How to choose a CRM system

[jpatten]

Does anyone have any idea why hundreds of messages with the header below are slipping through Spamcop, please. I cannot even blacklist it using the return path.

Regards

John

"Return-Path: <sales[at]accknowledge.co.uk>

Delivered-To: spamcop-net-tabcrest[at]spamcop.net

Received: (qmail 20161 invoked from network); 20 May 2004 18:41:58 -0000

Received: from unknown (192.168.1.101)

by blade4.cesmail.net with QMQP; 20 May 2004 18:41:58 -0000

Received: from he103war.uk.vianw.net (195.102.244.134)

by mailgate.cesmail.net with SMTP; 20 May 2004 18:41:57 -0000

Received: from [62.249.219.52] (helo=olympic-catering.co.uk)

by he103war.uk.vianw.net with esmtp (Exim 4.04)

id 1BQrsh-0000uG-00

for vpatten[at]tabcrest.co.uk; Thu, 20 May 2004 19:03:07 +0100

Received: from mail pickup service by olympic-catering.co.uk with Microsoft SMTPSVC;

Wed, 19 May 2004 17:31:57 +0100

thread-index: AcQ9tB77MxOHHBOOT7idfVhdZjiocw==

From: "Sales" <sales[at]accknowledge.co.uk>

To: <PWormley[at]NSPCC.org.uk>,

<andrewrichardson[at]1bigselfstore.com>,

etc etc etc

"IMB Recipient 290" <mspop3connector.sandco[at]SANDERSONS.CO.UK>

Cc: <simon.pullum[at]randomorder.co.uk>,

<matt[at]randomorder.co.uk>

Content-Transfer-Encoding: 7bit

Subject: How to choose a CRM system

Message-ID: <001801c43dbe$cc0f1e80$3466a8c0[at]olympiccatering.local>

Date: Wed, 19 May 2004 17:31:54 +0100

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0001_01C43DB5.26FE2020"

X-Priority: 3 (Normal)

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook, Build 10.0.2627

Importance: Normal

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0

X-Virus-Scanned: by AMaViS 0.3.12

Content-Class: urn:content-classes:message

Priority: normal

X-UIDL: ZFjytxGbh8MGt9QKPdc0

X-OriginalArrivalTime: 19 May 2004 14:58:32.0463 (UTC) FILETIME=[C0B241F0:01C43DB1]

X-Sender-Verify: sales[at]accknowledge.co.uk could not be verified

X-Virus-Scanner: This e-mail has been scanned by VIA NET.WORKS UK Managed Anti-Virus service powered by Sophos. Message ID: *1BQT7S-0006wc-00*YXzhxey.FFE*

X-Sender-Verify: sales[at]accknowledge.co.uk could not be verified

X-Filtered: 1BQrsh-0000uG-00 filtered by he103war.uk.vianw.net

X-Filtered: 1BQrsh-0000uG-00 filtered by he103war.uk.vianw.net

X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4

X-spam-Level:

X-spam-Status: hits=0.3 tests=CLICK_BELOW,HTML_70_80,HTML_FONTCOLOR_UNKNOWN,

HTML_LINK_CLICK_HERE,HTML_MESSAGE version=2.63

X-SpamCop-Checked: 192.168.1.101 195.102.244.134 62.249.219.52

This is a multi-part message in MIME format."

[Wazoo]

X-SpamCop-Checked: 192.168.1.101 195.102.244.134 62.249.219.52

says that the parse went all the way to the alleged source, which isn't currently listed in tthe BL

Query bl.spamcop.net - 62.249.219.52

DNS error: 62.249.219.52 is no-dns-yet.enta.net but no-dns-yet.enta.net has no DNS information

62.249.219.52 not listed in bl.spamcop.net

SpamCop has no record of this system

195.102.244.134 is also not listed, so there's no reason to suspect "spam" based on source.

No one here can verify your filtering setups, so you might have to describe something in a bit more detail.

Does anyone have any idea why hundreds of messages with the header below are slipping through Spamcop, please. I cannot even blacklist it using the return path.

Are you suggesting that the hundreds of these are arriving with the "same" headers, addresses, etc? In general, trying to blacklist on an e-mail address like this is a lost cause, as most spammers use forged data in these blocks.

Noting that none of the IPs are listed, are you reporting any of them? One would think that if you're seeing 'hundreds' . there'd be other folks getting them (and reporting them) also ..?? But that the BL details make the statement "has no record" suggests that no one has reported these.

Am curious as to the lines that say SpamAssisin checked, but no level assigned. But once again, no way to tell from here as to whther you've got any of these filters in place or not.

[jpatten]

I have added "sales[at]accknowledge.co.uk" to my personal blacklist & am using the Spamcop, SPEWS, DSBL, Spamhaus & SORBS DNS blacklists.

Others are also receiving the messages & are starting to bounce them back to everyone else, causing mayhem.

I am also curious about the Spamhaus report. It almost seems as though something is telling Spamcop or whoever not to check the message.

[Wazoo]

OK, help me out here .... You posted this in the Forum for folks using the SpamCop Filtered E-Mail account .... but your last post seems to suggest that you're talking about your own server not filtering these things. This is whole different spin on the question / answer thing ... perhpas this needs to be moved over into the Help Forum?

[StevenUnderwood]

Wazoo: All of the lists he is using are available with the filtered email system. I believe he is using the email system also becuase the headers:

X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4

X-spam-Level:

X-spam-Status: hits=0.3 tests=CLICK_BELOW,HTML_70_80,HTML_FONTCOLOR_UNKNOWN,

HTML_LINK_CLICK_HERE,HTML_MESSAGE version=2.63

X-SpamCop-Checked: 192.168.1.101 195.102.244.134 62.249.219.52

are included in the message headers.

The SpamAssasin did check the message and came up with a 0.3 score, so the X-spam-Level: is 0 (blank)

jpattem: The fact that the personal blacklist is not working here is confusing unless there is a typo (hidden character or space somewhere) in the setting. Is your blacklist entry all in lower case? That has been a problem in the past. Perhaps if you delete and redo the blacklist entry.

Also, does the original have the " character before the Return-Path: as in your post? That could cause problems as the scanner is only looking for certain strings and by RFC the " should not be there. I an unclear (from JT) whether the white and black lists look only at the Return-Path: or if they look at the From: entry as well. Clearly, in this case both entries match what you claim is in your blacklist.

"Return-Path: <sales[at]accknowledge.co.uk>

From: "Sales" <sales[at]accknowledge.co.uk>

I am also curious about the Spamhaus report.

I don't know which Spamhaus report you are talking about. All of the X- headers except for X-spam and X-Spamcop are ignored by spamcop.

It almost seems as though something is telling Spamcop or whoever not to check the message.

It could be that the scanner only scans for the Return-Path and becuase it is not RFC compliant, the match does not work. If that " is not in the original message headers, JT should be contacted about this to see if he can figure out why things are not matching.