Re: [Declude.JunkMail] Global.cfg lines for SPF

2005-11-23 Thread Scott Fisher 
I don't give any weight to a SPF pass since many spammers have set up their 
own SPF records and will pass.


- Original Message - 
From: Kim Premuda [EMAIL PROTECTED]

To: Declude.JunkMail@declude.com
Sent: Wednesday, November 23, 2005 12:12 AM
Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF



This is what we have in our 'global.cfg' file:

  SPFFAIL spffail x x 3 0

Is this old syntax? A remnant of version 1.86? We are currently running 
JunkMail 3.0.5.20.


Also, why are the weights all zero? Shouldn't a fail add weight, and a 
pass subtract weight? Or, am I misunderstanding the 'spf' test?


Thanks!

Kim



-- Original Message --
From: David Barker [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 21 Nov 2005 16:26:13 -0500


This is the correct syntax.

SPFFAIL spf fail x 0 0
SPFPASS spf pass x 0 0
SPFUNKNOWN spf unknown x 0 0

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan
Sent: Monday, November 21, 2005 4:00 PM
To: Declude.JunkMail@declude.com
Cc: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF



I use:
SPFPASS   spf  pass x 0 0
SPFUNKNOWN   spf  unknown x 0 0
SPFFAIL   spf  fail x 50 0

 Set 1:
 SPFFAIL spf fail x 9 0
 SPFPASS spf pass x 0 0



Thanks for the quick responses. I did have the correct pair of lines in my
global.cfg file but I have received messages over the weekend which 
Imail's

SPF check marked as SPFFAIL but Declude did not. The messages were what
F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own domain.
Since I have an SPF record, they should have failed the Declude check but
they did not. As a result the first few that arrived before F-Prot updated
their databases and were delivered to my users. I'm aware of at least one
user who attempted to open the zip file.

Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20?

Brad Morgan
IT Manager
Horizon Interactive Inc.


---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




--
Kim W. Premuda
FastWave Internet Services
San Diego, CA

--
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Double scoring

2005-11-23 Thread John Carter 
I think I may be double scoring a test.  If you have a score in the filter
file  0 and a score in the global  0, does it add the two into the overall
weight?

Example
Filter file entry
REVDNS 1 ENDSWITH .liverandcherrys.com

Global.cfg
JCREVDNS filter d:\Decludefilters\jcrevdns.txt x 1 0

Would a hit here result in a score of 2?

Thanks,
John

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Double scoring

2005-11-23 Thread Matt 

Yes it does.

Matt



John Carter wrote:


I think I may be double scoring a test.  If you have a score in the filter
file  0 and a score in the global  0, does it add the two into the overall
weight?

Example
Filter file entry
REVDNS 1 ENDSWITH .liverandcherrys.com

Global.cfg
JCREVDNS filter d:\Decludefilters\jcrevdns.txt x 1 0

Would a hit here result in a score of 2?

Thanks,
John

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.