Re: [Declude.JunkMail] negative weight filters?

[DLAnalyzer Support]

We have been creating negative weight filters based on reverse DNS. 

REVDNS-3  ENDSWITH .dell.com 

Darrell

Check Out DLAnalyzer a comprehensive reporting tool for
Declude Junkmail Logs - http://www.dlanalyzer.com 

Administration writes: 

Hello,
I was wondering if any one could show me some examples of what they are using
for negative weight filters? It would seem that i'm catching alot of legit mail
in a last few weeks, mostly just mailing lists and ebay messages. 

thanks in advance for your time!
ken 

---
[This E-mail scanned for viruses by Declude Virus] 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Legitimate AOL Messages being tagged as spam

[R. Scott Perry]

I've been watching email go thru the system and all messages from AOL.COM 
are being tagged as spam.  The following tests for each email are failed: 
BADSENDERS:5 NOABUSE:2 NOPOSTMASTER:1 nNON_ENGLISH:3 .  Total weight = 
11.Does anyone else have this problem?  or have a suggestion as 
possible correction?
Well, the first question would be "What is your BADSENDERS test?"

The second would be why you are penalizing E-mails for being in 
English?  Is that intentional?  "nNON_ENGLISH:3" means that you are adding 
3 points to the weight of E-mail that does not fail the NON_ENGLISH test.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Legitimate AOL Messages being tagged as spam

[Kornitz, David]

I've been watching email go thru the system and all messages from AOL.COM are being 
tagged as spam.  The following tests for each email are failed: BADSENDERS:5 NOABUSE:2 
NOPOSTMASTER:1 nNON_ENGLISH:3 .  Total weight = 11.Does anyone else have this 
problem?  or have a suggestion as possible correction?

David
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] matching from and to addresses

[Jeffrey Di Gregorio]

Thanks for the response John.  Since
I am running Declude only on my gateway mail servers, and not on my internal
exchange server (where all my clients are), I do not think this is such an
issue for me.  Do you know of a way that Declude Junkmail could perform this
type of test?

Thanks for any advice,

 

Jeffrey

 

-Original Message-
From: John Tolmachoff (Lists)
[mailto:[EMAIL PROTECTED] 
Sent: Tuesday, December 09, 2003
3:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
matching from and to addresses

 

CEOs and others that like
to send copies to themselves.

 



John
Tolmachoff

Engineer/Consultant/Owner

eServices
For You



 



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Jeffrey Di Gregorio
Sent: Tuesday, December 09, 2003
1:13 PM
To: '[EMAIL PROTECTED]'
Subject: [Declude.JunkMail]
matching from and to addresses

 

Hello,

 

I'm not sure if I'm missing
something very simple here, but is there a way to add a weight when an email
has a matching from and to address, or is there a reason why this type of a
test is not a good idea.

 

Thanks for any help,

 

Jeffrey

 

 

 

Jeffrey Di Gregorio

Systems Administrator

Pacific School of Religion

510-849-8283

 

RE: [Declude.JunkMail] Minor Error on List of All Known DNS-based Spam Databases

[Andy Schmidt]

But make sure you use -DUL (not -DUHL) in your config file - so that Declude
knows to apply that test only to the last hop. Correct?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday, December 09, 2003 06:56 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Minor Error on List of All Known DNS-based
Spam Databases



>On this list...
>
>http://www.declude.com/junkmail/support/ip4r.htm
>
>you have an IP4R test identified as SORBS-DUHL.  Shouldn't that be 
>SORBS-DUL?

They actually just recently changed the name (see 
http://www.dnsbl.us.sorbs.net/NEWS.html ).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] matching from and to addresses

[John Tolmachoff \(Lists\)]

CEOs and others that like to send copies
to themselves.

 



John Tolmachoff

Engineer/Consultant/Owner

eServices For You



 



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Jeffrey Di Gregorio
Sent: Tuesday,
 December 09, 2003 1:13 PM
To: '[EMAIL PROTECTED]'
Subject: [Declude.JunkMail]
matching from and to addresses

 

Hello,

 

I'm not sure if I'm missing something very simple here, but
is there a way to add a weight when an email has a matching from and to
address, or is there a reason why this type of a test is not a good idea.

 

Thanks for any help,

 

Jeffrey

 

 

 

Jeffrey Di Gregorio

Systems Administrator

Pacific School of Religion

510-849-8283

 

RE: [Declude.JunkMail] Per user tests....

[R. Scott Perry]

Ahh. OK. I am getting it now. So, to whitelist for that particular users
fromfile, I would set the test to assign weight 0 in my global.cfg, and
then in the users config file ( a renamed copy of the $junkmail file ),
I would use a ROUTETO statement ?
Is this correct ?
That should work fine.  That way, E-mail failing the test that is sent to 
the one user to get caught, but if it is sent to other users, it will not 
get caught (although it would appear in the X-Spam-Tests-Failed: header).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Minor Error on List of All Known DNS-based Spam Databases

[R. Scott Perry]

On this list...

http://www.declude.com/junkmail/support/ip4r.htm

you have an IP4R test identified as SORBS-DUHL.  Shouldn't that be
SORBS-DUL?
They actually just recently changed the name (see 
http://www.dnsbl.us.sorbs.net/NEWS.html ).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Per user tests....

[IS - Systems Eng. (Karl Drugge)]

Ahh. OK. I am getting it now. So, to whitelist for that particular users
fromfile, I would set the test to assign weight 0 in my global.cfg, and
then in the users config file ( a renamed copy of the $junkmail file ),
I would use a ROUTETO statement ?

Is this correct ?


Karl Drugge
 
 
 
 
 
 

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, December 09, 2003 5:58 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Per user tests


> > Tests in Declude JunkMail are global.  The best you can do for a
per-user
> > test is one that runs for everyone, but actions are only taken on
the test
> > for specific user(s).

>If I define the tests ( ie: a fromfile ) in the global.cfg, how do I
>make it apply for only one person in the $junkmail file ?

By having the default file not take any action ("TESTNAME IGNORE"), and 
having the per-use config file take an action ("TESTNAME HOLD", for
example).

>I thought points were assigned in the global.cfg, and the $junkmail
file 
>just told
>declude what to do with the final point value ?

Close.

The weight is determined by the global.cfg file.  The $default$.JunkMail

file is used to determine the actions to take on tests.

I would recommend not assigning any weight to the per-user test, as that

weight would be applied to all users.  Instead, you can have the weight
set 
to 0, and use "TESTNAME HOLD" (or "TESTNAME DELETE" or whatever).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Per user tests....

[R. Scott Perry]

> Tests in Declude JunkMail are global.  The best you can do for a per-user
> test is one that runs for everyone, but actions are only taken on the test
> for specific user(s).

If I define the tests ( ie: a fromfile ) in the global.cfg, how do I
make it apply for only one person in the $junkmail file ?
By having the default file not take any action ("TESTNAME IGNORE"), and 
having the per-use config file take an action ("TESTNAME HOLD", for example).

I thought points were assigned in the global.cfg, and the $junkmail file 
just told
declude what to do with the final point value ?
Close.

The weight is determined by the global.cfg file.  The $default$.JunkMail 
file is used to determine the actions to take on tests.

I would recommend not assigning any weight to the per-user test, as that 
weight would be applied to all users.  Instead, you can have the weight set 
to 0, and use "TESTNAME HOLD" (or "TESTNAME DELETE" or whatever).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Minor Error on List of All Known DNS-based Spam Databases

[Dan Geiser]

Hi, Scott,
On this list...

http://www.declude.com/junkmail/support/ip4r.htm

you have an IP4R test identified as SORBS-DUHL.  Shouldn't that be
SORBS-DUL?

Just Curious,
Dan Geiser [EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Per user tests....

[IS - Systems Eng. (Karl Drugge)]

OK, I guess I can deal with that. A bit processor intensive for one PITA
user, but if that's the way it is... 

If I define the tests ( ie: a fromfile ) in the global.cfg, how do I
make it apply for only one person in the $junkmail file ? I thought
points were assigned in the global.cfg, and the $junkmail file just told
declude what to do with the final point value ? Even if I assign the
user there own $junkmail file, I still have to play with the points in
the tests given in the global.cfg, yes ? 

Karl Drugge
 
 
 
 
 
 

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, December 09, 2003 5:23 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Per user tests


>Where do I define per user tests ?

Tests in Declude JunkMail are global.  The best you can do for a
per-user 
test is one that runs for everyone, but actions are only taken on the
test 
for specific user(s).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Per user tests....

[R. Scott Perry]

Where do I define per user tests ?
Tests in Declude JunkMail are global.  The best you can do for a per-user 
test is one that runs for everyone, but actions are only taken on the test 
for specific user(s).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Per user tests....

[IS - Systems Eng. (Karl Drugge)]

Argh. I know this has been covered buy I can't find it in my own
archives from the group..

Where do I define per user tests ? I am trying to use the REDIRECT (
REDIRECT [EMAIL PROTECTED] c:\dir\dir\username.txt ) statement to point at
a username.txt with their own configs in it. Particularly their own word
and fromfile filters. Do I copy and rename the $junkmail file ? Where do
their own tests get defined ? Do I copy and rename the global.cfg ?

I am looking in the dec.log files and not finding any errors or
something that tells me that the user is using their own tests or cfg
file ...


Karl Drugge
 
 
 
 
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] matching from and to addresses

[Jeffrey Di Gregorio]

Hello,

 

I'm not sure if I'm missing something very
simple here, but is there a way to add a weight when an email has a matching
from and to address, or is there a reason why this type of a test is not a good
idea.

 

Thanks for any help,

 

Jeffrey

 

 

 

Jeffrey Di Gregorio

Systems Administrator

Pacific School of Religion

510-849-8283

 

RE: [Declude.JunkMail] no Subject or Contents

[R. Scott Perry]

I tried to look at the source for the body and it would not let me. Plus
when I open the message it says Untitled - Message (Plain Text).
So that would mean it is blank, right?
Perhaps -- it would depend on your mail client.  However, if it doesn't let 
you view the source, I would be suspicious -- that could indicate a bug or 
problem with the mail client (IE sometimes can't display the source of a 
page, but it seems to usually be caused by a lack of resources).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] no Subject or Contents

[Danny Klopfer]

I tried to look at the source for the body and it would not let me. Plus
when I open the message it says Untitled - Message (Plain Text).

So that would mean it is blank, right?




> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
> Sent: Tuesday, December 09, 2003 12:47 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] no Subject or Contents
>
>
>
> >I have seen 2 messages now that have nothing in the subject and
> nothing in
> >the body.  Is there a way to block these?
>
> You should be able to use a line such as "SUBJECT 3 ISBLANK" in a filter
> file to get the blank subject.  "BODY 3 ISBLANK" would work in the latest
> beta, but only if the body really is blank (most blank E-mails aren't
> really blank, but have HTML codes or other hidden stuff in them).
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] no Subject or Contents

[John Tolmachoff \(Lists\)]

Filter file in JunkMail Pro:

SUBJECT (weight) ISBLANK

BODY (weight) ISBLANK

However, it does not appear the BODY ISBLANK works as there is usually
something there, such as a CR or SPACE or so forth.

Also, if you are not using Declude Virus to stop vulnerabilities, an message
with a vulnerability or broken sending e-mail client could format the header
to where a small HTML body could end up being in the header.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Danny Klopfer
> Sent: Tuesday, December 09, 2003 12:18 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] no Subject or Contents
> 
> I have seen 2 messages now that have nothing in the subject and nothing in
> the body.  Is there a way to block these?
> 
> What's weird is the message has a WEIGHT that should add something the
> Subject but it does not add it.
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] no Subject or Contents

[R. Scott Perry]

I have seen 2 messages now that have nothing in the subject and nothing in
the body.  Is there a way to block these?
You should be able to use a line such as "SUBJECT 3 ISBLANK" in a filter 
file to get the blank subject.  "BODY 3 ISBLANK" would work in the latest 
beta, but only if the body really is blank (most blank E-mails aren't 
really blank, but have HTML codes or other hidden stuff in them).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] WAMCHECK External Plus Program

[Bill Morgan]

Hi,


I see from my log files that several people have downloaded my WAMCHECK
external plus program for whitelisting/blacklisting messages.
Unfortunately, I discovered an error in the program over the weekend.
The error could occur when the message had no subject line.  I didn't
discover this until I installed the program on a Server-2003 server.  I
have fixed this problem and have tested it with 150,000 messages with no
errors.  Anyone that downloaded the program prior to today should
replace it with this latest version.

http://www.wamusa.com/wamcheck

Thanks,
Bill

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] no Subject or Contents

[Danny Klopfer]

I have seen 2 messages now that have nothing in the subject and nothing in
the body.  Is there a way to block these?

What's weird is the message has a WEIGHT that should add something the
Subject but it does not add it.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] High weight for mail FROM our own list/alias addresses?

[Todd Ryan]

We use only alias addresses on our web site so we have more general 
contact addresses to give out.  We also have a few open lists because 
they need to allow non list members to send mail to them.

On occasion where we get spam that doesn't reach our hold or delete 
threshhold, the consequences are more pronounced when it is sent to one 
of these lists or aliases since a large number of people get it.  I've 
noticed that in most cases, the spammer used the list/alias address as 
the TO and FROM address like they commonly do.

I think I can stop this by giving a high weight to mail coming FROM any 
of our list or alias addresses.  Can someone check my logic on this 
before I do this?  For example, if we DELETE at 250, and I give a weight 
of 250 to anything coming from [EMAIL PROTECTED], this should never 
interfere with legitimate mail, right?  Am I correct in assuming that 
list mail should never come FROM the list address?  Wouldn't it either 
come from the list owner address or the original sender?  Is there any 
case where this would accidentally block legitimate mail?

Thanks!

--Todd.

 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] TLD blacklist

[R. Scott Perry]

COUNTRIES   CONTAINS10   kr,cn,br,fr
This filter line should actually be:

COUNTRIES   CONTAINS10   kr
COUNTRIES   CONTAINS10   cn
COUNTRIES   CONTAINS10   br
COUNTRIES   CONTAINS10   fr
since there is no country code that contains "kr,cn,br,fr".  This does 
require Declude JunkMail Pro.  Also note that the COUNTRIES filter (which 
requires setting up the experimental all_list.dat file) works on the actual 
country of origin (as opposed to a claimed country of origin, such as in 
the return address or HELO/EHLO).

We are looking into a test that would compare all the various countries 
(which would catch an E-mail from [EMAIL PROTECTED] that is sent from Korea, 
for example).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] TLD blacklist

[Andy Ognenoff]

Yes...but doesn't that require Declude Pro?

- Andy

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Administration
> Sent: Tuesday, December 09, 2003 8:24 AM
> To: Andy Ognenoff
> Subject: Re: [Declude.JunkMail] TLD blacklist
>
> Hello Andy,
>
> do u mean something like this?
>
> COUNTRIES   CONTAINS10   kr,cn,br,fr
> # country code http://www.iana.org/cctld/cctld-whois.htm
>
>
> ken
>
>
>
> Monday, December 8, 2003, 1:07:03 PM, you wrote:
>
> AO> I was just checking out the archives and I came across someone with
> the same
> AO> problem as I but I wanted to see if there has been any additional work
> or
> AO> suggestions about it.
>
> AO> I want to blacklist some TLDs using Declude (Standard).  Scott
> answered that
> AO> it's not reliable but offered a suggestion of giving the test a high
> AO> weight...
>
> AO> Has there been any additional work on this (the post was from a year
> ago)
> AO> and if not what is the best way to accomplish this?  Specifically I
> get a
> AO> lot of spam from .de and .fr with no legit messages coming from them.
>
> AO> Thanks!
>
> AO> Andy Ognenoff
> AO> Online Systems Administrator
> AO> -
> AO> Cousins Submarines, Inc.
> AO> http://www.cousinssubs.com
>
>
>
> AO> ---
> AO> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> AO> ---
> AO> This E-mail came from the Declude.JunkMail mailing list.  To
> AO> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> AO> type "unsubscribe Declude.JunkMail".  The archives can be found
> AO> at http://www.mail-archive.com.
> AO> ---
> AO> [This E-mail scanned for viruses by Declude Virus]
>
>
>
>
> --
> Best regards,
>  Administrationmailto:[EMAIL PROTECTED]
>
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] negative weight filters?

[Administration]

Hello,
I was wondering if any one could show me some examples of what they are using
for negative weight filters? It would seem that i'm catching alot of legit mail
in a last few weeks, mostly just mailing lists and ebay messages.

thanks in advance for your time!
ken

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] TLD blacklist

[Administration]

Hello Andy,

do u mean something like this?

COUNTRIES   CONTAINS10   kr,cn,br,fr
# country code http://www.iana.org/cctld/cctld-whois.htm


ken



Monday, December 8, 2003, 1:07:03 PM, you wrote:

AO> I was just checking out the archives and I came across someone with the same
AO> problem as I but I wanted to see if there has been any additional work or
AO> suggestions about it.

AO> I want to blacklist some TLDs using Declude (Standard).  Scott answered that
AO> it's not reliable but offered a suggestion of giving the test a high
AO> weight...

AO> Has there been any additional work on this (the post was from a year ago)
AO> and if not what is the best way to accomplish this?  Specifically I get a
AO> lot of spam from .de and .fr with no legit messages coming from them.

AO> Thanks!

AO> Andy Ognenoff
AO> Online Systems Administrator
AO> -
AO> Cousins Submarines, Inc.
AO> http://www.cousinssubs.com



AO> ---
AO> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

AO> ---
AO> This E-mail came from the Declude.JunkMail mailing list.  To
AO> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
AO> type "unsubscribe Declude.JunkMail".  The archives can be found
AO> at http://www.mail-archive.com.
AO> ---
AO> [This E-mail scanned for viruses by Declude Virus]




-- 
Best regards,
 Administrationmailto:[EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] END statement in filters

[R. Scott Perry]

Is anyone using the END statement in filters successfully?  I am finding 
on my server that if I have an END anywhere in a filter it always ends, 
whether it matches that statement or not.
There is indeed a problem with END -- we are working on a fix for it.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Outgoing mail?

[R. Scott Perry]

Can something be added to the wish list?

XOUTHEADER:  For abuse please contact 
[EMAIL PROTECTED]

This way we can give a little customization to the header for separate 
domains.
That already is possible.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Outgoing mail?

[Kami Razvan]

Hi;
 
Can something be 
added to the wish list?
 
XOUTHEADER:  
For abuse please contact [EMAIL PROTECTED]
 
This way we can 
give a little customization to the header for separate 
domains.
 
Regards,
Kami