Received-SPF: pass (Last token {mx} (res=PASS)) client-ip=46.226.110.80; envelope-from=<john@wilkes.com>; x-ip-name=mx.wilkes.com;
X-Received: from wilkes.com (mx.wilkes.com [46.226.110.80])
by netwin.co.nz (SurgeMail 7.7d) with ESMTP id 6296430-1391920
for <surgemail-list@netwin.co.nz>; Mon, 27 Feb 2023 15:41:23 +0000
X-Return-Path: john
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wilkes.com;
s=default; t=1677512483;
bh=56eTDdnKe0p4QQ02kmRfoJ4XxPJ9nj+e/zJ9NPO1YjA=;
h=Date:To:From:Subject;
b=Y6fxhERqwyeg4mWpQeGWw4wSN/1+galFu9oIMw4zfEBVki8SVhelNLg7jy48YdOrD
S14mCvify1RnXXob7yKdUxrVPoTMEvoH9PGPcXN2iKDTS0e0q8HgnKpfEmnemJdw6m
Olq5lNmaQ1mAr3jr7hx3oEQrRIvijjXoUjIFzdILOTOFr5+4m1BGAJYHKALZpYsimo
1oxdnx4UKp5n7lRxAJqmu5eeHgYpgP7nN7stsh6hUBu5eIQt4prMpyrwFOnAYvjFR2
62JfLpKphO7RUy9kky3fp2Up3Y06/HmslxdBZuTAf/fStommwqGi5GFQZImX1l5AaD
3c2aCZ8XaJT3A==
X-Default-Received-SPF: pass (skip=forwardok (res=PASS)); envelope-from=172.16.1.22;
X-Return-Path: john
Message-ID: <e65b96db-c069-37c5-5426-8c15f08a53d9@wilkes.com>
Date: Mon, 27 Feb 2023 09:41:21 -0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.7.1
Content-Language: en-US
To: surgemail-list@netwin.co.nz
References: <4328bb09-d094-67ac-3e3d-1cb98a5d437c@wilkes.com>
<CH2PR05MB6840EF5000EA50A04F92796794AF9@CH2PR05MB6840.namprd05.prod.outlook.com>
From: John Wilkes
Subject: Re: [SurgeMail List] filtering not working
In-Reply-To: <CH2PR05MB6840EF5000EA50A04F92796794AF9@CH2PR05MB6840.namprd05.prod.outlook.com>
X-X-Qnum: 13781
X-X-Authenticated-User: john@wilkes.com
X-Originating-IP: 46.226.110.80
X-Country: code=LU country="Luxembourg" ip=46.226.110.80
X-Qnum: 6296430
X-ORBS-Accept: dnswl_none
X-Rcpt-To: <surgemail-list@netwin.co.nz>
X-SpamDetect: *****: 5.2 sd=5.2 lv=6.82 nok=24/9 m=32 nf=0 Close 0.04(X-myrbl:Color=white) 0.90(X-Phrase:isspam) 0.79(X-Verify-Helo:wrongip) 0.78(X-Verify-Helo:-ERR) 0.40(genuine) 0.40(dkimok) 0.41(StandardTLD) 0.41(X-NotAscii:utf) 0.48(spfpass) 0.49(X-LangGuess:English) 0.50(dnswl_none) Sval 5.2 bsan 6.8 Moved 6.8->5.2 Sval 5.2
X-NotAscii: charset=utf-8
X-LangGuess: English
X-Phrase: IsSpam score=1.00
X-Verify-Helo: -ERR wrongip: wilkes.com -> 217.70.*.* not in 46.226.110.80
X-Dmarc: reject, from=john@wilkes.com, dkim=Good known=True spf=True
Authentication-Results: netwin.co.nz header.from=wilkes.com; dkim=pass (good signature)
X-MyRbl: Color=White Age=1827 Spam=0 Notspam=0 Stars=0 Good=344 Friend=614 Surbl=0 Catch=0 r=0 ip=46.226.110.80
X-IP-stats: Incoming Outgoing Last 0, First 1815, in=89284, out=475, spam=0 Known=true ip=46.226.110.80
List-Unsubscribe: <mailto:surgemail-list-leave@netwin.co.nz?subject=unsubscribe>
X-Mailing-List: surgemail-list@netwin.co.nz
List-ID: <surgemail-list@netwin.co.nz>
Precedence: bulk
Reply-To: surgemail-list@netwin.co.nz
Content-Transfer-Encoding: 8bit
Content-Transfer-Encoding: 8bit
I don't think so. I don't think I have a domain allow list, and
a grep for the domain name in surgemail.ini_* does not find
anything.
Other filter rules continue to work; e.g., surgemail-list email
goes into a surgemail folder, not my inbox.
On 2/27/23 9:20 AM, Jim Lohiser wrote:
John,
Is the domain, perhaps, in your allow list? If it is, the filter rule will be ignored.
Jim L
-----Original Message-----
From: John Wilkes <john@wilkes.com>
Sent: Monday, February 27, 2023 10:18 AM
To: surgemail-list@netwin.co.nz
Subject: [SurgeMail List] filtering not working
CAUTION: This email came from someone outside of the organization. Do not click the links or open any attachments unless you recognize the sender and know the content is safe.
I have a filter rule to reject email from a certain domain:
if the From header contains https://urldefense.proofpoint.com/v2/url?u=http-3A__foobar.org&d=DwIDaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=K-OlZkh8jrQ1nMVw7Viqeg&m=ftlIWCYo6r4iClCDV8jHvaVR5GEm9dvE5dn_SDUpeIM&s=pzhBteLU4xpkncLpMvNMdAaqURjh6zFuQWkbaoRRRTo&e= Reject
It is the first rule in the table, i.e. rule #0.
It is in the user's filter rules, and it is in the domain's filter rules.
Yet email from https://urldefense.proofpoint.com/v2/url?u=http-3A__foobar.org&d=DwIDaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=K-OlZkh8jrQ1nMVw7Viqeg&m=ftlIWCYo6r4iClCDV8jHvaVR5GEm9dvE5dn_SDUpeIM&s=pzhBteLU4xpkncLpMvNMdAaqURjh6zFuQWkbaoRRRTo&e= continues to be delivered.]
I recently upgraded to SurgeMail version 7.7c-1 from a truly ancient version. Filters used to work.
Any idea why the filter is apparently bypassed?
--
john@wilkes.com