Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site
but javascript must be enabled... more options with and without javascript: http://javascript.about.com/library/blemail1.htm I prefer HTML using ampersand code, easy simple, but doesnt sure if this may be able to decode by spam spiders? marc At 20:54 10.11.2004, you wrote: Use javascript that pulls a seperate page that pulls the emailaddress w/Redirect. Spiders will pull an email address out of the source, but normally don't execute javascript, if they did, simply add a Javascript Question. or, Just have a webforum, and have that email them to confirm the email submission prior to actually forwarding it - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 2:34 PM Subject: RE: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Most spiders actually visit the page anyway so this doesn't help. The Javascript method usually works best. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Wednesday, November 10, 2004 11:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Pull them from a database dynamicly so the page actually has to be visited to display the addys Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 11:26 AM Subject: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Hello, All, We have a new web site and we would like to put links on the contact page which allow people to click on the links and send us an e-mail but we don't want those addresses to be scanned and added to the latest spammers mailing list. Are there any common practices for obfuscating the links so they are recognizable as valid html mailto links by an e-mail client but they would be less than likely to be picked up by the spammers of the world? Right now our webmaster replaced the e-mail addresses with images of the e-mail addresses and the images look horrible. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site
Yes, encoded HTML would be easily extracted by spiders. javascript would not, unless it's a well-known function...in which case they might take the time to build a template for that function into the spider and thereby extract and reassemble the pieces of the email address. A good reason to write your own function to obscure email addresses rather than using someone else's. Darin. - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 3:34 AM Subject: Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site but javascript must be enabled... more options with and without javascript: http://javascript.about.com/library/blemail1.htm I prefer HTML using ampersand code, easy simple, but doesnt sure if this may be able to decode by spam spiders? marc At 20:54 10.11.2004, you wrote: Use javascript that pulls a seperate page that pulls the emailaddress w/Redirect. Spiders will pull an email address out of the source, but normally don't execute javascript, if they did, simply add a Javascript Question. or, Just have a webforum, and have that email them to confirm the email submission prior to actually forwarding it - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 2:34 PM Subject: RE: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Most spiders actually visit the page anyway so this doesn't help. The Javascript method usually works best. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Wednesday, November 10, 2004 11:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Pull them from a database dynamicly so the page actually has to be visited to display the addys Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 11:26 AM Subject: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Hello, All, We have a new web site and we would like to put links on the contact page which allow people to click on the links and send us an e-mail but we don't want those addresses to be scanned and added to the latest spammers mailing list. Are there any common practices for obfuscating the links so they are recognizable as valid html mailto links by an e-mail client but they would be less than likely to be picked up by the spammers of the world? Right now our webmaster replaced the e-mail addresses with images of the e-mail addresses and the images look horrible. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail
[Declude.JunkMail] would any valid email contain
I'm wondering, would any valid corporate email contain a href=""rect" href=""body 0 contains a href="" and "body 0 contains shape="rect" href="" href="http://%">http://% Any valid reasons these would be in a corporate email?
[Declude.JunkMail] Is DNSStuff Down?
Scott, I can seem to reach www.dnsstuff.com or backup.dnsstuff.com. Are you current having issues? Thanks, Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site
Here's a resource that creates an RSA-encrypted address. This looks to be much more secure than the HTML-encoders that are out there. http://www.jracademy.com/~jtucek/email/download.php I've tried it and it seems to work just fine. -Dave Doherty Skywaves, Inc. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 9:01 AM Subject: Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Yes, encoded HTML would be easily extracted by spiders. javascript would not, unless it's a well-known function...in which case they might take the time to build a template for that function into the spider and thereby extract and reassemble the pieces of the email address. A good reason to write your own function to obscure email addresses rather than using someone else's. Darin. - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 3:34 AM Subject: Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site but javascript must be enabled... more options with and without javascript: http://javascript.about.com/library/blemail1.htm I prefer HTML using ampersand code, easy simple, but doesnt sure if this may be able to decode by spam spiders? marc At 20:54 10.11.2004, you wrote: Use javascript that pulls a seperate page that pulls the emailaddress w/Redirect. Spiders will pull an email address out of the source, but normally don't execute javascript, if they did, simply add a Javascript Question. or, Just have a webforum, and have that email them to confirm the email submission prior to actually forwarding it - Original Message - From: Mark E. Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 2:34 PM Subject: RE: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Most spiders actually visit the page anyway so this doesn't help. The Javascript method usually works best. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Wednesday, November 10, 2004 11:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Pull them from a database dynamicly so the page actually has to be visited to display the addys Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 11:26 AM Subject: [Declude.JunkMail] OT: Using Real E-Mail Address on Web Site Hello, All, We have a new web site and we would like to put links on the contact page which allow people to click on the links and send us an e-mail but we don't want those addresses to be scanned and added to the latest spammers mailing list. Are there any common practices for obfuscating the links so they are recognizable as valid html mailto links by an e-mail client but they would be less than likely to be picked up by the spammers of the world? Right now our webmaster replaced the e-mail addresses with images of the e-mail addresses and the images look horrible. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [Scanned for viruses by Declude Virus] [Scanned for viruses by Declude Virus] ---
[Declude.JunkMail] Need NDR Filter Help
We are receiving thousands of NDR messaages daily due to some spammer forging his message headers with our mail server name and IP address, 'ns3.fastwave.net' and '[207.212.80.137]' (below - note, it is not an IMail header): Received: (from [EMAIL PROTECTED]) by mailgate3.nec.co.jp (8.11.7/3.7W-MAILGATE-NEC) id iABBF0N18133 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 20:15:00 +0900 (JST) Received: from no-wucking-furries.com ([211.223.136.240]) by TYO205.gate.nec.co.jp (8.11.7/3.7W01080315) with SMTP id iABBEtF01977 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 20:14:56 +0900 (JST) Received: from fastwave.net (ns3.fastwave.net [207.212.80.137]) by no-wucking-furries.com (Postfix) with ESMTP id D2C16DA045 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 05:13:08 -0600 Our customers who are targeted to receive the NDRs are complaining, and my first attempt at writing a JunkMail filter to (temporarily, at least) trap these NDRs has failed (it doesn't seem to be working). I want to trap on the 'From:' line, since that seems to be the most commom element in all the NDRs: From: Mail Delivery Subsystem [EMAIL PROTECTED] From: [EMAIL PROTECTED] (Mail Delivery System) From: Mail Administrator [EMAIL PROTECTED] From: [EMAIL PROTECTED] etc. So, I created a filter called JOEJOBNDR that contains the following: MAILFROM 0 CONTAINSMAILER-DAEMON MAILFROM 0 CONTAINSpostmaster MAILFROM 0 CONTAINSBarracuda Spam Firewall MAILFROM 0 CONTAINSmailmaster MAILFROM 0 CONTAINSautomated-response with the 'global.cfg' and '$default$.junkmail' files containing (respectively): JOEJOBNDR filter C:\IMail\Declude\Filters\JoeJob.txt x 25 0 JOEJOBNDR WARN Can someone tell me why the filter is not working? Also, I am open to any other methods or suggestions for getting the job done. Thanks in advance, Kim Premuda FastWave San Diego, CA -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
on 11/11/04 10:33 AM, Dan Geiser wrote: I can seem to reach www.dnsstuff.com or backup.dnsstuff.com. Are you current having issues? I can't get there either, and I've been trying for an hour+. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is this the correct format?
66.54.138.* Description of why I want to list the whole class C /24, so is the above the correct syntax in an IPFILE? Thanks, Kris McElroy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need NDR Filter Help
If you look at the envelope sender, these are usually . MAILFROM 1 IS Of course, you'll be killing off legit bounces too... Below is a link to a discussion I had where my e-mail address was being Joe-jobbed. Looking at the e-mail's, they fake a from address similiar to Heavenly Helper [EMAIL PROTECTED] So I use a filter similiar to the: ALLRECIPS END NOTCONTAINS sfisher@ MINWEIGHTTOFAIL 1 BODY END CONTAINS Scott Fisher BODY 1 CONTAINS a [EMAIL PROTECTED] BODY 1 CONTAINS b [EMAIL PROTECTED] and so on to z... I still get out of office, over quota and challenge and response type bounces. But I've cut out 90-95% without chopping out legit bounces. Below is a link to a discussion I had where my e-mail address was being Joe-jobbed. http://www.mail-archive.com/declude.junkmail@declude.com/msg21907.html - Original Message - From: Kim Premuda [EMAIL PROTECTED] To: Declude JunkMail Forum [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 9:38 AM Subject: [Declude.JunkMail] Need NDR Filter Help We are receiving thousands of NDR messaages daily due to some spammer forging his message headers with our mail server name and IP address, 'ns3.fastwave.net' and '[207.212.80.137]' (below - note, it is not an IMail header): Received: (from [EMAIL PROTECTED]) by mailgate3.nec.co.jp (8.11.7/3.7W-MAILGATE-NEC) id iABBF0N18133 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 20:15:00 +0900 (JST) Received: from no-wucking-furries.com ([211.223.136.240]) by TYO205.gate.nec.co.jp (8.11.7/3.7W01080315) with SMTP id iABBEtF01977 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 20:14:56 +0900 (JST) Received: from fastwave.net (ns3.fastwave.net [207.212.80.137]) by no-wucking-furries.com (Postfix) with ESMTP id D2C16DA045 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 05:13:08 -0600 Our customers who are targeted to receive the NDRs are complaining, and my first attempt at writing a JunkMail filter to (temporarily, at least) trap these NDRs has failed (it doesn't seem to be working). I want to trap on the 'From:' line, since that seems to be the most commom element in all the NDRs: From: Mail Delivery Subsystem [EMAIL PROTECTED] From: [EMAIL PROTECTED] (Mail Delivery System) From: Mail Administrator [EMAIL PROTECTED] From: [EMAIL PROTECTED] etc. So, I created a filter called JOEJOBNDR that contains the following: MAILFROM 0 CONTAINS MAILER-DAEMON MAILFROM 0 CONTAINS postmaster MAILFROM 0 CONTAINS Barracuda Spam Firewall MAILFROM 0 CONTAINS mailmaster MAILFROM 0 CONTAINS automated-response with the 'global.cfg' and '$default$.junkmail' files containing (respectively): JOEJOBNDR filter C:\IMail\Declude\Filters\JoeJob.txt x 25 0 JOEJOBNDR WARN Can someone tell me why the filter is not working? Also, I am open to any other methods or suggestions for getting the job done. Thanks in advance, Kim Premuda FastWave San Diego, CA -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is this the correct format?
I use: 66.54.138.0/24 Description - Original Message - From: Kris McElroy [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 10:02 AM Subject: [Declude.JunkMail] Is this the correct format? 66.54.138.* Description of why I want to list the whole class C /24, so is the above the correct syntax in an IPFILE? Thanks, Kris McElroy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ALLRECIPS syntax
More than likely: ALLRECIPS480IS[EMAIL PROTECTED], [EMAIL PROTECTED] - Original Message - From: Matt Goodhue To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 6:12 PM Subject: RE: [Declude.JunkMail] ALLRECIPS syntax I guess I am confused. My Imail is setup as a mail gateway, so this user is not local. So what would be the imail user then? Thanks.matt From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott FisherSent: Wednesday, November 10, 2004 7:01 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] ALLRECIPS syntax ALLRECIPS with IS test: It needs to be "[EMAIL PROTECTED], [EMAIL PROTECTED] (where the first "[EMAIL PROTECTED] is the name entered by the user, and the second one is the one that IMail uses) ALLRECIPS480IS[EMAIL PROTECTED], [EMAIL PROTECTED] - Original Message - From: Matt Goodhue To: [EMAIL PROTECTED] Sent: Wednesday, November 10, 2004 5:42 PM Subject: [Declude.JunkMail] ALLRECIPS syntax Hello All, We have our Declude/Imail server setup as a gateway to our exchange server. We had a user that used to get a ton of spam. We gave him a new email address, but a bunch of junk is still coming to his old email address that doesnt exist anymore. It then gets stuck in our spool folder and keeps trying to re-deliver until it finally hits the maximum number of times. I created an external filter with the allrecips but I dont think I have the syntax right it is: ALLRECIPS 2000 IS Email @ ourdomain This should assign the message a really high weight so it just gets deleted. I call it in my global config this way: BADEMAILADDS filter c:\imail\declude\bad_email.txt x 0 0 Shouldnt this work? Thanks. Matt Goodhue Certified Technician Comon Sense Computing, LLC
Re: [Declude.JunkMail] Need NDR Filter Help
Kim, Declude's MAILFROM variable matches the Mail From that is given in the SMTP envelope and not necessarily the address contained in the From header. All of the permutations that you gave are likely to have a Mail From/MAILFROM of . So the correct format of your filter line would be as follows: MAILFROM 0 CONTAINS Keep in mind that if you indiscriminately block this address, you will also be blocking legitimate NDR's. Unfortunately there is no easy answer to the problem. On my system, I 'combo' the null sender address with things that are capable of recording spam hits on content and I add a bunch of extra points when found. Sniffer is an excellent tool for this. Most of these Joe-Jobs are being sent to random addresses that won't correspond to an account, but there appears to be a spammer that is now using real addresses repeatedly, resulting in a prolonged deluge of NDR's from spam that goes to a specific account. Because not all NDR's will return the original content, it is impossible to block all of these, and as a result the only possible solution is to block all NDR's for those specific accounts. For now, the strategy of specifying the accounts to block NDR's is enough on my system, but short of that, there is no solution that would otherwise maintain the ability to legitimately bounce messages. Someone needs to create a new RFC for properly bouncing E-mail with the full original content (unless it is due to excessive size). Matt Kim Premuda wrote: We are receiving thousands of NDR messaages daily due to some spammer forging his message headers with our mail server name and IP address, 'ns3.fastwave.net' and '[207.212.80.137]' (below - note, it is not an IMail header): Received: (from [EMAIL PROTECTED]) by mailgate3.nec.co.jp (8.11.7/3.7W-MAILGATE-NEC) id iABBF0N18133 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 20:15:00 +0900 (JST) Received: from no-wucking-furries.com ([211.223.136.240]) by TYO205.gate.nec.co.jp (8.11.7/3.7W01080315) with SMTP id iABBEtF01977 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 20:14:56 +0900 (JST) Received: from fastwave.net (ns3.fastwave.net [207.212.80.137]) by no-wucking-furries.com (Postfix) with ESMTP id D2C16DA045 for [EMAIL PROTECTED]; Thu, 11 Nov 2004 05:13:08 -0600 Our customers who are targeted to receive the NDRs are complaining, and my first attempt at writing a JunkMail filter to (temporarily, at least) trap these NDRs has failed (it doesn't seem to be working). I want to trap on the 'From:' line, since that seems to be the most commom element in all the NDRs: From: Mail Delivery Subsystem [EMAIL PROTECTED] From: [EMAIL PROTECTED] (Mail Delivery System) From: Mail Administrator [EMAIL PROTECTED] From: [EMAIL PROTECTED] etc. So, I created a filter called JOEJOBNDR that contains the following: MAILFROM 0 CONTAINSMAILER-DAEMON MAILFROM 0 CONTAINSpostmaster MAILFROM 0 CONTAINSBarracuda Spam Firewall MAILFROM 0 CONTAINSmailmaster MAILFROM 0 CONTAINSautomated-response with the 'global.cfg' and '$default$.junkmail' files containing (respectively): JOEJOBNDR filter C:\IMail\Declude\Filters\JoeJob.txt x 25 0 JOEJOBNDR WARN Can someone tell me why the filter is not working? Also, I am open to any other methods or suggestions for getting the job done. Thanks in advance, Kim Premuda FastWave San Diego, CA -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is this the correct format?
Kris, The syntax would be 66.54.138.0/24 Description Of Why Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Kris McElroy writes: 66.54.138.* Description of why I want to list the whole class C /24, so is the above the correct syntax in an IPFILE? Thanks, Kris McElroy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FROM Actions
I've got a pretty simple need, but having trouble figuring out how to accomplish this. I have one domain that wants to put a specific text string in the subject line of all messages coming from a list of sender domains. In other words if a message is coming to example.com from domain1.com, domain2.com, domain3.com, etc, then I need to put xyz in the subject line. I thought the best way to accomplish this was with a filter file and an associated SUBJECT action but all I see in filter file parameters is MAILFROM not FROM. And, I hate to scan every single message with filters for this one tiny domain. Any suggestions? -- Best regards, David mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Neal R. Mathews is out of the office.
I will be out of the office starting 11/11/2004 and will not return until 11/12/2004. I will respond to your message when I return. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROM Actions
That's life as they say. You can set up the filter to be very efficient by placing a line at the top of the filter to prequalify it and save processing. ALLRECIPS END NOTCONTAINS @cutomerdomain.com Matt David Sullivan wrote: I've got a pretty simple need, but having trouble figuring out how to accomplish this. I have one domain that wants to put a specific text string in the subject line of all messages coming from a list of sender domains. In other words if a message is coming to example.com from domain1.com, domain2.com, domain3.com, etc, then I need to put xyz in the subject line. I thought the best way to accomplish this was with a filter file and an associated SUBJECT action but all I see in filter file parameters is MAILFROM not FROM. And, I hate to scan every single message with filters for this one tiny domain. Any suggestions? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Moving mail servers
I am in the process of moving my Imail server to a different machine at a different hosting facility, hence a new IP. Does anyone have any suggestions for making this a smooth transition? I have moved Imail many times before, so I am not worried about the setup. What I am looking for is suggestions as to how to handle the lag time of routers picking up the new IP. I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. What do you guys think? Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
3:10PM - It's still down. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 10:33 AM Subject: [Declude.JunkMail] Is DNSStuff Down? Scott, I can seem to reach www.dnsstuff.com or backup.dnsstuff.com. Are you current having issues? Thanks, Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
Dean Lawrence wrote: I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, A few days before the move, change the TTL on the existing DNS records to something very short. That way, once you change the IP address, there's a better chance that the fresh data will go out. but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. Not a bad idea, either. -- For it's Tommy this, an' Tommy that, an' Chuck him out, the brute! But it's Saviour of 'is country when the guns begin to shoot; An' it's Tommy this, an' Tommy that, an' anything you please; An' Tommy ain't a bloomin' fool -- you bet that Tommy sees! -- Rudyard Kipling, tommy - Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com - --- [This E-mail scanned for viruses by Declude Virus / Sophos AV] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
Bud, The TTL is a great suggestion. Thanks, Dean On Thu, 11 Nov 2004 15:38:55 -0500, Bud Durland [EMAIL PROTECTED] wrote: Dean Lawrence wrote: I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, A few days before the move, change the TTL on the existing DNS records to something very short. That way, once you change the IP address, there's a better chance that the fresh data will go out. but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. Not a bad idea, either. -- For it's Tommy this, an' Tommy that, an' Chuck him out, the brute! But it's Saviour of 'is country when the guns begin to shoot; An' it's Tommy this, an' Tommy that, an' anything you please; An' Tommy ain't a bloomin' fool -- you bet that Tommy sees! -- Rudyard Kipling, tommy - Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com - --- [This E-mail scanned for viruses by Declude Virus / Sophos AV] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
What Bud said, plus... You could set up a HOSTS file in C:\winnt\systrem32\drivers\etc\ with the IP address of your new server and the domain names that it services, one IP and domain name per line. Delete or rename all the customer domains from your current server. That should work as a temporary solution, which is just what you need. Sample HOSTS entries: 123.123.123.123myhost.com 123.123.123.123yourhost.org 123.123.123.123hisdomain.net etc... -Dave Doherty Skywaves, Inc. - Original Message - From: Dean Lawrence [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 2:26 PM Subject: [Declude.JunkMail] OT: Moving mail servers I am in the process of moving my Imail server to a different machine at a different hosting facility, hence a new IP. Does anyone have any suggestions for making this a smooth transition? I have moved Imail many times before, so I am not worried about the setup. What I am looking for is suggestions as to how to handle the lag time of routers picking up the new IP. I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. What do you guys think? Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 2 actions
If a message results in both a copy and a hold action, will the copy execute ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
Thanks Dave, That is what I was originally think of doing with the store and forward option. Dean On Thu, 11 Nov 2004 15:50:59 -0500, Dave Doherty [EMAIL PROTECTED] wrote: What Bud said, plus... You could set up a HOSTS file in C:\winnt\systrem32\drivers\etc\ with the IP address of your new server and the domain names that it services, one IP and domain name per line. Delete or rename all the customer domains from your current server. That should work as a temporary solution, which is just what you need. Sample HOSTS entries: 123.123.123.123myhost.com 123.123.123.123yourhost.org 123.123.123.123hisdomain.net etc... -Dave Doherty Skywaves, Inc. - Original Message - From: Dean Lawrence [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 2:26 PM Subject: [Declude.JunkMail] OT: Moving mail servers I am in the process of moving my Imail server to a different machine at a different hosting facility, hence a new IP. Does anyone have any suggestions for making this a smooth transition? I have moved Imail many times before, so I am not worried about the setup. What I am looking for is suggestions as to how to handle the lag time of routers picking up the new IP. I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. What do you guys think? Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
Dean, The best thing to do is lower your TTL well ahead of time of the move. If you lower your TTL down to about 5 minutes on your records your cutover should not take that long for mail to cutover to your new IP. Also, make sure you get your PTR records added ahead of time. Also you have the option of adding the new ip address as a secondary MX so that when the first box goes offline it should start hitting it right away. Than all you have to do is update and remove the old MX. Just make sure you lower the TTL's for any A records as well for how folks access the machine. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Dean Lawrence writes: I am in the process of moving my Imail server to a different machine at a different hosting facility, hence a new IP. Does anyone have any suggestions for making this a smooth transition? I have moved Imail many times before, so I am not worried about the setup. What I am looking for is suggestions as to how to handle the lag time of routers picking up the new IP. I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. What do you guys think? Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Moving mail servers
In addition to Bud's TTL suggestion, if you want to ensure zero interruption of service, you could have your customers create a second account to pull mail off of both servers, but in general a short TTL (say 15-60 minutes) and store and forward to the new server will work fine. Darin. - Original Message - From: Dean Lawrence [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 2:26 PM Subject: [Declude.JunkMail] OT: Moving mail servers I am in the process of moving my Imail server to a different machine at a different hosting facility, hence a new IP. Does anyone have any suggestions for making this a smooth transition? I have moved Imail many times before, so I am not worried about the setup. What I am looking for is suggestions as to how to handle the lag time of routers picking up the new IP. I host mail for a number of my clients, so there may be a period of time where they cannot get to their mail. I would like to minimize this. I had thought about just turning off the old server once the DNS changes have been made so that no mail would be lost in translation, but I had also thought about converting it to a store and forward server so that the mail will get delivered to the new server quicker. What do you guys think? Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] FROM Actions
M That's life as they say. You can set up the filter to be very efficient M by placing a line at the top of the filter to prequalify it and save M processing. M ALLRECIPS END NOTCONTAINS @cutomerdomain.com Then the rest of my lines would look like this: MAILFROM 0 CONTAINS @senderdomain1.com MAILFROM 0 CONTAINS @senderdomain2.com MAILFROM 0 CONTAINS @senderdomain3.com -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
I can seem to reach www.dnsstuff.com or backup.dnsstuff.com. Are you current having issues? It was down, but should be back up soon. The main server is struggling right now. It's still under a DDoS attack, but is handling that pretty well. But the data partition was destroyed by good 'ole chkdsk -- Windows had troubles reading one (or perhaps several) unnecessary files, and said to run chkdsk. On the next reboot (a few days ago), chkdsk was run, and destroyed the entire partition (with log files, cached WHOIS entries, etc.). Most of the important data has been recovered, but while the rest is being recovered (which could take a week or two), it's running off of just the primary partition, which is far from optimal. And, it's going to be nearly impossible to restore the data partition to the way it was, which may cause some odd behavior. The backup, meanwhile, just isn't prepared for the DDoS attack -- so when the switchover occurred, it couldn't handle the load. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2 actions
If a message results in both a copy and a hold action, will the copy execute? Yes, but not the way you want. The COPYTO action will execute -- Declude JunkMail will tell IMail to add an extra recipient. But the HOLD action will also execute, which prevents the E-mail from being delivered. That will prevent both the original recipient(s) from receiving the E-mail, as well as the COPYTO address. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test to for attachments?
Is there anyway you can scan the email to see if it contains a attachment of say .lnk, and the email going to a user and a patictuler domain and then bounce or delete that email? Since Declude antivirus can't be configured for defferent domains, I was wondering maybe it can be possible to just have deculde junkmail delete all email that hashas forbiddin attachments? (No need to test the domain, as Declude Junk mail can be configured seperatly for each domain) Thanks, William Stillwell Palm Harbor, FL
Re: [Declude.JunkMail] OT: Moving mail servers
Great Guys!! I really appreciate all of your input. Dean --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
Bummer times two. How widely distributed is the attack, Scott? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 5:01 PM Subject: Re: [Declude.JunkMail] Is DNSStuff Down? I can seem to reach www.dnsstuff.com or backup.dnsstuff.com. Are you current having issues? It was down, but should be back up soon. The main server is struggling right now. It's still under a DDoS attack, but is handling that pretty well. But the data partition was destroyed by good 'ole chkdsk -- Windows had troubles reading one (or perhaps several) unnecessary files, and said to run chkdsk. On the next reboot (a few days ago), chkdsk was run, and destroyed the entire partition (with log files, cached WHOIS entries, etc.). Most of the important data has been recovered, but while the rest is being recovered (which could take a week or two), it's running off of just the primary partition, which is far from optimal. And, it's going to be nearly impossible to restore the data partition to the way it was, which may cause some odd behavior. The backup, meanwhile, just isn't prepared for the DDoS attack -- so when the switchover occurred, it couldn't handle the load. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need NDR Filter Help
Thanks Scott and Matt for clearing up the '' issue...it's a far better approach than what I was attempting. Scott... What is the interaction between your two tests, MAILFROM-NULL-SENDER and USER-JOE-JOB? The reason I am asking is that I can only get MAILFROM-NULL-SENDER to trigger and not the user-specific USER-JOB-JOB test. It appears to me that they are mutually exclusive tests: Mailfrom-Null-sender.txt: TESTSFAILED 1 CONTAINS USER-JOE-JOB user-joe-job.txt: TESTSFAILED END NOTCONTAINS MAILFROM-NULL-SENDER MAILFROM-NULL-SENDER does not fail unless USER-JOE-JOB also fails but USER-JOE-JOB ends if MAILFROM-NULL-SENDER hasn't already failed It's kinda like a catch 22 sort of thing. Is my logic wrong? Which brings me to another question...does the order in which the tests appear in the 'global.config' file matter? Thanks! Kim -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROM Actions
Yes. David Sullivan wrote: M That's life as they say. You can set up the filter to be very efficient M by placing a line at the top of the filter to prequalify it and save M processing. M ALLRECIPS END NOTCONTAINS @cutomerdomain.com Then the rest of my lines would look like this: MAILFROM 0 CONTAINS @senderdomain1.com MAILFROM 0 CONTAINS @senderdomain2.com MAILFROM 0 CONTAINS @senderdomain3.com -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need NDR Filter Help
Kim Premuda wrote: It's kinda like a catch 22 sort of thing. Is my logic wrong? Which brings me to another question...does the order in which the tests appear in the 'global.config' file matter? That's actually where to start. Test order does matter. Declude processes the DNS lookups first, then external tests, then fromfiles/ipfiles/spamdomains (not positive of the order), and then custom filters. There are some other things that I left out, but those are the things that matter the most. As far as custom filters go, they will process in the order that they appear in your config. Essentially what happens is Declude populates a TESTSFAILED variable as tests are failed, each value separated with a space, and since filters are run in serial, this exposes that variable for use in each subsequent filter, adding the most recently failed test to the end of the string. Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is DNSStuff Down?
Bummer times two. How widely distributed is the attack, Scott? The hits are coming from over 5,000 IPs -- but those are just web proxies being used by the malware, so the actual number of infected computers could be much higher or lower. Fortunately, the attack was not designed to be an attack (as far as I can tell), so it hasn't been too difficult to deal with. However, it does make other problems worse (such as when the backup can't handle the load). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 2 actions
is there a workarround ? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 11, 2004 10:04 PM Subject: Re: [Declude.JunkMail] 2 actions If a message results in both a copy and a hold action, will the copy execute? Yes, but not the way you want. The COPYTO action will execute -- Declude JunkMail will tell IMail to add an extra recipient. But the HOLD action will also execute, which prevents the E-mail from being delivered. That will prevent both the original recipient(s) from receiving the E-mail, as well as the COPYTO address. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need NDR Filter Help
Yes order does matter. If you are using a TESTSFAILED comparison, the TEST you are wanting to compare needs to be run first. So in this case the mailfrom-null-sender filter must run first. Then I run the joe-job filters. Lastly a combo filter with Message Sniffer and the joe-job filter to lob on more weight. So user-joe-job will only fail, if the mailfrom-null-sender has already true (failed) My general rule for filters is to run the small tests first and the big tests last. So mailfrom, HELO, country, revdsn I consider small tests because there isn't much to compare and it should run quicker. Header and subject are middle tests Body and Anything are the last filters tests that I run, hoping that enough weight is accumulated to skip them. -- Original Message -- From: Kim Premuda [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Thu, 11 Nov 2004 15:20:14 -0800 Thanks Scott and Matt for clearing up the '' issue...it's a far better approach than what I was attempting. Scott... What is the interaction between your two tests, MAILFROM-NULL-SENDER and USER-JOE-JOB? The reason I am asking is that I can only get MAILFROM-NULL-SENDER to trigger and not the user-specific USER-JOB-JOB test. It appears to me that they are mutually exclusive tests: Mailfrom-Null-sender.txt: TESTSFAILED 1 CONTAINS USER-JOE-JOB user-joe-job.txt: TESTSFAILED END NOTCONTAINS MAILFROM-NULL-SENDER MAILFROM-NULL-SENDER does not fail unless USER-JOE-JOB also fails but USER-JOE-JOB ends if MAILFROM-NULL-SENDER hasn't already failed It's kinda like a catch 22 sort of thing. Is my logic wrong? Which brings me to another question...does the order in which the tests appear in the 'global.config' file matter? Thanks! Kim -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
