Re: [Declude.JunkMail] ***DECLUDE NO-AUTHENTICATION KEY***

[SM Admin]

So what needs to be done with ClamAV?

-Original Message-
From: Matt
Sent: Wednesday, April 17, 2013 11:24 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] ***DECLUDE NO-AUTHENTICATION KEY***

It seems clear at this point that the failure of Declude's licensing
system is causing widespread havoc for their customers, and they are not
responding to support issues, or any issues at all, and that they are in
fact out of business.  Therefore I am going to share the key that allows
Declude to operate without authentication.  This key will not allow
either AVG nor Commtouch Zero Hour to work, but it will allow Declude to
process email with filters and other add-ons.

The key goes in your Declude.cfg file and it requires a restart. This is
the same key that was shared, but I am changing the subject in order to
highlight that the code is in here:

 CODE28607230-BF21-4CDE-A59B-A451CC7C9CA0

My recommendation is to configure both Sniffer (convert your license
with Pete if it was bound to Declude) and ClamAV so that you have virus
protection.

Matt



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

Why the negative weight on Caution? What’s the logic behind that?

Thanks,

Ben

From: Pete McNeil
Sent: Wednesday, April 17, 2013 10:47 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

On 2013-04-17 13:36, David Barker wrote:

  SNIFFER   external  NONZERO   
"C:\Smartermail\Declude\SNF\SNFClient.exe" 20  0

  SNIFFER-CAUTION  external   020
"C:\Smartermail\Declude\SNF\SNFClient.exe" -10  0

  SNIFFER-TRUNCATEexternal  040 
"C:\Smartermail\Declude\SNF\SNFClient.exe" 10  0



Woops!! That's backward.

It SHOULD be:

SNIFFER-CAUTIONexternal040etc...
SNIFFER-TRUNCATEexternal020etc...

Best,

_M


--
Pete McNeil, President
MicroNeil Research Corporation
www.microneil.com
703.779.4909 x7010
twitter/codedweller



--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

For IMail that was true, but I switched to SM last fall and that no longer
appears to be the case. There is no license code in my declude.cfg file and
the cod line says "SmarterMail can removed this line".

Ben

-Original Message-
From: Randy Armbrecht
Sent: Wednesday, April 17, 2013 10:43 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] No one at Declude?

License code is in the declude.cfg file



Sincerely,

Randy A.


-Original Message-
From: SM Admin [mailto:imailad...@bcwebhost.net]
Sent: Wednesday, April 17, 2013 1:27 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

Hi,

I haven't seen anyone else comment on this post and I wondered if it was one
of the perpetual licenses.  I would test it but I can't recall or figure out
how to change the license code manually. So how do I do that?

Thanks,

Ben

-Original Message-
From: Stephan Chayer
Sent: Wednesday, April 17, 2013 2:36 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] No one at Declude?

Use this key: CODE 28607230-BF21-4CDE-A59B-A451CC7C9CA0

-Message d'origine-
De : SM Admin [mailto:imailad...@bcwebhost.net] Envoyé : 17 avril, 2013 2:43
À : Declude.JunkMail@declude.com Objet : Re: [Declude.JunkMail] No one at
Declude?

Apparently I was too quick on the draw as this line has since been added to
the diag file:

04/16/2013 22:24:21.947[BB86F9-606322-C04138-958B5A-AB7343-94F75B]
IS INVALID KEY

Did someone say something about new keys?

-Original Message-
From: SM Admin
Sent: Tuesday, April 16, 2013 10:25 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

I noticed today that Declude wasn't processing.  I checked the diag file and
it has the usual entries at the top plus an entry at the bottom saying that
the Sniffer license is invalid.  How is that?

So then I restarted the Declud service and now the diag file only shows
this:

Declude 4.12.02 Diagnostics
Compilation Platform: SmarterMail
Copyright (c) 2000-2013 Declude, Inc.

Host Name   mail1.bcwebhost.net
Declude Key 

So I have no idea what's going on. Anyone?

-Original Message-
From: Brian Baker
Sent: Tuesday, April 16, 2013 7:09 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

Looks like tonight we better figure out a new approach. My declude diag file
is now reading declude lic as invalid. Anyone else?


- Original Message -
From: "Todd Richards" 
To: 
Sent: Monday, April 15, 2013 9:34 AM
Subject: RE: [Declude.JunkMail] No one at Declude?



What system is that?  Our users are getting hammered with spam.  Reminds me
of the days, many years ago, before I happened upon Declude...

Todd



-Original Message-
On Sunday, April 14, 2013 10:24 PM,  John Doyle wrote:
>>I have reverted to a system that works.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

Hi,

I haven't seen anyone else comment on this post and I wondered if it was one
of the perpetual licenses.  I would test it but I can't recall or figure out
how to change the license code manually. So how do I do that?

Thanks,

Ben

-Original Message-
From: Stephan Chayer
Sent: Wednesday, April 17, 2013 2:36 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] No one at Declude?

Use this key: CODE 28607230-BF21-4CDE-A59B-A451CC7C9CA0

-Message d'origine-
De : SM Admin [mailto:imailad...@bcwebhost.net]
Envoyé : 17 avril, 2013 2:43
À : Declude.JunkMail@declude.com
Objet : Re: [Declude.JunkMail] No one at Declude?

Apparently I was too quick on the draw as this line has since been added to
the diag file:

04/16/2013 22:24:21.947[BB86F9-606322-C04138-958B5A-AB7343-94F75B]
IS INVALID KEY

Did someone say something about new keys?

-Original Message-
From: SM Admin
Sent: Tuesday, April 16, 2013 10:25 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

I noticed today that Declude wasn't processing.  I checked the diag file and
it has the usual entries at the top plus an entry at the bottom saying that
the Sniffer license is invalid.  How is that?

So then I restarted the Declud service and now the diag file only shows
this:

Declude 4.12.02 Diagnostics
Compilation Platform: SmarterMail
Copyright (c) 2000-2013 Declude, Inc.

Host Name   mail1.bcwebhost.net
Declude Key 

So I have no idea what's going on. Anyone?

-Original Message-
From: Brian Baker
Sent: Tuesday, April 16, 2013 7:09 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

Looks like tonight we better figure out a new approach. My declude diag file
is now reading declude lic as invalid. Anyone else?


- Original Message -
From: "Todd Richards" 
To: 
Sent: Monday, April 15, 2013 9:34 AM
Subject: RE: [Declude.JunkMail] No one at Declude?



What system is that?  Our users are getting hammered with spam.  Reminds me
of the days, many years ago, before I happened upon Declude...

Todd



-Original Message-
On Sunday, April 14, 2013 10:24 PM,  John Doyle wrote:
>>I have reverted to a system that works.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

Apparently I was too quick on the draw as this line has since been added to
the diag file:

04/16/2013 22:24:21.947[BB86F9-606322-C04138-958B5A-AB7343-94F75B]
IS INVALID KEY

Did someone say something about new keys?

-Original Message-
From: SM Admin
Sent: Tuesday, April 16, 2013 10:25 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

I noticed today that Declude wasn't processing.  I checked the diag file and
it has the usual entries at the top plus an entry at the bottom saying that
the Sniffer license is invalid.  How is that?

So then I restarted the Declud service and now the diag file only shows
this:

Declude 4.12.02 Diagnostics
Compilation Platform: SmarterMail
Copyright (c) 2000-2013 Declude, Inc.

Host Name   mail1.bcwebhost.net
Declude Key 

So I have no idea what's going on. Anyone?

-Original Message-
From: Brian Baker
Sent: Tuesday, April 16, 2013 7:09 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

Looks like tonight we better figure out a new approach. My declude diag file
is now reading declude lic as invalid. Anyone else?


- Original Message -
From: "Todd Richards" 
To: 
Sent: Monday, April 15, 2013 9:34 AM
Subject: RE: [Declude.JunkMail] No one at Declude?



What system is that?  Our users are getting hammered with spam.  Reminds me
of the days, many years ago, before I happened upon Declude...

Todd



-Original Message-
On Sunday, April 14, 2013 10:24 PM,  John Doyle wrote:
>>I have reverted to a system that works.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

I noticed today that Declude wasn't processing.  I checked the diag file and
it has the usual entries at the top plus an entry at the bottom saying that
the Sniffer license is invalid.  How is that?

So then I restarted the Declud service and now the diag file only shows
this:

Declude 4.12.02 Diagnostics
Compilation Platform: SmarterMail
Copyright (c) 2000-2013 Declude, Inc.

Host Name   mail1.bcwebhost.net
Declude Key 

So I have no idea what's going on. Anyone?

-Original Message-
From: Brian Baker
Sent: Tuesday, April 16, 2013 7:09 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?

Looks like tonight we better figure out a new approach. My declude diag file
is now reading declude lic as invalid. Anyone else?


- Original Message -
From: "Todd Richards" 
To: 
Sent: Monday, April 15, 2013 9:34 AM
Subject: RE: [Declude.JunkMail] No one at Declude?



What system is that?  Our users are getting hammered with spam.  Reminds me
of the days, many years ago, before I happened upon Declude...

Todd



-Original Message-
On Sunday, April 14, 2013 10:24 PM,  John Doyle wrote:
>>I have reverted to a system that works.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

Hi Dave,

Can you tell us who the owners are of Declude and in what state it is 
incorporated? We might be able to find out if they’ve filed for bankruptcy or 
other legal proceedings.

Thanks,

Ben

From: David Barker
Sent: Wednesday, April 10, 2013 1:47 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] No one at Declude?

No offence taken J  Feel free to email Declude or call them.



David



From: ra...@globalweb.us [mailto:ra...@globalweb.us]
Sent: Wednesday, April 10, 2013 4:34 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] No one at Declude?



I would like to get an official notice from Declude on what is going on and how 
it will affect us, like your example of the license server.



Sincerely,
Randy A.

John Dobbin wrote:So it would seem. With all the discussion recently about 
Declude going down, my concern is more with what happens if/when the licensing 
server goes away?

What are people looking at to migrate to?

Has there been any actual confirmation aside from postings from former 
employees and people's perceptions? (no offence David)



-Original Message-
From: Herb Guenther [mailto:h...@lanex.com]
Sent: Wednesday, April 10, 2013 3:18 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] No one at Declude?



---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Re: The Answer

[SM Admin]

Hi Dave,

This sounds great. Do you foresee this being the end of development for 
Declude? Do you know what happened to the new owners of Declude?

Thanks,

Ben
  - Original Message -
  From: David Barker
  To: Declude.JunkMail@declude.com
  Sent: Monday, April 08, 2013 8:35 PM
  Subject: [Declude.JunkMail] Re: The Answer


  Declude users,

  As many of you may already know Linda Pagillo and I left Declude in January 
of 2013.  Long story short they  “Killed The Goose That Laid the Golden Egg” … 
my guess … the end is nigh!

  However it is not all bad news. We have started a new company called Mail’s 
Best Friend, not only can we continue to support your Declude product but we 
have established several strategic relationships that allow us to offer 
multiple alternate solutions, everything from Message Sniffer, to Cloud based 
solutions to Hosted Exchange, Mail's Best Friend provides best-of-breed support 
and integration services for all email solutions.

  We have always envisioned this as a community effort so the time has come to 
become independent and build this our way!

  With that said if you need assistance with Declude please contact us so we 
can help you either maintain what you have or find you an alternate upgrade 
path.

  Same good service, same great people… this time without the corporate 
interference. Hope to see you soon.

  Sincerely,

  David Barker
  Mail’s Best Friend

  Email : david.bar...@mailsbestfriend.com
  Web  : www.mailsbestfriend.com
  Office: 703.988.3605 x7015
  Mobile  : 978.518.6461















  .














  --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
<>

Re: [Declude.JunkMail] No one at Declude?

[SM Admin]

So, has no one still heard nothing from Declude? This is my favorite anti-spam 
service and I would hate to lose them.

Ben
  - Original Message -
  From: declude
  To: Declude.JunkMail@declude.com
  Sent: Wednesday, April 03, 2013 10:21 AM
  Subject: [Declude.JunkMail] No one at Declude?


  Last Wednesday (3/27/2013), I renewed my Declude and Messaage Sniffer service 
agreements.  A full week later, they both still come up as expired.  All phone 
calls and emails have gone unanswered.  I left voice mails for Tech support, 
Sales and the phone number previously listed on this list for John.  I emailed 
both support at declude and jprovost at declude.com.

  I don't know where to go from here.

  A very sad time for Declude.

  Don




  
  Sent via the WebMail system at net1media.com






  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to imail...@declude.com, and
  type "unsubscribe Declude.JunkMail".  The archives can be found
  at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] why have spam scores jumped?

[SM Admin]

Ahhh, yes, but that’s the answer I don't want.  Right now, I could take our
existing old authoritative DNS server and make it non-recursive, then put a
recursive name server on the mail server itself, but listening only to the
internal IP and that would seem to follow your suggestion.  Although, when I
look at the Interface tab in Properties, I don't see a local or 127.0.0.1
IP.  Maybe it's that funny IPv6 string I see?

The problem is that we're downsizing and consolidating this stuff, so we'd
like to move all the DNS functions over to just the mail server and retire
the old DNS server.  In that case, of course, we only have one DNS server.

I've been looking online to see how others might handle this.  It seems that
BIND can do this one way or another.  You might be able to tell it to listen
for recursive requests only on certain IPs or you can disable all recursion
for the server but then override it for each of your authoritative zones.
Unfortunately, I have yet to find either of those features as part of MS DNS
and I'm not about to launch into the world of BIND.

The second idea was to consolidate the DNS server onto the mail server,
enable recursion, but then block recursive requests from the outside world.
For example, use a firewall to block recursive requests (but only those that
are recursive) from the outside.  I found some online discussion of people
trying to do this, possibly using port 53, but no indications that anyone
actually succeeded.

So for now, I'm still stuck.

-Original Message-
From: Darin Cox
Sent: Friday, March 15, 2013 11:11 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] why have spam scores jumped?

Hi Ben,

You'll want to set up at least two DNS servers for that.  One recursive for
mail server lookups, most likely on the mail server.  The DNS service on the
mail server should not be publicly accessible.  The other non-recursive DNS
server can be used as your nameserver and, of course, publicly accessible.
Since you need multiple nameservers anyway, this is not likely an issue.
And you'll want them on separate subnets, network connections, etc... as
much separation as you can get to avoid common points of failure.

Another reason to separate the nameservers from your web and email services
is that if you host any websites that process credit cards, PCI-DSS
compliance requires any publicly accessible DNS services on the web or email
server to have recursion turned off.

Hope this helps,

Darin.

-Original Message-
From: SM Admin
Sent: Saturday, March 16, 2013 1:55 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] why have spam scores jumped?

Thanks, Sandy.  Of course, if I had understood everything perfectly (or even
reasonably), I wouldn't have had to post my questions here.

On our old DNS server that ran under Windows 2000 Advanced Server, you could
actually toggle Forwarding and Recursion separately.  However, under Windows
2008 server this isn't the case.  You are correct that it's not symmetric as
I claimed, although I really did no better.  Turning off recursion from the
Advanced properties tab turns off forwarding.  Turning off forwarding I
assume is done by just not having any forwarders listed.  So what I said
previously was wrong, although I don't see where it really changes what I
was thinking about.

The challenge here is that our DNS server has two purposes: it is the
authoritative name server for a bunch of zone and it is also the primary
name server used by our mail server.

For purposes of being authoritative for our hosted zones we don't need
either recursion or forwarding.  Requests come to us, get what they need,
and then go away.  For purposes of our mail server we need our DNS server to
be recursive, at the least.

We set up forwarding to the Comcast name servers to offload server and
network traffic.  They can do all the recursion and then pass back the
results to our DNS server, which passes the results back to our mail server.
So I gather the recommendation here is to skip the forwarding and do all the
work ourselves.

I don't understand your remark about open resolver because you don't explain
where I'm wrong in my understanding.  What I understand is that if you have
a DNS server that does recursion on a public IP, then it is an open resolver
and could be attacked. Is that wrong? And if we turn off forwarding but
leave on recursion, then won't our name server still be an open resolver? It
needs to be that way so that the mail server can resolve its requests
against it.

In theory, I only need our name server to be recursive on requests from our
mail server and to be non-recursive for everyone else.  However, I haven't
seen any way to configure that.

Thanks,

Ben

-Original Message-
From: Sanford Whiteman
Sent: Friday, March 15, 2013 6:08 PM
To: Declude.JunkMail@declude.com
Subject: Re

Re: [Declude.JunkMail] why have spam scores jumped?

[SM Admin]

I thought it was a clever observation, too. And it makes me feel better
about the wrong-headed idea I had of what MS suggests.

-Original Message-
From: Sanford Whiteman
Sent: Friday, March 15, 2013 10:48 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] why have spam scores jumped?

> My experience with  MS DNS is that forwarders are setup at
> installation because the installer assumes a blank forwarder means
> the DNS server will be unable to lookup addresses.

Well put. That must explain the feeling that forwarders are
recommended -- they've been turned on for so long that they're thought
to be the necessary.

-- S.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] why have spam scores jumped?

[SM Admin]

Very succinct. But I need further explanation...

Forget forwarding. We'd like to keep it to off-load the server and network
traffic, but we can live without.  However, I need one server to be both
recursive for our mail server and non-recursive for our authoritative zones.
We don't have to worry about our internal workstations because those I can
set up to directly use the Comcast DNS servers (small network so I don't
need internal DNS).  But the mail server presents us the same kind of
problem.

The perfect solution would be a setting that tells the MS DNS server to
accept recursive requests only from specified client IPs, but I don't see
any way to do that.  Any ideas?

Thanks,

Ben

-Original Message-
From: Scott Fosseen
Sent: Friday, March 15, 2013 10:33 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] why have spam scores jumped?

Another way to look at it.

Recursion:
  Off: DNS server can only answer queries from its local zone files.
Queries for any other records returns no results.  Used when server is
authoritative for Public domains (declude.com, nasa.gov)
  On:  DNS server will try to answer all Queries.  If it does not know the
answer it will call out to other DNS servers to get the answer.
( I run both.  I have 4 non-recursive DNS servers for hosting zone files,
and 2 recursive DNS servers for workstations to point to.  )

Forwarders:  Valid only if Recurion is on.
If Forwarder is set and DNS server does not know the answer to a query,
the DNS server will ask the Forwarder DNS server for the answer.
If no Forwarder is set and the DNS server does not know the answer to a
query the DNS server will contact the Root servers and find the answer
itself.

My experience with  MS DNS is that forwarders are setup at installation
because the installer assumes a blank forwarder means the DNS server will be
unable to lookup addresses.  Because DNS works with a forwarder the setting
gets left on.  About the only time I recommend forwarders is if the site
uses something like OpenDNS for Content Filtering, in which case all queries
should go tot he OpenDNS servers.



-Original Message-
From: "Sanford Whiteman" 
Sent 3/15/2013 8:08:14 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] why have spam scores jumped?

> The challenge for me is in not using forwarding. For MS DNS > servers,
> forwarding and recursion are tied together; turn off one > and you lose
> both. Incorrect. Turning off recursion turns off forwarders, but not vice
> versa. You can have a perfectly operating recursive MS DNS server that
> does not delegate recursion to any other server (forwarding amounts to
> delegating recursion, but the server as a whole is still recursive, thus
> the unidirectional relationship between the two settings). You only MUST
> use forwarders if you are not allowed to pass DNS requests out past your
> ISP's border (similar to when you have to use the ISP's outbound SMTP
> gateway). > So if I turn off recursion and forwarding, then all my DNS
> requests > will have to go to the root servers for resolution. No, if you
> turn off recursion completely, you can't get responses for domains that
> aren't on your box. No one is going to do it for you -- the "root servers"
> sure won't. > I do understand the dangers of being an open resolver You're
> mixing up a lot of terms here. An open resolver is one that will perform
> recursive lookups for any address on the open internet. > but I am also
> under the impression that resolving only through root > servers is bad.
> It's not "bad," it doesn't exist. > Since MS seems to recommend forwarding
> I doubt that... > With a stub zone, queries to URIBL.com are resolved
> directly through > the URIBL Name servers... ... and there is no reason to
> go down this road. If you can get DNS requests past your ISP, there's no
> reason to have forwarders. -- S. --- This E-mail came from the
> Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to
> imail...@declude.com, and type "unsubscribe Declude.JunkMail". The
> archives can be found at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] why have spam scores jumped?

[SM Admin]

Thanks, Sandy.  Of course, if I had understood everything perfectly (or even
reasonably), I wouldn't have had to post my questions here.

On our old DNS server that ran under Windows 2000 Advanced Server, you could
actually toggle Forwarding and Recursion separately.  However, under Windows
2008 server this isn't the case.  You are correct that it's not symmetric as
I claimed, although I really did no better.  Turning off recursion from the
Advanced properties tab turns off forwarding.  Turning off forwarding I
assume is done by just not having any forwarders listed.  So what I said
previously was wrong, although I don't see where it really changes what I
was thinking about.

The challenge here is that our DNS server has two purposes: it is the
authoritative name server for a bunch of zone and it is also the primary
name server used by our mail server.

For purposes of being authoritative for our hosted zones we don't need
either recursion or forwarding.  Requests come to us, get what they need,
and then go away.  For purposes of our mail server we need our DNS server to
be recursive, at the least.

We set up forwarding to the Comcast name servers to offload server and
network traffic.  They can do all the recursion and then pass back the
results to our DNS server, which passes the results back to our mail server.
So I gather the recommendation here is to skip the forwarding and do all the
work ourselves.

I don't understand your remark about open resolver because you don't explain
where I'm wrong in my understanding.  What I understand is that if you have
a DNS server that does recursion on a public IP, then it is an open resolver
and could be attacked. Is that wrong? And if we turn off forwarding but
leave on recursion, then won't our name server still be an open resolver? It
needs to be that way so that the mail server can resolve its requests
against it.

In theory, I only need our name server to be recursive on requests from our
mail server and to be non-recursive for everyone else.  However, I haven't
seen any way to configure that.

Thanks,

Ben

-Original Message-
From: Sanford Whiteman
Sent: Friday, March 15, 2013 6:08 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] why have spam scores jumped?

> The challenge for me is in not using forwarding.  For MS DNS
> servers,  forwarding and recursion are tied together; turn off one
> and you lose  both.

Incorrect. Turning off recursion turns off forwarders, but not vice
versa.

You can have a perfectly operating recursive MS DNS server that does
not delegate recursion to any other server (forwarding amounts to
delegating recursion, but the server as a whole is still recursive,
thus the unidirectional relationship between the two settings).

You only MUST use forwarders if you are not allowed to pass DNS
requests out past your ISP's border (similar to when you have to use
the ISP's outbound SMTP gateway).

> So if I turn off recursion and forwarding, then all my DNS requests
> will have to go to the root servers for resolution.

No, if you turn off recursion completely, you can't get responses for
domains that aren't on your box. No one is going to do it for you --
the "root servers" sure won't.

> I do understand the dangers of being an open resolver

You're mixing up a lot of terms here. An open resolver is one that
will perform recursive lookups for any address on the open internet.

> but I am also under the impression that resolving only through root
> servers is bad.

It's not "bad," it doesn't exist.

> Since MS seems to recommend forwarding

I doubt that...

> With a stub zone, queries to URIBL.com are resolved directly through
> the URIBL Name servers...

... and there is no reason to go down this road. If you can get DNS
requests past your ISP, there's no reason to have forwarders.

-- S.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] why have spam scores jumped?

[SM Admin]

Hi Andrew and thanks!

The problem isn't Declude but it is spam related so I'd be interested to see if 
anyone else has ideas.  I spent some time on the SmarterMail forums and this is 
what it looks like:

1. SM uses a series of built-in tests as well as external tests such as 
Declude.  Among these are a pair of URIBL tests that are based on links 
embedded in the messages.
2. SM scores a hit for each bad link reported by URIBL and applies the weight 
score to each hit.  With the default weight of 4, a message with five links 
rejected by URIBL would give a total score of 4 x 5 = 20.
3. Starting some time late 2012, URIBL started rejected some requests based on 
high volume of calls from a particular server.  Various people have experienced 
this problem at various times over the last three months. Once URIBL starts 
rejected the requests then every request gets scored as bad.  So, for example, 
every message with five embedded links gets a weight of 20, regardless of the 
legitimacy of those links.  This results in a sudden inflation of spam scores.
4. I don't understand how our mail server would be subject to this. Our volume 
of mail isn't just small, one might almost call it tiny.  The number of calls 
we make to URIBL are correspondingly very small.
5. The claim made by Those Who Know on the SM forum is that the URIBL rejection 
is really directed at those who use high volume public DNS servers. I'm not 
really sure how URIBL even knows which DNS server I use, but that's the claim.  
Since last year, I have had my SM server configured to use the Comcast national 
DNS servers (Comcast being my upstream provider). Since that's supposed to be 
the problem, I switched to our in-house public DNS server, but that didn't help 
either.  Then I tried setting up a private DNS server on the mail server itself 
and still couldn't get it to work.
6. Then I was told that I need to turn off recursion on the DNS server to be 
considered acceptable to URIBL. Again, I don't know why.  The problem is that I 
use the MS DNS server (Win 2008) and when you turn off recursion, it forced off 
forwarding as well.  There are many good reasons for not wanting to turn off 
forwarding (in fact, MS doesn't recommend it). So now I'm stuck between a rock 
and a hard place.
7. I tried writing to the URIBL abuse administrator but got no response and 
couldn't find any other contact information.

Anyone able to correct or illuminate me?

Thanks,

Ben
  - Original Message -
  From: Colbeck, Andrew
  To: Declude.JunkMail@declude.com
  Sent: Wednesday, March 06, 2013 3:27 PM
  Subject: RE: [Declude.JunkMail] why have spam scores jumped?


  Ben, check the archive website here 
http://www.mail-archive.com/declude.junkmail@declude.com/ for the mail you’ve 
missed.





  Andrew.





  From: SM Admin [mailto:imailad...@bcwebhost.net]
  Sent: Tuesday, March 05, 2013 10:10 PM
  To: Declude.JunkMail@declude.com
  Subject: Re: [Declude.JunkMail] why have spam scores jumped?



  Thanks for the heads-up, but I didn’t and still don’t see either my original 
email or the responses.  I just took a look at it via the web interface because 
sometime Microsoft Live Mail (like Outlook Express before it) will not show 
some messages where it doesn’t like the header, but I just don’t see either my 
message or the responses. I’m assuming what happened was exactly what I was 
asking about – those messages were given him spam scores and deleted.



  I don’t suppose you could resend those replies to the list?



  Thanks,



  Ben



  From: Randy Armbrecht

  Sent: Tuesday, March 05, 2013 11:12 AM

  To: Declude.JunkMail@declude.com

  Subject: RE: [Declude.JunkMail] why have spam scores jumped?



  Your Friday post did show up and already has 2 or 3 responses to it







  Sincerely,



  Randy Armbrecht

  Global Web Solutions, Inc.

  Office: 804.442.5300 x112

  Toll Free: 877.800.4562



  24 /7 Tech Support!

  Your Internet Source.Since 1996!



  NEW GlobalSync Remote-BackUp Solutions!



  Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services

  Hi-Speed DSL, Ethernet and Wireless Internet -  T-1/T-3's

  PC Support - Networking - Virus/MalWare Removal



  25% discount on most services for Non-Profits!  Call us today!



  From: SM Admin [mailto:imailad...@bcwebhost.net]
  Sent: Tuesday, March 05, 2013 1:52 PM
  To: Declude.JunkMail@declude.com
  Subject: [Declude.JunkMail] why have spam scores jumped?



  (I sent this message on Friday but it never showed up, so I thought I’d try 
again.)



  Hi,



  I don't know if anyone is still here but I'd like some insights into some 
strange anti-spam behavior.



  We have latest SmarterMail and Declude, as well as Sniffer. Over the last few 
days I noticed a significant drop in email messages.  Upon further 
investigation, I found that messages were being givn much higher spam scores 
than in the past, with 

Re: [Declude.JunkMail] why have spam scores jumped?

[SM Admin]

Thanks for the heads-up, but I didn’t and still don’t see either my original 
email or the responses.  I just took a look at it via the web interface because 
sometime Microsoft Live Mail (like Outlook Express before it) will not show 
some messages where it doesn’t like the header, but I just don’t see either my 
message or the responses. I’m assuming what happened was exactly what I was 
asking about – those messages were given him spam scores and deleted.

I don’t suppose you could resend those replies to the list?

Thanks,

Ben

From: Randy Armbrecht
Sent: Tuesday, March 05, 2013 11:12 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] why have spam scores jumped?

Your Friday post did show up and already has 2 or 3 responses to it







Sincerely,



Randy Armbrecht

Global Web Solutions, Inc.

Office: 804.442.5300 x112

Toll Free: 877.800.4562



24 /7 Tech Support!

Your Internet Source.Since 1996!



NEW GlobalSync Remote-BackUp Solutions!



Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services

Hi-Speed DSL, Ethernet and Wireless Internet -  T-1/T-3's

PC Support - Networking - Virus/MalWare Removal



25% discount on most services for Non-Profits!  Call us today!



From: SM Admin [mailto:imailad...@bcwebhost.net]
Sent: Tuesday, March 05, 2013 1:52 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] why have spam scores jumped?



(I sent this message on Friday but it never showed up, so I thought I’d try 
again.)



Hi,



I don't know if anyone is still here but I'd like some insights into some 
strange anti-spam behavior.



We have latest SmarterMail and Declude, as well as Sniffer. Over the last few 
days I noticed a significant drop in email messages.  Upon further 
investigation, I found that messages were being givn much higher spam scores 
than in the past, with the result that they get classified as spam or just 
outright deleted.  Checking the headers, however, I don't see why the scores 
are coming in so high.  Below are a few examples.  Does anyone see why the spam 
scores come out so high?



Thanks,



Ben



***

X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-2998-c
X-Declude-Sender: mstad...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 195938010.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [0] at 17:26:20 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:3, Declude: 0
X-SmarterMail-TotalSpamWeight: 15

*

-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-32767-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159487572.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 16:38:51 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:7, Declude: -3
X-SmarterMail-SpamDetail: 0.0 TVD_SUBJ_ACC_NUM
X-SmarterMail-SpamDetail: 0.0 T_OBFU_PDF_ATTACH
X-SmarterMail-TotalSpamWeight: 28

**

X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-32767-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159487567.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 16:35:50 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 1 [raw: 1], DK_None, DKIM_None, 
URIBL:10, Declude: -3
X-SmarterMail-TotalSpamWeight: 41

**

Just for comparison, here is an email from the same source from Tuesday (and 
very typical of past headers):



X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-27512-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159486224.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 17:56:38 on 26 Feb 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination

[Declude.JunkMail] why have spam scores jumped?

[SM Admin]

(I sent this message on Friday but it never showed up, so I thought I’d try 
again.)

Hi,

I don't know if anyone is still here but I'd like some insights into some 
strange anti-spam behavior.

We have latest SmarterMail and Declude, as well as Sniffer. Over the last few 
days I noticed a significant drop in email messages.  Upon further 
investigation, I found that messages were being givn much higher spam scores 
than in the past, with the result that they get classified as spam or just 
outright deleted.  Checking the headers, however, I don't see why the scores 
are coming in so high.  Below are a few examples.  Does anyone see why the spam 
scores come out so high?

Thanks,

Ben

***
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-2998-c
X-Declude-Sender: mstad...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 195938010.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [0] at 17:26:20 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:3, Declude: 0
X-SmarterMail-TotalSpamWeight: 15
*
-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-32767-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159487572.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 16:38:51 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:7, Declude: -3
X-SmarterMail-SpamDetail: 0.0 TVD_SUBJ_ACC_NUM
X-SmarterMail-SpamDetail: 0.0 T_OBFU_PDF_ATTACH
X-SmarterMail-TotalSpamWeight: 28
**
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-32767-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159487567.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 16:35:50 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 1 [raw: 1], DK_None, DKIM_None, 
URIBL:10, Declude: -3
X-SmarterMail-TotalSpamWeight: 41
**
Just for comparison, here is an email from the same source from Tuesday (and 
very typical of past headers):

X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-27512-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159486224.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 17:56:38 on 26 Feb 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 5 [raw: 3], DK_None, DKIM_None, 
Declude: -3
X-SmarterMail-TotalSpamWeight: 5




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] why have spam scores jumped?

[SM Admin]

Hi,

I don't know if anyone is still here but I'd like some insights into some 
strange anti-spam behavior.

We have latest SmarterMail and Declude, as well as Sniffer. Over the last few 
days I noticed a significant drop in email messages.  Upon further 
investigation, I found that messages were being givn much higher spam scores 
than in the past, with the result that they get classified as spam or just 
outright deleted.  Checking the headers, however, I don't see why the scores 
are coming in so high.  Below are a few examples.  Does anyone see why the spam 
scores come out so high?

Thanks,

Ben

***
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-2998-c
X-Declude-Sender: mstad...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 195938010.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [0] at 17:26:20 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:3, Declude: 0
X-SmarterMail-TotalSpamWeight: 15
*
-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-32767-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159487572.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 16:38:51 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:7, Declude: -3
X-SmarterMail-SpamDetail: 0.0 TVD_SUBJ_ACC_NUM
X-SmarterMail-SpamDetail: 0.0 T_OBFU_PDF_ATTACH
X-SmarterMail-TotalSpamWeight: 28
**
X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-32767-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159487567.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 16:35:50 on 01 Mar 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 1 [raw: 1], DK_None, DKIM_None, 
URIBL:10, Declude: -3
X-SmarterMail-TotalSpamWeight: 41
**
Just for comparison, here is an email from the same source from Tuesday (and 
very typical of past headers):

X-MessageSniffer-Scan-Result: 0
X-MessageSniffer-Rules: 0-0-0-27512-c
X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]
X-Declude-Spoolname: 159486224.eml
X-Declude-RefID:
X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-3] at 17:56:38 on 26 Feb 2013
X-Declude-Tests: SPFUNKNOWN [1]
X-Country-Chain: UNITED STATES->destination
X-Declude-Code: 1e
X-HELO: mail.garrettlaw.com
X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com
X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 5 [raw: 3], DK_None, DKIM_None, 
Declude: -3
X-SmarterMail-TotalSpamWeight: 5




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude subscription valid but IS EXPIRED KEY in diags.txt

[SM Admin]

Shock  for me too. I hope John will keep it up and that the whole thing won't 
fold away.
  - Original Message -
  From: Dean Lawrence
  To: Declude.JunkMail@declude.com
  Sent: Wednesday, January 30, 2013 4:13 PM
  Subject: Re: [Declude.JunkMail] Declude subscription valid but IS EXPIRED KEY 
in diags.txt


  Wow, that comes as a bit of a shock! Like I said, I just worked with David a 
couple of weeks ago. Thanks for the information Steve.



  On Wed, Jan 30, 2013 at 6:14 PM, Steve Cirivello  
wrote:

I did hear from Declude yesterday afternoon and again this morning.  John 
reports our IS EXPIRED KEY problem is finally repaired (on the 9th day after 
the initial voice/email inquiries.)

He also wrote: "David and Linda have both left our company and I will be 
your primary contact. We are experiencing overload on our virtual call machine 
for receiving calls and are in the process of correcting all calls forwarding."

You might email jprovost at the declude.com domain.  603 479 7640 was also 
contained in his message.  It's not clear if support@ is being monitored, or, 
David's and Linda's addresses.

David/Linda - thank you for many years of excellent customer service.

Steve

  - Original Message -
  From: Dean Lawrence
  To: Declude.JunkMail@declude.com
  Sent: Wednesday, January 30, 2013 9:52 AM
  Subject: Re: [Declude.JunkMail] Declude subscription valid but IS EXPIRED 
KEY in diags.txt


  Steve, were you able to get ahold of anyone at Declude? I need to reach 
them as well and am running into similar issues as you. The odd thing is, is 
that I Dave Barker a couple of weeks ago.



  On Mon, Jan 28, 2013 at 5:22 PM, Steve Cirivello 
 wrote:

Thank you Ben for your suggestions.  The CODE/key as shown in our 
account on declude.com is identical to the value that's been in our declude.cfg 
file for some time.  Our account page shows valid through Jan 2014, but, 
there's a red circle (not the usual greeen circle) in the upper left corner of 
the product/subscription status display box.

John (a new voice) fixed the subscription date last Wednesday morning.  
After the call, I bounced decludeproc, and, IS EXPIRED KEY is still in 
diags.txt.

Since that call with John last Wednesday morning, email messages to the 
usual addresses (including supp...@declude.com) are unanswered.  Phone calls to 
Declude are not answered (except the auto-attendant) -  1 for sales now rolls 
to a Skype authentication, and  2 for support rolls to voice mail.

I've bounced decludeproc several times a day since last Wednesday 
morning - no change.  Daily emails and voice messages remain unanswered.

This is very unusual.  Maybe it's just this customer?

Steve

  ----- Original Message -
  From: SM Admin
  To: Declude.JunkMail@declude.com
  Sent: Monday, January 28, 2013 10:29 AM
  Subject: Re: [Declude.JunkMail] Declude subscription valid but IS 
EXPIRED KEY in diags.txt


  Is it possible that they issued you a new key when you renewed?

  And what emails did you write to?

  Ben

  From: Steve Cirivello
  Sent: Monday, January 28, 2013 7:18 AM
  To: Declude.JunkMail@declude.com
  Subject: SPAM-LOW: [Declude.JunkMail] Declude subscription valid but 
IS EXPIRED KEY in diags.txt

  Hello,

  We've been a Declude customer for many years.  We renewed the annual 
subscription last Monday, and, on Tuesday, Declude (for IMail) stopped working 
with IS EXPIRED KEY in diags.txt

  We've been unable to reach anyone at Declude by phone or email since 
last Wednesday morning.  Has anyone contacted Declude recently and received a 
reply?

  Also, any suggestions for temporarily working around the IS EXPIRED 
KEY error.  Our customer/partner login on declude.com shows our subscription is 
valid until Jan 2014.  (We've considered purchasing a new subscription to get a 
new CODE/key, but if the purchase and CODE delivery process isn't completely 
automated we'd still be stuck.)

  Thanks.

  Steve


  --- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

  --- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

--- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and

Re: [Declude.JunkMail] Declude subscription valid but IS EXPIRED KEY in diags.txt

[SM Admin]

Hi Steve,

I'll admit this is worrisome.  My most recent declude contacts were with David 
Barker and his contact info is:

VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
dbar...@declude.com

I also got a few messages from:

Linda Pagillo
Declude Technical Support Engineer
866-332-5833 Ext. 2
lpagi...@declude.com

Post again if you have any update on reaching them or not.

Thanks,

Ben

- Original Message -
  From: Steve Cirivello
  To: Declude.JunkMail@declude.com
  Sent: Monday, January 28, 2013 2:22 PM
  Subject: SPAM-LOW: Re: [Declude.JunkMail] Declude subscription valid but IS 
EXPIRED KEY in diags.txt


  Thank you Ben for your suggestions.  The CODE/key as shown in our account on 
declude.com is identical to the value that's been in our declude.cfg file for 
some time.  Our account page shows valid through Jan 2014, but, there's a red 
circle (not the usual greeen circle) in the upper left corner of the 
product/subscription status display box.

  John (a new voice) fixed the subscription date last Wednesday morning.  After 
the call, I bounced decludeproc, and, IS EXPIRED KEY is still in diags.txt.

  Since that call with John last Wednesday morning, email messages to the usual 
addresses (including supp...@declude.com) are unanswered.  Phone calls to 
Declude are not answered (except the auto-attendant) -  1 for sales now rolls 
to a Skype authentication, and  2 for support rolls to voice mail.

  I've bounced decludeproc several times a day since last Wednesday morning - 
no change.  Daily emails and voice messages remain unanswered.

  This is very unusual.  Maybe it's just this customer?

  Steve

- Original Message -
From: SM Admin
To: Declude.JunkMail@declude.com
Sent: Monday, January 28, 2013 10:29 AM
Subject: Re: [Declude.JunkMail] Declude subscription valid but IS EXPIRED 
KEY in diags.txt


Is it possible that they issued you a new key when you renewed?

And what emails did you write to?

Ben

From: Steve Cirivello
Sent: Monday, January 28, 2013 7:18 AM
To: Declude.JunkMail@declude.com
Subject: SPAM-LOW: [Declude.JunkMail] Declude subscription valid but IS 
EXPIRED KEY in diags.txt

Hello,

We've been a Declude customer for many years.  We renewed the annual 
subscription last Monday, and, on Tuesday, Declude (for IMail) stopped working 
with IS EXPIRED KEY in diags.txt

We've been unable to reach anyone at Declude by phone or email since last 
Wednesday morning.  Has anyone contacted Declude recently and received a reply?

Also, any suggestions for temporarily working around the IS EXPIRED KEY 
error.  Our customer/partner login on declude.com shows our subscription is 
valid until Jan 2014.  (We've considered purchasing a new subscription to get a 
new CODE/key, but if the purchase and CODE delivery process isn't completely 
automated we'd still be stuck.)

Thanks.

Steve


--- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

--- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

  --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude subscription valid but IS EXPIRED KEY in diags.txt

[SM Admin]

Is it possible that they issued you a new key when you renewed?

And what emails did you write to?

Ben

From: Steve Cirivello
Sent: Monday, January 28, 2013 7:18 AM
To: Declude.JunkMail@declude.com
Subject: SPAM-LOW: [Declude.JunkMail] Declude subscription valid but IS EXPIRED 
KEY in diags.txt

Hello,

We've been a Declude customer for many years.  We renewed the annual 
subscription last Monday, and, on Tuesday, Declude (for IMail) stopped working 
with IS EXPIRED KEY in diags.txt

We've been unable to reach anyone at Declude by phone or email since last 
Wednesday morning.  Has anyone contacted Declude recently and received a reply?

Also, any suggestions for temporarily working around the IS EXPIRED KEY error.  
Our customer/partner login on declude.com shows our subscription is valid until 
Jan 2014.  (We've considered purchasing a new subscription to get a new 
CODE/key, but if the purchase and CODE delivery process isn't completely 
automated we'd still be stuck.)

Thanks.

Steve


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

[SM Admin]

Hi Sandy,

I forwarded your last reply to Comcast but haven't heard from anyone there 
since that last message where the tech says he can't help me any further.

At this point, I'd sure like to fight with them some more just because of the 
obnoxious replies by Mr. Jones, but I'm not sure it's worth the time.  What 
I've notice is that while I continue to get a trickle of messages showing up at 
the old mail server, since last weekend they've only been spam.  I'm not sure 
how, but it seems that some spammers are still latched on to the wrong (out of 
date) DNS information.  Strange, huh?

Thanks again for all your help and the same for Shaun.

Ben
  - Original Message -
  From: Sanford Whiteman
  To: Declude.JunkMail@declude.com
  Sent: Wednesday, November 28, 2012 7:24 PM
  Subject: Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS 
stuff


  Ben,

  Thanks for running your questions by me. Feel free to forward this
  message to your Comcast rep. Even if he is unwilling to help you
  further, there is information below that will help him be more
  accurate in future cases, since he currently lacks sufficient
  understanding of DNS.

  Mr. Jones is seemingly unaware of the difference between a delegated
  subdomain and a hostname. This gap in understanding does call the
  other conclusions into question, and I would not consider his to be an
  expert-level response. NOTE: I don't know if Comcast is or is not
  ultimately at fault for your mail delivery problems, but I would
  advise you to look for more expert testimony.

  It's perfectly normal for a hostname to be both the label and the
  value of an MX record (i.e. to "be its own MX"). In fact, the
  RFC-specified behavior of SMTP is to connect to the hostname to
  deliver mail to user@hostname in the absence of an MX record. All you
  are doing by adding  IN MX  is specifying that
  which would already be assumed (and also taking advantage of the MX
  algorithm).

  So normal is this configuration that I was able to quickly dig these
  examples from large, reputable domains:

  mail.beta.army.mil IN MX 10 mail.beta.army.mil
  ajax1.rutgers.edu IN MX 10 ajax1.rutgers.edu
  web.mail.vt.edu IN MX 0 web.mail.vt.edu
  webmail.uic.edu IN MX 0 webmail.uic.edu
  mail.messaging.microsoft.com IN MX 10 mail.messaging.microsoft.com
  webmail.villanova.edu IN MX 0 webmail.villanova.edu
  smtp01in.umuc.edu IN MX 0 smtp01in.umuc.edu
  mta4.wiscmail.wisc.edu IN MX 0 mta4.wiscmail.wisc.edu
  mail.dotster.com IN MX 0 mail.dotster.com

  Good luck with your continued troubleshooting!

  -- Sandy



  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to imail...@declude.com, and
  type "unsubscribe Declude.JunkMail".  The archives can be found
  at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

[SM Admin]

I should add that the number of erroneous emails sent to the old mail server
has decreased.  From Thursday through Saturday it went down to zero and I
was hoping the problem had gone away.  Then it started up again on Sunday,
but at lower volume than before.  Interestingly, most of the emails now
received at the old server are spam.  In the last three days, I've only
received one email personally that was real mail and that went to the old
server.  By comparison, a week ago I had to check my account on the old
server every hour.

Ben

-Original Message-
From: Sanford Whiteman
Sent: Tuesday, November 27, 2012 6:09 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS
stuff

> Actually, you did catch something.  The section that starts with
> "Authority".  In his email he says "Answer ns0.xname.org" which I
> take to mean that he is getting that authorotative response from
> nso0.xname.org and not ns1.xname.org as you assume below.

It means "ns0.xname.org" is part of the answer(s) to the question he
asked, i.e. the A record for ns0.xname.org.

Doesn't mean that is/is not the server queried.

-- S.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

[SM Admin]

Just for your amusement, here is my latest exchange with Comcast (read the
Comcast email first, then my response).

**
Dear Mr. Jones,

It does not surprise me that refuse to provide any further help.  Your
previous emails displayed a dismissive and confrontational attitude with a
lack of any real interest in finding an answer.  Your responses included
technical errors, contradictory statements, and failed to address some of my
key questions.  As near as I can tell, you are claiming that Comcast cannot
be responsible by simple proclamation.

Unfortunately, the evidence continues to indicate that Comcast is in same
way responsible.  The volume of erroneous emails has decreased, so perhaps
this was a temporary result of your recent change in DNS systems that is
slowly improving – one can only hope.  In the meanwhile, I would like a
referral to someone else at Comcast who has both technical knowledge and
some skill at customer relations.  Perhaps you or one of the others CC’d on
this email can provide that referral.

Sincerely,

Ben

From: Jones, Spencer
Sent: Wednesday, November 28, 2012 8:10 AM

As I stated before good luck. I can help you no more.

Spencer Jones
Engineer II Enterprise Technical Support
7150 S. Fulton St, Centennial, CO 80112





-Original Message-
From: Sanford Whiteman
Sent: Tuesday, November 27, 2012 6:09 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS
stuff

> Actually, you did catch something.  The section that starts with
> "Authority".  In his email he says "Answer ns0.xname.org" which I
> take to mean that he is getting that authorotative response from
> nso0.xname.org and not ns1.xname.org as you assume below.

It means "ns0.xname.org" is part of the answer(s) to the question he
asked, i.e. the A record for ns0.xname.org.

Doesn't mean that is/is not the server queried.

-- S.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

[SM Admin]

Hi Sandy,

Actually, you did catch something.  The section that starts with "Authority".  
In his email he says "Answer ns0.xname.org" which I take to mean that he is 
getting that authorotative response from nso0.xname.org and not ns1.xname.org 
as you assume below.  Which doesn't make sense to me because I just ran the 
DNSStuff tool against ns0.xname.org and came up with the correct results.

ns0.xname.org. [195.234.42.1] (124ms)


Response from ns0.xname.org. [195.234.42.1]


Results found: 8
  Domain Type Class TTL Response time Answer
  Answer section:
  bcwebhost.net. NS IN 43200 124ms ns1.twisted4life.com.
  bcwebhost.net. NS IN 43200 124ms ns2.xname.org.
  bcwebhost.net. NS IN 43200 124ms bcw4.bcwebhost.net.
  bcwebhost.net. NS IN 43200 124ms ns0.xname.org.
  Additional section:
  ns0.xname.org. A IN 600 124ms 195.234.42.1
  ns2.xname.org. A IN 600 124ms 88.191.64.64
  bcw4.bcwebhost.net. A IN 43200 124ms 173.164.65.197
  ns2.xname.org.  IN 600 124ms 2a01:e0b:1:64:240:63ff:fee8:6155



And those servers all report the correct NS records, as well as all the gtld 
servers report the correct results.  So how did he get bad results?

Thanks,

Ben

  - Original Message -
  From: Sanford Whiteman
  To: Declude.JunkMail@declude.com
  Sent: Tuesday, November 27, 2012 4:36 PM
  Subject: Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS 
stuff


  > In the end, he seems to be  saying that we have a name server
  > giving wrong results, which would make sense, except I can't figure
  > out which name servers he's referring to.  You'll see below where he
  > says "the NS0 name server points to NS1 and that will point to
  > mail2.bcwebhost.net and your incorrect IP address," and I don't see
  > that, do you?

  No.

  He's so far up his own... something... that he's decided upfront that
  it cannot be his problem, so he is willfully misreading the actual
  results.

  Look at this, from his message:

  > Authority:
  >xname.org.600   NS  ns2.xname.org.
  >xname.org.600   NS  ns3.xtremeweb.de.
  >xname.org.600   NS  ns0.xname.org.
  >xname.org.600   NS  ns1.xname.org.

  He claims to be getting this information from ns1.xname.org. I'm sure
  he is. The question is WHY he is querying ns1.xname.org, since it does
  not appear in the parents at gtld-servers.net nor in any NS records
  returned by your NSs.

  I think you may have a chicken-egg situation where he is actually
  using a broken server to check for brokenness!

  Tell him this: at *..gtld-servers.net, your NSs are

  NS-record for bcwebhost.net:
  DNS server = bcw4.bcwebhost.net
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns1.twisted4life.com
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns0.xname.org
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns2.xname.org
  TTL = 172800 (2 days)

  *AND* querying each of those NSs directly, the same list of NSs
  appears. Ask him if he differs with this. He can't.

  So why would ns1.xname.org even be on his mind? Why would he be
  hitting this server at all? Answer: he is not actually digging
  directly into your servers, but trusting his own, broken server. Which
  means he is not testing properly. What server is he using, anyway
  (never mind "non-Comcast tools")?

  Now, I grant you, his server wouldn't be "broken" per se if you had
  set, say, a 30-day TTL somewhere. That would be your fault. But we
  don't see that, or at least we can't see it anywhere in his results.

  > Do you see where in the stuff below it says that ns0 is getting its
  > results from ns1? The IP of ns1 is 178.33.255.252 and for ns0 it's
  > 195.234.42.1.

  No, and I don't even know what it would mean to be "getting its
  results from ns1." ns0 is returning authoritative results. As you
  said, he seems to be willfully making no sense: "getting its results
  from" is useless nonsense. Which is weird because in certain ways he
  seems to know what he's talking about.

  > At any rate, unless ns0 is really linked to ns1 as this guy claims,
  > then I don't see how ns1 is relevant.

  It isn't relevant. It isn't in the picture. If it's in the picture for
  him, he's not testing with working servers.

  > This is a subdomain
  > “ANYTHING.DOMAIN.TLD” is a subdomain and your mail.bcwebhost.net
  > subdomain should NOT have its own MX record.

  > Answer:

  >mail.bcwebhost.net.  43200  A 173.164.65.200

  > mail.bcwebhost.net. 43200  MX   0  
mail.bcwebhost.net.

  There is absolutely nothing wrong with this setup and I wish you could
  make this Spencer Jones idiot publish this claim in a DNS-centric
  place where he will be shamed (as opposed to a pretty 

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

[SM Admin]

Hi Sandy,

Actually, you did catch something.  The section that starts with "Authority".  
In his email he says "Answer ns0.xname.org" which I take to mean that he is 
getting that authorotative response from nso0.xname.org and not ns1.xname.org 
as you assume below.  Which doesn't make sense to me because I just ran the 
DNSStuff tool against ns0.xname.org and came up with the correct results.

ns0.xname.org. [195.234.42.1] (124ms)


Response from ns0.xname.org. [195.234.42.1]


Results found: 8
  Domain Type Class TTL Response time Answer
  Answer section:
  bcwebhost.net. NS IN 43200 124ms ns1.twisted4life.com.
  bcwebhost.net. NS IN 43200 124ms ns2.xname.org.
  bcwebhost.net. NS IN 43200 124ms bcw4.bcwebhost.net.
  bcwebhost.net. NS IN 43200 124ms ns0.xname.org.
  Additional section:
  ns0.xname.org. A IN 600 124ms 195.234.42.1
  ns2.xname.org. A IN 600 124ms 88.191.64.64
  bcw4.bcwebhost.net. A IN 43200 124ms 173.164.65.197
  ns2.xname.org.  IN 600 124ms 2a01:e0b:1:64:240:63ff:fee8:6155



And those servers all report the correct NS records, as well as all the gtld 
servers report the correct results.  So how did he get bad results?

Thanks,

Ben

  - Original Message -
  From: Sanford Whiteman
  To: Declude.JunkMail@declude.com
  Sent: Tuesday, November 27, 2012 4:36 PM
  Subject: Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS 
stuff


  > In the end, he seems to be  saying that we have a name server
  > giving wrong results, which would make sense, except I can't figure
  > out which name servers he's referring to.  You'll see below where he
  > says "the NS0 name server points to NS1 and that will point to
  > mail2.bcwebhost.net and your incorrect IP address," and I don't see
  > that, do you?

  No.

  He's so far up his own... something... that he's decided upfront that
  it cannot be his problem, so he is willfully misreading the actual
  results.

  Look at this, from his message:

  > Authority:
  >xname.org.600   NS  ns2.xname.org.
  >xname.org.600   NS  ns3.xtremeweb.de.
  >xname.org.600   NS  ns0.xname.org.
  >xname.org.600   NS  ns1.xname.org.

  He claims to be getting this information from ns1.xname.org. I'm sure
  he is. The question is WHY he is querying ns1.xname.org, since it does
  not appear in the parents at gtld-servers.net nor in any NS records
  returned by your NSs.

  I think you may have a chicken-egg situation where he is actually
  using a broken server to check for brokenness!

  Tell him this: at *..gtld-servers.net, your NSs are

  NS-record for bcwebhost.net:
  DNS server = bcw4.bcwebhost.net
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns1.twisted4life.com
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns0.xname.org
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns2.xname.org
  TTL = 172800 (2 days)

  *AND* querying each of those NSs directly, the same list of NSs
  appears. Ask him if he differs with this. He can't.

  So why would ns1.xname.org even be on his mind? Why would he be
  hitting this server at all? Answer: he is not actually digging
  directly into your servers, but trusting his own, broken server. Which
  means he is not testing properly. What server is he using, anyway
  (never mind "non-Comcast tools")?

  Now, I grant you, his server wouldn't be "broken" per se if you had
  set, say, a 30-day TTL somewhere. That would be your fault. But we
  don't see that, or at least we can't see it anywhere in his results.

  > Do you see where in the stuff below it says that ns0 is getting its
  > results from ns1? The IP of ns1 is 178.33.255.252 and for ns0 it's
  > 195.234.42.1.

  No, and I don't even know what it would mean to be "getting its
  results from ns1." ns0 is returning authoritative results. As you
  said, he seems to be willfully making no sense: "getting its results
  from" is useless nonsense. Which is weird because in certain ways he
  seems to know what he's talking about.

  > At any rate, unless ns0 is really linked to ns1 as this guy claims,
  > then I don't see how ns1 is relevant.

  It isn't relevant. It isn't in the picture. If it's in the picture for
  him, he's not testing with working servers.

  > This is a subdomain
  > “ANYTHING.DOMAIN.TLD” is a subdomain and your mail.bcwebhost.net
  > subdomain should NOT have its own MX record.

  > Answer:

  >mail.bcwebhost.net.  43200  A 173.164.65.200

  > mail.bcwebhost.net. 43200  MX   0  
mail.bcwebhost.net.

  There is absolutely nothing wrong with this setup and I wish you could
  make this Spencer Jones idiot publish this claim in a DNS-centric
  place where he will be shamed (as opposed to a pretty 

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

[SM Admin]

I remember Len Conrad from way back when, and I believe he could "hand him 
his"  Where would there be a DNS-centric list or forum where Len hangs out?

Thanks,

Ben
  - Original Message -
  From: Sanford Whiteman
  To: Declude.JunkMail@declude.com
  Sent: Tuesday, November 27, 2012 4:36 PM
  Subject: Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS 
stuff


  > In the end, he seems to be  saying that we have a name server
  > giving wrong results, which would make sense, except I can't figure
  > out which name servers he's referring to.  You'll see below where he
  > says "the NS0 name server points to NS1 and that will point to
  > mail2.bcwebhost.net and your incorrect IP address," and I don't see
  > that, do you?

  No.

  He's so far up his own... something... that he's decided upfront that
  it cannot be his problem, so he is willfully misreading the actual
  results.

  Look at this, from his message:

  > Authority:
  >xname.org.600   NS  ns2.xname.org.
  >xname.org.600   NS  ns3.xtremeweb.de.
  >xname.org.600   NS  ns0.xname.org.
  >xname.org.600   NS  ns1.xname.org.

  He claims to be getting this information from ns1.xname.org. I'm sure
  he is. The question is WHY he is querying ns1.xname.org, since it does
  not appear in the parents at gtld-servers.net nor in any NS records
  returned by your NSs.

  I think you may have a chicken-egg situation where he is actually
  using a broken server to check for brokenness!

  Tell him this: at *..gtld-servers.net, your NSs are

  NS-record for bcwebhost.net:
  DNS server = bcw4.bcwebhost.net
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns1.twisted4life.com
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns0.xname.org
  TTL = 172800 (2 days)
  NS-record for bcwebhost.net:
  DNS server = ns2.xname.org
  TTL = 172800 (2 days)

  *AND* querying each of those NSs directly, the same list of NSs
  appears. Ask him if he differs with this. He can't.

  So why would ns1.xname.org even be on his mind? Why would he be
  hitting this server at all? Answer: he is not actually digging
  directly into your servers, but trusting his own, broken server. Which
  means he is not testing properly. What server is he using, anyway
  (never mind "non-Comcast tools")?

  Now, I grant you, his server wouldn't be "broken" per se if you had
  set, say, a 30-day TTL somewhere. That would be your fault. But we
  don't see that, or at least we can't see it anywhere in his results.

  > Do you see where in the stuff below it says that ns0 is getting its
  > results from ns1? The IP of ns1 is 178.33.255.252 and for ns0 it's
  > 195.234.42.1.

  No, and I don't even know what it would mean to be "getting its
  results from ns1." ns0 is returning authoritative results. As you
  said, he seems to be willfully making no sense: "getting its results
  from" is useless nonsense. Which is weird because in certain ways he
  seems to know what he's talking about.

  > At any rate, unless ns0 is really linked to ns1 as this guy claims,
  > then I don't see how ns1 is relevant.

  It isn't relevant. It isn't in the picture. If it's in the picture for
  him, he's not testing with working servers.

  > This is a subdomain
  > “ANYTHING.DOMAIN.TLD” is a subdomain and your mail.bcwebhost.net
  > subdomain should NOT have its own MX record.

  > Answer:

  >mail.bcwebhost.net.  43200  A 173.164.65.200

  > mail.bcwebhost.net. 43200  MX   0  
mail.bcwebhost.net.

  There is absolutely nothing wrong with this setup and I wish you could
  make this Spencer Jones idiot publish this claim in a DNS-centric
  place where he will be shamed (as opposed to a pretty dormant ML).
  Someone like Len Conrad could hand him his

  -- S.

  ---
  Sanford Whiteman, Chief Technologist
  Broadleaf Systems, a division of
  Cypress Integrated Systems, Inc.
  e-mail: sa...@cypressintegrated.com

  SpamAssassin plugs into Declude!

http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/

  Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail 
Aliases!

http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/

http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/



  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to imail...@declude.com, and
  type "unsubscribe Declude.JunkMail".  The archives can be found
  at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The a

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

Hi Sandy,

Thanks for the info on TTL.  We don't change very often and we're pretty low
volume, so 4 hours would be fine.

The link you provide is what I found before: it's a Windows port but it's
uncompiled.  Lacking a compiler, I was looking for something precompiled.

Thanks,

Ben

-Original Message-
From: Sanford Whiteman
Sent: Monday, November 26, 2012 7:20 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] MX, DNS and other weird stuff

> So, two questions: first, is there a version of p0f that runs under
> Windows?
> I found the Unix version and I found a Windows-port version that is not
> compiled (and I haven't used a real compiler in at least ten years).

http://packetstormsecurity.org/files/download/109101/p0f-3.03b-win.zip

> Second question: what's the popular recommendation for DNS TTL nowadays? I
> think I reset mine many years ago after a discussion here among some other
> people.

"Universal" default TTL? You could say 4 hours. But it depends on the
application, the stage you're at with setting up a new host (testing
vs. long-term stable), the need for dynamic changes, all, of course,
balanced against much load you want/need to shed.

I test using 5m TTLs, but also keep 5- and 10-minute TTLs permanently
where we have geographic clusters because that's the only way they
work. In other cases, I try for one day. Rarely do I use more than a
day even when a host has been stable for a long period, even if I
could; with our traffic, I don't mind one DNS request per day for each
session.

For reference, you can look around at high-traffic sites like web
analytics. My two analytics packages use 60s and 5m. I think the first
one was at my behest because one of their servers kept going down and
needing to be null-routed a couple of years ago!

-- S.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

Hi Guys,

So, two questions: first, is there a version of p0f that runs under Windows?
I found the Unix version and I found a Windows-port version that is not
compiled (and I haven't used a real compiler in at least ten years).

Second question: what's the popular recommendation for DNS TTL nowadays? I
think I reset mine many years ago after a discussion here among some other
people.

Thanks,

Ben

-Original Message-
From: Sanford Whiteman
Sent: Friday, November 23, 2012 6:01 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] MX, DNS and other weird stuff

It's not really a complex setup unless you have (or had) a secondary
that is capable of reloading with bad records. It shouldn't be
possible to have a proper secondary that does this, as it should use
either standard *XFR methods or some proprietary sync mechanism at
startup to get the right records (incl serial #) from its primary.

Since your tests show all of your possible NSs giving the right
results when q'd directly (although you can't be sure it's 100% of the
time if the secondaries are outside your control) the "good" news is
now you are justified in using p0f to try to see if something is
sitting in-between your Comcast boxes and the outside world. You could
set up a box the just sends a barrage of queries to the Comcast NSs
and pipes the p0f results to a file, then scan it after a day and see
if anything looks amiss.

Re: subdomain v. hostname, as mail.bcwebhost.net has an IP address
assigned to it, it should be considered a hostname. If the label had
only NSs,, it would be considered a subdomain that could have child
hostnames. I have no idea what the Comcast dude is saying about
"subdomain that has an MX." If it were a delegated subdomain, that
might be notable, but it's not.

One other thing: is it possible that you have a rally long TTL
that you set at some point that might still send people to the
bad/strange server? You could have mistyped and have 30 days to wait
it out

-- S.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

Hi,

I just now did an nslookup mail.bcwebhost.net  on each of our DNS servers,
including the now no longer used ns1.xname.org. They all, even that last
one, gave the correct IP address of .200.  My observations about
ns1.xname.org from last week was that sometimes it had the right serial
number and sometimes not.  I got the impression that someone was reloading
it with old records, possibly due to hardware crashing.  Anyway, we no
longer use that server.

So what is the extra complexity that you think we have in our DNS
configuration? I wasn't intending to make anything complicated.  I have the
MX records pointing to A record mail, which points to the .200 IP address. I
also have a second A I record mail1 pointing to the same IP. I don't see why
any of this should be a problem?

Also, did you understand the Comcast guy's reference to subdomain? I know an
address such as mail.bcwebhost.net can be a host or a subdomain, but I
didn't consider the two phrases to be synonymous. And we don't have any
subdomains.

Thanks,

Ben

-Original Message-
From: SM Admin
Sent: Thursday, November 22, 2012 12:22 PM
To: Declude.JunkMail@declude.com
Subject: Fw: [Declude.JunkMail] MX, DNS and other weird stuff



-Original Message-
From: Sanford Whiteman
Sent: Thursday, November 22, 2012 11:55 AM
To: imailad...@bcwebhost.net
Subject: Re: [Declude.JunkMail] MX, DNS and other weird stuff

[I'm not subscribed using this address, but it's the only one on my mobile.
Pls feel free to forward to the list.]

This guy's idea that  IN MX  is incorrect and "will cause
issues" should really get him fired if he's the highest-level tech on this.
When you want to set up a proper MX record to catch replies to
postmas...@mysmtpserver.example.com, you of course do this by setting up
such a record.  Otherwise the implication would be that you can never
receive mail at the same machine that originated it, but have to come up
with some fake additional hostname?  Ridiculous.  Servers have been set up
this way since the old days, when it was common to see addresses like
u...@host.example.com (as opposed to just @example.com).

Likewise, the idea that an intermediate host that is exempt from
anti-spoofing measures can't reroute DNS requests is ridic.  This is how our
egress filters work: a machine listens using a network monitoring port and
sends synthesized replies back if a website is in the block list.  (The
machine isn't a proxy, it's just listening to the switch's mirroring port in
promiscuous mode).

However, it is true that you have some complexity in your NSs that you need
to work out.  If you hadn't asked about interception it wouldn't have been
my first guess.  When you directly query each NS, what do you get?

-- S.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Fw: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

-Original Message-
From: Sanford Whiteman
Sent: Thursday, November 22, 2012 11:55 AM
To: imailad...@bcwebhost.net
Subject: Re: [Declude.JunkMail] MX, DNS and other weird stuff

[I'm not subscribed using this address, but it's the only one on my mobile.
Pls feel free to forward to the list.]

This guy's idea that  IN MX  is incorrect and "will cause
issues" should really get him fired if he's the highest-level tech on this.
When you want to set up a proper MX record to catch replies to
postmas...@mysmtpserver.example.com, you of course do this by setting up
such a record.  Otherwise the implication would be that you can never
receive mail at the same machine that originated it, but have to come up
with some fake additional hostname?  Ridiculous.  Servers have been set up
this way since the old days, when it was common to see addresses like
u...@host.example.com (as opposed to just @example.com).

Likewise, the idea that an intermediate host that is exempt from
anti-spoofing measures can't reroute DNS requests is ridic.  This is how our
egress filters work: a machine listens using a network monitoring port and
sends synthesized replies back if a website is in the block list.  (The
machine isn't a proxy, it's just listening to the switch's mirroring port in
promiscuous mode).

However, it is true that you have some complexity in your NSs that you need
to work out.  If you hadn't asked about interception it wouldn't have been
my first guess.  When you directly query each NS, what do you get?

-- S.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

Hi,

First, I want to thank Shaun and Sandy for truly useful replies.  Next, below 
is a response from someone at Comcast – presumably an engineer of some sort. 
I’m trying to fit together his comments (I find his tone pretty argumentative) 
with the points made here.  For examples, Shaun seems to have shown that 
Comcast can intercept A-calls and I know that Comcast told me three years ago 
they intercept some calls, and yet here is this guy claiming it’s impossible.

One thing Spencer has correct is a problem with ns1.xname.org.  I have 
secondary DNS services set up with xname and twisted4life and I noticed last 
week that of the three xname servers (ns0, ns1, ns2), ns1 frequently had an old 
serial number.  One day it would be 131 or something similar, which is about 
correct, and then the next day it would be 120, which is old.  So last weekend 
I removed all references to ns1 (but kept ns0 and ns2 as secondaries) from our 
server and the registrar accounts.  Really, by the time Spencer wrote to me 
yesterday afternoon, he shouldn’t have seen any references to ns1.xname.org.

Any comments?

Thanks,

Ben

From: Jones, Spencer
Sent: Wednesday, November 21, 2012 2:39 PM
To: b...@bcwebhost.net
Cc: Self, Andrew
Subject: FW: DNS zone files for BC Web LLC (Ben Bednarz)



Sir,



As to what you have below. Your MX record does point to a host 
name, but then that subdomain that does point to an A record and should ONLY 
point to an A record has an MX record of its own. This is NOT set up correctly, 
and WILL create issues. As far as our DNS servers intercepting DNS request 
traffic. That is not possible. If I make a DNS request it will go to 8.8.8.8, 
and if that server does not know the answer it goes to one of the 13 ROOT 
servers, then if the root server does not know the IP it goes to the TLD 
servers, they know the NS of the domain and go to that IP to get the answer if 
they do not know it. That is it, our servers can not and would have no way to 
know what traffic is going across the Comcast network, and then pull in packets 
that are DNS requests. Tens of  thousands of people on Comcast’s network run 
DNS servers, including me and I do not have an issue. I bind to NASA’s ROOT 
server and everything pulls from there. I also host a Name Server on the 
network and never have I had a request answered by another NS. How do you 
suspect that our servers intercept traffic meant for your IP address, but only 
yours and only if it is a DNS request, and not any other traffic? Please show 
the 2 domain query’s below to your DNS expert and see if he feels that is 
correct that the subdomain points to itself. I am sorry you are having this 
issue but forward records of zone files we do not host CAN NOT be our issue, 
and in no way can ANY DNS server intercept a packet meant for another IP 
address. I see five name servers below for this domain and when I look up 
mail.bcwebhost.net on ns1.xname.org it gives me the answer of 
mail2.bcwebhost.net. So I found your issue and as I said it is NOT a Comcast 
one.









Query: bcwebhost.net.  Query type: Any record

Recursive query: Yes Authoritative answer: Yes

Query time: 188 ms. Server name: n/a



Answer:

   bcwebhost.net. 43200  A   173.164.65.201

   bcwebhost.net. 43200  NSbcw4.bcwebhost.net.

   bcwebhost.net. 43200  NSns0.xname.org.

   bcwebhost.net. 43200  NSns2.xname.org.

   bcwebhost.net. 43200  NSns1.twisted4life.com.

   bcwebhost.net. 43200  SOA  bcw4.bcwebhost.net.

  
administrator.bcwebhost.net.

  133   

; serial

  21600 

  ; refresh (6 hours)

  3600  

   ; retry (1 hour)

  2419200   

; expire (28 days)

  43200 

  ; minimum (12 hours)

   bcwebhost.net. 43200  MX0  mail.bcwebhost.net.

   bcwebhost.net. 43200  TXT  "v=spf1 a mx a:bcw5, a:bcw6, 
a:mail1 ip4:73.164.65.192/28 -all"



Additional:

   bcw4.bcwebhost.net.43200  A   173.164.65.197

   ns2.xname.org.  19A   88.191.64.64

   ns1.tw

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

Hi Shaun,

Thank you for a helpful response.  I am CC'ing the list with this so I can
get your response posted there.

Thanks,

Ben

-Original Message-
From: Shaun Sturby
Sent: Wednesday, November 21, 2012 9:01 AM
To: imailad...@bcwebhost.net
Subject: RE: [Declude.JunkMail] MX, DNS and other weird stuff

Hello Ben,

(I get Declude mailing list messages but can't reply for some reason)

I used the DNSStuff ISP Cached DNS records tester for mail.bcwebhost.net and
all the records came back with the 173.164.65.200 IP EXCEPT for Comcast (NJ)
which came back with "mail.bcwebhost.net. 0 IN A 68.87.92.78".  Note that
this
is a very short TTL

If you connect to that IP address you will see that the URL changes to
'http://selfinstall1.comcast.com/captiveportal/index.html'.

Yet a DNS Cache Check using http://dns.comcast.net/ shows the correct .200
IP
address.

They did change DNS recently as this announcement shows.
Comcast recursive resolver IPs (68.87.64.146, 68.87.64.150, and
68.87.64.196)
will no longer be supported after October 12, 2012. If you manually
configured
any of these IPs on your device, please allow DHCP to update your DNS
resolver
IP addresses or update manually with 75.75.75.75 and 75.75.76.76.

It looks like they intercept all A records to allow them to re-direct people
to their management portal. I have seen this done before with ISP's like
Telus
when you need to register the MAC address of your router with your account
but
typically this uses a RFC 1918 private IP space and not live IP addresses.

This is not the solution to your problem but is additional information to
help
you when you deal with ComCast.

Shaun Sturby
Technical Services Manager
sh...@optrics.com
Optrics Engineering | www.Optrics.com
Canada:
  6810 - 104 Street, Edmonton, AB, T6H 2L6
  TF: 877-463-7638Fax: 780-432-5630
USA:
  1740 S 300 West #10, Clearfield, UT, 84015
  TF: 877-386-3763Fax: 801-705-3150


This message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and delete
this e-mail from your system. E-mail transmission cannot be guaranteed to be
secure or error-free as information could be intercepted, corrupted, lost,
destroyed, arrive late or incomplete, or contain viruses. The sender
therefore
does not accept liability for any errors or omissions in the contents of
this
message, which arise as a result of e-mail transmission. If verification is
required please request a hard-copy version.


From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Tuesday, November 20, 2012 5:05 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] MX, DNS and other weird stuff

Hi,

This is a question about DNS records and MX records and how I'm getting some
weird behavior.  It's not strictly speaking Declude issue, but I have a lot
of
respect for the people that used to hang out here and I'm hoping there's
someone around who can give me some insights.

Original problem:
We use Comcast for our upstream provider.  A few years ago, when we switched
to them from our telecom provider, they told us that their DNS servers would
sometimes intercept DNS calls even though we have our own DNS server.  This
was supposedly because we only rent a small IP subnet from them.  At the
time,
they had us send copies of our zone records to them so that their DNS
servers
would have the same information as our DNS server.  This worked fine until
this fall, when we installed a new mail server on a new IP address.  Our DNS
server, of course, was updated to reflect this change.  However, mail
sometimes shows up at the old mail server anyway, in a more or less random
pattern.

It apprears to me that most of the time when people send mail to us, their
mail servers correctly getting the IP address resolved by our DNS server.
However, about 25% of the time, it appears that the DNS request from those
sending mail servers receives an outdated response from some unidentified
Comcast DNS server, resulting in the wrong IP address and the mail ends up
going to our old mail server.

Suppose, for example, that you send a message to imailad...@bcwebhost.net
(the
address I'm using here, which is a misnomer since our new mail server is
running SmarterMail).  The MX records for bcwebhost.net points to
mail.bcwebhost.net and the A record mail.bcwebhost.net points to our new
server IP (ending in .200).  So your email should arrive at our new mail
server.  However, sometimes it will arrive at the old mail server named
mail2.bcwebhost.net (IP ending in .193).  The old DNS records had the
bcwebhost.net MX record pointing to mail2.bcwebhost.net, for which the A
record pointed to .193 (the old server).

I've been going in circles for about a month with Comcast on this and th

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[SM Admin]

Thanks!

-Original Message-
From: Sanford Whiteman
Sent: Tuesday, November 20, 2012 10:37 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] MX, DNS and other weird stuff

> Thanks for the info.  Is there any problem with using the same host name
> for
> both MX record and A record?

None at all. It is arguably redundant, as the host name will be tried
in the absence of an A record, but it is best to keep your zones
self-explanatory and not rely on fallback mechanisms.  IN MX
 is fine.

-- S.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] MX, DNS and other weird stuff

[IMail Admin]

Hi Sandy,

Thanks for the info.  Is there any problem with using the same host name for
both MX record and A record?  Although this wouldn't apply if you are
writing to me at imailad...@bcwebhost.net because the MX record has no host
name but it points to a real host name (mail.bcwebhost.net). However, would
there be a problem writing to me at imailad...@mail.bcwebhost.net, since the
MX record for mail.bcwebhost.net points to mail.bcwebhost.net, which is an A
record?

Thanks,

Ben

-Original Message-
From: Sanford Whiteman
Sent: Tuesday, November 20, 2012 5:32 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] MX, DNS and other weird stuff

> Second problem:
> In our new DNS records, I have it set up something like this:

> two MX records:
> bcwebhost.net MX mail.bcwebhost.net
> mail.bcwebhost.net MX mail.bcwebhost.net

> one A record:
> mail.bcwebhost.net A (IP.200)

> Is there any reason I can't have the same name for both an MX and
> an A record (in this case, mail.bcwebhost.net)?

> The Comcast people claimed this was wrong and that the MX record
> should point to an IP address directly instead of a host name (which
> I'm sure is wrong).

Absolutely, without any doubt, they are wrong.

MX RRs MUST point to A (hostname) records per RFC. Not to alias
(CNAME) records (though this can function 95% of the time, it is an
RFC violation). And *definitely* not to IPs.

"This domain name must have as its value one or more address records.
Currently those will be A records, however in the future other record
types giving addressing information may be acceptable."

"The domain name used as the value of a NS resource record, or part of
the value of a MX resource record must not be an alias."

-- both RFC 2181

> They tried to claim that this is the cause of my original problem
> but even if they're right about this, then it still doesn't explain the
> original problem.

I'll reflect on your first problem later. Do not worry at all that
they are right here.

-- Sandy



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] MX, DNS and other weird stuff

[Imail Admin]

Hi,

This is a question about DNS records and MX records and how I'm getting some 
weird behavior.  It's not strictly speaking Declude issue, but I have a lot of 
respect for the people that used to hang out here and I'm hoping there's 
someone around who can give me some insights.

Original problem:
We use Comcast for our upstream provider.  A few years ago, when we switched to 
them from our telecom provider, they told us that their DNS servers would 
sometimes intercept DNS calls even though we have our own DNS server.  This was 
supposedly because we only rent a small IP subnet from them.  At the time, they 
had us send copies of our zone records to them so that their DNS  servers would 
have the same information as our DNS server.  This worked fine until this fall, 
when we installed a new mail server on a new IP address.  Our DNS server, of 
course, was updated to reflect this change.  However, mail sometimes shows up 
at the old mail server anyway, in a more or less random pattern.

It apprears to me that most of the time when people send mail to us, their mail 
servers correctly getting the IP address resolved by our DNS server.  However, 
about 25% of the time, it appears that the DNS request from those sending mail 
servers receives an outdated response from some unidentified Comcast DNS 
server, resulting in the wrong IP address and the mail ends up going to our old 
mail server.

Suppose, for example, that you send a message to imailad...@bcwebhost.net (the 
address I'm using here, which is a misnomer since our new mail server is 
running SmarterMail).  The MX records for bcwebhost.net points to 
mail.bcwebhost.net and the A record mail.bcwebhost.net points to our new server 
IP (ending in .200).  So your email should arrive at our new mail server.  
However, sometimes it will arrive at the old mail server named 
mail2.bcwebhost.net (IP ending in .193).  The old DNS records had the 
bcwebhost.net MX record pointing to mail2.bcwebhost.net, for which the A record 
pointed to .193 (the old server).

I've been going in circles for about a month with Comcast on this and they 
don't recall that they're the ones who told me three years ago that they 
sometimes intercept DNS calls.  I was wondering if anyone has any ideas or 
suggestions on how to track down the errant DNS calls?

Second problem:
In our new DNS records, I have it set up something like this:

two MX records:
bcwebhost.net MX mail.bcwebhost.net
mail.bcwebhost.net MX mail.bcwebhost.net

one A record:
mail.bcwebhost.net A (IP.200)

Is there any reason I can't have the same name for both an MX and an A record 
(in this case, mail.bcwebhost.net)? The Comcast people claimed this was wrong 
and that the MX record should point to an IP address directly instead of a host 
name (which I'm sure is wrong).

They tried to claim that this is the cause of my original problem but even if 
they're right about this, then it still doesn't explain the original problem.

Thanks,

Ben


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] abused whitelist?

[IMail Admin]

The SA on that server isn’t active but we’re going to move over to SmarterMail 
with a new Declude anyway.

I was figuring that this client’s own account must be compromised, since it’s 
their return address.  However, why does the country chain come out blank?

Thanks,

Ben

P.S. Yes, I know we have Hijack but – try not to laugh – I’ve never used it and 
we’ve had it for years.

From: Linda Pagillo
Sent: Monday, October 22, 2012 9:25 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] abused whitelist?

Hey fellas, the list is still here, just not very active. I apologize for the 
delay in my response, Ben. It looks like you may have a compromised account on 
your server. Do you have a Declude service agreement? If yes, I will be happy 
to have a look at your server and let you know for sure. If not, you can enable 
Declude Hijack which is a part of your Declude suite and it should catch the 
emails being sent from the compromised account. Thanks.






From: "andyb@thumpernet" 
Sent: Monday, October 22, 2012 8:33 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] abused whitelist?

Hi,

aha!

Thanks,
Andrew Baldwin

an...@thumpernet.com
an...@thumpernet.com
315-277-0685

Monday, October 22, 2012, 7:53:29 PM, you wrote:

DC> Hi Andy,

DC> He sent it to the Declude Junkmail list, of which you are a member.
DC> However, the list is pretty much defunct. Declude switched to online forums
DC> years ago, which effectively killed the list.

DC> Darin.

DC> -Original Message-
DC> From: andyb@thumpernet
DC> Sent: Monday, October 22, 2012 6:03 PM
DC> To: Declude.JunkMail@declude.com
DC> Subject: Re: [Declude.JunkMail] abused whitelist?

DC> Hi,

DC> I think you're sending this to the wrong place. Who/what company are
DC> you looking for?

DC> Thanks,
DC> Andrew Baldwin

DC> an...@thumpernet.com
DC> an...@thumpernet.com
DC> 315-277-0685

DC> Monday, October 22, 2012, 2:54:29 PM, you wrote:

IA>>
IA>>
IA>>
IA>>
IA>>
IA>> Hi,

IA>>
IA>>
IA>>

IA>>
IA>>
IA>> We have a client that is getting bounced spams. When I check
IA>> the header, it looks like they’re being whitelisted through
IA>> Declude. I checked the whitelisting settings and only have
IA>> “whitelist auth” (autowhitelist is off). Does this mean their
IA>> account is hacked? How else could the spam get whitelisted?

IA>>
IA>>
IA>>

IA>>
IA>>
IA>> Here is the Declude header, although I can’t figure out why the country
DC> chain is blank.

IA>>
IA>>
IA>>

IA>>
IA>> X-Declude-Sender: off...@somedomain.com [190.0.103.59]
IA>> X-Declude-Spoolname: D8baa03aac020.smd
IA>> X-Declude-Note: Scanned by Declude 4.2.20 for spam.
IA>> "http://www.declude.com/x-note.htm";
IA>> X-Declude-Scan: Score [0] at 11:09:02 on 22 Oct 2012
IA>> X-Declude-Fail: Whitelisted, ZEROHOUR [0]
IA>> X-Country-Chain:

IA>>
IA>>
IA>> Thanks,

IA>>
IA>>
IA>>

IA>>
IA>>
IA>> Ben





IA>> --- This E-mail came from the Declude.JunkMail mailing list. To
IA>> unsubscribe, just send an E-mail to imail...@declude.com, and type
IA>> "unsubscribe Declude.JunkMail". The archives can be found at
DC> http://www.mail-archive.com.




DC> ---
DC> This E-mail came from the Declude.JunkMail mailing list. To
DC> unsubscribe, just send an E-mail to imail...@declude.com, and
DC> type "unsubscribe Declude.JunkMail". The archives can be found
DC> at http://www.mail-archive.com.



DC> ---
DC> This E-mail came from the Declude.JunkMail mailing list. To
DC> unsubscribe, just send an E-mail to imail...@declude.com, and
DC> type "unsubscribe Declude.JunkMail". The archives can be found
DC> at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] abused whitelist?

[IMail Admin]

Hi,
We have a client that is getting bounced spams.  When I check the header, it 
looks like they’re being whitelisted through Declude.  I checked the 
whitelisting settings and only have “whitelist auth” (autowhitelist is off). 
Does this mean their account is hacked? How else could the spam get whitelisted?
Here is the Declude header, although I can’t figure out why the country chain 
is blank.
X-Declude-Sender: off...@somedomain.com [190.0.103.59]
X-Declude-Spoolname: D8baa03aac020.smd
X-Declude-Note: Scanned by Declude 4.2.20 for spam.
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Score [0] at 11:09:02 on 22 Oct 2012
X-Declude-Fail: Whitelisted, ZEROHOUR [0]
X-Country-Chain:

Thanks,
Ben

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] invisible attachments?

[Imail Admin]

Thanks Steve.  That's the kind of solution I'd already found which doesn't 
help.  In fact, in the discussion on that link there are some whose problems 
were apparently not resolved and others where they were solved.

Ben
  - Original Message -
  From: Steve Cirivello
  To: Declude.JunkMail@declude.com
  Sent: Monday, March 12, 2012 6:44 PM
  Subject: Re: [Declude.JunkMail] invisible attachments?


  Perhaps this issue:

  http://www.tomshardware.com/forum/236687-49-outlook-express-attachments

  along with Microsoft Support Article ID 197066

  Steve


- Original Message -
    From: Imail Admin
To: Declude.JunkMail@declude.com
Sent: Monday, March 12, 2012 6:10 PM
Subject: [Declude.JunkMail] invisible attachments?


Hi,

I have a  problem with invisible attachments and I'm wondering if it's an 
IMail problem, a Declude problem, or something else.

A law firm that I've dealt with for a long time recently has a problem that 
messages send to us with attachments sometimes don't display the attachments.  
They leave the sender with an attachment, but they arrive with no clue that  
there is an attachment.  If I forward them on to a gmail account I use for 
testing, then the attachments are visible there.

I've tested this with both Outlook Express and Mail Live on the receiving 
end and see nothing about the attachments.   I check on an Android phone using 
K-9 and it doesn't show the attachments but does show the mail.dat file usually 
associated with Outlook and the formatting of messages (and these senders are 
using Outlook with MS Exchange).  However, the usual fix (use Plain Text Only) 
doesn't seem to help.

My first thought was that the attachments were getting stripped (by 
Declude?) at our server.  But since they still seem to be there once I forward 
to the gmail account, that excludes that idea.  I haven't had any problems 
receiving test JPG files as attachments and sometimes their PDF files get 
through just fine. So any idea what's going on here?

Thanks,

Ben

--- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

  --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] invisible attachments?

[Imail Admin]

Hi,

I have a  problem with invisible attachments and I'm wondering if it's an IMail 
problem, a Declude problem, or something else.

A law firm that I've dealt with for a long time recently has a problem that 
messages send to us with attachments sometimes don't display the attachments.  
They leave the sender with an attachment, but they arrive with no clue that  
there is an attachment.  If I forward them on to a gmail account I use for 
testing, then the attachments are visible there.

I've tested this with both Outlook Express and Mail Live on the receiving end 
and see nothing about the attachments.   I check on an Android phone using K-9 
and it doesn't show the attachments but does show the mail.dat file usually 
associated with Outlook and the formatting of messages (and these senders are 
using Outlook with MS Exchange).  However, the usual fix (use Plain Text Only) 
doesn't seem to help.

My first thought was that the attachments were getting stripped (by Declude?) 
at our server.  But since they still seem to be there once I forward to the 
gmail account, that excludes that idea.  I haven't had any problems receiving 
test JPG files as attachments and sometimes their PDF files get through just 
fine. So any idea what's going on here?

Thanks,

Ben

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Time to upgrade and to what?

[Imail Admin]

Last June I posted a question and got some great replies. Being preoccupied 
with work that actually pays me money, I haven’t done anything yet, but the 
time is getting close. My question now is: what OS?

Our old Imail 2006 runs on Win Server 2000. Would SmarterMail run on Win 7 Pro? 
Would it run on a 64-bit version and would there be any point in using the 
64-bit version? I ask because I’ve actually got a spare system sitting around 
with just that and it has 4 GB of RAM. I’d like to take advantage of all that 
ram.

Thanks in advance,

Ben

  From: IMail Admin
  Sent: Tuesday, June 07, 2011 10:28 AM
  To: Declude.JunkMail@declude.com
  Subject: Re: [Declude.JunkMail] Time to upgrade and to what?

  Thanks, that helped.


  From: Todd Richards
  Sent: Monday, June 06, 2011 6:18 PM
  To: Declude.JunkMail@declude.com
  Subject: RE: [Declude.JunkMail] Time to upgrade and to what?

  Hey Ben –



  If you haven’t already, you can download a trial of SmarterMail to give you a 
hands on feel for how the interface works, from the system administrator to a 
domain administrator to an end user.  I can’t speak to the latest version of 
SmarterMail as we are still running 6.9xx (we have a current subscription but 
never felt the need yet to upgrade – probably will soon), nor can I offer a 
good comparison, since we were still on IMail 8.2x when we made the change.  
There were three main reasons we made the switch:  cost, a much improved web 
interface from our IMail 8.2x version, and the massive number of positive 
recommendations about switching to SM.  Like the others, we have never looked 
back.  We too were on the unlimited version of IMail, but are on a 1000 user 
version of SmarterMail.  That has proved plenty for us at this point.  The nice 
thing is, if we need more then we add them on.



  We are heavy users of the Mailing Lists in SmarterMail.  I like the fact that 
we can manage subscribers separate from lists.  Our main domain (the one that I 
am on) currently has almost 70 mailing lists.  It’s great that, via the web 
interface, we can add a single subscriber to multiple lists.  We can also go 
into the individual lists and manage subscribers as well.  You can add your own 
custom fields to the subscriber screens if you want to track Name, City, 
Company Name, etc.  It also has the ability to remove a user from the lists if 
they have a certain number of bounces.  While that feature was nice, we 
actually increased it (maybe even turned it off – can’t remember for sure 
without going and looking) because it would remove someone and nobody ever knew 
about it.  There were requests about maybe alerting the administrator of such a 
change, or disabling a user versus removing them, etc.  I’m just not sure 
whether that part has been upgraded.  Again, we are on SmarterMail 6.9 but I 
don’t think the rest of it has changed that much.



  The one thing that I didn’t like about the mailing lists is that we had an 
ASP page with all of the options that people could subscribe to.  At the end, 
when they hit submit, it would fire off an email to IMail and subscribe (or 
unsubscribe) them from all of their choices in one swoop.  SmarterMail didn’t 
handle things that way, and would simply make the change for the first option 
but ignore the rest of them.  We weren’t aware of that at first and had people 
think they were making changes but they really weren’t.  SmarterMail does offer 
the ability to tie web pages to the mail server using SOAP, etc.  But I don’t 
know it and haven’t had the time to make the changeover.



  Todd









  From: Imail Admin [mailto:imailad...@bcwebhost.net]
  Sent: Monday, June 06, 2011 6:12 PM
  To: Declude.JunkMail@declude.com
  Subject: Re: [Declude.JunkMail] Time to upgrade and to what?



  I guess my three areas on concern would be how IM and SM compare in their web 
mail interface, how they compare in administration, and how they compare in 
list server.  We make pretty modest use of the IM list server (which is pretty 
primitive), but I would hate to give it up altogether.



  Thanks for any comments,



  Ben

- Original Message -

From: Heimir Eidskrem

To: Declude.JunkMail@declude.com

Sent: Monday, June 06, 2011 1:41 PM

Subject: Re: [Declude.JunkMail] Time to upgrade and to what?



We dumped Imail after being with them since version 4 I think.
Moved to Smartermail and never looked back.

Our customers really like SM and we have nothing but positive feedback.

the transition was easy with the migration tools from SM.

I would do it again with no hesitation.




On 6/1/2011 9:09 PM, Imail Admin wrote:

I've been musing over whether it's time to upgrade or replace my mail 
system.  I've got IMail (unlimited users) v 2006.23 on an old server runing 
Win2k Advanced Server with Declude v.?? (not current, whatever it is).  On the 
one hand, I only have a small number of domains and mail boxes 

Re: [Declude.JunkMail] Time to upgrade and to what?

[IMail Admin]

Last June I posted a question and got some great replies. Being preoccupied 
with work that actually pays me money, I haven’t done anything yet, but the 
time is getting close. My question now is: what OS?

Our old Imail 2006 runs on Win Server 2000. Would SmarterMail run on Win 7 Pro? 
Would it run on a 64-bit version and would there be any point in using the 
64-bit version? I ask because I’ve actually got a spare system sitting around 
with just that and it has 4 GB of RAM. I’d like to take advantage of all that 
ram.

Thanks in advance,

Ben


From: IMail Admin
Sent: Tuesday, June 07, 2011 10:28 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Time to upgrade and to what?

Thanks, that helped.


From: Todd Richards
Sent: Monday, June 06, 2011 6:18 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Time to upgrade and to what?

Hey Ben –



If you haven’t already, you can download a trial of SmarterMail to give you a 
hands on feel for how the interface works, from the system administrator to a 
domain administrator to an end user.  I can’t speak to the latest version of 
SmarterMail as we are still running 6.9xx (we have a current subscription but 
never felt the need yet to upgrade – probably will soon), nor can I offer a 
good comparison, since we were still on IMail 8.2x when we made the change.  
There were three main reasons we made the switch:  cost, a much improved web 
interface from our IMail 8.2x version, and the massive number of positive 
recommendations about switching to SM.  Like the others, we have never looked 
back.  We too were on the unlimited version of IMail, but are on a 1000 user 
version of SmarterMail.  That has proved plenty for us at this point.  The nice 
thing is, if we need more then we add them on.



We are heavy users of the Mailing Lists in SmarterMail.  I like the fact that 
we can manage subscribers separate from lists.  Our main domain (the one that I 
am on) currently has almost 70 mailing lists.  It’s great that, via the web 
interface, we can add a single subscriber to multiple lists.  We can also go 
into the individual lists and manage subscribers as well.  You can add your own 
custom fields to the subscriber screens if you want to track Name, City, 
Company Name, etc.  It also has the ability to remove a user from the lists if 
they have a certain number of bounces.  While that feature was nice, we 
actually increased it (maybe even turned it off – can’t remember for sure 
without going and looking) because it would remove someone and nobody ever knew 
about it.  There were requests about maybe alerting the administrator of such a 
change, or disabling a user versus removing them, etc.  I’m just not sure 
whether that part has been upgraded.  Again, we are on SmarterMail 6.9 but I 
don’t think the rest of it has changed that much.



The one thing that I didn’t like about the mailing lists is that we had an ASP 
page with all of the options that people could subscribe to.  At the end, when 
they hit submit, it would fire off an email to IMail and subscribe (or 
unsubscribe) them from all of their choices in one swoop.  SmarterMail didn’t 
handle things that way, and would simply make the change for the first option 
but ignore the rest of them.  We weren’t aware of that at first and had people 
think they were making changes but they really weren’t.  SmarterMail does offer 
the ability to tie web pages to the mail server using SOAP, etc.  But I don’t 
know it and haven’t had the time to make the changeover.



Todd









From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Monday, June 06, 2011 6:12 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Time to upgrade and to what?



I guess my three areas on concern would be how IM and SM compare in their web 
mail interface, how they compare in administration, and how they compare in 
list server.  We make pretty modest use of the IM list server (which is pretty 
primitive), but I would hate to give it up altogether.



Thanks for any comments,



Ben

  - Original Message -

  From: Heimir Eidskrem

  To: Declude.JunkMail@declude.com

  Sent: Monday, June 06, 2011 1:41 PM

  Subject: Re: [Declude.JunkMail] Time to upgrade and to what?



  We dumped Imail after being with them since version 4 I think.
  Moved to Smartermail and never looked back.

  Our customers really like SM and we have nothing but positive feedback.

  the transition was easy with the migration tools from SM.

  I would do it again with no hesitation.




  On 6/1/2011 9:09 PM, Imail Admin wrote:

  I've been musing over whether it's time to upgrade or replace my mail 
system.  I've got IMail (unlimited users) v 2006.23 on an old server runing 
Win2k Advanced Server with Declude v.?? (not current, whatever it is).  On the 
one hand, I only have a small number of domains and mail boxes any more and on 
the other hand, my old server is looking pretty lo

Re: [Declude.JunkMail] error message in declude log

[Imail Admin]

I stared at those lines for 15 minutes  without seeing the obvious.  Is it 
weekend yet?

Thanks,

Ben

  - Original Message -
  From: Colbeck, Andrew
  To: Declude.JunkMail@declude.com
  Sent: Wednesday, August 17, 2011 5:10 PM
  Subject: RE: [Declude.JunkMail] error message in declude log


  Sometimes a cigar is just a cigar.

  Look at the order of your lines. You have a duplicate pair of weight4
  lines between your "7" and "8" pair.


  Andrew 8)



  -Original Message-
  From: IMail Admin [mailto:imailad...@bcwebhost.net]
  Sent: Wednesday, August 17, 2011 4:56 PM
  To: Declude.JunkMail@declude.com
  Subject: [Declude.JunkMail] error message in declude log

  Hi,

  I'm getting the following lines in my log file:

  08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration
  in following line in configuration file ('weight' is not an ACTION). May
  be a duplicate test definition?
  08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4 weight x x 4 0
  08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration
  in following line in configuration file ('weightrange' is not an
  ACTION). Maybe a duplicate test definition?
  08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4r weightrange x x 4
  8

  They seem to only cover tests 4 and 4r, but I actually have a whole
  series
  of these:

  #WEIGHT10 weight  x x 10 0
  #WEIGHT14 weight  x x 14 0
  #WEIGHT20 weight  x x 20 0
  #WEIGHT30 weight  x x 30 0
  WEIGHT5  weight  x x 5 0
  WEIGHT5r weightrange x x 5 9
  WEIGHT10 weight  x x 10 0
  WEIGHT10r weightrange x x 10 14
  WEIGHT15 weight  x x 15 0
  WEIGHT15r weightrange x x 15 19
  WEIGHT20 weight  x x 20 0
  WEIGHT20r weight  x x 20 29
  WEIGHT30 weight  x x 30 0
  WEIGHT30r weight  x x 30 39
  WEIGHT2  weight  x x 2 0
  WEIGHT2r weightrange x x 2 4
  WEIGHT3  weight  x x 3 0
  WEIGHT3r weightrange x x 3 6
  WEIGHT4  weight  x x 4 0
  WEIGHT4r weightrange x x 4 8
  WEIGHT6  weight  x x 6 0
  WEIGHT6r weightrange x x 6 9
  WEIGHT7  weight  x x 7 0
  WEIGHT7r weightrange x x 7 14
  WEIGHT4  weight  x x 4 0
  WEIGHT4r weightrange x x 4 8
  WEIGHT8  weight  x x 8 0
  WEIGHT8r weightrange x x 8 12
  WEIGHT9  weight  x x 9 0
  WEIGHT9r weightrange x x 9 12
  WEIGHT12 weight  x x 12 0
  WEIGHT12r weightrange x x 12 15

  I didn't have this problem before. Any idea what I screwed up?

  Thanks,

  Ben

  (global.cfg attached)


  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to imail...@declude.com, and
  type "unsubscribe Declude.JunkMail".  The archives can be found
  at http://www.mail-archive.com.


  This message (and any associated files) may contain confidential, proprietary 
and/or privileged material and access to these materials by anyone other than 
the intended recipient is unauthorized. Unauthorized recipients are required to 
maintain confidentiality. Any review, retransmission, dissemination or other 
use of these materials by persons or entities other than the intended recipient 
is prohibited and may be unlawful. If you have received this message in error, 
please notify us immediately and destroy the original.


  Ce message et tout document qui y est eventuellement joint peuvent contenir 
de l'information confidentielle ou exclusive. L'acces a cette information par 
quiconque autre que le destinataire designe en est donc interdit. Les personnes 
ou les entites non autorisees doivent respecter la confidentialite de cette 
information. La lecture, la retransmission, la communication ou toute autre 
utilisation de cette information par une personne ou une entite non autorisee 
est strictement interdite. Si vous avez recu ce message par erreur, veuillez 
nous en aviser immediatement et le detruire.


  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to imail...@declude.com, and
  type "unsubscribe Declude.JunkMail".  The archives can be found
  at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] error message in declude log

[IMail Admin]

Hi,

I'm getting the following lines in my log file:

08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration in
following line in configuration file ('weight' is not an ACTION). May be a
duplicate test definition?
08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4 weight x x 4 0
08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration in
following line in configuration file ('weightrange' is not an ACTION). May
be a duplicate test definition?
08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4r weightrange x x 4 8

They seem to only cover tests 4 and 4r, but I actually have a whole series
of these:

#WEIGHT10 weight  x x 10 0
#WEIGHT14 weight  x x 14 0
#WEIGHT20 weight  x x 20 0
#WEIGHT30 weight  x x 30 0
WEIGHT5  weight  x x 5 0
WEIGHT5r weightrange x x 5 9
WEIGHT10 weight  x x 10 0
WEIGHT10r weightrange x x 10 14
WEIGHT15 weight  x x 15 0
WEIGHT15r weightrange x x 15 19
WEIGHT20 weight  x x 20 0
WEIGHT20r weight  x x 20 29
WEIGHT30 weight  x x 30 0
WEIGHT30r weight  x x 30 39
WEIGHT2  weight  x x 2 0
WEIGHT2r weightrange x x 2 4
WEIGHT3  weight  x x 3 0
WEIGHT3r weightrange x x 3 6
WEIGHT4  weight  x x 4 0
WEIGHT4r weightrange x x 4 8
WEIGHT6  weight  x x 6 0
WEIGHT6r weightrange x x 6 9
WEIGHT7  weight  x x 7 0
WEIGHT7r weightrange x x 7 14
WEIGHT4  weight  x x 4 0
WEIGHT4r weightrange x x 4 8
WEIGHT8  weight  x x 8 0
WEIGHT8r weightrange x x 8 12
WEIGHT9  weight  x x 9 0
WEIGHT9r weightrange x x 9 12
WEIGHT12 weight  x x 12 0
WEIGHT12r weightrange x x 12 15

I didn't have this problem before. Any idea what I screwed up?

Thanks,

Ben

(global.cfg attached)


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


global.cfg
Description: Binary data

Re: [Declude.JunkMail] white list or positive weight for a specific To address?

[IMail Admin]

“It is just our way.”  That has such a Zen sound to it, like you must find your 
own path to enlightenment.

I am still confused by both your suggestion and Randy’s.  They both seem to be 
based on the From line, which would not be declude.com.  Here are the first few 
header lines from one of Randy’s emails in this discussion:

Received: from smtp.declude.com [216.144.195.81] by mail2.bcwebhost.net with 
ESMTP
  (SMTPD-9.23) id A94001FC; Sat, 18 Jun 2011 11:06:56 -0700
Received: from smail.globalweb.net (smail.globalweb.net [208.74.80.105]) by 
smtp.declude.com with SMTP;
   Sat, 18 Jun 2011 13:05:28 -0500
Received: from HRADellDTPC (173-163-199-121-richmond.hfc.comcastbusiness.net 
[173.163.199.121]) by smail.globalweb.net with SMTP;
   Sat, 18 Jun 2011 14:05:05 -0400
From: "Randy A" 
To: Declude.JunkMail@declude.com
References: <-291971859_45532...@smtp.declude.com> 
<-170080375_45540...@smtp.declude.com> <242286454_45562...@smtp.declude.com> 
<251212219_45563...@smtp.declude.com> <258933297_45563...@smtp.declude.com> 
<317249079_45567...@smtp.declude.com> <51015843_49160...@smtp.declude.com> 
<82729453_49162...@smtp.declude.com> <119798468_49164...@smtp.declude.com>
In-Reply-To: <119798468_49164...@smtp.declude.com>
Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?
Date: Sat, 18 Jun 2011 14:06:08 -0400

I would expect both your whitelist technique and Randy’s counter-weighting to 
apply to the From line, which shows ra...@globalweb.us, not Declude.com.  So am 
I misunderstanding how these tests work?  Do they use the In-Reply-To line 
instead?  Or search the whole header?

Thanks,

Ben

From: Nick Hayer
Sent: Saturday, June 18, 2011 12:12 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?

yup there is some sort of cap in global.cfg   the around that is with a 
whitelist file that would contain entries like:
MAILFROMWHITELISTCONTAINS@declude.com

and clearly implementation technique is a personal thing  :)
We use compensatory filters to add/subtract weights as needed, and whitelist 
filters for whitelisting - which I am not suggesting is a better way.  Its just 
our way..

-Nick


MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm





From: "Randy A" 
Sent: Saturday, June 18, 2011 2:23 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?


Yes but if I remember correctly there is a limit on the number of whitelist 
entries you can have in the cfg file (200 I think – please correct me if I am 
wrong) so depending on the number of domains you are hosting email for, this 
could fill up at some point.  We use the whitelist technique for our company 
needs, and the text file format for customer needs so everything is in one 
location for easier management.







Sincerely,



Randy Armbrecht

Global Web Solutions, Inc.

Office: 804.442.5300 option 1

Toll Free: 877.800.4562



24 /7 Tech Support!

Your Internet Source.Since 1996!



NEW GlobalSync Remote-BackUp Solutions!



Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services Hi-Speed DSL and 
Wireless Internet -  T-1/T-3's PC Support - Networking - Virus/MalWare Removal



25% discount on most services for Non-Profits!  Call us today!



From: Nick Hayer [mailto:n...@madriveraccess.com]
Sent: Saturday, June 18, 2011 2:10 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To 
address?



An easy way to whitelist these in your global.cfg >
WHITELISTFROM@declude.com

-Nick

MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm




----

From: "IMail Admin" 
Sent: Saturday, June 18, 2011 1:36 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To 
address?

Can you give me the line you used in the config file?



From: Randy A

Sent: Saturday, June 18, 2011 12:18 AM

To: Declude.JunkMail@declude.com

Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?



On my declude config, I set up a GoodMailList test text file, added a negative 
point value to this test, and then I add any of my customer’s email lists that 
were getting flagged by declude







S

Re: [Declude.JunkMail] white list or positive weight for a specific To address?

[IMail Admin]

I’m confused on what part of the envelope this is filtering on.  List messages 
show up in the mailbox as From Contributor (such as From: Randy A) and To 
Listname (such as To: Declude.JunkMail).  I want the positive weight to only 
apply to list messages, which means the weight has to be filtered on the To 
line.  It would seem your list below gives weight based on the From line?  Or 
perhaps from both From and To lines?

Ben


From: Randy A
Sent: Saturday, June 18, 2011 11:06 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?

We scale on a base of mark as Spam at 15; quarantine at 20; delete at 30



In my global.config file I have:

FILTER-GOODMAILINGLISTS   fromfileC:\...path to 
file…\filter-GoodMailingLists.txt  x  -20  0





In the default.junkmail file:

FILTER-GOODMAILINGLISTS   WARN





The actual filter-GoodMailingLists.txt file includes lines like:

ema...@domain1.com   #actual full email address

Domain2.com#deduct points for anything incl. this domain, 
i.e. em...@domain2.com or em...@sub.domain2.com or em...@otherdomain2.com

@alerts.wachovia.com  #deduct points for emails from this specific subdomain

@Domain3.com#deduct points for anything from this specific 
domain





Sincerely,



Randy Armbrecht

Global Web Solutions, Inc.

Office: 804.442.5300 option 1

Toll Free: 877.800.4562



24 /7 Tech Support!

Your Internet Source.Since 1996!



NEW GlobalSync Remote-BackUp Solutions!



Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services Hi-Speed DSL and 
Wireless Internet -  T-1/T-3's PC Support - Networking - Virus/MalWare Removal



25% discount on most services for Non-Profits!  Call us today!



From: IMail Admin [mailto:imailad...@bcwebhost.net]
Sent: Saturday, June 18, 2011 1:32 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To 
address?



Can you give me the line you used in the config file?



From: Randy A

Sent: Saturday, June 18, 2011 12:18 AM

To: Declude.JunkMail@declude.com

Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?



On my declude config, I set up a GoodMailList test text file, added a negative 
point value to this test, and then I add any of my customer’s email lists that 
were getting flagged by declude







Sincerely,



Randy Armbrecht

Global Web Solutions, Inc.

Office: 804.442.5300 option 1

Toll Free: 877.800.4562



24 /7 Tech Support!

Your Internet Source.Since 1996!



NEW GlobalSync Remote-BackUp Solutions!



Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services Hi-Speed DSL and 
Wireless Internet -  T-1/T-3's PC Support - Networking - Virus/MalWare Removal



25% discount on most services for Non-Profits!  Call us today!



From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Friday, June 17, 2011 6:31 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] white list or positive weight for a specific To 
address?



Hi,



The emails I receive from this list have various >From lines but always have 
one To line: Declude.JunkMail@declude.com.  I would like to white list or, 
better yet, add a positive weight for emails I receive addressed to 
Declude.JunkMail@declude.com.  How do I do this?



Thanks,



Ben




--
This message has been scanned for viruses and
dangerous content by the ipengines.net MailScanner and is
believed to be clean.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--
This message has been scanned for viruses and
dangerous content by the ipengines.net MailScanner and is
believed to be clean.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] white list or positive weight for a specific To address?

[IMail Admin]

I like the idea of reverse weights over whitelisting.  The problem with 
whitelisting is that the mail is guaranteed to get through.  I just want to 
counter-weight mail from a list.  For example, I have one list that typically 
shows up with a weight of 4-6.  I can counter that with –4 and then if 
something really bad shows up, it is likely to have a much larger weight (20+) 
and my counter-weight won’t matter.  I like this for individual addresses as 
well.

Ben


From: Nick Hayer
Sent: Saturday, June 18, 2011 11:09 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To 
address?

An easy way to whitelist these in your global.cfg >
WHITELISTFROM@declude.com

-Nick


MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm





From: "IMail Admin" 
Sent: Saturday, June 18, 2011 1:36 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To 
address?


Can you give me the line you used in the config file?

From: Randy A
Sent: Saturday, June 18, 2011 12:18 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?

On my declude config, I set up a GoodMailList test text file, added a negative 
point value to this test, and then I add any of my customer’s email lists that 
were getting flagged by declude







Sincerely,



Randy Armbrecht

Global Web Solutions, Inc.

Office: 804.442.5300 option 1

Toll Free: 877.800.4562



24 /7 Tech Support!

Your Internet Source.Since 1996!



NEW GlobalSync Remote-BackUp Solutions!



Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services Hi-Speed DSL and 
Wireless Internet -  T-1/T-3's PC Support - Networking - Virus/MalWare Removal



25% discount on most services for Non-Profits!  Call us today!



From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Friday, June 17, 2011 6:31 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] white list or positive weight for a specific To 
address?



Hi,



The emails I receive from this list have various >From lines but always have 
one To line: Declude.JunkMail@declude.com.  I would like to white list or, 
better yet, add a positive weight for emails I receive addressed to 
Declude.JunkMail@declude.com.  How do I do this?



Thanks,



Ben




--
This message has been scanned for viruses and
dangerous content by the ipengines.net MailScanner and is
believed to be clean.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] white list or positive weight for a specific To address?

[IMail Admin]

Can you give me the line you used in the config file?

From: Randy A
Sent: Saturday, June 18, 2011 12:18 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To 
address?

On my declude config, I set up a GoodMailList test text file, added a negative 
point value to this test, and then I add any of my customer’s email lists that 
were getting flagged by declude







Sincerely,



Randy Armbrecht

Global Web Solutions, Inc.

Office: 804.442.5300 option 1

Toll Free: 877.800.4562



24 /7 Tech Support!

Your Internet Source.Since 1996!



NEW GlobalSync Remote-BackUp Solutions!



Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services Hi-Speed DSL and 
Wireless Internet -  T-1/T-3's PC Support - Networking - Virus/MalWare Removal



25% discount on most services for Non-Profits!  Call us today!



From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Friday, June 17, 2011 6:31 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] white list or positive weight for a specific To 
address?



Hi,



The emails I receive from this list have various >From lines but always have 
one To line: Declude.JunkMail@declude.com.  I would like to white list or, 
better yet, add a positive weight for emails I receive addressed to 
Declude.JunkMail@declude.com.  How do I do this?



Thanks,



Ben




--
This message has been scanned for viruses and
dangerous content by the ipengines.net MailScanner and is
believed to be clean.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] white list or positive weight for a specific To address?

[Imail Admin]

Hi,

The emails I receive from this list have various From lines but always have one 
To line: Declude.JunkMail@declude.com.  I would like to white list or, better 
yet, add a positive weight for emails I receive addressed to 
Declude.JunkMail@declude.com.  How do I do this?

Thanks,

Ben

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Time to upgrade and to what?

[IMail Admin]

Thanks, that helped.


From: Todd Richards
Sent: Monday, June 06, 2011 6:18 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Time to upgrade and to what?

Hey Ben –



If you haven’t already, you can download a trial of SmarterMail to give you a 
hands on feel for how the interface works, from the system administrator to a 
domain administrator to an end user.  I can’t speak to the latest version of 
SmarterMail as we are still running 6.9xx (we have a current subscription but 
never felt the need yet to upgrade – probably will soon), nor can I offer a 
good comparison, since we were still on IMail 8.2x when we made the change.  
There were three main reasons we made the switch:  cost, a much improved web 
interface from our IMail 8.2x version, and the massive number of positive 
recommendations about switching to SM.  Like the others, we have never looked 
back.  We too were on the unlimited version of IMail, but are on a 1000 user 
version of SmarterMail.  That has proved plenty for us at this point.  The nice 
thing is, if we need more then we add them on.



We are heavy users of the Mailing Lists in SmarterMail.  I like the fact that 
we can manage subscribers separate from lists.  Our main domain (the one that I 
am on) currently has almost 70 mailing lists.  It’s great that, via the web 
interface, we can add a single subscriber to multiple lists.  We can also go 
into the individual lists and manage subscribers as well.  You can add your own 
custom fields to the subscriber screens if you want to track Name, City, 
Company Name, etc.  It also has the ability to remove a user from the lists if 
they have a certain number of bounces.  While that feature was nice, we 
actually increased it (maybe even turned it off – can’t remember for sure 
without going and looking) because it would remove someone and nobody ever knew 
about it.  There were requests about maybe alerting the administrator of such a 
change, or disabling a user versus removing them, etc.  I’m just not sure 
whether that part has been upgraded.  Again, we are on SmarterMail 6.9 but I 
don’t think the rest of it has changed that much.



The one thing that I didn’t like about the mailing lists is that we had an ASP 
page with all of the options that people could subscribe to.  At the end, when 
they hit submit, it would fire off an email to IMail and subscribe (or 
unsubscribe) them from all of their choices in one swoop.  SmarterMail didn’t 
handle things that way, and would simply make the change for the first option 
but ignore the rest of them.  We weren’t aware of that at first and had people 
think they were making changes but they really weren’t.  SmarterMail does offer 
the ability to tie web pages to the mail server using SOAP, etc.  But I don’t 
know it and haven’t had the time to make the changeover.



Todd









From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Monday, June 06, 2011 6:12 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Time to upgrade and to what?



I guess my three areas on concern would be how IM and SM compare in their web 
mail interface, how they compare in administration, and how they compare in 
list server.  We make pretty modest use of the IM list server (which is pretty 
primitive), but I would hate to give it up altogether.



Thanks for any comments,



Ben

  - Original Message -

  From: Heimir Eidskrem

  To: Declude.JunkMail@declude.com

  Sent: Monday, June 06, 2011 1:41 PM

  Subject: Re: [Declude.JunkMail] Time to upgrade and to what?



  We dumped Imail after being with them since version 4 I think.
  Moved to Smartermail and never looked back.

  Our customers really like SM and we have nothing but positive feedback.

  the transition was easy with the migration tools from SM.

  I would do it again with no hesitation.




  On 6/1/2011 9:09 PM, Imail Admin wrote:

  I've been musing over whether it's time to upgrade or replace my mail 
system.  I've got IMail (unlimited users) v 2006.23 on an old server runing 
Win2k Advanced Server with Declude v.?? (not current, whatever it is).  On the 
one hand, I only have a small number of domains and mail boxes any more and on 
the other hand, my old server is looking pretty long in the tooth.

  Â

  I started out looking at boxes to build a new server, but they're not that 
expensive any more.  Then I got caughter up in the software.  Ipswitch wants 
$2300 or some such for a software upgrade (unlimited users).  That's way more 
than I can justify spending.  I don't really need unlimited users any more, 
but I hate to give it up.  On the other hand, I recall a few years ago when 
people were switching en masse to SmaterMail so I looked at them and their 
prices are a lot nice.  Anyone care to say how the current versions of either 
software compared with my old IMail?

  Â

  I assume that I'll have to upgrade to the current version of Declude

Re: [Declude.JunkMail] Time to upgrade and to what?

[Imail Admin]

I guess my three areas on concern would be how IM and SM compare in their web 
mail interface, how they compare in administration, and how they compare in 
list server.  We make pretty modest use of the IM list server (which is pretty 
primitive), but I would hate to give it up altogether.

Thanks for any comments,

Ben
  - Original Message -
  From: Heimir Eidskrem
  To: Declude.JunkMail@declude.com
  Sent: Monday, June 06, 2011 1:41 PM
  Subject: Re: [Declude.JunkMail] Time to upgrade and to what?


  We dumped Imail after being with them since version 4 I think.
  Moved to Smartermail and never looked back.

  Our customers really like SM and we have nothing but positive feedback.

  the transition was easy with the migration tools from SM.

  I would do it again with no hesitation.




  On 6/1/2011 9:09 PM, Imail Admin wrote:
I've been musing over whether it's time to upgrade or replace my mail 
system.  I've got IMail (unlimited users) v 2006.23 on an old server runing 
Win2k Advanced Server with Declude v.?? (not current, whatever it is).  On the 
one hand, I only have a small number of domains and mail boxes any more and on 
the other hand, my old server is looking pretty long in the tooth.
Â
I started out looking at boxes to build a new server, but they're not that 
expensive any more.  Then I got caughter up in the software.  Ipswitch wants 
$2300 or some such for a software upgrade (unlimited users).  That's way more 
than I can justify spending.  I don't really need unlimited users any more, 
but I hate to give it up.  On the other hand, I recall a few years ago when 
people were switching en masse to SmaterMail so I looked at them and their 
prices are a lot nice.  Anyone care to say how the current versions of either 
software compared with my old IMail?
Â
I assume that I'll have to upgrade to the current version of Declude, but 
otherwise that will work the same as before?
Â
Any suggestions or pointers would be appreciated.
Â
Thanks,
Â
Ben
Â

--- This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


  --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Time to upgrade and to what?

[IMail Admin]

What is the difference from a user point of view?  If you’re using a mail 
client such as Outlook with IMAP, I imagine you wouldn’t see any difference.  
So the only place I would expect to see a change is in the web interface?

Ben


From: Nick Hayer
Sent: Thursday, June 02, 2011 5:27 AM
To: Declude.JunkMail@declude.com
Subject: re: [Declude.JunkMail] Time to upgrade and to what?

I have the latest versions of both; I bought SM to dump Imail but found that 
some customers are simply resistant to change. So rather than risk losing them 
I am keeping Imail up to date.

Privately Imail maybe receptive to price matching SM [give them a call?] - so 
that is a 3rd option.

-Nick


MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm





From: "Imail Admin" 
Sent: Wednesday, June 01, 2011 10:10 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Time to upgrade and to what?

?
I've been musing over whether it's time to upgrade or replace my mail system.  
I've got IMail (unlimited users) v 2006.23 on an old server runing Win2k 
Advanced Server with Declude v.?? (not current, whatever it is).  On the one 
hand, I only have a small number of domains and mail boxes any more and on the 
other hand, my old server is looking pretty long in the tooth.

I started out looking at boxes to build a new server, but they're not that 
expensive any more.  Then I got caughter up in the software.  Ipswitch wants 
$2300 or some such for a software upgrade (unlimited users).  That's way more 
than I can justify spending.  I don't really need unlimited users any more, but 
I hate to give it up.  On the other hand, I recall a few years ago when people 
were switching en masse to SmaterMail so I looked at them and their prices are 
a lot nice.  Anyone care to say how the current versions of either software 
compared with my old IMail?

I assume that I'll have to upgrade to the current version of Declude, but 
otherwise that will work the same as before?

Any suggestions or pointers would be appreciated.

Thanks,

Ben


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Time to upgrade and to what?

[Imail Admin]

I've been musing over whether it's time to upgrade or replace my mail system.  
I've got IMail (unlimited users) v 2006.23 on an old server runing Win2k 
Advanced Server with Declude v.?? (not current, whatever it is).  On the one 
hand, I only have a small number of domains and mail boxes any more and on the 
other hand, my old server is looking pretty long in the tooth.

I started out looking at boxes to build a new server, but they're not that 
expensive any more.  Then I got caughter up in the software.  Ipswitch wants 
$2300 or some such for a software upgrade (unlimited users).  That's way more 
than I can justify spending.  I don't really need unlimited users any more, but 
I hate to give it up.  On the other hand, I recall a few years ago when people 
were switching en masse to SmaterMail so I looked at them and their prices are 
a lot nice.  Anyone care to say how the current versions of either software 
compared with my old IMail?

I assume that I'll have to upgrade to the current version of Declude, but 
otherwise that will work the same as before?

Any suggestions or pointers would be appreciated.

Thanks,

Ben

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?)

[IMail Admin]

Whew!  Thanks.  I saw that it was an automated response, but the wording was 
just ambiguous enough to imply something more.  Now I’ll just wait to see if 
anyone responds to my original question.

Ben


From: David Barker
Sent: Friday, May 20, 2011 10:34 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Do you use the Declude email notification 
templates? (and what happened to the declude.virus mailing list?)

That was a bounce or auto notify, from webjogger.net who is also subscribed to 
the list.



From: IMail Admin [mailto:imailad...@bcwebhost.net]
Sent: Friday, May 20, 2011 1:28 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Do you use the Declude email notification 
templates? (and what happened to the declude.virus mailing list?)



Hi,



I’ve just always left these templates in place (the .eml files) that cause 
various notifications to be sent out. However, in recent years I’ve received 
complaints that these notifications are unnecessary or a nuisance. I was 
curious if anyone else bothered with these, or if you deleted them all, or if 
you kept just some? Any recommendations?



I originally posted this to the declude.virus list a few minutes ago.  Then I 
got a response saying “

This address is not being used. Please contact supp...@webjogger.net

”.  Looking back, I realize I haven’t seen any posts for declude.virus since 
October, but, on the other hand, I didn’t see any announcements the list was 
going away.  Did I miss something?  Has it moved?



Thanks,



Ben


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?)

[IMail Admin]

Hi,
I’ve just always left these templates in place (the .eml files) that cause 
various notifications to be sent out. However, in recent years I’ve received 
complaints that these notifications are unnecessary or a nuisance. I was 
curious if anyone else bothered with these, or if you deleted them all, or if 
you kept just some? Any recommendations?
I originally posted this to the declude.virus list a few minutes ago.  Then I 
got a response saying “This address is not being used. Please contact 
supp...@webjogger.net ”.  Looking back, I realize I haven’t seen any posts for 
declude.virus since October, but, on the other hand, I didn’t see any 
announcements the list was going away.  Did I miss something?  Has it moved?
Thanks,
Ben
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] FROMNOMATCH returning high scores

[IMail Admin]

I’ve seen invUribl do it on random occasions, but I don’t know a cause or 
solution.

Ben


From: Jim Comerford
Sent: Thursday, May 19, 2011 12:00 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] FROMNOMATCH returning high scores

Was it invURIBL by any chance? If so did you find a cause?



From: Nick Hayer [mailto:n...@madriveraccess.com]
Sent: Wednesday, May 18, 2011 3:06 PM
To: Declude.JunkMail@declude.com
Subject: re: [Declude.JunkMail] FROMNOMATCH returning high scores



I haven't seen it on FROMNOMATCH but have seen it elsewhere; specifically when 
an external app throws an exception.  Bottom line somewhere declude or some 
other app threw an exception - the wacko score is the result.

-Nick

MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm






From: "Jim Comerford" 
Sent: Wednesday, May 18, 2011 1:13 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] FROMNOMATCH returning high scores


Has anyone else seen the FROMNOMATCH test returning ridiculously high scores 
(like 1027774676) event though its not configured to do so... and yet Declude 
does not act on the cumulative score, so for example a message with score 
1027774676 would not get deleted like it is configured to at a score of 30?

Curious if anyone else is seeing this and if they know the cause.

-Jim


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.



--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] error 0xC0000142 smtp.exe

[Imail Admin]

I should add that in looking through my spool folder, I found a *lot* of 
tmp*.tmp files, all generated by Armresearch for Sniffer and going way back.  
Does this mean I have something misconfigured that these files are being left 
over?
  - Original Message -
  From: Imail Admin
  To: Declude.JunkMail@declude.com
  Sent: Thursday, May 05, 2011 4:41 PM
  Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe


  Hi,

  I just looked in my declude.cfg and found these as the only non-commented 
lines:

  THREADS  15
  WAITFORMAIL  5000
  INVITEFIXON

  So it appears I've got 15 threads going.  Unless there is some sort of 
multiplier going?  What happens if my thread count is too small?

  Thanks,

  Ben

- Original Message -
From: Bonno Bloksma
To: Declude.JunkMail@declude.com
Sent: Thursday, May 05, 2011 1:28 PM
Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe


Hi,



Even though I am running an Imail server for a bachelor level education 
with about 2500 active mailboxes and about 15.000 mails per day, I still have 
Declude set to max 150 THREADS. That is plenty to get the mail delivered in 
time.



Declude itself can handle a lot more and using the build in Sniffer helps 
keeping the max heap problem down, but I have never found a good reason the 
increase the THREAD count.

As a matter of fact I have had it even lower in the past and still mail was 
delivered quickly enough for users never to notice it.





Yours sincerely,
Bonno Bloksma
senior systeembeheerder

tio
university of applied sciences for hospitality and tourism
julianalaan 9 / 7553 ab hengelo

netherlands
t +31-74-255 06 10 / f +31-74-255 06 11

b.blok...@tio.nl  / www.tio.nl
Follow us at Twitter / Facebook / Hyves / YouTube





Van: IMail Admin [mailto:imailad...@bcwebhost.net]
Verzonden: donderdag 5 mei 2011 22:10
Aan: Declude.JunkMail@declude.com
Onderwerp: Re: [Declude.JunkMail] error 0xC142 smtp.exe



That sounds like me.  What’s the cure?  Drop the number of threads in 
declude.cfg?  I haven’t looked at it yet to see what I have.



From: Andy Schmidt

Sent: Thursday, May 05, 2011 1:05 PM

To: Declude.JunkMail@declude.com

Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe



I had encountered the problem when I introduced another Declude add-on to 
the mix (e.g., another command line program that Declude was launching). 
Eventually there were too many command line processes using up too much heap…



Some of us were using the old command-line sniffer and 2 or 3 anti-virus 
command line tools, and invURIBL and various other – each one chipping away at 
the heap.



From: IMail Admin [mailto:imailad...@bcwebhost.net]
Sent: Thursday, May 05, 2011 2:21 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe



HI Pete,



Thanks for the links.  After reading all of those, and everything they link 
to, I have a better idea of what’s happening.  What Declude originally called 
the “mystery heap” is apparently the desktop heap, which had a system wide 
limit of 48 mb (Win2k and Win2k3), allocated between interactive and 
non-interactive desktops.  Presumably, too many processes are launched, 
exhausting this heap.  Setting a smaller value for the per-process allocation 
(512 kb by default) should allow more processes to run.  So all of this makes 
sense but doesn’t explain why my server should have this problem.



My business is so small any more than I could imagine using my smart phone 
to run the mail server.  If it’s the smtp32.exe process causing the crash, then 
that would imply to me that I’ve got a lot of outbound messages all at once.  I 
just don’t see how this could happen.  I’m guessing that we’ve got no more than 
a couple hundred mailboxes spread over 30 domains, and no lists larger than 
200.  So how do I find out where all this outbound stuff is coming from? And is 
there a setting I could use to limit the number of outbound messages sent (or 
processed) at one time?



Any suggestions are appreciated.



Thanks,



Ben



P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a 
Win 7 PC or a Windows 2010 server? Just thinking out loud.



From: Pete McNeil

Sent: Wednesday, May 04, 2011 8:34 PM

To: Declude.JunkMail@declude.com

Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe



On 5/4/2011 11:08 PM, Imail Admin wrote:

Hi,

Â

I recall a while back about errors where you get Error #0xC142 (The 
application failed to initialize) for smtp32.exe, somehow related to Declude.  
We started getting these recently for no particular reason that I can think 
of.  Is there a setting in Declude that helps with this?


IIRC, this is the "mystery heap" problem and solving it will mostly have to 
do w

Re: [Declude.JunkMail] error 0xC0000142 smtp.exe

[Imail Admin]

Hi,

I just looked in my declude.cfg and found these as the only non-commented lines:

THREADS  15
WAITFORMAIL  5000
INVITEFIXON

So it appears I've got 15 threads going.  Unless there is some sort of 
multiplier going?  What happens if my thread count is too small?

Thanks,

Ben

  - Original Message -
  From: Bonno Bloksma
  To: Declude.JunkMail@declude.com
  Sent: Thursday, May 05, 2011 1:28 PM
  Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe


  Hi,



  Even though I am running an Imail server for a bachelor level education with 
about 2500 active mailboxes and about 15.000 mails per day, I still have 
Declude set to max 150 THREADS. That is plenty to get the mail delivered in 
time.



  Declude itself can handle a lot more and using the build in Sniffer helps 
keeping the max heap problem down, but I have never found a good reason the 
increase the THREAD count.

  As a matter of fact I have had it even lower in the past and still mail was 
delivered quickly enough for users never to notice it.





  Yours sincerely,
  Bonno Bloksma
  senior systeembeheerder

  tio
  university of applied sciences for hospitality and tourism
  julianalaan 9 / 7553 ab hengelo

  netherlands
  t +31-74-255 06 10 / f +31-74-255 06 11

  b.blok...@tio.nl  / www.tio.nl
  Follow us at Twitter / Facebook / Hyves / YouTube





  Van: IMail Admin [mailto:imailad...@bcwebhost.net]
  Verzonden: donderdag 5 mei 2011 22:10
  Aan: Declude.JunkMail@declude.com
  Onderwerp: Re: [Declude.JunkMail] error 0xC142 smtp.exe



  That sounds like me.  What’s the cure?  Drop the number of threads in 
declude.cfg?  I haven’t looked at it yet to see what I have.



  From: Andy Schmidt

  Sent: Thursday, May 05, 2011 1:05 PM

  To: Declude.JunkMail@declude.com

  Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe



  I had encountered the problem when I introduced another Declude add-on to the 
mix (e.g., another command line program that Declude was launching). Eventually 
there were too many command line processes using up too much heap…



  Some of us were using the old command-line sniffer and 2 or 3 anti-virus 
command line tools, and invURIBL and various other – each one chipping away at 
the heap.



  From: IMail Admin [mailto:imailad...@bcwebhost.net]
  Sent: Thursday, May 05, 2011 2:21 PM
  To: Declude.JunkMail@declude.com
  Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe



  HI Pete,



  Thanks for the links.  After reading all of those, and everything they link 
to, I have a better idea of what’s happening.  What Declude originally called 
the “mystery heap” is apparently the desktop heap, which had a system wide 
limit of 48 mb (Win2k and Win2k3), allocated between interactive and 
non-interactive desktops.  Presumably, too many processes are launched, 
exhausting this heap.  Setting a smaller value for the per-process allocation 
(512 kb by default) should allow more processes to run.  So all of this makes 
sense but doesn’t explain why my server should have this problem.



  My business is so small any more than I could imagine using my smart phone to 
run the mail server.  If it’s the smtp32.exe process causing the crash, then 
that would imply to me that I’ve got a lot of outbound messages all at once.  I 
just don’t see how this could happen.  I’m guessing that we’ve got no more than 
a couple hundred mailboxes spread over 30 domains, and no lists larger than 
200.  So how do I find out where all this outbound stuff is coming from? And is 
there a setting I could use to limit the number of outbound messages sent (or 
processed) at one time?



  Any suggestions are appreciated.



  Thanks,



  Ben



  P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a 
Win 7 PC or a Windows 2010 server? Just thinking out loud.



  From: Pete McNeil

  Sent: Wednesday, May 04, 2011 8:34 PM

  To: Declude.JunkMail@declude.com

  Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe



  On 5/4/2011 11:08 PM, Imail Admin wrote:

  Hi,

  Â

  I recall a while back about errors where you get Error #0xC142 (The 
application failed to initialize) for smtp32.exe, somehow related to Declude.  
We started getting these recently for no particular reason that I can think 
of.  Is there a setting in Declude that helps with this?


  IIRC, this is the "mystery heap" problem and solving it will mostly have to 
do with the setting you're using.

  
http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686

  There is a particular chunk of memory that runs out if too many 
applications/processes are started at once as children of other processes. In 
your case, for example, too many concurrent instances of SMTP32.exe along with 
a number of other factors.

  If I'm guessing correctly, you could suddenly experience this problem due to 
allowing enough SMTP32 processes (usually controlled by the number of 
processi

Re: [Declude.JunkMail] error 0xC0000142 smtp.exe

[IMail Admin]

That sounds like me.  What’s the cure?  Drop the number of threads in 
declude.cfg?  I haven’t looked at it yet to see what I have.

From: Andy Schmidt
Sent: Thursday, May 05, 2011 1:05 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe

I had encountered the problem when I introduced another Declude add-on to the 
mix (e.g., another command line program that Declude was launching). Eventually 
there were too many command line processes using up too much heap…



Some of us were using the old command-line sniffer and 2 or 3 anti-virus 
command line tools, and invURIBL and various other – each one chipping away at 
the heap.



From: IMail Admin [mailto:imailad...@bcwebhost.net]
Sent: Thursday, May 05, 2011 2:21 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe



HI Pete,



Thanks for the links.  After reading all of those, and everything they link to, 
I have a better idea of what’s happening.  What Declude originally called the 
“mystery heap” is apparently the desktop heap, which had a system wide limit of 
48 mb (Win2k and Win2k3), allocated between interactive and non-interactive 
desktops.  Presumably, too many processes are launched, exhausting this heap.  
Setting a smaller value for the per-process allocation (512 kb by default) 
should allow more processes to run.  So all of this makes sense but doesn’t 
explain why my server should have this problem.



My business is so small any more than I could imagine using my smart phone to 
run the mail server.  If it’s the smtp32.exe process causing the crash, then 
that would imply to me that I’ve got a lot of outbound messages all at once.  I 
just don’t see how this could happen.  I’m guessing that we’ve got no more than 
a couple hundred mailboxes spread over 30 domains, and no lists larger than 
200.  So how do I find out where all this outbound stuff is coming from? And is 
there a setting I could use to limit the number of outbound messages sent (or 
processed) at one time?



Any suggestions are appreciated.



Thanks,



Ben



P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 
7 PC or a Windows 2010 server? Just thinking out loud.



From: Pete McNeil

Sent: Wednesday, May 04, 2011 8:34 PM

To: Declude.JunkMail@declude.com

Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe



On 5/4/2011 11:08 PM, Imail Admin wrote:

Hi,

Â

I recall a while back about errors where you get Error #0xC142 (The 
application failed to initialize) for smtp32.exe, somehow related to Declude.  
We started getting these recently for no particular reason that I can think 
of.  Is there a setting in Declude that helps with this?


IIRC, this is the "mystery heap" problem and solving it will mostly have to do 
with the setting you're using.

http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686

There is a particular chunk of memory that runs out if too many 
applications/processes are started at once as children of other processes. In 
your case, for example, too many concurrent instances of SMTP32.exe along with 
a number of other factors.

If I'm guessing correctly, you could suddenly experience this problem due to 
allowing enough SMTP32 processes (usually controlled by the number of 
processing threads you allow) and also having enough mail running through your 
system to exhaust the mystery heap.

This search might help you find what you're looking for in previous discussions.

Hope this helps,

_M




--Pete McNeil, PresidentMicroNeil Research 
Corporationwww.microneil.com703.779.4909x7010
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] error 0xC0000142 smtp.exe

[IMail Admin]

HI Pete,

Thanks for the links.  After reading all of those, and everything they link to, 
I have a better idea of what’s happening.  What Declude originally called the 
“mystery heap” is apparently the desktop heap, which had a system wide limit of 
48 mb (Win2k and Win2k3), allocated between interactive and non-interactive 
desktops.  Presumably, too many processes are launched, exhausting this heap.  
Setting a smaller value for the per-process allocation (512 kb by default) 
should allow more processes to run.  So all of this makes sense but doesn’t 
explain why my server should have this problem.

My business is so small any more than I could imagine using my smart phone to 
run the mail server.  If it’s the smtp32.exe process causing the crash, then 
that would imply to me that I’ve got a lot of outbound messages all at once.  I 
just don’t see how this could happen.  I’m guessing that we’ve got no more than 
a couple hundred mailboxes spread over 30 domains, and no lists larger than 
200.  So how do I find out where all this outbound stuff is coming from? And is 
there a setting I could use to limit the number of outbound messages sent (or 
processed) at one time?

Any suggestions are appreciated.

Thanks,

Ben

P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 
7 PC or a Windows 2010 server? Just thinking out loud.

From: Pete McNeil
Sent: Wednesday, May 04, 2011 8:34 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe

On 5/4/2011 11:08 PM, Imail Admin wrote:
  Hi,
  Â
  I recall a while back about errors where you get Error #0xC142 (The 
application failed to initialize) for smtp32.exe, somehow related to Declude.  
We started getting these recently for no particular reason that I can think 
of.  Is there a setting in Declude that helps with this?

IIRC, this is the "mystery heap" problem and solving it will mostly have to do 
with the setting you're using.

http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686

There is a particular chunk of memory that runs out if too many 
applications/processes are started at once as children of other processes. In 
your case, for example, too many concurrent instances of SMTP32.exe along with 
a number of other factors.

If I'm guessing correctly, you could suddenly experience this problem due to 
allowing enough SMTP32 processes (usually controlled by the number of 
processing threads you allow) and also having enough mail running through your 
system to exhaust the mystery heap.

This search might help you find what you're looking for in previous discussions.

Hope this helps,

_M


--
Pete McNeil, President
MicroNeil Research Corporation
www.microneil.com
703.779.4909
x7010


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] error 0xC0000142 smtp.exe

[Imail Admin]

Hi,

I recall a while back about errors where you get Error #0xC142 (The 
application failed to initialize) for smtp32.exe, somehow related to Declude.  
We started getting these recently for no particular reason that I can think of. 
 Is there a setting in Declude that helps with this?

Thanks,

Ben

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Web analytics

[IMail Admin]

I know this is way off topic, but I’d love to hear if anybody wants to throw 
out an opinion.
We’ve been using HitList Commerce 4.0 since, I don’t know, maybe 2000? to 
generate web statics reports for our clients’ domains.  It was a simple system 
that produced decent reports emails in a single .RTF file.  Recently, however, 
it broke and I can’t seem to repair it.  The makers of HitList, Marketwave, 
have undergone many changes of ownership over the years and focus now only on 
very expensive products and services (it was a few hundred dollars when we 
bought it).  So I’m looking at getting something modern.
The truth is that I only have a handful of domains who care about this, so I’m 
looking for something free or very cheap.  I’d prefer it to read our IIS logs 
and then send out emails, but I guess we could adapt to something that just 
displays a web page.  The question is: what’s cheap or free, suitable for 
hosters (as opposed to end-users) and simple?
I’m looking right now at something called JawStats (open source) and also 
Google Analytics, but I don’t know what’s involved.  Any old-timers here with 
suggestions?
Thanks,
Ben
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX

[IMail Admin]

Thanks.  Now that you’ve posted this I have to apologize because I recall 
reading this years ago.

The problem I’m struggling with is that I get a lot of spam that fail many 
tests and ends up being deleted, but I also get a lot of true spam that fails 
only one test, usually Sniffer, and I’d like to find test(s) that would 
incrementally confirm the spam and push it to the next threshold.  For example, 
I weight Sniffer at 8, so I get a lot of spam that score 8.  They’re true spam, 
but the other tests don’t confirm it and my delete threshold is 12 (although I 
would be happy to get just to 10 on these spams).

Any suggestions welcome.

Thanks,

Ben



From: Nick Hayer
Sent: Friday, April 08, 2011 12:23 PM
To: Declude.JunkMail@declude.com
Subject: re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX

the defs are in the junkmail manual  
https://www.declude.com/searchresults.asp?Cat=109

IPNOTINMX - The IPNOTINMX test is good for helping reduce false positives. By 
default, Declude JunkMail will subtract several points from the weighting 
system when an email does not fail this test (which is very different from the 
way a spam test normally works). WARNING: The IPNOTINMX should NOT be used to 
detect spam! It will be triggered when an email is sent from an IP address that 
is not in its MX record. Although this test will catch a lot of spam (perhaps 
80%), it will also catch a lot of legitimate mail (as quite a few larger 
mailers will send their mail through a different mail server than they use to 
receive mail).

NOLEGITCONTENT - Like the IPNOTINMX test, the NOLEGITCONTENT test is good for 
helping reduce false positives. By default, Declude JunkMail will subtract 
several points from the weighting system when an email does not fail this test 
(which is very different from the way a spam test normally works). WARNING: The 
NOLEGITCONTENT test should NOT be used to detect spam! It will be triggered 
Declude JunkMail does not detect any legitimate content in an email. NOTE: Some 
legitimate email will fail this test, but almost all spam will fail it.


The best 'test' is a 'combo' test where it takes several unrelated tests to 
fail before you wack the email w/a penalty.

-Nick

MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm




----
From: "IMail Admin" 
Sent: Friday, April 08, 2011 1:38 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX


In all this work on inv-uribl, I realized that my system scores 0 for 
NOLEGITCONTENT and IPNOTINMX.  I would just be following the default, so that 
leads to the question: what is the purpose of these tests and do other people 
assign them scores?

--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX

[IMail Admin]

In all this work on inv-uribl, I realized that my system scores 0 for 
NOLEGITCONTENT and IPNOTINMX.  I would just be following the default, so that 
leads to the question: what is the purpose of these tests and do other people 
assign them scores?
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

[IMail Admin]

Makes sense.  Thanks.

From: Nick Hayer
Sent: Friday, April 08, 2011 10:29 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

It crashed - through an exception and either Declude was unsure of what to do 
with it or that was the score it returned.I have seen this happen when I 
was developing my own app.

-Nick


MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm





From: "IMail Admin" 
Sent: Friday, April 08, 2011 1:23 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?


I added in a weight for the grey listings, but it hasn’t had much impact.  A 
review of the log files shows only a few messages failing due to grey and since 
I give it a small weight, I’m not worried about false positives.  In the 
meanwhile, something Very Strange happened this morning.

An extreme spam (high score under Declude) showed up in my inbox today.  It got 
there thanks to inv-uribl.  Here are the relevant lines from the header:

X-RBL-Warning: INV-URIBL: Message failed INV-URIBL: -1066598274.
X-Declude-Sender: neomaanastaci...@keci.com [201.50.140.132]
X-Declude-Spoolname: D1c67025c4807.smd
X-Declude-Note: Scanned by Declude 4.2.20 for spam. 
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-1066598201] at 07:33:30 on 08 Apr 2011
X-Declude-Fail-WithWeight: NOLEGITCONTENT [0], IPNOTINMX [0], CBL [6], 
FIVETEN-SRC [7], ZEN [7], SORBS-DUHL [6], SPAMCOP [8], UCEPROTECT-1 [6], 
UCEPROTECT-2 [5], UCEPROTECT-3 [2], BARRACUDA [4], CMDSPACE [8], SPFUNKNOWN 
[1], SUBSPACE-12 [1], SUBSPACE-15 [1], SUBCHARS-50 [1], SUBCHARS-55 [1], 
SUBCHARS-60 [1], SNIFFER [8], INV-URIBL [-1066598274], ZEROHOUR [0]

This result was also confirmed by the line in the Declude log file:

04/08/2011 07:33:30.046 q1c67025c4807.smd Tests failed 
[weight=-1066598201]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=WARN[0] 
IPNOTINMX=WARN[0] CBL=WARN[6] FIVETEN-SRC=WARN[7] ZEN=IGNORE[7] 
SORBS-DUHL=WARN[6] SPAMCOP=WARN[8] UCEPROTECT-1=WARN[6] UCEPROTECT-2=WARN[5] 
UCEPROTECT-3=WARN[2] BARRACUDA=IGNORE[4] CMDSPACE=WARN[8] SPFUNKNOWN=WARN[1] 
SUBSPACE-12=WARN[1] SUBSPACE-15=WARN[1] SUBCHARS-50=WARN[1] SUBCHARS-55=WARN[1] 
SUBCHARS-60=WARN[1] SNIFFER=WARN[8] INV-URIBL=WARN[-1066598274]

Now how the heck did inv-urible generate a scored of –1 billion???  I checked 
and there’s nothing like that in the config file.  So then I checked the 
inv-uribl log file and this message does not show up in the log file.  
Inv-uribl apparently didn’t process this message but did manage to give it an 
outrageous score.

Has anyone seen something like this and is it cause for concern?

Thanks,

Ben


From: IMail Admin
Sent: Wednesday, April 06, 2011 10:23 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

HI Scott,

It looks to me like you only score the black and not the grey or red listings.  
The config I have, which would have come from someone else or the default 
because I’ve never tried tweaking inv-uribl, scores black and red but not grey. 
 I’m thinking of scoring grey with a small score but I was waiting to see 
response on the list such as yours.

Thanks,

Ben

From: Scott Fisher
Sent: Wednesday, April 06, 2011 6:50 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file?

The 127.0.0.4 is a gray listing for the uribl.   I personally don’t score the 
gray result because of too many false positives.



 









 





















-Original Message-----
From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Tuesday, April 05, 2011 7:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file?



So I'm still looking at ways to make Inv-Uribl more effective.  I'm getting a 
lot of spam that gets through my system with relatively marginal score so I'm 
looking at the Inv-Uribl log.  Here are the lines for a message that I would 
consider to be obviously spam, yet came through Inv-Uribl as "Clean":



2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 
D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI 
from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 
216.139.251.42 [Total Weigh

Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

[IMail Admin]

I added in a weight for the grey listings, but it hasn’t had much impact.  A 
review of the log files shows only a few messages failing due to grey and since 
I give it a small weight, I’m not worried about false positives.  In the 
meanwhile, something Very Strange happened this morning.

An extreme spam (high score under Declude) showed up in my inbox today.  It got 
there thanks to inv-uribl.  Here are the relevant lines from the header:

X-RBL-Warning: INV-URIBL: Message failed INV-URIBL: -1066598274.
X-Declude-Sender: neomaanastaci...@keci.com [201.50.140.132]
X-Declude-Spoolname: D1c67025c4807.smd
X-Declude-Note: Scanned by Declude 4.2.20 for spam. 
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [-1066598201] at 07:33:30 on 08 Apr 2011
X-Declude-Fail-WithWeight: NOLEGITCONTENT [0], IPNOTINMX [0], CBL [6], 
FIVETEN-SRC [7], ZEN [7], SORBS-DUHL [6], SPAMCOP [8], UCEPROTECT-1 [6], 
UCEPROTECT-2 [5], UCEPROTECT-3 [2], BARRACUDA [4], CMDSPACE [8], SPFUNKNOWN 
[1], SUBSPACE-12 [1], SUBSPACE-15 [1], SUBCHARS-50 [1], SUBCHARS-55 [1], 
SUBCHARS-60 [1], SNIFFER [8], INV-URIBL [-1066598274], ZEROHOUR [0]

This result was also confirmed by the line in the Declude log file:

04/08/2011 07:33:30.046 q1c67025c4807.smd Tests failed 
[weight=-1066598201]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=WARN[0] 
IPNOTINMX=WARN[0] CBL=WARN[6] FIVETEN-SRC=WARN[7] ZEN=IGNORE[7] 
SORBS-DUHL=WARN[6] SPAMCOP=WARN[8] UCEPROTECT-1=WARN[6] UCEPROTECT-2=WARN[5] 
UCEPROTECT-3=WARN[2] BARRACUDA=IGNORE[4] CMDSPACE=WARN[8] SPFUNKNOWN=WARN[1] 
SUBSPACE-12=WARN[1] SUBSPACE-15=WARN[1] SUBCHARS-50=WARN[1] SUBCHARS-55=WARN[1] 
SUBCHARS-60=WARN[1] SNIFFER=WARN[8] INV-URIBL=WARN[-1066598274]

Now how the heck did inv-urible generate a scored of –1 billion???  I checked 
and there’s nothing like that in the config file.  So then I checked the 
inv-uribl log file and this message does not show up in the log file.  
Inv-uribl apparently didn’t process this message but did manage to give it an 
outrageous score.

Has anyone seen something like this and is it cause for concern?

Thanks,

Ben


From: IMail Admin
Sent: Wednesday, April 06, 2011 10:23 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

HI Scott,

It looks to me like you only score the black and not the grey or red listings.  
The config I have, which would have come from someone else or the default 
because I’ve never tried tweaking inv-uribl, scores black and red but not grey. 
 I’m thinking of scoring grey with a small score but I was waiting to see 
response on the list such as yours.

Thanks,

Ben

From: Scott Fisher
Sent: Wednesday, April 06, 2011 6:50 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file?

The 127.0.0.4 is a gray listing for the uribl.   I personally don’t score the 
gray result because of too many false positives.



 









 





















-Original Message-
From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Tuesday, April 05, 2011 7:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file?



So I'm still looking at ways to make Inv-Uribl more effective.  I'm getting a 
lot of spam that gets through my system with relatively marginal score so I'm 
looking at the Inv-Uribl log.  Here are the lines for a message that I would 
consider to be obviously spam, yet came through Inv-Uribl as "Clean":



2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 
D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI 
from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 
216.139.251.42 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 
173.164.65.196 [Total Weight=0]

Did I miss something here that should have triggered a score (additional spam 
weight in Declude)?



Thanks,



Ben




--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "

Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

[IMail Admin]

HI Scott,

It looks to me like you only score the black and not the grey or red listings.  
The config I have, which would have come from someone else or the default 
because I’ve never tried tweaking inv-uribl, scores black and red but not grey. 
 I’m thinking of scoring grey with a small score but I was waiting to see 
response on the list such as yours.

Thanks,

Ben

From: Scott Fisher
Sent: Wednesday, April 06, 2011 6:50 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file?

The 127.0.0.4 is a gray listing for the uribl.   I personally don’t score the 
gray result because of too many false positives.



 









 





















-Original Message-
From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Tuesday, April 05, 2011 7:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file?



So I'm still looking at ways to make Inv-Uribl more effective.  I'm getting a 
lot of spam that gets through my system with relatively marginal score so I'm 
looking at the Inv-Uribl log.  Here are the lines for a message that I would 
consider to be obviously spam, yet came through Inv-Uribl as "Clean":



2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 
D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI 
from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 
216.139.251.42 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 
173.164.65.196 [Total Weight=0]

Did I miss something here that should have triggered a score (additional spam 
weight in Declude)?



Thanks,



Ben




--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

[IMail Admin]

That’s a good idea, so I looked at what I have in the config file:

















I’m not an expert, but this seems to say that showing up in the black, grey, or 
red lists gets you scores of 7, 0 2 corresponding to bitmasks results of 
127.0.0.2, 127.0.0.4, and 127.0.0.8.  So then I went to the uribl.com web site 
to look up the definitions of these lists:

■black.uribl.com
- This lists contains domain names belonging to and used by spammers, including 
but not restricted to those that appear in URIs found in Unsolicited Bulk 
and/or Commercial Email (UBE/UCE). This list has a goal of zero False 
Positives. This zone rebuilds frequently as new data is added.
■grey.uribl.com
- This lists contains domains found in UBE/UCE, and possibly honour opt-out 
requests. It may include ESPs which allow customers to import their recipient 
lists and may have no control over the subscription methods. This list can and 
probably will cause False Positives depending on your definition of UBE/UCE. 
This zone rebuilds several times a day as necessary.
■red.uribl.com
- This list contains domains that actively show up in mail flow, are not listed 
on URIBL black, and are either: being monitored, very young (domain age via 
whois), or use whois privacy features to protect their identity. This list is 
automated in nature, so please use at your own risk.

>From this, I don’t understand why red would rate a score of 2 and grey a score 
>of 0.  It seems to me that grey is in between black and red, and should 
>probably have a score of 3 or 4.  In my system, that kind of score wouldn’t be 
>enough to cause the message to be treated as spam (my Declude threshold for 
>“ordinary email” is 5), but it would if combined with other failed tests.

Any thoughts on this?

Thanks,

Ben




From: Nick Hayer
Sent: Tuesday, April 05, 2011 5:52 PM
To: Declude.JunkMail@declude.com
Subject: re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

maybe it scores bitmask results and 127.0.0.4 response is not tagged?

-Nick


MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm




----
From: "Imail Admin" 
Sent: Tuesday, April 05, 2011 8:36 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file?


So I'm still looking at ways to make Inv-Uribl more effective.  I'm getting a 
lot of spam that gets through my system with relatively marginal score so I'm 
looking at the Inv-Uribl log.  Here are the lines for a message that I would 
consider to be obviously spam, yet came through Inv-Uribl as "Clean":

2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 
D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI 
from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 
216.139.251.42 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 
173.164.65.196 [Total Weight=0]

Did I miss something here that should have triggered a score (additional spam 
weight in Declude)?

Thanks,

Ben


--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] How do you read the Inv-Uribl log file?

[Imail Admin]

So I'm still looking at ways to make Inv-Uribl more effective.  I'm getting a 
lot of spam that gets through my system with relatively marginal score so I'm 
looking at the Inv-Uribl log.  Here are the lines for a message that I would 
consider to be obviously spam, yet came through Inv-Uribl as "Clean":

2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 
D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI 
from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 
216.139.251.42 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 
D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 
173.164.65.196 [Total Weight=0]

Did I miss something here that should have triggered a score (additional spam 
weight in Declude)?

Thanks,

Ben

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How effective should Inv-Uribl be?

[IMail Admin]

I’m not quite sure what you mean.  In the Declude global.cfg file the only 
reference to inv-uribl is

INV-URIBL external weight "D:\imail\INVURIBL\INVURIBL.exe %WEIGHT% 
%REMOTEIP%" 0 0

In the invUribl.exe.config file there is (in part):

***




























































***

In the inv-uribl log file I find references to multi.surbl.org, 
sbl.spamhaus.org, multi.uribl.com, and xx.countries.nerd.dk (where xx is a 
country code such as ru).  All the lines that end in Total Weight = 0 don’t 
list any tests at all – they just resolve the IP.

Thanks.

From: Nick Hayer
Sent: Friday, March 18, 2011 11:21 AM
To: Declude.JunkMail@declude.com
Subject: re: [Declude.JunkMail] How effective should Inv-Uribl be?

What uribl tests are you using and are you getting hits on them - check your 
logs..
I'm suggesting you may need different tests - the one you are using may have 
blacklisted you or are dead even...

-Nick


MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482 or International +1-802-229-6574
Emergency Support 24/7: supp...@skywaves.net
General and Non-Emergency support ticket:
https://www.skywaves.com/content/secure/support_ticket.htm




----
From: "IMail Admin" 
Sent: Friday, March 18, 2011 2:13 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How effective should Inv-Uribl be?


I'm still having trouble with more spam seepage, so I've been looking at my
various tests. I noticed that in the past, the Inv-uribl test caught 63-70%
of messages, but recently it's only catching 56%. When I look at a lot of
the low value spam (messages that barely get classified as spam), they
always have an Inv-uribl result of score 0 range clean. Is it just that
this test is less effective now? Or have I somehow messed up my
configuration?

As an aside: I use DL Analyzer to check these results. One this it always
does is give the average weight/message and average weight/failed message.
Typically, these are scores such as 45 and 46. Just lately I started get
results like -131,000 and -136,000. I don't know if this is another sign of
something broken in my configuration or if the analyzer program has somehow
broken.

Thanks.


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.



--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] How effective should Inv-Uribl be?

[IMail Admin]

I'm still having trouble with more spam seepage, so I've been looking at my
various tests.  I noticed that in the past, the Inv-uribl test caught 63-70%
of messages, but recently it's only catching 56%.  When I look at a lot of
the low value spam (messages that barely get classified as spam), they
always have an Inv-uribl result of score 0 range clean.  Is it just that
this test is less effective now?  Or have I somehow messed up my
configuration?

As an aside: I use DL Analyzer to check these results.  One this it always
does is give the average weight/message and average weight/failed message.
Typically, these are scores such as 45 and 46.  Just lately I started get
results like -131,000 and -136,000.  I don't know if this is another sign of
something broken in my configuration or if the analyzer program has somehow
broken.

Thanks.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spam scores rising

[IMail Admin]

OK, so I added truncate and Sniffer was tweaked.  I just ran a report and
the results are better, but not back to where they were.

Last December, the average failed score was 50.  A week ago, when I
originally posted my question, it was down to 41.  It's now up to 46, so
about halfway in between.  So it's gotten better, but still not as effective
as a few months ago.

What we do with the score varies by domain, but the default goes like this:
<5 goes into the InBox.  5 to 9 goes to a folder called SpamLow (mix of good
and bad), 10-14 goes into a folder called Spam (mostly bad), and 15+ gets
deleted.  What I've been seeing (although it's improved some) is stuff in
the InBox that would have been in the SpamLow folder before, stuff in
SpamLow that would have been in Spam before, etc.

Thanks,

Ben


-Original Message-
From: Pete McNeil
Sent: Friday, February 11, 2011 3:01 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Spam scores rising

On 2/11/2011 2:49 PM, IMail Admin wrote:
> But keeping the spam down is a bigger issue right now.

You might try adding truncate to your RBLs.

http://www.gbudb.com/truncate/index.jsp

_M

--
Pete McNeil, President
MicroNeil Research Corporation
www.microneil.com
703.779.4909
x7010




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
[This E-mail was scanned by Declude]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] weird processing of lists

[Imail Admin]

Thanks for the offer.  In it's simplest sense, however, I think I understand 
what's going on.  Declude is processing messages sent to a list address and 
then attempting to send some messages to folders within that "mailbox."  I 
can't even imagine why Declude would process the list address, rather than the 
addresses of the individual recipients.  I guess that's the real question.

Thanks,

Ben

  - Original Message - 
  From: Nick Hayer 
  To: declude.junkmail@declude.com 
  Sent: Wednesday, December 29, 2010 2:49 PM
  Subject: Re: [Declude.JunkMail] weird processing of lists


  Ben,

  No idea how to fix it - all I can suggest though is to run your log in debug 
mode and duplicate the problem.  Then the logs may give you a clue as to what 
is going on.

  -Nick


  MadRiverAccess.com|Skywaves.com Tech Support 
  US/Canada 877-873-6482 or International +1-802-229-6574 
  Emergency Support 24/7: supp...@skywaves.net 
  General and Non-Emergency support ticket: 
  https://www.skywaves.com/content/secure/support_ticket.htm




--
  From: "Imail Admin" 
  Sent: Wednesday, December 29, 2010 5:26 PM
  To: declude.junkmail@declude.com
  Subject: Re: [Declude.JunkMail] weird processing of lists


  What surprises me is that I haven't found anywhere where this problem has 
been discussed before.  Granted that IMail's list server is primitive and that 
seriously list services use a separate list server, still a lot of IMail admin 
use the built-in list service for basic list services.  So I would assume that 
all of these users would have them same problem with JM and the IMail list 
service.  For that matter, I don't really understand why I'm having this 
problem just now, after using of using both products.

  Ben
- Original Message - 
From: Dean Lawrence 
To: declude.junkmail@declude.com 
Sent: Wednesday, December 29, 2010 12:52 PM
Subject: Re: [Declude.JunkMail] weird processing of lists


Ben,

Maybe you could right a rule that evaluates the sender and originating
IP. So that if the email is from listn...@domain.com and the IP
matches the server's IP (since it is being generated from your
server), that it assigns a negative weight to the message?

Dean

P.S.
This is off the top of my head without looking at the docs, so I may
    be off base.

On Wed, Dec 29, 2010 at 3:07 PM, IMail Admin  
wrote:
> But you're the man who knows everything about Declude. Surely you know the
> answer to my original question?
>
> Ben
>
> -Original Message- From: David Barker
> Sent: Wednesday, December 29, 2010 5:21 AM
> To: declude.junkmail@declude.com
> Subject: RE: [Declude.JunkMail] weird processing of lists
>
> Most likely ;)
>
> -Original Message-
> From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of IMail
> Admin
> Sent: Tuesday, December 28, 2010 3:24 PM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] weird processing of lists
>
> Everyone gone on vacation?
>
> -Original Message- From: IMail Admin
> Sent: Friday, December 24, 2010 11:23 AM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] weird processing of lists
>
> Hi,
>
> I've run into a small problem between Declude and lists. I have a domain
> with a list on it such as listn...@domain.com. You have to be on the
> posters' list to send messages to that list. One of the posters sends
> messages to the list and is authorized for the list, but gets this error
> message: "Invalid final delivery userid: listname-spam...@domain.com".
> SpamLow is the folder into which messages are normally dropped when their
> score is between 5 and 10.
>
> It appears that Declude is assigning this message a score between 5 and 10
> and then trying to put the message into the SpamLow folder for this user.
> Except that it's not a user, it's a list.
>
> So why does this happen and how do I handle it?
>
> Thanks,
>
> Ben
>
> P.S. We've been using Declude JM/AV with Imail for a long time. The 
current
> versions are Imail 2006.23 and Declude 1.63.
>
>
>
> ---
> [This E-mail was scanned by Declude]
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to imail...@declude.com, and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
&g

Re: [Declude.JunkMail] weird processing of lists

[Imail Admin]

What surprises me is that I haven't found anywhere where this problem has been 
discussed before.  Granted that IMail's list server is primitive and that 
seriously list services use a separate list server, still a lot of IMail admin 
use the built-in list service for basic list services.  So I would assume that 
all of these users would have them same problem with JM and the IMail list 
service.  For that matter, I don't really understand why I'm having this 
problem just now, after using of using both products.

Ben
  - Original Message - 
  From: Dean Lawrence 
  To: declude.junkmail@declude.com 
  Sent: Wednesday, December 29, 2010 12:52 PM
  Subject: Re: [Declude.JunkMail] weird processing of lists


  Ben,

  Maybe you could right a rule that evaluates the sender and originating
  IP. So that if the email is from listn...@domain.com and the IP
  matches the server's IP (since it is being generated from your
  server), that it assigns a negative weight to the message?

  Dean

  P.S.
  This is off the top of my head without looking at the docs, so I may
  be off base.

  On Wed, Dec 29, 2010 at 3:07 PM, IMail Admin  wrote:
  > But you're the man who knows everything about Declude. Surely you know the
  > answer to my original question?
  >
  > Ben
  >
  > -Original Message- From: David Barker
  > Sent: Wednesday, December 29, 2010 5:21 AM
  > To: declude.junkmail@declude.com
  > Subject: RE: [Declude.JunkMail] weird processing of lists
  >
  > Most likely ;)
  >
  > -Original Message-
  > From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of IMail
  > Admin
  > Sent: Tuesday, December 28, 2010 3:24 PM
  > To: declude.junkmail@declude.com
  > Subject: Re: [Declude.JunkMail] weird processing of lists
  >
  > Everyone gone on vacation?
  >
  > -Original Message- From: IMail Admin
  > Sent: Friday, December 24, 2010 11:23 AM
  > To: declude.junkmail@declude.com
  > Subject: [Declude.JunkMail] weird processing of lists
  >
  > Hi,
  >
  > I've run into a small problem between Declude and lists. I have a domain
  > with a list on it such as listn...@domain.com. You have to be on the
  > posters' list to send messages to that list. One of the posters sends
  > messages to the list and is authorized for the list, but gets this error
  > message: "Invalid final delivery userid: listname-spam...@domain.com".
  > SpamLow is the folder into which messages are normally dropped when their
  > score is between 5 and 10.
  >
  > It appears that Declude is assigning this message a score between 5 and 10
  > and then trying to put the message into the SpamLow folder for this user.
  > Except that it's not a user, it's a list.
  >
  > So why does this happen and how do I handle it?
  >
  > Thanks,
  >
  > Ben
  >
  > P.S. We've been using Declude JM/AV with Imail for a long time. The current
  > versions are Imail 2006.23 and Declude 1.63.
  >
  >
  >
  > ---
  > [This E-mail was scanned by Declude]
  >
  >
  > ---
  > This E-mail came from the Declude.JunkMail mailing list. To
  > unsubscribe, just send an E-mail to imail...@declude.com, and
  > type "unsubscribe Declude.JunkMail". The archives can be found
  > at http://www.mail-archive.com.
  >
  >
  >
  >
  > ---
  > [This E-mail was scanned by Declude]
  >
  >
  > ---
  > This E-mail came from the Declude.JunkMail mailing list. To
  > unsubscribe, just send an E-mail to imail...@declude.com, and
  > type "unsubscribe Declude.JunkMail". The archives can be found
  > at http://www.mail-archive.com.
  >
  >
  >
  > ---
  > [This E-mail was scanned by Declude]
  >
  >
  > ---
  > This E-mail came from the Declude.JunkMail mailing list. To
  > unsubscribe, just send an E-mail to imail...@declude.com, and
  > type "unsubscribe Declude.JunkMail". The archives can be found
  > at http://www.mail-archive.com.
  >
  >
  >
  >
  > ---
  > [This E-mail was scanned by Declude]
  >
  >
  > ---
  > This E-mail came from the Declude.JunkMail mailing list. To
  > unsubscribe, just send an E-mail to imail...@declude.com, and
  > type "unsubscribe Declude.JunkMail". The archives can be found
  > at http://www.mail-archive.com.
  >
  >



  -- 
  ---
  Dean M. Lawrence
  INTERNET DATA TECHNOLOGY
  p // 888.438.4381 ext. 701
  w // www.idatatech.com
  f // www.facebook.com/idatatech
  t // www.twitter.com/idatatech

  Social Marketing | SEO | Design | Internet Development


  ---
  [This E-mail was scanned by Declude]


  ---
  This E-mail came from the Declude.JunkMail m

Re: [Declude.JunkMail] weird processing of lists

[IMail Admin]

But you're the man who knows everything about Declude.  Surely you know the 
answer to my original question?


Ben

-Original Message- 
From: David Barker

Sent: Wednesday, December 29, 2010 5:21 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] weird processing of lists

Most likely ;)

-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of IMail
Admin
Sent: Tuesday, December 28, 2010 3:24 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] weird processing of lists

Everyone gone on vacation?

-Original Message- 
From: IMail Admin

Sent: Friday, December 24, 2010 11:23 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] weird processing of lists

Hi,

I've run into a small problem between Declude and lists.  I have a domain
with a list on it such as listn...@domain.com.  You have to be on the
posters' list to send messages to that list.  One of the posters sends
messages to the list and is authorized for the list, but gets this error
message: "Invalid final delivery userid: listname-spam...@domain.com".
SpamLow is the folder into which messages are normally dropped when their
score is between 5 and 10.

It appears that Declude is assigning this message a score between 5 and 10
and then trying to put the message into the SpamLow folder for this user.
Except that it's not a user, it's a list.

So why does this happen and how do I handle it?

Thanks,

Ben

P.S. We've been using Declude JM/AV with Imail for a long time.  The current
versions are Imail 2006.23 and Declude 1.63.



---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] weird processing of lists

[IMail Admin]

Everyone gone on vacation?

-Original Message- 
From: IMail Admin

Sent: Friday, December 24, 2010 11:23 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] weird processing of lists

Hi,

I've run into a small problem between Declude and lists.  I have a domain
with a list on it such as listn...@domain.com.  You have to be on the
posters' list to send messages to that list.  One of the posters sends
messages to the list and is authorized for the list, but gets this error
message: "Invalid final delivery userid: listname-spam...@domain.com".
SpamLow is the folder into which messages are normally dropped when their
score is between 5 and 10.

It appears that Declude is assigning this message a score between 5 and 10
and then trying to put the message into the SpamLow folder for this user.
Except that it's not a user, it's a list.

So why does this happen and how do I handle it?

Thanks,

Ben

P.S. We've been using Declude JM/AV with Imail for a long time.  The current
versions are Imail 2006.23 and Declude 1.63.



---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] weird processing of lists

[IMail Admin]

I've got a second user with the same problem, so I'd be interested in help. 
The only thing I've thought of so far is to create user-specific settings 
for each list and specify not to create folders, but that's a pain in the 
neck.


Any help would be appreciated.

Thanks,

Ben

-Original Message- 
From: IMail Admin

Sent: Friday, December 24, 2010 11:23 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] weird processing of lists

Hi,

I've run into a small problem between Declude and lists.  I have a domain
with a list on it such as listn...@domain.com.  You have to be on the
posters' list to send messages to that list.  One of the posters sends
messages to the list and is authorized for the list, but gets this error
message: "Invalid final delivery userid: listname-spam...@domain.com".
SpamLow is the folder into which messages are normally dropped when their
score is between 5 and 10.

It appears that Declude is assigning this message a score between 5 and 10
and then trying to put the message into the SpamLow folder for this user.
Except that it's not a user, it's a list.

So why does this happen and how do I handle it?

Thanks,

Ben

P.S. We've been using Declude JM/AV with Imail for a long time.  The current
versions are Imail 2006.23 and Declude 1.63.



---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] weird processing of lists

[IMail Admin]

Hi,

I've run into a small problem between Declude and lists.  I have a domain 
with a list on it such as listn...@domain.com.  You have to be on the 
posters' list to send messages to that list.  One of the posters sends 
messages to the list and is authorized for the list, but gets this error 
message: "Invalid final delivery userid: listname-spam...@domain.com". 
SpamLow is the folder into which messages are normally dropped when their 
score is between 5 and 10.


It appears that Declude is assigning this message a score between 5 and 10 
and then trying to put the message into the SpamLow folder for this user. 
Except that it's not a user, it's a list.


So why does this happen and how do I handle it?

Thanks,

Ben

P.S. We've been using Declude JM/AV with Imail for a long time.  The current
versions are Imail 2006.23 and Declude 1.63. 




---
[This E-mail was scanned by Declude]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] What's wrong with my Declude?

[Imail Admin]

Got it.  Thanks!

---
[This E-mail was checked by Declude]

- Original Message - 
From: "Pete McNeil" 

To: 
Sent: Sunday, August 01, 2010 2:34 PM
Subject: Re: [Declude.JunkMail] What's wrong with my Declude?



On 8/1/2010 3:03 PM, Imail Admin wrote:

Hi Pete,

OK, I did the upgrade.  One thing that was slightly different from the 
instructions was that even though I directed it to install into the 
same folder as the prior Sniffer installation (d:\imail\sniffer), it 
only offered me a choice of a new install and said nothing about an 
upgrade.  Still, it seemed to go through smoothly, so I'll just cross 
my fingers.  Now that that's done, do I need to change my global.cfg 
setting?  The old setting is


SNIFFER  external  nonzero "D:\imail\sniffer\liajkovy.exe 
w91zgqvr4g73s6o5" 7  0.


I'm guessing the installer didn't understand the old installation -- 
that happens sometimes because they all tend to be a little different.


You should comment out your old SNIFFER line -- the installer should 
have created a new one for you that calls SNFClient.


Note that SNFClient will accept and ignore the authentication string, 
but it doesn't need to have it...


Your new SNIFFER line might look something like:

SNIFFER external nonzero "D:\sniffer\SNFClient.exe" 7 0

Hope this helps,

_M

---
[This E-mail was checked by Declude]

--
President
MicroNeil Research Corporation
www.microneil.com



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] What's wrong with my Declude?

[Imail Admin]

Hi Pete,

OK, I did the upgrade.  One thing that was slightly different from the 
instructions was that even though I directed it to install into the same 
folder as the prior Sniffer installation (d:\imail\sniffer), it only offered 
me a choice of a new install and said nothing about an upgrade.  Still, it 
seemed to go through smoothly, so I'll just cross my fingers.  Now that 
that's done, do I need to change my global.cfg setting?  The old setting is


SNIFFER  external  nonzero "D:\imail\sniffer\liajkovy.exe w91zgqvr4g73s6o5" 
7  0.


Thanks,

Ben
---
[This E-mail was checked by Declude]

- Original Message - 
From: "Pete McNeil" 

To: 
Sent: Sunday, August 01, 2010 11:28 AM
Subject: Re: [Declude.JunkMail] What's wrong with my Declude?



On 8/1/2010 1:36 PM, Imail Admin wrote:

Hi Pete,

By SNF I assume you mean Sniffer?  How do I tell for sure which version 
is running and whether it is getting the latest downloads?  I know it's 
running at least partially because the report lists it.  I checked the 
cfg file and it says "configuration for v2r3", so I assume that's version 
2 and not version 3?  Then I checked my old emails and found that my last 
license renewal was at the end of last August, so I have a valid license. 
I haven't received any noticed since then about newer versions or even 
renewing my license this year.


That all sounds about right.
I'm betting (based on the above) that you simply never upgraded to version 
3.


The best way to do that is to use our installer.

http://www.armresearch.com/products/snfClientServerWinInstaller.jsp
http://www.armresearch.com/message-sniffer/download/SNF_CS_Installer.exe

Another good way (if you're upgrading Declude also) is to switch to the 
built-in OEM version of SNF in Declude. (contact Declude about that if you 
wish to switch).


_M

---
[This E-mail was checked by Declude]

--
President
MicroNeil Research Corporation
www.microneil.com



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.







---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] What's wrong with my Declude?

[Imail Admin]

Hi Pete,

Thanks.  I think I'll try your installer first.  I checked and my Sniffer 
subscription runs out in late September.  I'm considering the possibility of 
upgrading Declude (first time in many years) and getting the OEM Sniffer 
with it.  If I do that, it'll be in September.  My system is so old (Imail 
2006.23 running on top of Windows Server 2000) that I worry it won't handle 
the newest versions of these products.


Thanks,

Ben

---
[This E-mail was checked by Declude]

- Original Message - 
From: "Pete McNeil" 

To: 
Sent: Sunday, August 01, 2010 11:28 AM
Subject: Re: [Declude.JunkMail] What's wrong with my Declude?



On 8/1/2010 1:36 PM, Imail Admin wrote:

Hi Pete,

By SNF I assume you mean Sniffer?  How do I tell for sure which version 
is running and whether it is getting the latest downloads?  I know it's 
running at least partially because the report lists it.  I checked the 
cfg file and it says "configuration for v2r3", so I assume that's version 
2 and not version 3?  Then I checked my old emails and found that my last 
license renewal was at the end of last August, so I have a valid license. 
I haven't received any noticed since then about newer versions or even 
renewing my license this year.


That all sounds about right.
I'm betting (based on the above) that you simply never upgraded to version 
3.


The best way to do that is to use our installer.

http://www.armresearch.com/products/snfClientServerWinInstaller.jsp
http://www.armresearch.com/message-sniffer/download/SNF_CS_Installer.exe

Another good way (if you're upgrading Declude also) is to switch to the 
built-in OEM version of SNF in Declude. (contact Declude about that if you 
wish to switch).


_M

---
[This E-mail was checked by Declude]

--
President
MicroNeil Research Corporation
www.microneil.com



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.







---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] What's wrong with my Declude?

[Imail Admin]

Hi Pete,

By SNF I assume you mean Sniffer?  How do I tell for sure which version is 
running and whether it is getting the latest downloads?  I know it's running 
at least partially because the report lists it.  I checked the cfg file and 
it says "configuration for v2r3", so I assume that's version 2 and not 
version 3?  Then I checked my old emails and found that my last license 
renewal was at the end of last August, so I have a valid license.  I haven't 
received any noticed since then about newer versions or even renewing my 
license this year.


Thanks,

Ben

---
[This E-mail was checked by Declude]

- Original Message - 
From: "Pete McNeil" 

To: 
Sent: Wednesday, July 28, 2010 12:18 PM
Subject: Re: [Declude.JunkMail] What's wrong with my Declude?



On 7/28/2010 2:29 PM, Imail Admin wrote:

lately (last couple of
weeks) I've noticed more spam getting through.  A lot more.


Check your SNF installation. I looked up your license ID and checked for 
your telemetry and did not find it.
This usually means that SNF is not currently running on your system or 
that you have not yet upgraded to version 3.


Hope this helps,

_M

--
President
MicroNeil Research Corporation
www.microneil.com

---
[This E-mail scanned for viruses by Declude]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.








---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] What's wrong with my Declude?

[Imail Admin]

Hi,

How do I get a current version of global.cfg?  My license is long expired 
and my version is much older.  Here's the relevant sections from the 
global.cfg file I have now:


#=   RBL IP4R TESTS 
==
# 1. Definitions of the tests to use (do not edit unless you know what you 
are doing). These must come before the actions.
# 2. First is the name of the check, then the type of check (ip4r is a DNS 
lookup using the reverse of the IP address).
# 3. For type ip4r, 'matchstring' is the string to look for, or "*" for 
anything.


AHBL   ip4r dnsbl.ahbl.org*  6 0
ADNSBL   ip4r dnsbl.antispam.or.id  127.0.0.2  3 0
BLITZEDALL  ip4r opm.blitzed.org*  7 0
CBL   ip4r cbl.abuseat.org   127.0.0.2  6 0
CSMA-SBL  ip4r sbl.csma.biz   127.0.0.2  2 0
DSBL-CONFIRMED  ip4r list.dsbl.org*  6 0
FIVETEN-SRC  ip4r blackholes.five-ten-sg.com 127.0.0.2  7 0
JAMMDNSBL  ip4r dnsbl.jammconsulting.com 127.0.0.2  3 0
INTERSIL  ip4r blackholes.intersil.net  127.0.0.2  5 0
IPWHOIS   ip4r ipwhois.rfc-ignorant.org 127.0.0.6  3 0
IMP-SPAM  ip4r spamrbl.imp.ch   127.0.0.5  5 0
#ORDB   ip4r relays.ordb.org*  5 0

#MTLDB   ip4r mtldb.declude.com  127.0.0.2  3 0

#MXRATE is FREE but requires registration 
http://www.mxrate.com/Subscribe.asp

MXRATE-BLOCK  ip4r pub.mxrate.net   127.0.0.2  7 0
MXRATE-SUSPICIOUS ip4r pub.mxrate.net   127.0.0.4  2 0

NJABL   ip4r dnsbl.njabl.org   127.0.0.2  5 0
SBL   ip4r sbl.spamhaus.org   *  9 0

SORBS-HTTP  ip4r dnsbl.sorbs.net   127.0.0.2  5 0
SORBS-SOCKS  ip4r dnsbl.sorbs.net   127.0.0.3  5 0
SORBS-MISC  ip4r dnsbl.sorbs.net   127.0.0.4  5 0
SORBS-SMTP  ip4r dnsbl.sorbs.net   127.0.0.5  5 0
SORBS-SPAM  ip4r dnsbl.sorbs.net   127.0.0.6  4 0
SORBS-WEB  ip4r dnsbl.sorbs.net   127.0.0.7  5 0
SORBS-BLOCK  ip4r dnsbl.sorbs.net   127.0.0.8  5 0
SORBS-ZOMBIE  ip4r dnsbl.sorbs.net   127.0.0.9  5 0
SORBS-DUHL  ip4r dnsbl.sorbs.net   127.0.0.10  6 0

SPAMBAG   ip4r blacklist.spambag.org  127.0.0.2  2 0
SPAMCANNIBAL  ip4r bl.spamcannibal.org  127.0.0.2  2 0
SPAMCOP   ip4r bl.spamcop.net   127.0.0.2  8 0

#UCEPROTECT-1  ip4r dnsbl-1.uceprotect.net  127.0.0.2  8 0
#UCEPROTECT-2  ip4r dnsbl-2.uceprotect.net  127.0.0.2  7 0
UCEPROTECT-1  ip4r dnsbl-1.uceprotect.net  127.0.0.2  5 0
UCEPROTECT-2  ip4r dnsbl-2.uceprotect.net  127.0.0.2  4 0
UCEPROTECT-3  ip4r dnsbl-3.uceprotect.net  127.0.0.2  2 0

BARRACUDA  IP4Rb.barracudacentral.org 127.0.0.2 3   0

#=  GOOD MAIL IP4R  TESTS 
==


BONDEDSENDER  ip4r query.bondedsender.org  127.0.0.10  -10 0
IADB   ip4r iadb.isipp.com   127.0.0.1  -5 0
FIVETEN-OPTIN  ip4r blackholes.five-ten-sg.com 127.0.0.4  -3 0
MXRATE-ALLOW  ip4r pub.mxrate.net   127.0.0.3  -3 0

#=   RHBSL  TESTS 
==


AHBL-DOMAINSRHSBL  rhsbl.ahbl.org127.0.0.2   10  0
BADWHOIS  rhsbl whois.rfc-ignorant.org  127.0.0.5  3 0
DSN   rhsbl dsn.rfc-ignorant.org  127.0.0.2  3 0
NOABUSE   rhsbl abuse.rfc-ignorant.org  127.0.0.4  2 0
NOPOSTMASTER  rhsbl postmaster.rfc-ignorant.org 127.0.0.3  1 0

MAILPOLICE-BLOCK rhsbl  block.rhs.mailpolice.com 127.0.0.2   8 0
MAILPOLICE-FRAUD  rhsbl  fraud.rhs.mailpolice.com 127.0.0.2  8 0

SURBL   rhsbl  multi.surbl.org*  5  0

Thanks,

Ben


---
[This E-mail was checked by Declude]

- Original Message - 
From: "Scott Fisher" 

To: 
Sent: Wednesday, July 28, 2010 11:59 AM
Subject: RE: [Declude.JunkMail] What's wrong with my Declude?


One thing is to add zen.spamhaus.org  (removing cbl, sbl and perhaps njabl).
It's the newer list from spamhaus
ZEN IP4R zen.spamhaus.org *
7 0


You'd probably be best off comparing your global.cfg to Declude's current
globabl.cfg.

-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Imail
Admin
Sent: Wednesday, July 28, 2010 1:30 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] What's wrong with my Declude?


Hi,

We've been using Declude JM/AV with Imail for a long time.  The current
versions are Imail 2006.23 and Declude 1.63.  I don't spend much time
tweaking the system any more -- it's a small server that only handles about
40 domains (none of them heavy users).  Anyway, lately (last couple of
weeks) I've noticed more spam getting through.  A lot more.  Everything
seems to be working as always, but it's not as effective.  I'm looking for
advice on how to make this effective without spending either big bucks or
investing huge amounts of time.  Any advice?  Here is my DL Analyzer report:

 Total Messages Processed: 7,487
 Messages That Failed Defined Test(s): 7,404
 Percentage That Failed Defined Test(s): 98.89%
 Average Message Weight: 42
 Average Message Weight/Failed: 42
 TEST # FAILED PERCENTAGE
 CAT

[Declude.JunkMail] What's wrong with my Declude?

[Imail Admin]

Hi,

We've been using Declude JM/AV with Imail for a long time.  The current
versions are Imail 2006.23 and Declude 1.63.  I don't spend much time
tweaking the system any more -- it's a small server that only handles about
40 domains (none of them heavy users).  Anyway, lately (last couple of
weeks) I've noticed more spam getting through.  A lot more.  Everything
seems to be working as always, but it's not as effective.  I'm looking for
advice on how to make this effective without spending either big bucks or
investing huge amounts of time.  Any advice?  Here is my DL Analyzer report:

 Total Messages Processed: 7,487
 Messages That Failed Defined Test(s): 7,404
 Percentage That Failed Defined Test(s): 98.89%
 Average Message Weight: 42
 Average Message Weight/Failed: 42
 TEST # FAILED PERCENTAGE
 CATCHALLMAILS 7,404 98.89%
 IPNOTINMX 7,306 97.58%
 WEIGHT4 6,791 90.70%
 WEIGHT5 6,726 89.84%
 WEIGHT7 6,652 88.85%
 WEIGHT8 6,554 87.54%
 WEIGHT10 6,481 86.56%
 WEIGHT12 6,282 83.91%
 NOLEGITCONTENT 6,239 83.33%
 WEIGHT15 6,147 82.10%
 WEIGHT20 5,930 79.20%
 WEIGHT20R 5,930 79.20%
 BARRACUDA 5,917 79.03%
 WEIGHT30 5,534 73.91%
 WEIGHT30R 5,534 73.91%
 INV-URIBL 5,427 72.49%
 SPFUNKNOWN 5,290 70.66%
 SNIFFER 4,625 61.77%
 CBL 4,121 55.04%
 UCEPROTECT-2 3,840 51.29%
 UCEPROTECT-3 3,702 49.45%
 SPAMCOP 3,659 48.87%
 UCEPROTECT-1 3,355 44.81%
 REVDNS 2,467 32.95%
 CMDSPACE 2,290 30.59%
 SUBCHARS-50 2,227 29.74%
 SUBCHARS-55 1,787 23.87%
 SPFPASS 1,664 22.23%
 SORBS-WEB 1,574 21.02%
 SUBCHARS-60 1,441 19.25%
 SORBS-DUHL 1,086 14.51%
 FIVETEN-SRC 1,085 14.49%
 FROMNOMATCH 1,072 14.32%
 NOPOSTMASTER 886 11.83%
 NOABUSE 728 9.72%
 SUBSPACE-12 592 7.91%
 BADHEADERS 583 7.79%
 SURBL 564 7.53%
 DYNHELO 541 7.23%
 WEIGHT7R 505 6.75%
 NONENGLISH 500 6.68%
 IMP-SPAM 392 5.24%
 SPFFAIL 342 4.57%
 WEIGHT10R 334 4.46%
 SORBS-SPAM 325 4.34%
 WEIGHT8R 293 3.91%
 SUBSPACE-15 286 3.82%
 WEIGHT4R 269 3.59%
 WEIGHT5R 245 3.27%
 WEIGHT15R 217 2.90%
 SPAMCANNIBAL 217 2.90%
 HELOBOGUS 217 2.90%
 SBL 205 2.74%
 SUBSPACE-17 201 2.68%
 WEIGHT12R 174 2.32%
 AHBL 158 2.11%
 SPAMHEADERS 152 2.03%
 BADWHOIS 133 1.78%
 FIVETEN-OPTIN 113 1.51%
 DSN 57 0.76%
 BONDEDSENDER 46 0.61%
 ROUTING 36 0.48%
 SIZE-300K 33 0.44%
 BASE64 32 0.43%
 SIZE-500K 20 0.27%
 IADB 19 0.25%
 AHBL-DOMAINS 15 0.20%
 SIZE-1MB 12 0.16%
 CONTSPACES 4 0.05%
 NJABL 4 0.05%
 BADCTYREVDNSTO 1 0.01%


Thanks,

Ben

---
[This E-mail scanned for viruses by Declude]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] multistage filtering [OT]

[Ncl Admin]

Alligate  Alligate Alligate

At 12:28 PM 2/10/2010 +0100, you wrote: 

Hi,


With the amount of spam I have to throw away each day no reaching consistant levels of over 90%... I can of course get an even faster mailserver but I think I would be better of with an extra smtp server in front of my mailserver which filters the most blatant spam mail purly based on session info. What passes that server can go on to my IMail server and have more contect based filtering using Declude, Sniffer, InvURIBL etc.


What would be a good first step server? I have experience with (Debian) Linux so a Linux based solution is no problem.


Met vriendelijke groet,
Bonno Bloksma
senior systeembeheerder

tio 
hogeschool hospitality en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
b.blok...@tio.nl / www.tio.nl 



-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 

RE: [Declude.JunkMail] CBL:IP is Blacklisted

[Ncl Admin]

Well Alligate should most definitely be in your plan.  I run it, cuts
server hits
by over 90%, is cost effective. Cuts Virus by nearly 99% as bots don't get
through
I tried SM as well as microsoft.  Best thing I have ever tried was Alligate.

Works well with Declude and they even have something coming out together.
Guess
SM has nice web interface now tho.  


At 01:34 PM 2/13/2009 -0600, Todd Richards wrote:
>Thanks Craig.  I have on my budget an upgrade for our mail server - not sure
>yet whether I'm sticking with Imail or going to SM.  Just sucks that it is
>suddenly happening and I probably need to do it sooner rather than later.  I
>don't know anything about Alligate and don't know whether that should be in
>my plan regardless of what I upgrade to.  So I don't know if I should waste
>time putting that in as a work around for now.
>
>Todd
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig
>Edmonds
>Sent: Friday, February 13, 2009 11:33 AM
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>
>I had this problem too  and I have imail 8.15 so the stupid fix does not
>apply to me either.
>
>Therefore I had the choice (or rather the ultimatum from CBL) to either
>upgrade Imail or use a smtp gateway.
>
>So I now use Alligate as an smtp server.
>
>It funny...notthat they "used" to whitelist imail users, now they dont,
>they just give you the ultimatum even when you can prove that your server is
>legit and well protected.
>
>The guys at CBL have their heads up theirwell you can imagine it.
>
>
>Kindest Regards
>Craig Edmonds
>123 Marbella Internet Services
>W: www.123marbella.com
>E : cr...@123marbella.com
>
>
>
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd
>Richards
>Sent: 13 February 2009 18:25
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>
>Thanks Andrew.  I just got a note from CBL that says that they are no longer
>automatically removing Imail machines, as there is a fix.  Not sure if my
>older version (8.2x) is part of that fix or what.  Anyway, their message
>said
>
>"The CBL attempts to detect compromised machines in a number of ways based
>upon the email that the CBL's mail servers receive.
>
>During this it tries distinguish whether the connections represent real mail
>servers by ensuring that each connection is claiming a plausible machine
>name for itself (via SMTP HELO), and not listing any IP that corresponds to
>a real mail server (or several mail servers if the IP address is a NAT
>firewall with multiple mail servers behind it).
>
>8.7.193.82 was found to be using several different EHLO/HELO names during
>multiple connections on or about:
>
>2009:02:12 ~21:30 UTC+/- 15 minutes (approximately 19 hours ago).
>
>The names seen included:
>
>   enwcommunity.com, hcaa.com, mail.nnepa.com, p01c11m022.mxlogic.net,
>p01c11m096.mxlogic.net, p01c11m102.mxlogic.net, p01c11m107.mxlogic.net,
>p01c12m013.mxlogic.net, p01c12m062.mxlogic.net
>"
>
>The first two are legitimate virtual domains on our server, the third is our
>server.  But I have no idea where the mxlogic.net names are from?
>
>Todd
>
>
>
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Colbeck,
>Andrew
>Sent: Friday, February 13, 2009 10:56 AM
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>Here's the answer, Todd.
>
>http://www.mail-archive.com/imail_fo...@list.ipswitch.com/msg103112.html
>
>It's an old problem with CBL and IMail. Certainly, CBL is at fault and
>by now they should have at least taken up SPF record checking to weed
>out false positives. I just checked your SPF record and it is valid, so
>this would have helped you.
>
>
>Andrew.
>
>
> 
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd
>Richards
>Sent: Friday, February 13, 2009 8:42 AM
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>
>OK, Sorry to cry wolf.  I sent them an email directly (which is what
>they
>said to do if you are running Imail) and it appears that they have us
>removed already.  Not sure why/how we got added, if it has anything to
>do
>with Imail (as they suggest) or what.  I'm running several misc. scans
>on
>our server to be sure we don't have a problem.  Any other suggestions of
>how/why, or what to check are always appreciated!
>
>Todd
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd
>Richards
>Sent: Friday, February 13, 2009 10:13 AM
>To: declude.junkmail@declude.com
>Subject: [Declude.JunkMail] CBL:IP is Blacklisted
>
>Hi  Everyone -
>
>Late yesterday I started seeing some bounces that our IP address was
>being
>rejected because of the following:
>
>   RCPT TO generated following response:
>   5

Re: [Declude.JunkMail] Help Me Add Weight

[Ncl Admin]

I would add country weight as well. There used to be examples that work.  I
actually weight yahoo.com.XX as well.


At 01:20 PM 2/10/2009 -0500, Pete McNeil wrote: 

Robert Grosshandler wrote: 
   
 
Sounds like a spam headline, doesnt it?
 
 
 
Anyway, were getting obvious spam, but were not able to weight it enough
to block it.  Any tests you might suggest.  The following came to us BCCd,
I believe.  Nothing about it was appropriate for us.
  


  

X-RBL-Warning: SNIFFER: Message failed SNIFFER: 60.
 
X-Declude-Sender: scp...@yahoo.com.ar
[173.15.150.165]
 
X-Declude-Spoolname: Dccef01a2279a.smd
 
X-Declude-RefID: str=0001.0A010203.498BCCF8.0197,ss=1,fgs=0
 
X-Declude-Scan: Incoming Score [11] at 23:39:07 on 05 Feb 2009
 
X-Declude-Fail: UCEPROTECT-1 [4], SNIFFER [12], WEIGHT9 [9], WEIGHTMID
[10], ZEROHOUR [0]
  
I'm biased, but you might increase the weight you add for SNF -- I note it
did fail the message.

Most systems seem to weight SNF so that SNF + any other test will hold a
message.

Many hold on SNF alone.

Given that general practice, adding weight to SNF might solve this problem
for you.

_M



-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.





-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SMTPd32.exe failing. Faulting application ntdll.dll

[Ncl Admin]

I suggest you google.com smtp and ntdll.dll.  Seems this is fairly common.

At 10:31 AM 1/26/2009 -0700, Dale McDiarmid wrote:
>That's going to be tricky. The outages are random, sometimes not  
>happening for 24 hours or more. We went most the weekend without  
>failure then had two this morning.
>
>Going without spam or virus protection for a few days or more would be  
>a hardship on everyone in the company.
>
>At this point I'd consider paying for Ipswitch's Plus package to  
>replace Declude's.
>
>But that's $1000 on an experiment that might not work.
>
>Thx,
>D.
>
>
>On Jan 26, 2009, at 9:54 AM, David Barker wrote:
>
>> Remove Declude from the process. If the SMTPd32.exe still faults  
>> this would
>> help verify that the problem is associated with Ipswitch. However the
>> ntdll.dll is a windows OS .dll and there could be a specific  
>> variable on
>> your server that is causing this issue in which case it may not be  
>> either of
>> the vendors.
>>
>> David B
>>
>> -Original Message-
>> From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of  
>> Dale
>> McDiarmid
>> Sent: Monday, January 26, 2009 11:47 AM
>> To: declude.junkmail@declude.com
>> Subject: [Declude.JunkMail] SMTPd32.exe failing. Faulting application
>> ntdll.dll
>>
>> Hello...
>>
>> Beginning late last week we're experiencing periodic SMTP failures.
>> Error log shows: Faulting application SMTPd32.exe, version 8.11.6.0,
>> faulting module ntdll.dll version 5.2.3790.1830.
>>
>> Ipswitch tech support updated my system to 10.02 (I was at 9.04 when
>> it all began). Declude tech support also updated my Declude.
>>
>> But the problems persist. Now Ipswitch is blaming Declude, and Declude
>> it blaming Ipswitch. Both saying pretty much the say thing "There's no
>> way our program could cause this. We've seen this before and always
>> been the other guy".
>>
>> While tech support at both Ipswitch and Declude have been very good,
>> as always, I'm stuck with both sides giving up.
>>
>> Any suggestions?
>>
>> Thx,
>> D.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to imail...@declude.com, and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>
>-
>This information is intended only for the use of the individual or
>entity named above. 
>
>If you are not the intended recipient, you are hereby notified that
>any disclosure, copying, distribution, or action taken in reliance
>on the contents of these documents is strictly prohibited. If you
>have received this information in error, please notify the sender
>immediately and arrange for the return or destruction of the 
>document(s).
>
>Warning: All e-mail sent to or from this address will be received or
>otherwise recorded by the Corporate e-mail system and is subject to 
>archival, monitoring or review by, and/or disclosure to, someone other
>than the recipient.
>
>


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SMTPd32.exe failing. Faulting application ntdll.dll

[Ncl Admin]

I suggest you google.com smtp and ntdll.dll.  Seems this is fairly common.

At 10:31 AM 1/26/2009 -0700, Dale McDiarmid wrote:
>That's going to be tricky. The outages are random, sometimes not  
>happening for 24 hours or more. We went most the weekend without  
>failure then had two this morning.
>
>Going without spam or virus protection for a few days or more would be  
>a hardship on everyone in the company.
>
>At this point I'd consider paying for Ipswitch's Plus package to  
>replace Declude's.
>
>But that's $1000 on an experiment that might not work.
>
>Thx,
>D.
>
>
>On Jan 26, 2009, at 9:54 AM, David Barker wrote:
>
>> Remove Declude from the process. If the SMTPd32.exe still faults  
>> this would
>> help verify that the problem is associated with Ipswitch. However the
>> ntdll.dll is a windows OS .dll and there could be a specific  
>> variable on
>> your server that is causing this issue in which case it may not be  
>> either of
>> the vendors.
>>
>> David B
>>
>> -Original Message-
>> From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of  
>> Dale
>> McDiarmid
>> Sent: Monday, January 26, 2009 11:47 AM
>> To: declude.junkmail@declude.com
>> Subject: [Declude.JunkMail] SMTPd32.exe failing. Faulting application
>> ntdll.dll
>>
>> Hello...
>>
>> Beginning late last week we're experiencing periodic SMTP failures.
>> Error log shows: Faulting application SMTPd32.exe, version 8.11.6.0,
>> faulting module ntdll.dll version 5.2.3790.1830.
>>
>> Ipswitch tech support updated my system to 10.02 (I was at 9.04 when
>> it all began). Declude tech support also updated my Declude.
>>
>> But the problems persist. Now Ipswitch is blaming Declude, and Declude
>> it blaming Ipswitch. Both saying pretty much the say thing "There's no
>> way our program could cause this. We've seen this before and always
>> been the other guy".
>>
>> While tech support at both Ipswitch and Declude have been very good,
>> as always, I'm stuck with both sides giving up.
>>
>> Any suggestions?
>>
>> Thx,
>> D.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to imail...@declude.com, and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>
>-
>This information is intended only for the use of the individual or
>entity named above. 
>
>If you are not the intended recipient, you are hereby notified that
>any disclosure, copying, distribution, or action taken in reliance
>on the contents of these documents is strictly prohibited. If you
>have received this information in error, please notify the sender
>immediately and arrange for the return or destruction of the 
>document(s).
>
>Warning: All e-mail sent to or from this address will be received or
>otherwise recorded by the Corporate e-mail system and is subject to 
>archival, monitoring or review by, and/or disclosure to, someone other
>than the recipient.
>
>


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] "New" Blacklist / Whitelist (Barracuda)

[Imail Admin]

Hi,

A couple of months ago I read the discussion about the new Barracuda BRBL. 
Then I went to the archives to see how people were implementing it into 
Declude.  I have Declude 4.2.x, so I don't have the features of 4.4.  I was 
unable from reviewing the archives to figure out the best way to implement 
this.  Can someone give me the lines for global.cfg?  And do you still think 
it's worth it?


Thanks,

Ben

- Original Message - 
From: "David Dodell" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, October 15, 2008 9:28 PM
Subject: Re: [Declude.JunkMail] "New" Blacklist / Whitelist



b)   http://www.barracudacentral.org/rbl
Hadn’t seen this one mentioned? Any experiences? Effective? False 
Positives?



I'm giving this one a try ... I know Barracuda is a large manufacturer
of hardware spam "firewalls" ... reputable company

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail]

[Ncl Admin]

It wouldn't create a folder if Imail is set in the domain control panel to not allow that I believe.

Message & Mailbox Options 
Default Maximum Mailbox Size:   byte(s) KB MB GB  
Max. Outbound Message Size:   byte(s) KB MB GB  
Single Message Maximum Size:   byte(s) KB MB GB  
Full Mailbox Notify (percentage):  
Default Maximum Messages:   
Full Mailbox Notify Address:  
Maximum User Count:   
Current User Count: 
Sub-mailbox Creation: Create Send to Inbox Bounce  
Minimum POP Frequency (minutes):  



At 04:32 PM 11/12/2008 -0500, David Barker wrote: 


Not sure why it is not creating the folder as it should do. It should not matter if there is a space or tab used. I would suggest opening a ticket with [EMAIL PROTECTED] m so we can troubleshoot the issue with you.




David Barker




From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Declude Junkmail
Sent: Wednesday, November 12, 2008 11:18 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail]




IMail Version 9.2. (We have the latest but just haven't installed it yet)




It works great and helped me catch one false positive just this AM, but I had to create the mailbox (folder) manually from the web interface. Does it make a difference if that's a space or a tab between MAILBOX and spam? I used a tab.

MAILBOX spam

MAILBOXspam




Can Mailbox be used multiple times such a one folder used for an IP blacklist filter and another used for PDFs? Such as:

IPBLACKLIstMAILBOXBADIPs

FILTERPDFMAILBOXPDF




~Joe

- Original Message - 

From: David Barker 

To: declude.junkmail@declude.com 

Sent: Wednesday, November 12, 2008 8:07 AM

Subject: RE: [Declude.JunkMail] Wish List: Related to Anyone know a tool...




This is how the Mailbox action should work. The MAILBOX action will send an E-mail to a specific mailbox (folder) for the recipient. For example, you can have E-mail moved to a "spam" mailbox that the user can check via web messaging or IMAP (or POP3, by setting up a special account in the format "user-mailbox"). To use it, just include the name of the mailbox to use -- for example, "WEIGHT10 MAILBOX spam".




Are you using SM or IM ?




David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]







From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Declude Junkmail
Sent: Wednesday, November 12, 2008 1:21 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Wish List: Related to Anyone know a tool...




It would certainly be nice if the Mailbox command would create a new folder in a user's account.

Such as
weight22  mailbox   junkmail
where the folder named junkmail would automatically be created.

Or maybe I'm missing something? When I attempted to use this directive in a username.junkmail file, it wouldn't work until I manually created the folder for email to go to.

Maybe someone can point me to a good way to do this.

~Joe







---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 

Re: Re[6]: [Declude.JunkMail] DNS Changes

[Ncl Admin]

There is also the question of loss of connectivity from point A to OpenDNS
server #1 which is all that you have if you setup Declude to use a Single
Source DNS server.  If anywhere in that path there is an outage you will
have no DNS.

Far better to learn a little about DNS and run your own. Then you can at
least use several other sources even if you care to set it up to use OpenDNS.

As for $0.01 I have changed that as of recent events to $0.005 as your 401K
has probably gone down that much in recent months.

At 09:01 AM 10/9/2008 -0400, Darin Cox wrote:
>1. The customer has no control over its availability. 
>My $0.01. (decreased due to inflation and other financial considerations, 
>plus being mostly a reiteration of points already made)



-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Tip of the day??

[Imail Admin]

I prefer 

table...

tennis
  - Original Message - 
  From: John T 
  To: declude.junkmail@declude.com 
  Sent: Saturday, May 17, 2008 12:44 AM
  Subject: Re: [Declude.JunkMail] Tip of the day??


  Pong


  John T
  eServices For You




  -Original Message-
  From: "Declude Junkmail" <[EMAIL PROTECTED]>
  Sent 5/14/2008 12:12:45 PM
  To: declude.junkmail@declude.com
  Subject: [Declude.JunkMail] Tip of the day??


  Ping. kinda quiet arounf here... 

  Anyone got any tips on blocking the business loan junkmail?

  ~Joe


  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 
  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] blocking certain character sets

[Imail Admin]

Oh, well, thanks anyway Dave.  I have 4.2.20 and no current SA.
  - Original Message - 
  From: David Barker 
  To: declude.junkmail@declude.com 
  Sent: Friday, May 16, 2008 10:00 AM
  Subject: RE: [Declude.JunkMail] blocking certain character sets


  Declude Security Suite 4.3.40 [12 March 2007]

   

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Imail Admin
  Sent: Friday, May 16, 2008 12:45 PM
  To: declude.junkmail@declude.com
  Subject: Re: [Declude.JunkMail] blocking certain character sets

   

  David,

   

  Can you tell me when (what version number) the PCRE filter was introduced?

   

  Thanks,

   

  Ben

   

- Original Message - 

From: David Barker 

To: declude.junkmail@declude.com 

Sent: Friday, May 16, 2008 8:39 AM

Subject: RE: [Declude.JunkMail] blocking certain character sets

 

Ferrell,

 

It would be interesting to get a copy of the email line that the filter did 
not work on - that way we can look at adjusting the expression

 

David

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard
Sent: Friday, May 16, 2008 11:34 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] blocking certain character sets

 

When I added to my global.cfg

BANCHARSETkoi8-r

it did not do anything ( emails continued to come in with this character 
set)

 

Putting it into a Filter   DID  work.

ANYWHERE  30  PCRE (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?))

(most of the time - but not all the time).

 

The advantage - for me - for the Filter is that it applies to all 400 Post 
Offices

that we host on the server.

Whereas the rules.ima would have to be set up for each mailbox.

 

Ferrell

 

- Original Message - 

From: "Imail Admin" <[EMAIL PROTECTED]>

To: 

Sent: Thursday, May 15, 2008 3:56 PM

Subject: Re: [Declude.JunkMail] blocking certain character sets

 

> Hi,
> 
> I have a question of strategy.  Per David's message below, one can setup a
> filter for a character set (such as Russian).  Alternative, one could use
> BANCHARSET.  For a third alternative, one could use rules.ima within IMail
> itself.  So what are the pros and cons of these three approaches?  Which
> would likely have the least CPU impact?
> 
> Also, is BANCHARSET new?  I have a slightly older version of Declude and I
> don't recall it (of course, I can't find a manual for my version either).
> 
> Thanks,
> 
> Ben
> 
> - Original Message - 
> From: "David Barker" <[EMAIL PROTECTED]>
> To: 
> Sent: Tuesday, May 06, 2008 8:14 AM
> Subject: RE: [Declude.JunkMail] blocking certain character sets
> 
> 
> For these char sets it is much easier - use the following:
> 
> ANYWHERE 10 PCRE (?i:(iso-2022-jp|unicode-1-1-utf-7))
> 
> David B
> 
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
> Ard
> Sent: Tuesday, May 06, 2008 11:05 AM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] blocking certain character sets
> 
> David
> 
> Thank you for the filter for "koi8-r"
> 
> Would you be willing to code me one for "unicode-1-1-utf-7" &
> "ISO-2022-JP"
> 
> (I deleted my example of unicode-1-1-utf-7)
> 
> Subject: =?ISO-2022-JP?B?GyRCQXc/LiUoJWkhPBsoSg==?=
> 
> Subject: X-IMail-SPAM DELIVERY FAILURE:
> =?ISO-2022-JP?B?GyRCJWYhPCU2ITwbKEIgeG55cnd5ICh4bnlyd3lAc21iYy5jb20uaGs=?=
> =?ISO-2022-JP?B?KSAbJEIkTxsoQiBEb21pbm8gGyRCJUclIyVsJS8lSCVqJEskTzgrGyhC?=
> =?ISO-2022-JP?B?GyRCJEQkKyRqJF4kOyRzISMbKEI=?=
> Thanks very much
> 
> Ferrell
> - Original Message - 
> From: David Barker
> To: declude.junkmail@declude.com
> Sent: Monday, April 21, 2008 10:21 AM
> Subject: RE: [Declude.JunkMail] blocking certain character sets
> 
> I am surprised that they are still coming through, I would think that 
should
> have stopped it altogether. However add the following line to a junkmail
> filter:
> 
> #CYRILLIC
> ANYWHERE 10 PCRE
> (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?))
> 
> David
> 
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
> Ard
> Sent: Monday, April 21, 2008 7:55 AM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] blocking certain character sets
> 
> David
> 
> Thanks 

Re: [Declude.JunkMail] blocking certain character sets

[Imail Admin]

David,

Can you tell me when (what version number) the PCRE filter was introduced?

Thanks,

Ben

  - Original Message - 
  From: David Barker 
  To: declude.junkmail@declude.com 
  Sent: Friday, May 16, 2008 8:39 AM
  Subject: RE: [Declude.JunkMail] blocking certain character sets


  Ferrell,

   

  It would be interesting to get a copy of the email line that the filter did 
not work on - that way we can look at adjusting the expression

   

  David

   

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard
  Sent: Friday, May 16, 2008 11:34 AM
  To: declude.junkmail@declude.com
  Subject: Re: [Declude.JunkMail] blocking certain character sets

   

  When I added to my global.cfg

  BANCHARSETkoi8-r

  it did not do anything ( emails continued to come in with this character set)

   

  Putting it into a Filter   DID  work.

  ANYWHERE  30  PCRE (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?))

  (most of the time - but not all the time).

   

  The advantage - for me - for the Filter is that it applies to all 400 Post 
Offices

  that we host on the server.

  Whereas the rules.ima would have to be set up for each mailbox.

   

  Ferrell

   

  - Original Message - 

  From: "Imail Admin" <[EMAIL PROTECTED]>

  To: 

  Sent: Thursday, May 15, 2008 3:56 PM

  Subject: Re: [Declude.JunkMail] blocking certain character sets

   

  > Hi,
  > 
  > I have a question of strategy.  Per David's message below, one can setup a
  > filter for a character set (such as Russian).  Alternative, one could use
  > BANCHARSET.  For a third alternative, one could use rules.ima within IMail
  > itself.  So what are the pros and cons of these three approaches?  Which
  > would likely have the least CPU impact?
  > 
  > Also, is BANCHARSET new?  I have a slightly older version of Declude and I
  > don't recall it (of course, I can't find a manual for my version either).
  > 
  > Thanks,
  > 
  > Ben
  > 
  > - Original Message - 
  > From: "David Barker" <[EMAIL PROTECTED]>
  > To: 
  > Sent: Tuesday, May 06, 2008 8:14 AM
  > Subject: RE: [Declude.JunkMail] blocking certain character sets
  > 
  > 
  > For these char sets it is much easier - use the following:
  > 
  > ANYWHERE 10 PCRE (?i:(iso-2022-jp|unicode-1-1-utf-7))
  > 
  > David B
  > 
  > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
  > Ard
  > Sent: Tuesday, May 06, 2008 11:05 AM
  > To: declude.junkmail@declude.com
  > Subject: Re: [Declude.JunkMail] blocking certain character sets
  > 
  > David
  > 
  > Thank you for the filter for "koi8-r"
  > 
  > Would you be willing to code me one for "unicode-1-1-utf-7" &
  > "ISO-2022-JP"
  > 
  > (I deleted my example of unicode-1-1-utf-7)
  > 
  > Subject: =?ISO-2022-JP?B?GyRCQXc/LiUoJWkhPBsoSg==?=
  > 
  > Subject: X-IMail-SPAM DELIVERY FAILURE:
  > =?ISO-2022-JP?B?GyRCJWYhPCU2ITwbKEIgeG55cnd5ICh4bnlyd3lAc21iYy5jb20uaGs=?=
  > =?ISO-2022-JP?B?KSAbJEIkTxsoQiBEb21pbm8gGyRCJUclIyVsJS8lSCVqJEskTzgrGyhC?=
  > =?ISO-2022-JP?B?GyRCJEQkKyRqJF4kOyRzISMbKEI=?=
  > Thanks very much
  > 
  > Ferrell
  > - Original Message - 
  > From: David Barker
  > To: declude.junkmail@declude.com
  > Sent: Monday, April 21, 2008 10:21 AM
  > Subject: RE: [Declude.JunkMail] blocking certain character sets
  > 
  > I am surprised that they are still coming through, I would think that should
  > have stopped it altogether. However add the following line to a junkmail
  > filter:
  > 
  > #CYRILLIC
  > ANYWHERE 10 PCRE
  > (?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?))
  > 
  > David
  > 
  > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
  > Ard
  > Sent: Monday, April 21, 2008 7:55 AM
  > To: declude.junkmail@declude.com
  > Subject: Re: [Declude.JunkMail] blocking certain character sets
  > 
  > David
  > 
  > Thanks very much.
  > 
  > I added to the Declude.cfg BANCHARSET koi8-r
  > after I upgraded to 4.4.0
  > 
  > They are still coming thru.
  > Is there anything else that I need to do?
  > 
  > This is what I'm still getting
  > 
  > From: =?koi8-r?B?58XOzsHEycog98HTyczYxdfJ3g==?= <[EMAIL PROTECTED]>
  > Subject: X-IMail-SPAM =?koi8-r?B?58/S0d3JxSDQ1dTF18vJIQ==?=
  > Thanks very much
  > Ferrell Ard
  > - Original Message - 
  > From: David Barker
  > To: declude.junkmail@declude.com
  > Sent: Tuesday, April 08, 2008 10:12 AM
  > Subject: RE: [Declude.JunkMail] Need help in setting up filter please
  > 
  > You can use the settings in Declude.cfg to stop certain character sets.
  > 
  > David B
  > 
  > From:

Re: [Declude.JunkMail] blocking certain character sets

[Imail Admin]

Hi,

I have a question of strategy.  Per David's message below, one can setup a
filter for a character set (such as Russian).  Alternative, one could use
BANCHARSET.  For a third alternative, one could use rules.ima within IMail
itself.  So what are the pros and cons of these three approaches?  Which
would likely have the least CPU impact?

Also, is BANCHARSET new?  I have a slightly older version of Declude and I
don't recall it (of course, I can't find a manual for my version either).

Thanks,

Ben

- Original Message - 
From: "David Barker" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, May 06, 2008 8:14 AM
Subject: RE: [Declude.JunkMail] blocking certain character sets


For these char sets it is much easier - use the following:

ANYWHERE 10 PCRE (?i:(iso-2022-jp|unicode-1-1-utf-7))

David B

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
Ard
Sent: Tuesday, May 06, 2008 11:05 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] blocking certain character sets

David

Thank you for the filter for "koi8-r"

Would you be willing to code me one for "unicode-1-1-utf-7" &
"ISO-2022-JP"

(I deleted my example of unicode-1-1-utf-7)

Subject: =?ISO-2022-JP?B?GyRCQXc/LiUoJWkhPBsoSg==?=

Subject: X-IMail-SPAM DELIVERY FAILURE:
=?ISO-2022-JP?B?GyRCJWYhPCU2ITwbKEIgeG55cnd5ICh4bnlyd3lAc21iYy5jb20uaGs=?=
=?ISO-2022-JP?B?KSAbJEIkTxsoQiBEb21pbm8gGyRCJUclIyVsJS8lSCVqJEskTzgrGyhC?=
=?ISO-2022-JP?B?GyRCJEQkKyRqJF4kOyRzISMbKEI=?=
Thanks very much

Ferrell
- Original Message - 
From: David Barker
To: declude.junkmail@declude.com
Sent: Monday, April 21, 2008 10:21 AM
Subject: RE: [Declude.JunkMail] blocking certain character sets

I am surprised that they are still coming through, I would think that should
have stopped it altogether. However add the following line to a junkmail
filter:

#CYRILLIC
ANYWHERE 10 PCRE
(?i:(charset=.{0,2}koi8-[ur].{0,2})|(=\?koi8-[ur]\?b\?))

David

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
Ard
Sent: Monday, April 21, 2008 7:55 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] blocking certain character sets

David

Thanks very much.

I added to the Declude.cfg BANCHARSET koi8-r
after I upgraded to 4.4.0

They are still coming thru.
Is there anything else that I need to do?

This is what I'm still getting

From: =?koi8-r?B?58XOzsHEycog98HTyczYxdfJ3g==?= <[EMAIL PROTECTED]>
Subject: X-IMail-SPAM =?koi8-r?B?58/S0d3JxSDQ1dTF18vJIQ==?=
Thanks very much
Ferrell Ard
- Original Message - 
From: David Barker
To: declude.junkmail@declude.com
Sent: Tuesday, April 08, 2008 10:12 AM
Subject: RE: [Declude.JunkMail] Need help in setting up filter please

You can use the settings in Declude.cfg to stop certain character sets.

David B

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
Ard
Sent: Tuesday, April 08, 2008 7:41 AM
To: Declude
Subject: [Declude.JunkMail] Need help in setting up filter please

We are getting a lot of email that has the code for character set
in the "From"

The from always starts with =?koi8-r?

Does anyone have a filter that might help me eliminate these.

From: =?koi8-r?B?8dLP08zB1yD30d7F08zB18/Xyd4=?= http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Question on mailbox action...

[Imail Admin]

The answer to your question is yes, the mailbox is created automatically. 
We use it all the time.


Ben

- Original Message - 
From: "Chuck Schick" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 30, 2008 7:47 AM
Subject: RE: [Declude.JunkMail] Question on mailbox action...



I am not trying to re route the messages.  What I want to do is place the
email in a spam folder for each user if the message exceeds a certain
weight.  The mailbox action in declude would seem to do this.  I just want
to know if the folder will be created automatically using the mailbox 
action

if it does not already exist.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry
vanderzand
Sent: Tuesday, April 29, 2008 4:32 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Question on mailbox action...


It the mail box is [EMAIL PROTECTED]

And you say ROUTETO [EMAIL PROTECTED] THEN THE FOLDER SPAM GETS CREATED
AUTOMATICLY

Harry Vanderzand
NEW ADDRESS Effective Jan 24, 2008
Intown Internet
117 Ruskview Road
Kitchener, ON, N2M 4S1
519-741-1222


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Tuesday, April 29, 2008 5:36 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Question on mailbox action...


If I institute a mailbox action like 

WEIGHT10 MAILBOX spam

Will Imail automatically create the folder "spam" for the user if it does
not already exist?

Thanks

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.






---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Reasons to renew

[Ncl Admin]

 
Now there is a good question.


At 10:13 AM 4/2/2008 -0700, you wrote: 


After seeing Matt’s post here about not renewing his JunkMail
subscription. I’m asking Declude to respond to the group as to why any of
us with perpetual licensing. Our SA expires soon and I would like to know
the value of renewing.

 

The updates to Declude have been extremely slow and in some cases painful
since Scott sold out.

 

 

Any idea when ZEROHOUR will be available for use in %TESTSFAILED%

 

 

 

 

 

 

Kevin Bilbee
Network Administrator
Standard Abrasives

3M Simi Valley
[EMAIL PROTECTED]



 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] evaluating foreign spam

[Imail Admin]

Hi,

Lately, we've been getting a lot of stuff like this:

Received: from mail5.slik.com.ru [194.62.0.249] by mail2.bcwebhost.net with 
ESMTP
  (SMTPD-9.20) id ABB40398; Wed, 05 Mar 2008 09:43:16 -0800
Message-ID: <[EMAIL PROTECTED]>
From: =?koi8-r?B?7dXSwdfDxddh?= <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: SPAM 
[13]=?koi8-r?B?xMzRINDSz8bJzMHL1MnLySDJIMzF3sXOydEgzc7Px8nIINrBws/MxQ==?=
 =?koi8-r?B?18HOyco=?=
Date: Wed, 05 Mar 2008 15:54:03 +
MIME-Version: 1.0
Content-Type: multipart/related;
 type="multipart/alternative";
 boundary="=_NextPart_000_0007_01C87EE8.0451BBC1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.0 on 3/5/2008 9:47:33 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: SUBCHARS-50: Subject with at least 50 characters found.
X-RBL-Warning: SUBCHARS-55: Subject with at least 55 characters found.
X-RBL-Warning: SUBCHARS-60: Subject with at least 60 characters found.
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 61.
X-Declude-Sender: [EMAIL PROTECTED] [194.62.0.249]
X-Declude-Spoolname: Ddbb401e07908.smd
X-Declude-Note: Scanned by Declude 4.2.20 for spam. 
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [13] at 09:47:34 on 05 Mar 2008
X-Declude-Fail: NOABUSE [2], NOPOSTMASTER [1], SUBCHARS-50 [1], SUBCHARS-55 
[1], SUBCHARS-60 [1], SNIFFER [7], WEIGHT5 [5], WEIGHT10 [10], WEIGHT10r [10], 
WEIGHT7 [7], WEIGHT7r [7], ZEROHOUR [0] 
X-Country-Chain: [RIPE Unlisted]->destination

Where the body of the message is full of Russian.  

Is the best way to weight this stuff by country of origin?  If so, what kind of 
country tests do people typically use?   How severe is the CPU load on these 
kinds of tests?  For this particular message, it get blocked as spam, but some 
of these messages come through as clean and I'm trying to figure how to filter 
for them better.

Thanks,

Ben



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] why isn't this message deleted

[Imail Admin]

So, how do I add a mod to the subject line for all messages for a specific 
domain?  I mean, it would obviously be a setting in the junkmail file for that 
domain name, but I'm used to using weights to trigger such things, while for 
this case, I want it on all messages.

Thanks,

Ben
  - Original Message - 
  From: Darin Cox 
  To: declude.junkmail@declude.com 
  Sent: Tuesday, February 26, 2008 1:19 PM
  Subject: Re: [Declude.JunkMail] why isn't this message deleted


  I don't believe it will work that way for you.  Forwarded messages are not 
scanned twice, so I believe they are only processed as incoming.  As for 
changing the subject, that again would be done on the inbound filter for 
forwarded messages.

  As to the CPU question, the cost is the same for the same tests, inbound or 
outbound doesn't matter.

  Darin.


  - Original Message - 
  From: Imail Admin 
  To: declude.junkmail@declude.com 
  Sent: Monday, February 25, 2008 8:59 PM
  Subject: Re: [Declude.JunkMail] why isn't this message deleted


  Hi,

  Thanks, Darin.  We were putting the filter on outbound because we charge a 
little more for filtering on inbound service and they aren't paying for it.  Is 
there a cost in terms of CPU utilization if we filter on outbound?

  In general, I don't expect to hit legit messages on outbound.  We'll set the 
threshold pretty high and if the messages are coming from our clients (which 
should be the case except for forwarding), then they should never come close to 
the threshold.

  One question: is it possible to change the subject line for forwarded 
messages?  That would give our clients a heads-up where the messages are coming 
from.

  Thanks,

  Ben

- Original Message - 
From: Darin Cox 
To: declude.junkmail@declude.com 
Sent: Monday, February 25, 2008 3:34 PM
Subject: Re: [Declude.JunkMail] why isn't this message deleted


Yes, it will work.  However, I think you'll want the delete setting put on 
inbound messages rather than outbound.  In other words, do the scanning and 
actions on the inbound message to that account, before it is forwarded to the 
other account.  You'll also want to be careful that you're not deleting legit 
messages, so don't change a filter to delete unless you are sure.

Lastly, you'll want to get on AOL's postmaster feedback loop, if you aren't 
already.

Darin.


- Original Message - 
From: Imail Admin 
To: declude.junkmail@declude.com 
Sent: Monday, February 25, 2008 6:14 PM
Subject: [Declude.JunkMail] why isn't this message deleted


Hi,

We have Declude running with IMail 2006.23.  One of our clients has their 
mail box setup to forward to their AOL account.  The problem we have is that if 
they receive a message and mark it as spam, then AOL thinks the spam came from 
us and we risk being blocked.

I thought we were configured to scan and stop outgoing messages, but one of 
them got through today.  When I checked our global.cfg file, I found that all 
the triggers were set to "warn."  Is it just a matter of setting one of the 
triggers to "delete"?  And will this work with forwarded messages?

Thanks,

Ben


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 

  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 
  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] why isn't this message deleted

[Imail Admin]

Hi,

Thanks, Darin.  We were putting the filter on outbound because we charge a 
little more for filtering on inbound service and they aren't paying for it.  Is 
there a cost in terms of CPU utilization if we filter on outbound?

In general, I don't expect to hit legit messages on outbound.  We'll set the 
threshold pretty high and if the messages are coming from our clients (which 
should be the case except for forwarding), then they should never come close to 
the threshold.

One question: is it possible to change the subject line for forwarded messages? 
 That would give our clients a heads-up where the messages are coming from.

Thanks,

Ben

  - Original Message - 
  From: Darin Cox 
  To: declude.junkmail@declude.com 
  Sent: Monday, February 25, 2008 3:34 PM
  Subject: Re: [Declude.JunkMail] why isn't this message deleted


  Yes, it will work.  However, I think you'll want the delete setting put on 
inbound messages rather than outbound.  In other words, do the scanning and 
actions on the inbound message to that account, before it is forwarded to the 
other account.  You'll also want to be careful that you're not deleting legit 
messages, so don't change a filter to delete unless you are sure.

  Lastly, you'll want to get on AOL's postmaster feedback loop, if you aren't 
already.

  Darin.


  - Original Message - 
  From: Imail Admin 
  To: declude.junkmail@declude.com 
  Sent: Monday, February 25, 2008 6:14 PM
  Subject: [Declude.JunkMail] why isn't this message deleted


  Hi,

  We have Declude running with IMail 2006.23.  One of our clients has their 
mail box setup to forward to their AOL account.  The problem we have is that if 
they receive a message and mark it as spam, then AOL thinks the spam came from 
us and we risk being blocked.

  I thought we were configured to scan and stop outgoing messages, but one of 
them got through today.  When I checked our global.cfg file, I found that all 
the triggers were set to "warn."  Is it just a matter of setting one of the 
triggers to "delete"?  And will this work with forwarded messages?

  Thanks,

  Ben


  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 
  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type "unsubscribe Declude.JunkMail". The archives can be found
  at http://www.mail-archive.com. 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.