Re: CBL:RE: [Declude.JunkMail] Declude and Ipswitch ICS
Bud Durland wrote: There's been an almost hysterical reaction to the ICS announcement. People have right to be angry disappointed over it; but traffic on he iMail list almost seems like a knee-jerk reaction: Good lord that's a lot of money -- I'm buying something else right now. If GM decided to only make Cadillacs, does that mean your Chevy is suddenly un-drivable? Your exiting iMail installation isn't going to stop working just because your service agreement ran out. I mean, are there really any show stopper bugs in iMail right now? The problem is this.. at least in my case... 1) I am not going to renew my service agreement because I know that I will not migrate to ICS so why would I spend more money with IPSwitch? 2) Because of #1 I am putting myself in a bind because as soon as a security flaw is found (and they have existed in IMail product) then I have to either go buy a service agreement which I didn't want to do... for $495 in my case... or I can right now make the jump to SmarterMail for $200 and it has a free migration util and I can be in a perfect place again. Sure I lose Calendaring but the calendar in IMail has just been useless because it was in WebMail only so nobody was using it. I would bet that my situation is the same for others and this is a painful place to be. On the one hand you don't want to waste money, and on the other hand you want to be sure that you'll be on a secure platform so that you won't have your server taken over. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: CBL:RE: [Declude.JunkMail] Declude and Ipswitch ICS
All, We're missing one huge point and that is why purchase support agreements from Ipswitch. Let's review. 1. To get phone support. 2. To get major software updates. Everyone else keeps adding: 3. To get security hotfixes. However, #3 is incorrect: From Ipswitch.com Patches and Upgrades - Registered users for the current major version of a product may obtain patches and minor updates within that version. Upgrades to the next major version of a product are available only under warranty or Service Agreement. So, let's review the two options. 1. Phone Support -- I think I can speak for the majority of the users on this list when I say that we've probably called Ipswitch once just because we were lazy. The reality is that the users on this list (and therefore the people who are freaking out) are technically savvy and can research a configuration issue/problem without calling Ipswich. Therefore we don't need a support agreement for phone support. 2. Major Software Updates. -- There aren't going to be anymore unless you KNOW you're going to ICS which gets you a discount. So, there's really no reason to renew a support contract or to freak out. 8.13 is out and will continue to suffice the vast majority of its users for 12-36 months. That's an eternity in technology terms. The only reason to freak out is because Ipswich has pissed off their customer base by not giving people a heads up and slapping us in the fact with the price tag on a piece of software that we probably won't use. Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Ipswitch ICS
The only reason to freak out is because Ipswich has pissed off their customer base by not giving people a heads up and slapping us in the fact Well I think a lot of us are concerned because we have invested a lot of money and time into Imail: 1. platform - Windows vs. free Linux alternative 2. add ons - declude and anti-virus 3. time on setups, configs, automated tools, scripts, etc If I have to switch mail platforms most of that goes out the window. I now have to re-evaluate several mail clients - pick one and hope it works as well as iMail did, and that companies like Declude will support them. I don't think any of us would be as upset if a year ago Ipswitch published their intentions to kill off Imail which would have allowed everyone to come up with migration plans or upgrade, but now as others have pointed out if something security or bug wise shows up in current or older versions of Imail - will Ipswitch release patches or upgrades? Jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Ipswitch ICS
Great article! Ipswitch wouldnt be the first company destroyed by an MBA, they seem to be so enamoured with their MBA status that they overlook the reason the company was succesful in the first place... I bet the MBAs and Marketing people at Ipswitch ride to and from work in a short bus Rick Davidson National Systems Manager North American Title Group - Copy of Original Message(s): - sl So... I saw this link on the Ipswitch forums and it's a good read - I sl don't think it's been posted here yet. sl http://www.joelonsoftware.com/items/2004/10/26.html sl -jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Ipswitch ICS
I don't think any of us would be as upset if a year ago Ipswitch published their intentions to kill off Imail which would have allowed everyone to come up with migration plans or upgrade. Exactly. In fact, I find Ipswitch's actions to be completely deceitful. Here is the email from the 8.12 release notice of Imail. as well as support for the upcoming add-on collaboration tools -0- -Original Message- From: Ipswitch, Inc. [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 16, 2004 12:41 PM To: [EMAIL PROTECTED] Subject: IMail Server 8.12 is here Hello, We are excited to announce that IMail Server 8.12 has just been released. As a Service Agreement holder, you are entitled to a free upgrade, which you can download here: http://visit.ipswitch.com/812patch This release includes a number of fixes, as well as support for the upcoming add-on collaboration tools, available in late July. We apologize for the delays in releasing IMail Collaboration, but we want to ensure a high-quality release. We are confident that when these tools ship, they will have been worth the wait. Best regards, David Karp Product Marketing Manager, Messaging Ipswitch, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Ipswitch ICS
So, you're saying this is an example of bait and Ipswitch? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark E. Smith Sent: Wednesday, October 27, 2004 9:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude and Ipswitch ICS Exactly. In fact, I find Ipswitch's actions to be completely deceitful. Here is the email from the 8.12 release notice of Imail. snip --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude development strategy
We have been asked to be more explicit as to our future strategy but like every well managed software company we are reluctant to set expectations we cannot meet, so with every caveat imaginable in mind here is the outline of the plan. Downloadable Windows based version - In design with three options on the table; MS SMTP, Listening on Port 25, or alternative mail server. Each of these choices has pluses and minuses and we will shortly make a decision as to the first roll out choice. This does not preclude us from offering all of these options over time. Linux based appliance - obviously using Linux and either Postfix or QMail. The final choice has not been made. All options will have Message Sniffer and additional third party applications available. With the recent announcement and the flurry of activity on the mailing lists we are watching and reading and we are committed to reaching decisions that will make at least some of the people happy all of the time. Barry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude and Ipswitch ICS
LOL! Darin. - Original Message - From: Sean Fahey [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 11:09 AM Subject: RE: [Declude.JunkMail] Declude and Ipswitch ICS So, you're saying this is an example of bait and Ipswitch? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark E. Smith Sent: Wednesday, October 27, 2004 9:48 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude and Ipswitch ICS Exactly. In fact, I find Ipswitch's actions to be completely deceitful. Here is the email from the 8.12 release notice of Imail. snip --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude development strategy
Barry, Thanks for the insight. My only suggestion (and this might be the case) is to continue to upgrade the current product and it's dependency on Imail for at least 12-24 months. Those of us who are simply using Imail for a Gateway have no real need to move off of it in the short term. Thanks! Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Wednesday, October 27, 2004 11:24 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude development strategy We have been asked to be more explicit as to our future strategy but like every well managed software company we are reluctant to set expectations we cannot meet, so with every caveat imaginable in mind here is the outline of the plan. Downloadable Windows based version - In design with three options on the table; MS SMTP, Listening on Port 25, or alternative mail server. Each of these choices has pluses and minuses and we will shortly make a decision as to the first roll out choice. This does not preclude us from offering all of these options over time. Linux based appliance - obviously using Linux and either Postfix or QMail. The final choice has not been made. All options will have Message Sniffer and additional third party applications available. With the recent announcement and the flurry of activity on the mailing lists we are watching and reading and we are committed to reaching decisions that will make at least some of the people happy all of the time. Barry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS
Funny but sadly true. Definition: A sales tactic in which a bargain-priced item is used to attract customers who are then encouraged to purchase a more expensive similar item. This is a punishable legal offense. I do think there is very clearly a basis for action against Ipswitch here. I do think that the efficacy of a lawsuit would be quite good, particularly a class action involving lots of abused customers. I think a Federal judge's opinion would land on the side of Imail users. That's just my own personal opinion, but I have spent millions in legal fees regarding my more than 30 patents. I think the definition above says a lot about what is happening here. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - SF So, you're saying this is an example of bait and Ipswitch? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS
So we have been baited for seven years?? And now the ol' Ipswitch-a-roo??? I know there is a lot of anger, frustration, etc., but the talk of legal action is a waste of bandwidth. I'm not happy either, but am not about to spend 10's of thousands to end up with (as someone said yesterday) a coupon for an Ipswitch product (probably WS-FTP LE! - I'm sure they have some old diskettes of that in a drawer someplace). John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Lee Heath Sent: Wednesday, October 27, 2004 10:37 AM To: Sean Fahey Subject: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS Funny but sadly true. Definition: A sales tactic in which a bargain-priced item is used to attract customers who are then encouraged to purchase a more expensive similar item. This is a punishable legal offense. I do think there is very clearly a basis for action against Ipswitch here. I do think that the efficacy of a lawsuit would be quite good, particularly a class action involving lots of abused customers. I think a Federal judge's opinion would land on the side of Imail users. That's just my own personal opinion, but I have spent millions in legal fees regarding my more than 30 patents. I think the definition above says a lot about what is happening here. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - SF So, you're saying this is an example of bait and Ipswitch? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] Declude and Ipswitch ICS
The seven years enforces the argument, not weakens it. I did not propose litigation. I stated I think litigation could be successful in my opinion. Also, WS_FTP has not been discontinued and put into a suite of products at ten times the costs. So none of these things apply. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - JC So we have been baited for seven years?? And now the ol' Ipswitch-a-roo??? I JC know there is a lot of anger, frustration, etc., but the talk of legal JC action is a waste of bandwidth. I'm not happy either, but am not about to JC spend 10's of thousands to end up with (as someone said yesterday) a coupon JC for an Ipswitch product (probably WS-FTP LE! - I'm sure they have some old JC diskettes of that in a drawer someplace). JC John JC -Original Message- JC From: [EMAIL PROTECTED] JC [mailto:[EMAIL PROTECTED] On Behalf Of R. Lee Heath JC Sent: Wednesday, October 27, 2004 10:37 AM JC To: Sean Fahey JC Subject: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS JC Funny but sadly true. JC Definition: A sales tactic in which a bargain-priced item is used to JC attract customers who are then encouraged to purchase a more expensive JC similar item. JC This is a punishable legal offense. I do think there is very clearly a JC basis for action against Ipswitch here. I do think that the efficacy JC of a lawsuit would be quite good, particularly a class action JC involving lots of abused customers. I think a Federal judge's opinion JC would land on the side of Imail users. That's just my own personal JC opinion, but I have spent millions in legal fees regarding my more JC than 30 patents. JC I think the definition above says a lot about what is happening here. JC -- JC Roger Heath JC [EMAIL PROTECTED] JC www.rleeheath.com JC - Copy of Original Message(s): - SF So, you're saying this is an example of bait and Ipswitch? JC --- JC [This E-mail was scanned for viruses by Declude Virus JC (http://www.declude.com)] JC --- JC This E-mail came from the Declude.JunkMail mailing list. To JC unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JC type unsubscribe Declude.JunkMail. The archives can be found JC at http://www.mail-archive.com. JC --- JC [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] JC --- JC This E-mail came from the Declude.JunkMail mailing list. To JC unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JC type unsubscribe Declude.JunkMail. The archives can be found JC at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS
Yah, I was cracking a joke but I agree wholeheartedly - it's best to just move on and get over it. I won't be buying or recommending their products in the future. Since so many seem to feel the same way, I expect that will hurt them far more than a lawsuit would. Nothing kills your business faster than screwing with your existing (and up until recently) loyal customers. They'll spend a lot more money and resources recovering from lost business and trying to find new suckers, er... I mean valued customers. Their reputation might be too dinged up now. They're not THAT big or deep - I predict they'll get acquired within 2 years, or just go out with a whimper. It's not like there isn't a lot of low cost (and even free) alternatives available. It's obvious to me that they're taking the Look at us, we're enterprise-capable, we're like Exchange! approach because OSS and other value point competitors are eating their lunch. I've been looking at ClarkConnect for awhile... http://www.clarkconnect.com and like quite a bit about it. Sean -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Wednesday, October 27, 2004 11:05 AM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS So we have been baited for seven years?? And now the ol' Ipswitch-a-roo??? I know there is a lot of anger, frustration, etc., but the talk of legal action is a waste of bandwidth. I'm not happy either, but am not about to spend 10's of thousands to end up with (as someone said yesterday) a coupon for an Ipswitch product (probably WS-FTP LE! - I'm sure they have some old diskettes of that in a drawer someplace). John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Lee Heath Sent: Wednesday, October 27, 2004 10:37 AM To: Sean Fahey Subject: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS Funny but sadly true. Definition: A sales tactic in which a bargain-priced item is used to attract customers who are then encouraged to purchase a more expensive similar item. This is a punishable legal offense. I do think there is very clearly a basis for action against Ipswitch here. I do think that the efficacy of a lawsuit would be quite good, particularly a class action involving lots of abused customers. I think a Federal judge's opinion would land on the side of Imail users. That's just my own personal opinion, but I have spent millions in legal fees regarding my more than 30 patents. I think the definition above says a lot about what is happening here. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - SF So, you're saying this is an example of bait and Ipswitch? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
Rick, I was looking at your filter -- great idea. One question (which falls under the processing order) If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, October 26, 2004 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? 1 in 500,000? That's fantastic. I think that qualifies for the anti-spam guru of the week award! heh, that is no exageration either, it is mainly due to spending alot of time in looking at false positives and finding ways to prevent them. For example use filtering to look for legit mail, the attached filter file runs before all other filters, it contains things that I found in false positives. This file is my number one false positive eliminator, my second method is test the hell out of any significant changes first. I do have the luxury of having to only filter for one company and I can be fairly restrictive I will see if I can get my configs somewhere for download, I am willing to share my work because I hate spam and spammers so much... man do i hate them. Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and Ipswitch ICS
My wild guess is that the brain trust at Ipswitch decided they either needed to lower their prices or raise them. I don't blame them for deciding to switch to a higher pricing / less customers business plan. I do blame them for what appears to be a horrid transition. They do have some time to do the right thing. I'm not holding my breath waiting. -Dan Rapaport, Cayuga Computers and IthacaDomains.com -- Original Message -- From: Sean Fahey [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 27 Oct 2004 11:50:46 -0500 Yah, I was cracking a joke but I agree wholeheartedly - it's best to just move on and get over it. I won't be buying or recommending their products in the future. Since so many seem to feel the same way, I expect that will hurt them far more than a lawsuit would. Nothing kills your business faster than screwing with your existing (and up until recently) loyal customers. They'll spend a lot more money and resources recovering from lost business and trying to find new suckers, er... I mean valued customers. Their reputation might be too dinged up now. They're not THAT big or deep - I predict they'll get acquired within 2 years, or just go out with a whimper. It's not like there isn't a lot of low cost (and even free) alternatives available. It's obvious to me that they're taking the Look at us, we're enterprise-capable, we're like Exchange! approach because OSS and other value point competitors are eating their lunch. I've been looking at ClarkConnect for awhile... http://www.clarkconnect.com and like quite a bit about it. Sean --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
- Original Message - From: Mark E. Smith [EMAIL PROTECTED] Rick, I was looking at your filter -- great idea. One question (which falls under the processing order) If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? By default, virus scanning happens before spam filtering, unless you use AVAFTERJM in either of your Virus or JunkMail config files. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
One question (which falls under the processing order) If you have: BODYSTOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? Declude Virus runs first. So in this case, Declude Virus would scan the E-mail -- and Declude JunkMail would only look at it if it was deemed virus-free by the virus scanner. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude development strategy
- Original Message - From: Barry Simpson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 08:23 Subject: [Declude.JunkMail] Declude development strategy We have been asked to be more explicit as to our future strategy but like every well managed software company we are reluctant to set expectations we cannot meet, so with every caveat imaginable in mind here is the outline of the plan. Downloadable Windows based version - In design with three options on the table; MS SMTP, Listening on Port 25, or alternative mail server. Each of these choices has pluses and minuses and we will shortly make a decision as to the first roll out choice. This does not preclude us from offering all of these options over time. Linux based appliance - obviously using Linux and either Postfix or QMail. The final choice has not been made. All options will have Message Sniffer and additional third party applications available. With the recent announcement and the flurry of activity on the mailing lists we are watching and reading and we are committed to reaching decisions that will make at least some of the people happy all of the time. We certainly would look at a product involving Postfix. -- A. Clausen[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
That is correct, declude virus processes before junkmail I did look at quite a few zip viruses and didnt see any of them using the Content-Type: application/x-zip-compressed in the mime info Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:03 PM Subject: RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? Rick, I was looking at your filter -- great idea. One question (which falls under the processing order) If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, October 26, 2004 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? 1 in 500,000? That's fantastic. I think that qualifies for the anti-spam guru of the week award! heh, that is no exageration either, it is mainly due to spending alot of time in looking at false positives and finding ways to prevent them. For example use filtering to look for legit mail, the attached filter file runs before all other filters, it contains things that I found in false positives. This file is my number one false positive eliminator, my second method is test the hell out of any significant changes first. I do have the luxury of having to only filter for one company and I can be fairly restrictive I will see if I can get my configs somewhere for download, I am willing to share my work because I hate spam and spammers so much... man do i hate them. Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream -0- Content-Type: multipart/mixed;boundary===IMail_v8.1== Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type: application/octet-stream; name=2004 Technology.xls Content-Transfer-Encoding: base64 == -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Wednesday, October 27, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? That is correct, declude virus processes before junkmail I did look at quite a few zip viruses and didnt see any of them using the Content-Type: application/x-zip-compressed in the mime info Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:03 PM Subject: RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? Rick, I was looking at your filter -- great idea. One question (which falls under the processing order) If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Tuesday, October 26, 2004 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? 1 in 500,000? That's fantastic. I think that qualifies for the anti-spam guru of the week award! heh, that is no exageration either, it is mainly due to spending alot of time in looking at false positives and finding ways to prevent them. For example use filtering to look for legit mail, the attached filter file runs before all other filters, it contains things that I found in false positives. This file is my number one false positive eliminator, my second method is test the hell out of any significant changes first. I do have the luxury of having to only filter for one company and I can be fairly restrictive I will see if I can get my configs somewhere for download, I am willing to share my work because I hate spam and spammers so much... man do i hate them. Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude development strategy
Barry, Thank you very much for sharing this information. Understandably it is too early to say exactly which one it will be at first, but I think that both you and your customers benefit from knowing the options considering the events that transpired. When you commit to a particular platform to develop, not that this would be an exclusive platform, please share this with your customers as well. I think that everyone here understands that it may take up to 6 months to get something migrated that is stable and ready to sell. Thanks, Matt Barry Simpson wrote: We have been asked to be more explicit as to our future strategy but like every well managed software company we are reluctant to set expectations we cannot meet, so with every caveat imaginable in mind here is the outline of the plan. Downloadable Windows based version - In design with three options on the table; MS SMTP, Listening on Port 25, or alternative mail server. Each of these choices has pluses and minuses and we will shortly make a decision as to the first roll out choice. This does not preclude us from offering all of these options over time. Linux based appliance - obviously using Linux and either Postfix or QMail. The final choice has not been made. All options will have Message Sniffer and additional third party applications available. With the recent announcement and the flurry of activity on the mailing lists we are watching and reading and we are committed to reaching decisions that will make at least some of the people happy all of the time. Barry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Determining a BCC Recipient
That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
That's a MIME type :) They are all over the place, and they can be forged. Here's how MS handles it: http://msdn.microsoft.com/library/default.asp?url=""> Matt Mark E. Smith wrote: Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream -0- Content-Type: multipart/mixed;boundary="==IMail_v8.1==" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type: application/octet-stream; name="2004 Technology.xls" Content-Transfer-Encoding: base64 == -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, October 27, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? That is correct, declude virus processes before junkmail I did look at quite a few zip viruses and didnt see any of them using the Content-Type: application/x-zip-compressed in the mime info Rick Davidson National Systems Manager North American Title Group - - Original Message - From: "Mark E. Smith" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:03 PM Subject: RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? Rick, I was looking at your filter -- great idea. One question (which falls under the processing order) If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Tuesday, October 26, 2004 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? 1 in 500,000? That's fantastic. I think that qualifies for the anti-spam guru of the week award! heh, that is no exageration either, it is mainly due to spending alot of time in looking at false positives and finding ways to prevent them. For example use filtering to look for legit mail, the attached filter file runs before all other filters, it contains things that I found in false positives. This file is my number one false positive eliminator, my second method is test the hell out of any significant changes first. I do have the luxury of having to only filter for one company and I can be fairly restrictive I will see if I can get my configs somewhere for download, I am willing to share my work because I hate spam and spammers so much... man do i hate them. Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] Determining a BCC Recipient
Rick, I am looking at creating our own email archiving solution using sql This, as Matt notes, could be monstrous. It certainly is not best-practice to store this many CLOBs (or BLOBs, if you're decoding MIME) in a generic DB. That's why the only RDBMS message stores worth their salt are Exchange, Notes (sort of), and the archiving vendors' back ends, as they are purpose-built on both client and server ends. If you do go the RDBMS route, you should definitely consider auto-splitting by date into separate tables and/or separate databases to enable scaling out. However, I'd suggest instead that you use a well-known format such as MBOX and an MBOX-aware, high-capacity indexing/search product like dtSearch. We've used dtSearch Web as a message archive-and-search mechanism and have been very happy with the speed (though, admittedly, the display needs a lot of tweaks). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam?
Title: Message Microsoft software is probably the "most guilty" for using the vague application-octet-stream MIME type instead of something more explicit, like application/msexcel. PDF is also very likely to come as a stream. I place viruses and malware asa distant 3rd for using stream. As a result, my"attachment type" skip logic (in a single filter text file) is more brief than has been talked about in this thread, but has been working for me, and was based on Rick Davidson's earlier work. Couple this with Matt's Size.vbs script or the compiled version that (the other) Scott hosts and you've got a useful way to skip wasteful body filters. #Based on a submission to the Declude Support list by Rick Davidson [EMAIL PROTECTED] #Jun-17-2004 AC This would be better as an external file and do these tests as a message size# and/or purpose-built searcher for the content-type keys. #These are sorted by most frequently appearing in our inbound mail BODY 0 CONTAINS content-type: application/msexcelBODY 0 CONTAINS content-type: application/mswordBODY 0 CONTAINS content-type: application/pdfBODY 0 CONTAINS content-type: application/vnd.ms-BODY 0 CONTAINS content-type: text/x-vcardBODY 0 CONTAINS content-type: application/x-zip-compressedBODY 0 CONTAINS content-type: application/zipBODY 0 CONTAINS content-type: application/rtf #Also frequent, but not in the same magnitude BODY 0 CONTAINS content-type: application/applefileBODY 0 CONTAINS content-type: application/mac-binhex40BODY 0 CONTAINS content-type: application/postscriptBODY 0 CONTAINS content-type: application/x-macbinaryBODY 0 CONTAINS content-type: application/x-ms-excelBODY 0 CONTAINS content-type: application/x-ms-wmzBODY 0 CONTAINS content-type: application/x-msdownloadBODY 0 CONTAINS content-type: application/x-msexcelBODY 0 CONTAINS content-type: application/x-stuffitBODY 0 CONTAINS content-type: audio/mpegBODY 0 CONTAINS content-type: audio/x-midiBODY 0 CONTAINS content-type: audio/x-mpegBODY 0 CONTAINS content-type: text/richtextBODY 0 CONTAINS content-type: video/aviBODY 0 CONTAINS content-type: video/mpegBODY 0 CONTAINS content-type: video/mpgBODY 0 CONTAINS content-type: video/x-mpegBODY 0 CONTAINS content-type: video/x-ms-asfBODY 0 CONTAINS content-type: video/x-ms-wmvBODY 0 CONTAINS content-type: video/x-msvideo #Jul-21-2004 AC If I had a nickel for every crap mailhost that sends PDF in the octet stream# format so that we can't get Declude to really tell the filetype...# There is now a small counterweight for .pdf" in the body, see BentallNegText.txt #Original line items I've not implemented#BODY 0 CONTAINS .PDF#BODY 0 CONTAINS X-MS-Attachment: -Original Message-From: Matt [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 12:03 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?That's a MIME type :) They are all over the place, and they can be forged. Here's how MS handles it:http://msdn.microsoft.com/library/default.asp?url="">MattMark E. Smith wrote: Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream -0- Content-Type: multipart/mixed;boundary="==IMail_v8.1==" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type: application/octet-stream; name="2004 Technology.xls" Content-Transfer-Encoding: base64 == -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, October 27, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? That is correct, declude virus processes before junkmail I did look at quite a few zip viruses and didnt see any of them using the Content-Type: application/x-zip-compressed in the mime info Rick Davidson National Systems Manager North American Title Group - - Original Message - From: "Mark E. Smith" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:03 PM Subject: RE: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? Rick, I was looking at your filter -- great idea. One question (which falls under the processing order) If you have: BODY STOPALLTESTS CONTAINS Content-Type: application/x-zip-compressed I think Declude Virus will still grab this correct? Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Tuesday, October 26, 2004 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
Re: [Declude.JunkMail] Determining a BCC Recipient
ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Determining a BCC Recipient
That's funny that you should ask. I just coded that one up in VBScript this last weekend. I even managed to decode base64 text attachments, remove quoted-printable encoding, and strip out all of the HTML code. If this is for archiving according to legal requirement, the attachments would probably be necessary however. Sandy had some good recommendations on how to archive. Maybe if you shared your requirements with the list, someone would have some recommendations as to how to approach this a better way. Matt Rick Davidson wrote: ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail
RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam?
Title: Message Problem was that this wasn't sent through Microsoft OL it was sent through IMail's web interface. Also, why would these content types go in the Body? Wouldn't they go in the HEADER? -0- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Wednesday, October 27, 2004 3:27 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Microsoft software is probably the "most guilty" for using the vague application-octet-stream MIME type instead of something more explicit, like application/msexcel. PDF is also very likely to come as a stream. I place viruses and malware asa distant 3rd for using stream. As a result, my"attachment type" skip logic (in a single filter text file) is more brief than has been talked about in this thread, but has been working for me, and was based on Rick Davidson's earlier work. Couple this with Matt's Size.vbs script or the compiled version that (the other) Scott hosts and you've got a useful way to skip wasteful body filters. #Based on a submission to the Declude Support list by Rick Davidson [EMAIL PROTECTED] #Jun-17-2004 AC This would be better as an external file and do these tests as a message size# and/or purpose-built searcher for the content-type keys. #These are sorted by most frequently appearing in our inbound mail BODY 0 CONTAINS content-type: application/msexcelBODY 0 CONTAINS content-type: application/mswordBODY 0 CONTAINS content-type: application/pdfBODY 0 CONTAINS content-type: application/vnd.ms-BODY 0 CONTAINS content-type: text/x-vcardBODY 0 CONTAINS content-type: application/x-zip-compressedBODY 0 CONTAINS content-type: application/zipBODY 0 CONTAINS content-type: application/rtf #Also frequent, but not in the same magnitude BODY 0 CONTAINS content-type: application/applefileBODY 0 CONTAINS content-type: application/mac-binhex40BODY 0 CONTAINS content-type: application/postscriptBODY 0 CONTAINS content-type: application/x-macbinaryBODY 0 CONTAINS content-type: application/x-ms-excelBODY 0 CONTAINS content-type: application/x-ms-wmzBODY 0 CONTAINS content-type: application/x-msdownloadBODY 0 CONTAINS content-type: application/x-msexcelBODY 0 CONTAINS content-type: application/x-stuffitBODY 0 CONTAINS content-type: audio/mpegBODY 0 CONTAINS content-type: audio/x-midiBODY 0 CONTAINS content-type: audio/x-mpegBODY 0 CONTAINS content-type: text/richtextBODY 0 CONTAINS content-type: video/aviBODY 0 CONTAINS content-type: video/mpegBODY 0 CONTAINS content-type: video/mpgBODY 0 CONTAINS content-type: video/x-mpegBODY 0 CONTAINS content-type: video/x-ms-asfBODY 0 CONTAINS content-type: video/x-ms-wmvBODY 0 CONTAINS content-type: video/x-msvideo #Jul-21-2004 AC If I had a nickel for every crap mailhost that sends PDF in the octet stream# format so that we can't get Declude to really tell the filetype...# There is now a small counterweight for .pdf" in the body, see BentallNegText.txt #Original line items I've not implemented#BODY 0 CONTAINS .PDF#BODY 0 CONTAINS X-MS-Attachment: -Original Message-From: Matt [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 12:03 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?That's a MIME type :) They are all over the place, and they can be forged. Here's how MS handles it:http://msdn.microsoft.com/library/default.asp?url="">MattMark E. Smith wrote: Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream -0- Content-Type: multipart/mixed;boundary="==IMail_v8.1==" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type: application/octet-stream; name="2004 Technology.xls" Content-Transfer-Encoding: base64 == -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, October 27, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? That is correct, declude virus processes before junkmail I did look at quite a few zip viruses and didnt see any of them using the Content-Type: application/x-zip-compressed in the mime info Rick Davidson National Systems Manager North American Title Group - - Original Message - From: "Mark E. Smith" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:03 PM Subject: RE: [Declude.JunkMail] Best Practices for
Re: [Declude.JunkMail] Determining a BCC Recipient
Thanks Sandy, I will look into those, the boss wants me to do this on the cheap, the sql idea was first so we could at least say we were archiving the email. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Rick Davidson [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 3:21 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, I am looking at creating our own email archiving solution using sql This, as Matt notes, could be monstrous. It certainly is not best-practice to store this many CLOBs (or BLOBs, if you're decoding MIME) in a generic DB. That's why the only RDBMS message stores worth their salt are Exchange, Notes (sort of), and the archiving vendors' back ends, as they are purpose-built on both client and server ends. If you do go the RDBMS route, you should definitely consider auto-splitting by date into separate tables and/or separate databases to enable scaling out. However, I'd suggest instead that you use a well-known format such as MBOX and an MBOX-aware, high-capacity indexing/search product like dtSearch. We've used dtSearch Web as a message archive-and-search mechanism and have been very happy with the speed (though, admittedly, the display needs a lot of tweaks). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude and Ipswitch ICS
A goggle search on news related to Ipswitch shows they have gotten two of their press releases printed publicizing the brilliant move by Ipswitch in Going Pro and Taking on Exchange. Im sure the MBAs are delighted with the self- congratulatory free marketing they are getting from these. But, there is nothing like a little bad press to send shock waves through a company. Why not contact these publications and let them know how you feel about the good news delivered by Ipswitch? For example: Computer Weekly: http://www.computerweekly.com/articles/article.asp? liArticleID=134579liArticleTypeID=1liCategoryID=1liChannelI D=9liFlavourID=1sSearch=nPage=1 e-Mail the publication ([EMAIL PROTECTED]) that reprinted the Ipswich Press Release to tell them the rest of the story as Paul Harvey would say. Network World Fusion http://www.nwfusion.com/news/2004/1014ipswitch.html e-Mail the reporter Denise Dubie: [EMAIL PROTECTED] and tell her how delighted the existing 10,000 users are with this new release. I suspect these publications might deem it newsworthy if they get several dozen e-mails from angry former loyal customers who felt betrayed and swindled by the companys recent actions. Be sure to include links to the list archives so they can see for themselves how Ipswitch customers feel about all this. Just my 2 cents. Nf_ ynub! 0u%dj)\jgr[xf)+-Nrz;uj)l^r[yjwmmr[x8^j!qy.i0f+r
RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam?
Title: Message They go in the body because ... that's where they go. Take a look at a message in your spam folder. The header ends where you see a blank line (two carriage returns, or two line feeds). The attachment type line descriptions do not appear in the header. I don't understand your comment about Microsoft Outlook; I didn't mention it, so it's not clear to mewhat you're clarifying. Andrew. -Original Message-From: Mark E. Smith [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:10 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Problem was that this wasn't sent through Microsoft OL it was sent through IMail's web interface. Also, why would these content types go in the Body? Wouldn't they go in the HEADER? -0- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Wednesday, October 27, 2004 3:27 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Microsoft software is probably the "most guilty" for using the vague application-octet-stream MIME type instead of something more explicit, like application/msexcel. PDF is also very likely to come as a stream. I place viruses and malware asa distant 3rd for using stream. As a result, my"attachment type" skip logic (in a single filter text file) is more brief than has been talked about in this thread, but has been working for me, and was based on Rick Davidson's earlier work. Couple this with Matt's Size.vbs script or the compiled version that (the other) Scott hosts and you've got a useful way to skip wasteful body filters. #Based on a submission to the Declude Support list by Rick Davidson [EMAIL PROTECTED] #Jun-17-2004 AC This would be better as an external file and do these tests as a message size# and/or purpose-built searcher for the content-type keys. #These are sorted by most frequently appearing in our inbound mail BODY 0 CONTAINS content-type: application/msexcelBODY 0 CONTAINS content-type: application/mswordBODY 0 CONTAINS content-type: application/pdfBODY 0 CONTAINS content-type: application/vnd.ms-BODY 0 CONTAINS content-type: text/x-vcardBODY 0 CONTAINS content-type: application/x-zip-compressedBODY 0 CONTAINS content-type: application/zipBODY 0 CONTAINS content-type: application/rtf #Also frequent, but not in the same magnitude BODY 0 CONTAINS content-type: application/applefileBODY 0 CONTAINS content-type: application/mac-binhex40BODY 0 CONTAINS content-type: application/postscriptBODY 0 CONTAINS content-type: application/x-macbinaryBODY 0 CONTAINS content-type: application/x-ms-excelBODY 0 CONTAINS content-type: application/x-ms-wmzBODY 0 CONTAINS content-type: application/x-msdownloadBODY 0 CONTAINS content-type: application/x-msexcelBODY 0 CONTAINS content-type: application/x-stuffitBODY 0 CONTAINS content-type: audio/mpegBODY 0 CONTAINS content-type: audio/x-midiBODY 0 CONTAINS content-type: audio/x-mpegBODY 0 CONTAINS content-type: text/richtextBODY 0 CONTAINS content-type: video/aviBODY 0 CONTAINS content-type: video/mpegBODY 0 CONTAINS content-type: video/mpgBODY 0 CONTAINS content-type: video/x-mpegBODY 0 CONTAINS content-type: video/x-ms-asfBODY 0 CONTAINS content-type: video/x-ms-wmvBODY 0 CONTAINS content-type: video/x-msvideo #Jul-21-2004 AC If I had a nickel for every crap mailhost that sends PDF in the octet stream# format so that we can't get Declude to really tell the filetype...# There is now a small counterweight for .pdf" in the body, see BentallNegText.txt #Original line items I've not implemented#BODY 0 CONTAINS .PDF#BODY 0 CONTAINS X-MS-Attachment: -Original Message-From: Matt [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 12:03 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?That's a MIME type :) They are all over the place, and they can be forged. Here's how MS handles it:http://msdn.microsoft.com/library/default.asp?url="">MattMark E. Smith wrote: Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream -0- Content-Type: multipart/mixed;boundary="==IMail_v8.1==" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type:
Re: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam?
When an E-mail comes in multiple parts (boundary listed in the headers), each segment should have it's own Content-Type so that the mail reader knows how to display it properly. For instance, most personal E-mail comes as both text/plain and text/html in the same message, but you generally only see the text/html in modern mail clients, and this is determined on the fly by your client. You can also find Uuencoded attachments in messages that don't have MIME headers, but appear in plain text segments identified by begin and three octal numbers followed by a file name, and then the encoding, and then "end" on a single line. Everything else though should be identified by Content-Type following the boundary. Matt Mark E. Smith wrote: Message Problem was that this wasn't sent through Microsoft OL it was sent through IMail's web interface. Also, why would these content types go in the Body? Wouldn't they go in the HEADER? -0- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Wednesday, October 27, 2004 3:27 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Microsoft software is probably the "most guilty" for using the vague application-octet-stream MIME type instead of something more explicit, like application/msexcel. PDF is also very likely to come as a stream. I place viruses and malware asa distant 3rd for using stream. As a result, my"attachment type" skip logic (in a single filter text file) is more brief than has been talked about in this thread, but has been working for me, and was based on Rick Davidson's earlier work. Couple this with Matt's Size.vbs script or the compiled version that (the other) Scott hosts and you've got a useful way to skip wasteful body filters. #Based on a submission to the Declude Support list by Rick Davidson [EMAIL PROTECTED] #Jun-17-2004 AC This would be better as an external file and do these tests as a message size # and/or purpose-built searcher for the content-type keys. #These are sorted by most frequently appearing in our inbound mail BODY 0 CONTAINS content-type: application/msexcel BODY 0 CONTAINS content-type: application/msword BODY 0 CONTAINS content-type: application/pdf BODY 0 CONTAINS content-type: application/vnd.ms- BODY 0 CONTAINS content-type: text/x-vcard BODY 0 CONTAINS content-type: application/x-zip-compressed BODY 0 CONTAINS content-type: application/zip BODY 0 CONTAINS content-type: application/rtf #Also frequent, but not in the same magnitude BODY 0 CONTAINS content-type: application/applefile BODY 0 CONTAINS content-type: application/mac-binhex40 BODY 0 CONTAINS content-type: application/postscript BODY 0 CONTAINS content-type: application/x-macbinary BODY 0 CONTAINS content-type: application/x-ms-excel BODY 0 CONTAINS content-type: application/x-ms-wmz BODY 0 CONTAINS content-type: application/x-msdownload BODY 0 CONTAINS content-type: application/x-msexcel BODY 0 CONTAINS content-type: application/x-stuffit BODY 0 CONTAINS content-type: audio/mpeg BODY 0 CONTAINS content-type: audio/x-midi BODY 0 CONTAINS content-type: audio/x-mpeg BODY 0 CONTAINS content-type: text/richtext BODY 0 CONTAINS content-type: video/avi BODY 0 CONTAINS content-type: video/mpeg BODY 0 CONTAINS content-type: video/mpg BODY 0 CONTAINS content-type: video/x-mpeg BODY 0 CONTAINS content-type: video/x-ms-asf BODY 0 CONTAINS content-type: video/x-ms-wmv BODY 0 CONTAINS content-type: video/x-msvideo #Jul-21-2004 AC If I had a nickel for every crap mailhost that sends PDF in the octet stream # format so that we can't get Declude to really tell the filetype... # There is now a small counterweight for .pdf" in the body, see BentallNegText.txt #Original line items I've not implemented #BODY 0 CONTAINS .PDF #BODY 0 CONTAINS X-MS-Attachment: -Original Message- From: Matt [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 27, 2004 12:03 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices for handing legit email flagged as spam? That's a MIME type :) They are all over the place, and they can be forged. Here's how MS handles it: http://msdn.microsoft.com/library/default.asp?url=""> Matt Mark E. Smith wrote: Yeah, just checked on a few of these MIME items and the actual type isn't defined. For example, an Excel attachment just says application-octet-stream -0- Content-Type: multipart/mixed;boundary="==IMail_v8.1==" Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Oct 2004 18:29:21.0419 (UTC) FILETIME=[E09185B0:01C4BC52] --==IMail_v8.1== Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --==IMail_v8.1== Content-Type: application/octet-stream; name="2004
Re: [Declude.JunkMail] Determining a BCC Recipient
Essentially the good folks at Enron and WorldComm brought us the Sarbanes-Oxley Act or SOX for short. Public companies have to keep a record of all communications, the details of this are vague but mostly apply to the money people and decision makers. Since we cant selectively catch that specific traffic we have to grab it all. Basicly all mail must be archived including the attachments and all mail must be retrievable in a reasonable amount of time, thats about it. We were considering stripping the attachments and storing them in a directory structure and storing the email text data in the sql database. Separate fields for the date, to, from, subject, the entire D file and the attachment names and their location. We figure we can get decent compression and searchabiltiy with the text info but the biggest hurdle is the attachments and being a Title company we have alot of large attachments to deal with. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 3:53 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's funny that you should ask. I just coded that one up in VBScript this last weekend. I even managed to decode base64 text attachments, remove quoted-printable encoding, and strip out all of the HTML code. If this is for archiving according to legal requirement, the attachments would probably be necessary however. Sandy had some good recommendations on how to archive. Maybe if you shared your requirements with the list, someone would have some recommendations as to how to approach this a better way. Matt Rick Davidson wrote: ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned
Re[2]: [Declude.JunkMail] Determining a BCC Recipient
I will look into those, the boss wants me to do this on the cheap, the sql idea was first so we could at least say we were archiving the email. If you just want archiving for independent audit and to show good faith, concatenate the Q and D into an envelope-preserving MBOX for each day. However, you have to plan for a real investigation, and retrievability and simple envelope and body searching requirements will not be met on the cheap--since maintaining terabyte databases with _any_ data isn't cheap. Full-text indexing of such dbs also not a small project no matter what the driver. FTR, dtSearch web costs, I believe, 1000 bucks ( + server + storage + labor ). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam?
Title: Message Ok they're being displayed in the headers using Outlook Peek. Anyway... For some reason the filter isn't logging/catching. If I paste the text: Content-Type: application/vnd.ms- Into the body it will catch. But if I attach an XLS file it won't even though the string: Content-Type: application/vnd.ms-excel shows up in the Message Body. Any ideas? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Wednesday, October 27, 2004 4:20 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? They go in the body because ... that's where they go. Take a look at a message in your spam folder. The header ends where you see a blank line (two carriage returns, or two line feeds). The attachment type line descriptions do not appear in the header. I don't understand your comment about Microsoft Outlook; I didn't mention it, so it's not clear to mewhat you're clarifying. Andrew. -Original Message-From: Mark E. Smith [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:10 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Problem was that this wasn't sent through Microsoft OL it was sent through IMail's web interface. Also, why would these content types go in the Body? Wouldn't they go in the HEADER? -0- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Wednesday, October 27, 2004 3:27 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Microsoft software is probably the "most guilty" for using the vague application-octet-stream MIME type instead of something more explicit, like application/msexcel. PDF is also very likely to come as a stream. I place viruses and malware asa distant 3rd for using stream. As a result, my"attachment type" skip logic (in a single filter text file) is more brief than has been talked about in this thread, but has been working for me, and was based on Rick Davidson's earlier work. Couple this with Matt's Size.vbs script or the compiled version that (the other) Scott hosts and you've got a useful way to skip wasteful body filters. #Based on a submission to the Declude Support list by Rick Davidson [EMAIL PROTECTED] #Jun-17-2004 AC This would be better as an external file and do these tests as a message size# and/or purpose-built searcher for the content-type keys. #These are sorted by most frequently appearing in our inbound mail BODY 0 CONTAINS content-type: application/msexcelBODY 0 CONTAINS content-type: application/mswordBODY 0 CONTAINS content-type: application/pdfBODY 0 CONTAINS content-type: application/vnd.ms-BODY 0 CONTAINS content-type: text/x-vcardBODY 0 CONTAINS content-type: application/x-zip-compressedBODY 0 CONTAINS content-type: application/zipBODY 0 CONTAINS content-type: application/rtf #Also frequent, but not in the same magnitude BODY 0 CONTAINS content-type: application/applefileBODY 0 CONTAINS content-type: application/mac-binhex40BODY 0 CONTAINS content-type: application/postscriptBODY 0 CONTAINS content-type: application/x-macbinaryBODY 0 CONTAINS content-type: application/x-ms-excelBODY 0 CONTAINS content-type: application/x-ms-wmzBODY 0 CONTAINS content-type: application/x-msdownloadBODY 0 CONTAINS content-type: application/x-msexcelBODY 0 CONTAINS content-type: application/x-stuffitBODY 0 CONTAINS content-type: audio/mpegBODY 0 CONTAINS content-type: audio/x-midiBODY 0 CONTAINS content-type: audio/x-mpegBODY 0 CONTAINS content-type: text/richtextBODY 0 CONTAINS content-type: video/aviBODY 0 CONTAINS content-type: video/mpegBODY 0 CONTAINS content-type: video/mpgBODY 0 CONTAINS content-type: video/x-mpegBODY 0 CONTAINS content-type: video/x-ms-asfBODY 0 CONTAINS content-type: video/x-ms-wmvBODY 0 CONTAINS content-type: video/x-msvideo #Jul-21-2004 AC If I had a nickel for every crap mailhost that sends PDF in the octet stream# format so that we can't get Declude to really tell the filetype...# There is now a small counterweight for .pdf" in the body, see BentallNegText.txt #Original line items I've not implemented#BODY 0 CONTAINS .PDF#BODY 0 CONTAINS X-MS-Attachment: -Original Message-From: Matt [mailto:[EMAIL PROTECTED]
RE: Re[2]: [Declude.JunkMail] Determining a BCC Recipient
I have an application that acts as a POP3 mail client and writes the message body (with basic header info) to disk as a .txt file. I drop them into a folder hierarchy based on the date, etc which Microsoft Index server indexes (free w/ Windows). Just look for the message via a query based web page... Not sure if that helps but that's what we did for archiving/searching. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Wednesday, October 27, 2004 4:47 PM To: Rick Davidson Subject: Re[2]: [Declude.JunkMail] Determining a BCC Recipient I will look into those, the boss wants me to do this on the cheap, the sql idea was first so we could at least say we were archiving the email. If you just want archiving for independent audit and to show good faith, concatenate the Q and D into an envelope-preserving MBOX for each day. However, you have to plan for a real investigation, and retrievability and simple envelope and body searching requirements will not be met on the cheap--since maintaining terabyte databases with _any_ data isn't cheap. Full-text indexing of such dbs also not a small project no matter what the driver. FTR, dtSearch web costs, I believe, 1000 bucks ( + server + storage + labor ). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/do wnload/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2a liases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2alias es/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam?
Title: Message OK... If you haveSTOPALLTESTS in a filter in place of a weight, does that prevent the current failed test from being logged%TESTSFAILED% ? If so I think that's what happening. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark E. SmithSent: Wednesday, October 27, 2004 4:44 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Ok they're being displayed in the headers using Outlook Peek. Anyway... For some reason the filter isn't logging/catching. If I paste the text: Content-Type: application/vnd.ms- Into the body it will catch. But if I attach an XLS file it won't even though the string: Content-Type: application/vnd.ms-excel shows up in the Message Body. Any ideas? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Wednesday, October 27, 2004 4:20 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? They go in the body because ... that's where they go. Take a look at a message in your spam folder. The header ends where you see a blank line (two carriage returns, or two line feeds). The attachment type line descriptions do not appear in the header. I don't understand your comment about Microsoft Outlook; I didn't mention it, so it's not clear to mewhat you're clarifying. Andrew. -Original Message-From: Mark E. Smith [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 1:10 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Problem was that this wasn't sent through Microsoft OL it was sent through IMail's web interface. Also, why would these content types go in the Body? Wouldn't they go in the HEADER? -0- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Wednesday, October 27, 2004 3:27 PMTo: '[EMAIL PROTECTED]'Subject: RE: [Declude.JunkMail] Best Practices for handing legit email fla gged as spam? Microsoft software is probably the "most guilty" for using the vague application-octet-stream MIME type instead of something more explicit, like application/msexcel. PDF is also very likely to come as a stream. I place viruses and malware asa distant 3rd for using stream. As a result, my"attachment type" skip logic (in a single filter text file) is more brief than has been talked about in this thread, but has been working for me, and was based on Rick Davidson's earlier work. Couple this with Matt's Size.vbs script or the compiled version that (the other) Scott hosts and you've got a useful way to skip wasteful body filters. #Based on a submission to the Declude Support list by Rick Davidson [EMAIL PROTECTED] #Jun-17-2004 AC This would be better as an external file and do these tests as a message size# and/or purpose-built searcher for the content-type keys. #These are sorted by most frequently appearing in our inbound mail BODY 0 CONTAINS content-type: application/msexcelBODY 0 CONTAINS content-type: application/mswordBODY 0 CONTAINS content-type: application/pdfBODY 0 CONTAINS content-type: application/vnd.ms-BODY 0 CONTAINS content-type: text/x-vcardBODY 0 CONTAINS content-type: application/x-zip-compressedBODY 0 CONTAINS content-type: application/zipBODY 0 CONTAINS content-type: application/rtf #Also frequent, but not in the same magnitude BODY 0 CONTAINS content-type: application/applefileBODY 0 CONTAINS content-type: application/mac-binhex40BODY 0 CONTAINS content-type: application/postscriptBODY 0 CONTAINS content-type: application/x-macbinaryBODY 0 CONTAINS content-type: application/x-ms-excelBODY 0 CONTAINS content-type: application/x-ms-wmzBODY 0 CONTAINS content-type: application/x-msdownloadBODY 0 CONTAINS content-type: application/x-msexcelBODY 0 CONTAINS content-type: application/x-stuffitBODY 0 CONTAINS content-type: audio/mpegBODY 0 CONTAINS content-type: audio/x-midiBODY 0 CONTAINS content-type: audio/x-mpegBODY 0 CONTAINS content-type: text/richtextBODY 0 CONTAINS content-type: video/aviBODY 0 CONTAINS content-type: video/mpegBODY 0 CONTAINS content-type: video/mpgBODY 0 CONTAINS content-type:
Re: [Declude.JunkMail] Determining a BCC Recipient
Mabry Internet/X Controls has a very good Mime processing controls for easy reading of uue files. - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 3:53 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's funny that you should ask. I just coded that one up in VBScript this last weekend. I even managed to decode base64 text attachments, remove quoted-printable encoding, and strip out all of the HTML code. If this is for archiving according to legal requirement, the attachments would probably be necessary however. Sandy had some good recommendations on how to archive. Maybe if you shared your requirements with the list, someone would have some recommendations as to how to approach this a better way. Matt Rick Davidson wrote: ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the
Re: [Declude.JunkMail] Determining a BCC Recipient
If it were me I would just use the CATCHALLMAILS feature of Declude and COPY them to an archival e-mail address and then just burn the inbox of that address to disk once a month. - Original Message - From: Rick Davidson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 4:29 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Essentially the good folks at Enron and WorldComm brought us the Sarbanes-Oxley Act or SOX for short. Public companies have to keep a record of all communications, the details of this are vague but mostly apply to the money people and decision makers. Since we cant selectively catch that specific traffic we have to grab it all. Basicly all mail must be archived including the attachments and all mail must be retrievable in a reasonable amount of time, thats about it. We were considering stripping the attachments and storing them in a directory structure and storing the email text data in the sql database. Separate fields for the date, to, from, subject, the entire D file and the attachment names and their location. We figure we can get decent compression and searchabiltiy with the text info but the biggest hurdle is the attachments and being a Title company we have alot of large attachments to deal with. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 3:53 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's funny that you should ask. I just coded that one up in VBScript this last weekend. I even managed to decode base64 text attachments, remove quoted-printable encoding, and strip out all of the HTML code. If this is for archiving according to legal requirement, the attachments would probably be necessary however. Sandy had some good recommendations on how to archive. Maybe if you shared your requirements with the list, someone would have some recommendations as to how to approach this a better way. Matt Rick Davidson wrote: ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at
Re[2]: [Declude.JunkMail] Determining a BCC Recipient
If it were me I would just use the CATCHALLMAILS feature of Declude and COPY them to an archival e-mail address and then just burn the inbox of that address to disk once a month. For low-volume and unregulated businesses, perhaps, but this will not accomplish compliance, since: - it does not preserve envelope routing information - at 1.5 GB per day, you could not actually read the monthly MBXs using a standard client, even if IMail and the filesystem allowed you to create them - it does not allow for keyword search and export over the volume of data in question - the monthly backup is too infrequent Remember, this is a question of regulations, not internal policies. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Determining a BCC Recipient
Why not just turn the Archive feature of IMAIL SMTP on and route that way? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, October 27, 2004 5:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Determining a BCC Recipient If it were me I would just use the CATCHALLMAILS feature of Declude and COPY them to an archival e-mail address and then just burn the inbox of that address to disk once a month. - Original Message - From: Rick Davidson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 4:29 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Essentially the good folks at Enron and WorldComm brought us the Sarbanes-Oxley Act or SOX for short. Public companies have to keep a record of all communications, the details of this are vague but mostly apply to the money people and decision makers. Since we cant selectively catch that specific traffic we have to grab it all. Basicly all mail must be archived including the attachments and all mail must be retrievable in a reasonable amount of time, thats about it. We were considering stripping the attachments and storing them in a directory structure and storing the email text data in the sql database. Separate fields for the date, to, from, subject, the entire D file and the attachment names and their location. We figure we can get decent compression and searchabiltiy with the text info but the biggest hurdle is the attachments and being a Title company we have alot of large attachments to deal with. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 3:53 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's funny that you should ask. I just coded that one up in VBScript this last weekend. I even managed to decode base64 text attachments, remove quoted-printable encoding, and strip out all of the HTML code. If this is for archiving according to legal requirement, the attachments would probably be necessary however. Sandy had some good recommendations on how to archive. Maybe if you shared your requirements with the list, someone would have some recommendations as to how to approach this a better way. Matt Rick Davidson wrote: ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:;
Re: Re[2]: [Declude.JunkMail] Determining a BCC Recipient
OK, fine then. Don't do it every month. Pick the archival frequency of your choosing. And can't you use Declude to insert the routing information into the headers? And can't you download the e-mail from the inbox into the mail client of your choosing and archive it that way? Anyway, as usual someone's off on an unintended tangent here. All I'm saying is that if I worked for a company I would come up with a more elegant solution to mail archiving then being dependent on SQL Server or any other proprietary format. Plain old text files are just fine by me. - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Dan Geiser [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 5:33 PM Subject: Re[2]: [Declude.JunkMail] Determining a BCC Recipient If it were me I would just use the CATCHALLMAILS feature of Declude and COPY them to an archival e-mail address and then just burn the inbox of that address to disk once a month. For low-volume and unregulated businesses, perhaps, but this will not accomplish compliance, since: - it does not preserve envelope routing information - at 1.5 GB per day, you could not actually read the monthly MBXs using a standard client, even if IMail and the filesystem allowed you to create them - it does not allow for keyword search and export over the volume of data in question - the monthly backup is too infrequent Remember, this is a question of regulations, not internal policies. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] Determining a BCC Recipient
And can't you use Declude to insert the routing information into the headers? Not without compromising BCC recipients, which is unacceptable. And can't you download the e-mail from the inbox into the mail client of your choosing and archive it that way? Possibly, but that's an ingredient you're not mentioning. A client could be anything from IMail client (bad) to a full-text indexing web-based MUA with giant capacity (good). It hinges on this component, which is open to question. I'm saying is that if I worked for a company I would come up with a more elegant solution to mail archiving then being dependent on SQL Server or any other proprietary format. Well, as I suggested, daily MBOX files--always recoverable in raw form--with a proprietary dtSearch full-text index is robust and RDBMS-free. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Determining a BCC Recipient
I strongly recommend that you just simply keep these in their Q* and D* formats and zip up the directories every night and write them to a CD or something every so often. Retrieval of such E-mail should be rare if ever necessary, and you can easily write something that would unzip the files, search for addresses in the Q* files, and copy the needed files to a directory when needed. You can also of course script the zipping. Personally, I like the WinZip command line add-on as it seems to compress better than freeware components, and WinZip only costs $20. You can zip an entire directory with a short call, and in a script you can generate a time stamp for the file name and then set it up on the scheduler. Matt Rick Davidson wrote: Essentially the good folks at Enron and WorldComm brought us the Sarbanes-Oxley Act or SOX for short. Public companies have to keep a record of all communications, the details of this are vague but mostly apply to the money people and decision makers. Since we cant selectively catch that specific traffic we have to grab it all. Basicly all mail must be archived including the attachments and all mail must be retrievable in a reasonable amount of time, thats about it. We were considering stripping the attachments and storing them in a directory structure and storing the email text data in the sql database. Separate fields for the date, to, from, subject, the entire D file and the attachment names and their location. We figure we can get decent compression and searchabiltiy with the text info but the biggest hurdle is the attachments and being a Title company we have alot of large attachments to deal with. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 3:53 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's funny that you should ask. I just coded that one up in VBScript this last weekend. I even managed to decode base64 text attachments, remove quoted-printable encoding, and strip out all of the HTML code. If this is for archiving according to legal requirement, the attachments would probably be necessary however. Sandy had some good recommendations on how to archive. Maybe if you shared your requirements with the list, someone would have some recommendations as to how to approach this a better way. Matt Rick Davidson wrote: ok thanks Matt, we do have some programmers on staff here but I will sure conscript your help if we brick wall. Regardless of where it is stored its going to be a massive amount of data, my initial samplings show 1.5 to 2GB per day. Yikes! You wouldnt happen to know how to parse mime types and remove attachments would you? :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 2:58 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient That's going to be one massive database :) I've become quite the VBScripter as of late (if that's something to brag about), so let me know if you need any help. Matt Rick Davidson wrote: Thanks Matt, COPYFILE is working perfectly, now its just a matter of writing the program to parse and insert it into the SQL database. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Matt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 26, 2004 5:15 PM Subject: Re: [Declude.JunkMail] Determining a BCC Recipient Rick, This information is in the Q* file. If you use the COPYFILE action, it will keep both the D* and the Q* file. The only issue is that the Declude headers are lost and each message is kept separately and not viewable without a special application like spamreview. IMO, this is appropriate for archiving due to legal requirement, but not for doing review. If you want to handle this in a different way by just sending to a mailbox, you can use a WARN action with the %ALLRECIPS% variable which will contain the BCC addresses as well. For instance, you could do the following: TESTNAMEWARN X-RECIPIENTS: %ALLRECIPS% This of course exposes the BCC info to all that might view the headers. Matt Rick Davidson wrote: I am looking at creating our own email archiving solution using sql, the main hurdle is how to handle and email sent to a user using BCC. Is there a way to use Declude to include that info in a recipient x-header? If I send myself using only the BCC field the header contains only this From: Rick Davidson [EMAIL PROTECTED] To: Undisclosed-Recipient:; Subject: test I assume the BCC info is lost once the message hits the senders SMTP server correct? Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus
Re: Re[2]: [Declude.JunkMail] Determining a BCC Recipient
After all these suggestions I think concatenating the Q and D file and maintaining a text file is a much better way to go, dtsearch definately looks attractive. Thanks again for the suggestions. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Rick Davidson [EMAIL PROTECTED] Sent: Wednesday, October 27, 2004 4:46 PM Subject: Re[2]: [Declude.JunkMail] Determining a BCC Recipient I will look into those, the boss wants me to do this on the cheap, the sql idea was first so we could at least say we were archiving the email. If you just want archiving for independent audit and to show good faith, concatenate the Q and D into an envelope-preserving MBOX for each day. However, you have to plan for a real investigation, and retrievability and simple envelope and body searching requirements will not be met on the cheap--since maintaining terabyte databases with _any_ data isn't cheap. Full-text indexing of such dbs also not a small project no matter what the driver. FTR, dtSearch web costs, I believe, 1000 bucks ( + server + storage + labor ). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Ipswitch ICS
FWIW, that second link is a story on WhatsUp Pro, not ICS. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wolf Tombe Sent: Wednesday, October 27, 2004 4:17 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude and Ipswitch ICS A goggle search on news related to Ipswitch shows they have gotten two of their press releases printed publicizing the brilliant move by Ipswitch in Going Pro and Taking on Exchange. I'm sure the MBAs are delighted with the self- congratulatory free marketing they are getting from these. But, there is nothing like a little bad press to send shock waves through a company. Why not contact these publications and let them know how you feel about the good news delivered by Ipswitch? For example: Computer Weekly: http://www.computerweekly.com/articles/article.asp? liArticleID=134579liArticleTypeID=1liCategoryID=1liChannelI D=9liFlavourID=1sSearch=nPage=1 e-Mail the publication ([EMAIL PROTECTED]) that reprinted the Ipswich Press Release to tell them the rest of the story as Paul Harvey would say. Network World Fusion http://www.nwfusion.com/news/2004/1014ipswitch.html e-Mail the reporter Denise Dubie: [EMAIL PROTECTED] and tell her how delighted the existing 10,000 users are with this new release. I suspect these publications might deem it newsworthy if they get several dozen e-mails from angry former loyal customers who felt betrayed and swindled by the company's recent actions. Be sure to include links to the list archives so they can see for themselves how Ipswitch customers feel about all this. Just my 2 cents. Nf?_? ynu b! 0u %?d j)\jg r[x?f)+-N? rz;guej)l^r[y jwm??? m r[x?8^j!q y. i 0 f??+ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Determining a BCC Recipient
I strongly recommend that you just simply keep these in their Q* and D* formats and zip up the directories every night and write them to a CD or something every so often. Like I keep trying to say, this isn't an every so often or best-effort regulation. It's strict and for-real. . . . you can easily write something that would unzip the files, search for addresses in the Q* files, and copy the needed files to a directory when needed. Searches are almost always by keyword, not by user. This is why full-text indexing of body and attachment is a must. And the restrictions on outside auditor access, et al. are too long a list to satisfy here. Just remember that this question relates to SOX, not random measures under the umbrella of archiving. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] STOPALLTESTS
By design, STOPALLTESTS should stop not only that filter, but also all other filters that appear after it within the Global.cfg. I'm positive that this is the design, however I haven't used it to see if it actually works. Matt Mark E. Smith wrote: Sorry for the repeated posts but I think my question might have been lost in another thread. I'm working on a BYPASS Filter to identify ham. But I'm running into a problem. It seems that if STOPALLTESTS is used in place of the weight like: BODYSTOPALLTESTSCONTAINScontent-type: application/vnd.ms- That it isn't logged in %TESTSFAILED% Furthermore tests AFTER the BYPASS test (where STOPALLTESTS is hit) continue to run. In the below header, CATCHALLMAILS runs first then BYPASS then a number of declude (IPNOTINMX, NOLEGIT, Sniffer - MS-WHITE, then filters) but as you can see they're being logged. The odd thing is that if I replace STOPALLTESTS in my BYPASS filter with 0 then the test is logged. Any ideas? -0- X-Note: X-Note: == X-Note: Spam Score: 0 [SUBJECT STRING ON 120-340 DELETED ON 350+] X-Note: Scan Time: 19:20:55 on 27 Oct 2004 X-Note: Spool File: D2d4fc3a90020bf39.SMD X-Note: Server Name: ns2.xxx.com X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Reverse DNS IP: ns2.xxx.com [xxx.xxx.89.132] X-Note: Organization: ctcmx01.ap.org X-Note: Recipient(s): [EMAIL PROTECTED] X-Note: Country Chain: UNITED STATES-destination X-Note: Tests Failed: CATCHALLMAILS, IPNOTINMX, NOLEGITCONTENT, MS-WHITE X-Note: In or Out: outgoing X-Note: == X-Note: filter [1.81] for SPAM virus. X-Note: == X-Note: 10/27/2004 07:21:01 PM Content-Type: multipart/mixed; boundary==_NextPart_000_0003_01C4BC5A.0E7F9FA0 --=_NextPart_000_0003_01C4BC5A.0E7F9FA0 Content-Type: multipart/alternative; boundary==_NextPart_001_0004_01C4BC5A.0E7F9FA0 --=_NextPart_001_0004_01C4BC5A.0E7F9FA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 --=_NextPart_001_0004_01C4BC5A.0E7F9FA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 --=_NextPart_001_0004_01C4BC5A.0E7F9FA0-- --=_NextPart_000_0003_01C4BC5A.0E7F9FA0 Content-Type: application/vnd.ms-excel; name=AP_Select5_SA_9785638.xls Content-Disposition: attachment; filename=AP_Select5_SA_9785638.xls Content-Transfer-Encoding: base64 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] STOPALLTESTS
Sorry for the repeated posts but I think my question might have been lost in another thread. I'm working on a BYPASS Filter to identify ham. But I'm running into a problem. It seems that if STOPALLTESTS is used in place of the weight like: BODYSTOPALLTESTSCONTAINScontent-type: application/vnd.ms- That it isn't logged in %TESTSFAILED% Furthermore tests AFTER the BYPASS test (where STOPALLTESTS is hit) continue to run. In the below header, CATCHALLMAILS runs first then BYPASS then a number of declude (IPNOTINMX, NOLEGIT, Sniffer - MS-WHITE, then filters) but as you can see they're being logged. The odd thing is that if I replace STOPALLTESTS in my BYPASS filter with 0 then the test is logged. Any ideas? -0- X-Note: X-Note: == X-Note: Spam Score: 0 [SUBJECT STRING ON 120-340 DELETED ON 350+] X-Note: Scan Time: 19:20:55 on 27 Oct 2004 X-Note: Spool File: D2d4fc3a90020bf39.SMD X-Note: Server Name: ns2.xxx.com X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Reverse DNS IP: ns2.xxx.com [xxx.xxx.89.132] X-Note: Organization: ctcmx01.ap.org X-Note: Recipient(s): [EMAIL PROTECTED] X-Note: Country Chain: UNITED STATES-destination X-Note: Tests Failed: CATCHALLMAILS, IPNOTINMX, NOLEGITCONTENT, MS-WHITE X-Note: In or Out: outgoing X-Note: == X-Note: filter [1.81] for SPAM virus. X-Note: == X-Note: 10/27/2004 07:21:01 PM Content-Type: multipart/mixed; boundary==_NextPart_000_0003_01C4BC5A.0E7F9FA0 --=_NextPart_000_0003_01C4BC5A.0E7F9FA0 Content-Type: multipart/alternative; boundary==_NextPart_001_0004_01C4BC5A.0E7F9FA0 --=_NextPart_001_0004_01C4BC5A.0E7F9FA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 --=_NextPart_001_0004_01C4BC5A.0E7F9FA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 --=_NextPart_001_0004_01C4BC5A.0E7F9FA0-- --=_NextPart_000_0003_01C4BC5A.0E7F9FA0 Content-Type: application/vnd.ms-excel; name=AP_Select5_SA_9785638.xls Content-Disposition: attachment; filename=AP_Select5_SA_9785638.xls Content-Transfer-Encoding: base64 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Determining a BCC Recipient
Please don't parse my words so carefully. Each company is different and therefore so are their needs. Many that archive will never need to go through the data, primarily because many companies aren't so enormous that they have the legal liability nor the volume that would necessitate a preemptive indexing of content. In such cases, constructing a solution to unzip and index the archives in response to a subpoena would be entirely appropriate, and probably quite simple to do. For more frequent access to such information, one could turn drive compression on in Windows and leave the files in raw format within massive directories and then use Index Server to get maybe a better effect. I would consider it to be unrealistic to demand that a full text indexing be done of file attachments, so this solution would probably be near perfect. A little bit of scripting in ASP could get you a search engine capable of identifying files by way of sender, recipient, and/or text, and display the contents of each message in a browser window (decoded even if you wished). The decoding part would be a fair deal of work. That's probably how I would approach it. Note that you probably would need to turn WHITELIST AUTH or any IP settings off for the COPYFILE filter to work on internal E-mail. You could replace this with a credit filter that won't result in disabling actions based on test name, probably one that combines both IP and MAILFROM as matches. Matt Sanford Whiteman wrote: I strongly recommend that you just simply keep these in their Q* and D* formats and zip up the directories every night and write them to a CD or something every so often. Like I keep trying to say, this isn't an "every so often" or best-effort regulation. It's strict and for-real. . . . you can easily write something that would unzip the files, search for addresses in the Q* files, and copy the needed files to a directory when needed. Searches are almost always by keyword, not by user. This is why full-text indexing of body and attachment is a must. And the restrictions on outside auditor access, et al. are too long a list to satisfy here. Just remember that this question relates to SOX, not random measures under the umbrella of archiving. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
