What does env_From=ok mean?

Vernon Schryver vjs@calcite.rhyolite.com
Fri Jun 17 18:09:09 UTC 2005


> From: Gary Mills 

> Today, I received a phish that purported to come from service@paypal.com.
> DCC added this header line:
>
>   X-DCC-UofM-Metrics: electra 1033; env_From=ok Body=many Fuz1=many Fuz2=many
>
> The envelope sender was indeed service@paypal.com, but this address
> does not appear in any of our whitelist files, except in commented-
> out form:
>
>   #ok     env_from        service@paypal.com
>
> There are some other paypal addresses in the whitecommon file, but
> not this one.  How is this possible?  Could it somehow persiste in
> the database after being commented out in a whitelist file?  There's
> no DCC log for this message.

When was dbclean last run?  Changes to the whitecommon file do not
take effect until the next time the database is rebuilt.

Has dbclean been complaining about errors in the whitelist files?
When dbclean cannot parse them, it falls back to the the results
of last good parsing.


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.