Re: [Declude.JunkMail] Whitelist from ? (clarification)
The line: WHITELIST FROM [EMAIL PROTECTED] would work fine in the global.cfg file, and would whitelist E-mail from [EMAIL PROTECTED] and [EMAIL PROTECTED] -Scott At 05:46 PM 8/29/2003, Agid, Corby wrote: Also, the top level domain isnt' always the same. Sometimes the mail will be from [EMAIL PROTECTED] and the next time it could be from [EMAIL PROTECTED] Original message: Is it possible to whitelist using the subdomains? For example I want to whitelist mail from [EMAIL PROTECTED] using the following syntax: whitelist from [EMAIL PROTECTED] The reason being is that one of my recipients recieves mail from a legitmate source. Unfortunately, the legitmate source uses a mass mailer service that also is known to send spam. Thanks. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Possible test suggestion
I'm trying to remember if this has been suggested before, couldn't seem to find anything in the archives (probably bad search terms). How about a test similar to MAILFROM but it checks the intended recipients of all local domains and fails if any of them are invailid, ignoring the nobody alias. It could even return the count as weight or a multiplier of count as weight. I can't think of a reason legitimate mail will have more than a couple outside of a mailing list, which, if I'm remembering right, generally only uses single recipients. It's a good idea, and something we will likely add. It would probably have occasional false positives for various reasons, but would make for a useful test. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
This "file" you speak of, is it an ascii file that can be edited? What if someone wants to remove an email address in it? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Friday, August 29, 2003 2:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Unless you send e-mail to your self, your e-mail address will not be listed in your file. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Johnson > Sent: Friday, August 29, 2003 2:23 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > Rob, > How does the AUTOWhite handle "spoofed" addressing when someone > uses my address to send email? Thanks for the aid. > > Keith > > -Original Message- > From: Robert Grosshandler [mailto:[EMAIL PROTECTED] > Sent: Friday, August 29, 2003 11:20 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > > Also, check out autowhite. It automatically whitelists an e-mail > address when you send e-mail to that address. > > While it has more flexibility than that, that's the simplest > description. > > I immediately went to Outlook, and sent e-mail to anybody I cared about, > and now I know that I'll get whatever they send me, even if it normally > would trigger all of the anti-spam (but not anti-virus) stuff we have > running. > > I don't have a great link for it, but it is in the archive. > > Rob > > === > Robert N. Grosshandler > www.iGive.com > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Possible test suggestion
Hi; What we have done about this is simple. We created a filter file with: ALLRECIPS 0 CONTAINSXemployees email & set the action to delete This filter file is only the emails we see in our log files that are constantly getting email and the emails are either no longer valid or they have never existed.. My favorites are: [EMAIL PROTECTED] This email receives email everyday.. It is the most popular guy at our company... ALLRECIPS has the benefit that if anyone in the To or CC has this address the email gets treated with our action. We have a DELETE action on this filter. The way we see it if [EMAIL PROTECTED] & [EMAIL PROTECTED] are in the same To field chances are quite high that the email is spam. So that takes care of this. I wish there was a way that Imail would refuse email from senders that do not exist. For example: [EMAIL PROTECTED] can not be in the from address since Imail should know the domain is local and that user does not exist and it should outright reject it and refuse connection. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Friday, August 29, 2003 6:07 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Possible test suggestion Chuck, that suggestion could be useful for me, but I can two bits... I've noticed that some legitimate bulk mailers, like spammers, are completely brain dead when it comes to removing e-mail addresses that have bounced. For example, I saw a spammer consistently using an address that hadn't existed for 5 years in my domain. So now it's a spam trap, but it wasn't just getting spam, it was still getting catalog flyers, "service updates" for a cell phone that would be long gone, and some other member news kind of stuff. This bad behaviour on their part wouldn't invalidate the test you're suggesting, but it would make me give it a moderate weight. The other false positive I can easily see would be spelling errors. Happens all the time. -Original Message- From: Charles Frolick [mailto:[EMAIL PROTECTED] Sent: Friday, August 29, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Possible test suggestion I'm trying to remember if this has been suggested before, couldn't seem to find anything in the archives (probably bad search terms). How about a test similar to MAILFROM but it checks the intended recipients of all local domains and fails if any of them are invailid, ignoring the nobody alias. It could even return the count as weight or a multiplier of count as weight. I can't think of a reason legitimate mail will have more than a couple outside of a mailing list, which, if I'm remembering right, generally only uses single recipients. Pros, cons, extensions? Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
It doesn't. But spoofed messages are, in my experience, virii, and therefore are stopped by that most wonderful of products, Declude AV. Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, August 29, 2003 4:23 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Rob, How does the AUTOWhite handle "spoofed" addressing when someone uses my address to send email? Thanks for the aid. Keith -Original Message- From: Robert Grosshandler [mailto:[EMAIL PROTECTED] Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Possible test suggestion
Chuck, that suggestion could be useful for me, but I can two bits... I've noticed that some legitimate bulk mailers, like spammers, are completely brain dead when it comes to removing e-mail addresses that have bounced. For example, I saw a spammer consistently using an address that hadn't existed for 5 years in my domain. So now it's a spam trap, but it wasn't just getting spam, it was still getting catalog flyers, "service updates" for a cell phone that would be long gone, and some other member news kind of stuff. This bad behaviour on their part wouldn't invalidate the test you're suggesting, but it would make me give it a moderate weight. The other false positive I can easily see would be spelling errors. Happens all the time. -Original Message- From: Charles Frolick [mailto:[EMAIL PROTECTED] Sent: Friday, August 29, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Possible test suggestion I'm trying to remember if this has been suggested before, couldn't seem to find anything in the archives (probably bad search terms). How about a test similar to MAILFROM but it checks the intended recipients of all local domains and fails if any of them are invailid, ignoring the nobody alias. It could even return the count as weight or a multiplier of count as weight. I can't think of a reason legitimate mail will have more than a couple outside of a mailing list, which, if I'm remembering right, generally only uses single recipients. Pros, cons, extensions? Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist from ? (clarification)
Also, the top level domain isnt' always the same. Sometimes the mail will be from [EMAIL PROTECTED] and the next time it could be from [EMAIL PROTECTED] Original message: Is it possible to whitelist using the subdomains? For example I want to whitelist mail from [EMAIL PROTECTED] using the following syntax: whitelist from [EMAIL PROTECTED] The reason being is that one of my recipients recieves mail from a legitmate source. Unfortunately, the legitmate source uses a mass mailer service that also is known to send spam. Thanks. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist from ?
Is it possible to whitelist using the subdomains? For example I want to whitelist mail from [EMAIL PROTECTED] using the following syntax: whitelist from [EMAIL PROTECTED] The reason being is that one of my recipients recieves mail from a legitmate source. Unfortunately, the legitmate source uses a mass mailer service that also is known to send spam. Thanks. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: dsl vendor
If anyone here is using TDS Telecom commercial DSL, please contact me off list. Thank you, Karen Oland --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
Unless you send e-mail to your self, your e-mail address will not be listed in your file. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Johnson > Sent: Friday, August 29, 2003 2:23 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > Rob, > How does the AUTOWhite handle "spoofed" addressing when someone > uses my address to send email? Thanks for the aid. > > Keith > > -Original Message- > From: Robert Grosshandler [mailto:[EMAIL PROTECTED] > Sent: Friday, August 29, 2003 11:20 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > > Also, check out autowhite. It automatically whitelists an e-mail > address when you send e-mail to that address. > > While it has more flexibility than that, that's the simplest > description. > > I immediately went to Outlook, and sent e-mail to anybody I cared about, > and now I know that I'll get whatever they send me, even if it normally > would trigger all of the anti-spam (but not anti-virus) stuff we have > running. > > I don't have a great link for it, but it is in the archive. > > Rob > > === > Robert N. Grosshandler > www.iGive.com > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Osirusoft replacement ?
Benny. Thanks to help from members of the list our Declude config is more diversified than before and we are catching equal or more spam with the same or fewer FPs. Keep in mind we have only been using these for the last couple days and are still tuning the Weights We hold at Weight 100 NJABL ip4rdnsbl.njabl.org 127.0.0.2 35 0 FABELSOURCESip4rspamsources.fabel.dk127.0.0.2 35 0 FIVETEN-SPAMip4rblackholes.five-ten-sg.com 127.0.0.2 35 0 FIVETEN-BULKip4rblackholes.five-ten-sg.com 127.0.0.4 35 0 FIVETEN-MULTISTAGE ip4rblackholes.five-ten-sg.com 127.0.0.5 25 0 FIVETEN-SPAMSUPPORT ip4rblackholes.five-ten-sg.com 127.0.0.7 35 0 FIVETEN-MISCip4rblackholes.five-ten-sg.com 127.0.0.9 25 0 FIVETEN-SINGLESTAGE ip4rblackholes.five-ten-sg.com 127.0.0.6 25 0 FIVETEN-FREEip4rblackholes.five-ten-sg.com 127.0.0.12 25 0 INTERSILip4rblackholes.intersil.net 127.0.0.2 35 0 SPAMHAUSip4rsbl.spamhaus.org127...0.0.2 55 0 CBL ip4rcbl.abuseat.org 127.0.0.2 45 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 45 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 55 0 Hope this helps. Todd At 05:10 PM 8/29/2003 +0200, you wrote: trying again anyone have any good replacements after this one died ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
Rob, How does the AUTOWhite handle "spoofed" addressing when someone uses my address to send email? Thanks for the aid. Keith -Original Message- From: Robert Grosshandler [mailto:[EMAIL PROTECTED] Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Possible test suggestion
I'm trying to remember if this has been suggested before, couldn't seem to find anything in the archives (probably bad search terms). How about a test similar to MAILFROM but it checks the intended recipients of all local domains and fails if any of them are invailid, ignoring the nobody alias. It could even return the count as weight or a multiplier of count as weight. I can't think of a reason legitimate mail will have more than a couple outside of a mailing list, which, if I'm remembering right, generally only uses single recipients. Pros, cons, extensions? Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spammers know OSRelay is down too.
> Number of spam messages not caught has gone up since the tests went down. I have seen this here too. I have been testing some of the other lists but so far no noticeable change for the good. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
> If the AUTOWHITE from John how much is it? I don't see a price on his > website. It is in the information.pdf. Standard, $75 Professional, $175 Enterprise, Pending John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
I don't see it either -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Danny Klopfer Sent: Friday, August 29, 2003 3:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Kami, Are you talking about the AUTOWHITELIST ON option or are you talking about the 3rd party software from John? If the AUTOWHITE from John how much is it? I don't see a price on his website. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Friday, August 29, 2003 9:32 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Hi; For what it is worth... We have been using AutoWhitelist for a long long time... It will dramatically help you with False Positives. It has given us much more freedom to be strict with our rules and has reduced FP's to zero... Of course mailing lists not included. Highly recommend it... Hope it is OK to mention a 3rd party tool in this list... :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Friday, August 29, 2003 11:34 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question What - I missed something... autolist by who you send email to? This would be awesome! Then I could block all email coming in and then my users could still get email from those they specify Where do I get this? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Robert Grosshandler Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
Please note, there are 2 different items: AUTOWHITELIST is a Declude JunkMail option. AutoWhite for Declude is a 3rd party add on. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blackholes.us test format
Thanks! Todd At 03:36 PM 8/29/2003 -0400, you wrote: Can anyone tell me if this would be the correct format for this test? BHTAIWANipr4taiwan.blackholes.us 127.0.0.2 5 0 Close -- it should be BHTAIWANip4rtaiwan.blackholes.us 127.0.0.2 5 0 with "ip4r". -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
Kami, Are you talking about the AUTOWHITELIST ON option or are you talking about the 3rd party software from John? If the AUTOWHITE from John how much is it? I don't see a price on his website. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Friday, August 29, 2003 9:32 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Hi; For what it is worth... We have been using AutoWhitelist for a long long time... It will dramatically help you with False Positives. It has given us much more freedom to be strict with our rules and has reduced FP's to zero... Of course mailing lists not included. Highly recommend it... Hope it is OK to mention a 3rd party tool in this list... :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Friday, August 29, 2003 11:34 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question What - I missed something... autolist by who you send email to? This would be awesome! Then I could block all email coming in and then my users could still get email from those they specify Where do I get this? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Robert Grosshandler Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blackholes.us test format
Can anyone tell me if this would be the correct format for this test? BHTAIWANipr4taiwan.blackholes.us 127.0.0.2 5 0 Close -- it should be BHTAIWANip4rtaiwan.blackholes.us 127.0.0.2 5 0 with "ip4r". -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blackholes.us test format
Can anyone tell me if this would be the correct format for this test? BHTAIWANipr4taiwan.blackholes.us 127.0.0.2 5 0 Thanks, Todd
RE: [Declude.JunkMail] AUTO Whitelist question
Hi; For what it is worth... We have been using AutoWhitelist for a long long time... It will dramatically help you with False Positives. It has given us much more freedom to be strict with our rules and has reduced FP's to zero... Of course mailing lists not included. Highly recommend it... Hope it is OK to mention a 3rd party tool in this list... :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Friday, August 29, 2003 11:34 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question What - I missed something... autolist by who you send email to? This would be awesome! Then I could block all email coming in and then my users could still get email from those they specify Where do I get this? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Robert Grosshandler Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
In order for AUTOWHITELIST to work do we need to add something to the $default$.junkmail or is that it? No -- you only need to add it to the global.cfg file, since it is a global setting. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
Scott, In order for AUTOWHITELIST to work do we need to add something to the $default$.junkmail or is that it? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Friday, August 29, 2003 8:01 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] AUTO Whitelist question >How does AUTO Whitelist work? If you add a line "AUTOWHITELIST ON" to the \IMail\Declude\global.cfg file (with v1.75 or higher), Declude JunkMail will automatically whitelist E-mail if the sender is listed in the recipient's web messaging address book. >Wouldn't users have to have their address books stored on the Imail server >for this to work? That is correct. There is no way to query the address book of a mail client. So this means that the feature is useful to [1] users who currently use web messaging, and [2] users who want to whitelist specific E-mail addresses, and are willing to use web messaging to add them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spammers know OSRelay is down too.
But what can you use instead `? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: 29. august 2003 21:13 To: [EMAIL PROTECTED] Number of spam messages not caught has gone up since the tests went down. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spammers know OSRelay is down too.
Number of spam messages not caught has gone up since the tests went down. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FW: Attention mail server administrators
It won't help with Lawyers and the like who need a server stamp and the users will need to go between work and home, but there is a way to make life easy: Make up a sub domain, something like cox.mydomain.com for each blocking ISP. On the LAN (private IP), point cox.mydomain.com at the private email server. Point the public cox.mydomain.com at the required ISPs email server. If your people run multiple ISPs or regions, you can can make extra entries, cox1.mydomain.com, cox2.mydomain.com, etc. Then configure that sub domain as the users SMTP server and they'll have context sensitive email delivery. Dan On Thursday, August 28, 2003 7:42, Markus Gufler <[EMAIL PROTECTED]> wrote: >Your opinions? > >Markus > > >-- >From: No-IP Alerts [mailto:[EMAIL PROTECTED] >To: xxx >Subject: Attention mail server administrators > > >Hello , > >NOTICE: Mail you send from your dynamic IP may not be reaching your >customers. > >Many ISP's including AOL,Road Runner have started rejecting mail sent >from residential dynamic IP address blocks in attempt to reduce the >amount of unsolicited email that travels through their networks. >No-IP.com has been working around the clock to provide a solution, >Alternate-Port SMTP. > >Altnerate-Port SMTP solves a couple of problems our users encounter when >trying to send mail from a residential service such as blocked outbound >port 25, AOL and other ISPs rejecting mail based on ip, and inability to >send mail from email addresses @yourdomain.com > >For detailed information about this service please visit: >http://www.no-ip.com/svc/mail/smtp > >Some providers that restrict outbound port 25 include >- NetZero >- Mindspring >- MSN >- Earthlink >- Flashnet >- MediaOne >- AT&T >- Verizon >- Bell Canada >- Cox > >Note that Alternate-Port SMTP is for outbound mail only. Should your >ISP block inbound port 25 you will need our Mail Reflector service >(http://www.no-ip.com/svc/mail/reflector). > >If you are unsure what service you need or have questions please open a >support ticket at http://www.no-ip.com/ticket/ > >Regards, >No-IP.com Alerts > > > > > > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test is different between header and log
OK. Thanks. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Friday, August 29, 2003 10:37 > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Test is different between > header and log > > > > >Well yes, but if I see the IPNOTINMX as failed in the > header, should it not > >also show in the log? > > No -- because it has a weight of 0, it is not listed. The > line with the > "nNOLEGITCONTENT" in it is used for determining how Declude JunkMail > arrived at the total weight for the E-mail. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Alligate
John, Our demo policy is now more open than before. I don't want to put too fine a point on it, but as part of our open source release, we changed the way we do demos for Message Sniffer. The sniffer2.snf license has some restrictions but it continually updated. You might consider implementing Message Sniffer "for evaluation purposes" using the demo license until you have the funds you need. Sure, it won't perform as well as a registered version, and it can't be customized, no support, etc... None the less, as an additional test it might be quite helpful. Just a thought, _M |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] On Behalf Of John |Tolmachoff (Lists) |Sent: Thursday, August 28, 2003 1:44 PM |To: [EMAIL PROTECTED] |Subject: RE: [Declude.JunkMail] Alligate | | |I do not use MessageSniffer at this time, but would if I could. | |I like the product. I have evaluated it. It is a very good test to use. | |Why would I use both, the broader the scope of the tests, the |more chance of catching all spam with a lesser FP rate. | |They both have there strengths, and weaknesses. Their |weaknesses is nothing to detract from them, it is inhearant in |any program. | |I just do not have the funds at this time. | |John Tolmachoff MCSE CSSA |Engineer/Consultant |eServices For You |www.eservicesforyou.com | | |> -Original Message- |> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- |> [EMAIL PROTECTED] On Behalf Of Bill Newberg |> Sent: Thursday, August 28, 2003 9:39 AM |> To: [EMAIL PROTECTED] |> Subject: FW: [Declude.JunkMail] Alligate |> |> John, |> |> I understand you are very pleased with the product. Do you use |> MessageSniffer as well? If so, why? |> |> Thanks, |> |> Bill |> |> > |> > -- Original Message -- |> > From: "John Tolmachoff \(Lists\)" <[EMAIL PROTECTED]> |> > Reply-To: [EMAIL PROTECTED] |> > Date: Thu, 28 Aug 2003 09:03:45 -0700 |> > |> > Please see the link to the archives in my earlier post on this. |> > |> > John Tolmachoff MCSE CSSA |> > Engineer/Consultant |> > eServices For You |> > www.eservicesforyou.com |> > |> > |> > > -Original Message- |> > > From: [EMAIL PROTECTED] |[mailto:Declude.JunkMail- |> > > [EMAIL PROTECTED] On Behalf |Of bill.maillists |> > > Sent: Thursday, August 28, 2003 8:28 AM |> > > To: [EMAIL PROTECTED] |> > > Subject: [Declude.JunkMail] Alligate |> > > |> > > I"m already using Message Sniffer with Declude. What would |> > Alligate do |> > that |> > > Message Sniffer doesn't? |> > > |> > > Thanks, |> > > |> > > Bill Newberg |> |> --- |> [This E-mail was scanned for viruses by Declude Virus |(http://www.declude.com)] |> |> --- |> This E-mail came from the Declude.JunkMail mailing list. To |> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type |> "unsubscribe Declude.JunkMail". The archives can be found at |> http://www.mail-archive.com. | |--- |[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [IMail Forum] Webshield failing badheaders
I measured the length of the To line though and it turned out to be 1128 characters long. Could that be an issue with BADHEADERS? Would you be interested in seeing the unedited E-mail? Bug maybe? Or maybe just the occasional malformed message? The lines should be limited to 1000 characters, but the BADHEADERS test won't check for that. If you could send the full headers (either on- or off-list), that would be helpful. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [IMail Forum] Webshield failing bad headers
Scott, first thanks for all the answers you provide here, I know that it
takes you a ton of time to monitor this group and provide the assistance
that you do!
Secondly... :( I'm afraid that all the E-mail addresses are on the
same line. Blocking Hotmail could be a bad thing, though I couldn't
find any other examples in the 1,200 messages, though I'm not at all
confident that there weren't other messages that were sent to my customers.
I measured the length of the To line though and it turned out to be 1128
characters long. Could that be an issue with BADHEADERS? Would you be
interested in seeing the unedited E-mail? Bug maybe? Or maybe just the
occasional malformed message?
Thanks,
Matt
R. Scott Perry wrote:
I did actually set up the BADHEADERS filter last night and I just
caught a false positive (though a BADHEADER positive). I don't have
the error being written to the E-mail headers, but I looked it up on
Scott's tool's page from the code in the log file and got back "This
E-mail has a made-up header that does not follow the standard RFC
format for an E-mail header." Any ideas??? Could it have barfed on
the ~50 addresses in the To line???
This is valid content and seems to have been sent through HotMail???
It doesn't look strange to me (but what do I know).
I'm guessing the bogus header was what seemed to be part of the To:
headers. For example:
To: [EMAIL PROTECTED],
[EMAIL PROTECTED],
[EMAIL PROTECTED],
[EMAIL PROTECTED],
[EMAIL PROTECTED]
contains a bogus header ("[EMAIL PROTECTED]," is treated as a header
separate from the "To:" header).
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test is different between header and log
Well yes, but if I see the IPNOTINMX as failed in the header, should it not also show in the log? No -- because it has a weight of 0, it is not listed. The line with the "nNOLEGITCONTENT" in it is used for determining how Declude JunkMail arrived at the total weight for the E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test is different between header and log
Well yes, but if I see the IPNOTINMX as failed in the header, should it not also show in the log? The nNOLEGITCONTENT was the *only* entry in the log. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Friday, August 29, 2003 10:15 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Test is different between > header and log > > > > >Here is the associated log output for that message and it > shows a different > >test as failed: > > > >Q809c2823013c78d3 nNOLEGITCONTENT:-3 . Total weight = -3 > > > >How come? > > At LOGLEVEL MID, you'll see that line -- the "n" means > "negative", so the > E-mail did not fail the NOLEGITCONTENT test (and therefore > had 3 points > removed from its score). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Test is different between header and log
Here is the associated log output for that message and it shows a different test as failed: Q809c2823013c78d3 nNOLEGITCONTENT:-3 . Total weight = -3 How come? At LOGLEVEL MID, you'll see that line -- the "n" means "negative", so the E-mail did not fail the NOLEGITCONTENT test (and therefore had 3 points removed from its score). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [IMail Forum] Webshield failing badheaders
I did actually set up the BADHEADERS filter last night and I just caught a
false positive (though a BADHEADER positive). I don't have the error
being written to the E-mail headers, but I looked it up on Scott's tool's
page from the code in the log file and got back "This E-mail has a made-up
header that does not follow the standard RFC format for an E-mail
header." Any ideas??? Could it have barfed on the ~50 addresses in the
To line???
This is valid content and seems to have been sent through HotMail??? It
doesn't look strange to me (but what do I know).
I'm guessing the bogus header was what seemed to be part of the To:
headers. For example:
To: [EMAIL PROTECTED],
[EMAIL PROTECTED],
[EMAIL PROTECTED],
[EMAIL PROTECTED],
[EMAIL PROTECTED]
contains a bogus header ("[EMAIL PROTECTED]," is treated as a header
separate from the "To:" header).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] [IMail Forum] Webshield failing bad headers
I did actually set up the BADHEADERS filter last night and I just caught a false positive (though a BADHEADER positive). I don't have the error being written to the E-mail headers, but I looked it up on Scott's tool's page from the code in the log file and got back "This E-mail has a made-up header that does not follow the standard RFC format for an E-mail header." Any ideas??? Could it have barfed on the ~50 addresses in the To line??? This is valid content and seems to have been sent through HotMail??? It doesn't look strange to me (but what do I know). Thanks, Matt >From <[EMAIL PROTECTED]> Fri Aug 29 12:41:55 2003 Received: from hotmail.com [64.4.27.106] by peckspages.com with ESMTP (SMTPD32-7.13) id A24F261D0150; Fri, 29 Aug 2003 12:41:51 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Fri, 29 Aug 2003 09:41:48 -0700 Received: from 129.130.205.148 by by8fd.bay8.hotmail.msn.com with HTTP; Fri, 29 Aug 2003 16:41:32 GMT X-Originating-IP: [129.130.205.148] X-Originating-Email: [[EMAIL PROTECTED]] From: "CBC News" <[EMAIL PROTECTED]> To: (removed long list of E-mail addresses) Subject: Last reminder Date: Fri, 29 Aug 2003 16:41:32 + Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: <[EMAIL PROTECTED]> X-OriginalArrivalTime: 29 Aug 2003 16:41:48.0938 (UTC) FILETIME=[71074EA0:01C36E4C] X-Declude-Sender: [EMAIL PROTECTED] [64.4.27.106] X-Note: This E-mail was scanned by iGaia Incorporated's E-mail service (www.igaia.com) for spam. X-Note: This E-mail was sent from bay8-f106.bay8.hotmail.com ([64.4.27.106]). X-Spam-Tests-Failed: NOPOSTMASTER, BADHEADERS, IPNOTINMX, HEURISTICS-2 [4] X-RCPT-TO: <[EMAIL PROTECTED]> Status: R X-UIDL: 362044561 Matthew Bramble wrote: Could someone help me with a little more detail on this. I'm wondering specifically about if this affects networks behind Webshield SMTP, or E-mail coming from a network protected by Webshield SMTP...or something else? The message below seems to be generated by Webshield SMTP in response to an E-mail with a virus in it, and it includes an improperly formatted Date field (Date: Tue Aug 26 16:48:12 2003). Would this affect anything besides automated notifications originating from Webshield SMTP? Scott, you also mentioned that you believed it was safe to fail automatically on BADHEADERS because such E-mail will also be rejected by other servers, not just a Declude protected one. I'm wondering if these other such servers are common, and therefore enough of an issue that non-complient products would be compelled to fix their code. I would imagine that some of your tests in BADHEADERS are less serious than others, possibly the date for instance, and those might be passed by most mail servers. I have found in the last 36 hours of monitoring that failing E-mail based on BADHEADERS would clean up about 1/3 of the spam that is getting through, and in that time, I haven't caught a legit E-mail that failed this test, though I haven't set up a catch account for it specifically, but will do momentarily. I can't remember what exactly it was that made me reduce the score to just 3/10, but I'm sure it was necessary in order to let something through that I believed was important, though this might have been the result of the test catching an automated notification from a firewall. If others have more examples of BADHEADERS false positives, please send them along, I would appreciate this greatly. Thanks in advance for any insight. Matt Marc Catuogno wrote: Scott-After reading your e-mail recommending that you can hold on bad headers I tripled the weight. Although I really don't care much that this was held right now if virus did really come through my server I would like to get this. Any idea why a Webshield Alert would fail BADHEADERS? (if that is where this is really from...) Received: from ASSENTOR4.corp.isib.net [199.250.13.98] by mail.prudentialrand.com with ESMTP (SMTPD32-7.15) id A5AE450008A; Tue, 26 Aug 2003 17:48:30 -0400 Received: from MSMP2.corp.isib.net (unverified) by ASSENTOR4.corp.isib.net (Content Technologies SMTPRS 4.2.10) with ESMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>; Tue, 26 Aug 2003 16:48:11 -0500 Received: from SMTPAV2.corp.isib.net (unverified) by MSMP2.corp.isib.net (Content Technologies SMTPRS 4.2.5) with SMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>; Tue, 26 Aug 2003 16:48:11 -0500 Message-ID: <[EMAIL PROTECTED]> X-Mailer: Network Associates, Inc. Webshield SMTP, Version 4.5 Date: Tue Aug 26 16:48:12 2003 To: <[EMAIL PROTECTED]> From: [EMAIL PROTECTED] Subject: [SPAM]Virus Detected by Network Associates, Inc. Webshield SMTP V4.5 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [801e]. X-RBL-Warning: HELOBOGUS: Domain ASSENTOR4.corp.isib.net has no MX or A records. X-RBL-Warning: WEIGHT10: Weight of 20 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL P
[Declude.JunkMail] Test is different between header and log
Scott: Here's a partial header from a message and it shows clearly that the spam test failed was IPNOTINMX X-Declude-Spoolname: D809c2823013c78d3.SMD X-Note: This E-mail was sent from tandem.alberni.net ([64.141.6.11]). X-Note: This E-mail was scanned for spam by Declude JunkMail. X-Spam-Tests-Failed: IPNOTINMX [-3] Here is the associated log output for that message and it shows a different test as failed: Q809c2823013c78d3 nNOLEGITCONTENT:-3 . Total weight = -3 How come? Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [IMail Forum] Webshield failing badheaders
Could someone help me with a little more detail on this. I'm wondering specifically about if this affects networks behind Webshield SMTP, or E-mail coming from a network protected by Webshield SMTP...or something else? WebShield simply has a lot of problems. The message below seems to be generated by Webshield SMTP in response to an E-mail with a virus in it, and it includes an improperly formatted Date field (Date: Tue Aug 26 16:48:12 2003). Would this affect anything besides automated notifications originating from Webshield SMTP? It should not. There are other catches with WebShield, though -- one of the main ones being that most (all?) versions hide the IP address of the source of the E-mail, making spammer's lives a lot easier (WebShield hides their IP), and making it much harder to stop spam. Scott, you also mentioned that you believed it was safe to fail automatically on BADHEADERS because such E-mail will also be rejected by other servers, not just a Declude protected one. Correct. For example, depending on the severity of the issue, a mail client may simply delete the E-mail. The most common problem (Date: headers that are bogus) typically force the E-mail to the top of the inbox, where they may not be seen for days/weeks. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [IMail Forum] Webshield failing bad headers
Could someone help me with a little more detail on this. I'm wondering specifically about if this affects networks behind Webshield SMTP, or E-mail coming from a network protected by Webshield SMTP...or something else? The message below seems to be generated by Webshield SMTP in response to an E-mail with a virus in it, and it includes an improperly formatted Date field (Date: Tue Aug 26 16:48:12 2003). Would this affect anything besides automated notifications originating from Webshield SMTP? Scott, you also mentioned that you believed it was safe to fail automatically on BADHEADERS because such E-mail will also be rejected by other servers, not just a Declude protected one. I'm wondering if these other such servers are common, and therefore enough of an issue that non-complient products would be compelled to fix their code. I would imagine that some of your tests in BADHEADERS are less serious than others, possibly the date for instance, and those might be passed by most mail servers. I have found in the last 36 hours of monitoring that failing E-mail based on BADHEADERS would clean up about 1/3 of the spam that is getting through, and in that time, I haven't caught a legit E-mail that failed this test, though I haven't set up a catch account for it specifically, but will do momentarily. I can't remember what exactly it was that made me reduce the score to just 3/10, but I'm sure it was necessary in order to let something through that I believed was important, though this might have been the result of the test catching an automated notification from a firewall. If others have more examples of BADHEADERS false positives, please send them along, I would appreciate this greatly. Thanks in advance for any insight. Matt Marc Catuogno wrote: Scott-After reading your e-mail recommending that you can hold on bad headers I tripled the weight. Although I really don't care much that this was held right now if virus did really come through my server I would like to get this. Any idea why a Webshield Alert would fail BADHEADERS? (if that is where this is really from...) Received: from ASSENTOR4.corp.isib.net [199.250.13.98] by mail.prudentialrand.com with ESMTP (SMTPD32-7.15) id A5AE450008A; Tue, 26 Aug 2003 17:48:30 -0400 Received: from MSMP2.corp.isib.net (unverified) by ASSENTOR4.corp.isib.net (Content Technologies SMTPRS 4.2.10) with ESMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>; Tue, 26 Aug 2003 16:48:11 -0500 Received: from SMTPAV2.corp.isib.net (unverified) by MSMP2.corp.isib.net (Content Technologies SMTPRS 4.2.5) with SMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>; Tue, 26 Aug 2003 16:48:11 -0500 Message-ID: <[EMAIL PROTECTED]> X-Mailer: Network Associates, Inc. Webshield SMTP, Version 4.5 Date: Tue Aug 26 16:48:12 2003 To: <[EMAIL PROTECTED]> From: [EMAIL PROTECTED] Subject: [SPAM]Virus Detected by Network Associates, Inc. Webshield SMTP V4.5 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [801e]. X-RBL-Warning: HELOBOGUS: Domain ASSENTOR4.corp.isib.net has no MX or A records. X-RBL-Warning: WEIGHT10: Weight of 20 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [199.250.13.98] X-Declude-Spoolname: Dd5ae0450008aaab3.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: BADHEADERS, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, WEIGHT10, WEIGHT20, WEIGHT15 [20] X-Note: This E-mail was sent from mplfw2.dainrauscher.com ([199.250.13.98]). SMTPAV1: Network Associates WebShield SMTP V4.5 on SMTPAV2 detected virus W32/[EMAIL PROTECTED] in attachment thank_you.pif from <[EMAIL PROTECTED]> and it was Cleaned and Quarantined. RBC Dain Rauscher does not accept buy, sell or cancel orders by e-mail, or any instructions by e-mail that would require your signature. Information contained in this communication is not considered an official record of your account and does not supersede normal trade confirmations or statements. Any information provided has been prepared from sources believed to be reliable but is not guaranteed, does not represent all available data necessary for making investment decisions and is for informational purposes only. This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you receive this e-mail in error, please advise me (by return e-mail or otherwise) immediately. Information received by or sent from this system is subject to review by supervisory personnel, is retained and may be produced to regulatory authorities or others with a legal right to the information. --- [This E-mail scanned for viruses by Declude Virus] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, August 26, 2003 01:54
RE: [Declude.JunkMail] AUTO Whitelist question
http://www.eservicesforyou.com/products/autowhite.html John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You 626-737-6003 [EMAIL PROTECTED] www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Greg Foulks > Sent: Friday, August 29, 2003 8:34 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > What - I missed something... autolist by who you send email to? > > This would be awesome! Then I could block all email coming in and then my > users could still get email from those they specify > > Where do I get this? > > Greg > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Robert > Grosshandler > Sent: Friday, August 29, 2003 11:20 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AUTO Whitelist question > > > Also, check out autowhite. It automatically whitelists an e-mail address > when you send e-mail to that address. > > While it has more flexibility than that, that's the simplest description. > > I immediately went to Outlook, and sent e-mail to anybody I cared about, and > now I know that I'll get whatever they send me, even if it normally would > trigger all of the anti-spam (but not anti-virus) stuff we have running. > > I don't have a great link for it, but it is in the archive. > > Rob > > === > Robert N. Grosshandler > www.iGive.com > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > -- > [This E-mail was scanned for viruses by Declude Virus Scanner on > mail.nfti.com] > > > -- > [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
What - I missed something... autolist by who you send email to? This would be awesome! Then I could block all email coming in and then my users could still get email from those they specify Where do I get this? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Robert Grosshandler Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
Ops sorry. It doesn't count how often a remote sender has send messages to the local recipient. Instead it's counting how often the local user has send messages to the remote user. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AUTO Whitelist question
A correction is in order I believe. According to John's site, his application counts how often you send messages to a particular address instead of how many messages are received from that address. Matt Markus Gufler wrote: John Tolmachoff [[EMAIL PROTECTED]] has written a nice addon for declude (external test) This test "counts" how often a local recipient has received messages from a remote sender. You can define exactly how much negative points should receive any message from a sender that was already in contact with the recipient n times. Helps definitely to reduce false positives, but is powerless on the first contact. My opinion is that is more usefull then addressbock-whitelisting because it works automatically without any user interaction. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Friday, August 29, 2003 4:54 PM To: Declude JunkMail (E-mail) Subject: [Declude.JunkMail] AUTO Whitelist question How does AUTO Whitelist work? Wouldn't users have to have their address books stored on the Imail server for this to work? Greg Foulks NewFound Technologies, Inc. [EMAIL PROTECTED] http://www.nfti.com 614.318.5036
RE: [Declude.JunkMail] AUTO Whitelist question
Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
John Tolmachoff [EMAIL PROTECTED] has written a nice addon for declude (external test) This test "counts" how often a local recipient has received messages from a remote sender. You can define exactly how much negative points should receive any message from a sender that was already in contact with the recipient n times. Helps definitely to reduce false positives, but is powerless on the first contact. My opinion is that is more usefull then addressbock-whitelisting because it works automatically without any user interaction. Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > Sent: Friday, August 29, 2003 4:54 PM > To: Declude JunkMail (E-mail) > Subject: [Declude.JunkMail] AUTO Whitelist question > > How does AUTO Whitelist work? > > Wouldn't users have to have their address books stored on the Imail server > for this to work? > > Greg Foulks > NewFound Technologies, Inc. > [EMAIL PROTECTED] > http://www.nfti.com > 614.318.5036 > <>
[Declude.JunkMail] Osirusoft replacement ?
trying again anyone have any good replacements after this one died ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AUTO Whitelist question
How does AUTO Whitelist work? If you add a line "AUTOWHITELIST ON" to the \IMail\Declude\global.cfg file (with v1.75 or higher), Declude JunkMail will automatically whitelist E-mail if the sender is listed in the recipient's web messaging address book. Wouldn't users have to have their address books stored on the Imail server for this to work? That is correct. There is no way to query the address book of a mail client. So this means that the feature is useful to [1] users who currently use web messaging, and [2] users who want to whitelist specific E-mail addresses, and are willing to use web messaging to add them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AUTO Whitelist question
How does AUTO Whitelist work? Wouldn't users have to have their address books stored on the Imail server for this to work? Greg Foulks NewFound Technologies, Inc. [EMAIL PROTECTED] http://www.nfti.com 614.318.5036 <>
Re: [Declude.JunkMail] Is there a limit to the # of blacklistentries?
I have this line in my blacklist file revealsystems.net spammed many Yet an e-mail with the following headers keeps getting through: X-RBL-Warning: WEIGHT25: Weight of 27 reaches or exceeds the limit of 25. X-Declude-Sender: [EMAIL PROTECTED] [207.174.23.4] X-Declude-Spoolname: D8d6f041e00b07343.SMD Now it is on line 1651 of my file - is there a limit? I didn't notice one specified in the manual... That E-mail should get caught (there is no limit to the number of entries in the file). Is is the last entry? If so, you should make sure that there is a carriage return at the end of the line. Are you sure there are no typos in the line? What version of Declude JunkMail are you running (you can type "\IMail\Declude -diag" from a command prompt to find out)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IMAIL directory
Just noticed many bregDDMM files in my imail directory. anyone knows what these are. Could that stand for registry backup? That would be my guess. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Osirusoft replacement ?
anyone have any good replacements after this one died ? Benny --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IMAIL directory
yes, nothing readble - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, August 29, 2003 6:49 AM Subject: RE: [Declude.JunkMail] IMAIL directory > Have you tried opening one in notepad? > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of serge > > Sent: Thursday, August 28, 2003 6:36 PM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] IMAIL directory > > > > Just noticed many bregDDMM files in my imail directory. > > anyone knows what these are. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IMAIL directory
Have you tried opening one in notepad? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of serge > Sent: Thursday, August 28, 2003 6:36 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] IMAIL directory > > Just noticed many bregDDMM files in my imail directory. > anyone knows what these are. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is there a limit to the # of blacklist entries?
I have this line in my blacklist file revealsystems.net spammed many Yet an e-mail with the following headers keeps getting through: X-RBL-Warning: WEIGHT25: Weight of 27 reaches or exceeds the limit of 25. X-Declude-Sender: [EMAIL PROTECTED] [207.174.23.4] X-Declude-Spoolname: D8d6f041e00b07343.SMD Now it is on line 1651 of my file - is there a limit? I didn't notice one specified in the manual... --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IMAIL directory
Just noticed many bregDDMM files in my imail directory. anyone knows what these are. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
