Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
> I made these changes and restarted services. > But then I stopped receiving emails. Try implementing the DAISYCHAIN function as follows: (a) COPY SMTP32.EXE to SMTP32.EXB (this step just for backup) (b) RENAME SMTP32.EXE to IPSMTP32.EXE (c) COPY DECLUDE.EXE to SMTP32.EXE (d) Add the DAISYCHAIN directive as described earlier In other words, do *not* make the Registry change, nor rename DECLUDE.EXE. I do not believe these steps were part of the standard procedure (and I was the person who originally suggested DAISYCHAIN, so I do have lots of experience implementing it). -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
First and foremost, look in the web log and see what account they are using and shut that account off. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Brian Cunningham > Sent: Wednesday, March 26, 2003 7:38 PM > To: [EMAIL PROTECTED] > Subject: Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ? > > The reverse dns is because of a nat'ing scheme we have behind two firewalls and a > load director (posts in the past have already described our config). > > The freaking SpamCop is because I apparently have Spammers sending an > incredible amount of spam through our web messaging (i.e. bypassing hijack and > why I'm posting it as an issue). How is that even possible? > > b > > > > -- Original Message -- > From: Eje Gustafsson <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Wed, 26 Mar 2003 21:27:20 -0600 > > >Not besides that your listed yourself in spamcop and that you need to > >take a look at the logs to see what's in them and/or show them to us > >so we can see what is failing. > > > >I see a couple of things right of. > >1) no reverse DNS for 208.253.112.168 which is your sending ip for you > >mailserver. > >2) your subnet is listed with numerous spam lists. > >DELINK, SPAMCOP, XBL, HEUR1, REVDNS, SPAMCHK, IPNOTINMX, > Reverse-IP > > > >- Eje > > > >Wednesday, March 26, 2003, 9:15:11 PM, you wrote: > > > >BC> Scott, > > > >BC> I made these changes and restarted services. > > > >BC> But then I stopped receiving emails. > > > >BC> When I reverted back, I'm now receiving emails again. > > > >BC> Any thoughts? > > > >BC> Thanks. > > > >BC> b > > > >BC> -- Original Message -- > >BC> From: "R. Scott Perry" <[EMAIL PROTECTED]> > >BC> Reply-To: [EMAIL PROTECTED] > >BC> Date: Wed, 26 Mar 2003 19:19:28 -0500 > > > >>> > I checked the W log files and it looks like they are coming in through web > messaging (god knows how they are sending that much email through web > messaging) under several IP's ranging from Nigeria to Israel. I blocked > those IP's within Imail "Control Access". > >>> > >>>Ah, that explains what is going on. That's the first time I've seen > >>>serious spammers try to send E-mail through web messaging. > >>> > How can I make Hijack work with webmessaging? > >>> > >>>It is possible to do this, by having the declude.exe file act as the > >>>smtp32.exe file, so that Declude can intercept the web messaging E-mail. > >>> > >>>This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the > >>>declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the > >>>hijack.cfg file. > >>> > >>>Then, you need to use regedit to change the > >>>HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to > point > >>>to smtp32.exe instead of declude.com, and finally stop/restart the IMail > >>>SMTP service so that IMail will recognize the change > >>> -Scott > >>> > >>>--- > >>>[This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > >>> > >>>--- > >>>This E-mail came from the Declude.JunkMail mailing list. To > >>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >>>type "unsubscribe Declude.JunkMail". The archives can be found > >>>at http://www.mail-archive.com. > >>>--- > >>>[This E-mail was scanned for Viruses and Spam by Richmond.com] > >>> > >>> > >BC> --- > >BC> [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > >BC> --- > >BC> This E-mail came from the Declude.JunkMail mailing list. To > >BC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >BC> type "unsubscribe Declude.JunkMail". The archives can be found > >BC> at http://www.mail-archive.com. > >BC> --- > >BC> [This E-mail scanned for viruses by Declude Virus] > > > > > > > >Best regards, > > Eje Gustafsson mailto:[EMAIL PROTECTED] > >--- > >The Family Entertainment Network http://www.fament.com > >Phone : 620-231- Fax : 620-231-4066 > >eBay UserID : macahan > > - Your Full Time Professionals - > > > >--- > >[This E-mail scanned for viruses by Declude Virus] > > > >--- > >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > >--- > >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubsc
Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
The reverse dns is because of a nat'ing scheme we have behind two firewalls and a load director (posts in the past have already described our config). The freaking SpamCop is because I apparently have Spammers sending an incredible amount of spam through our web messaging (i.e. bypassing hijack and why I'm posting it as an issue). How is that even possible? b -- Original Message -- From: Eje Gustafsson <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 21:27:20 -0600 >Not besides that your listed yourself in spamcop and that you need to >take a look at the logs to see what's in them and/or show them to us >so we can see what is failing. > >I see a couple of things right of. >1) no reverse DNS for 208.253.112.168 which is your sending ip for you >mailserver. >2) your subnet is listed with numerous spam lists. >DELINK, SPAMCOP, XBL, HEUR1, REVDNS, SPAMCHK, IPNOTINMX, Reverse-IP > >- Eje > >Wednesday, March 26, 2003, 9:15:11 PM, you wrote: > >BC> Scott, > >BC> I made these changes and restarted services. > >BC> But then I stopped receiving emails. > >BC> When I reverted back, I'm now receiving emails again. > >BC> Any thoughts? > >BC> Thanks. > >BC> b > >BC> -- Original Message -- >BC> From: "R. Scott Perry" <[EMAIL PROTECTED]> >BC> Reply-To: [EMAIL PROTECTED] >BC> Date: Wed, 26 Mar 2003 19:19:28 -0500 > >>> I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail "Control Access". >>> >>>Ah, that explains what is going on. That's the first time I've seen >>>serious spammers try to send E-mail through web messaging. >>> How can I make Hijack work with webmessaging? >>> >>>It is possible to do this, by having the declude.exe file act as the >>>smtp32.exe file, so that Declude can intercept the web messaging E-mail. >>> >>>This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the >>>declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the >>>hijack.cfg file. >>> >>>Then, you need to use regedit to change the >>>HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point >>>to smtp32.exe instead of declude.com, and finally stop/restart the IMail >>>SMTP service so that IMail will recognize the change >>> -Scott >>> >>>--- >>>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] >>> >>>--- >>>This E-mail came from the Declude.JunkMail mailing list. To >>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>type "unsubscribe Declude.JunkMail". The archives can be found >>>at http://www.mail-archive.com. >>>--- >>>[This E-mail was scanned for Viruses and Spam by Richmond.com] >>> >>> >BC> --- >BC> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >BC> --- >BC> This E-mail came from the Declude.JunkMail mailing list. To >BC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >BC> type "unsubscribe Declude.JunkMail". The archives can be found >BC> at http://www.mail-archive.com. >BC> --- >BC> [This E-mail scanned for viruses by Declude Virus] > > > >Best regards, > Eje Gustafsson mailto:[EMAIL PROTECTED] >--- >The Family Entertainment Network http://www.fament.com >Phone : 620-231- Fax : 620-231-4066 >eBay UserID : macahan > - Your Full Time Professionals - > >--- >[This E-mail scanned for viruses by Declude Virus] > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
Not besides that your listed yourself in spamcop and that you need to take a look at the logs to see what's in them and/or show them to us so we can see what is failing. I see a couple of things right of. 1) no reverse DNS for 208.253.112.168 which is your sending ip for you mailserver. 2) your subnet is listed with numerous spam lists. DELINK, SPAMCOP, XBL, HEUR1, REVDNS, SPAMCHK, IPNOTINMX, Reverse-IP - Eje Wednesday, March 26, 2003, 9:15:11 PM, you wrote: BC> Scott, BC> I made these changes and restarted services. BC> But then I stopped receiving emails. BC> When I reverted back, I'm now receiving emails again. BC> Any thoughts? BC> Thanks. BC> b BC> -- Original Message -- BC> From: "R. Scott Perry" <[EMAIL PROTECTED]> BC> Reply-To: [EMAIL PROTECTED] BC> Date: Wed, 26 Mar 2003 19:19:28 -0500 >> >>>I checked the W log files and it looks like they are coming in through web >>>messaging (god knows how they are sending that much email through web >>>messaging) under several IP's ranging from Nigeria to Israel. I blocked >>>those IP's within Imail "Control Access". >> >>Ah, that explains what is going on. That's the first time I've seen >>serious spammers try to send E-mail through web messaging. >> >>>How can I make Hijack work with webmessaging? >> >>It is possible to do this, by having the declude.exe file act as the >>smtp32.exe file, so that Declude can intercept the web messaging E-mail. >> >>This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the >>declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the >>hijack.cfg file. >> >>Then, you need to use regedit to change the >>HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point >>to smtp32.exe instead of declude.com, and finally stop/restart the IMail >>SMTP service so that IMail will recognize the change >> -Scott >> >>--- >>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] >> >>--- >>This E-mail came from the Declude.JunkMail mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.JunkMail". The archives can be found >>at http://www.mail-archive.com. >>--- >>[This E-mail was scanned for Viruses and Spam by Richmond.com] >> >> BC> --- BC> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] BC> --- BC> This E-mail came from the Declude.JunkMail mailing list. To BC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and BC> type "unsubscribe Declude.JunkMail". The archives can be found BC> at http://www.mail-archive.com. BC> --- BC> [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
Scott, I made these changes and restarted services. But then I stopped receiving emails. When I reverted back, I'm now receiving emails again. Any thoughts? Thanks. b -- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 19:19:28 -0500 > >>I checked the W log files and it looks like they are coming in through web >>messaging (god knows how they are sending that much email through web >>messaging) under several IP's ranging from Nigeria to Israel. I blocked >>those IP's within Imail "Control Access". > >Ah, that explains what is going on. That's the first time I've seen >serious spammers try to send E-mail through web messaging. > >>How can I make Hijack work with webmessaging? > >It is possible to do this, by having the declude.exe file act as the >smtp32.exe file, so that Declude can intercept the web messaging E-mail. > >This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the >declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the >hijack.cfg file. > >Then, you need to use regedit to change the >HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point >to smtp32.exe instead of declude.com, and finally stop/restart the IMail >SMTP service so that IMail will recognize the change > -Scott > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HiJack Not Working ?
I've got you up until the "DAISYCHAIN ipsmtp.exe" point. Do you want me to rename the two files and then add the daisychain line above to the config file of hijack? That is correct. > Will renaming declude.exe to smtp32.exe cause problems with junkmail or virus? No. > Do I need to rename or make a copy of declude.exe as renamed? It's best to rename it, just to make sure there isn't any confusion. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
Will renaming declude.exe to smtp32.exe cause problems with junkmail or virus? Do I need to rename or make a copy of declude.exe as renamed? b -- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 19:19:28 -0500 > >>I checked the W log files and it looks like they are coming in through web >>messaging (god knows how they are sending that much email through web >>messaging) under several IP's ranging from Nigeria to Israel. I blocked >>those IP's within Imail "Control Access". > >Ah, that explains what is going on. That's the first time I've seen >serious spammers try to send E-mail through web messaging. > >>How can I make Hijack work with webmessaging? > >It is possible to do this, by having the declude.exe file act as the >smtp32.exe file, so that Declude can intercept the web messaging E-mail. > >This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the >declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the >hijack.cfg file. > >Then, you need to use regedit to change the >HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point >to smtp32.exe instead of declude.com, and finally stop/restart the IMail >SMTP service so that IMail will recognize the change > -Scott > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
I've got you up until the "DAISYCHAIN ipsmtp.exe" point. Do you want me to rename the two files and then add the daisychain line above to the config file of hijack? Thanks. b -- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 19:19:28 -0500 > >>I checked the W log files and it looks like they are coming in through web >>messaging (god knows how they are sending that much email through web >>messaging) under several IP's ranging from Nigeria to Israel. I blocked >>those IP's within Imail "Control Access". > >Ah, that explains what is going on. That's the first time I've seen >serious spammers try to send E-mail through web messaging. > >>How can I make Hijack work with webmessaging? > >It is possible to do this, by having the declude.exe file act as the >smtp32.exe file, so that Declude can intercept the web messaging E-mail. > >This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the >declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the >hijack.cfg file. > >Then, you need to use regedit to change the >HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point >to smtp32.exe instead of declude.com, and finally stop/restart the IMail >SMTP service so that IMail will recognize the change > -Scott > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HiJack Not Working ?
I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail "Control Access". Ah, that explains what is going on. That's the first time I've seen serious spammers try to send E-mail through web messaging. How can I make Hijack work with webmessaging? It is possible to do this, by having the declude.exe file act as the smtp32.exe file, so that Declude can intercept the web messaging E-mail. This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the declude.exe file to smtp32.exe, using a "DAISYCHAIN ipsmtp.exe" line in the hijack.cfg file. Then, you need to use regedit to change the HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point to smtp32.exe instead of declude.com, and finally stop/restart the IMail SMTP service so that IMail will recognize the change -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
SPAMCOP:RE: [Declude.JunkMail] HiJack Not Working ?
Thanks Scott. I've emailed you the file. We do have a few ALLOWIP's, but I they are for IP's we own. I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail "Control Access". How can I make Hijack work with webmessaging? b -- Original Message -- From: "R. Scott Perry" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 18:10:23 -0500 > >>And the log files have not held anything today. Everything went through >>as "OK" with juat a couple not local users. > >Note that Declude Hijack allows unlimited E-mail to local users, and >doesn't count that towards a user's quota. > >>But I see that [EMAIL PROTECTED] now has about 300 outgoing spam messages >>in the queue. > >Do you have any "ALLOWIP" lines in your hijack.cfg file? > >Is the user sending these E-mails via SMTP, or web messaging (which would >not be scanned by default)? > >Could you E-mail me the log file (off-list to [EMAIL PROTECTED])? > -Scott > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail was scanned for Viruses and Spam by Richmond.com] > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HiJack Not Working ?
And the log files have not held anything today. Everything went through as "OK" with juat a couple not local users. Note that Declude Hijack allows unlimited E-mail to local users, and doesn't count that towards a user's quota. But I see that [EMAIL PROTECTED] now has about 300 outgoing spam messages in the queue. Do you have any "ALLOWIP" lines in your hijack.cfg file? Is the user sending these E-mails via SMTP, or web messaging (which would not be scanned by default)? Could you E-mail me the log file (off-list to [EMAIL PROTECTED])? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Different bounce messages?
> Based on failing a weight of 40, I have a WEIGHT40 that bounces. I also > have a weight of 60 that will delete. What happens to the mail that falls > in between 41 and 59? Jim Jim Jim. Bounces are not good. :)) Kind of like trying to get the license number of the car that cut us off. Does not work. Any way... Between 41 and 59 will bounce, and at 60 it will try to bounce, but Delete will take presendce. That is one reason why I use WEIGHTRANGE instead. That way, it is exactly defined. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HiJack Not Working ?
I've checked, and the Hijack is registered. The config is set to: RELAYTHRESHOLD1 10 20 RELAYTHRESHOLD2 30 60 And the log files have not held anything today. Everything went through as "OK" with juat a couple not local users. But I see that [EMAIL PROTECTED] now has about 300 outgoing spam messages in the queue. Help! Thanks. b -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 5:58 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HiJack Not Working ? >We've got a locked down public Imail server where anyone can register >for >a free email, but all users have to authenticate before relaying mail. > >We've also got Declude with HiJack in order to stop spammers from using >our system > >But somehow we've got registered users sending hundreds of messages >through us and bypassing HiJack. > >Why isn't the email being trapped by HiJack? The first thing to do is make sure that Declude Hijack is running (you can type "\IMail\Declude -diag", *without* making any changes, and you should see a line "Declude Hijack Status: Registered"). Next, you would want to check your \IMail\Declude\hijack.cfg file to make sure that the settings are reasonable (the default settings are "RELAYTHRESHOLD1 10 20" and "RELAYTHRESHOLD230 80", which allow up to 80 E-mails to be sent within 30 minutes). Finally, you would check the Declude Hijack log file to see what it says about the E-mails. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HiJack Not Working ?
We've got a locked down public Imail server where anyone can register for a free email, but all users have to authenticate before relaying mail. We've also got Declude with HiJack in order to stop spammers from using our system But somehow we've got registered users sending hundreds of messages through us and bypassing HiJack. Why isn't the email being trapped by HiJack? The first thing to do is make sure that Declude Hijack is running (you can type "\IMail\Declude -diag", *without* making any changes, and you should see a line "Declude Hijack Status: Registered"). Next, you would want to check your \IMail\Declude\hijack.cfg file to make sure that the settings are reasonable (the default settings are "RELAYTHRESHOLD1 10 20" and "RELAYTHRESHOLD230 80", which allow up to 80 E-mails to be sent within 30 minutes). Finally, you would check the Declude Hijack log file to see what it says about the E-mails. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Different bounce messages?
Based on failing a weight of 40, I have a WEIGHT40 that bounces. I also have a weight of 60 that will delete. What happens to the mail that falls in between 41 and 59? They will bounce, since the WEIGHT40 test will be triggered but the WEIGHT60 will not be triggered. Note, though, that the E-mail with a weight of 40-60 is almost certainly spam, which means that you are almost certainly spreading the spam (since spam very often has an innocent victim's return address). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What does this mean: internet.e-mail
Title: Nachricht Hi Kami, I've here around 7300 hold spam from the last 14 days. 167 of them contains the string "i_nternet.e-mail" other 22 messages contains "s_aved from url" without the string above. I've checked the first 25 messages containing this string and all of them has recieved a minimum weight of 150% of our hold value. Most of them over 200% As I understand messages containing a "s_aved from url ..." wasn't designed to pass spam filters. We'll try to add this phrase to our SpamChk. So we can see from the logfile if there are also legitimate messages containing this. Markus -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami RazvanSent: Wednesday, March 26, 2003 6:16 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] What does this mean: internet.e-mail Hi; We have a watch words file that if with an entry in the default file - simply to know if these words appear and how often. One such entry in the spam emails is: more importantly the last part: http://internet.e-mail Does anyone know if this is an output generated by a special software -- I hardly see this in any other emails. So far 100% of all the emails reported with this entry are spam. Regards, Kami
[Declude.JunkMail] HiJack Not Working ?
Title: Message We've got a locked down public Imail server where anyone can register for a free email, but all users have to authenticate before relaying mail. We've also got Declude with HiJack in order to stop spammers from using our system But somehow we've got registered users sending hundreds of messages through us and bypassing HiJack. Why isn't the email being trapped by HiJack? Here's an example from the Logs where the user [EMAIL PROTECTED] is sending spam: 03:26 15:25 SMTP-(0B6C) 250-mailhost.gscpa.org Hello [208.253.112.168]03:26 15:25 SMTP-(0B6C) 250-TURN03:26 15:25 SMTP-(0B6C) 250-ATRN03:26 15:25 SMTP-(0B6C) 250-SIZE03:26 15:25 SMTP-(0B6C) 250-ETRN03:26 15:25 SMTP-(0B6C) 250-PIPELINING03:26 15:25 SMTP-(0B6C) 250-DSN03:26 15:25 SMTP-(0B6C) 250-ENHANCEDSTATUSCODES03:26 15:25 SMTP-(0B6C) 250-8bitmime03:26 15:25 SMTP-(0B6C) 250-BINARYMIME03:26 15:25 SMTP-(0B6C) 250-CHUNKING03:26 15:25 SMTP-(0B6C) 250-VRFY03:26 15:25 SMTP-(0B6C) 250-X-EXPS GSSAPI NTLM LOGIN03:26 15:25 SMTP-(0B6C) 250-X-EXPS=LOGIN03:26 15:25 SMTP-(0B6C) 250-AUTH GSSAPI NTLM LOGIN03:26 15:25 SMTP-(0B6C) 250-AUTH=LOGIN03:26 15:25 SMTP-(0B6C) 250-X-LINK2STATE03:26 15:25 SMTP-(0B6C) 250-XEXCH5003:26 15:25 SMTP-(0B6C) 250 OK03:26 15:25 SMTP-(0B6C) >MAIL FROM:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(0254) 354 go ahead03:26 15:25 SMTP-(0BA8) 354 START MAIL INPUT, END WITH "." ON A LINE BY ITSELF03:26 15:25 SMTP-(0254) >.03:26 15:25 SMTP-(0BA8) >.03:26 15:25 SMTP-(0B6C) 250 2.1.0 [EMAIL PROTECTED] OK03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(09B8) Connect mailbox.co.za [196.31.150.75:25] (1)03:26 15:25 SMTP-(07F0) Trying unsubscribe.myfamily.com (0)03:26 15:25 SMTP-(0B6C) 250 2.1.5 [EMAIL PROTECTED]03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(0BA8) 250 OK03:26 15:25 SMTP-(0BA8) rdeliver aol.com [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 667003:26 15:25 SMTP-(0BA8) >QUIT03:26 15:25 SMTP-(0BA8) 221 SERVICE CLOSING CHANNEL03:26 15:25 SMTP-(0BA8) finished d:\IMail\spool\Qe18d009a0078d0bf.SMP status=103:26 15:25 SMTP-(0BA8) d:\IMail\spool\Qed8300a000a68876.SMP03:26 15:25 SMTP-(0BA8) processing d:\IMail\spool\Qed8300a000a68876.SMP03:26 15:25 SMTP-(0B6C) 250 2.1.5 [EMAIL PROTECTED]03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(0BA8) Trying earthlink.net (0)03:26 15:25 SMTP-(07F0) Connect unsubscribe.myfamily.com [63.92.86.131:25] (1)03:26 15:25 SMTP-(0B6C) 250 2.1.5 [EMAIL PROTECTED]03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(0B6C) 250 2.1.5 [EMAIL PROTECTED]03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(0BA8) Connect earthlink.net [207.217.120.79:25] (1)03:26 15:25 SMTP-(0B6C) 250 2.1.5 [EMAIL PROTECTED]03:26 15:25 SMTP-(0B6C) >DATA03:26 15:25 SMTP-(0B6C) 354 Start mail input; end with .03:26 15:25 SMTP-(0B6C) >.03:26 15:25 SMTP-(0B6C) 250 2.6.0 <[EMAIL PROTECTED]> Queued mail for delivery03:26 15:25 SMTP-(0B6C) rdeliver gscpa.org multiple (5) [EMAIL PROTECTED] 259503:26 15:25 SMTP-(0B6C) >QUIT03:26 15:25 SMTP-(0B6C) 221 2.0.0 mailhost.gscpa.org Service closing transmission channel03:26 15:25 SMTP-(0B6C) Connect gscpa.org [216.230.88.131:25] (1)03:26 15:25 SMTP-(0B6C) 220 mailhost.gscpa.org Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready at Wed, 26 Mar 2003 15:25:25 -050003:26 15:25 SMTP-(0B6C) >EHLO richmond.com03:26 15:25 SMTP-(0B6C) 250-mailhost.gscpa.org Hello [208.253.112.168]03:26 15:25 SMTP-(0B6C) 250-TURN03:26 15:25 SMTP-(0B6C) 250-ATRN03:26 15:25 SMTP-(0B6C) 250-SIZE03:26 15:25 SMTP-(0B6C) 250-ETRN03:26 15:25 SMTP-(0B6C) 250-PIPELINING03:26 15:25 SMTP-(0B6C) 250-DSN03:26 15:25 SMTP-(0B6C) 250-ENHANCEDSTATUSCODES03:26 15:25 SMTP-(0B6C) 250-8bitmime03:26 15:25 SMTP-(0B6C) 250-BINARYMIME03:26 15:25 SMTP-(0B6C) 250-CHUNKING03:26 15:25 SMTP-(0B6C) 250-VRFY03:26 15:25 SMTP-(0B6C) 250-X-EXPS GSSAPI NTLM LOGIN03:26 15:25 SMTP-(0B6C) 250-X-EXPS=LOGIN03:26 15:25 SMTP-(0B6C) 250-AUTH GSSAPI NTLM LOGIN03:26 15:25 SMTP-(0B6C) 250-AUTH=LOGIN03:26 15:25 SMTP-(0B6C) 250-X-LINK2STATE03:26 15:25 SMTP-(0B6C) 250-XEXCH5003:26 15:25 SMTP-(0B6C) 250 OK03:26 15:25 SMTP-(0B6C) >MAIL FROM:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(08CC) Connect ou.edu [129.15.2.47:25] (1)03:26 15:25 SMTP-(0254) 250 ok dirdel03:26 15:25 SMTP-(0254) rdeliver yahoo.com [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 146003:26 15:25 SMTP-(0254) >QUIT03:26 15:25 SMTP-(0B6C) 250 2.1.0 [EMAIL PROTECTED] OK03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAIL PROTECTED]>03:26 15:25 SMTP-(0B6C) 250 2.1.5 [EMAIL PROTECTED]03:26 15:25 SMTP-(0B6C) >RCPT To:<[EMAI
RE: [Declude.JunkMail] Different bounce messages?
Based on failing a weight of 40, I have a WEIGHT40 that bounces. I also have a weight of 60 that will delete. What happens to the mail that falls in between 41 and 59? Jim Rooth Klotron, Inc. 214.244.0979 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Saturday, March 15, 2003 1:03 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Different bounce messages? >Can we have different bounce messages? Lets say if we can define a >certain test and for that test a certain message be sent out!? Yes. Declude JunkMail uses the name of the test in the name of the .eml file it uses for the bounce message, so if you have "TEST1" and "TEST2", you would use the files \IMail\Declude\TEST1bounce.eml and \IMail\Declude\TEST2bounce.eml. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.462 / Virus Database: 261 - Release Date: 3/13/2003 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.463 / Virus Database: 262 - Release Date: 3/17/2003 --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What does this mean: internet.e-mail
Title: Message Kami, I think it's an annotation put there by the bulk mailer as a note to themselves about the source of the target list (ooh, I'm starting to sound like *them*). I saw this in the body of the html spam I received today: I've changed the names to protect the potentially innocent. The message came via bCentral.com, by the way. Checking my personal spam database, I find only one message that matches better with what you've found: If it helps, it was spamvertising generic viagra pills at one of those invulnerable hosts in China. Andrew 8) -Original Message-From: Kami Razvan [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 9:16 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] What does this mean: internet.e-mail Hi; We have a watch words file that if with an entry in the default file - simply to know if these words appear and how often. One such entry in the spam emails is: more importantly the last part: http://internet.e-mail Does anyone know if this is an output generated by a special software -- I hardly see this in any other emails. So far 100% of all the emails reported with this entry are spam. Regards, Kami
Re: [Declude.JunkMail] Reference documents needed
At 02:47 PM 3/26/2003, you wrote: I simply cannot keep up with the constant changes in JunkMail. News tests, variables, and parameters are listed in the Release Notes, but the trick is how to integrate those tests into an existing configuration, where to insert them, how to configure the parameters for new tests, etc. For example, the Release Notes for 1.67 Beta says JM ADD Adds "comments" test type to detect anti-filter HTML comments. Sounds great. Where and how do I use that test?? That's exactly what this list is for -- our goal is to add new features to the manual after new releases, but to have information about beta features discussed on this list. JM ADD Adds "AUTOWHITELIST ON" option in global.cfg file which will use address books as whitelists . . . " Wonderful! A personal whitelist! Uhh, but address books where? Uhh, in the archive of this list. :) How many times does the poor guy have to repeat this??? :) -NM * If you are not the intended addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Please advise immediately if you or your employer do not consent to Internet email for messages of this kind. === Neal R. Mathews Network Systems Engineer Email: [EMAIL PROTECTED] Phone: 1-716-673-1000 ext 8321 Direct: 1-716-673-8321 The Carriage House Companies, Inc. 196 Newton Street Fredonia, NY 14063
RE: [Declude.JunkMail] Reference documents needed
Title: Message I happen to agree with Glenn. I love my declude setup, but its getting more difficult to keep up with the changes. Just my two cents, love Declude and keep up the good work. Maybe if some external people would be willing to help put together a document. Its not like we don't have any place to host it ;) Thank you, Aaron Caviglia [EMAIL PROTECTED] VanTech.Net www.vantech.net Toll Free 800-872-3359 Phone 559-732-3952 Fax 559-732-1509 6707 W. Goshen Ave. Visalia, CA 93291 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \ WCNetSent: Wednesday, March 26, 2003 11:41 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Reference documents needed I simply cannot keep up with the constant changes in JunkMail. News tests, variables, and parameters are listed in the Release Notes, but the trick is how to integrate those tests into an existing configuration, where to insert them, how to configure the parameters for new tests, etc. For example, the Release Notes for 1.67 Beta says JM ADD Adds "comments" test type to detect anti-filter HTML comments. Sounds great. Where and how do I use that test?? JM ADD Adds "AUTOWHITELIST ON" option in global.cfg file which will use address books as whitelists . . . " Wonderful! A personal whitelist! Uhh, but address books where? In the user's WebMail configuration, I assume. Not all users use WebMail, some use only a client and don't have a WebMail address book at all, and have never even logged in to WebMail. Does it work in a gateway server situation, where there are no "local" users on the gateway server, mail is scanned as outgoing and passed on to another IMail server for delivery into the user mailboxes? I assume it doesn't, but the Release Notes don't say. Scott and company do a fantastic job, but when *they* write the documention and Release Notes, *they* already know how it works. I know new tests are defined in the updated global.cfg and $default$.junkmail with each new release, but it would be much easier to integrate new tests into an existing configuration if basic test syntax and parameters were included in the Release Notes. Glenn Z. - Original Message - From: R. Scott Perry To: [EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 12:30 PM Subject: Re: [Declude.JunkMail] Reference documents needed >In order to make the most use of Declude's power in the shortest time>possible, I would need a couple of documents (hopefully they exist):>>1. A reference list (beyond the HTML manual at>www.declude.com/JunkMail/manual.html) that lists every single variable >available>and what it represents (eventually with a short example).The manual should list all the variables (except ones that have been added since the latest beta). I'll see if we can add examples to the manual.>2. A complete list of all the tests available in Declude junk mail with a>detailed description of their use?That's impossible, unfortunately, as Declude JunkMail can use spam tests that haven't even been created yet. For DNS-based tests, http://www.declude.com/junkmail/support/ip4r.htm has the list of them all (however, most people will use just the ones that are already defined in Declude JunkMail).When Declude JunkMail was first started, there were really just 2 tests (RBL and ORBS), so there wasn't any need to worry about documenting test types. You could just look in the global.cfg file to see what tests were available.However, as things have progressed, I think we'll need to add a table with a list of all the test types. -Scott---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Reference documents needed
I simply cannot keep up with the constant changes in JunkMail. News tests, variables, and parameters are listed in the Release Notes, but the trick is how to integrate those tests into an existing configuration, where to insert them, how to configure the parameters for new tests, etc. For example, the Release Notes for 1.67 Beta says JM ADD Adds "comments" test type to detect anti-filter HTML comments. Sounds great. Where and how do I use that test?? That's exactly what this list is for -- our goal is to add new features to the manual after new releases, but to have information about beta features discussed on this list. JM ADD Adds "AUTOWHITELIST ON" option in global.cfg file which will use address books as whitelists . . . " Wonderful! A personal whitelist! Uhh, but address books where? Uhh, in the archive of this list. :) Perhaps it is something that should be changed, but this list is the source for details on new beta features. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Reference documents needed
I simply cannot keep up with the constant changes in JunkMail. News tests, variables, and parameters are listed in the Release Notes, but the trick is how to integrate those tests into an existing configuration, where to insert them, how to configure the parameters for new tests, etc. For example, the Release Notes for 1.67 Beta says JM ADD Adds "comments" test type to detect anti-filter HTML comments. Sounds great. Where and how do I use that test?? JM ADD Adds "AUTOWHITELIST ON" option in global.cfg file which will use address books as whitelists . . . " Wonderful! A personal whitelist! Uhh, but address books where? In the user's WebMail configuration, I assume. Not all users use WebMail, some use only a client and don't have a WebMail address book at all, and have never even logged in to WebMail. Does it work in a gateway server situation, where there are no "local" users on the gateway server, mail is scanned as outgoing and passed on to another IMail server for delivery into the user mailboxes? I assume it doesn't, but the Release Notes don't say. Scott and company do a fantastic job, but when *they* write the documention and Release Notes, *they* already know how it works. I know new tests are defined in the updated global.cfg and $default$.junkmail with each new release, but it would be much easier to integrate new tests into an existing configuration if basic test syntax and parameters were included in the Release Notes. Glenn Z. - Original Message - From: R. Scott Perry To: [EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 12:30 PM Subject: Re: [Declude.JunkMail] Reference documents needed >In order to make the most use of Declude's power in the shortest time>possible, I would need a couple of documents (hopefully they exist):>>1. A reference list (beyond the HTML manual at>www.declude.com/JunkMail/manual.html) that lists every single variable >available>and what it represents (eventually with a short example).The manual should list all the variables (except ones that have been added since the latest beta). I'll see if we can add examples to the manual.>2. A complete list of all the tests available in Declude junk mail with a>detailed description of their use?That's impossible, unfortunately, as Declude JunkMail can use spam tests that haven't even been created yet. For DNS-based tests, http://www.declude.com/junkmail/support/ip4r.htm has the list of them all (however, most people will use just the ones that are already defined in Declude JunkMail).When Declude JunkMail was first started, there were really just 2 tests (RBL and ORBS), so there wasn't any need to worry about documenting test types. You could just look in the global.cfg file to see what tests were available.However, as things have progressed, I think we'll need to add a table with a list of all the test types. -Scott---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Reference documents needed
> It constantly occurs to me, as it has to many others who have mentioned this > previously, that what we really need is a FAQ compilation that covers > customization and best-practices for various situations and integration of > the add-on tools and who knows what else. "Search the archives" hasn't > proven to be a very effective recommendation all the time. Speaking of FAQ, does any one know of a good easy cheap way to compile one? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What does this mean: internet.e-mail
Title: Message Kami, I seen several messages today that had that listed right at the top of the message source., Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Wednesday, March 26, 2003 12:16 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] What does this mean: internet.e-mail Hi; We have a watch words file that if with an entry in the default file - simply to know if these words appear and how often. One such entry in the spam emails is: more importantly the last part: http://internet.e-mail Does anyone know if this is an output generated by a special software -- I hardly see this in any other emails. So far 100% of all the emails reported with this entry are spam. Regards, Kami
RE: [Declude.JunkMail] Question On behavior
John, You are absolutely right on this should be implemented instead of whitelisting the postmaster or abuse account. This week I can't tell you how many messages got through because "postmaster@" was listed as a recipient. That shouldn't happen anymore... Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff Sent: Wednesday, March 26, 2003 11:24 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Question On behavior > We have achieved the desired behavior with that setup. I sent a test > message tripping off one of the filters and the mail was delivered to > the postmaster and was not delivered to the other recipients. Thanks for that update Darrell. Sounds like something that should be implemented by any one whitelisting postmaster or root or abuse. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reference documents needed
It constantly occurs to me, as it has to many others who have mentioned this previously, that what we really need is a FAQ compilation that covers customization and best-practices for various situations and integration of the add-on tools and who knows what else. "Search the archives" hasn't proven to be a very effective recommendation all the time. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, 26 March 2003 1:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Reference documents needed >In order to make the most use of Declude's power in the shortest time >possible, I would need a couple of documents (hopefully they exist): > >1. A reference list (beyond the HTML manual at >www.declude.com/JunkMail/manual.html) that lists every single variable >available >and what it represents (eventually with a short example). The manual should list all the variables (except ones that have been added since the latest beta). I'll see if we can add examples to the manual. >2. A complete list of all the tests available in Declude junk mail with a >detailed description of their use? That's impossible, unfortunately, as Declude JunkMail can use spam tests that haven't even been created yet. For DNS-based tests, http://www.declude.com/junkmail/support/ip4r.htm has the list of them all (however, most people will use just the ones that are already defined in Declude JunkMail). When Declude JunkMail was first started, there were really just 2 tests (RBL and ORBS), so there wasn't any need to worry about documenting test types. You could just look in the global.cfg file to see what tests were available. However, as things have progressed, I think we'll need to add a table with a list of all the test types. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reference documents needed
The online docs and the mailing list archives tends to be a very good reference, however since the program is so flexible, even Scott doesn't know it's full potential. There are often threads where people have managed to come up with some new and unforseen way of using Declude. Now, that being said, maybe a nice How-To site where users can post their little tricks and tips would be very helpful. Generally speaking, the only things not listed in the online manual are beta features, and they are listed in the revision history and very well discussed in the archives. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, March 26, 2003 11:13 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Reference documents needed Hello, All, This sounds very similiar to the request that I made when I first started using Declude.JunkMail. Unfortunately I don't think these documents exist. But I could be wrong. Once our management agrees to buy JunkMail Pro for us I plan on writing up something along these lines. If I had one complaint about Declude JunkMail that would probably be the only one. The program itself is awesome. Scott's technical support is outstanding. But the current documentation seems too conversational in tone. Now that tone is a good way for some people to learn. But some people (like Adrian, Joseph, myself and others, I'm guessing) need documentation which reads as more of a reference guide. I can't think of any other way to describe it. (Un)fortunately I've made it past the hump in the learning curve where something like this seems absolutely necessary but I still could many situations where it would be beneficial. Dan - Original Message - From: "Joseph Acac" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, March 26, 2003 11:27 AM Subject: Re: [Declude.JunkMail] Reference documents needed > I second that. > > At 08:15 03.26.2003, you wrote: > >Hi Scott, > > > >I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on > >this list on a daily basis. Excellent discussions and I have already learned a > >lot. In order to make the most use of Declude's power in the shortest time > >possible, I would need a couple of documents (hopefully they exist): > > > >1. A reference list (beyond the HTML manual at > >www.declude.com/JunkMail/manual.html) that lists every single variable > >available > >and what it represents (eventually with a short example). > > > >2. A complete list of all the tests available in Declude junk mail with a > >detailed description of their use? > > > >Thanks in advance, > > > > > >PS: If Declude doesn't have such documents, then maybe one of the list > >subscribers have compiled them. Any help would be much appreciated. > > > > > > > >-- > >Regards, > >Adrian Titei > >Director of IT > >Jumbo Entertainment Inc. > > > >p: 905-634-4244 x 232 > >f: 905-632-2964 > >e: [EMAIL PROTECTED] > > > >===> Confidentiality Notice: < > >This e-mail message and any attachment to same contains confidential > >information intended only for the person(s) to whom the said e-mail is > >intended > >to be sent. Any review, retransmission, dissemination or other use of or the > >taking of any action and reliance upon this information by persons or entities > >other than the intended recipient violates confidentiality and is prohibited. > >If you have received this e-mail message in error, please notify the sender > >immediately and delete the e-mail message from your computer. > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Joseph C. Acac > CNPRC > University of California at Davis > [EMAIL PROTECTED] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > This E-mail is scanned and free from viruses. www.nexustechgroup.com > > This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Viru
Re: [Declude.JunkMail] Reference documents needed
In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). The manual should list all the variables (except ones that have been added since the latest beta). I'll see if we can add examples to the manual. 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? That's impossible, unfortunately, as Declude JunkMail can use spam tests that haven't even been created yet. For DNS-based tests, http://www.declude.com/junkmail/support/ip4r.htm has the list of them all (however, most people will use just the ones that are already defined in Declude JunkMail). When Declude JunkMail was first started, there were really just 2 tests (RBL and ORBS), so there wasn't any need to worry about documenting test types. You could just look in the global.cfg file to see what tests were available. However, as things have progressed, I think we'll need to add a table with a list of all the test types. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reference documents needed
One problem with documents on a program like JunkMail is that it is such an adaptable product that it is hard to explain everything. For those interested in SpamManager, I am going to be writing up a white paper on implementing that within Declude. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Dan Geiser > Sent: Wednesday, March 26, 2003 9:13 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Reference documents needed > > Hello, All, > > This sounds very similiar to the request that I made when I first started > using Declude.JunkMail. Unfortunately I don't think these documents exist. > But I could be wrong. Once our management agrees to buy JunkMail Pro for us > I plan on writing up something along these lines. > > If I had one complaint about Declude JunkMail that would probably be the > only one. The program itself is awesome. Scott's technical support is > outstanding. But the current documentation seems too conversational in > tone. Now that tone is a good way for some people to learn. But some > people (like Adrian, Joseph, myself and others, I'm guessing) need > documentation which reads as more of a reference guide. I can't think of > any other way to describe it. > > (Un)fortunately I've made it past the hump in the learning curve where > something like this seems absolutely necessary but I still could many > situations where it would be beneficial. > > Dan > > - Original Message - > From: "Joseph Acac" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, March 26, 2003 11:27 AM > Subject: Re: [Declude.JunkMail] Reference documents needed > > > > I second that. > > > > At 08:15 03.26.2003, you wrote: > > >Hi Scott, > > > > > >I am a fairly new user of Declude JunkMail Pro and I'm reading the > messages on > > >this list on a daily basis. Excellent discussions and I have already > learned a > > >lot. In order to make the most use of Declude's power in the shortest > time > > >possible, I would need a couple of documents (hopefully they exist): > > > > > >1. A reference list (beyond the HTML manual at > > >www.declude.com/JunkMail/manual.html) that lists every single variable > > >available > > >and what it represents (eventually with a short example). > > > > > >2. A complete list of all the tests available in Declude junk mail with a > > >detailed description of their use? > > > > > >Thanks in advance, > > > > > > > > >PS: If Declude doesn't have such documents, then maybe one of the list > > >subscribers have compiled them. Any help would be much appreciated. > > > > > > > > > > > >-- > > >Regards, > > >Adrian Titei > > >Director of IT > > >Jumbo Entertainment Inc. > > > > > >p: 905-634-4244 x 232 > > >f: 905-632-2964 > > >e: [EMAIL PROTECTED] > > > > > >===> Confidentiality Notice: < > > >This e-mail message and any attachment to same contains confidential > > >information intended only for the person(s) to whom the said e-mail is > > >intended > > >to be sent. Any review, retransmission, dissemination or other use of or > the > > >taking of any action and reliance upon this information by persons or > entities > > >other than the intended recipient violates confidentiality and is > prohibited. > > >If you have received this e-mail message in error, please notify the > sender > > >immediately and delete the e-mail message from your computer. > > >--- > > >[This E-mail was scanned for viruses by Declude Virus > > >(http://www.declude.com)] > > > > > >--- > > >This E-mail came from the Declude.JunkMail mailing list. To > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > >type "unsubscribe Declude.JunkMail". The archives can be found > > >at http://www.mail-archive.com. > > > > Joseph C. Acac > > CNPRC > > University of California at Davis > > [EMAIL PROTECTED] > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > === > = > > This E-mail is scanned and free from viruses. www.nexustechgroup.com > > > > > > === > = > This E-mail is scanned and free from viruses. www.nexustechgroup.com > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail w
[Declude.JunkMail] What does this mean: internet.e-mail
Title: Message Hi; We have a watch words file that if with an entry in the default file - simply to know if these words appear and how often. One such entry in the spam emails is: more importantly the last part: http://internet.e-mail Does anyone know if this is an output generated by a special software -- I hardly see this in any other emails. So far 100% of all the emails reported with this entry are spam. Regards, Kami
Re: [Declude.JunkMail] Reference documents needed
Hello, All, This sounds very similiar to the request that I made when I first started using Declude.JunkMail. Unfortunately I don't think these documents exist. But I could be wrong. Once our management agrees to buy JunkMail Pro for us I plan on writing up something along these lines. If I had one complaint about Declude JunkMail that would probably be the only one. The program itself is awesome. Scott's technical support is outstanding. But the current documentation seems too conversational in tone. Now that tone is a good way for some people to learn. But some people (like Adrian, Joseph, myself and others, I'm guessing) need documentation which reads as more of a reference guide. I can't think of any other way to describe it. (Un)fortunately I've made it past the hump in the learning curve where something like this seems absolutely necessary but I still could many situations where it would be beneficial. Dan - Original Message - From: "Joseph Acac" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, March 26, 2003 11:27 AM Subject: Re: [Declude.JunkMail] Reference documents needed > I second that. > > At 08:15 03.26.2003, you wrote: > >Hi Scott, > > > >I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on > >this list on a daily basis. Excellent discussions and I have already learned a > >lot. In order to make the most use of Declude's power in the shortest time > >possible, I would need a couple of documents (hopefully they exist): > > > >1. A reference list (beyond the HTML manual at > >www.declude.com/JunkMail/manual.html) that lists every single variable > >available > >and what it represents (eventually with a short example). > > > >2. A complete list of all the tests available in Declude junk mail with a > >detailed description of their use? > > > >Thanks in advance, > > > > > >PS: If Declude doesn't have such documents, then maybe one of the list > >subscribers have compiled them. Any help would be much appreciated. > > > > > > > >-- > >Regards, > >Adrian Titei > >Director of IT > >Jumbo Entertainment Inc. > > > >p: 905-634-4244 x 232 > >f: 905-632-2964 > >e: [EMAIL PROTECTED] > > > >===> Confidentiality Notice: < > >This e-mail message and any attachment to same contains confidential > >information intended only for the person(s) to whom the said e-mail is > >intended > >to be sent. Any review, retransmission, dissemination or other use of or the > >taking of any action and reliance upon this information by persons or entities > >other than the intended recipient violates confidentiality and is prohibited. > >If you have received this e-mail message in error, please notify the sender > >immediately and delete the e-mail message from your computer. > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > Joseph C. Acac > CNPRC > University of California at Davis > [EMAIL PROTECTED] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > This E-mail is scanned and free from viruses. www.nexustechgroup.com > > This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Reference documents needed
I second that. At 08:15 03.26.2003, you wrote: Hi Scott, I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on this list on a daily basis. Excellent discussions and I have already learned a lot. In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? Thanks in advance, PS: If Declude doesn't have such documents, then maybe one of the list subscribers have compiled them. Any help would be much appreciated. -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] ===> Confidentiality Notice: < This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Question On behavior
> We have achieved the desired behavior with that setup. I sent a test > message tripping off one of the filters and the mail was delivered to > the postmaster and was not delivered to the other recipients. Thanks for that update Darrell. Sounds like something that should be implemented by any one whitelisting postmaster or root or abuse. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reference documents needed
Hi Scott, I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on this list on a daily basis. Excellent discussions and I have already learned a lot. In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? Thanks in advance, PS: If Declude doesn't have such documents, then maybe one of the list subscribers have compiled them. Any help would be much appreciated. -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] ===> Confidentiality Notice: < This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Question On behavior
Scott, We have achieved the desired behavior with that setup. I sent a test message tripping off one of the filters and the mail was delivered to the postmaster and was not delivered to the other recipients. This is just a testament on how flexible this product is.. Thanks for the help Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, March 26, 2003 9:13 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Question On behavior >To get around this problem do you think this is possible? > >Add a lot of negative weight to the message that has a recipient as >postmaster so it won't get bounced. Then create a test that will route >the message back to the postmaster's account? It might be possible to do something like that. An action "ROUTETO [EMAIL PROTECTED]" would prevent the other users from seeing the E-mail. Perhaps adding a filter that includes a line "ALLRECIPS 0 CONTAINS [EMAIL PROTECTED]", and then having the action for that filter set to "ROUTETO [EMAIL PROTECTED]"? That way, any E-mail that was addressed to [EMAIL PROTECTED] would get sent only to [EMAIL PROTECTED] -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Not Failing the comments test
The Message Sniffer rule for this is also being adjusted/broadened. _M ]-Original Message- ]From: [EMAIL PROTECTED] ][mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry ]Sent: Wednesday, March 26, 2003 9:09 AM ]To: [EMAIL PROTECTED] ]Subject: Re: [Declude.JunkMail] Not Failing the comments test ] ] ] ]>I assume this didn't fail the comments test because it is actually not ]>formatted like a true html comment
RE: [Declude.JunkMail] Question On behavior
To get around this problem do you think this is possible? Add a lot of negative weight to the message that has a recipient as postmaster so it won't get bounced. Then create a test that will route the message back to the postmaster's account? It might be possible to do something like that. An action "ROUTETO [EMAIL PROTECTED]" would prevent the other users from seeing the E-mail. Perhaps adding a filter that includes a line "ALLRECIPS 0 CONTAINS [EMAIL PROTECTED]", and then having the action for that filter set to "ROUTETO [EMAIL PROTECTED]"? That way, any E-mail that was addressed to [EMAIL PROTECTED] would get sent only to [EMAIL PROTECTED] -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] request?
How about a test to check if the e-mail address in the subject is the same as the person it was sent to? Or how about a test that checks for the following dupe names: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] We're looking into tests that would detect these tricks. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Not Failing the comments test
I assume this didn't fail the comments test because it is actually not formatted like a true html comment
[Declude.JunkMail] Not Failing the comments test
I assume this didn't fail the comments test because it is actually not formatted like a true html comment
RE: [Declude.JunkMail] Question On behavior
Scott, To get around this problem do you think this is possible? Add a lot of negative weight to the message that has a recipient as postmaster so it won't get bounced. Then create a test that will route the message back to the postmaster's account? This would then route the message to the postmaster and not the other recipients? I am only pursing this because some really offensive email has been getting through where they are including the postmaster@ address in the mail. Is it possible to accomplish something like that? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, March 25, 2003 10:04 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Question On behavior >We have our domains postmaster addresses whitelisted. I noticed that a >message coming in that has multiple recipients will be delivered to all >the recipients mailboxes as long as it has a whitelisted postmaster >address. > >This is not exactly the desired behavior I am looking for. Unfortunately, that is the behavior that is required. The problem is that you are dealing with a single E-mail with multiple recipients, not multiple E-mails. We are working on some creative ways to get around this, but there would still be some definite limitations. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
