Hmmm. The virus checker should happen before the mailman gets the email. So unless there is a a two layer spoof happening that is quite odd. I'll look into it. Thanks for the notice and the details.<br><br>All messages that go the "moderator" queue get deleted. since they are spam (and in French ??) and the volume is high (100+ per day) they just get deleted.<br>
<br><div class="gmail_quote">On Wed, Jul 9, 2008 at 2:41 PM, Jim Popovitch <<a href="mailto:yahoo@jimpop.com">yahoo@jimpop.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
2008/7/9 Jim Kinney <<a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>>:<br>
<div class="Ih2E3d">> The ale mail server automatically discards virus infected email. It does not<br>
> bounce any email for virus infection or undeliverable or anything.<br>
> It simply discards the chaff.<br>
<br>
</div>No it doesn't. I have a lot of proof too. :-) Here are the headers<br>
from one of many emails where ALE's Mailman is sending a response<br>
(including the viral content) back to <a href="mailto:jimpop@yahoo.com">jimpop@yahoo.com</a>:<br>
<br>
-----------------------------------------------------------------------------------<br>
>From <a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a> Wed Jul 9 02:49:08 2008<br>
Return-Path: <<a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a>><br>
Authentication-Results: <a href="http://mta234.mail.re3.yahoo.com" target="_blank">mta234.mail.re3.yahoo.com</a> from=<a href="http://ale.org" target="_blank">ale.org</a>;<br>
domainkeys=neutral (no sig)<br>
Received: from <a href="http://209.195.3.75" target="_blank">209.195.3.75</a> (EHLO <a href="http://mail.ale.org" target="_blank">mail.ale.org</a>) (<a href="http://209.195.3.75" target="_blank">209.195.3.75</a>)<br>
by <a href="http://mta234.mail.re3.yahoo.com" target="_blank">mta234.mail.re3.yahoo.com</a> with SMTP; Wed, 09 Jul 2008 02:49:09 -0700<br>
Received: from <a href="http://mail.ale.org" target="_blank">mail.ale.org</a> (localhost.localdomain [<a href="http://127.0.0.1" target="_blank">127.0.0.1</a>])<br>
by <a href="http://mail.ale.org" target="_blank">mail.ale.org</a> (8.13.8/8.13.8) with ESMTP id m699n9cd003703<br>
for <<a href="mailto:jimpop@yahoo.com">jimpop@yahoo.com</a>>; Wed, 9 Jul 2008 05:49:09 -0400<br>
Subject: The results of your email commands<br>
<div class="Ih2E3d">From: <a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a><br>
</div>To: <a href="mailto:jimpop@yahoo.com">jimpop@yahoo.com</a><br>
MIME-Version: 1.0<br>
Content-Type: multipart/mixed; boundary="===============0866748141=="<br>
Message-ID: <<a href="mailto:mailman.2492.1215596948.2190.ale@ale.org">mailman.2492.1215596948.2190.ale@ale.org</a>><br>
Date: Wed, 09 Jul 2008 05:49:08 -0400<br>
Precedence: bulk<br>
List-Id: <<a href="http://ale.ale.org" target="_blank">ale.ale.org</a>><br>
Sender: <a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a><br>
Errors-To: <a href="mailto:ale-bounces@ale.org">ale-bounces@ale.org</a><br>
Content-Length: 130484<br>
-----------------------------------------------------------------------------------<br>
<br>
In short, the spoofed email is hitting <a href="http://ale.org" target="_blank">ale.org</a>, being accepted and<br>
passed on to Mailman which is responding because <a href="mailto:jimpop@yahoo.com">jimpop@yahoo.com</a> is<br>
not subscribed. I also have a few " Your message to Ale awaits<br>
moderator approval" emails, containing URLs for the held emails.<br>
However it looks like someone has deleted those emails from the ALE<br>
moderator queue.<br>
<br>
-Jim P.<br>
<div><div></div><div class="Wj3C7c">_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>-- <br>James P. Kinney III <br>