Re: [Declude.JunkMail] MAILFROM - correct?
Hi Andy, I believe it should be straightened out now. Skanska is a customer of ours. Someone there forgot to renew their domain, so it expired Friday morning. They quickly re-registered, but the damage was done for a day. I believe that's what caused the MAILFROM and HELOBOGUS errors we were receiving when sending to them. They've also had periodic problems managing their mail servers, however. Much of it is probably due to major internal IT restructuring (personnel, corporate identity, and merging of several separate infrastructures from mergers) that has been occurring within their organization for the past few months. We talk to their IT personnel periodically to help them straighten out these problems when they occur. Darin. - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 10:03 PM Subject: RE: [Declude.JunkMail] MAILFROM - correct? Hi Scott: Granted, based on http://www.dnsreport.com/tools/dnsreport.ch?domain=skanskausa.com this domain is a mess - but, it DOES have a MX record and the lowest priority MX record (5) has an "A" record and IS even answered. Most of the cc:'s in this email when to @skanskausa.com and WERE indeed delivered - proving that MAILFROM is valid. So, why did this fail MAILFROM: Received: from mlx-sku-par-1.skubi.com [12.3.242.12] by mail.webhost.hm-software.com with ESMTP (SMTPD32-7.07) id AC05147F0162; Fri, 30 May 2003 11:43:01 -0400 Received: from mlx-sku-par-1.skubi.com ([127.0.0.1]) by mlx-sku-par-1.skubi.com with Microsoft SMTPSVC(5.0.2195.5329); Fri, 30 May 2003 11:38:19 -0400 Received: by mlb-sku-par-1.skanskausa.com with Internet Mail Service (5.5.2653.19) id ; Fri, 30 May 2003 11:41:00 -0400 Message-ID: <[EMAIL PROTECTED]> From: ...removed... To: ...removed... Cc: ...removed..., ...removed... ...removed..., ...removed... ...removed..., ...removed... ...removed... Subject: MDY Date: Fri, 30 May 2003 11:42:01 -0400 Importance: high X-Priority: 1 Return-Receipt-To: [EMAIL PROTECTED]> MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/html; charset="iso-8859-1" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 30 May 2003 15:38:19.0640 (UTC) FILETIME=[7EEB4F80:01C326C1] X-Declude-Note: Domain mlx-sku-par-1.skubi.com has no MX or A records. X-Declude: Version 1.70i1; D7c05147f0162cb7b.SMD from gateway1.skubi.com [12.3.242.12] X-Declude: Triggered MAILFROM, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT [3] X-Countries: UNITED STATES->destination Return-Path: <[EMAIL PROTECTED]> X-Spam-Prob: 0.768622 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] PREWHITELIST Question
I thought that whitelisted IP addresses would not be scanned with PREWHITELIST ON. I am currently running: Diagnostics ON (Declude v1.70i1). Declude JunkMail Status: PRO version registered. Actually, for IPs, the PREWHITELIST ON setting will only work with individual IPs, not CIDR ranges. So in this case, the whitelisting would not take effect until after the tests were run. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MAILFROM - correct?
So, why did this fail MAILFROM: Return-Path: <[EMAIL PROTECTED]> Were there any non-alphanumeric characters in the "...removed..." section? For example, if it was "[EMAIL PROTECTED]@skanskausa.com" or "user:[EMAIL PROTECTED]" or "[EMAIL PROTECTED]", those could cause problems. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] PREWHITELIST Question
Scott, I have PREWHITELIST ON and WHITELIST IP 10.0.0.0/8 in my Global.cfg, but I am still seeing: == 05/30/2003 21:27:10 Q2f1b167300aa673e nNOLEGITCONTENT:-5 BODY-FILTER:20 SPAMCHECK:2 . Total weight = 17 05/30/2003 21:27:10 Q2f1b167300aa673e E-mail whitelisted - automatically passing all spam tests [10.0.0.0/8] 05/30/2003 21:27:10 Q2f1b167300aa673e R1 Message OK 05/30/2003 21:27:10 Q2f1b167300aa673e Subject: Re: Friday 05/30/2003 21:27:10 Q2f1b167300aa673e From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 10.2.68.1 ID: == I thought that whitelisted IP addresses would not be scanned with PREWHITELIST ON. I am currently running: Diagnostics ON (Declude v1.70i1). Declude JunkMail Status: PRO version registered. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MAILFROM - correct?
Hi Scott: Granted, based on http://www.dnsreport.com/tools/dnsreport.ch?domain=skanskausa.com this domain is a mess - but, it DOES have a MX record and the lowest priority MX record (5) has an "A" record and IS even answered. Most of the cc:'s in this email when to @skanskausa.com and WERE indeed delivered - proving that MAILFROM is valid. So, why did this fail MAILFROM: Received: from mlx-sku-par-1.skubi.com [12.3.242.12] by mail.webhost.hm-software.com with ESMTP (SMTPD32-7.07) id AC05147F0162; Fri, 30 May 2003 11:43:01 -0400 Received: from mlx-sku-par-1.skubi.com ([127.0.0.1]) by mlx-sku-par-1.skubi.com with Microsoft SMTPSVC(5.0.2195.5329); Fri, 30 May 2003 11:38:19 -0400 Received: by mlb-sku-par-1.skanskausa.com with Internet Mail Service (5.5.2653.19) id ; Fri, 30 May 2003 11:41:00 -0400 Message-ID: <[EMAIL PROTECTED]> From: ...removed... To: ...removed... Cc: ...removed..., ...removed... ...removed..., ...removed... ...removed..., ...removed... ...removed... Subject: MDY Date: Fri, 30 May 2003 11:42:01 -0400 Importance: high X-Priority: 1 Return-Receipt-To: [EMAIL PROTECTED]> MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/html; charset="iso-8859-1" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 30 May 2003 15:38:19.0640 (UTC) FILETIME=[7EEB4F80:01C326C1] X-Declude-Note: Domain mlx-sku-par-1.skubi.com has no MX or A records. X-Declude: Version 1.70i1; D7c05147f0162cb7b.SMD from gateway1.skubi.com [12.3.242.12] X-Declude: Triggered MAILFROM, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT [3] X-Countries: UNITED STATES->destination Return-Path: <[EMAIL PROTECTED]> X-Spam-Prob: 0.768622 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] updated spamdomains list
Rocketmail.com resolves to yahoo.com So: Rocketmail.com yahoo.com Would be a valid entry What about the following? Bigfoot.com Geocities.com Rocketmail.com Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.70 (beta) released
Excellent. Thanks Scott. I'm not too worried about mail TO that account. It will either not be a real account or will not be read. Outgoing only. --Todd. - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 7:59 AM Subject: Re: [Declude.JunkMail] Declude JunkMail v1.70 (beta) released > > >So I can set DOSENDERACTIONS ON in my global.cfg. In order to have a footer > >added to email sent from [EMAIL PROTECTED] but nobody else in the > >example.com domain, I would create a user1.junkmail file (we're using Pro) > >and put "CATCHALLMAILS FOOTER [This is my footer]"? > > Correct. > > Note that this would apply to both E-mail from [EMAIL PROTECTED], as well > as E-mail to [EMAIL PROTECTED] (there isn't any way around that). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] updated spamdomains list
What about the following? Bigfoot.com Geocities.com Rocketmail.com Wanadoo.fr Another question: Normaly if one of our new customers has a old ISP-specific email-Adress (for example [EMAIL PROTECTED]) we try to let configure an email-forwarding to the clients mailbox on our server. For this messages it's already difficult to make DNS-based tests, specialy if the old ISP forwards the message over 3-4 hops. (Require declude's hophigh set to 4-5) But if I understand right all this forwarded messages will fail also the SPAMDOMAINS test because the sending ISP usually hasn't the allowed string in his PTR record. Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill B. > Sent: Saturday, May 31, 2003 12:16 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] updated spamdomains list > > > Here is my updated list that we're using based on todays's > discussions and further review of our log data. Let me know > if anybody sees any errors or omissions. > > Would anybody like to expand on the Lycos domains? I know > they offer free email accounts at several of their > international domain names, however the RevDNS doesn't always > include ".lycos." > > Bill > > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
What if you had two lines: msn.com hotmail.com msn.com microsoft.com It would NOT fail if it reversed to either hotmail or ms, correct? Actually, it would fail in this case, since each line is processed separately from the rest. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] updated spamdomains list
Hi Bill, I think for GMX-mails (german freemailer) we can use the same solution as you have proposed for yahoo @gmx. .gmx. I've seen that there are a lot of country specific domains (gmx.it, .at, .de ...) resolving to the PTR-Records: 213.165.64.100 PTR record: mx0.gmx.net. [TTL 50222s] [A=213.165.64.100] 213.165.64.100 PTR record: mx0.gmx.de. [TTL 50222s] [A=213.165.64.100] Other gmx-domains (gmx.net, ...) have the PTR records: 213.165.64.20 PTR record: mail.gmx.net. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: mail.gmx.de. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: pop.gmx.net. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: pop.gmx.de. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: imap.gmx.net. [TTL 86400s] [A=213.165.64.20] Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill B. > Sent: Saturday, May 31, 2003 12:16 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] updated spamdomains list > > > Here is my updated list that we're using based on todays's > discussions and further review of our log data. Let me know > if anybody sees any errors or omissions. > > Would anybody like to expand on the Lycos domains? I know > they offer free email accounts at several of their > international domain names, however the RevDNS doesn't always > include ".lycos." > > Bill > > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
What if you had two lines: msn.com hotmail.com msn.com microsoft.com It would NOT fail if it reversed to either hotmail or ms, correct? Friday, May 30, 2003, 4:36:14 PM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >> > Msg failed SPAMDOMAINS (Spamdomain 'microsoft.com' found: Address of >> > [EMAIL PROTECTED] >> > sent from invalid [No Reverse DNS].). Action=WARN. >> > Are you running the latest beta (1.70)? From the release notes, a REVDNS >>timeout sould not cause SPAMDOMAINS to fail... >>Thanks, you understand my issue. RSP> The problem here is that there is no reverse DNS entry (not a RSP> timeout). Microsoft has specifically stated that the IP address of their RSP> mailserver has no host name (as opposed to a timeout, where they *may* say RSP> that it has a host name, but we don't know for sure one way or the other). RSP> In this case, where there definitely is no reverse DNS entry, the RSP> SPAMDOMAINS test will fail (by design). I would recommend not having the RSP> "microsoft.com msn.com" line in the SPAMDOMAINS test file, as it requires RSP> any E-mail from @microsoft.com (or @*.microsoft.com) to have a valid RSP> reverse DNS entry. It seems that many Microsoft mailservers do not have a RSP> reverse DNS entry. RSP> "msn.com microsoft.com" would work better, as it would only apply to RSP> msn.com E-mail. RSP> -Scott RSP> --- RSP> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. RSP> Declude Virus: Catches known viruses and is the leader in mailserver RSP> vulnerability detection. RSP> Find out what you have been missing: Ask for a free 30-day evaluation. RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP> --- RSP> This E-mail came from the Declude.JunkMail mailing list. To RSP> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP> type "unsubscribe Declude.JunkMail". The archives can be found RSP> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] updated spamdomains list
Here is my updated list that we're using based on todays's discussions and further review of our log data. Let me know if anybody sees any errors or omissions. Would anybody like to expand on the Lycos domains? I know they offer free email accounts at several of their international domain names, however the RevDNS doesn't always include ".lycos." Bill sd.zip Description: Zip archive
Re: [Declude.JunkMail] spamdomains list
Yes 1.70. Thanks, you understand my issue. Fred - Original Message - From: "Bill B." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 4:40 PM Subject: Re: [Declude.JunkMail] spamdomains list > Are you running the latest beta (1.70)? From the release notes, a REVDNS timeout sould not cause SPAMDOMAINS to fail... > > - SPAMDOMAINS test will now not get triggered if reverse DNS times out > > Bill > > > -Original Message- > From: "Frederick Samarelli" > Sent: Fri, 30 May 2003 15:49:30 -0400 > Subject: Re: [Declude.JunkMail] spamdomains list > > > John, > > In your list you your have: microsoft.com msn.com > > How can we prevent this from happening. This is a good MS email but failed > the test. > > Msg failed SPAMDOMAINS (Spamdomain 'microsoft.com' found: Address of > [EMAIL PROTECTED] > sent from invalid [No Reverse DNS].). Action=WARN. > > - Original Message - > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, May 30, 2003 3:15 PM > Subject: RE: [Declude.JunkMail] spamdomains list > > > > > > If someone has a comprehensive spamdomains listing they are happy > > > > with,could they post it for others to analyze/use? > > > > > >Uh, see the orginal post that started this thread. > > > > I would, except the list archives are still down. > > Would not be in the archives even if they were up. This thread was started > at about 7:40 this morning (PDT), and if you received the follow-up post you > would also have received the orginal post by Bill B. > > Attached is the file that Bill sent to this list at 7:40 THIS morning. (PDT) > (About 4 1/2 hours ago.) > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Wordfilter
When I see the following in a message header: X-RBL-Warning: WORDFILTER: Message failed WORDFILTER test (294) Do I assume that this means the message failed the filter on line 294 of my wordfilter file? That is correct. I am seeing multiple messages fail wordfilter, showing line 294, however the contents of my wordfilter file's line 294 appears nowhere in the message. Just in case, I checked lines 293 and 295 as well, with no luck. Does line 294 have any high bit characters in it? If so, you should upgrade to v1.70, which allows high bit characters (otherwise, they will terminate the line). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
> Msg failed SPAMDOMAINS (Spamdomain 'microsoft.com' found: Address of > [EMAIL PROTECTED] > sent from invalid [No Reverse DNS].). Action=WARN. > Are you running the latest beta (1.70)? From the release notes, a REVDNS timeout sould not cause SPAMDOMAINS to fail... Thanks, you understand my issue. The problem here is that there is no reverse DNS entry (not a timeout). Microsoft has specifically stated that the IP address of their mailserver has no host name (as opposed to a timeout, where they *may* say that it has a host name, but we don't know for sure one way or the other). In this case, where there definitely is no reverse DNS entry, the SPAMDOMAINS test will fail (by design). I would recommend not having the "microsoft.com msn.com" line in the SPAMDOMAINS test file, as it requires any E-mail from @microsoft.com (or @*.microsoft.com) to have a valid reverse DNS entry. It seems that many Microsoft mailservers do not have a reverse DNS entry. "msn.com microsoft.com" would work better, as it would only apply to msn.com E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Thanks for the heads-up, Andy, I'll check it out... Bill - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 1:38 PM Subject: RE: [Declude.JunkMail] spamdomains list > Bill, > > MX records only tell you where email is SENT to. It doesn't tell you > anything about OUTBOUND mail. > > I have in fact received emails where signed @excite.com but where sent > through the excitenetwork's server. > > The only way how you can determine, which other RDNS are used, is by > checking your Declude log files, use FILESTR to find the SPAMDOMAINS > failures and then filter for "excite"... > > Best Regards > Andy > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Friday, May 30, 2003 03:04 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] spamdomains list > > > >From what I see, they look to be mutually exclusive: > == > dig mx excite.com > > ; <<>> DiG 9.2.1 <<>> mx excite.com > ;; global options: printcmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15919 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 > > ;; QUESTION SECTION: > ;excite.com.IN MX > > ;; ANSWER SECTION: > excite.com. 900 IN MX 10 xmxpita.excite.com. > > ;; AUTHORITY SECTION: > excite.com. 900 IN NS dns5.imgfarm.com. > excite.com. 900 IN NS dns4.imgfarm.com. > > ;; ADDITIONAL SECTION: > xmxpita.excite.com. 900 IN A 208.45.133.107 > > ;; Query time: 81 msec > ;; SERVER: 204.189.38.2#53(204.189.38.2) > ;; WHEN: Fri May 30 11:50:28 2003 > ;; MSG SIZE rcvd: 114 > == > dig mx excitenetwork.com > > ; <<>> DiG 9.2.1 <<>> mx excitenetwork.com > ;; global options: printcmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2577 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 > > ;; QUESTION SECTION: > ;excitenetwork.com. IN MX > > ;; ANSWER SECTION: > excitenetwork.com. 300 IN MX 25 mx.excitenetwork.com. > > ;; AUTHORITY SECTION: > excitenetwork.com. 300 IN NS dns5.imgfarm.com. > excitenetwork.com. 300 IN NS dns4.imgfarm.com. > > ;; ADDITIONAL SECTION: > mx.excitenetwork.com. 300 IN A 63.108.110.20 > > ;; Query time: 121 msec > ;; SERVER: 204.189.38.2#53(204.189.38.2) > ;; WHEN: Fri May 30 11:51:56 2003 > ;; MSG SIZE rcvd: 116 > == > > Bill > > - Original Message - > From: "Andy Schmidt" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, May 30, 2003 11:45 AM > Subject: RE: [Declude.JunkMail] spamdomains list > > > > Bill, > > > > You need to update: > > > > excite.com excitenetwork.com > > > > Best Regards > > Andy Schmidt > > > > H&M Systems Software, Inc. > > 600 East Crescent Avenue, Suite 203 > > Upper Saddle River, NJ 07458-1846 > > > > Phone: +1 201 934-3414 x20 (Business) > > Fax:+1 201 934-9206 > > > > http://www.HM-Software.com/ > > > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry > > Sent: Friday, May 30, 2003 01:16 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] spamdomains list > > > > > > Here is my list thus far: > > > > amazon.com > > aol.com > > apple.com > > att. > > attbi.com > > bellsouth.net > > charter.net > > comcast. > > compuserve.com > > cox. > > earthlink. > > excite.com > > gte. > > hotmail.com > > juno.com .untd.com > > lycos.com > > microsoft.com > > mindspring. > > msn.com .hotmail.com > > netscape. > > psi. > > qwest. > > .rr.com > > verio. > > verizon. .bellatlantic. > > yahoo.com > > > > Bill > > - Original Message - > > From: "Scott MacLean" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Friday, May 30, 2003 9:49 AM > > Subject: Re: [Declude.JunkMail] spamdomains list > > > > > > > If someone has a comprehensive spamdomains listing they are happy > > > with,could they post it for others to analyze/use? > > > > > > At 10:36 AM 5/30/2003, Bill Landry wrote: > > > > > > >One comment. Instead of having: > > > > > > > >yahoo.com > > > >yahoo.ca yahoo.com > > > >yahoo.de yahoo.com > > > >yahoo.dk yahoo.com > > > >yahoo.es yahoo.com > > > >yahoo.fr yahoo.com > > > >yahoo.it yahoo.com > > > >yahoo.no yahoo.com > > > >yahoo.se yahoo.com > > > >yahoo.co.jp yahoo.com > > > >yahoo.co.uk yahoo.com > > > >yahoo.com.ar yahoo.com > > > >yahoo.com.au yahoo.com > > > >yahoo.com.br yahoo.com > > > >yahoo.com.cn yahoo.com > > > >yahoo.com.hk yahoo.com > > > >yahoo.co.kr yahoo.com > > > >yahoo.com.mx yahoo.com > > > >yahoo.com.tw yahoo.com > > > > > > > >Why not just consolidate this down to: > > > > > > > >yahoo.yahoo.com > > > > > > > >Bill > > > >- Original Message - > > > >From: "Bill B." <[EMAIL PROTECTED]> > > > >To: <[EMAIL
RE: [Declude.JunkMail] spamdomains list
Hi Frederick: A HUGE amount of spam is created with Yahoo.com and similar accounts as a fake (or real) return address domain. But almost never do these Spams actually get sent from a Yahoo.com SMTP server. So - a test that compares sender domain with sender server can be used in a weighting scheme to identify "suspect" senders. If other factors are added (e.g., no reverse DNS, sending mail server is an open relay, etc.) then there is a good likelihood that it is SPAM. If the sending mail server appears otherwise "legit" then the email may just be from a Yahoo user who is sending email through your ISP's smtp server. I have been using the SPAMDOMAINS quite successfully - but I'm limiting myself just to the most frequently used/faked sender domains. Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Friday, May 30, 2003 04:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] spamdomains list Sorry John. I am questioning the validity of the test more then I am questioning you. Fred - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 4:16 PM Subject: RE: [Declude.JunkMail] spamdomains list > > John, > > > > In your list you your have: microsoft.com msn.com > > Urgh, I can't win. It is not my list. Please people, read the entire > post. (Yes, I myself am guilty at times, so first admonishment is to > me.) > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Are you running the latest beta (1.70)? From the release notes, a REVDNS timeout sould not cause SPAMDOMAINS to fail... - SPAMDOMAINS test will now not get triggered if reverse DNS times out Bill -Original Message- From: "Frederick Samarelli" Sent: Fri, 30 May 2003 15:49:30 -0400 Subject: Re: [Declude.JunkMail] spamdomains list John, In your list you your have: microsoft.com msn.com How can we prevent this from happening. This is a good MS email but failed the test. Msg failed SPAMDOMAINS (Spamdomain 'microsoft.com' found: Address of [EMAIL PROTECTED] sent from invalid [No Reverse DNS].). Action=WARN. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 3:15 PM Subject: RE: [Declude.JunkMail] spamdomains list > > > If someone has a comprehensive spamdomains listing they are happy > > > with,could they post it for others to analyze/use? > > > >Uh, see the orginal post that started this thread. > > I would, except the list archives are still down. Would not be in the archives even if they were up. This thread was started at about 7:40 this morning (PDT), and if you received the follow-up post you would also have received the orginal post by Bill B. Attached is the file that Bill sent to this list at 7:40 THIS morning. (PDT) (About 4 1/2 hours ago.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] New Variable Question ?
> This works and we have set this up now however, this setup adds a > number of extra x-headers... Further to Chuck's comment on this, can you post the WEIGHTRANGE lines from your .CFG? By definition, you can't fail mutually exclusive WEIGHTRANGE tests. -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
> Sorry John. > > I am questioning the validity of the test more then I am questioning you. SOK. It has been a long week. I have got like zilch done today because half the time I can not think. I think (Ouch) it is time to go back to sleep. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Wordfilter
When I see the following in a message header: X-RBL-Warning: WORDFILTER: Message failed WORDFILTER test (294) Do I assume that this means the message failed the filter on line 294 of my wordfilter file? Or is there another way to identify just which filter it failed? I am seeing multiple messages fail wordfilter, showing line 294, however the contents of my wordfilter file's line 294 appears nowhere in the message. Just in case, I checked lines 293 and 295 as well, with no luck. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
Bill, MX records only tell you where email is SENT to. It doesn't tell you anything about OUTBOUND mail. I have in fact received emails where signed @excite.com but where sent through the excitenetwork's server. The only way how you can determine, which other RDNS are used, is by checking your Declude log files, use FILESTR to find the SPAMDOMAINS failures and then filter for "excite"... Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Friday, May 30, 2003 03:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] spamdomains list >From what I see, they look to be mutually exclusive: == dig mx excite.com ; <<>> DiG 9.2.1 <<>> mx excite.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15919 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;excite.com.IN MX ;; ANSWER SECTION: excite.com. 900 IN MX 10 xmxpita.excite.com. ;; AUTHORITY SECTION: excite.com. 900 IN NS dns5.imgfarm.com. excite.com. 900 IN NS dns4.imgfarm.com. ;; ADDITIONAL SECTION: xmxpita.excite.com. 900 IN A 208.45.133.107 ;; Query time: 81 msec ;; SERVER: 204.189.38.2#53(204.189.38.2) ;; WHEN: Fri May 30 11:50:28 2003 ;; MSG SIZE rcvd: 114 == dig mx excitenetwork.com ; <<>> DiG 9.2.1 <<>> mx excitenetwork.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2577 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;excitenetwork.com. IN MX ;; ANSWER SECTION: excitenetwork.com. 300 IN MX 25 mx.excitenetwork.com. ;; AUTHORITY SECTION: excitenetwork.com. 300 IN NS dns5.imgfarm.com. excitenetwork.com. 300 IN NS dns4.imgfarm.com. ;; ADDITIONAL SECTION: mx.excitenetwork.com. 300 IN A 63.108.110.20 ;; Query time: 121 msec ;; SERVER: 204.189.38.2#53(204.189.38.2) ;; WHEN: Fri May 30 11:51:56 2003 ;; MSG SIZE rcvd: 116 == Bill - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 11:45 AM Subject: RE: [Declude.JunkMail] spamdomains list > Bill, > > You need to update: > > excite.com excitenetwork.com > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue, Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.HM-Software.com/ > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Friday, May 30, 2003 01:16 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] spamdomains list > > > Here is my list thus far: > > amazon.com > aol.com > apple.com > att. > attbi.com > bellsouth.net > charter.net > comcast. > compuserve.com > cox. > earthlink. > excite.com > gte. > hotmail.com > juno.com .untd.com > lycos.com > microsoft.com > mindspring. > msn.com .hotmail.com > netscape. > psi. > qwest. > .rr.com > verio. > verizon. .bellatlantic. > yahoo.com > > Bill > - Original Message - > From: "Scott MacLean" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, May 30, 2003 9:49 AM > Subject: Re: [Declude.JunkMail] spamdomains list > > > > If someone has a comprehensive spamdomains listing they are happy > > with,could they post it for others to analyze/use? > > > > At 10:36 AM 5/30/2003, Bill Landry wrote: > > > > >One comment. Instead of having: > > > > > >yahoo.com > > >yahoo.ca yahoo.com > > >yahoo.de yahoo.com > > >yahoo.dk yahoo.com > > >yahoo.es yahoo.com > > >yahoo.fr yahoo.com > > >yahoo.it yahoo.com > > >yahoo.no yahoo.com > > >yahoo.se yahoo.com > > >yahoo.co.jp yahoo.com > > >yahoo.co.uk yahoo.com > > >yahoo.com.ar yahoo.com > > >yahoo.com.au yahoo.com > > >yahoo.com.br yahoo.com > > >yahoo.com.cn yahoo.com > > >yahoo.com.hk yahoo.com > > >yahoo.co.kr yahoo.com > > >yahoo.com.mx yahoo.com > > >yahoo.com.tw yahoo.com > > > > > >Why not just consolidate this down to: > > > > > >yahoo.yahoo.com > > > > > >Bill > > >- Original Message - > > >From: "Bill B." <[EMAIL PROTECTED]> > > >To: <[EMAIL PROTECTED]> > > >Sent: Friday, May 30, 2003 7:20 AM > > >Subject: [Declude.JunkMail] spamdomains list > > > > > > > > > > Attached is a list of spamdomains and their coresponding aliases > > > > that > I've > > >compiled thus far. Anybody want to comment or expand upon this? > > > > > > > > Bill > > > > > > > > > > > > > > > > > > > > > >--- > > >[This E-mail was scanned for viruses by Declude Virus > > >(http://www.declude.com)] > > > > > >--- > > >This E-mail came from the Declude.JunkMail mailing list. To > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and typ
Re: [Declude.JunkMail] spamdomains list
Sorry John. I am questioning the validity of the test more then I am questioning you. Fred - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 4:16 PM Subject: RE: [Declude.JunkMail] spamdomains list > > John, > > > > In your list you your have: microsoft.com msn.com > > Urgh, I can't win. It is not my list. Please people, read the entire post. > (Yes, I myself am guilty at times, so first admonishment is to me.) > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
> John, > > In your list you your have: microsoft.com msn.com Urgh, I can't win. It is not my list. Please people, read the entire post. (Yes, I myself am guilty at times, so first admonishment is to me.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is wishlist still accepting entries?
Title: Message Scott: Just a suggestion... I really think that we should keep any dynamic entries out of the Global statement. Global should be a file that changes only when one wants to make changes to the engine or adding functionality. It is simply like a .ini file that controls the engine. Currently there is one that I am confused as to why it belong to Global.cfg. WHITELIST HELO As one wants to add to these entries one has to work constantly with Global file. If this was like a filter file one could make the changes in a database and simply update these files dynamically. Right now these entries being in the Global makes it real hard. Is it a possibility to move any such action and make them a filter type entry so simply the address of the file is located in the global. Regards, Kami
Re: [Declude.JunkMail] spamdomains list
John, In your list you your have: microsoft.com msn.com How can we prevent this from happening. This is a good MS email but failed the test. Msg failed SPAMDOMAINS (Spamdomain 'microsoft.com' found: Address of [EMAIL PROTECTED] sent from invalid [No Reverse DNS].). Action=WARN. - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 3:15 PM Subject: RE: [Declude.JunkMail] spamdomains list > > > If someone has a comprehensive spamdomains listing they are happy > > > with,could they post it for others to analyze/use? > > > >Uh, see the orginal post that started this thread. > > I would, except the list archives are still down. Would not be in the archives even if they were up. This thread was started at about 7:40 this morning (PDT), and if you received the follow-up post you would also have received the orginal post by Bill B. Attached is the file that Bill sent to this list at 7:40 THIS morning. (PDT) (About 4 1/2 hours ago.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Ok, that makes sense. It might be benefitial if Declude were to strip the @ symbol when doing the revdns comparison. That would allow the @mail.com entry to match any revdns that has "mail.com" or "outblaze.com" in it. Bill -Original Message- From: "R. Scott Perry" Sent: Fri, 30 May 2003 14:53:24 -0400 Subject: Re: [Declude.JunkMail] spamdomains list >How about this?...is this format allowed in order to prevent >"anythingmail.com" and "ihateyahoo.com" from matching: > >@mail.comoutblaze.com >@yahoo. Since reverse DNS entries won't have an "@" in them, only the first one would work, and would require that mail from @mail.com have a reverse DNS entry that includes "outblaze.com" in it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
> > Does this mean if the address comes in as [EMAIL PROTECTED] - it's > > rev DNS can be either earthlink.net or earthlink.com ??? and the other > > way around if it's [EMAIL PROTECTED] - ? > > Exactly. Scott added this in 1.70. Ah ok, that makes more sense to me now, and glad I was correct on the thinking. > Netscape is owned by AOL, and f you send an email from a free netscape.net address it uses an AOL mail server. I included both variations since they are the same company. I did not know that! Where the heck have I been? =) Thanks! That makes that simple enough. I haven't gone to 1.70 yet. Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] helobogus
X-RBL-Warning: HELOBOGUS: Domain fr_ru1_exch_01.azlan.fr has no MX or A records. Did this fail the hellobogus because they used host name instead of domain name (azlan.fr does have mx) ? No. It failed the HELOBOGUS test because their mailserver claimed to be a host named fr_ru1_exch_01.azlan.fr. However, fr_ru1_exch_01.azlan.fr isn't an Internet host name (it doesn't exist). They can use whatever they want, just so long as it is a real host name or domain name (it needs to have either an A or MX record). how can i correct this ? By adding an A record for fr_ru1_exch_01.azlan.fr. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] helobogus
X-RBL-Warning: HELOBOGUS: Domain fr_ru1_exch_01.azlan.fr has no MX or A records. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 81.80.195.20 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of 10. X-Spam-Tests-Failed: HELOBOGUS, REVDNS, WEIGHT10 Did this fail the hellobogus because they used host name instead of domain name (azlan.fr does have mx) ? how can i correct this ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
> > > If someone has a comprehensive spamdomains listing they are happy > > > with,could they post it for others to analyze/use? > > > >Uh, see the orginal post that started this thread. > > I would, except the list archives are still down. Would not be in the archives even if they were up. This thread was started at about 7:40 this morning (PDT), and if you received the follow-up post you would also have received the orginal post by Bill B. Attached is the file that Bill sent to this list at 7:40 THIS morning. (PDT) (About 4 1/2 hours ago.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com sd.zip Description: Zip compressed data
Re: [Declude.JunkMail] spamdomains list
However, you could use something like: @mail.comoutblaze.com @yahoo..yahoo. Bill - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 11:53 AM Subject: Re: [Declude.JunkMail] spamdomains list > > >How about this?...is this format allowed in order to prevent > >"anythingmail.com" and "ihateyahoo.com" from matching: > > > >@mail.comoutblaze.com > >@yahoo. > > Since reverse DNS entries won't have an "@" in them, only the first one > would work, and would require that mail from @mail.com have a reverse DNS > entry that includes "outblaze.com" in it. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
>From what I see, they look to be mutually exclusive: == dig mx excite.com ; <<>> DiG 9.2.1 <<>> mx excite.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15919 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;excite.com.IN MX ;; ANSWER SECTION: excite.com. 900 IN MX 10 xmxpita.excite.com. ;; AUTHORITY SECTION: excite.com. 900 IN NS dns5.imgfarm.com. excite.com. 900 IN NS dns4.imgfarm.com. ;; ADDITIONAL SECTION: xmxpita.excite.com. 900 IN A 208.45.133.107 ;; Query time: 81 msec ;; SERVER: 204.189.38.2#53(204.189.38.2) ;; WHEN: Fri May 30 11:50:28 2003 ;; MSG SIZE rcvd: 114 == dig mx excitenetwork.com ; <<>> DiG 9.2.1 <<>> mx excitenetwork.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2577 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;excitenetwork.com. IN MX ;; ANSWER SECTION: excitenetwork.com. 300 IN MX 25 mx.excitenetwork.com. ;; AUTHORITY SECTION: excitenetwork.com. 300 IN NS dns5.imgfarm.com. excitenetwork.com. 300 IN NS dns4.imgfarm.com. ;; ADDITIONAL SECTION: mx.excitenetwork.com. 300 IN A 63.108.110.20 ;; Query time: 121 msec ;; SERVER: 204.189.38.2#53(204.189.38.2) ;; WHEN: Fri May 30 11:51:56 2003 ;; MSG SIZE rcvd: 116 == Bill - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 11:45 AM Subject: RE: [Declude.JunkMail] spamdomains list > Bill, > > You need to update: > > excite.com excitenetwork.com > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue, Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.HM-Software.com/ > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Friday, May 30, 2003 01:16 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] spamdomains list > > > Here is my list thus far: > > amazon.com > aol.com > apple.com > att. > attbi.com > bellsouth.net > charter.net > comcast. > compuserve.com > cox. > earthlink. > excite.com > gte. > hotmail.com > juno.com .untd.com > lycos.com > microsoft.com > mindspring. > msn.com .hotmail.com > netscape. > psi. > qwest. > .rr.com > verio. > verizon. .bellatlantic. > yahoo.com > > Bill > - Original Message - > From: "Scott MacLean" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, May 30, 2003 9:49 AM > Subject: Re: [Declude.JunkMail] spamdomains list > > > > If someone has a comprehensive spamdomains listing they are happy > > with,could they post it for others to analyze/use? > > > > At 10:36 AM 5/30/2003, Bill Landry wrote: > > > > >One comment. Instead of having: > > > > > >yahoo.com > > >yahoo.ca yahoo.com > > >yahoo.de yahoo.com > > >yahoo.dk yahoo.com > > >yahoo.es yahoo.com > > >yahoo.fr yahoo.com > > >yahoo.it yahoo.com > > >yahoo.no yahoo.com > > >yahoo.se yahoo.com > > >yahoo.co.jp yahoo.com > > >yahoo.co.uk yahoo.com > > >yahoo.com.ar yahoo.com > > >yahoo.com.au yahoo.com > > >yahoo.com.br yahoo.com > > >yahoo.com.cn yahoo.com > > >yahoo.com.hk yahoo.com > > >yahoo.co.kr yahoo.com > > >yahoo.com.mx yahoo.com > > >yahoo.com.tw yahoo.com > > > > > >Why not just consolidate this down to: > > > > > >yahoo.yahoo.com > > > > > >Bill > > >- Original Message - > > >From: "Bill B." <[EMAIL PROTECTED]> > > >To: <[EMAIL PROTECTED]> > > >Sent: Friday, May 30, 2003 7:20 AM > > >Subject: [Declude.JunkMail] spamdomains list > > > > > > > > > > Attached is a list of spamdomains and their coresponding aliases > > > > that > I've > > >compiled thus far. Anybody want to comment or expand upon this? > > > > > > > > Bill > > > > > > > > > > > > > > > > > > > > > >--- > > >[This E-mail was scanned for viruses by Declude Virus > > >(http://www.declude.com)] > > > > > >--- > > >This E-mail came from the Declude.JunkMail mailing list. To > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > >"unsubscribe Declude.JunkMail". The archives can be found at > > >http://www.mail-archive.com. > > > > ___ > > Scott MacLean > > [EMAIL PROTECTED] > > ICQ: 9184011 > > http://www.nerosoft.com > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus >
RE: [Declude.JunkMail] What folder should my per user settings be in.
Thanks for your help, worked perfectly, had to mess with my activate script a bit, but works great now. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Friday, May 30, 2003 12:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] What folder should my per user settings be in. >I need a little help, I can't seem to figure out what folder under declude I >should be putting my per user settings for this one domain. That depends on the type of E-mail: [1] Standard E-mail addressed to a user account: In this case, you need to use the Official (in the IMail settings) name of the domain (not a host alias). [2] Standard E-mail addressed to an alias: In this case, you need to use the domain that is used in the target address. >My problem child is virus.netamumail.com, it is \IMail\hosts\virusnetamumail >in imail, what should it be in the declude folder? If the Official name of the domain is "virus.netamumail.com", you would use a directory \IMail\Declude\virus.netamumail.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Variable Question ?
If you set it up right, it will only add one, since the message weight will only set off one of the weight tests as defined. I only get one. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, May 30, 2003 12:49 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] New Variable Question ? This works and we have set this up now however, this setup adds a number of extra x-headers which is what I'm looking to eliminate. Even more extra headers. Stu At 12:09 PM 05/30/2003 -0500, you wrote: >I use weightrange to define 6 distinct levels of spam (the last one >actually is just weight so anything over is caught). Then all I do is >add a header X-SPAM-Level: TESTNAME. End result is what you are asking >for, just use stars instead of TESTNAME. > >Global.cfg > >SPAM-NONE weightrange x x 0 4 >SPAM-VLOW weightrange x x 5 9 >SPAM-LOW weightrange x x 10 14 >SPAM-MID weightrange x x 15 19 >SPAM-HIGH weightrange x x 20 29 >SPAM-VHIGH weight x x 30 0 > >$default$.junkmail > >SPAM-NONE WARN X-SPAM-Level: %TESTNAME% >SPAM-VLOW WARN X-SPAM-Level: %TESTNAME% >SPAM-LOW WARN X-SPAM-Level: %TESTNAME% >SPAM-MID WARN X-SPAM-Level: %TESTNAME% >SPAM-HIGH WARN X-SPAM-Level: %TESTNAME% >SPAM-VHIGH WARN X-SPAM-Level: %TESTNAME% > >Thanks, >Chuck Frolick >ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
How about this?...is this format allowed in order to prevent "anythingmail.com" and "ihateyahoo.com" from matching: @mail.comoutblaze.com @yahoo. Bill -Original Message- From: "R. Scott Perry" Sent: Fri, 30 May 2003 14:06:11 -0400 Subject: Re: [Declude.JunkMail] spamdomains list >Ah, so I assume a line like this could cause problems then because it >would required that "anythingmail.com" must have either mail.com or >outblaze.com in their REVDNS. Is that correct? > >mail.comoutblaze.com Correct. However, the potential problems with this are minimal, because if the mailserver for "anythingmail.com" has a reverse DNS entry pointing back to "*.anythingmail.com", it won't fail the test. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
How about this?...is this format allowed in order to prevent "anythingmail.com" and "ihateyahoo.com" from matching: @mail.comoutblaze.com @yahoo. Since reverse DNS entries won't have an "@" in them, only the first one would work, and would require that mail from @mail.com have a reverse DNS entry that includes "outblaze.com" in it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
Bill, You need to update: excite.com excitenetwork.com Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
I am curious... Would Yahoo. Not cover yahoo.com? I guess one should just put yahoo. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, May 30, 2003 1:27 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] spamdomains list >I was under the impression that the spamdomains list could not include >partial domains, such as "yahoo.". Scott, could you help out on this >one?...are partial domain entries like this allowed? > >yahoo.yahoo.com This will work fine. For the SPAMDOMAINS test, you can have *anything* you want. So with a line "yahoo. yahoo.com", any E-mail with a return address that includes "yahoo." in it would need to have a reverse DNS entry that contains either "yahoo." or "yahoo.com". -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
At 01:36 PM 5/30/2003, John Tolmachoff \(Lists\) wrote: > If someone has a comprehensive spamdomains listing they are happy > with,could they post it for others to analyze/use? Uh, see the orginal post that started this thread. I would, except the list archives are still down. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
I am curious... Would Yahoo. Not cover yahoo.com? Yes, it would. I guess one should just put yahoo. That would work, too. A line with just "yahoo." would require that any E-mail with a return address at *yahoo.* to have a reverse DNS entry that includes *yahoo.*. That would include "[EMAIL PROTECTED]", "[EMAIL PROTECTED]", "[EMAIL PROTECTED]", etc. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
OK I am having trouble with the spam domains test. I just can not get my brain to wrap it. Could someone try to give a concise detailed explanation??? Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bill B. > Sent: Friday, May 30, 2003 7:20 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] spamdomains list > > > Attached is a list of spamdomains and their coresponding aliases > that I've compiled thus far. Anybody want to comment or expand upon this? > > Bill > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] re: Hold messages
I have found it very time consuming to go throught the held messages and look for false positives. So I have decided to enlist the help of all of my users. I am writing software the once a day will go throught the hold folder and send an email to any user that has a message in the hold floder format something like this: Hold Count: 1 Click the recover link if you would like to have the message delivered From: [EMAIL PROTECTED] Subject: Subject: [ SPAM 25 ]d i s c o u n t vi@ g r a Recover: http://mail.standardabrasives.com/?06a026b800408f50 The link would then go the the mail server and move the held mail to the spool automatically and display an appropriate message. Any undelivered messages are only held on the server for 14 days and then permanatly deleted. Also if the user recovers a message an email will be sent to the postmaster stating that a message was recovered and supplying the message in text form with the headers. This will allow me to the analyze why the message was held and possably configure Declude to not hold thoes messages anymore or contact the mail server admin to fix there server. Does any on have any thoughts or suggestions??? What parameters would you want to be configurable? At this point I can process about 1000 held messages in about 10 seconds. I have not written the recover portion yet? Kevin Bilbee Network Administrator Standard Abrasives, Inc. Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] base64 false-positive
I second that. I have messages with a bosy and a base 64 attachment that reguraly fail the base64 test. I also have found that email from our china customers are base64 encoded and they regurarly fail the base64 test. I have it at a low weight. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bill B. > Sent: Friday, May 30, 2003 7:07 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] base64 false-positive > > > Scott, > > Emails with a message body that just contains blank lines and > that contains an attachment, are still failing the BASE64 test. > > Attached is a sample. > > Bill > > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Yes. but you should be able to put in .mail.com outblaze.com Jason - Original Message - From: "Bill B." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 12:53 PM Subject: Re: [Declude.JunkMail] spamdomains list > Ah, so I assume a line like this could cause problems then because it would required that "anythingmail.com" must have either mail.com or outblaze.com in their REVDNS. Is that correct? > > mail.com outblaze.com > > > Bill > > > -Original Message- > From: "R. Scott Perry" > Sent: Fri, 30 May 2003 13:27:24 -0400 > Subject: Re: [Declude.JunkMail] spamdomains list > > > > >I was under the impression that the spamdomains list could not include > >partial domains, such as "yahoo.". Scott, could you help out on this > >one?...are partial domain entries like this allowed? > > > >yahoo.yahoo.com > > This will work fine. > > For the SPAMDOMAINS test, you can have *anything* you want. So with a line > "yahoo. yahoo.com", any E-mail with a return address that includes > "yahoo." in it would need to have a reverse DNS entry that contains either > "yahoo." or "yahoo.com". > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Ah, so I assume a line like this could cause problems then because it would required that "anythingmail.com" must have either mail.com or outblaze.com in their REVDNS. Is that correct? mail.comoutblaze.com Correct. However, the potential problems with this are minimal, because if the mailserver for "anythingmail.com" has a reverse DNS entry pointing back to "*.anythingmail.com", it won't fail the test. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Here is my list thus far: amazon.com aol.com apple.com att. attbi.com bellsouth.net charter.net comcast. compuserve.com cox. earthlink. excite.com gte. hotmail.com juno.com .untd.com lycos.com microsoft.com mindspring. msn.com .hotmail.com netscape. psi. qwest. .rr.com verio. verizon. .bellatlantic. yahoo.com Bill - Original Message - From: "Scott MacLean" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 9:49 AM Subject: Re: [Declude.JunkMail] spamdomains list > If someone has a comprehensive spamdomains listing they are happy > with,could they post it for others to analyze/use? > > At 10:36 AM 5/30/2003, Bill Landry wrote: > > >One comment. Instead of having: > > > >yahoo.com > >yahoo.ca yahoo.com > >yahoo.de yahoo.com > >yahoo.dk yahoo.com > >yahoo.es yahoo.com > >yahoo.fr yahoo.com > >yahoo.it yahoo.com > >yahoo.no yahoo.com > >yahoo.se yahoo.com > >yahoo.co.jp yahoo.com > >yahoo.co.uk yahoo.com > >yahoo.com.ar yahoo.com > >yahoo.com.au yahoo.com > >yahoo.com.br yahoo.com > >yahoo.com.cn yahoo.com > >yahoo.com.hk yahoo.com > >yahoo.co.kr yahoo.com > >yahoo.com.mx yahoo.com > >yahoo.com.tw yahoo.com > > > >Why not just consolidate this down to: > > > >yahoo.yahoo.com > > > >Bill > >- Original Message - > >From: "Bill B." <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Sent: Friday, May 30, 2003 7:20 AM > >Subject: [Declude.JunkMail] spamdomains list > > > > > > > Attached is a list of spamdomains and their coresponding aliases that I've > >compiled thus far. Anybody want to comment or expand upon this? > > > > > > Bill > > > > > > > > > > > > > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > ___ > Scott MacLean > [EMAIL PROTECTED] > ICQ: 9184011 > http://www.nerosoft.com > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Ah, so I assume a line like this could cause problems then because it would required that "anythingmail.com" must have either mail.com or outblaze.com in their REVDNS. Is that correct? mail.comoutblaze.com Bill -Original Message- From: "R. Scott Perry" Sent: Fri, 30 May 2003 13:27:24 -0400 Subject: Re: [Declude.JunkMail] spamdomains list >I was under the impression that the spamdomains list could not include >partial domains, such as "yahoo.". Scott, could you help out on this >one?...are partial domain entries like this allowed? > >yahoo.yahoo.com This will work fine. For the SPAMDOMAINS test, you can have *anything* you want. So with a line "yahoo. yahoo.com", any E-mail with a return address that includes "yahoo." in it would need to have a reverse DNS entry that contains either "yahoo." or "yahoo.com". -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Variable Question ?
This works and we have set this up now however, this setup adds a number of extra x-headers which is what I'm looking to eliminate. Even more extra headers. Stu At 12:09 PM 05/30/2003 -0500, you wrote: >I use weightrange to define 6 distinct levels of spam (the last one >actually is just weight so anything over is caught). Then all I do is >add a header X-SPAM-Level: TESTNAME. End result is what you are asking >for, just use stars instead of TESTNAME. > >Global.cfg > >SPAM-NONE weightrange x x 0 4 >SPAM-VLOW weightrange x x 5 9 >SPAM-LOW weightrange x x 10 14 >SPAM-MID weightrange x x 15 19 >SPAM-HIGH weightrange x x 20 29 >SPAM-VHIGH weight x x 30 0 > >$default$.junkmail > >SPAM-NONE WARN X-SPAM-Level: %TESTNAME% >SPAM-VLOW WARN X-SPAM-Level: %TESTNAME% >SPAM-LOW WARN X-SPAM-Level: %TESTNAME% >SPAM-MID WARN X-SPAM-Level: %TESTNAME% >SPAM-HIGH WARN X-SPAM-Level: %TESTNAME% >SPAM-VHIGH WARN X-SPAM-Level: %TESTNAME% > >Thanks, >Chuck Frolick >ArgoNet, Inc. > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of >[EMAIL PROTECTED] >Sent: Friday, May 30, 2003 11:05 AM >To: [EMAIL PROTECTED] >Subject: [Declude.JunkMail] New Variable Question ? > > >Scott, > >Would it be possible to have a variable like the %weight% variable say >%weight*% that would convert the weight into a series of stars based on >a >set division number with the division number possibly held in the >global.cfg >file. > >This way only one x-header can be used rather than a series of x-headers >showing up if with different x-headers for each weight level. > >Using the weight alone is difficult because of all the combinations that >can >develop (3 30 33) all look the same it trying to filter on x-header >contains "xx 3". Using a division number of say 5 this could be >represented >as "xx " and "xx **" or "xx ***" (depending on rounding >factor) >and be represented with 1 x-header instead of several depending on the >weight levels defined. > >Stu > >- >CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am > >CSOnline Technical Support Summer hours - Monday thru Saturday 8am - >12pm >(June - July - August) > >CSOnline Technical Support Numbers >Seneca814-677-2447 Clarion 814-227-3638 Cochranton >814-425-1696 >Parker724-399-1158 GremLan 814-337-7060 >http://www.csonline.net http://www.cshowcase.com >http://www.learncenter.com >http://www.gremlan.org > >- > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > - CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Summer hours - Monday thru Saturday 8am - 12pm (June - July - August) CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
> If someone has a comprehensive spamdomains listing they are happy > with,could they post it for others to analyze/use? Uh, see the orginal post that started this thread. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What folder should my per user settingsbe in.
I need a little help, I can't seem to figure out what folder under declude I should be putting my per user settings for this one domain. That depends on the type of E-mail: [1] Standard E-mail addressed to a user account: In this case, you need to use the Official (in the IMail settings) name of the domain (not a host alias). [2] Standard E-mail addressed to an alias: In this case, you need to use the domain that is used in the target address. My problem child is virus.netamumail.com, it is \IMail\hosts\virusnetamumail in imail, what should it be in the declude folder? If the Official name of the domain is "virus.netamumail.com", you would use a directory \IMail\Declude\virus.netamumail.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
I was under the impression that the spamdomains list could not include partial domains, such as "yahoo.". Scott, could you help out on this one?...are partial domain entries like this allowed? yahoo.yahoo.com This will work fine. For the SPAMDOMAINS test, you can have *anything* you want. So with a line "yahoo. yahoo.com", any E-mail with a return address that includes "yahoo." in it would need to have a reverse DNS entry that contains either "yahoo." or "yahoo.com". -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
I was under the impression that the spamdomains list could not include partial domains, such as "yahoo.". Scott, could you help out on this one?...are partial domain entries like this allowed? yahoo.yahoo.com -Original Message- From: "Bill Landry" Sent: Fri, 30 May 2003 07:36:00 -0700 Subject: Re: [Declude.JunkMail] spamdomains list One comment. Instead of having: yahoo.com yahoo.ca yahoo.com yahoo.de yahoo.com yahoo.dk yahoo.com yahoo.es yahoo.com yahoo.fr yahoo.com yahoo.it yahoo.com yahoo.no yahoo.com yahoo.se yahoo.com yahoo.co.jp yahoo.com yahoo.co.uk yahoo.com yahoo.com.ar yahoo.com yahoo.com.au yahoo.com yahoo.com.br yahoo.com yahoo.com.cn yahoo.com yahoo.com.hk yahoo.com yahoo.co.kr yahoo.com yahoo.com.mx yahoo.com yahoo.com.tw yahoo.com Why not just consolidate this down to: yahoo.yahoo.com Bill - Original Message - From: "Bill B." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 7:20 AM Subject: [Declude.JunkMail] spamdomains list > Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? > > Bill > > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What folder should my per user settings be in.
I need a little help, I can't seem to figure out what folder under declude I should be putting my per user settings for this one domain. One of our domains, mail.netamumail.com, is \IMail\hosts\netamumail and the corresponding declude folder is, \IMail\Declude\netamumail.com and that works great. My problem child is virus.netamumail.com, it is \IMail\hosts\virusnetamumail in imail, what should it be in the declude folder? Thanks for your help, Nathan Fouarge --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Variable Question ?
I use weightrange to define 6 distinct levels of spam (the last one actually is just weight so anything over is caught). Then all I do is add a header X-SPAM-Level: TESTNAME. End result is what you are asking for, just use stars instead of TESTNAME. Global.cfg SPAM-NONE weightrange x x 0 4 SPAM-VLOW weightrange x x 5 9 SPAM-LOWweightrange x x 10 14 SPAM-MIDweightrange x x 15 19 SPAM-HIGH weightrange x x 20 29 SPAM-VHIGH weight x x 30 0 $default$.junkmail SPAM-NONE WARN X-SPAM-Level: %TESTNAME% SPAM-VLOW WARN X-SPAM-Level: %TESTNAME% SPAM-LOWWARN X-SPAM-Level: %TESTNAME% SPAM-MIDWARN X-SPAM-Level: %TESTNAME% SPAM-HIGH WARN X-SPAM-Level: %TESTNAME% SPAM-VHIGH WARN X-SPAM-Level: %TESTNAME% Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, May 30, 2003 11:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New Variable Question ? Scott, Would it be possible to have a variable like the %weight% variable say %weight*% that would convert the weight into a series of stars based on a set division number with the division number possibly held in the global.cfg file. This way only one x-header can be used rather than a series of x-headers showing up if with different x-headers for each weight level. Using the weight alone is difficult because of all the combinations that can develop (3 30 33) all look the same it trying to filter on x-header contains "xx 3". Using a division number of say 5 this could be represented as "xx " and "xx **" or "xx ***" (depending on rounding factor) and be represented with 1 x-header instead of several depending on the weight levels defined. Stu - CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Summer hours - Monday thru Saturday 8am - 12pm (June - July - August) CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] spamdomains list
Reply to: R. Scott Perry Re: [Declude.JunkMail] spamdomains list on Friday 10:25:16 AM Thanks! -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Wait a second? When I requested this, was this format put in Declude? >> >>earthlink.com earthlink.net >>earthlink.net earthlink.com >>email.itwebmessenger.it >>excite.com excitenetwork.com >> >>If so, I did not see this indicated in any messages I have read. R> This was added to v1.70 -- you can either have one entry on a line (where R> the reverse DNS must contain that entry, if the return address contains R> it), or you can have two (in which case the reverse DNS entry must contain R> *either* of the two entries, if the *first* entry appears in the return R> address). R> -Scott R> --- R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. R> Declude Virus: Catches known viruses and is the leader in mailserver R> vulnerability detection. R> Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
If someone has a comprehensive spamdomains listing they are happy with,could they post it for others to analyze/use? At 10:36 AM 5/30/2003, Bill Landry wrote: One comment. Instead of having: yahoo.com yahoo.ca yahoo.com yahoo.de yahoo.com yahoo.dk yahoo.com yahoo.es yahoo.com yahoo.fr yahoo.com yahoo.it yahoo.com yahoo.no yahoo.com yahoo.se yahoo.com yahoo.co.jp yahoo.com yahoo.co.uk yahoo.com yahoo.com.ar yahoo.com yahoo.com.au yahoo.com yahoo.com.br yahoo.com yahoo.com.cn yahoo.com yahoo.com.hk yahoo.com yahoo.co.kr yahoo.com yahoo.com.mx yahoo.com yahoo.com.tw yahoo.com Why not just consolidate this down to: yahoo.yahoo.com Bill - Original Message - From: "Bill B." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 7:20 AM Subject: [Declude.JunkMail] spamdomains list > Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? > > Bill > > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
Jools, Friday, May 30, 2003 you wrote: JC> At some point I intend to write a pop mailbox viewer that I can press JC> a button to forward to original recipient (with addition of a JC> whitelisted header), reply, delete, bounce or report to spamcop. Just be careful though because I think that's how my client got his own server (and our severs) listed. Hard to get em back after they've left. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
TimeWarner AOL owns Netscape. - Original Message - From: "paul" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 11:02 AM Subject: Re: [Declude.JunkMail] spamdomains list > > Attached is a list of spamdomains and their coresponding aliases that I've > compiled thus far. Anybody want to comment or expand upon this? > > Please forgive my ignorance here, I have nearly every message from this list > for the past 6 months on my machine, so I have looked, but missed it I > guess. Anyway, what's the deal with this in the spamdomains list?? > > earthlink.com earthlink.net > earthlink.net earthlink.com > > Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS > can be either earthlink.net or earthlink.com ??? and the other way around if > it's [EMAIL PROTECTED] - ? > > What confuses me are these: > > aol.com netscape.net > netscape.net aol.com > > My feeling here is why would a netscape user be sending with an AOL address > and vice-versa. So am I off here? > > Thanks for any help > > Paul > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > This E-mail is scanned and free from viruses. www.nexustechgroup.com > > This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
This is new in the latest beta1.70b, and you are correct on your assumption of how it works... Jason - Original Message - From: "paul" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 10:02 AM Subject: Re: [Declude.JunkMail] spamdomains list > > Attached is a list of spamdomains and their coresponding aliases that I've > compiled thus far. Anybody want to comment or expand upon this? > > Please forgive my ignorance here, I have nearly every message from this list > for the past 6 months on my machine, so I have looked, but missed it I > guess. Anyway, what's the deal with this in the spamdomains list?? > > earthlink.com earthlink.net > earthlink.net earthlink.com > > Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS > can be either earthlink.net or earthlink.com ??? and the other way around if > it's [EMAIL PROTECTED] - ? > > What confuses me are these: > > aol.com netscape.net > netscape.net aol.com > > My feeling here is why would a netscape user be sending with an AOL address > and vice-versa. So am I off here? > > Thanks for any help > > Paul > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
>> We do not whitelist the postmaster account, instead you setup a "filter" test that contains an "allrecips" for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a "routeto" back to the postmasters account. << Hm - I assume your method only works, if I don't use a DELETE and/or BOUNCE action directly on individual tests - or will "routeto" supercede delete and/or bounce? DELETE takes priority over all other actions. So if you have "SPAMCOP DELETE", any E-mail failing the SPAMCOP test will be deleted (unless the E-mail is whitelisted). In that case, the weighting system won't help. The idea above assumes that you are using the weighting system exclusively. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
Thanks Bill! A very good list. Now I'm interested if I can remove my blacklist containing the popular domains. Before I will check how many mails will fail POPULARDOMAINS _AND_ SPAMDOMAINS. If there are a lot of hold spam from popular domains without failing the SPAMDOMAINS-test this means that the spam was send from the "right" mailserver. (or the spammer has created an appropriate revdns-entry) Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bill B. > Sent: Friday, May 30, 2003 4:20 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] spamdomains list > > > Attached is a list of spamdomains and their coresponding > aliases that I've compiled thus far. Anybody want to comment > or expand upon this? > > Bill > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
Darrell / Scott: >> We do not whitelist the postmaster account, instead you setup a "filter" test that contains an "allrecips" for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a "routeto" back to the postmasters account. << Hm - I assume your method only works, if I don't use a DELETE and/or BOUNCE action directly on individual tests - or will "routeto" supercede delete and/or bounce? Let's assume... Bounce on: Any OSDUL/OSSOFT Weight >= 10 Hold on: Any MailFrom/Percent I delete on: Weight >= 20 If someone needs assistance who gets caught by the MailFrom/Percent or OSDUL/OSSOFT and all your test does is reduce weights - I assume the people's emails would still not get through? So I do need to whitelist the PostMaster? Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
The difference with us is that we are mainly handling our own companys mail with a few small clients, our traffic is quite low so we can afford to look at our routeto mailbox fairly often. False positives (if there are any) are forwarded to the original recipient, otherwise they are binned. We also routeto anything between 15-30 weights and bounce anything over 30. It works for us. At some point I intend to write a pop mailbox viewer that I can press a button to forward to original recipient (with addition of a whitelisted header), reply, delete, bounce or report to spamcop. Jools On Fri, 30 May 2003 08:16:22 -0700, you wrote: >> We are quite aggressive in blocking spam and use ROUTETO a specific >> account for SpamCop blocked email, I find that 99% of the time it is >> accurate with very few false positives. > >If you would kindly search the archives (when they are back up) you will >find past discussions that have proven differently at times. > >Like Terry said, others have already been down that road. > >Try looking up Dunn & Bradstreet. Last year, they were listed about 8 times. >One of those was for only 20 minutes. Yes, 20 minutes. Just because some Yo >Yo did not like receiving the notices that they sent to him, (as in >collection notices,) he reported them. > >SpamCop seems to go in cycles. They will be great for a while then all of a >sudden start listing anything with one report. > >So, the next time SpamCop lists Dunn & Bradstreet and you Route the bosses >latest Credit report on the companies new big client, and the boss doesn't >get it, how are you going to explain that to him? (I speak from experience >here, when a client of mine called and said he was not getting his reports.) > >John Tolmachoff MCSE CSSA >Engineer/Consultant >eServices For You >www.eservicesforyou.com > > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New Variable Question ?
Scott, Would it be possible to have a variable like the %weight% variable say %weight*% that would convert the weight into a series of stars based on a set division number with the division number possibly held in the global.cfg file. This way only one x-header can be used rather than a series of x-headers showing up if with different x-headers for each weight level. Using the weight alone is difficult because of all the combinations that can develop (3 30 33) all look the same it trying to filter on x-header contains "xx 3". Using a division number of say 5 this could be represented as "xx " and "xx **" or "xx ***" (depending on rounding factor) and be represented with 1 x-header instead of several depending on the weight levels defined. Stu - CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Summer hours - Monday thru Saturday 8am - 12pm (June - July - August) CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] iMail 8.0
Are there any issues with Junkmail/Virus and iMail version 8.0? No issues. :) Just make sure to either disable the IMail v8 anti-spam, or make sure you know what it is doing (the default settings were blocking legitimate E-mail for some people). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
> Does this mean if the address comes in as [EMAIL PROTECTED] - it's > rev DNS can be either earthlink.net or earthlink.com ??? and the other > way around if it's [EMAIL PROTECTED] - ? Exactly. Scott added this in 1.70. > My feeling here is why would a netscape user be sending with an AOL > address and vice-versa. So am I off here? Netscape is owned by AOL, and f you send an email from a free netscape.net address it uses an AOL mail server. I included both variations since they are the same company. Bill -Original Message- From: "paul" Sent: Fri, 30 May 2003 11:02:34 -0400 Subject: Re: [Declude.JunkMail] spamdomains list > Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Please forgive my ignorance here, I have nearly every message from this list for the past 6 months on my machine, so I have looked, but missed it I guess. Anyway, what's the deal with this in the spamdomains list?? earthlink.com earthlink.net earthlink.net earthlink.com Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS can be either earthlink.net or earthlink.com ??? and the other way around if it's [EMAIL PROTECTED] - ? What confuses me are these: aol.com netscape.net netscape.net aol.com My feeling here is why would a netscape user be sending with an AOL address and vice-versa. So am I off here? Thanks for any help Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
One comment. Instead of having: yahoo.com yahoo.ca yahoo.com yahoo.de yahoo.com yahoo.dk yahoo.com yahoo.es yahoo.com yahoo.fr yahoo.com yahoo.it yahoo.com yahoo.no yahoo.com yahoo.se yahoo.com yahoo.co.jp yahoo.com yahoo.co.uk yahoo.com yahoo.com.ar yahoo.com yahoo.com.au yahoo.com yahoo.com.br yahoo.com yahoo.com.cn yahoo.com yahoo.com.hk yahoo.com yahoo.co.kr yahoo.com yahoo.com.mx yahoo.com yahoo.com.tw yahoo.com Why not just consolidate this down to: yahoo.yahoo.com Bill - Original Message - From: "Bill B." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 7:20 AM Subject: [Declude.JunkMail] spamdomains list > Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? > > Bill > > > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Enhancement Request: XUNIQUEINHEADER
Would be nice if Declude could be told not insert a header if one already exists, e.g.: XUNIQUEINHEADER Return-Path: <%MAILFROM%> That's a very good idea -- it has been added to the suggestion database. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Wait a second? When I requested this, was this format put in Declude? earthlink.com earthlink.net earthlink.net earthlink.com email.itwebmessenger.it excite.com excitenetwork.com If so, I did not see this indicated in any messages I have read. This was added to v1.70 -- you can either have one entry on a line (where the reverse DNS must contain that entry, if the return address contains it), or you can have two (in which case the reverse DNS entry must contain *either* of the two entries, if the *first* entry appears in the return address). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
email provided by netscape.net is at least partly based from AOL instant messenger accounts, which partly correspond to some peoples' real aol.com email addresses. when you do a full install of Netscape 6 and above, it links w/ your AIM account for messaging, and provides you a *free*, spammed, email account in the netscape.net domain, under your username as defined in AIM. That may be the connection. At 08:02 05.30.2003, you wrote: > Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Please forgive my ignorance here, I have nearly every message from this list for the past 6 months on my machine, so I have looked, but missed it I guess. Anyway, what's the deal with this in the spamdomains list?? earthlink.com earthlink.net earthlink.net earthlink.com Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS can be either earthlink.net or earthlink.com ??? and the other way around if it's [EMAIL PROTECTED] - ? What confuses me are these: aol.com netscape.net netscape.net aol.com My feeling here is why would a netscape user be sending with an AOL address and vice-versa. So am I off here? Thanks for any help Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] iMail 8.0
We're using that combination without any problems. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Mark Smith > Sent: Friday, May 30, 2003 9:41 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] iMail 8.0 > > > Are there any issues with Junkmail/Virus and iMail version 8.0? > > We're planning on the upgrade next week and didn't want to break > anything. :) > > Thanks! > --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: imail (NOT) spam....
> It's a wonder that more people don't submit mail maliciously if the > system works as it appears. Some do. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] iMail 8.0
> Are there any issues with Junkmail/Virus and iMail version 8.0? > > We're planning on the upgrade next week and didn't want to break > anything. :) Declude continues to rock as always. :)) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: imail (NOT) spam....
> We are quite aggressive in blocking spam and use ROUTETO a specific > account for SpamCop blocked email, I find that 99% of the time it is > accurate with very few false positives. If you would kindly search the archives (when they are back up) you will find past discussions that have proven differently at times. Like Terry said, others have already been down that road. Try looking up Dunn & Bradstreet. Last year, they were listed about 8 times. One of those was for only 20 minutes. Yes, 20 minutes. Just because some Yo Yo did not like receiving the notices that they sent to him, (as in collection notices,) he reported them. SpamCop seems to go in cycles. They will be great for a while then all of a sudden start listing anything with one report. So, the next time SpamCop lists Dunn & Bradstreet and you Route the bosses latest Credit report on the companies new big client, and the boss doesn't get it, how are you going to explain that to him? (I speak from experience here, when a client of mine called and said he was not getting his reports.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Enhancement Request: XUNIQUEINHEADER
Hi, Would be nice if Declude could be told not insert a header if one already exists, e.g.: XUNIQUEINHEADER Return-Path: <%MAILFROM%> Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
> Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Please forgive my ignorance here, I have nearly every message from this list for the past 6 months on my machine, so I have looked, but missed it I guess. Anyway, what's the deal with this in the spamdomains list?? earthlink.com earthlink.net earthlink.net earthlink.com Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS can be either earthlink.net or earthlink.com ??? and the other way around if it's [EMAIL PROTECTED] - ? What confuses me are these: aol.com netscape.net netscape.net aol.com My feeling here is why would a netscape user be sending with an AOL address and vice-versa. So am I off here? Thanks for any help Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Reply to: Bill B. Re: [Declude.JunkMail] spamdomains list on Friday 9:20:04 AM Wait a second? When I requested this, was this format put in Declude? earthlink.com earthlink.net earthlink.net earthlink.com email.itwebmessenger.it excite.com excitenetwork.com If so, I did not see this indicated in any messages I have read. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - B> Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? B> Bill -- ActivatorMail(tm) ver.0518031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
That would be nice, I'm surprised by their undocumented methods though. My dealings with them have been quite good as they delisted our old server very quickly after several people submitted a mailing of ours. It's a wonder that more people don't submit mail maliciously if the system works as it appears. Jools On Fri, 30 May 2003 10:26:37 -0400, you wrote: > >> Now in their defense I will say they are pretty good about >> responding to my messages and they have always done the right >> thing. But it is still time consuming and disruptive to have to >> investigate each incident. Their system is much too easily used >> for malicious purposes. > >What Spamcop really needs to do is have the TXT record include the % of >spam-to-legit E-mail, and their modified % (based on how recent the spam >was, etc.). From that, programs like Declude JunkMail could let you choose >exactly when to block the E-mail. I'm guessing that with better settings, >you might reduce the amount of spam that is caught by a couple percent, but >would virtually eliminate the false positives. > >-Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] iMail 8.0
Are there any issues with Junkmail/Virus and iMail version 8.0? We're planning on the upgrade next week and didn't want to break anything. :) Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist
What command can I use to White list from a file in the config.cfg To whitelist in the global.cfg file (FYI, there is no "config.cfg" file), you need to use the WHITELIST command (such as "WHITELIST FROM [EMAIL PROTECTED]"). Rather than trying to figure out a way to whitelist from a file in the global.cfg file, could you explain what you are trying to do? Perhaps there is another way to accomplish what you are trying to do. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist
What command can I use to White list from a file in the config.cfg Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, May 30, 2003 10:18 AM Subject: Re: [Declude.JunkMail] Whitelist > > >I want to whitelist from a file in both the config.cfg and > >$default$.junkmail > > > >I know this is the command for $default$.junkmail > >WHITELISTFILE C:\IMail\Declude\WhiteList.txt > > > >What is the command for the config.cfg. > > The WHITELISTFILE command does not work in the global.cfg file. It only > applies to incoming E-mail. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] base64 false-positive
Emails with a message body that just contains blank lines and that contains an attachment, are still failing the BASE64 test. This is something that we are working on. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
Now in their defense I will say they are pretty good about responding to my messages and they have always done the right thing. But it is still time consuming and disruptive to have to investigate each incident. Their system is much too easily used for malicious purposes. What Spamcop really needs to do is have the TXT record include the % of spam-to-legit E-mail, and their modified % (based on how recent the spam was, etc.). From that, programs like Declude JunkMail could let you choose exactly when to block the E-mail. I'm guessing that with better settings, you might reduce the amount of spam that is caught by a couple percent, but would virtually eliminate the false positives. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] spamdomains list
Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Bill sd.zip Description: Zip archive
Re: [Declude.JunkMail] OT: imail (NOT) spam....
Jools, Friday, May 30, 2003 you wrote: JC> This is waht Spamcop have to say about how their system works: JC> http://mailsc.spamcop.net/fom-serve/cache/297.html JC> look at number 7 especially: JC> 7. If a host has only 1 SUBE report against it, it will not be listed. JC> (SUBE is Supposed Unsolicited Bulk Mail) JC> We are quite aggressive in blocking spam and use ROUTETO a specific JC> account for Spamcop blocked email, I find that 99% of the time it is JC> accurate with very few false positives. What they say and what they do are two different things. We have been listed only once by SpamCop but have had to investigate numerous SpamCop incidents. In these incidents there has never been more than one report - always one single message filed by a complaining recipient. In none of these cases was the message sent from our server but the message contained a URL pointing to a web site on our servers. At least in one case I am pretty certain the complaint was filed as a harassment technique. The one time we were listed resulted from a single incident also. It was the result of a complaint filed by one of our own clients who submitted one of HIS OWN messages to SpamCop. It was a mistake on his part obviously but we were listed for about 2 or 3 hours and mail was disrupted during that time. Obviously you can do what you want regarding SapmCop but I and many others can attest that they do make mistakes and they do list innocent bystanders. Now in their defense I will say they are pretty good about responding to my messages and they have always done the right thing. But it is still time consuming and disruptive to have to investigate each incident. Their system is much too easily used for malicious purposes. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist
I want to whitelist from a file in both the config.cfg and $default$.junkmail I know this is the command for $default$.junkmail WHITELISTFILE C:\IMail\Declude\WhiteList.txt What is the command for the config.cfg. The WHITELISTFILE command does not work in the global.cfg file. It only applies to incoming E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] base64 false-positive
Scott, Emails with a message body that just contains blank lines and that contains an attachment, are still failing the BASE64 test. Attached is a sample. Bill base64fail.zip Description: Zip archive
Re: [Declude.JunkMail] OT: imail (NOT) spam....
This is waht Spamcop have to say about how their system works: http://mailsc.spamcop.net/fom-serve/cache/297.html look at number 7 especially: 7. If a host has only 1 SUBE report against it, it will not be listed. (SUBE is Supposed Unsolicited Bulk Mail) We are quite aggressive in blocking spam and use ROUTETO a specific account for Spamcop blocked email, I find that 99% of the time it is accurate with very few false positives. Jools On Fri, 30 May 2003 05:53:10 -0500, you wrote: >Jools, > >Friday, May 30, 2003 you wrote: >JC> But, to block a server at Spamcop it must be reported several times, >JC> this is obviously to stop people from being nasty and getting servers >JC> blocked that they don't like. > >That's not true. >Spamcop blocks on ONE incident. >Sometimes it is only for an hour or two but it is very disruptive. > > >Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and not failed????
That makes sense thanks Harry Vanderzand inTown Internet & Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of R. > Scott Perry > Sent: Friday, May 30, 2003 9:10 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] headers indicate both failed > and not failed > > > > >Can anyone tell me what is happening with the following headers? It > >indicates that tests failed yet at the end it says that test > failed is > >NOINE > > > >Received: from mail.escapees.com [207.70.132.66] by > intown.net with ESMTP > > (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 > >Received: from compuserve.com [68.58.200.135] by mail.escapees.com > > (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 > > It looks like the E-mail passed through 2 IMail servers, yours and > mail.escapees.com. > > >X-RBL-Warning: SPAMCOP: Blocked - see > >http://spamcop.net/bl.shtml?68.58.200.135 > >X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the > limit of 10. > >X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 > >X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] > >X-Note: This E-mail was scanned by Declude. > >X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL > > These are the headers that their Declude JunkMail added, and: > > >X-Note: This E-mail was sent from > >pcp02799235pcs.goosck01.sc.comcast.net > >([68.58.200.135]). > >X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] > >X-Declude-Spoolname: D046e00e000d0aec7.SMD > >X-Note: Tests Failed: None > > These are the ones that your Declude JunkMail added. Since > the server that > sent you the E-mail (207.70.132.66) is not listed in any spam > databases, it > didn't fail any tests on your server. This is a problem > inherent in E-mail > forwarded from one server to another. > > One option in this case would be to add a line "IPBYPASS > 207.70.132.66" to > your \IMail\Declude\global.cfg file, which will let Declude > JunkMail see > the IP address that actually sent the E-mail (so it will fail > the SPAMCOP > and DSBL tests on your server). > > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. Declude Virus: Catches known viruses and is the > leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist
I want to whitelist from a file in both the config.cfg and $default$.junkmail I know this is the command for $default$.junkmail WHITELISTFILE C:\IMail\Declude\WhiteList.txt What is the command for the config.cfg. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
