On 11.03.08 17:26, JDavila@languageworks.com wrote:
> Here is the full header. But also the local.cf has around 12000 entries,
> is that a problem.


WHAT? 12000 entries? What the hell are you doing with that?

> Received: from smtp1.citigroup.com ([199.67.179.116]
> helo=mail.citigroup.com)
> by nyclns01.languageworks.com with esmtps
> (TLSv1:AES256-SHA:256)
> (Exim 4.66)
> (envelope-from )
> id 1JZ4xk-0008OC-Om
> for BHyatt@languageworks.com; Tue, 11 Mar 2008 09:56:25
> -0400


[...]

> 4.0 SARE_FORGED_CITI Message appears to be forged,
> (citibank.com)


I wonder why it matches SARE_FORGED_CITI when it was received from
smtp1.citigroup.com. I personally doesn't use SARE so I can't comment it,
but it looks problematic.

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Chernobyl was an Windows 95 beta test site.