efa-project.org

I'm having an issue that I cannot seem to resolve. I am trying to white list a domain, but under the "receiving via" it has the server/ip consistently of the server in which this email is being "sent on behalf of" and the originating, forwarding server. The forwarding server changes every time (as its origin is from different email addresses) but the sending server is always the same.... I'm not sure if it makes a difference, but the "from" is always completely blank under the efa quarantine tab. Once the message is manually released it does have a sender like a normal email. All the messages are tagged as high scoring spam.

I have whitelisted the ip address of 216.135.74.38 to default but they continue to be tagged as high scoring spam... I'm guessing because the originating server changes, I'm not sure how I can continually whitelist these. The only two consisteny things about all emails is the first listed sending server (216.135.74.38 mail.fastironlist.com) and an apparent injection in the subject line of "[equipment]" and the rest changes.

The example below are actual copy/paste from two different emails. Any help is appreciated!

EXAMPLE 1

216.135.74.38 mail.fastironlist.com (GeoIP Lookup Failed) [ ] [ ] [ ] [ ]
68.99.120.39 dukecmfep04.coxmail.com (GeoIP Lookup Failed) [ ] [ ] [ ] [ ]


EXAMPLE 2

216.135.74.38 mail.fastironlist.com (GeoIP Lookup Failed) [ ] [ ] [ ] [ ]
68.99.120.40 dukecmfep05.coxmail.com (GeoIP Lookup Failed) [ ] [ ] [ ] [ ]

I think it would be helpful if copy and paste the "Spam Report" part (Score and Matching Rule) of the email.

Message Listing


#

Date/Time (A/D)

From (A/D)

To (A/D)

Subject (A/D)

Size (A/D)

SA Score (A/D)

Status

[ ] 04/12/14 06:00:58 postmaster@centraliowafarmstore.com todd@centraliowafarmstore.com [equipment] Want to move- NH 835TL Loader- Fits T6000 tractors (4 Cylinder only) 6.6Kb 0.00 W/L
[ ] 04/12/14 06:00:40 postmaster@centraliowafarmstore.com todd@centraliowafarmstore.com [equipment] Wanting to move- 3 sets of front mounting brackets (fits TD95D Tractors)- One set of front & rear mounting brackets (fits TD5050 Tractor) 6.7Kb 0.00 W/L
[ ] 02/12/14 14:25:30 todd@centraliowafarmstore.com [equipment] Wanting to move- 3 sets of front mounting brackets (fits TD95D Tractors)- One set of front & rear mounting brackets (fits TD5050 Tractor) 6.9Kb 7.00 Spam
[ ] 02/12/14 14:22:58 todd@centraliowafarmstore.com [equipment] Want to move- NH 835TL Loader- Fits T6000 tractors (4 Cylinder only) 6.9Kb 7.00 Spam
[ ] 02/12/14 07:00:43 postmaster@centraliowafarmstore.com todd@centraliowafarmstore.com [equipment] L230 2 Speed E-H Controls or L225 4.3Kb 0.00 W/L
[ ] 02/12/14 07:00:29 postmaster@centraliowafarmstore.com todd@centraliowafarmstore.com [equipment] Equipment Available 20.4Kb 0.00 W/L
[ ] 01/12/14 13:52:00 todd@centraliowafarmstore.com [equipment] Equipment Available 20.7Kb 7.00 Spam
[ ] 01/12/14 12:22:28 todd@centraliowafarmstore.com [equipment] L230 2 Speed E-H Controls or L225 4.5Kb 7.00 Spam

above is a copy / paste of the first few... you can see I've manually released a few... I generated the report using "the subject contains [equipment]" since that is one of the few things that is consistent about it

Sorry can't see spam report

To see the report you have to click on [ ] under the # in the first column. You should't write real email addresses in a forum.

Feel free to PM me. I need to see your spam report to understand the issue completely.