[Mimedefang] How can I tell WHY this was rejected?

[Craig Green]

Lisa Casey wrote:

>
> Is there any way I can figure out WHY mimedefang is rejecting this 
> e-mail so I can tell my user what he can change to keep this from 
> happening again?


The graphdefang sub probably isn't quite meant to be used for this, but 
it's convenient for dumping info to the maillog.  Put it in the filter 
just after you test to see if the hits are greater than the required_hits.

 From your code:

----------------

if ($hits > 6.0) {

               md_graphdefang_log('spam', "$hits/$req:$names:", 
$RelayAddr);  # Log hits and test names to maillog

               return action_bounce("Suspected spam - blocked Please 
contact Netlink 2000, Inc.");

----------------

You end up with a line like this:

Apr  4 00:01:42 blahblah mimedefang.pl[58095]: 
MDLOG,j3441dMH064785,spam,22.254:DCC_CHECK,DIGEST_MULTIPLE,MSGID_DOLLARS,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,URIBL
_AB_SURBL,URIBL_JP_SURBL,URIBL_MP_RHSBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SBL_XBL,URIBL_SC_SURBL,URIBL_WS_SURBL:,
199.212.134.9,<mhornus at wxs.nl>,someone at sample.com,Astounding Opportunity 
with options.

I also log ham, and have a script which will go through the maillog 
finding things like average scores for ham/spam, common tests and so on.

Craig.
------