<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
It was the watermarking. Watermarks + null sender = spam. <br>
<br>
<br>
<div class="moz-cite-prefix">On 5/9/14, 10:08 PM, Martin Hepworth
wrote:<br>
</div>
<blockquote
cite="mid:CAGDKor+NLikeAdfUU7Qjh8ZhMdorguU0t10GnbnLCXKB+-RvYA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>So what do the logs say about it?<br>
</div>
Are you signing the headers outbound or not?<br>
</div>
<div class="gmail_extra"><br clear="all">
<div>-- <br>
Martin Hepworth, CISSP<br>
Oxford, UK</div>
<br>
<br>
<div class="gmail_quote">On 9 May 2014 20:08, Jerry Benton <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:jerry.benton@mailborder.com" target="_blank">jerry.benton@mailborder.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"> No, this happens from
internal servers relaying emails outbound. The MTA is not
performing any ip related checks, but I will review in
case I missed something. <br>
<div>
<div class="h5"> <br>
<br>
<div>On 5/9/14, 8:21 PM, Jeremy McSpadden wrote:<br>
</div>
<blockquote type="cite">
<div>IP found on an RBL at MTA time ?<br>
<div><br>
<br>
<br>
--<br>
Jeremy McSpadden<br>
Flux Labs | <a moz-do-not-send="true"
href="http://www.fluxlabs.net" target="_blank">http://www.fluxlabs.net</a>
| Endless Solutions<br>
Office : <a moz-do-not-send="true"
href="tel:850-250-5590;501" target="_blank">850-250-5590x501</a>
| Cell : <a moz-do-not-send="true"
href="tel:850-890-2543" target="_blank">
850-890-2543</a> | Fax : <a
moz-do-not-send="true" href="tel:850-254-2955"
target="_blank">850-254-2955</a></div>
<br>
</div>
<br>
<br>
<br>
<div class="gmail_quote">On Fri, May 9, 2014 at
10:06 AM -0700, "Jerry Benton" <span dir="ltr">
<<a moz-do-not-send="true"
href="mailto:jerry.benton@mailborder.com"
target="_blank">jerry.benton@mailborder.com</a>></span>
wrote:<br>
<br>
</div>
<div>
<div dir="ltr">Has anyone seen NDRs getting marked
as spam without even being scanned by SA? I am
seeing the behavior and am assuming it is a
MailScanner thing since the message never seems
to pass through SA.
<div><br>
</div>
<div>I am assuming the null sender is triggering
it. <br>
<div>
<div><br>
</div>
-- <br>
<div dir="ltr">
<div>
<div><br>
--<br>
</div>
Jerry Benton<br>
</div>
Mailborder Systems<br>
<a moz-do-not-send="true"
href="http://www.mailborder.com"
target="_blank">www.mailborder.com</a><br>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
<br>
</div>
</div>
</div>
<br>
--<br>
MailScanner mailing list<br>
<a moz-do-not-send="true"
href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a moz-do-not-send="true"
href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"
target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a moz-do-not-send="true"
href="http://wiki.mailscanner.info/posting"
target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the
website!<br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>