target="_blank">dovecot-1225438765-217569-0@net3-nl-mail-02.vevida.net</a>><br>
Date:
Fri, 31 Oct 2008 08:39:25 +0100<br>From: Mail Delivery Subsystem <<a href="mailto:postmaster@vevida.net" target="_blank">postmaster@vevida.net</a>><br>To:
<ra.user@ourdomain.tld><br>MIME-Version: 1.0<br>Content-Type:
multipart/report;
report-type=disposition-notification;<br>
boundary="21397/<a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a>"<br>Subject:
Automatically rejected mail<br>Auto-Submitted: auto-replied
(rejected)<br>Precedence: bulk<br><br>This is a MIME-encapsulated
message<br><br>--21397/<a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a><br>Content-Type:
text/plain; charset=utf-8<br>Content-Disposition:
inline<br>Content-Transfer-Encoding: 8bit<br><br>Your message to <<a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a>> was
automatically rejected:<br>Quota exceeded<br>--21397/<a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a><br>Content-Type:
message/disposition-notification<br><br>Reporting-UA: <a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a>;
Dovecot Mail Delivery Agent<br>Final-Recipient: rfc822; <a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a><br>Original-Message-ID:
<F5C8BFB7A516F643817E53C49577255F01164454@EXCHANGE3.internal.domain><br>Disposition:
automatic-action/MDN-sent-automatically; deleted<br><br>--21397/<a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a><br>Content-Type:
message/rfc822<br><br>Return-Path:
<ra.user@ourdomain.tld><br>Delivered-To: <a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a><br>Received: from <a href="http://net3-nl-mx-03.vevida.net" target="_blank">net3-nl-mx-03.vevida.net</a> (<a href="http://net3-nl-mx-03.vevida.net" target="_blank">net3-nl-mx-03.vevida.net</a> [<a href="http://77.94.249.31" target="_blank"><font color="red"><b>MailScanner warning: numerical
links are often malicious:</b></font>
77.94.249.31</a>])<br> by <a href="http://net3-nl-mail-02.vevida.net" target="_blank">net3-nl-mail-02.vevida.net</a>
(Postfix) with ESMTP id
332F8350029<br> for <<a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a>>; Fri, 31 Oct
2008 08:39:25 +0100 (CET)<br>X-Virus-Scanned: amavisd-new at <a href="http://vevida.net" target="_blank">vevida.net</a><br>X-Spam-Status: No, score=0.202
required=5
tests=[ANY_BOUNCE_MESSAGE=0.1,<br>
HTML_MESSAGE=0.001, UNPARSEABLE_RELAY=0.001, VBOUNCE_MESSAGE=0.1]<br>Received:
from mail.ourdomain.tld (mail.ourdomain.tld
[our.ip.add.ress])<br> by <a href="http://net3-nl-mx-03.vevida.net" target="_blank">net3-nl-mx-03.vevida.net</a> (Postfix)
with ESMTP id 38DB8976BC<br> for
<<a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a>>; Fri, 31
Oct 2008 08:39:24 +0100 (CET)<br>Received: from sgmg.ourdomain.tld
(sgmg.ourdomain.tld [<a href="http://10.2.10.109" target="_blank"><font color="red"><b>MailScanner warning: numerical links are often
malicious:</b></font>
10.2.10.109</a>])<br> by
mailscan02.ourdomain.tld (Postfix) with ESMTP id B76B148F448<br>Received:
(from <a href="mailto:smtpd@127.0.0.1" target="_blank">smtpd@127.0.0.1</a>) by <a href="http://sgmg.prdf.nl" target="_blank">sgmg.prdf.nl</a>
(8.13.8/8.13.8)<br> id
m9V7dJj1022834 for <<a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a>>; Fri, 31 Oct
2008 08:39:19 +0100<br>Received: from unknown [<a href="http://10.2.10.114" target="_blank"><font color="red"><b>MailScanner warning: numerical
links are often malicious:</b></font> 10.2.10.114</a>] by gateway id
/processing/kwlCeRw3; Fri Oct 31 08:39:19 2008<br>MIME-Version:
1.0<br>X-MimeOLE: Produced By Microsoft Exchange V6.5<br>Subject: Out of
Office AutoReply: RaaR - muziek op zondag - Jazz au Foyer<br>Date: Fri,
31 Oct 2008 08:39:18 +0100<br>Message-ID:
<F5C8BFB7A516F643817E53C49577255F01164454@EXCHANGE3.internal.domain><br>X-MS-Has-Attach:<br>X-MS-TNEF-Correlator:<br>Thread-Topic:
RaaR - muziek op zondag - Jazz au Foyer<br>Thread-Index:
Ack7K8SpBsNSNiAkRmq5jBTFlWpQiwAAAOPO<br>From: "User, R"
<ra.user@ourdomain.tld><br>To: "RaaR eten & drinken" <<a href="mailto:newz@raar-nieuws.nl" target="_blank">newz@raar-nieuws.nl</a>><br>Content-class:
urn:content-classes:message<br>X-ORG-WM:
1226043563.0392@OUzi9liSBFaJtjtI7nMePQ<br>X-ORG:
Clean<br>----------------------------------------------------------------<br><br>We're
using a third party to scan our email and forward it to us. We use MailScanner
to filter out marked messages (spam header), we don't do much spam-scanning
ourselves, just the default SpamAssassin ruleset without any dns checks. All
our outgoing mail is relayed through the MailScanner machine and then
delivered directly to the receiver's mailserver. <br><br>We're using Postfix
2.5.1 as a MTA on an OpenBSD 4.3 machine.<br><br>-bash-3.2#
/opt/MailScanner/bin/MailScanner -v<br>Running on<br>OpenBSD
mailscan02.ourdomain.tld 4.3 GENERIC#698 i386<br>This is Perl version 5.008008
(5.8.8)<br><br>This is MailScanner version 4.70.7<br>Module versions
are:<br>1.00 AnyDBM_File<br>1.23
Archive::Zip<br>0.21 bignum<br>1.04
Carp<br>2.008 Compress::Zlib<br>1.119
Convert::BinHex<br>0.17
Convert::TNEF<br>2.121_08
Data::Dumper<br>2.27 Date::Parse<br>1.00
DirHandle<br>1.05 Fcntl<br>2.74
File::Basename<br>2.09 File::Copy<br>2.01
FileHandle<br>1.08 File::Path<br>0.19
File::Temp<br>0.90 Filesys::Df<br>1.35
HTML::Entities<br>3.56
HTML::Parser<br>2.37
HTML::TokeParser<br>1.23 IO<br>1.14
IO::File<br>1.13 IO::Pipe<br>2.02
Mail::Header<br>1.86 Math::BigInt<br>0.19
Math::BigRat<br>3.07 MIME::Base64<br>5.425
MIME::Decoder<br>5.425 MIME::Decoder::UU<br>5.425
MIME::Head<br>5.425 MIME::Parser<br>3.07
MIME::QuotedPrint<br>5.425 MIME::Tools<br>0.11
Net::CIDR<br>1.25 Net::IP<br>0.16
OLE::Storage_Lite<br>1.04
Pod::Escapes<br>3.05 Pod::Simple<br>1.09
POSIX<br>1.19 Scalar::Util<br>1.78
Socket<br>2.16 Storable<br>1.4
Sys::Hostname::Long<br>0.18
Sys::Syslog<br>1.26 Test::Pod<br>0.7
Test::Simple<br>1.9707 Time::HiRes<br>1.02
Time::localtime<br><br>Optional module versions are:<br>1.36
Archive::Tar<br>0.21 bignum<br>missing
Business::ISBN<br>missing Business::ISBN::Data<br>missing
Data::Dump<br>1.814 DB_File<br>1.14
DBD::SQLite<br>1.59 DBI<br>1.14
Digest<br>1.01 Digest::HMAC<br>2.36
Digest::MD5<br>2.11 Digest::SHA1<br>missing
Encode::Detect<br>missing Error<br>missing ExtUtils::CBuilder<br>missing
ExtUtils::ParseXS<br>2.36 Getopt::Long<br>missing
Inline<br>1.08 IO::String<br>1.08
IO::Zlib<br>missing IP::Country<br>missing
Mail::ClamAV<br>3.002004
Mail::SpamAssassin<br>missing
Mail::SPF<br>1.999001
Mail::SPF::Query<br>missing Module::Build<br>0.20
Net::CIDR::Lite<br>0.63 Net::DNS<br>missing
Net::DNS::Resolver::Programmable<br>missing Net::LDAP<br>missing
NetAddr::IP<br>missing Parse::RecDescent<br>missing
SAVI<br>2.64 Test::Harness<br>missing
Test::Manifest<br>1.95
Text::Balanced<br>1.35 URI<br>missing version<br>missing
YAML<br><br>What could be causing this? Why isn't watermarking working
properly?<br>Any help is much
appreciated!<br><br>Cheers.<br></blockquote><font size="1"><br>**********************************************************************
<br>Confidentiality : This e-mail and any attachments are intended for the
<br>addressee only and may be confidential. If they come to you in error
<br>you must take no action based on them, nor must you copy or show them
<br>to anyone. Please advise the sender by replying to this e-mail
<br>immediately and then delete the original from your computer.
<br>Opinion : Any opinions expressed in this e-mail are entirely those of
<br>the author and unless specifically stated to the contrary, are not
<br>necessarily those of the author's employer.
<br>Security Warning : Internet e-mail is not necessarily a secure
<br>communications medium and can be subject to data corruption. We advise
<br>that you consider this fact when e-mailing us.
<br>Viruses : We have taken steps to ensure that this e-mail and any
<br>attachments are free from known viruses but in keeping with good
<br>computing practice, you should ensure that they are virus free.
<br>
<br>Red Lion 49 Ltd T/A Solid State Logic
<br>Registered as a limited company in England and Wales
<br>(Company No:5362730)
<br>Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
<br>United Kingdom
<br>**********************************************************************</font>
</div>
<br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br>