Scott, Correct I have not added/removed any gateways or backup mailservers, changed any IP's for DNS or changed a DNS responsibility.
What I'm seeing in spam lately is that it looks more legit than in the past. Usually a piece of spam will fail at least one of our tests. like a RFC problem, a bad reverse, etc... It just seems like that recently the spam we've been getting is clean. Which makes it hard for declude to block it when it passes all of the rules. Greg -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, September 02, 2003 11:01 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] More and more email getting past Declude >I doubt it's a setup issue because I'm using the same setup that I've used >for a year now. Also I am not the only one receiving more spam.. All of my >users are as well... So in the past year, you haven't added/removed any gateways or backup mailservers, haven't changed IPs for DNS servers, haven't had a DNS server changed to be authoritative only, etc.? Note that a configuration change that causes problems will usually be noticeable by all users of the server. >Received: from p.advertisingbymail.com [64.119.218.212] by mail.nfti.com > (SMTPD32-6.06) id A91816D01A4; Tue, 02 Sep 2003 08:12:08 -0400 Given that this is sent from an IP that has a reverse DNS entry that matches the HELO/EHLO, and that it has an obvious domain name ("advertisingbymail.com"), by first guess is that it is: >[2] "quasi-legitimate E-mail" (for example, E-mail that you get after >giving your E-mail address to a company but forgetting to uncheck the box >that says "It's OK to give my E-mail address to your affiliates" or >whatever). In this case, you'll need to do some work to block this type of E-mail. In this case, you may want to try a filter that blocks all E-mail with "advertisingbymail.com" in the reverse DNS entry. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---------------------------------------------------------------------------- -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] ------------------------------------------------------------------------------ [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
