Re: [Declude.JunkMail] ANN: Availability of ldap2aliases 0.5.00, useful script for IMail MXs fronting IMail mailbox servers
Sandy, This looks very interesting, but I'm not quite clear on the mechanisms at work here and I would appreciate it if you would help to clarify. It all sounds like it would work for my needs, but maybe not 'out of the box'. I have 4 questions that would help to clear some of the fog: 1) I have a mix of gatewayed domains and locally hosted domains. It seems that this script is really built for locally hosted domains and would need to be extended to say take in addresses stored in a flat file or database. Is that correct? 2) I'm unfamiliar with IMail's ability to do envelope rejection based on LDAP data. Could you explain how this works, or possibly point me to a relevant article from Ipswitch on how this works? I'm also curious as to how Declude would see these addresses, i.e. is everything set up as an alias on the scanning server where say [EMAIL PROTECTED] would be aliased to [EMAIL PROTECTED] 3) Some domains of course use nobody aliases, and some gatewayed domains don't have complete lists of users available. I'm wondering if and how this is handled on the gateway server? 4) I'm wondering about how the lookups happen. Is the information pulled completely to the MX server when the script is run, or is it queried off of the mail server every time a message comes in? This could be very useful for many of us, but I fear that a general lack of experience with LDAP with IMail makes the instructions somewhat cryptic, or at least that is the case from where I sit. I certainly understand what LDAP is, and envelope rejection, but I understand nothing about how IMail makes this work, and how you coaxed IMail to do this. Thanks, Matt Sanford Whiteman wrote: All, I've posted ldap2aliases, a VBScript that automatically creates aliases on an IMail MX corresponding to users on a remote IMail mailbox server. It's similar in function to scripts that convert IMail userbases into alias maps for other MTAs, but designed for those using IMail as a backup or scanning MX, with or without Declude. The script allows you to reject unknown users _on the MX during the SMTP envelope_, which is a near-necessity these days. Bounce floods during dictionary attacks are a real resource burden and exacerbate the effects of Joe Jobs, as has been well documented. Thanks to IMail 8.12's use of OpenLDAP, this script will work reliably over the wide area, making it equally suited to (a) MXs and mailbox servers on the same subnet and (b) scanning/backup MXs and mailbox servers operated at different sites, perhaps by different entities. The script may be easily scheduled using Windows Task Scheduler. Notes: - We have found that the use of a true virtual host for store-and-forward routing, rather than HOSTS file routing, is preferable (now that this script is available!). Advantages: multiple DNS MX records are honored for redundancy, multiple IP-bound hosts may be used with different IMail anti-spam settings, and more. - IMail does not usually expose aliases via LDAP, only users. However, I have provided a companion script, aliases2ldap, which you run periodically on the mailbox server to ensure that all valid addresses are available. System requirements: - IMail 8.12 w/LDAP - Incoming and outgoing TCP 389 open as needed - aliases2ldap.vbs running on mailbox server to ensure alias propagation. Support: - Please post support questions as [OT] to the IMail or Declude forums to create a public archive. Download: http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/aliases2ldap/download/release/ --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail
RE: [Declude.JunkMail] ANN: Availability of ldap2aliases 0.5.00, useful script for IMail MXs fronting IMail mailbox servers
Not sure if Sandy is still up, so here is my best shot: 1) I have a mix of gatewayed domains and locally hosted domains. It seems that this script is really built for locally hosted domains and would need to be extended to say take in addresses stored in a flat file or database. Is that correct? This scripts that Sandy has developed are to create a local virtual domain of a gatewayed or SF domain that currently exists. 2) I'm unfamiliar with IMail's ability to do envelope rejection based on LDAP data. Could you explain how this works, or possibly point me to a relevant article from Ipswitch on how this works? I'm also curious as to how Declude would see these addresses, i.e. is everything set up as an alias on the scanning server where say [EMAIL PROTECTED] would be aliased to [EMAIL PROTECTED] The LDAP part is only used to query the database containing the user information when the script is run. 3) Some domains of course use nobody aliases, and some gatewayed domains don't have complete lists of users available. I'm wondering if and how this is handled on the gateway server? a) Use of the nobody aliases is irrelevant unless the gatewayed domain accepts to all and places in one account, such as Imail nobody and Mdameon. b) The scripts are meant to search the database for all mail boxes, and the aliases2ldap is to find the aliases. 4) I'm wondering about how the lookups happen. Is the information pulled completely to the MX server when the script is run, or is it queried off of the mail server every time a message comes in? The local Imail database for the local domain which is pinch hitting for the gatewayed domain is updated with the appropriate aliases each time the script is run. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] ANN: Availability of ldap2aliases 0.5.00, useful script for IMail MXs fronting IMail mailbox servers
Thanks to John for stepping in! Everything he said is on-point. I am, stupidly, still up. This will be my last post for tonight, though. 1) I have a mix of gatewayed domains and locally hosted domains. It seems that this script is really built for locally hosted domains and would need to be extended to say take in addresses stored in a flat file or database. Is that correct? The script doesn't discriminate between mailbox servers located behind your MX on an internal subnet and mailbox servers located on another site entirely. It uses LDAP/TCP for all transport and has no difficulty traversing a WAN (in fact, it is especially useful in such scenarios). However, it _does_ discriminate based on the MTA vendor and LDAP flavor in use on the mailbox server. It has been written specifically for IMail 8.12 with its built-in OpenLDAP. Can be tweaked for any LDAP server, particularly AD (in fact, exchange2aliases is a close approximation of such an AD tweak of ldap2aliases). I had no intention of supporting IMail's LDAP prior to the OpenLDAP introduction, since it was totally buggy. Using the standard OpenLDAP platform has made these scripts possible, a good call by Ipwitch. 2) I'm unfamiliar with IMail's ability to do envelope rejection based on LDAP data. Could you explain how this works, or possibly point me to a relevant article from Ipswitch on how this works? IMail will be doing envelope rejection not based on LDAP interaction during the envelope, but on its traditional alias check. Every user on the mailbox server has an alias on the MX. SMTPD isn't speaking LDAP. (I really shouldn't mention this now, but we do have a tool that does allow IMail's SMTPD to query LDAP in real-time...since you guessed that way. But that's not at all what's happening with this solution. Pay no attention.) I'm also curious as to how Declude would see these addresses, i.e. is everything set up as an alias on the scanning server where say [EMAIL PROTECTED] would be aliased to [EMAIL PROTECTED] There's a virtual host, storeforward.mailpure.com, on the MX. This host has a host alias for mailpure.com. There's a standard alias, forums, under storeforward.mailpure.com. Its target is, for example, [EMAIL PROTECTED] The IP of mail1.mailpure.com, the mailbox server, is entered in the HOSTS file on the MX or listed in DNS with a traditional MX record. Depending on the SWITCHRECIP setting, I believe Declude sees these users as being under storeforward.mailpure.com or mail1.mailpure.com. Whichever it is allows for all of the usual user.junkmail files. 3) Some domains of course use nobody aliases, and some gatewayed domains don't have complete lists of users available. I'm wondering if and how this is handled on the gateway server? Well, you just wouldn't run the sync script for domains for which you _need_ to accept all mail--it's that simple. They'd remain standard HOSTS-routed remote domains. 4) I'm wondering about how the lookups happen. Is the information pulled completely to the MX server when the script is run, or is it queried off of the mail server every time a message comes in? Whenever you run the script, the alias info is pulled from the mailbox server. If the script fails to run because the mailbox server can't be reached, the last retrieved aliases just stay in place, a failsafe. HTH. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ANN: Availability of ldap2aliases 0.5.00, useful script for IMail MXs fronting IMail mailbox servers
Thanks for the explanation. I'm still however less than perfectly clear as to how the gateway handles the forwarding of the E-mail to the real mail server. Am I correct in assuming that the gateway would have [EMAIL PROTECTED] configured as an alias that pointed to [EMAIL PROTECTED] and the main mail server would need to have a domain alias set up for destination.example.com in order to get the E-mail? If so, being that I gateway for other servers not under my control, I would need for my clients to set their servers up with their own domain aliases for destination.example.com? If this is the case I'm probably better off still going to ORF route and running IMail/Declude in tandem. Please correct me if I'm wrong about this. Thanks, Matt Sanford Whiteman wrote: Thanks to John for stepping in! Everything he said is on-point. I am, stupidly, still up. This will be my last post for tonight, though. 1) I have a mix of gatewayed domains and locally hosted domains. It seems that this script is really built for locally hosted domains and would need to be extended to say take in addresses stored in a flat file or database. Is that correct? The script doesn't discriminate between mailbox servers located "behind" your MX on an internal subnet and mailbox servers located on another site entirely. It uses LDAP/TCP for all transport and has no difficulty traversing a WAN (in fact, it is especially useful in such scenarios). However, it _does_ discriminate based on the MTA vendor and LDAP flavor in use on the mailbox server. It has been written specifically for IMail 8.12 with its built-in OpenLDAP. Can be tweaked for any LDAP server, particularly AD (in fact, exchange2aliases is a close approximation of such an AD tweak of ldap2aliases). I had no intention of supporting IMail's LDAP prior to the OpenLDAP introduction, since it was totally buggy. Using the standard OpenLDAP platform has made these scripts possible, a good call by Ipwitch. 2) I'm unfamiliar with IMail's ability to do envelope rejection based on LDAP data. Could you explain how this works, or possibly point me to a relevant article from Ipswitch on how this works? IMail will be doing envelope rejection not based on LDAP interaction during the envelope, but on its traditional alias check. Every user on the mailbox server has an alias on the MX. SMTPD isn't speaking LDAP. (I really shouldn't mention this now, but we do have a tool that does allow IMail's SMTPD to query LDAP in real-time...since you guessed that way. But that's not at all what's happening with this solution. Pay no attention.) I'm also curious as to how Declude would see these addresses, i.e. is everything set up as an alias on the scanning server where say [EMAIL PROTECTED] would be aliased to [EMAIL PROTECTED]? There's a virtual host, storeforward.mailpure.com, on the MX. This host has a host alias for mailpure.com. There's a standard alias, forums, under storeforward.mailpure.com. Its target is, for example, [EMAIL PROTECTED]. The IP of mail1.mailpure.com, the mailbox server, is entered in the HOSTS file on the MX or listed in DNS with a traditional MX record. Depending on the SWITCHRECIP setting, I believe Declude sees these users as being under storeforward.mailpure.com or mail1.mailpure.com. Whichever it is allows for all of the usual user.junkmail files. 3) Some domains of course use nobody aliases, and some gatewayed domains don't have complete lists of users available. I'm wondering if and how this is handled on the gateway server? Well, you just wouldn't run the sync script for domains for which you _need_ to accept all mail--it's that simple. They'd remain standard HOSTS-routed remote domains. 4) I'm wondering about how the lookups happen. Is the information pulled completely to the MX server when the script is run, or is it queried off of the mail server every time a message comes in? Whenever you run the script, the alias info is pulled from the mailbox server. If the script fails to run because the mailbox server can't be reached, the last retrieved aliases just stay in place, a failsafe. HTH. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from
Re[2]: [Declude.JunkMail] ANN: Availability of ldap2aliases 0.5.00, useful script for IMail MXs fronting IMail mailbox servers
Am I correct in assuming that the gateway would have [EMAIL PROTECTED] configured as an alias that pointed to [EMAIL PROTECTED] and the main mail server would need to have a domain alias set up for destination.example.com in order to get the E-mail? The server does indeed need to be able to receive the e-mail at a secondary routing domain. However...since the script is designed for IMail servers that are already following best practices: - The OHN of the virtual host on the mailbox server should already _not_ be example.com (example.com should be a host alias for an OHN such as mail.example.com). So you should be able to simply use the OHN of the virtual host as the routing domain. - You can use a domain literal as the routing domain, and this should already be set up on the mailbox server. - IMail's topmost host name on the mailbox server will _surely_ not be example.com, so you can use this routing domain (note the double '@'): @example.com@server host name If a server doesn't meet these conditions and absolutely can't be touched to add another host alias, it can't be used by ldap2aliases. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] [OT] Good iMail syslog viewer
Hello, Was wondering if anyone knows of a good iMail syslog viewer. Would like to see the IP addresses of messages arriving to try and block the [EMAIL PROTECTED], [EMAIL PROTECTED], etc. type of mass mailers.. Thanks..
RE: [Declude.JunkMail] [OT] Good iMail syslog viewer
http://www.baremetalsoft.com/baretail/index.php Great program except for the nag screen. Fritz Frederick P. Squib, Jr. Network Operations/Mail Administrator Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html mail /\- against microsoft attachments -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze Sent: Wednesday, July 28, 2004 10:59 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] [OT] Good iMail syslog viewer Hello, Was wondering if anyone knows of a good iMail syslog viewer. Would like to see the IP addresses of messages arriving to try and block the [EMAIL PROTECTED], [EMAIL PROTECTED], etc. type of mass mailers.. Thanks.. --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [OT] Good iMail syslog viewer
Was wondering if anyone knows of a good iMail syslog viewer. www.kiwisyslog.com. Indispensable. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [OT] Good iMail syslog viewer
Are you looking for something like the unix tail f command? We are finishing up on a Windows program that works like tail f and grep combined. Let me know if you are interested and Ill work harder. It is not far from completion. Thanks, Evans Martin http://www.martekware.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze Sent: Wednesday, July 28, 2004 9:59 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] [OT] Good iMail syslog viewer Hello, Was wondering if anyone knows of a good iMail syslog viewer. Would like to see the IP addresses of messages arriving to try and block the [EMAIL PROTECTED], [EMAIL PROTECTED], etc. type of mass mailers.. Thanks..
Re: [Declude.JunkMail] ANN: Availability of ldap2aliases 0.5.00, useful script for IMail MXs fronting IMail mailbox servers
Sanford Whiteman wrote: - IMail's topmost host name on the mailbox server will _surely_ not be example.com, so you can use this routing domain (note the double '@'): @example.com@server host name I understood the other points/issues, but not the one above. I'm not sure that matters though. My plan is to maintain just one scanning system for the time being, and have my backup gateway set up in cold-swap mode (config dumped regularly to it, but only ORF should be used under normal circumstances). I will have to run MS SMTP/ORF on the primary as well however for the same address validation needs, and that means some extra lifting of the damn files on the same box, which isn't the most optimized solution out there, especially considering that the licensing costs are more than the hardware costs. I like ORF because it is configurable for the result code that gets returned, and you can set up blacklists to do envelope rejection (should be reserved only for the worst offenders and nominations should not last long at all) in addition to RCPT To verification. I don't get that the folks at Ipswitch will ever provide such a thing, and if they did, they would surely mess it up. I think I'm back to a double SMTP server/same server set up because of the third-party domains that I am scanning for. For those that don't deal with third-party domains, this seems like a workable solution for them. Matt If a server doesn't meet these conditions and absolutely can't be touched to add another host alias, it can't be used by ldap2aliases. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Unique spam/hold directories
Scott, has any more thought been given to implementing different spam/hold directories for different domains or for matching certain weights? Instead of deleting mail over a certain weight, I would like to be able to drop it into a separate directory for parsing and submission to spam databases - is that possible today? Or, in the alternative, maybe a forward option that could handle a qualifier like: If weight 35, does not include test spam-test, then forward to [EMAIL PROTECTED] Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
Scott, has any more thought been given to implementing different spam/hold directories for different domains or for matching certain weights? It's something we still want to do, but it isn't as easy as it sounds, which is why it has not happened yet. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Scott, has any more thought been given to implementing different spam/hold directories for different domains or for matching certain weights? It's something we still want to do, but it isn't as easy as it sounds, which is why it has not happened yet. Are external tests run after all Declude internal tests have been run? Do external tests get run in the order they are placed in the global.cfg file? If external tests are run last, and external tests are run in the order listed in the global.cfg, and I create an external test and place it last in the list of external tests, can Declude JM send me the current total weight and tests that have failed along with the message? Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
Are external tests run after all Declude internal tests have been run? No. They are run in the middle. Do external tests get run in the order they are placed in the global.cfg file? If there are multiple external tests, the external tests will be run in the order they are placed in the global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Are external tests run after all Declude internal tests have been run? No. They are run in the middle. Do external tests get run in the order they are placed in the global.cfg file? If there are multiple external tests, the external tests will be run in the order they are placed in the global.cfg file. Okay, final question on this subject. Can I setup declude to send me the final resolved message instead of sending it back to IMail? I seem to recall that Declude supported something like chaining? Then my app would ultimately be responsible for final processing and forwarding of the messages back to IMail for delivery. Is this possible...? Thanks! Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
Okay, final question on this subject. Can I setup declude to send me the final resolved message instead of sending it back to IMail? I seem to recall that Declude supported something like chaining? Yes, you can do that, by adding a line such as DAISYCHAIN C:\IMail\Declude\program.exe to the \IMail\Declude\global.cfg file. Your program will be called with the Q*.SMD filename. However, this is more complex than an external test, as you have to take care of locking the file and starting SMTP32.exe (see http://support.ipswitch.com/kb/IM-2517-DM01.htm for details). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bogus Date header
I am trying to help out the admin of another server by showing him results from Declude here on our server. I am unclear as to what's wrong with the Date: header below. I suspect that it was added by Imail. The bad header lookup at Declude.com lists it as a bogus Date: header. If Imail added it shouldn't it be listed as a missing Date: header instead of a bogus one? What am I missing? (XXX's added by me) Received: from by firstcoastmail.com with ESMTP (SMTPD32-7.13) id A1825C6E0102; Wed, 28 Jul 2004 12:17:06 -0400 Received: from XXX by X via csmap id fb66b594_e0b1_11d8_8648_00304824a5c7_16592; Wed, 28 Jul 2004 11:20:04 -0500 (CDT) Received: from XXX by with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2657.72) id NM2L8MRV; Wed, 28 Jul 2004 11:17:04 -0500 Received: from XXX by X (IBM MVS SMTP CS V1R2) with BSMTP id 7868; Wed, 28 Jul 04 11:17:51 CDT TO: XXX FROM: SUBJECT: 09-A-10Q602 V2 MATERIAL DAMAGE APPRAISAL MIME-VERSION: 1.0; CONTENT-TYPE: TEXT/HTML; CHARSET=US-ASCII Message-Id: [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c020020c]. X-RBL-Warning: HELOBOGUS: Domain has no MX or A records [0301]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c020020c]. X-Declude-Sender: X-Declude-Spoolname: Dd1825c6e010245a8.SMD X-Note: X-Note: This message was scanned for Spam X-Test-Failed: BADHEADERS, HELOBOGUS, SPAMHEADERS, GIBBERISH, WEIGHT4, CATCHALLMAILS X-Note: Total spam weight of this E-mail is 20. X-Note: Recipient Host:XX X-Note: Sender Address:XX X-Note: Sender Host Name: XXX X-Note: Sender IP Address: X X-Note: Sender Country ID: X-Note: Date: Wed, 28 Jul 2004 12:17:12 -0400 X-RCPT-TO: XXX Status: R X-UIDL: 390996653 David Fletcher InfoTech International, LLC. (904)338-9234 -- Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bogus Date header
I am trying to help out the admin of another server by showing him results from Declude here on our server. I am unclear as to what's wrong with the Date: header below. I suspect that it was added by Imail. That is exactly the problem. Since it was added by IMail, it means that there was no Date: header when the E-mail was received. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bogus Date header
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Fletcher Sent: Wednesday, July 28, 2004 3:01 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Bogus Date header I am trying to help out the admin of another server by showing him results from Declude here on our server. I am unclear as to what's wrong with the Date: header below. I suspect that it was added by Imail. The bad header lookup at Declude.com lists it as a bogus Date: header. If Imail added it shouldn't it be listed as a missing Date: header instead of a bogus one? What am I missing? (XXX's added by me) Received: from by firstcoastmail.com with ESMTP (SMTPD32-7.13) id A1825C6E0102; Wed, 28 Jul 2004 12:17:06 -0400 Received: from XXX by X via csmap id fb66b594_e0b1_11d8_8648_00304824a5c7_16592; Wed, 28 Jul 2004 11:20:04 -0500 (CDT) Received: from XXX by with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2657.72) id NM2L8MRV; Wed, 28 Jul 2004 11:17:04 -0500 Received: from XXX by X (IBM MVS SMTP CS V1R2) with BSMTP id 7868; Wed, 28 Jul 04 11:17:51 CDT Just a thought, Could it be the IBM MVS SMTP product needs to use a 4-digit year? ~Patrick --- [This E-mail scanned for viruses at HGBD by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bogus Date header
Thanks. I just wanted to be sure. -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 28, 2004 3:10 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Bogus Date header I am trying to help out the admin of another server by showing him results from Declude here on our server. I am unclear as to what's wrong with the Date: header below. I suspect that it was added by Imail. That is exactly the problem. Since it was added by IMail, it means that there was no Date: header when the E-mail was received. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
For a simple implementation of this, why not try: WEIGHT20 MAILBOX SUPERSPAM WEIGHT10 MAILBOX SPAM in the CFG file? - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 28, 2004 1:19 PM Subject: [Declude.JunkMail] Unique spam/hold directories Scott, has any more thought been given to implementing different spam/hold directories for different domains or for matching certain weights? Instead of deleting mail over a certain weight, I would like to be able to drop it into a separate directory for parsing and submission to spam databases - is that possible today? Or, in the alternative, maybe a forward option that could handle a qualifier like: If weight 35, does not include test spam-test, then forward to [EMAIL PROTECTED] Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bogus Date header
what is the easiest way to refuse mail from a remote ip imail or declude ? if imail, how to configure ? TIA - Original Message - From: David Fletcher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 28, 2004 7:27 PM Subject: RE: [Declude.JunkMail] Bogus Date header Thanks. I just wanted to be sure. -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 28, 2004 3:10 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Bogus Date header I am trying to help out the admin of another server by showing him results from Declude here on our server. I am unclear as to what's wrong with the Date: header below. I suspect that it was added by Imail. That is exactly the problem. Since it was added by IMail, it means that there was no Date: header when the E-mail was received. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bogus Date header
what is the easiest way to refuse mail from a remote ip imail or declude ? if imail, how to configure ? The best way (and probably easiest) is the IMail SMTP Control Access file (in the SMTP security settings). It should be fairly straightforward to block individual IPs there. That will prevent the SMTP connection from occurring, which saves on bandwidth. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Okay, final question on this subject. Can I setup declude to send me the final resolved message instead of sending it back to IMail? I seem to recall that Declude supported something like chaining? Yes, you can do that, by adding a line such as DAISYCHAIN C:\IMail\Declude\program.exe to the \IMail\Declude\global.cfg file. Your program will be called with the Q*.SMD filename. However, this is more complex than an external test, as you have to take care of locking the file and starting SMTP32.exe (see http://support.ipswitch.com/kb/IM-2517-DM01.htm for details). Thanks Scott, I appreciate your feedback on this! Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unique spam/hold directories
- Original Message - From: Dave Doherty [EMAIL PROTECTED] For a simple implementation of this, why not try: WEIGHT20 MAILBOX SUPERSPAM WEIGHT10 MAILBOX SPAM in the CFG file? I could do that, except I want the files in their D*.SMD and Q*.SMD formats, not in an mbx file. That way I can parse the D files for data I am looking for and then modify the appropriate Q files so that I can automate the reporting to different spam databases. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bogus Date header
Doesn't the Imail SMTP control only allow for 20 ip addresses? Thanks Robert - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 28, 2004 4:45 PM Subject: Re: [Declude.JunkMail] Bogus Date header what is the easiest way to refuse mail from a remote ip imail or declude ? if imail, how to configure ? The best way (and probably easiest) is the IMail SMTP Control Access file (in the SMTP security settings). It should be fairly straightforward to block individual IPs there. That will prevent the SMTP connection from occurring, which saves on bandwidth. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bogus Date header
Doesn't the Imail SMTP control only allow for 20 ip addresses? It's unclear -- I believe that there is no limit, although someone from Ipswitch did post that there was a limit (20? 100?), but I believe he was mistaken. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
