Received-SPF: pass (Last token {a:dispatch-us.ppe-hosted.com} (res=PASS)) client-ip=67.231.154.164; envelope-from=<JimL@n2net.com>; x-ip-name=dispatch1-us1.ppe-hosted.com;
X-Received: from dispatch1-us1.ppe-hosted.com (dispatch1-us1.ppe-hosted.com [67.231.154.164])
by netwin.co.nz (SurgeMail 7.7d) with ESMTP (TLS) id 6295981-1391920
for <surgemail-list@netwin.co.nz>; Mon, 27 Feb 2023 15:20:05 +0000
X-Return-Path: JimL
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=n2net.com;
h=content-transfer-encoding:content-transfer-encoding:content-type:content-type:date:date:from:from:in-reply-to:in-reply-to:message-id:message-id:mime-version:mime-version:references:references:subject:subject:to:to;
s=selector-1653076095; bh=HgnaK90d07SHrvWYxGjI1kBwVHlyGmLbPYgo/Xgxwuk=;
b=n1txSsjttB20kyyTklpoOazd+oJ9VBwOIuWIfsMv4XsMpi8vsd5ukjKp1aic9LgOoXUOUr/khZboEOCL1WxMBtergbM6sFxFrhz5DopAMnayu/xfa37TS2zVtzhV2M+4yhSQlSdfNt1xaVDdLQxxOP/tqIoxzmmuEXtJkvjBkvSGkmjzO2dxNOM+RSUXRogSzAe6lbsB7WF6uX3GvoyBjZOrtZz7/ij1cx+eWG54c5N4MgW8VmxZInGKxb7WZc76XnnEk8xLiIyXjjDFWw6Mm2RyRnRWjI03qG+4TEOIRyppSYIhYtNIAGjA6gOskcT2DlIF5ff3pOiCT0pDyaMLPw==
X-Virus-Scanned: Proofpoint Essentials engine
X-Received: from MW2PR02CU002-vft-obe.outbound.protection.outlook.com (mail-westus2azlp17013038.outbound.protection.outlook.com [40.93.10.38])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1-us1.ppe-hosted.com (PPE Hosted ESMTP Server) with ESMTPS id BEC3A8C006C
for <surgemail-list@netwin.co.nz>; Mon, 27 Feb 2023 15:20:03 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=gtp2R/GMLto2UkFqw627iMNAJpECPg5imnwUZE/HcRV1vjyz/e4MRZwIPF52bMWvLXEFj/vd5J6yzjjbLAiyyP0WkvtII9RnwrXM9RvFlWXrEiOqRkybBqLZU9MkYmypmXlTHTSwtRktOdCYvuKQt9Rd83WRDTCnrp6dy0mFolEhtnEP9bCUK+BueG0/RWXBezHpUHeuehY7v/RaePh43V4RJTpuQXQVX3/bM+6KCwZYSxiX5j5le1h4ly8awK47Vb+7zpjWZFtO8sZhgbz5wws/d63K4iQn2Ij5Rb5HGqs3AJsZ2Tc+6uIYXdYbaLNjbu13chkj/B6czalPCbdFsw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=HgnaK90d07SHrvWYxGjI1kBwVHlyGmLbPYgo/Xgxwuk=;
b=cRq8S7Knam4dEo/dU5Wu2N563MY5Bx/cNCGqlOhtelRW/DTRtkglkUazn0GuQXjdL6P80NFUeIT58HdUZaUCxWmWzl+c9sPo3o0SW1nQWCvEnGXe8omjEY0azXXUDqq+5cBcHoxloMOWETo2KnfNJoCxPd9+jbPiZ+Lnqr5Ozn64UiE4VeKqSat4CYPFWJeFnedpQjOKRd2+YnsEeOI56IXal2qOiSERuWDoFwzSQrELPFzU3qpdyKps4FYTmohLCJF+yBRBYCqbK8s3n0frQEDgAN2WSMx4A/GBcpx5u4R0+JoNmblCJg1ChHeZn+jPkJJPnMmzyHGcKCuW1FrwvA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=n2net.com; dmarc=pass action=none header.from=n2net.com;
dkim=pass header.d=n2net.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=n2nettenant.onmicrosoft.com; s=selector1-n2nettenant-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=HgnaK90d07SHrvWYxGjI1kBwVHlyGmLbPYgo/Xgxwuk=;
b=2bPx2LjX1v6iFZMAOeMKT/h5Sfy1rO5jioZg2qB80ya6B4yBP/G3yEundrpCx1Ohaznk42lttS52nE4cWCDnx+LbqIbL3PfS4Gi9FcuH0GmHb4X4/mbFYxCi8EOOc/As1qsbksukb1biLGvdXhVQGRYxKsFx/Mp4GGGb2y2/T6g=
X-Received: from CH2PR05MB6840.namprd05.prod.outlook.com (2603:10b6:610:7::10)
by BN6PR05MB3601.namprd05.prod.outlook.com (2603:10b6:405:45::38) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6134.21; Mon, 27 Feb
2023 15:20:00 +0000
X-Received: from CH2PR05MB6840.namprd05.prod.outlook.com
([fe80::34b6:1d34:a76c:1495]) by CH2PR05MB6840.namprd05.prod.outlook.com
([fe80::34b6:1d34:a76c:1495%6]) with mapi id 15.20.6134.025; Mon, 27 Feb 2023
15:20:00 +0000
From: Jim Lohiser
To: "surgemail-list@netwin.co.nz" <surgemail-list@netwin.co.nz>
Subject: RE: [SurgeMail List] filtering not working
Thread-Topic: [SurgeMail List] filtering not working
Thread-Index: AQHZSr6xcM0GiEBfn0aUPR9B9pQ2da7i6Ceg
Date: Mon, 27 Feb 2023 15:20:00 +0000
Message-ID:
<CH2PR05MB6840EF5000EA50A04F92796794AF9@CH2PR05MB6840.namprd05.prod.outlook.com>
References: <4328bb09-d094-67ac-3e3d-1cb98a5d437c@wilkes.com>
In-Reply-To: <4328bb09-d094-67ac-3e3d-1cb98a5d437c@wilkes.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
X-authentication-results: dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=n2net.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CH2PR05MB6840:EE_|BN6PR05MB3601:EE_
x-ms-office365-filtering-correlation-id: 21fbafdf-d7da-405c-109f-08db18d617aa
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
bmZITG4IJdVNBwG89OYbp0KUw+R0Q1CGFRLXmr80C+kVXAGpHFO1qbNhtllo6PJmAtDoyJ8daKjl4I1CJmXpKxxSebUJiA2kkle3UXI+XZoBi3KUAe+LvkHK4yLQw3rI1vjiRhtqUlUF6xSSPnuVXOl3QHY3jrblo/gBdINmueJf5YTbbJpNIoTpTnKVmcyA4+ZUD+AOTFUsKPwxRQq5CPJKKNvZ344DCnzEZYzJz1UID+jvtjhM8Xu+AdXKqWLeoq0UoXKx3/eHKA0yEnoc4I+2FcpOYIjNpjvfWWpLtlRaOgwKzsffCDljRCTp7ePYwZAY6iw4tr3i0eeCSh7gc75SZKp/IoYey853pmy7BRsrBLBBjLeSDtwhhL9uUAD6XWhI3RdOLVPiXcl0/cHjH3Ire9Kyl4ZDKjAGLoXxOYbJYDCQrHk8rLN71oCDYS31FfYrWXPodh2/F/liiGDyKUCTy0i7dkhwqBvZSQHBs8jAKG4F6/w7WWOPm+9Jcv0wptzS/lmCnofjpGoqhYZyvKDy0jV+Fi35/U7/H+R/nWLr27JawqpPxG2YqM+cTBCr7DP4FY+lgPIQC5D7COJW1L7V9lMUtLHxgqLry65ClcZR04Ajv1hziXJaj9nR88Oxab0w7RU4XVKSVIcurRxxr1q4j3ZAQ+slQ4eOcB2pVlqGD7XqOoeI8cnlu9gIHq25
x-forefront-antispam-report:
CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR05MB6840.namprd05.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230025)(136003)(346002)(366004)(376002)(39830400003)(396003)(451199018)(26005)(316002)(8936002)(41300700001)(5660300002)(186003)(8676002)(33656002)(86362001)(52536014)(2906002)(66446008)(9686003)(6916009)(83380400001)(76116006)(55016003)(66556008)(966005)(122000001)(71200400001)(7696005)(478600001)(53546011)(64756008)(38070700005)(6506007)(66476007)(66946007)(38100700002);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?utf-8?B?ZmlsZHRrNW5vektYY05weTR1MWNJb1pQTEVISW1ZQXdxTWRzOURNZUZody9v?=
=?utf-8?B?Z0I2SEZvTGNKZHpzVnluQTdJRndVNmNIaU5HaG55dVAyVkFYYzBGQStMdklp?=
=?utf-8?B?Sm9HYnVNV1I4U1pVcGdreXlPck9vWG9RSjN5VTZCcjh1RGo0N1NIRC9lV0dr?=
=?utf-8?B?MEU1QmRVV01WOXlXQXNaYlYvZkFzb09vKzQwbGJPS3R1YTVHQWw1MnVTa2Zn?=
=?utf-8?B?N3ZySU1Eb1UydXY3QjFyNzI5MXo5QTlIK1hkUUhmTzAzNkJmM1JWc0Z0T0o4?=
=?utf-8?B?aWtRR2pIQWJHZTZLTSthb0dhRS9kQm9lQVdCV0M0UnFGYTFlSDhxVnFWdFd6?=
=?utf-8?B?MDZ1a2xQbUNQbEh0M2V3L1YyM0loa25lMDZvcDlnT0NTS3JadmpuV2k2QU9Z?=
=?utf-8?B?dEpXYnJlQmpkbkRSekUxaXJpQ0FoRVFHR2xTeGJRUzNFbkxlQWV0UUdySCtU?=
=?utf-8?B?WXhHaGpiZ2czVkk1aW1QQ3pHTmt0amxUYmU3ZXlTNExFdXJvRTNIS0podVVF?=
=?utf-8?B?bkJBVi9yVTRjZldDVzBMcTYwaWYvcnA0Q0tSbE9BYUp0OGU2dWVoNnF4aEtI?=
=?utf-8?B?OEdPcm9SbGUyRmNzMTF3MXhyZVI5bWlxMXlJT241QnJOV1NaWlIxd1dubERO?=
=?utf-8?B?N0FicW84SU52MCtrQmo5UHlvT0ZQRWN6SktsWUwzVUE4aFhwckwrVXZRUkIw?=
=?utf-8?B?Q2hkV2Y3Q0o2bHgrcWNZU1BLME53NFptR0NuMDM0TTZaMmFiejIrcWlYeEhB?=
=?utf-8?B?cDdtdjJPMk1wWTIzbWZEVm1VdTZEb0NMaWJyNzl0L0lXY2R5aWowOVlmRVF3?=
=?utf-8?B?bDdXMkt6L0RCa1BrNHVmTGVHVk5xT1hlL1dOV3l6ME9SWmEvRUNqTmZ2dkJY?=
=?utf-8?B?dThUMlEvTkNoeU0zSGJ5ZTZNL1RkZUxvSHRiQjhvVXAxSEp4Y0lCTncrRG1K?=
=?utf-8?B?QzRjWGZpK2V6ZlBXNXJyMmI2QVAzblplYXJIT3JDdEIwbzNhcGkrUVhQNHJN?=
=?utf-8?B?OW1KSEtxcFRtLzBZQXE0SkZmSlpUcjlLMVF4YmxDNUFqeGNVUE1qdlFBTG9N?=
=?utf-8?B?TG43dTROK25YaFZqUkd1aGUxM2piS3BxaE9TMGtxaXJyZ1NFNHNXeUJEUlpn?=
=?utf-8?B?QVozL0pqUnhJL21NQStaQnpQTGtiNDU5ZnJKWHNIWVFxZHRyNnFCM2lBeDFq?=
=?utf-8?B?YVBtYnVBNFZuL3ZrY2ZCc1dWQlA2cm8rWXA0VGt3dHRCd003WWZOTlo3a2xl?=
=?utf-8?B?amF3UFh3VnN1S1dSMUlJUnRoSDNvNTNuSE5ZcFVhazh5d203S3pZUDA3YWNr?=
=?utf-8?B?cTNNUlhld3ROa2xoNjhpL1JEU3VCaUhLL21taUIzd3VFWTlGN1VXTm9nUEpS?=
=?utf-8?B?Smt4TDBHMHpsdGxacEk1ME8vREp5c2I4MmcxSjg1NEdhS091RU5tMFJZSU0v?=
=?utf-8?B?amtSQzF5blpHZ3Z2ZXR2ZGdZb25Yc2dUYW9JYWhBeno0OFZ1ei82Mk5HdnV2?=
=?utf-8?B?alVOOUVHeTJiUDVxNHo2LzR4Zi80TnhzK1QxdXBIMUtzeXZRS2trRW5PZloy?=
=?utf-8?B?ZEd3NXVsak8vMWFOTkZTWXVNbjVnOWZ4WWNZcDZCeGgwRjNLU3ZvR0oybjJY?=
=?utf-8?B?eUxpLzMwN25OUEdEOGNMN05ndkNibEZDOEl6R2xJS2V4YTNLVjZ3a0ZKbks5?=
=?utf-8?B?Y0xETzN4MzNZa282c2o1cE1wM3BaY3VNUUgzUlZiWTBzaVd1MVdhUjJ3OXdt?=
=?utf-8?B?ZUFNOHdBL1dEazVQaW1QTlA0Q0tUWVhsVUtmS3FRN2JINDlvSlhaYlpZTWQr?=
=?utf-8?B?MGlVVE1adGs4Z3BxaGhYYjR1Mm04Z2dQekVtNHFVcmpGQzNUUjF1NXJjQ1NS?=
=?utf-8?B?Qkc1STc0NmRtbld3Zk5Lb0hUb0o4MjNEdzZYR3FGT1MrVE9OREVhZjloeDZU?=
=?utf-8?B?YkVGOGxabm1hRGgzaTY3SzBNeDQ2TC8wRGtTUDNVdklZWE5BK1RNVGwyOFQ4?=
=?utf-8?B?TkJCUEh1aXgzSW93bmg3ZExRMVoxMy9xNVhJTGhKWlo3Q0lmZ2MzZnBhNGxW?=
=?utf-8?B?RHZMNmliazN5MW02amFvQkozWnU3em1zTTFsT0xqWlRrNUZvMFVZeFZwSVpK?=
=?utf-8?Q?5Qi097u6+HpjX6No9DIVnA9f8?=
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: n2net.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR05MB6840.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 21fbafdf-d7da-405c-109f-08db18d617aa
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Feb 2023 15:20:00.1990
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 509ad38e-1591-4f89-8aa7-cb7bc8ef1dba
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: /S9L1cItmDSGfc8Z9WTn77wDzrzvhKSmYM0YQJGCzgQAbZHmrhYECrmewUGBLCQTye5BjPUIP5B/AXSFHQV9oQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR05MB3601
X-MDID: 1677511204-AIWptRn7zqfA
X-MDID-O: us1;at1;1677511204;AIWptRn7zqfA;<JimL@n2net.com>
X-Originating-IP: 67.231.154.164
X-Country: code=US country="United States" ip=67.231.154.164
X-Qnum: 6295981
X-ORBS-Accept: hostkarma_white, hostkarma_quitok
X-Rcpt-To: <surgemail-list@netwin.co.nz>
X-SpamDetect: *******: 7.2 sd=7.2 NoRule 0.04(X-myrbl:Color=white) 0.90(X-Phrase:isspam) 0.87(Whole message is base64 e) 0.87(three_words) 0.79(X-Verify-Helo:wrongip) 0.78(X-Verify-Helo:-ERR) 0.40(genuine) 0.40(dkimok) 0.41(StandardTLD) 0.41(X-NotAscii:utf) 0.48(spfpass) 0.49(X-LangGuess:English) Saned 5.0 sanityx 7.2 Moved 5.0->7.2 Sval 7.2
X-NotAscii: charset=utf-8
X-LangGuess: English
X-Phrase: IsSpam score=1.00
X-Verify-Helo: -ERR wrongip: dispatch1-us1.ppe-hosted.com -> 148.163.*.* not in 67.231.154.164
X-Dmarc: quarantine, from=JimL@n2net.com, dkim=Good known=True spf=True
Authentication-Results: netwin.co.nz header.from=n2net.com; dkim=pass (good signature, Wrong Domain? sender=JimL@n2net.com; signer=n2nettenant.onmicrosoft.com;)
X-Encryption: SSL encrypted
X-MyRbl: Color=White Age=2015 Spam=140 Notspam=553 Stars=14222 Good=672429 Friend=1439343 Surbl=327 Catch=10 r=0.0013 ip=67.231.154.164
X-IP-stats: Incoming Last 6, First 7, in=2, out=0, spam=0 ip=67.231.154.164
List-Unsubscribe: <mailto:surgemail-list-leave@netwin.co.nz?subject=unsubscribe>
X-Mailing-List: surgemail-list@netwin.co.nz
List-ID: <surgemail-list@netwin.co.nz>
Precedence: bulk
Reply-To: surgemail-list@netwin.co.nz
John,
Is the domain, perhaps, in your allow list? If it is, the filter rule will be ignored.
Jim L
-----Original Message-----
From: John Wilkes <john@wilkes.com>
Sent: Monday, February 27, 2023 10:18 AM
To: surgemail-list@netwin.co.nz
Subject: [SurgeMail List] filtering not working
CAUTION: This email came from someone outside of the organization. Do not click the links or open any attachments unless you recognize the sender and know the content is safe.
I have a filter rule to reject email from a certain domain:
if the From header contains https://urldefense.proofpoint.com/v2/url?u=http-3A__foobar.org&d=DwIDaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=K-OlZkh8jrQ1nMVw7Viqeg&m=ftlIWCYo6r4iClCDV8jHvaVR5GEm9dvE5dn_SDUpeIM&s=pzhBteLU4xpkncLpMvNMdAaqURjh6zFuQWkbaoRRRTo&e= Reject
It is the first rule in the table, i.e. rule #0.
It is in the user's filter rules, and it is in the domain's filter rules.
Yet email from https://urldefense.proofpoint.com/v2/url?u=http-3A__foobar.org&d=DwIDaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=K-OlZkh8jrQ1nMVw7Viqeg&m=ftlIWCYo6r4iClCDV8jHvaVR5GEm9dvE5dn_SDUpeIM&s=pzhBteLU4xpkncLpMvNMdAaqURjh6zFuQWkbaoRRRTo&e= continues to be delivered.]
I recently upgraded to SurgeMail version 7.7c-1 from a truly ancient version. Filters used to work.
Any idea why the filter is apparently bypassed?
--
john@wilkes.com
|