[Mimedefang] Messages that slip through access db

Fri Oct 18 10:04:01 EDT 2002

Thanks Jeff.  So the From: header is the so-called "envelope from" whereas
the Return- Path: is the real From:?  I did see that earlier, so I added
theoffers.com.  But for future reference, I should be looking at the
Return-Path?  Is this all in RFC 821, Simple Mail Transfer Protocol?

Cheers,

Stefano

-----Original Message-----
From: Jeff Grossman [mailto:jeff at stikman.com] 
Sent: Friday, October 18, 2002 9:03 AM
To: mimedefang at lists.roaringpenguin.com
Subject: RE: [Mimedefang] Messages that slip through access db

> -----Original Message-----
> From: mimedefang-admin at lists.roaringpenguin.com [mailto:mimedefang-
> admin at lists.roaringpenguin.com] On Behalf Of Stefano McGhee
> Sent: Thursday, October 17, 2002 10:26 AM
> To: mimedefang at lists.roaringpenguin.com
> Subject: RE: [Mimedefang] Messages that slip through access db
> 
> Hello all,
> 	Thanks for the ideas.  I restarted sendmail anyway, but I was
under
> the impression, like most of you, that I didn't have to restart it.  I
DID
> rebuild the database though i.e. makemap hash access < access.  No
change
> though.  The envelope headers are an interesting thought though.
Here,
> take a look at this example that got through...
> 
> Microsoft Mail Internet Headers Version 2.0
> Received: from galactica.arcweb.com ([63.111.209.16]) by
apollo.arcweb.com
> with Microsoft SMTPSVC(5.0.2195.5329);
> 	 Thu, 17 Oct 2002 02:25:31 -0400
> Received: from suitemail.theoffers.com ([216.52.222.109])
> 	by galactica.arcweb.com (8.12.6/8.12.6) with SMTP id
g9H6SMPX027971
> 	for <achatha at arcweb.com>; Thu, 17 Oct 2002 02:28:24 -0400

You could either use "theoffers.com" in your access.db or read below.

> Message-Id: <200210170628.g9H6SMPX027971 at galactica.arcweb.com>
> Date: Wed, 16 Oct 02 20:45:03
> From: "Insurance Shopping Network" <info at virtualoffers.net>
> To: achatha at arcweb.com
> Subject: Are you paying too much for insurance?
> MIME-Version: 1.0
> X-Mailer: IES v1.1002.10129150
> Reply-To: r.1810.10129150 at q.suitemail.theoffers.com
> Content-Type: multipart/alternative;
> 	boundary="=_3bd668d5da3d5201829258b1b1159088"
> X-Spam-Status: No, hits=10 req=10
> X-Scanned-By: MIMEDefang 2.21 (www . roaringpenguin . com /
mimedefang)
> Return-Path: n.1810.10129150 at q.suitemail.theoffers.com

Or, you could use, I guess the same thing.  The above line is the actual
FROM header in the SMTP transaction.  The other FROM line is just
cosmetic.

> X-OriginalArrivalTime: 17 Oct 2002 06:25:31.0270 (UTC)
> FILETIME=[FE15F260:01C275A5]
> 
> --=_3bd668d5da3d5201829258b1b1159088
> Content-Type: text/plain; charset="iso-8859-1"
> Content-Transfer-Encoding: 7bit
> 
> --=_3bd668d5da3d5201829258b1b1159088
> Content-Type: text/html; charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
> 
> 
> --=_3bd668d5da3d5201829258b1b1159088--
> 
> -----Original Message-----
> From: Paul Norton [mailto:Paul_Norton at nacm.com]
> Sent: Thursday, October 17, 2002 12:06 PM
> To: mimedefang at lists.roaringpenguin.com
> Subject: RE: [Mimedefang] Messages that slip through access db
> 
> 
> Hmmmm...I don't have to restart sendmail for access.db changes to take
> effect. I just have to rebuild the database.
> 
> -----Original Message-----
> From: Stefano McGhee [mailto:SMcGhee at arcweb.com]
> Sent: Thursday, October 17, 2002 8:55 AM
> To: mimedefang at lists.roaringpenguin.com
> Subject: RE: [Mimedefang] Messages that slip through access db
> 
> 
> No way!  I was under the impression that restarting sendmail was
unecessary
> and that the changes were near realtime.  Well, if that's it, that
will fix
> it.  <DUH> on me...
> 
> Cheers,
> 
> Stefano
> 
> -----Original Message-----
> From: Jason Abbott [mailto:teljanin at uga.edu]
> Sent: Thursday, October 17, 2002 11:52 AM
> To: mimedefang at lists.roaringpenguin.com
> Subject: Re: [Mimedefang] Messages that slip through access db
> 
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Silly question; but did you restart sendmail?  You have to restart
sendmail
> 
> after making any new db maps for them to take effect.
> 
> On Thursday 17 October 2002 11:40 am, Stefano McGhee wrote:
> > Hello all,
> > 	A question about something related to recent converstaions.  I
use
> > the access db to block domains that send us spam in addition to
using
> > SpamCop.  For instance, I have
> >
> > virtualoffers.net               ERROR:"550 Domain explicitly denied"
> >
> > in my access file, but I still get mail from this at virtualoffers.net
or
> > that at virtualoffers.net from time to time.  I have saved the file and
also
> > done makemap after saving it.  Any ideas on why that might be
happening?
> >
> > Cheers,
> >
> > Stefano
> >
> > _______________________________________________
> > MIMEDefang mailing list
> > MIMEDefang at lists.roaringpenguin.com
> > http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
> 
> - --
> Jason Abbott
> Productions Systems Support
> Enterprise IT Services
> University of Georgia
> - ---
> >SELECT * FROM users WHERE clue > 0
> 0 rows returned
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> 
> iD8DBQE9rtyUIrgbYNoVY7YRAlK/AJ9sDyvNytakldAhsf/eYmaZPOdDmgCgnt4p
> TgwEgtFPjN703xhsooQlwQA=
> =f1fH
> -----END PGP SIGNATURE-----
> 
> 
> _______________________________________________
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
> 
> _______________________________________________
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
> 
> _______________________________________________
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
> 
> _______________________________________________
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

_______________________________________________
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang