IP is blacklisted, but TotalSpamWeight: 0
Problem reported by igorinuk - June 6 at 2:28 PM
Submitted
A spam message was delivered to Inbox. Sender's IP is blacklisted in 2 RBL's (GBUDB and SORBS-RECENT), but TotalSpamWeight: 0. How is it possible?
X-SmarterMail-Spam: Reverse DNS Lookup [Passed], ISpamAssassin 0 [raw: 2], SPF_None, DKIM_None, GBUDB, SORBS-RECENT
X-SmarterMail-SpamDetail: 2.8 BAD_CREDIT Eliminate Bad Credit
X-SmarterMail-TotalSpamWeight: 0
 
The sender is not a Trusted Sender. The IP is not whitelisted.
 
Is it a bug?

13 Replies

Reply to Thread
0
Linda Pagillo Replied
Hi. Can you please post the entire header of this message along with the entire delivery log snip for this message? Thanks.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
0
igorinuk Replied
Hi Linda,

Thank you for your answer.

I have Declude related questions (about FROMNOMATCH parameter etc.) Where should I ask them? May I email the questions to you?
0
Linda Pagillo Replied
My pleasure! Yes, please email me directly at linda.pagillo@mailsbestfriend.com and I will be happy to help you. :)
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
0
igorinuk Replied
Entire headers and log (I just replaced our mail server domain name and customer domain name):

Return-Path: <appropriates@matt.clicker-rigger.services>
Received: from as.OurMailServer.com (as.OurMailServer.com [(our_gateway_IP_address)]) by mail.OurMailServer.com with SMTP;
Wed, 6 Jun 2018 16:10:24 -0500
Received: from matt.clicker-rigger.services (chess.sending.services [104.255.98.238]) by as.OurMailServer.com with SMTP;
Wed, 6 Jun 2018 16:10:23 -0500
Message-ID: <investor.201806061646.429587@matt.clicker-rigger.services>
Content-Language: en-us
Mime-Version: 1.0
List-Unsubscribe: <mailto:unsubscribe-198a47310a5625be046138e06_2c48185b@matt.clicker-rigger.services>, <<a target="_blank" href="matt.clicker-rigger.services/198a47310a5625be046138e06_2c48185b/3/>">matt.clicker-rigger.services/198a47310a5625be046138e06_2c48185b/3/></a>;
Date: Wed, 06 Jun 2018 16:46:36 -0400
From: "Score Alert" <appropriates@matt.clicker-rigger.services>
To: "bonnie@OurCustomer.com" <bonnie@OurCustomer.com>
Subject: MED-AS: Bad credit? Not anymore - see your new score.
Content-type: multipart/alternative; boundary="198a47310a5625be046138e06_2c48185b";
X-Declude-Sender: appropriates@matt.clicker-rigger.services [(our_gateway_IP_address)]
X-Declude-Spoolname: 26340398246.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.12.11 "<a target="_blank" href="http://www.declude.com/x-note.htm"">http://www.declude.com/x-note.htm"</a>;;
X-Declude-Scan: Incoming Score [0] at 16:10:28 on 06 Jun 2018
X-Declude-Tests: None
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: f
X-HELO: as.OurMailServer.com
X-Identity: (our_gateway_IP_address) | as.OurMailServer.com | matt.clicker-rigger.services
X-SmarterMail-Spam: Reverse DNS Lookup [Passed], ISpamAssassin 0 [raw: 2], SPF_None, DKIM_None, GBUDB, SORBS-RECENT, Declude: 0
X-SmarterMail-SpamDetail: 2.8 BAD_CREDIT Eliminate Bad Credit
X-SmarterMail-TotalSpamWeight: 0

16:10:28 [98246] Delivery started for appropriates@matt.clicker-rigger.services at 4:10:28 PM
16:10:31 [98246] Added to SpamCheckQueue (0 queued; 2/30 processing)
16:10:32 [98246] Starting Spam Checks.
16:10:35 [98246] Spam check results: [_REVERSEDNSLOOKUP: Passed], [_INTERNALSPAMASSASSIN: 2:0], [_SPF: None], [_DKIM: None], [CBL: passed], [GBUDB: failed], [HOSTKARMA - BLACKLIST: passed], [SORBS-NEW: passed], [SORBS-NOMAIL: passed], [SORBS-RECENT: failed], [SPAMCOP: passed], [UBL: passed], [URIBL-BLACK: passed], [URIBL-GREY: passed]
16:10:35 [98246] Spam Checks completed.
16:10:35 [98246] Removed from SpamCheckQueue (1 queued or processing)
16:10:38 [98246] Added to LocalDeliveryQueue (2 queued; 0/50 processing)
16:10:38 [98246] Starting local delivery to bonnie@OurCustomer.com
16:10:38 [98246] Delivery for appropriates@matt.clicker-rigger.services to bonnie@OurCustomer.com has completed (Delivered) Filter: None
16:10:38 [98246] End delivery to bonnie@OurCustomer.com (MessageID: <investor.201806061646.429587@matt.clicker-rigger.services>)
16:10:38 [98246] Removed from LocalDeliveryQueue (1 queued or processing)
16:10:38 [98246] Delivery finished for appropriates@matt.clicker-rigger.services at 4:10:38 PM [id:x26340398246]

0
igorinuk Replied
Suspicious part of the headers is:
 
X-Declude-Sender: appropriates@matt.clicker-rigger.services [(our_gateway_IP_address)]
 
It should be:
 
X-Declude-Sender: appropriates@matt.clicker-rigger.services [104.255.98.238]
 
As I understand. Because 104.255.98.238 is IP of their mail server matt.clicker-rigger.services (chess.sending.services).
0
Linda Pagillo Replied
If your gateway IP is showing as the X-Declude-Sender IP, you will need to add an IPBYPASS line in your Declude global.cfg file. That will cause Declude to skip your gateway IP and look at the real sender's IP. The line you need to add will look like this..

IPBYPASS xxx.xxx.xxx.xxx (replace the xxx with your gateway IP. )
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
0
igorinuk Replied
Thank you Linda once again. As, I understand, this will affect Declude score only. Right? SmarterMail will continue to ignore RBL and Declude score and will still show "X-SmarterMail-TotalSpamWeight".
0
Linda Pagillo Replied
My pleasure Igor! If you are not using the RBLs in SM, SM will continue to ignore them. The X-SmarterMail-TotalSpamWeight line of the headers will reflect the Declude score and SM score combined if you are using any of the RBLs in SM.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
0
igorinuk Replied
We do use RBLs in SmarterMail and the header says that:

X-SmarterMail-Spam: Reverse DNS Lookup [Passed], ISpamAssassin 0 [raw: 2], SPF_None, DKIM_None, GBUDB, SORBS-RECENT, Declude: 0

So why does SmarterMail writes this:

X-SmarterMail-TotalSpamWeight: 0

?

What are possible reasons of that? Is there some list like:
1. Trusted sender
2. Whitelisted IP
3. Negative score equal to the positive score
4. ...
5. ...

?
0
Linda Pagillo Replied
Igor, it could be several different things causing this. Can you send me the SMTP and delivery log entries for a message like the one above? Also, can you send me a screenshot of your SM RBLs? Thanks.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 
0
igorinuk Replied
Linda, the delivery log is above, after the message headers (starts with "16:10:28 [98246] Delivery started for appropriates@matt.clicker-rigger.services at 4:10:28 PM"). I can email you the screenshot, but do not want to post it on this forum.
0
igorinuk Replied
I sent you an email, but please do not spend your weekend time for this. Thanks.
0
Linda Pagillo Replied
Hi Igor. I received your email. I don't mind to looking at this today. I had some free time this morning :) I responded to your email requesting a few things. Thanks.
Linda Pagillo
Mail's Best Friend
Email: linda.pagillo@mailsbestfriend.com
Web: www.mailsbestfriend.com
Authorized SmarterTools Reseller
Authorized Message Sniffer Reseller
 

Reply to Thread