Re: [Declude.JunkMail] Off Topic? - Complaints from AOL
Title: Message Not true. If they would look at the standard message headers they would see the forwarding info. They just aren't savvy enough yet to implement better parsing. Case in point that they admitted to having a problem in their regular _expression_ parser for their feedback loop...but still haven't fixed it after over 6 weeks of calls. Forcing the little guys to institute such a No-AOL-Forwarding policy that isn't what the customer wants is not being a good netizen...but then no one ever acused AOL of being that, so I guess it's ok. Darin. - Original Message - From: Andy Schmidt To: [EMAIL PROTECTED] Sent: Wednesday, June 09, 2004 10:48 PM Subject: RE: [Declude.JunkMail] Off Topic? - Complaints from AOL Well, in AOL's defense, they cannot know which of their clients is having mail forwarded. However, you may institute a policy that you will not permit forwarding to AOL - email has to be read locally at your server - or they can use one of the registrars to forward they mail. Best RegardsAndy SchmidtPhone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)Sent: Wednesday, June 09, 2004 05:15 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Off Topic? - Complaints from AOL Problem is AOLs new REPORT SPAM button. What happens is a user on your server has his Imail forward his e-mail to his AOL address. When that user gets spam, he hits the REPORT SPAM button. Guess what, he just reported YOUR IP address. Another example of AOL stupidity. There response to my complaint about this, (which they admit has become a big problem,) is we have to educate our users not to use the AOL button. Since when are we paid to support AOL? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \\ WCNetSent: Monday, June 07, 2004 9:59 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Off Topic? - Complaints from AOL I've gotten three notices from AOL that complaints by AOL users about our network/mail have increased to an unacceptable level. 322 complaints, then 489. The notice makes reference to a "Report Card" but there is no link to view it, and nothing attached or quoted. There is a link to http://postmastesr.info.aol.com, which has a procedure to create a feedback loop for forwarding individual copies of complaints. I set that up on Friday, received a confirmation, but nothing else. Another notice arrived today advising 507 complaints. I have nothing but the three notices from AOL. I have no details on what are the complaints, nothing from any AOL users. How do I find out WHAT is going on? [EMAIL PROTECTED] hasn't responded to my inquiries. If figure somebody on this list will have suggestions. Thanks! Glenn Z.
RE: [Declude.JunkMail] Off Topic? - Complaints from AOL
Title: Message Well, in AOL's defense, they cannot know which of their clients is having mail forwarded. However, you may institute a policy that you will not permit forwarding to AOL - email has to be read locally at your server - or they can use one of the registrars to forward they mail. Best RegardsAndy SchmidtPhone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)Sent: Wednesday, June 09, 2004 05:15 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Off Topic? - Complaints from AOL Problem is AOL’s new REPORT SPAM button. What happens is a user on your server has his Imail forward his e-mail to his AOL address. When that user gets spam, he hits the REPORT SPAM button. Guess what, he just reported YOUR IP address. Another example of AOL stupidity. There response to my complaint about this, (which they admit has become a big problem,) is we have to educate our users not to use the AOL button. Since when are we paid to support AOL? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \\ WCNetSent: Monday, June 07, 2004 9:59 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Off Topic? - Complaints from AOL I've gotten three notices from AOL that complaints by AOL users about our network/mail have increased to an unacceptable level. 322 complaints, then 489. The notice makes reference to a "Report Card" but there is no link to view it, and nothing attached or quoted. There is a link to http://postmastesr.info.aol.com, which has a procedure to create a feedback loop for forwarding individual copies of complaints. I set that up on Friday, received a confirmation, but nothing else. Another notice arrived today advising 507 complaints. I have nothing but the three notices from AOL. I have no details on what are the complaints, nothing from any AOL users. How do I find out WHAT is going on? [EMAIL PROTECTED] hasn't responded to my inquiries. If figure somebody on this list will have suggestions. Thanks! Glenn Z.
RE: [Declude.JunkMail] OT: Exchange SMTP Greeting
> Isn't the field that you want on the properties page of the > > Default STMP Virtual Server >Delivery Tab >Advanced Button > In the Fully-qualified domain name field > > I know that when I change this in Exchange 2000 or 2003 that is the name > that the server identifies itself as in the SMTP handshakes. > > Or were you looking at changing something else? When ever I set up an Exchange Server, or IIS for that matter, I always install MetaEdit and make a bunch of changes that way. I have never even looked in the MMC for that. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Exchange SMTP Greeting
That is it. Thank you, Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic > Sent: Wednesday, June 09, 2004 5:37 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > Kevin & John, > > Isn't the field that you want on the properties page of the > > Default STMP Virtual Server >Delivery Tab >Advanced Button > In the Fully-qualified domain name field > > I know that when I change this in Exchange 2000 or 2003 that is the name > that the server identifies itself as in the SMTP handshakes. > > Or were you looking at changing something else? > > > > Goran Jovanovic > The LAN Shoppe > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Kevin Bilbee > > Sent: Wednesday, June 09, 2004 5:35 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > > John, > > > > Thank you, my local test worked using meta edit to change the Fully > > qualified host name for the SMTP service. > > > > > > Kevin > > > > > -Original Message- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] Behalf Of John > Tolmachoff > > > (Lists) > > > Sent: Wednesday, June 09, 2004 2:17 PM > > > To: [EMAIL PROTECTED] > > > Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > > > > > > > I know it is in the Metabase. You can install and use MetaEdit from > the > > > resource kit CD, or search on the downloads page for it. > > > > > > John Tolmachoff > > > Engineer/Consultant/Owner > > > eServices For You > > > > > > > > > > -Original Message- > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > > [EMAIL PROTECTED] On Behalf Of Kevin Bilbee > > > > Sent: Tuesday, June 08, 2004 12:38 PM > > > > To: [EMAIL PROTECTED] > > > > Subject: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > > > > > > I have a client that is having issues changing the SMTP greeting > from > > > their > > > > internal domain to using their official registered domain name. > > > > > > > > Could someone point me in the right direction to help them fix > > > the issue. > > > > > > > > I have searched the archives with no success. > > > > > > > > Kevin Bilbee > > > > > > > > > > > > --- > > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > > > --- > > > > This E-mail came from the Declude.JunkMail mailing list. To > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > > at http://www.mail-archive.com. > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Exchange SMTP Greeting
Kevin & John, Isn't the field that you want on the properties page of the Default STMP Virtual Server Delivery Tab Advanced Button In the Fully-qualified domain name field I know that when I change this in Exchange 2000 or 2003 that is the name that the server identifies itself as in the SMTP handshakes. Or were you looking at changing something else? Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Kevin Bilbee > Sent: Wednesday, June 09, 2004 5:35 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting > > John, > > Thank you, my local test worked using meta edit to change the Fully > qualified host name for the SMTP service. > > > Kevin > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff > > (Lists) > > Sent: Wednesday, June 09, 2004 2:17 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > > > > I know it is in the Metabase. You can install and use MetaEdit from the > > resource kit CD, or search on the downloads page for it. > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of Kevin Bilbee > > > Sent: Tuesday, June 08, 2004 12:38 PM > > > To: [EMAIL PROTECTED] > > > Subject: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > > > > I have a client that is having issues changing the SMTP greeting from > > their > > > internal domain to using their official registered domain name. > > > > > > Could someone point me in the right direction to help them fix > > the issue. > > > > > > I have searched the archives with no success. > > > > > > Kevin Bilbee > > > > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Unique New Spam Test
Any hints? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Junk Mail Test
I have an email that is getting caught on CMDSPACE test, but can't find any information on it in the Junkmail manual, are there other tests that are not listed there? That's a beta test -- for beta features, you can check the release notes, or the list archives. If it is outgoing E-mail, using WHITELIST AUTH will fix the problem (which will whitelist all your users that authenticate, if you use IMail v8). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Strange log action
Has anyone seen this before - where a test name is preceded by a character in the logs (in this case : nIPNOTINMX) ? That indicates a negative -- meaning that the E-mail did not fail the test, and had the weight change as a result. So: 06/09/2004 00:05:57 Q8c972f36011c17e2 SBL:6 CMDSPACE:3 nIPNOTINMX:-2 GIBBERISH:4 HOUR2:3 . Total weight = 14. The E-mail did not fail the IPNOTINMX test, and had 2 points subtracted from the weight as a result. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Off Topic? - Complaints from AOL
How about their damn Joe-Job bounces coming back without even the content to tag? Then there's Earthlink and their challenge/response crap. These companies take all the PR they can get for "solving the spam problem" when they are in fact inhibiting the solution for the vast majority of us. There's only two things that will generally get them to stop; 1) bad publicity (which they are unfortunately used to), or 2) lawsuits. One thing though that I'm sure about, complaining about it doesn't help in the majority of cases. Matt Darin Cox wrote: A case of the bug guy bullying everyone else...instead of fixing the problem and looking further up the chain to see the actual sender. On another note, they can't get their feedback loop notifications straight. We get a ton of them from a neighboring IP range. 6 weeks, half a dozen phone hour-long phone calls, two trouble tickets, and an escalated case number later and they still can't get it fixed. Darin. - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Wednesday, June 09, 2004 5:14 PM Subject: RE: [Declude.JunkMail] Off Topic? - Complaints from AOL Problem is AOL’s new REPORT SPAM button. What happens is a user on your server has his Imail forward his e-mail to his AOL address. When that user gets spam, he hits the REPORT SPAM button. Guess what, he just reported YOUR IP address. Another example of AOL stupidity. There response to my complaint about this, (which they admit has become a big problem,) is we have to educate our users not to use the AOL button. Since when are we paid to support AOL? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Glenn \\ WCNet Sent: Monday, June 07, 2004 9:59 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Off Topic? - Complaints from AOL I've gotten three notices from AOL that complaints by AOL users about our network/mail have increased to an unacceptable level. 322 complaints, then 489. The notice makes reference to a "Report Card" but there is no link to view it, and nothing attached or quoted. There is a link to http://postmastesr.info.aol.com, which has a procedure to create a feedback loop for forwarding individual copies of complaints. I set that up on Friday, received a confirmation, but nothing else. Another notice arrived today advising 507 complaints. I have nothing but the three notices from AOL. I have no details on what are the complaints, nothing from any AOL users. How do I find out WHAT is going on? [EMAIL PROTECTED] hasn't responded to my inquiries. If figure somebody on this list will have suggestions. Thanks! Glenn Z. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] OT: Exchange SMTP Greeting
John, Thank you, my local test worked using meta edit to change the Fully qualified host name for the SMTP service. Kevin > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff > (Lists) > Sent: Wednesday, June 09, 2004 2:17 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > I know it is in the Metabase. You can install and use MetaEdit from the > resource kit CD, or search on the downloads page for it. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Kevin Bilbee > > Sent: Tuesday, June 08, 2004 12:38 PM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] OT: Exchange SMTP Greeting > > > > I have a client that is having issues changing the SMTP greeting from > their > > internal domain to using their official registered domain name. > > > > Could someone point me in the right direction to help them fix > the issue. > > > > I have searched the archives with no success. > > > > Kevin Bilbee > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Off Topic? - Complaints from AOL
A case of the bug guy bullying everyone else...instead of fixing the problem and looking further up the chain to see the actual sender. On another note, they can't get their feedback loop notifications straight. We get a ton of them from a neighboring IP range. 6 weeks, half a dozen phone hour-long phone calls, two trouble tickets, and an escalated case number later and they still can't get it fixed. Darin. - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Wednesday, June 09, 2004 5:14 PM Subject: RE: [Declude.JunkMail] Off Topic? - Complaints from AOL Problem is AOLs new REPORT SPAM button. What happens is a user on your server has his Imail forward his e-mail to his AOL address. When that user gets spam, he hits the REPORT SPAM button. Guess what, he just reported YOUR IP address. Another example of AOL stupidity. There response to my complaint about this, (which they admit has become a big problem,) is we have to educate our users not to use the AOL button. Since when are we paid to support AOL? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \\ WCNetSent: Monday, June 07, 2004 9:59 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Off Topic? - Complaints from AOL I've gotten three notices from AOL that complaints by AOL users about our network/mail have increased to an unacceptable level. 322 complaints, then 489. The notice makes reference to a "Report Card" but there is no link to view it, and nothing attached or quoted. There is a link to http://postmastesr.info.aol.com, which has a procedure to create a feedback loop for forwarding individual copies of complaints. I set that up on Friday, received a confirmation, but nothing else. Another notice arrived today advising 507 complaints. I have nothing but the three notices from AOL. I have no details on what are the complaints, nothing from any AOL users. How do I find out WHAT is going on? [EMAIL PROTECTED] hasn't responded to my inquiries. If figure somebody on this list will have suggestions. Thanks! Glenn Z.
RE: [Declude.JunkMail] Off Topic? - Complaints from AOL
Problem is AOL’s new REPORT SPAM button. What happens is a user on your server has his Imail forward his e-mail to his AOL address. When that user gets spam, he hits the REPORT SPAM button. Guess what, he just reported YOUR IP address. Another example of AOL stupidity. There response to my complaint about this, (which they admit has become a big problem,) is we have to educate our users not to use the AOL button. Since when are we paid to support AOL? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \\ WCNet Sent: Monday, June 07, 2004 9:59 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Off Topic? - Complaints from AOL I've gotten three notices from AOL that complaints by AOL users about our network/mail have increased to an unacceptable level. 322 complaints, then 489. The notice makes reference to a "Report Card" but there is no link to view it, and nothing attached or quoted. There is a link to http://postmastesr.info.aol.com, which has a procedure to create a feedback loop for forwarding individual copies of complaints. I set that up on Friday, received a confirmation, but nothing else. Another notice arrived today advising 507 complaints. I have nothing but the three notices from AOL. I have no details on what are the complaints, nothing from any AOL users. How do I find out WHAT is going on? [EMAIL PROTECTED] hasn't responded to my inquiries. If figure somebody on this list will have suggestions. Thanks! Glenn Z.
RE: [Declude.JunkMail] Junk Mail Test
I believe outlook 2003 can cause this if it is connecting without authentication. If that is the client you’re using, try enabling authentication for sending email and see if that clears it up? I had that happen, being marked as spam sending myself a test message. M From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Calvert Sent: Wednesday, June 09, 2004 5:08 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Junk Mail Test Hi all, I have an email that is getting caught on CMDSPACE test, but can't find any information on it in the Junkmail manual, are there other tests that are not listed there? Jay Calvert Systems Administrator Web Support Services Corporate IT Office: 604.275.3800 Direct Phone: 604.448.3893 Cell: 604.612.6250
RE: [Declude.JunkMail] OT: Exchange SMTP Greeting
I know it is in the Metabase. You can install and use MetaEdit from the resource kit CD, or search on the downloads page for it. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Kevin Bilbee > Sent: Tuesday, June 08, 2004 12:38 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] OT: Exchange SMTP Greeting > > I have a client that is having issues changing the SMTP greeting from their > internal domain to using their official registered domain name. > > Could someone point me in the right direction to help them fix the issue. > > I have searched the archives with no success. > > Kevin Bilbee > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Way to punish null senders?
MAILFROM 15 CONTAINS <> John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Monday, June 07, 2004 8:51 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Way to punish null senders? I found this arriving today. X-Declude-Sender: <> [66.205.198.196] Is there a way to “punish” e-mails with a null sender? Is it appropriate to do that? Internally on the From field it shows up as Secret Markets [EMAIL PROTECTED] Goran Jovanovic The LAN Shoppe <>
RE: [Declude.JunkMail] Yahoo "Bulk Mail"
Well, I normally do not do this, but since I have a yahoo account, contact me off list, and I will have you have him send e-mail to my yahoo account, which I will then report as OK. John Tolmachoff Engineer/Consultant/Owner eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jonathan > Sent: Monday, June 07, 2004 9:34 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Yahoo "Bulk Mail" > > A bit OT, but I'm guessing you guys have dealt with this. > > We have a very legitimate customer, that seems to have found their way into > Yahoo's "Bulk Mail" filter. I'd personally vouch for this user - I know > they've never done any spamming (even indirectly or unknowingly). Does > anyone know the best way to get out of Yahoo's filters? > > Thanks in advance, > > Jonathan > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Junk Mail Test
Hi all, I have an email that is getting caught on CMDSPACE test, but can't find any information on it in the Junkmail manual, are there other tests that are not listed there? Jay CalvertSystems AdministratorWeb Support ServicesCorporate IT Office: 604.275.3800Direct Phone: 604.448.3893Cell: 604.612.6250
RE: [Declude.JunkMail] .zip files
Many stupid ridiculous e-mail server AV programs are configured to “clean and deliver” virus infected e-mails. This is probably what you are seeing. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Wednesday, June 09, 2004 10:31 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] .zip files Does anyone know what are the zip files are that are being caught in SpamReview..This has been going on for a while and they look like viruses but evidently not but I can tell it is SPAMI was getting so many I decided to Ban .zip files but of course customers complain...so today I took the ban off and immediatley I got one personally delivered to my mailbox.. "Your bill is attached" with an attachment Does anyone know a fix for these type .zip files and what are theyor how I can ban them and still let customers send and receive .zip files... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support
Re: [Declude.JunkMail] How did the weight start at 68
Filter test types run after all other tests besides weight and weightrange. So DNSBL, IP4R, RHSBL, external, spamdomains, ipfile, mailfrom and I think a few others will always run before the filter type is executed regardless of the order in your config. The individual filter files however will be processed in the order of appearance. Matt Goran Jovanovic wrote: This is the first log line for an e-mail that I used for testing. 06/09/2004 14:59:54 Q5e1f12a8012e3b47 Filter NIGERIAN: Skipping E-mail with a current weight of 68 (>=48) Since this is the first filter in the global.cfg how did the weight start off at 68??? Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Error Code 2?
- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> > >Scott, an odd thing about this is that the debug output shows that Alligate > >was returning a response code of "0" to Declude. I have sent you (off list) > >a copy of the debug output for a single message that was deleted, for your > >review. I would be curious to know why and how the message was getting > >deleted. > > Declude isn't doing it. If Declude deletes the E-mail, it will be a result > of the DELETE action being used, and you won't see an error/warning. > > In this case, it appears that Alligate is deleting the E-mail file, and > then returning an exit code of 0. That's what I thought - thanks for the feedback. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Strange log action
Has anyone seen this before - where a test name is preceded by a character
in the logs (in this case : nIPNOTINMX) ? Test failure doesn't show up in
the headers of the message (assuming due to altered name not matching Warn
action) but the points are still added to the total failure points.
06/09/2004 00:05:57 Q8c972f36011c17e2 SBL:6 CMDSPACE:3 nIPNOTINMX:-2
GIBBERISH:4 HOUR2:3 . Total weight = 14.
06/09/2004 00:05:57 Q8c972f36011c17e2 L1 Message OK
06/09/2004 00:05:57 Q8c972f36011c17e2 Subject: Free Digital Video Recorder -
Dish Network
06/09/2004 00:05:57 Q8c972f36011c17e2 From:
[EMAIL PROTECTED] To: {EMAIL PROTECTED} IP:
69.56.49.79 ID:
06/09/2004 00:05:57 Q8c972f36011c17e2 Tests failed [weight=14]: SBL=WARN
CMDSPACE=WARN NOLEGITCONTENT=IGNORE GIBBERISH=WARN HOUR2=WARN SPFPASS=WARN
WEIGHT1016=SUBJECT
06/09/2004 00:05:57 Q8c972f36011c17e2 Last action = IGNORE.
In looking deeper into this, it appears to be sporadic all through out the
day..
Sincerely,
Randy Armbrecht
Global Web SolutionsR, Inc.
804-346-5300 ext. 1
877-800-GLOBAL (4562) ext. 1
http://globalweb.net
Richmond's Internet Source since 1996!
WEB HOSTING including EMAIL beginning at $29/month!
Non-Profits - receive a 25% discount!
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] How did the weight start at 68
This is the first log line for an e-mail that I used for testing. 06/09/2004 14:59:54 Q5e1f12a8012e3b47 Filter NIGERIAN: Skipping E-mail with a current weight of 68 (>=48) Since this is the first filter in the global.cfg how did the weight start off at 68??? Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Error Code 2?
Scott, an odd thing about this is that the debug output shows that Alligate was returning a response code of "0" to Declude. I have sent you (off list) a copy of the debug output for a single message that was deleted, for your review. I would be curious to know why and how the message was getting deleted. Declude isn't doing it. If Declude deletes the E-mail, it will be a result of the DELETE action being used, and you won't see an error/warning. In this case, it appears that Alligate is deleting the E-mail file, and then returning an exit code of 0. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Error Code 2?
- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> > >Scott, can you tell me what might cause a situation like this where are the > >Declude spam tests are run, but then Declude cannot unlock the file because > >it has been deleted: > > > >06/09/2004 11:15:47 Q53c7027b03ee31a5 WARNING: Could not unlock > >f:\IMail\spool\_53c7027b03ee31a5.~MD; it has been deleted. > >06/09/2004 11:15:47 Q53c7027b03ee31a5 ERROR: Could not move spam to hold! > >Code: 2 f:\IMail\spool\D53c7027b03ee31a5.SMD > > Are you running an external test that could be deleting the E-mail? Do you > recall any changes that you made just before this started happening? Scott, an odd thing about this is that the debug output shows that Alligate was returning a response code of "0" to Declude. I have sent you (off list) a copy of the debug output for a single message that was deleted, for your review. I would be curious to know why and how the message was getting deleted. Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Error Code 2?
- Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> > >Scott, can you tell me what might cause a situation like this where are the > >Declude spam tests are run, but then Declude cannot unlock the file because > >it has been deleted: > > > >06/09/2004 11:15:47 Q53c7027b03ee31a5 WARNING: Could not unlock > >f:\IMail\spool\_53c7027b03ee31a5.~MD; it has been deleted. > >06/09/2004 11:15:47 Q53c7027b03ee31a5 ERROR: Could not move spam to hold! > >Code: 2 f:\IMail\spool\D53c7027b03ee31a5.SMD > > Are you running an external test that could be deleting the E-mail? Do you > recall any changes that you made just before this started happening? That was it. I had an old copy of Alligate running on this test server and its license had expired ([ERROR] - LICENSE EXPIRED) and apparently it was deleting all mail that was sent to it by Declude instead of simply passing it back with a 0 response code. *** WARNING *** WARNING *** WARNING *** Anyone that is still running Alligate should check to see if their license is getting close to expiring, you do not want Declude to send your e-mail to this external test once it has expired or all e-mail will get deleted! Thanks Scott for the tip, I just figured that all external apps would behave nicely and not default to deleting mail if there license expired. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
Thank you all for the input I got so caught up with the filtering that I forgot about the per-domain blacklist capability. So all I did was to add a .cz to the blacklist file for that domain and it took care of it. Got to remember the big picture :) Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Rick Davidson > Sent: Wednesday, June 09, 2004 1:21 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Blacklist one Country for one Domain > > agreed about the body but chances are that and end user is going to base > their filtering request on what they see in the body and in the case of > .cz > the chances of something matching that other than an email address or url > are slim > > if cpu processing is an issue run the test in its own filter and run it > last > using the "testsfailed end contains" to exclude it if it was already > killed > by another test. > > Rick Davidson > National Systems Manager > North American Title Group > - > - Original Message - > From: "Scott Fisher" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, June 09, 2004 12:58 PM > Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain > > > I'd avoid the ANYWHERE filter if possible. > Perhaps replace it with HEADERS if that's what you want. > > The anywhere will include the body, and those short matches on the body > seem > to match on strange things in attachments and such a little too often for > me. > Also ANYWHERE will be pretty CPU intensive compared to HEADERS or > MAILFROM. > > Scott Fisher > Director of IT > Farm Progress Companies > > >>> [EMAIL PROTECTED] 06/09/04 10:50AM >>> > Markus, > > I want to avail HOLD actions as much as possible (that way there is less > work for me :>) > > ALLRECIPS END NOTCONTAINS @domain.com > MAILFROM50ENDSWITH .cz > > They way I understand a filter file is that is it applied and scored > against every e-mail message that comes in. So for the other domains in > the system I want to allow or not penalize .cz mail. That is why I > thought I would use the first line to exit the filter unless it is > specifically for the domain in question. Now with the MAILFROM it will > get an email message what ends with .cz > > Or maybe I should use (Rick's suggestion) > > ANYWHERE 50 CONTAINS .cz > MAILFROM 50 CONTAINS .cz > > with the ANYWHERE line containing a training space. > > I was wondering if the filter approach is the best approach or is there > another way to do this? I am thinking something like a blacklist but I > am not sure how that would work?? > > > > Goran Jovanovic > The LAN Shoppe > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Markus Gufler > > Sent: Wednesday, June 09, 2004 11:33 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain > > > > > > > > Please blacklist anything that has a .cz in the > > > address line > > > > COUNTRIES doesn't look at the "address line" as your customer asked > for. > > It will filter if any IP-Address the contained in the mail header is > > assigned to the Czech republic. > > > > Why not use something like > > > > MAILFROM 50 ENDSWITH .cz > > > > > > What about other customers that want mail from the Czech republic? > > > > I consider to create a separate filter file (FILTER-CUSTOMERNAME) > > > > In this filter file put > > > > MAILFROM 0 ENDSWITH .cz > > > > > > Then create a .junkmail action file for this customer and set > > > > FILTER-CUSTOMERNAME HOLD > > > > > > > > Markus > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail
Re: [Declude.JunkMail] Error Code 2?
Scott, can you tell me what might cause a situation like this where are the Declude spam tests are run, but then Declude cannot unlock the file because it has been deleted: 06/09/2004 11:15:47 Q53c7027b03ee31a5 WARNING: Could not unlock f:\IMail\spool\_53c7027b03ee31a5.~MD; it has been deleted. 06/09/2004 11:15:47 Q53c7027b03ee31a5 ERROR: Could not move spam to hold! Code: 2 f:\IMail\spool\D53c7027b03ee31a5.SMD Are you running an external test that could be deleting the E-mail? Do you recall any changes that you made just before this started happening? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Error Code 2?
Scott, can you tell me what might cause a situation like this where are the
Declude spam tests are run, but then Declude cannot unlock the file because
it has been deleted:
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter: Set min weight to -50.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Triggered CONTAINS filter
REDUCTION-FILTER on Fetal [weight->-5; fetal territory resonate begga].
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter HELO-FILTER: Not skipping
E-mail due to current weight of 22.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter: Set max weight to 25.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter FORGEDHELO-FILTER: Not skipping
E-mail due to current weight of 22.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter: Set max weight to 7.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter DYNAMIC-FILTER: Not skipping
E-mail due to current weight of 22.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter: Set max weight to 5.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Triggered CONTAINS filter
DYNAMIC-FILTER on dyn [weight->2; dyn-83-152-158-114.ppp.tiscali].
06/09/2004 11:15:46 Q53c7027b03ee31a5 Triggered CONTAINS filter
DYNAMIC-FILTER on ppp [weight->2; ppp.tiscali.fr].
06/09/2004 11:15:47 Q53c7027b03ee31a5 Triggered CONTAINS filter
DYNAMIC-FILTER on -83- [weight->2; -83-152-158-114.ppp.tiscali.fr].
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Maximum weight of 5 reached
(with 6); ending this filter.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter REVDNS-FILTER: Not skipping
E-mail due to current weight of 27.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 25.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter MAILFROM-FILTER: Not skipping
E-mail due to current weight of 27.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 25.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter VERP-FILTER: Not skipping
E-mail due to current weight of 27.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 3.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter SUBJECT-FILTER: Not skipping
E-mail due to current weight of 27.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 25.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Triggered CONTAINS filter
SUBJECT-FILTER on Online [weight->5; online drug store Tech telex ].
06/09/2004 11:15:47 Q53c7027b03ee31a5 Triggered CONTAINS filter
HEADERS-FILTER on hits=61. [weight->6; hits=61.7 tagged_above=1.0 req].
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter GIBBERISH-FILTER: Not skipping
E-mail due to current weight of 38.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 5.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter OBFUSCATION-FILTER: Not
skipping E-mail due to current weight of 38.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 15.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter BODY-FILTER: Not skipping
E-mail due to current weight of 38.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Filter: Set max weight to 25.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Triggered CONTAINS filter BODY-FILTER
on Phent [weight->10; Phenterminee...
06/09/2004 11:15:47 Q53c7027b03ee31a5 ABUSEAT:3 DNSBL-T1:2 FIVETEN-OTHER:3
NJABL-DYNA:3 SORBS-DYNA:3 NOABUSE:2 NOPOSTMASTER:3 SPAM-DOMAIN:10
SNIFFER-WHITERULE:-2 REDUCTION-FILTER:-5 DYNAMIC-FILTER:5 SUBJECT-FILTER:5
HEADERS-FILTER:6 BODY-FILTER:10 . Total weight = 48.
06/09/2004 11:15:47 Q53c7027b03ee31a5 NOT bypassing whitelisting of E-mail
with weight >=16 (48) and at least 2 recipients (1).
06/09/2004 11:15:47 Q53c7027b03ee31a5 Using [incoming] CFG file
f:\IMail\Declude\$default$.junkmail.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed ABUSEAT ("Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=83.152.158.114";). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed DNSBL-T1 ("PLEASE SEE
http://dnsbl.net.au/lookup/?83.152.158.114";). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed FIVETEN-OTHER
(114.158.152.83.blackholes.five-ten-sg.com.). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed NJABL-DYNA
("Dynamic/Residential IP range listed by NJABL dynablock -
http://njabl.org/dynablock.html";). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed SORBS-DYNA ("Dynamic IP
Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=83.152.158.114";).
Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed NOABUSE ("Not supporting
[EMAIL PROTECTED]"). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed NOPOSTMASTER ("Not
supporting [EMAIL PROTECTED]"). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed IPNOTINMX (). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed NOLEGITCONTENT (No content
unique to legitimate E-mail detected.). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed SPAM-DOMAIN (Spamdomain
'msn.com' found: Address of [EMAIL PROTECTED] sent from invalid
dyn-83-152-158-114.ppp.tiscali.fr.). Action=WARN.
06/09/2004 11:15:47 Q53c7027b03ee31a5 Msg failed SNIFFER-WHITERULE (Message
failed SNIFFER-WHITERULE: 0.). Action=WARN.
06/09/2004 11:15:47
Re: [Declude.JunkMail] Blacklist one Country for one Domain
agreed about the body but chances are that and end user is going to base their filtering request on what they see in the body and in the case of .cz the chances of something matching that other than an email address or url are slim if cpu processing is an issue run the test in its own filter and run it last using the "testsfailed end contains" to exclude it if it was already killed by another test. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: "Scott Fisher" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 09, 2004 12:58 PM Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain I'd avoid the ANYWHERE filter if possible. Perhaps replace it with HEADERS if that's what you want. The anywhere will include the body, and those short matches on the body seem to match on strange things in attachments and such a little too often for me. Also ANYWHERE will be pretty CPU intensive compared to HEADERS or MAILFROM. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/09/04 10:50AM >>> Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :>) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM50ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Wednesday, June 09, 2004 11:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain > > > > > Please blacklist anything that has a .cz in the > > address line > > COUNTRIES doesn't look at the "address line" as your customer asked for. > It will filter if any IP-Address the contained in the mail header is > assigned to the Czech republic. > > Why not use something like > > MAILFROM 50 ENDSWITH .cz > > > What about other customers that want mail from the Czech republic? > > I consider to create a separate filter file (FILTER-CUSTOMERNAME) > > In this filter file put > > MAILFROM 0 ENDSWITH .cz > > > Then create a .junkmail action file for this customer and set > > FILTER-CUSTOMERNAME HOLD > > > > Markus > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Verify sender
You can do that in Imail on the SMTP Security tab be careful doing that cause it will affect alot of legit mail where gateways are used for example my mail domian is nat.com but the mx records point to my gateways which use the domain nat-mail.com Rick Davidson National Systems Manager North American Title Group - - Original Message - From: "geneh" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 09, 2004 1:19 PM Subject: [Declude.JunkMail] Verify sender > Is it possible, either through Declude JM or Imail, to verify the return address of an email is valid and came from the mail server that hosts the domain based on the MX record? > > Gene > > > > > > > Sent via the WebMail system at accram.com > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] .zip files
Does anyone know what are the zip files are that are being caught in SpamReview..This has been going on for a while and they look like viruses but evidently not but I can tell it is SPAMI was getting so many I decided to Ban .zip files but of course customers complain...so today I took the ban off and immediatley I got one personally delivered to my mailbox.. "Your bill is attached" with an attachment Does anyone know a fix for these type .zip files and what are theyor how I can ban them and still let customers send and receive .zip files... Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support
Re: [Declude.JunkMail] Verify sender
Is it possible, either through Declude JM or Imail, to verify the return address of an email is valid ... Declude JunkMail's MAILFROM test checks to make sure that the domain is valid. It does not check to see if the E-mail address is valid, as this is not very reliable (and can cause problems with people seeing you as attacking their mailservers). ... and came from the mail server that hosts the domain based on the MX record? The IPNOTINMX test checks for this, but be aware that it is perfectly valid (and fairly common) to have E-mail coming from other IPs. SPF does a better job with this, letting domains publish who can send mail and who cannot. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Verify sender
Is it possible, either through Declude JM or Imail, to verify the return address of an email is valid and came from the mail server that hosts the domain based on the MX record? Gene Sent via the WebMail system at accram.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
I'd avoid the ANYWHERE filter if possible. Perhaps replace it with HEADERS if that's what you want. The anywhere will include the body, and those short matches on the body seem to match on strange things in attachments and such a little too often for me. Also ANYWHERE will be pretty CPU intensive compared to HEADERS or MAILFROM. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/09/04 10:50AM >>> Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :>) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM50ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Wednesday, June 09, 2004 11:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain > > > > > Please blacklist anything that has a .cz in the > > address line > > COUNTRIES doesn't look at the "address line" as your customer asked for. > It will filter if any IP-Address the contained in the mail header is > assigned to the Czech republic. > > Why not use something like > > MAILFROM 50 ENDSWITH .cz > > > What about other customers that want mail from the Czech republic? > > I consider to create a separate filter file (FILTER-CUSTOMERNAME) > > In this filter file put > > MAILFROM 0 ENDSWITH .cz > > > Then create a .junkmail action file for this customer and set > > FILTER-CUSTOMERNAME HOLD > > > > Markus > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Messagerite
Anybody have any experience with this company? A customer of mine has been asked to use this service for one of his customers and he is trying to figure out what they are really doing and if we can set up our own way of doing the archiving. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Naming
Can I name a filter something like: SPECFIC-DOMAIN.COM Using the "." That will work fine. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter Naming
Scott, Can I name a filter something like: SPECFIC-DOMAIN.COM Using the "." Or do I have to stick with "-" SPECFIC-DOMAIN-COM Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] LAST vs DYNA ip4r tests
Yesterday's results are more in line with what I expect. The -ALL are consistantly higher than the -LAST. I'll keep observing, but I have no explanation why things changed... Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/08/04 05:09PM >>> Scott, Send me your log off-list and I'll parse it with DLAnalyzer so that we are both seeing data generated from the same app. Seems like a logical place to start. Matt Scott Fisher wrote: >Stats: > > AHBL-PROXIES-ALL901 > AHBL-PROXIES-LAST 908 last higher > BLITZEDALL-ALL 624This is what I'm used to. > BLITZEDALL-LAST 602 > CBL-ALL4000 > CBL-LAST 4017 last higher > DSBL-ALL 3607 > DSBL-LAST 3628last higher > ORDB-ALL 29 what I'm used to > ORDB-LAST28 > SPAMCOP-ALL4744 > SPAMCOP-LAST 4784last higher > >global.cfg lines: >AHBL-PROXIES-LAST dnsbl %IP4R%.dnsbl.ahbl.org 127.0.0.3 0 0 >AHBL-PROXIES-ALL ip4rdnsbl.ahbl.org 127.0.0.3 0 0 >CBL-LAST dnsbl %IP4R%.cbl.abuseat.org 127.0.0.2 50 0 >CBL-ALLip4rcbl.abuseat.org 127.0.0.2 18 0 >DSBL-LAST dnsbl %IP4R%.list.dsbl.org127.0.0.2 00 >DSBL-ALL ip4rlist.dsbl.org 127.0.0.2 00 >ORDB-LAST dnsbl %IP4R%.relays.ordb.org 127.0.0.2 0 0 >ORDB-ALL ip4rrelays.ordb.org 127.0.0.2 0 0 >SPAMCOP-LAST dnsbl %IP4R%.bl.spamcop.net 127.0.0.2 60 0 >SPAMCOP-ALLip4rbl.spamcop.net 127.0.0.2 30 0 > >IPBYPASS ... none >Whitelisting ... only true whitelisted items are my internal mailserver (all e-mail >forwarded past Imail) > >Unfortuantely I didn't change my ACTIONS from the -DYNA to the -LAST, so I don't have >logs to fall back on (yet). > >Scott Fisher >Director of IT >Farm Progress Companies > > > [EMAIL PROTECTED] 06/08/04 03:26PM >>> >Scott, > >That's odd and it points to a problem somewhere. The ALL tests should >hit every LAST hit and then some extra. I generally see about 1% to 2% >more for the ALL tests across the board (not percentage points, but a >percentage difference). Here are some examples from yesterday's stats: > >SPAMCOP(ALL)30,250...56.71% >SPAMCOP(LAST)...29,926...56.11% >XBL(ALL)22,201...41.62% >XBL(LAST)...21,891...41.04% >DSBL(ALL)...20,074...37.64% >DSBL(LAST)..19,771...37.07% >NJABL-PROXIES(ALL)...6,610...12.39% >NJABL-PROXIES(LAST)..6,459...12.11% >SORBS-SOCKS(ALL).4,9229.23% >SORBS-SOCKS(LAST)4,8169.03% > >Maybe you could post your config lines for examples where you saw LAST >score higher than ALL just to make sure. I suppose that other factors >like IPBYPASS or some some whitelist settings in combination with how >you get your stats could have an effect, but that would be a >config/method that I am unfamiliar with. > >Matt > > > >Scott Fisher wrote: > > > >>-Matt, >> >>I've converted my -DYNA tests to -LAST and have observed an unexpected result. >>Before the -DYNA tests totals would usually be a few less than the -ALL test. >>Now the -LAST test totals are usually a few more than the -ALL tests. >> >>I can account some of these for having my domain name used as the from address. But >>this doesn't account for all of them. >> >> >> >> >> >>Scott Fisher >>Director of IT >>Farm Progress Companies >> >>--- >>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] >> >>--- >>This E-mail came from the Declude.JunkMail mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.JunkMail". The archives can be found >>at http://www.mail-archive.com. >> >> >> >> >> >> > > > -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :>) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM50ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Wednesday, June 09, 2004 11:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain > > > > > Please blacklist anything that has a .cz in the > > address line > > COUNTRIES doesn't look at the "address line" as your customer asked for. > It will filter if any IP-Address the contained in the mail header is > assigned to the Czech republic. > > Why not use something like > > MAILFROM 50 ENDSWITH .cz > > > What about other customers that want mail from the Czech republic? > > I consider to create a separate filter file (FILTER-CUSTOMERNAME) > > In this filter file put > > MAILFROM 0 ENDSWITH .cz > > > Then create a .junkmail action file for this customer and set > > FILTER-CUSTOMERNAME HOLD > > > > Markus > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Feature request
I ran across a case where the NOTIS would be preferred over the NOTCONTAINS. Can we see the NOTIS and the NOTBEGINSWITH implimented? NOTIS will be in the next release. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
> > Please blacklist anything that has a .cz in the > address line COUNTRIES doesn't look at the "address line" as your customer asked for. It will filter if any IP-Address the contained in the mail header is assigned to the Czech republic. Why not use something like MAILFROM50 ENDSWITH .cz What about other customers that want mail from the Czech republic? I consider to create a separate filter file (FILTER-CUSTOMERNAME) In this filter file put MAILFROM0 ENDSWITH .cz Then create a .junkmail action file for this customer and set FILTER-CUSTOMERNAME HOLD Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist one Country for one Domain
I would focus on the mailfrom test, chances are the spam your client is complaining about did actually come from the country cz but definately nail it with the country test if thats what they want. you could even add a filter like anywhere 50 contains .cz (with a space after the .cz) anywhere 50 contains .cz> Rick Davidson National Systems Manager North American Title Group - - Original Message - From: "Goran Jovanovic" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 09, 2004 11:01 AM Subject: [Declude.JunkMail] Blacklist one Country for one Domain Hi, I have a client who sent this to me today > Please blacklist anything that has a .cz in the address line So the way that I see doing this is a filter with the following. ALLRECIPS END NOTCONTAINS @domain.com COUNTRIES 50 CONTAINS CZ MAILFROM50ENDSWITH .cz My questions: Is this the best way? COUNTRIES and not COUNTRY will check every mail hop? And the biggest question will this do what the client wants? Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blacklist one Country for one Domain
Hi, I have a client who sent this to me today > Please blacklist anything that has a .cz in the address line So the way that I see doing this is a filter with the following. ALLRECIPS END NOTCONTAINS @domain.com COUNTRIES 50 CONTAINS CZ MAILFROM50ENDSWITH .cz My questions: Is this the best way? COUNTRIES and not COUNTRY will check every mail hop? And the biggest question will this do what the client wants? Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Feature request
I ran across a case where the NOTIS would be preferred over the NOTCONTAINS. Can we see the NOTIS and the NOTBEGINSWITH implimented? Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Feature Suggestion -> More control over final action
Maybe one solution would be to set up an action that for instance would ROUTETO NULL, so that you could use this in place of DELETE and still get the COPYTO function to work? Actually, you can get DELETE and COPYTO to work. In this case, the DELETE action isn't really desired -- you just want someone else to get the E-mail, so you can use the ROUTETO action. Along the same lines, if you could include the Declude generated headers in the COPYFILE action... That's something we are looking into. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Upgrade Declude
You know if you talk about version 1.80, we'll want to download it... Anything noteworthy in 1.80? Sorry, that should have been 1.79. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Feature Suggestion -> More control over final action
> I'm still trying to come up with an "easy to implement" way > to give us more control over "conflicting" final actions. > Specifically, I have several tests set to "HOLD" or "DELETE" > (in fact, the vast majority of incoming > mail) - however, a small number of them escaped detection by > Sniffer or other services, which have an interest in > receiving a copy of such mail. After asking several times for features like this, I've switched to another way how to resolve this: 1.) Hold anything that is over a secure threeshold. 2.) Set additional WARN actions so that any SMD-file has enough information in the header-part 3.) Write some app, or script that parses all x minutes/hours the spam folder. For example: We hold on 100 and I've never seen a false positive over 165 points. So I've set up another WARN action for 200 points. (we hold on 100) Now if there is a SMD-file containing the WHEIGHT200 warning our script will move this message automaticaly to the spam/hold folder. So we can save a lot of review work because only 4% of the hold spam messages on our system is in the 100-200 range. Or another example: Search fo all messages containing the the WEIGHT200 warning (or whatever fits for your weighting system) but doesn't contain SNIFFER. (btw: works great ;) I'm sure Pete would be very interested if you forward such messages. There are also other possible features that can be processed in this way: For example: Assuming that every message having a final weight of 200% of the hold weight has a 99,99% probability to be spam. Why not process this message contents and filter out URLs and so on? Maybe someone has time and knowledge to implement such a combination of tools: Spam-Analyzer and external test filtering on the collected data. If the collected URLs would be saved in a database, beside a counter for spam messages and legit messages containing this URL it should be very reliable. Maybe it would also be a nice thing to resolve IP-adresses of al this URLs. So hopefully it would be possible to identify webservers hosting a lot of spam websites... and punish them. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
