[Declude.JunkMail] "Default" Hold and Delete Weights & Tracking

[Goran Jovanovic]

I know that this question is going to have a lot of "it depends" answers
but here it goes...

What are the "Default" Hold and Delete Weights that people use?

It will obviously be based on the tests that you employ and how much
weight you assign to them. In reading the JunkMail manual I got the
impression that out of the box the delete weight was 10. In talking to
some other folks I heard of Hold 20 and Delete 30. In reading Matt's
GIBBERISH filter Hold 10 and Delete 25. So I am looking for some
guidance on where to set some targets.

Now all I am doing is Subject line marking WEIGHT10+. With this I am
getting approx 77% SPAM capture and almost 0 false positives. My
WEIGHT20+ is only 41% so I have a long way to go. I want to crank up my
success capture to 95+%.

I am looking at other filers and starting to add them in slowly and
monitor the "SPAM" accounts that I have.

My other question is how do you all track and monitor how well or poorly
the SPAM tests are performing? Are there any programs to analyze the log
files? I have only found one, DLAnalyzer. Anything else? 

There is the IMail Log Analyzer but that does not tell me anything about
the JunkMail tests.

Any thoughts and insights are greatly appreciated. Thanx


 
Goran
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Proper Place To Download all_list.dat From?

[Matt]

R. Scott Perry wrote:

Right now, I can't say for certain.  Part of the problem is that while 
this is definitely a useful feature, is requires extra work to get set 
up properly, and doesn't seem to be as widely used was originally 
expected.


Have you looked at the possibility of using the Open Source GeoIP 
Country test from MaxMind?  This could save you the time in updating 
this information yourself.

   http://www.maxmind.com/app/geoip_country

Also, regarding usage, this has always been promoted as an experimental 
feature and not included in the manual or your sample configurations, 
and even the download link isn't listed anywhere on your site if I'm not 
mistaken.  If you documented the availability, described how to use it 
in your manual, and provided hints in the sample Global.cfg, usage would 
most certainly increase.

Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Whitelist To problem

[Rick Davidson]

sweet!
that will work perfectly

thanks man!

Rick Davidson
National Systems Manager
North American Title Group

-
- Original Message - 
From: "System Administrator" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, April 09, 2004 2:17 PM
Subject: Re: [Declude.JunkMail] Whitelist To problem


> on 4/9/04 1:32 PM, Rick Davidson wrote:
>
> > Is it possible to make it so that if a whitelisted TO address is
included
> > with many recipients that only that one particular address is
whitelisted
> > and not everyone in the To field?
> >
> > Whitelist To [EMAIL PROTECTED]
> >
> > recieve an email to [EMAIL PROTECTED]; [EMAIL PROTECTED];
[EMAIL PROTECTED];
> > [EMAIL PROTECTED]
>
> Not quite what you want but you can add
>
> BYPASSWHITELIST   bypasswhitelist  xx y   0  0
>
> to your global.cfg file. If a message weight exceeds "xx" and the message
> was sent to "y" or more addresses the assigned action will take place. We
> use delete and have a line in our $default$.JunkMail file(s) that is
>
> BYPASSWHITELIST DELETE
>
> Basically, this command lets the administrator have the final word as to
> what should happen with a message. We use 40 and 2 for the values.
>
> If tom wants everything whitelisted but dick, harry and joe don't then tom
> causes the others to get spam (not good). The bypasswhitelist command,
which
> isn't listed on the junkmail page, but is on the release page, let's the
> admin overrule tom, and depending upon the settings, causes none of them
to
> get the message. Tom won't miss his spam message and the others will never
> get to see it.
>
> Greg
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Whitelist To problem

[System Administrator]

on 4/9/04 1:32 PM, Rick Davidson wrote:

> Is it possible to make it so that if a whitelisted TO address is included
> with many recipients that only that one particular address is whitelisted
> and not everyone in the To field?
> 
> Whitelist To [EMAIL PROTECTED]
> 
> recieve an email to [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED];
> [EMAIL PROTECTED]

Not quite what you want but you can add

BYPASSWHITELIST   bypasswhitelist  xx y   0  0

to your global.cfg file. If a message weight exceeds "xx" and the message
was sent to "y" or more addresses the assigned action will take place. We
use delete and have a line in our $default$.JunkMail file(s) that is

BYPASSWHITELIST DELETE

Basically, this command lets the administrator have the final word as to
what should happen with a message. We use 40 and 2 for the values.

If tom wants everything whitelisted but dick, harry and joe don't then tom
causes the others to get spam (not good). The bypasswhitelist command, which
isn't listed on the junkmail page, but is on the release page, let's the
admin overrule tom, and depending upon the settings, causes none of them to
get the message. Tom won't miss his spam message and the others will never
get to see it.

Greg

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Proper Place To Download all_list.dat From?

[Rick Davidson]

> properly, and doesn't seem to be as widely used was originally expected.

Wow! I find the countries test to be extremely effective, not to good for
ISP folks but for any company that does localized business this test rocks.
I assign half my hold weight for any mail outside the US with a few
exceptions and then heavily penalize common relay countries such as korea,
china and poland and then assign full hold weight to countries that should
never be sending us mail. My spam dropped off significantly once I got it
tweaked right.

Sure would hate to loose the countries test

Rick Davidson
National Systems Manager
North American Title Group
-
- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, April 09, 2004 12:02 PM
Subject: Re: [Declude.JunkMail] Proper Place To Download all_list.dat From?


>
> >Now that 1.79 beta has been released are we supposed to download any
> >updates to all_list.dat from
> >
>
>http://www.declude.com/rel
ease/179/all_list.dat
>
> This is the correct location.
>
> >Is the current version in the path always the place to get the new
version
> >of all_list.dat?
>
> It could change, as this is still considered an experimental feature.
>
> >How often on average is all_list.dat updated?
>
> As needed.  Typically every few months.
>
> >If I come to rely on the experimental functionality which all_list.dat is
> >part of, what are the changes that this functionality is going to go
away?
>
> It is unlikely that it will go away completely; the biggest risk would be
> that the all_list.dat file can no longer be updated (this could happen,
for
> example, if one of the IP registrars decides to stop providing the
> information).
>
> >What are the changes that this experimental functionality is going to
stay
> >permanently, i.e. no longer be experimental?
>
> Right now, I can't say for certain.  Part of the problem is that while
this
> is definitely a useful feature, is requires extra work to get set up
> properly, and doesn't seem to be as widely used was originally expected.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Whitelist To problem

[Rick Davidson]

Is it possible to make it so that if a whitelisted TO address is included
with many recipients that only that one particular address is whitelisted
and not everyone in the To field?

Whitelist To [EMAIL PROTECTED]

recieve an email to [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED];
[EMAIL PROTECTED]

every tom, dick and harry gets whitelisted to

I have a spammer that is grouping addresses for my domain like this

Rick Davidson
National Systems Manager
North American Title Group

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Using COUNTRIES to Add Points for [ARIN Unlisted]

[R. Scott Perry]

In the below I think the URL you meant was
http://www.declude.com/release/179/all_list.dat.
You are correct.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Using COUNTRIES to Add Points for [ARIN Unlisted]

[Dan Geiser]

Scott,
Thanks for your quick response as always.

In the below I think the URL you meant was
http://www.declude.com/release/179/all_list.dat.

Thanks, Much!
Dan Geiser
[EMAIL PROTECTED]

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, April 09, 2004 11:59 AM
Subject: Re: [Declude.JunkMail] Using COUNTRIES to Add Points for [ARIN
Unlisted]


>
> >In addition to the standard country names which show up in the
> >X-Country-Chain: header I also see entries like "[Arin Unlisted]".  I can
> >use the country codes to check against the specific country names, e.g.
> >
> >COUNTRIES 5 CONTAINS kr
> >
> >but is there any way to add points for any of the other entries I might
> >see in the header, e.g. "[Arin Unlisted]"?
>
> My first question: Do you have the most recent all_list.dat file (from
> http://www.declude.com/179/all_list.dat)?  That will minimize the chances
> of getting the "[Arin Unlisted]".
>
> Assuming that you do have the latest all_list.dat file, the following may
> be used for filters, in cases where the country is not known:
>
>  *1 Multi-Regional
>  *2 Europe
>  *3 North America
>  *4 Central/South America
>  *5 Pacific Rim
>  *A ARIN Unlisted
>  *B Public Data Network
>  *E RIPE Unlisted
>  *I Private IP
>  *L Loopback
>  *M Multicast
>  *P APNIC Unlisted
>  *R IANA Reserved
>  *U Unknown
>
> So you could use "COUNTRIES 5 CONTAINS *A" to add 5 points to the weight
of
> E-mails coming from an IP that shows up as "ARIN Unlisted".
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] %RemoteRecps%

[Serge]

> Actually, there isn't such a variable in Declude Virus.  :)

OOps, you are correct, there is %LocalRecps% but i guess if you can compute
one, the other is as simple :)

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, April 09, 2004 11:36 AM
Subject: Re: [Declude.JunkMail] %RemoteRecps%


>
> >One of them will however need the %RemoteRecep% variable already
available
> >in delude virus
>
> Actually, there isn't such a variable in Declude Virus.  :)
>
> >Is is also available or can it be easily imported to junkmail ? (And
while
> >you are at it, %nbremoterecp% would also be very usufull)
>
> There is a good chance that we will be able to add these.
>
> >Finaly, we all know you have a feature list you work on, is it possible
to
> >publish it on your web site so we know what to expect ?
> >I understand the list is not always accurate, and some features may never
be
> >implemented, but   it will still give us some insight.
>
> Part of the problem is that we almost certainly will not be able to get to
> everything in the suggestion database.  Some of the features may only
> affect a few of our customers, some may not really be appropriate enough
to
> include, some may require much more time/effort than the benefit from
them,
> etc.  But this is something that we will consider doing.
>
> >I personaly have a wish list of less then 10 features that will make my
life
> >easier, if i do post it here, would you give me some info about which
> >features may be implemented and a rough timeframe (like few days, few
weeks,
> >few months, ...)
>
> I can try.  However, they would only be educated guesses until the
features
> are actually implemented.
>
> In general, when we look at suggestions for new features, we weigh the
> severity of the feature (if it is closer to a bug fix than a feature, it
> will get priority), what percentage of our customers would benefit from
the
> feature, and how easy it would be to implement.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Proper Place To Download all_list.dat From?

[Dan Geiser]

Hello, All,
Now that 1.79 beta has been released are we 
supposed to download any updates to all_list.dat from
 
http://www.declude.com/release/178/all_list.dat
 
or
 
http://www.declude.com/release/179/all_list.dat
 
?
 
Is the current version in the path always 
the place to get the new version of all_list.dat?
 
How often on average is all_list.dat 
updated?
 
If I come to rely on the experimental functionality 
which all_list.dat is part of, what are the changes that this functionality is 
going to go away?  What are the changes that this experimental 
functionality is going to stay permanently, i.e. no longer be 
experimental?
 
Thanks In Advance,
Dan Geiser
[EMAIL PROTECTED]

Re: [Declude.JunkMail] Proper Place To Download all_list.dat From?

[R. Scott Perry]

Now that 1.79 beta has been released are we supposed to download any 
updates to all_list.dat from

http://www.declude.com/release/179/all_list.dat
This is the correct location.

Is the current version in the path always the place to get the new version 
of all_list.dat?
It could change, as this is still considered an experimental feature.

How often on average is all_list.dat updated?
As needed.  Typically every few months.

If I come to rely on the experimental functionality which all_list.dat is 
part of, what are the changes that this functionality is going to go away?
It is unlikely that it will go away completely; the biggest risk would be 
that the all_list.dat file can no longer be updated (this could happen, for 
example, if one of the IP registrars decides to stop providing the 
information).

What are the changes that this experimental functionality is going to stay 
permanently, i.e. no longer be experimental?
Right now, I can't say for certain.  Part of the problem is that while this 
is definitely a useful feature, is requires extra work to get set up 
properly, and doesn't seem to be as widely used was originally expected.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Using COUNTRIES to Add Points for [ARIN Unlisted]

[R. Scott Perry]

In addition to the standard country names which show up in the 
X-Country-Chain: header I also see entries like "[Arin Unlisted]".  I can 
use the country codes to check against the specific country names, e.g.

COUNTRIES 5 CONTAINS kr

but is there any way to add points for any of the other entries I might 
see in the header, e.g. "[Arin Unlisted]"?
My first question: Do you have the most recent all_list.dat file (from 
http://www.declude.com/179/all_list.dat)?  That will minimize the chances 
of getting the "[Arin Unlisted]".

Assuming that you do have the latest all_list.dat file, the following may 
be used for filters, in cases where the country is not known:

*1 Multi-Regional
*2 Europe
*3 North America
*4 Central/South America
*5 Pacific Rim
*A ARIN Unlisted
*B Public Data Network
*E RIPE Unlisted
*I Private IP
*L Loopback
*M Multicast
*P APNIC Unlisted
*R IANA Reserved
*U Unknown
So you could use "COUNTRIES 5 CONTAINS *A" to add 5 points to the weight of 
E-mails coming from an IP that shows up as "ARIN Unlisted".

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Using COUNTRIES to Add Points for [ARIN Unlisted]

[Dan Geiser]

Hello, All,
In addition to the standard country names 
which show up in the X-Country-Chain: header I also see entries like "[Arin 
Unlisted]".  I can use the country codes to check against the specific 
country names, e.g.
 
COUNTRIES 5 CONTAINS kr
 
but is there any way to add points for any of the 
other entries I might see in the header, e.g. "[Arin Unlisted]"?
 
Thanks In Advance,
Dan Geiser
[EMAIL PROTECTED]

[Declude.JunkMail] SPAMDOMAIN entry for citibank

[Markus Gufler]

Attached you can find a message I've received today. I think it would be a
good tecnique to add this domain to our SPAMDOMAINS list.

According to the MX nslookup information of citibank.com :

citibank.comMX preference = 10, mail exchanger = mail2.citigroup.com
citibank.comMX preference = 10, mail exchanger = mail3.ssmb.com
citibank.comMX preference = 10, mail exchanger = mail3.citigroup.com
citibank.comMX preference = 10, mail exchanger = mail4.ssmb.com
citibank.comMX preference = 10, mail exchanger = mail4.citigroup.com
citibank.comMX preference = 50, mail exchanger = mail1.citigroup.com
citibank.comMX preference = 100, mail exchanger = mail0.citigroup.com
citibank.comMX preference = 10, mail exchanger = mail2.ssmb.com


it would be necessary to add 

citibank.comcitigroup.com

to the SPAMDOMAINS list. 
But what's with "ssmb.com" ?


Markus
--- Begin Message ---
Coca Cola good idea. Here's your Is it serious?well rest of the--- End Message ---

[Declude.JunkMail] A Preponderance of medical spam

[marc catuogno]

Thankfully declude is catching almost all of this, but I have my personal
filter set to add a subject and not DELETE.  I'm getting 50-60 messages a
day for prescripts online - all from subscriber networks (most often
charter) and it just started about 3 or 4 days ago.  I haven't run stats on
the server for a while, but I can only imagine how many of these are being
deleted if I'm getting that many a day (I'm going to try to check later) but
right now IMGATE is looking like a really good idea.  The idea that my
server is wasting resources processing this much of this crap is really
getting under my skin.  I know that this could cause another argument, but
I'm starting to think that blocking these completely is becoming a much more
desirable option, from both a junkmail and virus point of view.  Maybe if a
large percentage of people did block all these, the damn cable and dsl
companies would start doing something.  Sorry to vent...

Marc


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] More problems with Outlook 2003...

[R. Scott Perry]

A couple of days ago I found out that I no longer received mails form 
Declude lists: Virus, JunkMail and Release.

When I tried to re-subscribe to the lists with Outlook 2003, I got treated 
as SPAM and got the following error in the headers:

Article rejected, un-authorized poster of [EMAIL PROTECTED]
That means that your E-mail was rejected because the E-mail address of 
[EMAIL PROTECTED] was not allowed to post to the list.  That would happen 
if [EMAIL PROTECTED] was not on the mailing list at the time you sent the 
E-mail to the list.

After that I re-subscribed with webmail and everything went well, without 
me being detected as SPAM.
Spam isn't the issue here -- the issue is that when you were sending with 
Outlook 2003, you weren't subscribed; when you were sending with web 
messaging, you were subscribed.

I also se that my computername (PUPPY) in HELOBOGUS is equal my domain, 
which I find rather strange.
Your domain is not PUPPY.  PUPPY isn't a valid domain name.  Note that 
PUPPY was sent by your mail client, not your mail server -- so we don't see 
PUPPY here.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] %RemoteRecps%

[R. Scott Perry]

One of them will however need the %RemoteRecep% variable already available
in delude virus
Actually, there isn't such a variable in Declude Virus.  :)

Is is also available or can it be easily imported to junkmail ? (And while
you are at it, %nbremoterecp% would also be very usufull)
There is a good chance that we will be able to add these.

Finaly, we all know you have a feature list you work on, is it possible to
publish it on your web site so we know what to expect ?
I understand the list is not always accurate, and some features may never be
implemented, but   it will still give us some insight.
Part of the problem is that we almost certainly will not be able to get to 
everything in the suggestion database.  Some of the features may only 
affect a few of our customers, some may not really be appropriate enough to 
include, some may require much more time/effort than the benefit from them, 
etc.  But this is something that we will consider doing.

I personaly have a wish list of less then 10 features that will make my life
easier, if i do post it here, would you give me some info about which
features may be implemented and a rough timeframe (like few days, few weeks,
few months, ...)
I can try.  However, they would only be educated guesses until the features 
are actually implemented.

In general, when we look at suggestions for new features, we weigh the 
severity of the feature (if it is closer to a bug fix than a feature, it 
will get priority), what percentage of our customers would benefit from the 
feature, and how easy it would be to implement.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] OT: Email attack could kill servers

[Dave Doherty]

I asked IMail tech support about this. Their response:

IMail would not be vulnerable to this type of attack.  Multiple recipient
failures for the same message are included in a single bounce message.  And,
the original message is truncated in the bounce.

-Dave Doherty



- Original Message - 
From: "Alejandro Valenzuela" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, April 06, 2004 12:11 PM
Subject: RE: [Declude.JunkMail] OT: Email attack could kill servers


> Does Imail have this problem ?
> If So, what can we do to fix it ?
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of R. Lee Heath
> Sent: Tuesday, April 06, 2004 8:59 AM
> To: Mark Smith
> Subject: Re: [Declude.JunkMail] OT: Email attack could kill servers
>
>
> Wondering if a rule in Declude could trap such an email?
>
> This is actually a very old vulnerability in almost all mail
> servers.
>
> --
> Roger Heath
> [EMAIL PROTECTED]
> www.rleeheath.com
>
>
> - Copy of Original Message(s): -
>
> MS> http://www.newscientist.com/news/news.jsp?id=ns4858
>
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] NOLEGITCONTENT Test

[Markus Gufler]

> Would you say that this test is still "a valid" test? Is it 
> still worth
> -5 when the e-mail does not fail it? If both SPAM and HAM are 
> almost never tripping it perhaps it is a moot point anyway as 
> all mail will have the -5 added to it.

-5 of what? The standard hold weight of 20 points?

In my stats I can see that NOLEGITCONTENT is voting 19% correct for legit
messages. On the other side it has 6% of wrong votes for spam messages. For
the resting 75% of all messages it has no effect on the final weight.

In my eyes compared to other tests it's not the best and not the worst but
still an usefull test (in a weighting system).

Markus

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] test post (no longer receiving mail from Declude.JunkMail list)

[Steinar Rasch]

just 
testing

[Declude.JunkMail] More problems with Outlook 2003...

[Steinar Rasch]

Hi!

A couple of days ago I found out that I no longer received mails form Declude lists: 
Virus, JunkMail and Release.

When I tried to re-subscribe to the lists with Outlook 2003, I got treated as SPAM and 
got the following error in the headers:

---

Article rejected, un-authorized poster of [EMAIL PROTECTED]
Received: from commage.no [62.101.201.11] by declude.com with ESMTP
  (SMTPD32-8.05) id A3E12AE0BA8; Fri, 09 Apr 2004 04:50:41 -0400
Received: from puppy [82.148.164.214] by commage.no with ESMTP
  (SMTPD32-8.10) id A3B24B0014A; Fri, 09 Apr 2004 10:49:54 +0200
From: "Steinar Rasch" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: test post (no longer receiving mail from Declude.Virus list)
Date: Fri, 9 Apr 2004 10:50:33 +0200
Organization: comm.age as
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_000E_01C41E20.7C8D0560"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Thread-Index: AcQeD580cXaZQF4zTS6ljPjCCnGrpA==
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command .
X-RBL-Warning: HELOBOGUS: Domain puppy has no MX or A records [0301].
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 82.148.164.214 with no 
reverse DNS entry.
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420e].
X-RBL-Warning: WEIGHT10: Weight of 15 reaches or exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [82.148.164.214]
X-Spam-Tests-Failed: CMDSPACE, HELOBOGUS, REVDNS, SPAMHEADERS, WEIGHT10 [15]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 3. [2-97-30800]
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam 
[210f]. [2-99-31800]
X-Note: This E-mail was scanned for viruses by Declude Virus (www.declude.com)
X-NRecips: 1
X-Reverse-IP: sdsl11.bluecom.no
X-Weight: -6 (SPFUNKNOWN, HEUR2, SPAMCHK, ROUTING)
X-Country-Chain: [IANA Reserved]->NORWAY->destination.
X-Declude-Sender: [EMAIL PROTECTED] [62.101.201.11]
X-Declude-Spoolname: D63e102ae0ba88e0a.SMD

---

After that I re-subscribed with webmail and everything went well, without me being 
detected as SPAM.

I also se that my computername (PUPPY) in HELOBOGUS is equal my domain, which I find 
rather strange.

When using POP one should think that domain on the server is relayed as the domain and 
not my machine name, which obviously will jot have a domain...

Any ideas, anyone?

Regards,
Steinar
 





Send med WebMail systemet til www.epost.no


 
   
Denne eposten er skannet og funnet fri for virus
av Epost.no med Declude og FRISK F-Prot Software.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.