<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>watermark ruleset not firing</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I have created a watermark ruleset to do 'nothing' for specific mail servers. The entries are not matching.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I created watermark.rules in /etc/MailScanner/rules:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">From: copweed01.morganlewis.com nothing</FONT>
<BR><FONT SIZE=2 FACE="Arial">From: copweed02.morganlewis.com nothing</FONT>
<BR><FONT SIZE=2 FACE="Arial">From: cppweed01.morganlewis.com nothing</FONT>
<BR><FONT SIZE=2 FACE="Arial">From: 12.53.161.110 nothing</FONT>
<BR><FONT SIZE=2 FACE="Arial">From: 12.53.161.111 nothing</FONT>
<BR><FONT SIZE=2 FACE="Arial">From: 12.155.22.28 nothing</FONT>
<BR><FONT SIZE=2 FACE="Arial">FromOrTo: default 3</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Here are my watermark rules in my custom configuration file in /etc/MailScanner/conf.d:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Use Watermarking = yes</FONT>
<BR><FONT SIZE=2 FACE="Arial">Treat Invalid Watermarks With No Sender as Spam = %rules-dir%/watermark.rules</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">What am I missing?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">An example email that should have been excluded from the watermark check:</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Received: from copweed01.morganlewis.com (copweed01.morganlewis.com [12.53.161.110])</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">by alnmx01.bakerbotts.com (8.14.2/8.14.2) with ESMTP id p3MFaCwj012804;</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">Fri, 22 Apr 2011 10:36:19 -0500</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Resent-Date: Fri, 22 Apr 2011 10:36:12 -0500</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Resent-Message-Id: <201104221536.p3MFaCwj012804@alnmx01.bakerbotts.com></FONT>
<BR><FONT SIZE=2 FACE="Courier New">Received: from [10.242.132.22] by copweed01.morganlewis.com with ESMTP ( SMTP Relay (Email Firewall v6.5)); Fri, 22 Apr 2011 11:44:04 -0400</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">X-Server-Uuid: D6191EAF-0F04-49FC-A864-79434BF09F09</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Resent-From: FractusJointDefenseGroup@morganlewis.com</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Received: from copweed02.morganlewis.com (12.53.161.111) by copexht02.morganlewis.net (10.242.132.22) with Microsoft SMTP Server id 8.2.254.0; Fri, 22 Apr 2011 11:36:05 -0400</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Received: from [64.18.3.44] by copweed02.morganlewis.com over TLS secured channel with ESMTP (SMTP Relay (Email Firewall v6.5)); Fri, 22 Apr 2011 11:46:52 -0400</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">X-Server-Uuid: D70207A0-A86D-4D47-8AAC-CD3A36FFCB7C</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Received: from smtp1.atlantech.net ([209.183.192.110]) (using TLSv1) by exprod8mx253.postini.com ([64.18.7.10]) with SMTP; Fri, 22 Apr 2011</FONT></P>
<P><FONT SIZE=2 FACE="Courier New"> 08:35:59 PDT</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-IronPort-AV: E=Sophos;i="4.64,254,1301889600"; d="scan'208,217";a="71729624"</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Received: from ea.c3bccf.client.atlantech.net (HELO park-law.com) (</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> [207.188.195.234]) by smtp1.atlantech.net with ESMTP/TLS/RC4-MD5; 22 Apr 2011 11:35:57 -0400</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-MimeOLE: Produced By Microsoft Exchange V6.5</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Content-Class: urn:content-classes:message</FONT>
<BR><FONT SIZE=2 FACE="Courier New">MIME-Version: 1.0</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Subject: RE: Fractus v. Samsung et al.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Date: Fri, 22 Apr 2011 11:36:02 -0400</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Message-ID: <FA11762A28C4274E93B8D81A05917A0FA9E1AC@east.park-law.local></FONT>
<BR><FONT SIZE=2 FACE="Courier New">In-Reply-To: <D758CC4FAD3978498639789C594949A81373C28F15@COPXCMS03.morganlewis.net></FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-MS-Has-Attach: </FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-MS-TNEF-Correlator: </FONT>
<BR><FONT SIZE=2 FACE="Courier New">Thread-Topic: Fractus v. Samsung et al.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">thread-index: AcwAWNpB/cHvfz5ZSP+zULMZz2qU/QApx4ZAAAC+Y7A=</FONT>
<BR><FONT SIZE=2 FACE="Courier New">From: "Nathan H. Cristler" <NCristler@park-law.com></FONT>
<BR><FONT SIZE=2 FACE="Courier New">To: "Busby, Robert W." <rbusby@morganlewis.com>,</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> "Fractus Joint Defense Group" <FractusJointDefenseGroup@morganlewis.com>,</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> "fractus-mofo.com" <fractus@mofo.com></FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-pstn-neptune: 0/0/0.00/0</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-pstn-levels: (S:99.90000/99.90000 CV:99.9000 FC:95.5390 LC: 0.1839</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> R:95.9108 P:95.9108 M:97.0282 C:98.6951 )</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-WSS-ID: 61AF7D612YK55634622-01-01</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-EMS-Proccessed: Q/C4TKuMQud1ZsPcuJv0Lg==</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-EMS-STAMP: oGRTyRFNCl8T0TguFL2xvw==</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-WSS-ID: 61AF7DCE2X07647132-02-01</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Content-Type: multipart/alternative;</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> boundary="----_=_NextPart_001_01CC0102.F8A39818"</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner-Information: Please contact Baker Botts IT Help Desk for more information</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner-ID: p3MFaCwj012804</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner: Found to be clean</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner-SpamCheck: spam (no watermark or sender address),</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">SpamAssassin (not cached, score=-1.099, required 5,</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">autolearn=not spam, BAYES_00 -0.40, HTML_MESSAGE 0.00,</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">RCVD_IN_DNSWL_LOW -0.70)</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner-SpamScore: sssssss</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner-From: </FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-BakerBotts-MailScanner-Watermark: 1304091382.4845@Or22gDB9+IlOGwIUABHy9g</FONT>
<BR><FONT SIZE=2 FACE="Courier New">X-Spam-Status: Yes</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">Donald Dawson</FONT>
<BR><FONT SIZE=2 FACE="Arial">Security Administrator</FONT>
<BR><FONT SIZE=2 FACE="Arial">Baker Botts L.L.P.</FONT>
<BR><FONT SIZE=1 FACE="Arial">One Shell Plaza</FONT>
<BR><FONT SIZE=1 FACE="Arial">910 Louisiana</FONT>
<BR><FONT SIZE=1 FACE="Arial">Houston, TX 77002</FONT>
<BR><FONT SIZE=1 FACE="Arial">W: 713-229-2183</FONT>
</P>
<p><span style="font-family:'Arial';font-size:10pt;"><b>Confidentiality Notice:</b></span><span style="font-family:'Arial';font-size:10pt;"> The information contained in this email and any attachments is intended only for the recipient[s] listed above and may be privileged and confidential. Any dissemination, copying, or use of or reliance upon such information by or to anyone other than the recipient[s] listed above is prohibited. If you have received this message in error, please notify the sender immediately at the email address above and destroy any and all copies of this message.</span></p>
<p><span style="font-family:'Arial';font-size:10pt;"> </span></p></BODY>
</HTML>