Re: [Declude.JunkMail] Question about filtering

[Matt]

Kevin,

Yes, that filter should work.

Matt



Kevin Bilbee wrote:

  
  
  Ok that make good sence so do you think this
will work
   
  BODY 15 CONTAINS 
Content-Transfer-Encoding: quoted-printable  
  
   
  Which is what I asked in the message you replied
to?
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 4:43 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering


Let's clarify a couple of things that might have been confused here.

The original question was asking where the BODY begins.  That is what
my response was addressing.

When it comes to filtering line breaks, that is a totally different
story and it is not the question that I answered.  Within the BODY,
CRLF's are in fact replaced with spaces.

So considering both, in the example that you gave, you would need to
construct a filter that had the following (ignore line breaks if
inserted by your E-mail client and pay attention to spaces):
BODY 15 STARTSWITH  
--=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html;
charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable 


Since almost every E-mail has a different boundary (that first string
of characters), you can't use Declude's built-in filtering to check if
a multipart message starts with a  tag.  If you are
looking at single part messages, ones that have no MIME boundaries and
has only one body segment, you can in fact construct a filter that
checks to see if the body starts with a  tag.  I doubt
that is of any use considering the thread.

Inside joke follows:  A Would recommend to anyone!!!

Matt



Kevin Bilbee wrote:

  So with this -

  
  

  Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam

  

  
  
I would need to do the following if I was looking for 
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 1:37 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering


I believe it starts immediately following the first double CFLF.  I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
it is it only ignores CRLF's and not other characters.

Matt



Kevin Bilbee wrote:



  I have a problem I have been trying to solve. When a contains
  

filter comairs


  abainst the body of the email where does that body begin? Does
  

it begin at


  the mime segment or does it begin at actual content?

For example If I have something like this

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
 (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
by I295e.i.pppool.de with esmtp
id 7511378754121
for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam


Does the body scanning start at --= or does it start at [EMAIL PROTECTED]
(805) 520-5800 x7332

Changing the way industry works.

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




  

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




  
  
---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.J

[Declude.JunkMail] Way OT: Future Broadband - Verizon Business Fios Service

[Dave Doherty]

FWIW-
 
I signed up for Verizon's Business Fios 
(fiber optic broadband) service a couple of weeks ago, and they installed it 
last week.
 

Now let me start by saying that if I 
can buy the equivalent service for ANYTHING from anybody BUT Verizon, I do 
it. Overall, their customer service stinks. I was an early adopter of Vonage, just to get away from Verizon's phone 
service. And my company was a victim of Verizon's hideous network 
design in hurricane Floyd, during which I never lost connectivity but I 
could not move a packet because their billing center drowned.

 
So when the consumer Fios advertising 
blurb arrived a couple of months ago, announcing megabits of connectivity for 
under $100/month, I was skeptical. I reviewed the TOS and found that they 
specifically prohibit servers of any kind, and will not provide static IPs. That 
killed the service for me, because I run a couple of backup servers at home and 
I need the static IPs. There were other problems, but the no-server and no-fixed 
IP policies were deal breakers. I called and asked about a business grade 
service, and was told on no uncertain terms that business Fios was a concept, 
but it was at least three years away from implementation.
 
But a friend of mine down the street 
called around and found a Verizon person who was empowered to create Fios 
business accounts. I called her and got a static block of five IPs with 15mbps 
download and 2mbps upload. Straight pipe, no port blocking, no SMTP "you gotta 
host with us" BS.
 

The order process was very easy, and the 
order taker was great. She wanted to be sure she understood what I needed, 
and she needed to be sure that there was a good match between my needs and their 
offering. 
 
The installer was gracious from the start to the end, even to the point of 
asking me for a brush so he could clean the snow off his shoes before he entered 
the house. I could not ask for a better installer. He spent four hours setting 
up the physical stuff, but he had only done non-business installs before. Not 
surprising, since they are still not promoting Fios as a  business service. 
I spent two minutes setting up the router for a static IP, another two showing 
him how to do it, and about ten to fifteen minutes explaining the difference 
between dynamic and static IPs and the like. (The installer's lack of experience 
was the only negative I can point to, and I expected it since Fios is 
primarily a home service.)
 
I am not easily impressed, but I have 
only one word to describe this service: WOW!  
 
I am getting 15+mbps consistently from 
test sites. My VPN to the data center runs almost as fast as my LAN here at 
home. My backup mail server is running 
without a hitch, as is my backup DNS. I have had zero downtime since the service 
was installed, unlike my Covad DSL service which had downtime several times a 
week.

 
Anyway, sorry for the length of this, but 
I thought it would be interesting to all to see where the telcos are going for 
broadband. Their future clearly is fiber, and so far it looks really, really 
good, at least at Verizon.
 
-Dave Doherty
 Skywaves, Inc.
 

RE: [Declude.JunkMail] Question about filtering

[Kevin Bilbee]

Ok 
that make good sence so do you think this will work
 
BODY 15 CONTAINS  
Content-Transfer-Encoding: quoted-printable  
 
Which 
is what I asked in the message you replied to?

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of 
  MattSent: Monday, December 12, 2005 4:43 PMTo: 
  Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] 
  Question about filteringLet's clarify a couple of things 
  that might have been confused here.The original question was asking 
  where the BODY begins.  That is what my response was 
  addressing.When it comes to filtering line breaks, that is a totally 
  different story and it is not the question that I answered.  Within the 
  BODY, CRLF's are in fact replaced with spaces.So considering both, in 
  the example that you gave, you would need to construct a filter that had the 
  following (ignore line breaks if inserted by your E-mail client and pay 
  attention to spaces):
  BODY 15 STARTSWITH   
--=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html; 
charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable  
Since almost every E-mail has a different 
  boundary (that first string of characters), you can't use Declude's built-in 
  filtering to check if a multipart message starts with a  
  tag.  If you are looking at single part messages, ones that have no MIME 
  boundaries and has only one body segment, you can in fact construct a filter 
  that checks to see if the body starts with a  tag.  I doubt 
  that is of any use considering the thread.Inside joke follows:  
  A Would recommend to anyone!!!MattKevin Bilbee 
  wrote: 
  So with this -

  

  Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam

  
I would need to do the following if I was looking for 
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 1:37 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering


I believe it starts immediately following the first double CFLF.  I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
it is it only ignores CRLF's and not other characters.

Matt



Kevin Bilbee wrote:


  I have a problem I have been trying to solve. When a contains
  filter comairs

  abainst the body of the email where does that body begin? Does
  it begin at

  the mime segment or does it begin at actual content?

For example If I have something like this

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
 (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
by I295e.i.pppool.de with esmtp
id 7511378754121
for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam


Does the body scanning start at --= or does it start at [EMAIL PROTECTED]
(805) 520-5800 x7332

Changing the way industry works.

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




  ---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

Re: [Declude.JunkMail] Question about filtering

[Matt]

Let's clarify a couple of things that might have been confused here.

The original question was asking where the BODY begins.  That is what
my response was addressing.

When it comes to filtering line breaks, that is a totally different
story and it is not the question that I answered.  Within the BODY,
CRLF's are in fact replaced with spaces.

So considering both, in the example that you gave, you would need to
construct a filter that had the following (ignore line breaks if
inserted by your E-mail client and pay attention to spaces):
BODY 15 STARTSWITH   --=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable  

Since almost every E-mail has a different boundary (that first string
of characters), you can't use Declude's built-in filtering to check if
a multipart message starts with a  tag.  If you are
looking at single part messages, ones that have no MIME boundaries and
has only one body segment, you can in fact construct a filter that
checks to see if the body starts with a  tag.  I doubt
that is of any use considering the thread.

Inside joke follows:  A Would recommend to anyone!!!

Matt



Kevin Bilbee wrote:

  So with this -

  
  

  Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam

  

  
  
I would need to do the following if I was looking for 
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 1:37 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering


I believe it starts immediately following the first double CFLF.  I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
it is it only ignores CRLF's and not other characters.

Matt



Kevin Bilbee wrote:



  I have a problem I have been trying to solve. When a contains
  

filter comairs


  abainst the body of the email where does that body begin? Does
  

it begin at


  the mime segment or does it begin at actual content?

For example If I have something like this

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
 (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
by I295e.i.pppool.de with esmtp
id 7511378754121
for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam


Does the body scanning start at --= or does it start at [EMAIL PROTECTED]
(805) 520-5800 x7332

Changing the way industry works.

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




  

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




  
  
---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

RE: [Declude.JunkMail] WAY OT: COVAD VOIP

[Erik Currier]

I'll agree with Evans.

We tried Lingo and Skype.  Vonage is far better.  I live in Prague, Czech 
Republic 9 months of the year... 3 months in USA.  We use Vonage to connect to 
North America via phone.

Vonage does have settings to control how much bandwith is used when on the 
phone and on the internet at the same time.  If you lower the setting from 
their default, you do not notice difference in voice or internet downloading; 
and the voice quality is good.

Erik



-- Original Message --
From: "Evans Martin" <[EMAIL PROTECTED]>
Reply-To: Declude.JunkMail@declude.com
Date:  Mon, 12 Dec 2005 17:56:40 -0600

>I have been using Vonage at home and love it.  I had tried Lingo before
>Vonage and HATED it, although I think most of the problems were due to the
>D-Link hardware that they supplied.
>
>I have had some experience with Linux based PBX systems and have found them
>to be much more cost effective than hardware PBXs.  This along with VoIP
>really has the possibility of cutting quite a bit of cost around the office.
>
>Evans Martin
>
>---
>EVANS MARTIN  <[EMAIL PROTECTED]>
>HOSTING:  http://www.martek.net
>PROGRAMMING:  http://www.martekware.com
>
>iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting
>suite make IPlus Info Browser something no IMail administrator should be
>without.  http://www.martek.net/Default.aspx?tabid=96
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
>> [EMAIL PROTECTED] On Behalf Of Marc Catuogno
>> Sent: Monday, December 12, 2005 11:35 AM
>> To: Declude.JunkMail@declude.com
>> Subject: [Declude.JunkMail] WAY OT: COVAD VOIP
>> 
>> I have been considering switching many of our office from POTS lines to
>> COVAD voice over IP.  Since this is such a diverse and well informed
>> group,
>> I was wonder if anyone has any experience with them or suggestions as to
>> alternate VOIP providers. Off list replies are welcomed.
>> 
>> Thanks -
>> 
>> Marc
>> 
>> ---
>> [This E-mail scanned for viruses by Declude Virus]
>> 
>> ---
>> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>> 
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>> ---
>> [This E-mail scanned for viruses by Declude Virus]
>
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>---
>[This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
 
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] ANN: 5xxSink 0.5.01 update, IIS SMTP text-file recipient validator now supports 'nobody' wildcard domains

[Sanford Whiteman]

>Would it be an idea to develope it in this way that different virt.
>IIS-SMTP-Services can use 5xxSink with different prescan.txt and
>rcptlist.txt. . .

Certainly not a bad idea.  I would tie it to the virtual server instance, so 
you could have subfolders \SMTPSVC1, \SMTPSVC2, etc.  I don't think I'll build 
this in for a while, though, since I really want to encourage people to use a 
real database, like LDAP.  You should see how your performance really is when 
you add thousands of users at your current traffic level.  It may be perfectly 
fine.

--Sandy

--
 
Sanford Whiteman, Chief Technologist 
Broadleaf Systems, a division of 
Cypress Integrated Systems, Inc. 
mailto:[EMAIL PROTECTED] 

--
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] WAY OT: COVAD VOIP

[Evans Martin]

I have been using Vonage at home and love it.  I had tried Lingo before
Vonage and HATED it, although I think most of the problems were due to the
D-Link hardware that they supplied.

I have had some experience with Linux based PBX systems and have found them
to be much more cost effective than hardware PBXs.  This along with VoIP
really has the possibility of cutting quite a bit of cost around the office.

Evans Martin

---
EVANS MARTIN  <[EMAIL PROTECTED]>
HOSTING:  http://www.martek.net
PROGRAMMING:  http://www.martekware.com

iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting
suite make IPlus Info Browser something no IMail administrator should be
without.  http://www.martek.net/Default.aspx?tabid=96


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Marc Catuogno
> Sent: Monday, December 12, 2005 11:35 AM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] WAY OT: COVAD VOIP
> 
> I have been considering switching many of our office from POTS lines to
> COVAD voice over IP.  Since this is such a diverse and well informed
> group,
> I was wonder if anyone has any experience with them or suggestions as to
> alternate VOIP providers. Off list replies are welcomed.
> 
> Thanks -
> 
> Marc
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]

---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] ANN: 5xxSink 0.5.01 update, IIS SMTP text-file recipient validator now supports 'nobody' wildcard domains

[Markus Gufler]

Sandy,

I've tested the previous version and it seem's working great. The next step
will be testing it with several thousands of valid recipients.

Would it be an idea to develope it in this way that different virt.
IIS-SMTP-Services can use 5xxSink with different prescan.txt and
rcptlist.txt
So for example if I have one domain with many valid recipients I can
configure it on a separate IP/MX/IIS-virt-SRV, in order to avoid that
messages for some hundred or thousands of other domains - each one with one
up to around 20 valid recipients - must be checked against the entire list
of valid recipients of the big domain.

Markus




> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of 
> Sanford Whiteman
> Sent: Monday, December 12, 2005 9:13 AM
> To: Declude.JunkMail@declude.com; 
> IMail_Forum@list.ipswitch.com; Declude.Virus@declude.com; 
> sniffer@SortMonster.com
> Subject: [Declude.JunkMail] ANN: 5xxSink 0.5.01 update, IIS 
> SMTP text-file recipient validator now supports 'nobody' 
> wildcard domains
> 
> --
> 5XXSINK Release 0.5.01
> 12/12/2005
>   *
> 
> Release notes for this version:
> 
> [ + Added feature]
> [ * Improved/changed feature ]
> [ - Bug fix  ]
> [ ^ Cosmetic/naming change   ]
> 
> [+]  Added  new  feature,  RHS PRESCANNING, to help with 
> processing of large  recipient  lists  under  certain 
> circumstances. The prescan.txt file,  if it exists, is 
> scanned before the rcptlist.txt. If a match is found,  
> processing  continues  in  rcptlist.txt.  If  no match, 550 
> is returned  immediately.  If no prescan.txt is found, the 
> feature is not enabled.
> 
> The  intent  of  prescan.txt is that it can be a global 
> repository for allowed  RHS  (right-hand-side,  i.e. domain) 
> strings. You list all of your domains in prescan.txt as follows:
> 
> @example.com
> @example.net
> etc.
> 
> When messages are processed, they are FIRST matched against this list.
> This  allows  you  to  cut  down  the  initial  scan for 
> recipients at _unknown_  domains  substantially; for example, 
> if you have 100 hosted domains  with  100  users  each, and 
> you are the erroneous victim of a directory  harvesting  
> attack  against  a  domain  you  DO  NOT  host, rejections  
> with prescan.txt in place will take 1% of the time they if 
> the  entire  rcptlist.txt  were scanned! However, be somewhat careful:
> scanning  prescan.txt  does  add  its  own  overhead.  If  
> you are not concerned about such pure-DoS attacks, you will 
> end up lengthening the lookup  time  for  each  recipient,  
> though likely the effect would be negligible.
> 
> NOTE  #1:  if  prescan.txt  is enabled, users _must_ have 
> their domain listed  in prescan.txt AND their username in 
> rcptlist.txt (or, if they are  in  a  wildcard  domain,  they 
>  must  have  that domain listed in prescan.txt _and_ in rcptlist.txt).
> 
> NOTE  #2:  RHS prescanning is not the same as domain 
> wildcards. Do not be confused. See below.
> 
> [*]  Official  support  for  DOMAIN  WILDCARDS.  This  
> support in fact existed  previously,  but  I  was determined 
> to discourage people from using  it,  since I'm such an 
> opponent of 'nobody' setups. Well, a few people  wrote  to  
> me  and  changed  my  mind.  Anyway, when you enter 
> wildcards, you do not use the asterisk (*) character. You 
> simply enter domain names like so:
> 
> @example.com
> [EMAIL PROTECTED]
> @example.net
> [EMAIL PROTECTED]
> 
> You  may as well put your domain wildcards at the top of your 
> list, so they  get  processed  first. You're going to need 
> all the help you can get processing the backscatter. . . .
> 
> --Sandy
> 
> 
> 
> Sanford Whiteman, Chief Technologist
> Broadleaf Systems, a division of
> Cypress Integrated Systems, Inc.
> e-mail: [EMAIL PROTECTED]
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Question about filtering

[Kevin Bilbee]

Can declude jup in here and settle this. Does filtering remove CRLFs or does
it replace them with spaces???


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Scott Fisher
> Sent: Monday, December 12, 2005 3:07 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] Question about filtering
>
>
> I thought it replaced CRLF's with a space.
>
> - Original Message -
> From: "Matt" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 3:36 PM
> Subject: Re: [Declude.JunkMail] Question about filtering
>
>
> >I believe it starts immediately following the first double CFLF.
>  I'm not
> >sure if the STARTSWITH filter for BODY is tweaked in any way,
> but if it is
> >it only ignores CRLF's and not other characters.
> >
> > Matt
> >
> >
> >
> > Kevin Bilbee wrote:
> >
> >>I have a problem I have been trying to solve. When a contains filter
> >>comairs
> >>abainst the body of the email where does that body begin? Does
> it begin at
> >>the mime segment or does it begin at actual content?
> >>
> >>For example If I have something like this
> >>
> >>Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
> >>  (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
> >>Received: from I295e.i.pppool.de ([85.73.41.94])
> >> by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
> >> for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
> >>Received: from [192.168.207.41] (port=4196 helo=parents)
> >> by I295e.i.pppool.de with esmtp
> >> id 7511378754121
> >> for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
> >>MIME-Version: 1.0
> >>Content-Type: multipart/related;
> >> boundary="=_469e734c3adb39df03c2f293185d8c73"
> >>Message-Id: <[EMAIL PROTECTED]>
> >>Date: Mon, 12 Dec 2005 21:18:36 +0100
> >>To: <[EMAIL PROTECTED]>
> >>From: Jayme Dominguez <[EMAIL PROTECTED]>
> >>Subject: News Alert
> >>
> >>--=_469e734c3adb39df03c2f293185d8c73
> >>Content-Type: text/html; charset="ISO-8859-1"
> >>Content-Transfer-Encoding: quoted-printable
> >>
> >>This is a spam
> >>
> >>
> >>Does the body scanning start at --= or does it start at  >>
> >>Kevin Bilbee
> >>Network Administrator
> >>Standard Abrasives, Inc.
> >>[EMAIL PROTECTED]
> >>(805) 520-5800 x7332
> >>
> >>Changing the way industry works.
> >>
> >>---
> >>[This E-mail scanned for viruses by Declude Virus]
> >>
> >>---
> >>[This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >>
> >>---
> >>This E-mail came from the Declude.JunkMail mailing list.  To
> >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >>type "unsubscribe Declude.JunkMail".  The archives can be found
> >>at http://www.mail-archive.com.
> >>
> >>
> >>
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
>
>

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Question about filtering

[Scott Fisher]

I thought it replaced CRLF's with a space.

- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 3:36 PM
Subject: Re: [Declude.JunkMail] Question about filtering


I believe it starts immediately following the first double CFLF.  I'm not 
sure if the STARTSWITH filter for BODY is tweaked in any way, but if it is 
it only ignores CRLF's and not other characters.


Matt



Kevin Bilbee wrote:

I have a problem I have been trying to solve. When a contains filter 
comairs

abainst the body of the email where does that body begin? Does it begin at
the mime segment or does it begin at actual content?

For example If I have something like this

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
 (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
by I295e.i.pppool.de with esmtp
id 7511378754121
for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam


Does the body scanning start at --= or does it start at http://www.mail-archive.com.




---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Question about filtering

[Kevin Bilbee]

So with this -

> >Subject: News Alert
> >
> >--=_469e734c3adb39df03c2f293185d8c73
> >Content-Type: text/html; charset="ISO-8859-1"
> >Content-Transfer-Encoding: quoted-printable
> >
> >This is a spam
> >

I would need to do the following if I was looking for  -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Matt
> Sent: Monday, December 12, 2005 1:37 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] Question about filtering
>
>
> I believe it starts immediately following the first double CFLF.  I'm
> not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
> it is it only ignores CRLF's and not other characters.
>
> Matt
>
>
>
> Kevin Bilbee wrote:
>
> >I have a problem I have been trying to solve. When a contains
> filter comairs
> >abainst the body of the email where does that body begin? Does
> it begin at
> >the mime segment or does it begin at actual content?
> >
> >For example If I have something like this
> >
> >Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
> >  (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
> >Received: from I295e.i.pppool.de ([85.73.41.94])
> > by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
> > for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
> >Received: from [192.168.207.41] (port=4196 helo=parents)
> > by I295e.i.pppool.de with esmtp
> > id 7511378754121
> > for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
> >MIME-Version: 1.0
> >Content-Type: multipart/related;
> > boundary="=_469e734c3adb39df03c2f293185d8c73"
> >Message-Id: <[EMAIL PROTECTED]>
> >Date: Mon, 12 Dec 2005 21:18:36 +0100
> >To: <[EMAIL PROTECTED]>
> >From: Jayme Dominguez <[EMAIL PROTECTED]>
> >Subject: News Alert
> >
> >--=_469e734c3adb39df03c2f293185d8c73
> >Content-Type: text/html; charset="ISO-8859-1"
> >Content-Transfer-Encoding: quoted-printable
> >
> >This is a spam
> >
> >
> >Does the body scanning start at --= or does it start at  >
> >Kevin Bilbee
> >Network Administrator
> >Standard Abrasives, Inc.
> >[EMAIL PROTECTED]
> >(805) 520-5800 x7332
> >
> >Changing the way industry works.
> >
> >---
> >[This E-mail scanned for viruses by Declude Virus]
> >
> >---
> >[This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >
> >
> >
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
>
>

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Question about filtering

[Matt]

I believe it starts immediately following the first double CFLF.  I'm 
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if 
it is it only ignores CRLF's and not other characters.


Matt



Kevin Bilbee wrote:


I have a problem I have been trying to solve. When a contains filter comairs
abainst the body of the email where does that body begin? Does it begin at
the mime segment or does it begin at actual content?

For example If I have something like this

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
 (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
by I295e.i.pppool.de with esmtp
id 7511378754121
for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam


Does the body scanning start at --= or does it start at http://www.mail-archive.com.


 


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Question about filtering

[Kevin Bilbee]

I have a problem I have been trying to solve. When a contains filter comairs
abainst the body of the email where does that body begin? Does it begin at
the mime segment or does it begin at actual content?

For example If I have something like this

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
  (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
 by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
 for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
 by I295e.i.pppool.de with esmtp
 id 7511378754121
 for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert

--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

This is a spam


Does the body scanning start at --= or does it start at http://www.mail-archive.com.

RE: [Declude.JunkMail] CBL:Fw: news

[Ernesto Nieto]

I'm sorry if this question is really easy but I can't get it to work.
How does the test get included into the global.cfg file?

Ernesto
Imail/Declude newbie


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Tuesday, December 06, 2005 3:52 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] CBL:Fw: news

basically it will end the filter if any of the statements are not true.
 
These stock emails have always met these 4 criteria, so if it doesn't meet
them end the filter.
 
1. contains a gif attachment hence:Content-Type: image/gif
2&3.  contains a header like:  Received: from unknown (HELO randomword
[192.168.
4.  Always fails cmdspace

You could use mine and Kevin's combined:
 
BODY  END NOTCONTAINS Content-Type: image/gif
HEADERS  END NOTCONTAINS Received: from unknown (HELO
HEADERS  END NOTCONTAINS [192.168.
TESTSFAILED END NOTCONTAINS CMDSPACE
 
BODY 15 CONTAINS mailto:[EMAIL PROTECTED]>  
To: Declude.JunkMail@declude.com 
Sent: Tuesday, December 06, 2005 3:28 PM
Subject: Re: [Declude.JunkMail] CBL:Fw: news

Scott,  
 
I am looking through the Declude manual to determine what you are
doing.  I don't think I understand NOTCONTAINS. I would think CONTAINS mean
it has this string in the body and NOTCCONTAINS means it does not.  So why
NOTCONTAINS Content-Type: image/gif?
 
I feel like I am probably missing something painfully obvious here.
 
Todd
 
 

- Original Message - 
From: Scott Fisher   
To: Declude.JunkMail@declude.com 
Sent: Tuesday, December 06, 2005 1:50 PM
Subject: Re: [Declude.JunkMail] CBL:Fw: news

I use this filter:
 
STOPATFIRSTHIT
 
BODY  END NOTCONTAINS Content-Type: image/gif
HEADERS  END NOTCONTAINS Received: from unknown (HELO
HEADERS  END NOTCONTAINS [192.168.
TESTSFAILED END NOTCONTAINS CMDSPACE
 
TESTSFAILED 100 CONTAINS HELO-IS-REVDNS
TESTSFAILED 100 CONTAINS HELOISIP
TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
 
HELOISIP and HELO-IS-REVDNS are from external tests that I
run.

- Original Message - 
From: Richard Farris   
To: Declude.JunkMail@declude.com 
Sent: Tuesday, December 06, 2005 1:25 PM
Subject: [Declude.JunkMail] CBL:Fw: news

Does anyone have an answer to filter these type
emails?

Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - 
From: [EMAIL PROTECTED] 
To: [EMAIL PROTECTED] 
Sent: Tuesday, December 06, 2005 3:20 AM
Subject: news

 






---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Checking country so many times...

[Mark Smith]

Matt,
Thanks for the info but no dice.
I reverted back to 2.6 and blazing fast processing. There's just something
about 3.05 on my servers that runs slow.
And I've got 3 servers doing the same thing..

SysInternals Process explorer shows that DecludeProc really isn't calling
that many instances of spamchk, sniffer, etc.
It's like the files go into the work folder but just "hang out" there for a
while. It's almost as if there's a pause between each test.

Odd..

Had to go back to 2.6 again.



> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Matt
> Sent: Monday, December 12, 2005 1:01 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] Checking country so many times...
>
> Mark,
>
> I believe that most people that are seeing backups have
> reported that raising their THREADS to something like 75 and
> lowering their WAITFORTHREADS to something like 1 will clean
> up their performance issues.  This seems to be common for
> those around here that get more than 50,000 messages a day on
> a server and/or report that they are backing up E-mail but
> have spare CPU.
>
> I'm not sure why these settings are manually adjustable, or
> at least not having the defaults targeted at the higher
> volume servers where it matters the most.  It seems that the
> critical piece is the CPU utilization and not the threads,
> and of course all threads are not created equally.  A single
> thread could result in 100% CPU utilization on it's own on my
> beefy server, but on the other hand a message that doesn't
> get virus scanned (passes PRESCAN) and gets to the DELETE
> weight from RBL's alone is hardly a blip.  My biggest issue
> with getting slammed are bounce messages since they are
> mostly being scanned for viruses, and when the bounces come
> from a client's server and are legitimate (and pass spam
> scanning), every single filter needs to be run, and these
> messages typically come in real fast.  It would make so much
> more sense to monitor the CPU utilization and adjust the
> WAITBETWEENTHREADS number according to how high the CPU is.
> For instance, if the CPU is at 100% for the last 5 seconds,
> one should maybe wait 1 second before processing the next
> E-mail until it drops again, but if the CPU is at 50% for the
> last 5 seconds, the wait should be 0.
>
> So anyway, I would just leave your threads in an area that
> could be impractical for your server to handle and just hope
> that it stays stable under heavy load.  That at least seems
> to be the net result of changing these settings to the values
> that others have described doing.
>
> Matt
>
>
>
> Mark Smith wrote:
>
> >Just moved to 3.05.22 and my server's can't keep up with the
> queue (but
> >they can with 2.06).
> >Threads=20 CPU's fine.
> >Anyway, I set Declude logs to debug and I'm seeing this for
> every message.
> >
> >Anyone know why Declude would check the country so many times?
> >
> >
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking
> countries:  US .
> >12/12/2005 12:14:26.837 qaf8501fe000

Re: [Declude.JunkMail] WAY OT: COVAD VOIP

[Dave Doherty]

Yes, was all over their website when I signed up for the service. It's very 
clear that you need to provide the address info, and they make it very easy 
to do.


They were actually so pushy about it that I wondered whether they were in 
trouble somewhere and a few days later they were on the news about a lawsuit 
in Texas.


-d

- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 2:44 PM
Subject: Re: [Declude.JunkMail] WAY OT: COVAD VOIP


I know for a bit vonage did not provide 911 service - has that been 
resolved yet by them?  I know the FCC mandated it..

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, 
MRTG Integration, and Log Parsers.


Dave Doherty writes:
I use Vonage - $25/mo unlimited for home use. Been using it for about six 
months, and the only problem I encountered was an occasional breakup of 
the voice channel while downloading large files. I was using it on a 
Covad 384k DSL line, which I just dropped in favor of Verizon's Fios 
service. The VOIP works perfectly with the greater bandwidth Fios offers 
(15mbps down, 1.8mbps up). You need a minimum of 90kbps for each voice 
channel, so be sure you have enough bandwith available. There are a few 
features you can't get - at least not yet. The main one that I miss is 
one Verizon offered that blocked incoming calls if the caller cloaked his 
caller ID. I always figured that if the caller didn't want me know who he 
was, I didn't really care to talk to him anyway. But that is MUCH less of 
an issue now that we have the national and statewide (NJ) Do Not Call 
registries. I do keep one copper POTS line from the telephone company for 
emergency use. If all else fails, that self-powered copper pair is worth 
its weight in gold. Bat all-in-all, I've never looked back. -Dave Doherty
Skywaves, Inc. - Original Message - From: "Marc Catuogno" 
<[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 12:35 PM
Subject: [Declude.JunkMail] WAY OT: COVAD VOIP

I have been considering switching many of our office from POTS lines to
COVAD voice over IP.  Since this is such a diverse and well informed 
group,

I was wonder if anyone has any experience with them or suggestions as to
alternate VOIP providers. Off list replies are welcomed. Thanks - 
Marc ---

[This E-mail scanned for viruses by Declude Virus] ---
[This E-mail was scanned for viruses by Declude EVA www.declude.com] ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

 ---
[This E-mail was scanned for viruses by Declude EVA www.declude.com] ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] WAY OT: COVAD VOIP

[Darrell \([EMAIL PROTECTED])]

I know for a bit vonage did not provide 911 service - has that been resolved 
yet by them?  I know the FCC mandated it.. 


Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers. 



Dave Doherty writes: 

I use Vonage - $25/mo unlimited for home use. Been using it for about six 
months, and the only problem I encountered was an occasional breakup of 
the voice channel while downloading large files. I was using it on a Covad 
384k DSL line, which I just dropped in favor of Verizon's Fios service. 
The VOIP works perfectly with the greater bandwidth Fios offers (15mbps 
down, 1.8mbps up). You need a minimum of 90kbps for each voice channel, so 
be sure you have enough bandwith available. 

There are a few features you can't get - at least not yet. The main one 
that I miss is one Verizon offered that blocked incoming calls if the 
caller cloaked his caller ID. I always figured that if the caller didn't 
want me know who he was, I didn't really care to talk to him anyway. But 
that is MUCH less of an issue now that we have the national and statewide 
(NJ) Do Not Call registries. 

I do keep one copper POTS line from the telephone company for emergency 
use. If all else fails, that self-powered copper pair is worth its weight 
in gold. 

Bat all-in-all, I've never looked back. 


-Dave Doherty
Skywaves, Inc. 

 

 

- Original Message - From: "Marc Catuogno" 
<[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 12:35 PM
Subject: [Declude.JunkMail] WAY OT: COVAD VOIP 




I have been considering switching many of our office from POTS lines to
COVAD voice over IP.  Since this is such a diverse and well informed 
group,

I was wonder if anyone has any experience with them or suggestions as to
alternate VOIP providers. Off list replies are welcomed. 

Thanks - 

Marc 


---
[This E-mail scanned for viruses by Declude Virus] 


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com] 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com. 



 


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com] 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Checking country so many times...

[Scott Fisher]

My guess is that this is normal behavior. I'm thinking that what you are 
seeing is the searching through country database (all_list.dat).


- Original Message - 
From: "Mark Smith" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 11:28 AM
Subject: [Declude.JunkMail] Checking country so many times...


Just moved to 3.05.22 and my server's can't keep up with the queue (but 
they

can with 2.06).
Threads=20 CPU's fine.
Anyway, I set Declude logs to debug and I'm seeing this for every message.

Anyone know why Declude would check the country so many times?


12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf

Re: [Declude.JunkMail] WAY OT: COVAD VOIP

[Dave Doherty]

I use Vonage - $25/mo unlimited for home use. Been using it for about six 
months, and the only problem I encountered was an occasional breakup of the 
voice channel while downloading large files. I was using it on a Covad 384k 
DSL line, which I just dropped in favor of Verizon's Fios service. The VOIP 
works perfectly with the greater bandwidth Fios offers (15mbps down, 1.8mbps 
up). You need a minimum of 90kbps for each voice channel, so be sure you 
have enough bandwith available.


There are a few features you can't get - at least not yet. The main one that 
I miss is one Verizon offered that blocked incoming calls if the caller 
cloaked his caller ID. I always figured that if the caller didn't want me 
know who he was, I didn't really care to talk to him anyway. But that is 
MUCH less of an issue now that we have the national and statewide (NJ) Do 
Not Call registries.


I do keep one copper POTS line from the telephone company for emergency use. 
If all else fails, that self-powered copper pair is worth its weight in 
gold.


Bat all-in-all, I've never looked back.

-Dave Doherty
Skywaves, Inc.





- Original Message - 
From: "Marc Catuogno" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 12:35 PM
Subject: [Declude.JunkMail] WAY OT: COVAD VOIP



I have been considering switching many of our office from POTS lines to
COVAD voice over IP.  Since this is such a diverse and well informed 
group,

I was wonder if anyone has any experience with them or suggestions as to
alternate VOIP providers. Off list replies are welcomed.

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Checking country so many times...

[Bill Green dfn Systems]

Mark,

I don't know what your processor capability is, but with dual 1.5s my 
optimum setting is threads=65. You may try bumping yours up to at least 
35-40 and see what it does to your proc utilization. you'll need to restart 
decludeproc service after the change for it to take effect.


Keep in mind that if you have a backlog, your processor may max until it 
clears out. If it is still maxing after your que is cleared, adjust the 
threads back down some.


Bill


- Original Message - 
From: "Mark Smith" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 10:28 AM
Subject: [Declude.JunkMail] Checking country so many times...


Just moved to 3.05.22 and my server's can't keep up with the queue (but 
they

can with 2.06).
Threads=20 CPU's fine.
Anyway, I set Declude logs to debug and I'm seeing this for every message.

Anyone know why Declude would check the country so many times?


12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking co

RE: [Declude.JunkMail] WAY OT: COVAD VOIP

[calvis]

Yes this is Way OT :)


The good thing about Covad VOIP is that they will provide you with a SLA
which is rare for a VOIP provider. 

The Cons are:

1) You have to use their switch & router & brand of phones.
2) Rates are not really that good compared to other VOIP providers.
3) Their interface is limited.  i.e. you can't customize the interface to
work with CRM programs.
4) DID selection is limited. i.e. they could not provide Taiwan DIDs or me.


Alternatives are:


http://www.asterisk.org/
http://www.digium.com/
http://www.voip-info.org/wiki-asterisk


This requires some IT resources in learning and understanding, but the
possibilities are unlimited.


-calvis
Internet Technology Group
Redmond, WA






-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Monday, December 12, 2005 9:35 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] WAY OT: COVAD VOIP

I have been considering switching many of our office from POTS lines to
COVAD voice over IP.  Since this is such a diverse and well informed group,
I was wonder if anyone has any experience with them or suggestions as to
alternate VOIP providers. Off list replies are welcomed.

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Checking country so many times...

[Matt]

Mark,

I believe that most people that are seeing backups have reported that 
raising their THREADS to something like 75 and lowering their 
WAITFORTHREADS to something like 1 will clean up their performance 
issues.  This seems to be common for those around here that get more 
than 50,000 messages a day on a server and/or report that they are 
backing up E-mail but have spare CPU.


I'm not sure why these settings are manually adjustable, or at least not 
having the defaults targeted at the higher volume servers where it 
matters the most.  It seems that the critical piece is the CPU 
utilization and not the threads, and of course all threads are not 
created equally.  A single thread could result in 100% CPU utilization 
on it's own on my beefy server, but on the other hand a message that 
doesn't get virus scanned (passes PRESCAN) and gets to the DELETE weight 
from RBL's alone is hardly a blip.  My biggest issue with getting 
slammed are bounce messages since they are mostly being scanned for 
viruses, and when the bounces come from a client's server and are 
legitimate (and pass spam scanning), every single filter needs to be 
run, and these messages typically come in real fast.  It would make so 
much more sense to monitor the CPU utilization and adjust the 
WAITBETWEENTHREADS number according to how high the CPU is.  For 
instance, if the CPU is at 100% for the last 5 seconds, one should maybe 
wait 1 second before processing the next E-mail until it drops again, 
but if the CPU is at 50% for the last 5 seconds, the wait should be 0.


So anyway, I would just leave your threads in an area that could be 
impractical for your server to handle and just hope that it stays stable 
under heavy load.  That at least seems to be the net result of changing 
these settings to the values that others have described doing.


Matt



Mark Smith wrote:


Just moved to 3.05.22 and my server's can't keep up with the queue (but they
can with 2.06).
Threads=20 CPU's fine.
Anyway, I set Declude logs to debug and I'm seeing this for every message.

Anyone know why Declude would check the country so many times?


12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking 

re: [Declude.JunkMail] Checking country so many times...

[Gary Steiner]

It doesn't.  What happens (and it only seems to happen for the COUNTRIES 
filter) is that it prints a line for every line in the filter file.  The US 
that you see is what it found in the message, and it is comparing US to every 
line in the filter file.

Gary


  Original Message 
> From: "Mark Smith" <[EMAIL PROTECTED]>
> Sent: Monday, December 12, 2005 12:31 PM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] Checking country so many times...
> 
> Just moved to 3.05.22 and my server's can't keep up with the queue (but they
> can with 2.06).
> Threads=20 CPU's fine.
> Anyway, I set Declude logs to debug and I'm seeing this for every message.
> 
> Anyone know why Declude would check the country so many times?
> 
> 
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
> 12/12/2005 12:14:26.8

[Declude.JunkMail] WAY OT: COVAD VOIP

[Marc Catuogno]

I have been considering switching many of our office from POTS lines to
COVAD voice over IP.  Since this is such a diverse and well informed group,
I was wonder if anyone has any experience with them or suggestions as to
alternate VOIP providers. Off list replies are welcomed.

Thanks -

Marc

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Checking country so many times...

[Mark Smith]

Just moved to 3.05.22 and my server's can't keep up with the queue (but they
can with 2.06).
Threads=20 CPU's fine.
Anyway, I set Declude logs to debug and I'm seeing this for every message.

Anyone know why Declude would check the country so many times?


12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.837 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countries:  US .
12/12/2005 12:14:26.852 qaf8501fe351b.smd Checking countri

RE: [Declude.JunkMail] REVDNS

[Colbeck, Andrew]

Well, telling the fake hotmail from the normal hotmail is one thing...

And for this specific task, working around REVDNS is not your best best.
HotMail publishes SPF records that help you by identifying their blocks
of outbound CIDR addresses.  All you need to do is check for a mailfrom
that ends with hotmail.com and for a SPF PASS.

But another cautionary note is that you can *counterweight* hotmail
*too* much.

I, and others here, regularly see spam from disposable hotmail accounts.
The spammers know that they will get the account banned, but they don't
care, the payload is either in the HTML, or advertise a contact for
phone and fax number (Nigerian or "419" fraud), or pump and dump stock
fraud, or a deliberately mangled URL that won't be picked up by URI
scanning.  In other words, IP4R tests don't work to fight these, and
content scanners lag behind at least one wave of this spam.

Andrew 8)


> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Serge
> Sent: Monday, December 12, 2005 8:36 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] REVDNS
> 
> I use tests that were posted long time ago by kami I use them 
> for aol, hotmail, yahoo, ...
> i think they are much more flexible than spamdomains, and 
> they test mailfrom, revdns and helo (i think spamdomains only 
> test mailfrom and
> revdns)
> there was a long discussion at that time, i do not remember 
> all the details, try checking the archives.
> 
> 
> - Original Message -
> From: "Markus Gufler" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 3:14 PM
> Subject: RE: [Declude.JunkMail] REVDNS
> 
> 
> > Thank you Scott,
> >
> > Serge, why do you use such a filter? A SpamDomain-Test 
> should do this even
> > bether.
> >
> > Markus
> >
> >
> >
> > > -Original Message-
> > > From: [EMAIL PROTECTED]
> > > [mailto:[EMAIL PROTECTED] On Behalf Of 
> Scott Fisher
> > > Sent: Monday, December 12, 2005 3:58 PM
> > > To: Declude.JunkMail@declude.com
> > > Subject: Re: [Declude.JunkMail] REVDNS
> > >
> > > REVDNS  10 IS  (Timeout)
> > >
> > > - Original Message -
> > > From: "Markus Gufler" <[EMAIL PROTECTED]>
> > > To: 
> > > Sent: Monday, December 12, 2005 1:42 AM
> > > Subject: RE: [Declude.JunkMail] REVDNS
> > >
> > >
> > > >
> > > >> I think it may be (timeout).  I know Scott
> > > >> Fisher posted a filter the other day that had the exact text
> > > >> on what it is when rev dns times out.
> > > >
> > > > It was a message from Scott Fisher on the "cbl"-thread and
> > > as I can see he
> > > > posted a line
> > > >
> > > > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> > > >
> > > > So it would be interesting know what's exactly in his text
> > > filter file
> > > > "REVDNS-TIMEOUT"
> > > >
> > > > Markus
> > > >
> > > >
> > > > ---
> > > > [This E-mail was scanned for viruses by Declude EVA 
> www.declude.com]
> > > >
> > > > ---
> > > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > > at http://www.mail-archive.com.
> > > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude EVA 
> www.declude.com]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Serge]

I use tests that were posted long time ago by kami
I use them for aol, hotmail, yahoo, ...
i think they are much more flexible than spamdomains, and they test
mailfrom, revdns and helo (i think spamdomains only test mailfrom and
revdns)
there was a long discussion at that time, i do not remember all the details,
try checking the archives.


- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: 
Sent: Monday, December 12, 2005 3:14 PM
Subject: RE: [Declude.JunkMail] REVDNS


> Thank you Scott,
>
> Serge, why do you use such a filter? A SpamDomain-Test should do this even
> bether.
>
> Markus
>
>
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
> > Sent: Monday, December 12, 2005 3:58 PM
> > To: Declude.JunkMail@declude.com
> > Subject: Re: [Declude.JunkMail] REVDNS
> >
> > REVDNS  10 IS  (Timeout)
> >
> > - Original Message -
> > From: "Markus Gufler" <[EMAIL PROTECTED]>
> > To: 
> > Sent: Monday, December 12, 2005 1:42 AM
> > Subject: RE: [Declude.JunkMail] REVDNS
> >
> >
> > >
> > >> I think it may be (timeout).  I know Scott
> > >> Fisher posted a filter the other day that had the exact text
> > >> on what it is when rev dns times out.
> > >
> > > It was a message from Scott Fisher on the "cbl"-thread and
> > as I can see he
> > > posted a line
> > >
> > > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> > >
> > > So it would be interesting know what's exactly in his text
> > filter file
> > > "REVDNS-TIMEOUT"
> > >
> > > Markus
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Scott Fisher]

Last month I receveived a REVDNS timeout on 4% of all my email. 85% of that 
was spam.


It is certainly an obfuscation technique used by some static spammers.


- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 9:45 AM
Subject: RE: [Declude.JunkMail] REVDNS



Is a REVDNS-timeout such a frequent thing?

Markus




-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Monday, December 12, 2005 4:31 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] REVDNS

Spamdomains tests do not trigger on a REVDNS Timeout.

- Original Message -
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: 
Sent: Monday, December 12, 2005 9:14 AM
Subject: RE: [Declude.JunkMail] REVDNS


> Thank you Scott,
>
> Serge, why do you use such a filter? A SpamDomain-Test
should do this even
> bether.
>
> Markus
>
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED] On Behalf Of
Scott Fisher
>> Sent: Monday, December 12, 2005 3:58 PM
>> To: Declude.JunkMail@declude.com
>> Subject: Re: [Declude.JunkMail] REVDNS
>>
>> REVDNS  10 IS  (Timeout)
>>
>> - Original Message -
>> From: "Markus Gufler" <[EMAIL PROTECTED]>
>> To: 
>> Sent: Monday, December 12, 2005 1:42 AM
>> Subject: RE: [Declude.JunkMail] REVDNS
>>
>>
>> >
>> >> I think it may be (timeout).  I know Scott
>> >> Fisher posted a filter the other day that had the exact text
>> >> on what it is when rev dns times out.
>> >
>> > It was a message from Scott Fisher on the "cbl"-thread and
>> as I can see he
>> > posted a line
>> >
>> > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
>> >
>> > So it would be interesting know what's exactly in his text
>> filter file
>> > "REVDNS-TIMEOUT"
>> >
>> > Markus
>> >
>> >
>> > ---
>> > [This E-mail was scanned for viruses by Declude EVA
www.declude.com]
>> >
>> > ---
>> > This E-mail came from the Declude.JunkMail mailing list.  To
>> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> > type "unsubscribe Declude.JunkMail".  The archives can be found
>> > at http://www.mail-archive.com.
>> >
>>
>> ---
>> [This E-mail was scanned for viruses by Declude EVA
www.declude.com]
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] REVDNS

[Markus Gufler]

Is a REVDNS-timeout such a frequent thing?

Markus

 

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
> Sent: Monday, December 12, 2005 4:31 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] REVDNS
> 
> Spamdomains tests do not trigger on a REVDNS Timeout.
> 
> - Original Message -
> From: "Markus Gufler" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 9:14 AM
> Subject: RE: [Declude.JunkMail] REVDNS
> 
> 
> > Thank you Scott,
> >
> > Serge, why do you use such a filter? A SpamDomain-Test 
> should do this even
> > bether.
> >
> > Markus
> >
> >
> >
> >> -Original Message-
> >> From: [EMAIL PROTECTED]
> >> [mailto:[EMAIL PROTECTED] On Behalf Of 
> Scott Fisher
> >> Sent: Monday, December 12, 2005 3:58 PM
> >> To: Declude.JunkMail@declude.com
> >> Subject: Re: [Declude.JunkMail] REVDNS
> >>
> >> REVDNS  10 IS  (Timeout)
> >>
> >> - Original Message -
> >> From: "Markus Gufler" <[EMAIL PROTECTED]>
> >> To: 
> >> Sent: Monday, December 12, 2005 1:42 AM
> >> Subject: RE: [Declude.JunkMail] REVDNS
> >>
> >>
> >> >
> >> >> I think it may be (timeout).  I know Scott
> >> >> Fisher posted a filter the other day that had the exact text
> >> >> on what it is when rev dns times out.
> >> >
> >> > It was a message from Scott Fisher on the "cbl"-thread and
> >> as I can see he
> >> > posted a line
> >> >
> >> > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> >> >
> >> > So it would be interesting know what's exactly in his text
> >> filter file
> >> > "REVDNS-TIMEOUT"
> >> >
> >> > Markus
> >> >
> >> >
> >> > ---
> >> > [This E-mail was scanned for viruses by Declude EVA 
> www.declude.com]
> >> >
> >> > ---
> >> > This E-mail came from the Declude.JunkMail mailing list.  To
> >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >> > type "unsubscribe Declude.JunkMail".  The archives can be found
> >> > at http://www.mail-archive.com.
> >> >
> >>
> >> ---
> >> [This E-mail was scanned for viruses by Declude EVA 
> www.declude.com]
> >>
> >> ---
> >> This E-mail came from the Declude.JunkMail mailing list.  To
> >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >> type "unsubscribe Declude.JunkMail".  The archives can be found
> >> at http://www.mail-archive.com.
> >>
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > 
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Scott Fisher]

Spamdomains tests do not trigger on a REVDNS Timeout.

- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 9:14 AM
Subject: RE: [Declude.JunkMail] REVDNS



Thank you Scott,

Serge, why do you use such a filter? A SpamDomain-Test should do this even
bether.

Markus




-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Monday, December 12, 2005 3:58 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] REVDNS

REVDNS  10 IS  (Timeout)

- Original Message -
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: 
Sent: Monday, December 12, 2005 1:42 AM
Subject: RE: [Declude.JunkMail] REVDNS


>
>> I think it may be (timeout).  I know Scott
>> Fisher posted a filter the other day that had the exact text
>> on what it is when rev dns times out.
>
> It was a message from Scott Fisher on the "cbl"-thread and
as I can see he
> posted a line
>
> TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
>
> So it would be interesting know what's exactly in his text
filter file
> "REVDNS-TIMEOUT"
>
> Markus
>
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Scott Fisher]

It is (Timeout), but Declude isn't case sensative.

- Original Message - 
From: "Serge" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 9:14 AM
Subject: Re: [Declude.JunkMail] REVDNS



should this be (Timeout) or (timeout) ?



- Original Message - 
From: "Scott Fisher" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 2:58 PM
Subject: Re: [Declude.JunkMail] REVDNS



REVDNS  10 IS  (Timeout)

- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 1:42 AM
Subject: RE: [Declude.JunkMail] REVDNS


>
>> I think it may be (timeout).  I know Scott
>> Fisher posted a filter the other day that had the exact text
>> on what it is when rev dns times out.
>
> It was a message from Scott Fisher on the "cbl"-thread and as I can see

he

> posted a line
>
> TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
>
> So it would be interesting know what's exactly in his text filter file
> "REVDNS-TIMEOUT"
>
> Markus
>
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] REVDNS

[Goran Jovanovic]

Filter test are not case sensitive

Goran Jovanovic
Omega Network Solutions

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Serge
> Sent: Monday, December 12, 2005 10:14 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] REVDNS
> 
> should this be (Timeout) or (timeout) ?
> 
> 
> 
> - Original Message -
> From: "Scott Fisher" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 2:58 PM
> Subject: Re: [Declude.JunkMail] REVDNS
> 
> 
> > REVDNS  10 IS  (Timeout)
> >
> > - Original Message -
> > From: "Markus Gufler" <[EMAIL PROTECTED]>
> > To: 
> > Sent: Monday, December 12, 2005 1:42 AM
> > Subject: RE: [Declude.JunkMail] REVDNS
> >
> >
> > >
> > >> I think it may be (timeout).  I know Scott
> > >> Fisher posted a filter the other day that had the exact text
> > >> on what it is when rev dns times out.
> > >
> > > It was a message from Scott Fisher on the "cbl"-thread and as I
can
> see
> he
> > > posted a line
> > >
> > > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> > >
> > > So it would be interesting know what's exactly in his text filter
file
> > > "REVDNS-TIMEOUT"
> > >
> > > Markus
> > >
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude EVA
www.declude.com]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Serge]

should this be (Timeout) or (timeout) ?



- Original Message - 
From: "Scott Fisher" <[EMAIL PROTECTED]>
To: 
Sent: Monday, December 12, 2005 2:58 PM
Subject: Re: [Declude.JunkMail] REVDNS


> REVDNS  10 IS  (Timeout)
>
> - Original Message - 
> From: "Markus Gufler" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 1:42 AM
> Subject: RE: [Declude.JunkMail] REVDNS
>
>
> >
> >> I think it may be (timeout).  I know Scott
> >> Fisher posted a filter the other day that had the exact text
> >> on what it is when rev dns times out.
> >
> > It was a message from Scott Fisher on the "cbl"-thread and as I can see
he
> > posted a line
> >
> > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> >
> > So it would be interesting know what's exactly in his text filter file
> > "REVDNS-TIMEOUT"
> >
> > Markus
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] REVDNS

[Markus Gufler]

Thank you Scott,

Serge, why do you use such a filter? A SpamDomain-Test should do this even
bether.

Markus



> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
> Sent: Monday, December 12, 2005 3:58 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] REVDNS
> 
> REVDNS  10 IS  (Timeout)
> 
> - Original Message -
> From: "Markus Gufler" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 1:42 AM
> Subject: RE: [Declude.JunkMail] REVDNS
> 
> 
> >
> >> I think it may be (timeout).  I know Scott
> >> Fisher posted a filter the other day that had the exact text
> >> on what it is when rev dns times out.
> >
> > It was a message from Scott Fisher on the "cbl"-thread and 
> as I can see he
> > posted a line
> >
> > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> >
> > So it would be interesting know what's exactly in his text 
> filter file
> > "REVDNS-TIMEOUT"
> >
> > Markus
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > 
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] REVDNS

[Markus Gufler]

> I'm going to try
> REVDNS END CONTAINS (timeout)

Can you send a message from an IP who will timeout for REVDNS?

Declude support?

Markus


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] REVDNS

[Goran Jovanovic]

Here is the exact line for one my log

D9786103b008853ab.smd:X-Note: Reverse DNS: Sent from (timeout)
([81.215.38.233]).

This is from Version 3.0.5.22

Goran Jovanovic
Omega Network Solutions
Tel: 416 322-0333
New Cell: 416 805-4357 or 416 805-HELP
[EMAIL PROTECTED] 
 
 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Serge
> Sent: Monday, December 12, 2005 9:54 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] REVDNS
> 
> > So it would be interesting know what's exactly in his text filter
file
> > "REVDNS-TIMEOUT"
> 
> I'm going to try
> REVDNS END CONTAINS (timeout)
> 
> if somebody have a better idea, please post
> 
> 
> 
> - Original Message -
> From: "Markus Gufler" <[EMAIL PROTECTED]>
> To: 
> Sent: Monday, December 12, 2005 7:42 AM
> Subject: RE: [Declude.JunkMail] REVDNS
> 
> 
> >
> > > I think it may be (timeout).  I know Scott
> > > Fisher posted a filter the other day that had the exact text
> > > on what it is when rev dns times out.
> >
> > It was a message from Scott Fisher on the "cbl"-thread and as I can
see
> he
> > posted a line
> >
> > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
> >
> > So it would be interesting know what's exactly in his text filter
file
> > "REVDNS-TIMEOUT"
> >
> > Markus
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> 
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Serge]

> So it would be interesting know what's exactly in his text filter file
> "REVDNS-TIMEOUT"

I'm going to try
REVDNS END CONTAINS (timeout)

if somebody have a better idea, please post



- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: 
Sent: Monday, December 12, 2005 7:42 AM
Subject: RE: [Declude.JunkMail] REVDNS


>
> > I think it may be (timeout).  I know Scott
> > Fisher posted a filter the other day that had the exact text
> > on what it is when rev dns times out.
>
> It was a message from Scott Fisher on the "cbl"-thread and as I can see he
> posted a line
>
> TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT
>
> So it would be interesting know what's exactly in his text filter file
> "REVDNS-TIMEOUT"
>
> Markus
>
>
> ---
> [This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] REVDNS

[Scott Fisher]

REVDNS  10 IS  (Timeout)

- Original Message - 
From: "Markus Gufler" <[EMAIL PROTECTED]>

To: 
Sent: Monday, December 12, 2005 1:42 AM
Subject: RE: [Declude.JunkMail] REVDNS





I think it may be (timeout).  I know Scott
Fisher posted a filter the other day that had the exact text
on what it is when rev dns times out.


It was a message from Scott Fisher on the "cbl"-thread and as I can see he
posted a line

TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT

So it would be interesting know what's exactly in his text filter file
"REVDNS-TIMEOUT"

Markus


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] ANN: 5xxSink 0.5.01 update, IIS SMTP text-file recipient validator now supports 'nobody' wildcard domains

[Sanford Whiteman]

--
5XXSINK Release 0.5.01
12/12/2005
  *

Release notes for this version:

[ + Added feature]
[ * Improved/changed feature ]
[ - Bug fix  ]
[ ^ Cosmetic/naming change   ]

[+]  Added  new  feature,  RHS PRESCANNING, to help with processing of
large  recipient  lists  under  certain circumstances. The prescan.txt
file,  if it exists, is scanned before the rcptlist.txt. If a match is
found,  processing  continues  in  rcptlist.txt.  If  no match, 550 is
returned  immediately.  If no prescan.txt is found, the feature is not
enabled.

The  intent  of  prescan.txt is that it can be a global repository for
allowed  RHS  (right-hand-side,  i.e. domain) strings. You list all of
your domains in prescan.txt as follows:

@example.com
@example.net
etc.

When messages are processed, they are FIRST matched against this list.
This  allows  you  to  cut  down  the  initial  scan for recipients at
_unknown_  domains  substantially; for example, if you have 100 hosted
domains  with  100  users  each, and you are the erroneous victim of a
directory  harvesting  attack  against  a  domain  you  DO  NOT  host,
rejections  with prescan.txt in place will take 1% of the time they if
the  entire  rcptlist.txt  were scanned! However, be somewhat careful:
scanning  prescan.txt  does  add  its  own  overhead.  If  you are not
concerned about such pure-DoS attacks, you will end up lengthening the
lookup  time  for  each  recipient,  though likely the effect would be
negligible.

NOTE  #1:  if  prescan.txt  is enabled, users _must_ have their domain
listed  in prescan.txt AND their username in rcptlist.txt (or, if they
are  in  a  wildcard  domain,  they  must  have  that domain listed in
prescan.txt _and_ in rcptlist.txt).

NOTE  #2:  RHS prescanning is not the same as domain wildcards. Do not
be confused. See below.

[*]  Official  support  for  DOMAIN  WILDCARDS.  This  support in fact
existed  previously,  but  I  was determined to discourage people from
using  it,  since I'm such an opponent of 'nobody' setups. Well, a few
people  wrote  to  me  and  changed  my  mind.  Anyway, when you enter
wildcards, you do not use the asterisk (*) character. You simply enter
domain names like so:

@example.com
[EMAIL PROTECTED]
@example.net
[EMAIL PROTECTED]

You  may as well put your domain wildcards at the top of your list, so
they  get  processed  first. You're going to need all the help you can
get processing the backscatter. . . .

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.