Re: [Declude.JunkMail] Hijack Question

[Dean Lawrence]

Thanks Luis,
 
I should know to check the release notes for these little tidbits that have not made it into the manual.
 
Dean 
On 4/5/06, Panda Consulting S.A. Luis Alberto Arango <[EMAIL PROTECTED]> wrote:
Release notes don't show any other commandsLuis Arango
   From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] On Behalf Of Panda Consulting
S.A. Luis Alberto Arango   Sent: Miércoles, 05 de Abril de 2006 04:48 p.m.   To: Declude.JunkMail@declude.com   Subject: RE: [Declude.JunkMail] Hijack Question
   Unfortunately it is not in the manual. Too bad.. but it is in therelease notes   http://www.declude.com/Articles.asp?ID=122
   1.69 [Beta, 16 Apr 2003]   ADDED   ALLOWADDR option, to allow up to 20 E-mail addresses to sendunlimited E-mail.   Panda Consulting S.A.   Luis Alberto Arango E.
   From: [EMAIL PROTECTED][mailto:
[EMAIL PROTECTED]] On Behalf Of Dean Lawrence   Sent: Miércoles, 05 de Abril de 2006 12:57 p.m.   To: Declude.JunkMail@declude.com
   Subject: Re: [Declude.JunkMail] Hijack Question   Hi Nick,   Thanks for your input. I didn't see anything related toALLOWADDR in the manual, are there other commands available?
   Thanks,   Dean   On 4/5/06, Nick Hayer <[EMAIL PROTECTED]> wrote:   Hi Dean -
   Dean Lawrence wrote:   >   > First, what thresholds are most of you using, thatcauses minimal   > screaming phone calls from client? 8-)
   RELAYTHRESHOLD11020   RELAYTHRESHOLD23040   >   > Secondly, how are you handling non-fixed IP users
that may send large   > (over the thresholds), but not absorbent amountsof mail?   ALLOWADDR[EMAIL PROTECTED]
   -Nick   ---   This E-mail came from the Declude.JunkMail mailinglist.  To   unsubscribe, just send an E-mail to
[EMAIL PROTECTED], and   type "unsubscribe Declude.JunkMail".  The archivescan be found   at http://www.mail-archive.com
.   --   __   Dean Lawrence, CIO/Partner   Internet Data Technology   888.GET.IDT1
 ext. 701 * fax: 888.438.4381   http://www.idatatech.com/   Corporate Internet Development and Marketing Specialists__[Email scanned for viruses]
[Email escaneado contra virus]---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.-- __
Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 

RE: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - I upgraded to declude 3.0.6.4

[Howard Smith \(N.O.R.A.D.\)]

I have upgraded  to declude 3.0.6.4 
, created a declude.cfg add the line INVITEFIX ON , put my footer lines back in
the virus.cfg file ,  the invites work fine , but my footer is not being
added , so I tried setting the INVITEFIX OFF , still no footers showing up .


 



 

Howard Smith

N.O.R.A.D. Inc.

P.O. Box 680116

Miami, Florida 33168  

www.norad.com


[EMAIL PROTECTED]

Office - (305) NETWORK (638-9675)

Sales - (786) 206-0045

Fax 1 - (305) 359-5144

 



Confidentiality Notice: This email message, including any
Attachments, is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient, please contact  [EMAIL PROTECTED] by email and destroy all
copies of the original message. 

 



 









From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Friday, March 31, 2006 5:39
PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
HELP - outlook meeting invitations arell not coming through properly. Please
See below - Iam using imail 8.15 - declude 2.0.6



 

Best to do both if you have the
declude.cfg

 

David B

www.declude.com

 







From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Friday, March 31, 2006 5:28
PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
HELP - outlook meeting invitations arell not coming through properly. Please
See below - Iam using imail 8.15 - declude 2.0.6



There is a switch in declude.cfg for Declude 3.0.5.21 and up
that may help:





 





# Some customers had issues related to Outlook meeting
requests appearing as text only. 
# The default for this directive is OFF.  
INVITEFIX   ON 







- Original Message - 





From: Howard Smith
(N.O.R.A.D.) 





To: Declude.JunkMail@declude.com






Cc: [EMAIL PROTECTED] 





Sent: Friday, March 31,
2006 4:08 PM





Subject: [Declude.JunkMail]
HELP - outlook meeting invitations arell not coming through properly. Please See
below - Iam using imail 8.15 - declude 2.0.6





 



I have clients that are using outlook
appointment scheduling – but the receipts get the following  email
error - -

Original Message-

From: Bruce Kusens [mailto:[EMAIL PROTECTED]]

Sent: Thursday, March 30, 2006 9:33 AM

To: [EMAIL PROTECTED];
'Therese Adlhoch Smith'; [EMAIL PROTECTED]

Subject: GoToMeeting Invitation - PDC CD call

Received: from imf19aec.mail.bellsouth.net
[205.152.59.67] by norad06.norad.com with ESMTP

(SMTPD32-8.15) id A66ABC8D0026; Thu, 30 Mar 2006
12:33:30 -0500

Received: from ibm60aec.bellsouth.net
([65.8.197.116])

by imf19aec.mail.bellsouth.net with ESMTP

id

<[EMAIL PROTECTED]

>;

Thu, 30 Mar 2006 12:33:30 -0500

Received: from BedTV ([65.8.197.116]) by
ibm60aec.bellsouth.net with ESMTP

id <[EMAIL PROTECTED]>;

Thu, 30 Mar 2006 12:33:30 -0500

Reply-To: <[EMAIL PROTECTED]>

From: "Bruce Kusens"
<[EMAIL PROTECTED]>

To: <[EMAIL PROTECTED]>,

"'Therese Adlhoch Smith'"
<[EMAIL PROTECTED]>,

<[EMAIL PROTECTED]>

Subject: GoToMeeting Invitation - PDC CD call

Date: Thu, 30 Mar 2006 12:33:19 -0500

Organization: Atrus Inc

MIME-Version: 1.0

Content-Type: text/calendar; method=REQUEST;

charset="UTF-8"

Content-Transfer-Encoding: 7bit

X-Mailer: Microsoft Office Outlook, Build
11.0.6353

X-MimeOLE: Produced By Microsoft MimeOLE
V6.00.2900.2180

thread-index: AcZUIAkjq1y9Oj2zT7WmqZng/uqKww==

Message-Id:
<[EMAIL PROTECTED]>

X-Declude-Sender: [EMAIL PROTECTED]
[205.152.59.67]

X-Note: This E-mail was scanned by (www.SecureTrek.com)
for Spam and Virus.

X-Spam-Tests-Failed: Whitelisted [0]

X-Note: This E-mail was sent from
imf19aec.mail.bellsouth.net ([205.152.59.67]).

X-RCPT-TO: <[EMAIL PROTECTED]>

Status: U

X-UIDL: 432016717

BEGIN:VCALENDAR

PRODID:-//Microsoft Corporation//Outlook 11.0
MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT
ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED]

ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED]

ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED]

ORGANIZER:MAILTO:[EMAIL PROTECTED]

DTSTART:20060330T18Z

DTEND:20060330T19Z

TRANSP:OPAQUE

SEQUENCE:0

UID:04008200E00074C5B7101A82E008A0A14A20F653C601

100

01E062A20E3BE2D4881466EED97BFF648

DTSTAMP:20060330T173319Z

DESCRIPTION:When: Thursday\, March 30\, 2006
1:00 PM-2:00 PM (GMT-05:00)

Eastern Time (US & Canada).\n\n*~*~*~*~*~*~*~*~*~*\n\nPlease
join my

meeting at\n https://www.gotomeeting.com/join/874812145\nConference
Call:

Dial (319) 256-0210\, access code
874-812-145\nMeeting ID:

874-812-145\n\nGoToMeeting(TM) \nOnline Meetings
Made Easy\n SUMMARY:GoToMeeting Invitation - PDC CD call

PRIORITY:5

X-MICROSOFT-CDO-IMPORTANCE:1

CLASS:PUBLIC

BEGIN:VALARM

TRIGGER:-PT15M

ACTION:DISPLAY

DESCRIPTION:Reminder

END:VALARM

END:VEVENT

END:VCAL

RE: [Declude.JunkMail] Hijack Question

[Panda Consulting S.A. Luis Alberto Arango]

Release notes don't show any other commands
 
Luis Arango
 




From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting
S.A. Luis Alberto Arango
Sent: Miércoles, 05 de Abril de 2006 04:48 p.m.
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Hijack Question


Unfortunately it is not in the manual. Too bad.. but it is in the
release notes
 
http://www.declude.com/Articles.asp?ID=122
 
1.69 [Beta, 16 Apr 2003]
ADDED
ALLOWADDR option, to allow up to 20 E-mail addresses to send
unlimited E-mail.

 
 
Panda Consulting S.A.
Luis Alberto Arango E.
 




From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dean Lawrence
Sent: Miércoles, 05 de Abril de 2006 12:57 p.m.
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Hijack Question


Hi Nick,
 
Thanks for your input. I didn't see anything related to
ALLOWADDR in the manual, are there other commands available?
 
Thanks,
 
Dean

 
On 4/5/06, Nick Hayer <[EMAIL PROTECTED]> wrote: 

Hi Dean -

Dean Lawrence wrote:

>
> First, what thresholds are most of you using, that
causes minimal 
> screaming phone calls from client? 8-)

RELAYTHRESHOLD11020
RELAYTHRESHOLD23040

>
> Secondly, how are you handling non-fixed IP users
that may send large
> (over the thresholds), but not absorbent amounts
of mail? 

ALLOWADDR[EMAIL PROTECTED]

-Nick
---
This E-mail came from the Declude.JunkMail mailing
list.  To
unsubscribe, just send an E-mail to
[EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives
can be found
at http://www.mail-archive.com.





-- 
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/ 
Corporate Internet Development and Marketing Specialists 


__
[Email scanned for viruses]
[Email escaneado contra virus]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Hijack Question

[Panda Consulting S.A. Luis Alberto Arango]

Unfortunately it is not in the manual. Too bad.. but it is 
in the release notes
 
http://www.declude.com/Articles.asp?ID=122
 
1.69 
[Beta, 16 Apr 2003]
ADDED
ALLOWADDR option, to 
allow up to 20 E-mail addresses to send unlimited E-mail.

 
 
Panda Consulting S.A.
Luis Alberto Arango E.
 

  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Dean 
  LawrenceSent: Miércoles, 05 de Abril de 2006 12:57 
  p.m.To: Declude.JunkMail@declude.comSubject: Re: 
  [Declude.JunkMail] Hijack Question
  
  Hi Nick,
   
  Thanks for your input. I didn't see anything related to ALLOWADDR in the 
  manual, are there other commands available?
   
  Thanks,
   
  Dean 
  On 4/5/06, Nick 
  Hayer <[EMAIL PROTECTED]> 
  wrote: 
  Hi 
Dean -Dean Lawrence wrote:>> First, what 
thresholds are most of you using, that causes minimal > screaming 
phone calls from client? 
8-)RELAYTHRESHOLD11020RELAYTHRESHOLD23040>> 
Secondly, how are you handling non-fixed IP users that may send 
large> (over the thresholds), but not absorbent amounts of mail? 
ALLOWADDR[EMAIL PROTECTED]-Nick---This 
E-mail came from the Declude.JunkMail mailing 
list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype 
"unsubscribe Declude.JunkMail".  The archives can be foundat 
http://www.mail-archive.com.-- __Dean 
  Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * 
  fax: 888.438.4381http://www.idatatech.com/ Corporate 
  Internet Development and Marketing Specialists 

Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

[Dan]

Sweet Matt, thanks!


On Apr 5, 2006, at 13:56, Matt wrote:


Dan,

The code is sort of bitmasked in a way (using hex values).  So  
these codes actually reflect combinations.  There are literally  
hundreds of combinations.


Matt



Dan wrote:


I've been able to assemble these valid codes

http://www.declude.com/tools/header.php?code=c020040c
http://www.declude.com/tools/header.php?code=420f
http://www.declude.com/tools/header.php?code=6000410f
http://www.declude.com/tools/header.php?code=8004000e
http://www.declude.com/tools/header.php?code=801e
http://www.declude.com/tools/header.php?code=802c
http://www.declude.com/tools/header.php?code=840a
http://www.declude.com/tools/header.php?code=8c20
http://www.declude.com/tools/header.php?code=c040120e
http://www.declude.com/tools/header.php?code=c004020e
http://www.declude.com/tools/header.php?code=c010100e
http://www.declude.com/tools/header.php?code=c8000246
http://www.declude.com/tools/header.php?code=c8000247


and these invalid ones, which are reported to be from multiple  
criteria

http://www.declude.com/tools/header.php?code=a400010b
http://www.declude.com/tools/header.php?code=a010010f


Can you confirm if when multiple criteria are triggered, say 3,  
if  one of the 3 is displayed or if it is a composite code that   
represents all 3?


Thanks,
Dan



On Apr 5, 2006, at 5:55, David Barker wrote:


Hi Dan,

I am not sure that there is a list of codes. I think the codes  
are  generated
and then decoded by the headers page. It is a tool that Scott  
Perry  wrote so

I am not that familiar with it I would have to look into it further.

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan
Sent: Tuesday, April 04, 2006 8:40 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more  
confusion


David,

Pardon the delayed reply, but I'm curious, how many possible  
codes  are there

and is there a comprehensive inventory or list anywhere?

Thanks,
Dan



On Feb 24, 2006, at 5:56, David Barker wrote:

You can add the following to your global.cfg file under your  
headers

section:

XINHEADERX-Declude-Code: %HEADERCODE%

This will produce a code and you can check it on this web page  
which
will explain to you what problem(s) exist with headers that  
cause E-
mails to fail the BADHEADERS or SPAMHEADERS tests in Declude   
JunkMail.


http://www.declude.com/tools/header.php

David B
www.declude.com


From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Orin Wells
Sent: Friday, February 24, 2006 3:05 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more  
confusion



Thanks Matt.  I don't spend as much time as some of you folks have
spent on both iMail and Declude so there is more than a little  
bit I

still have to learn.

I misread your first response and got off on the wrong track by
thinking you had said the message-id header WAS inserted by the  
mail
client.  In re-reading you clearly said it was done by iMail.   
OK, I

know what to do now.

At 10:47 PM 2/23/2006, Matt wrote:


Outlook does not add a Message-ID header.  The difference  
between
these two messages is that the first is one that is using your  
server

as it's SMTP server and you are scanning the message as it came
directly from the E-mail client, while the second example is one  
that

passed through another server before coming to yours.  IMail, like
most every E-mail
server, adds a Message-ID header when one isn't already there.
Declude
detects Message-ID headers inserted by your own IMail box  
(Message- Id:
<[EMAIL PROTECTED]> in the first example), and  
treats  the

message as if it didn't have one since it didn't actually have one
when it was received, and this is what triggers SPAMHEADERS for  
this

message.  The
second example had a Message-ID header before it hit your server.
That
header was inserted by Charter's server.
There is a lesser known solution to this that you  
definitely should

add if you are going to stay on IMail 7.07.  You can add
"LOOSENSPAMHEADERS ON" to your Global.cfg to disable the Message-ID
test in SPAMHEADERS.  I use this even though I don't have the same
issue because I get a lot more false positives on SPAMHEADERS  
when it

checks for the Message-ID.  If you use this alternative switch, you
will still get other hits such as CMDSPACE and BADHEADERS on  
some of

the same E-mail clients.  It appears that you aren't using CMDSPACE
though because that test would hit every directly connecting  
Outlook

client unless it was whitelisted.  CMDSPACE is a great test,
especially in combination with other tests that target zombie spam
(XBL/CBL, SpamCop, open relay tests, and to some extent Sniffer).
The best solution is to upgrade to IMail 8.x or higher  
and add a
setting to your Global.cfg for "WHITELIST AUTH".  This will  
wh

Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

[Matt]

Dan,

The code is sort of bitmasked in a way (using hex values).  So these 
codes actually reflect combinations.  There are literally hundreds of 
combinations.


Matt



Dan wrote:


I've been able to assemble these valid codes

http://www.declude.com/tools/header.php?code=c020040c
http://www.declude.com/tools/header.php?code=420f
http://www.declude.com/tools/header.php?code=6000410f
http://www.declude.com/tools/header.php?code=8004000e
http://www.declude.com/tools/header.php?code=801e
http://www.declude.com/tools/header.php?code=802c
http://www.declude.com/tools/header.php?code=840a
http://www.declude.com/tools/header.php?code=8c20
http://www.declude.com/tools/header.php?code=c040120e
http://www.declude.com/tools/header.php?code=c004020e
http://www.declude.com/tools/header.php?code=c010100e
http://www.declude.com/tools/header.php?code=c8000246
http://www.declude.com/tools/header.php?code=c8000247


and these invalid ones, which are reported to be from multiple criteria
http://www.declude.com/tools/header.php?code=a400010b
http://www.declude.com/tools/header.php?code=a010010f


Can you confirm if when multiple criteria are triggered, say 3, if  
one of the 3 is displayed or if it is a composite code that  
represents all 3?


Thanks,
Dan



On Apr 5, 2006, at 5:55, David Barker wrote:


Hi Dan,

I am not sure that there is a list of codes. I think the codes are  
generated
and then decoded by the headers page. It is a tool that Scott Perry  
wrote so

I am not that familiar with it I would have to look into it further.

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan
Sent: Tuesday, April 04, 2006 8:40 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

David,

Pardon the delayed reply, but I'm curious, how many possible codes  
are there

and is there a comprehensive inventory or list anywhere?

Thanks,
Dan



On Feb 24, 2006, at 5:56, David Barker wrote:


You can add the following to your global.cfg file under your headers
section:

XINHEADERX-Declude-Code: %HEADERCODE%

This will produce a code and you can check it on this web page which
will explain to you what problem(s) exist with headers that cause E-
mails to fail the BADHEADERS or SPAMHEADERS tests in Declude  JunkMail.

http://www.declude.com/tools/header.php

David B
www.declude.com


From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Orin Wells
Sent: Friday, February 24, 2006 3:05 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion


Thanks Matt.  I don't spend as much time as some of you folks have
spent on both iMail and Declude so there is more than a little bit I
still have to learn.

I misread your first response and got off on the wrong track by
thinking you had said the message-id header WAS inserted by the mail
client.  In re-reading you clearly said it was done by iMail.  OK, I
know what to do now.

At 10:47 PM 2/23/2006, Matt wrote:


Outlook does not add a Message-ID header.  The difference between
these two messages is that the first is one that is using your server
as it's SMTP server and you are scanning the message as it came
directly from the E-mail client, while the second example is one that
passed through another server before coming to yours.  IMail, like
most every E-mail
server, adds a Message-ID header when one isn't already there.
Declude
detects Message-ID headers inserted by your own IMail box (Message- Id:
<[EMAIL PROTECTED]> in the first example), and treats  the
message as if it didn't have one since it didn't actually have one
when it was received, and this is what triggers SPAMHEADERS for this
message.  The
second example had a Message-ID header before it hit your server.
That
header was inserted by Charter's server.

There is a lesser known solution to this that you definitely should

add if you are going to stay on IMail 7.07.  You can add
"LOOSENSPAMHEADERS ON" to your Global.cfg to disable the Message-ID
test in SPAMHEADERS.  I use this even though I don't have the same
issue because I get a lot more false positives on SPAMHEADERS when it
checks for the Message-ID.  If you use this alternative switch, you
will still get other hits such as CMDSPACE and BADHEADERS on some of
the same E-mail clients.  It appears that you aren't using CMDSPACE
though because that test would hit every directly connecting Outlook
client unless it was whitelisted.  CMDSPACE is a great test,
especially in combination with other tests that target zombie spam
(XBL/CBL, SpamCop, open relay tests, and to some extent Sniffer).

The best solution is to upgrade to IMail 8.x or higher and add a

setting to your Global.cfg for "WHITELIST AUTH".  This will whitelist
all authenticated E-mail, which I assume included the first example
that you provided.  This also saves processing 

Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

[Dan]

I've been able to assemble these valid codes

http://www.declude.com/tools/header.php?code=c020040c
http://www.declude.com/tools/header.php?code=420f
http://www.declude.com/tools/header.php?code=6000410f
http://www.declude.com/tools/header.php?code=8004000e
http://www.declude.com/tools/header.php?code=801e
http://www.declude.com/tools/header.php?code=802c
http://www.declude.com/tools/header.php?code=840a
http://www.declude.com/tools/header.php?code=8c20
http://www.declude.com/tools/header.php?code=c040120e
http://www.declude.com/tools/header.php?code=c004020e
http://www.declude.com/tools/header.php?code=c010100e
http://www.declude.com/tools/header.php?code=c8000246
http://www.declude.com/tools/header.php?code=c8000247


and these invalid ones, which are reported to be from multiple criteria
http://www.declude.com/tools/header.php?code=a400010b
http://www.declude.com/tools/header.php?code=a010010f


Can you confirm if when multiple criteria are triggered, say 3, if  
one of the 3 is displayed or if it is a composite code that  
represents all 3?


Thanks,
Dan



On Apr 5, 2006, at 5:55, David Barker wrote:


Hi Dan,

I am not sure that there is a list of codes. I think the codes are  
generated
and then decoded by the headers page. It is a tool that Scott Perry  
wrote so

I am not that familiar with it I would have to look into it further.

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan
Sent: Tuesday, April 04, 2006 8:40 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

David,

Pardon the delayed reply, but I'm curious, how many possible codes  
are there

and is there a comprehensive inventory or list anywhere?

Thanks,
Dan



On Feb 24, 2006, at 5:56, David Barker wrote:


You can add the following to your global.cfg file under your headers
section:

XINHEADER   X-Declude-Code: %HEADERCODE%

This will produce a code and you can check it on this web page which
will explain to you what problem(s) exist with headers that cause E-
mails to fail the BADHEADERS or SPAMHEADERS tests in Declude  
JunkMail.


http://www.declude.com/tools/header.php

David B
www.declude.com


From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Orin Wells
Sent: Friday, February 24, 2006 3:05 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion


Thanks Matt.  I don't spend as much time as some of you folks have
spent on both iMail and Declude so there is more than a little bit I
still have to learn.

I misread your first response and got off on the wrong track by
thinking you had said the message-id header WAS inserted by the mail
client.  In re-reading you clearly said it was done by iMail.  OK, I
know what to do now.

At 10:47 PM 2/23/2006, Matt wrote:


Outlook does not add a Message-ID header.  The difference between
these two messages is that the first is one that is using your server
as it's SMTP server and you are scanning the message as it came
directly from the E-mail client, while the second example is one that
passed through another server before coming to yours.  IMail, like
most every E-mail
server, adds a Message-ID header when one isn't already there.
Declude
detects Message-ID headers inserted by your own IMail box (Message- 
Id:
<[EMAIL PROTECTED]> in the first example), and treats  
the

message as if it didn't have one since it didn't actually have one
when it was received, and this is what triggers SPAMHEADERS for this
message.  The
second example had a Message-ID header before it hit your server.
That
header was inserted by Charter's server.

There is a lesser known solution to this that you definitely should
add if you are going to stay on IMail 7.07.  You can add
"LOOSENSPAMHEADERS ON" to your Global.cfg to disable the Message-ID
test in SPAMHEADERS.  I use this even though I don't have the same
issue because I get a lot more false positives on SPAMHEADERS when it
checks for the Message-ID.  If you use this alternative switch, you
will still get other hits such as CMDSPACE and BADHEADERS on some of
the same E-mail clients.  It appears that you aren't using CMDSPACE
though because that test would hit every directly connecting Outlook
client unless it was whitelisted.  CMDSPACE is a great test,
especially in combination with other tests that target zombie spam
(XBL/CBL, SpamCop, open relay tests, and to some extent Sniffer).

The best solution is to upgrade to IMail 8.x or higher and add a
setting to your Global.cfg for "WHITELIST AUTH".  This will whitelist
all authenticated E-mail, which I assume included the first example
that you provided.  This also saves processing power since WHITELIST
AUTH disables most tests in JunkMail.

Matt





Orin Wells wrote:
 

RE: [Declude.JunkMail] Sorry, have to share

[Colbeck, Andrew]

Gee, I thought it looked like a perl script...

I sometimes wonder if the spammers write stuff like this because they
lose the thread and forget that they are trying to convince people to
buy their stuff, and not just to craft their message to get past the
antispam filters!

Andrew 8)


> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
> Sent: Wednesday, April 05, 2006 5:52 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] Sorry, have to share
> 
> Actually the grammar reminds me of Matt   :)
> 
> -Nick
> 
> John Carter wrote:
> 
> >I know some of you have seen such before, but the text below is the 
> >most extreme (useless) attempt to get around filters I've seen.  It 
> >looks like something my son would text message.
> >
> >LOL
> >John
> >
> >Your c a redi z t doesn't matter to us ! lf you O n WN real 
> e O st 6 at 
> >x e and want IMMED beIA when TE c 8 ash to spen 7 d ANY way 
> you like, 
> >or simply wish to L b OWER your monthIy pa F f yment S s by 
> a third or 
> >more, here are the de x als we have T U ODbe AY (puke)nbsp;
> >  u
> >$ 40 u 4,000 at a 3, 5 36% f q ixed - rat 3 e $ 37 6 3,000 at a 3, B 
> >00% vari 2 able - rat hi e $ 4 ok 93,000 at a 3, O 4 24% 
> intere u st - 
> >onl z y $
> >2 e 44,000 at a 3,3 G 3% fi oh xed - rat V e $ 1 uh 96,000 
> at a 3 def 
> >,52% varia N ble - ra bi te
> >  
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To 
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> >"unsubscribe Declude.JunkMail".  The archives can be found at 
> >http://www.mail-archive.com.
> >
> >
> >  
> >
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Todd]

The gibberish filter has only "body   0" so no weight is posted in the 
filter.  Weight is only assigned by Declude upon failure of the gibberish 
filter.





- Original Message - 
From: "Scott Fisher" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 1:13 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



You are assigning 30/40 points for the failure of the gibberish filter.
Are you also scoring points within the gibberish filter.

a body 15 contains text  would score 15 for that line matching plus the 30 
for the filter matching.


- Original Message - 
From: "Todd" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:33 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



I recently changed the Gibberish weight from 30 to 40.

SPFPASS spf pass x 0 0

GIBBERISH filter d:\imail\declude\filters\gibberish.txt x 40 
0


SPAMCHK external weight 
"d:\imail\declude\spamchk\spamchk.exe"







- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:21 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



Todd,
Can you post your gibberish, spamchk, and spfpass lines from your 
global.cfg as well.

Darrell
Todd writes:
04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file 
d:\imail\declude\filters\navsmtpspam.txt.txt.

04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK
04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: 
SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN 
GIBBERISH=WARN CATCHALLMAILS=IGNORE
04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on 
this email = IGNORE WARN  [LAST ACTION=WARN] - Original 
Message -  From: "Darrell ([EMAIL PROTECTED])" 
<[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:30 AM
Subject: Re: [Declude.JunkMail] This doesnt add up

Todd,
We would really need to see the Declude log entries for that message 
to better determine the issue.  Can you post that message entry.

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes:


A lot of spam has been getting through lately and at first I was 
thinking my Declude needed some tweaking.  I am seeing some funny 
stuff though.  I find emails where emails contain items that should 
have triggered filters but did not.  I am on IMail 8.15 and Declude 
2.06. Here is a header of an email where the numbers dont add to the 
score. It should have had a score of 5 + 15 + 15 + 30 = 65 but 
instead shows 30 My global.cfg has the following entries for the 
tests that were triggered SUBJECTSPACES7 subjectspaces 7   x 
5 0

SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0 
X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces 
found.

X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, 
weight 30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) 
for spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, 
SPAMCHK, GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com 
([69.89.85.90]). ---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from th

Re: [Declude.JunkMail] This doesnt add up

[Scott Fisher]

Anoth
- Original Message - 
From: "IS - Systems Eng. (Karl Drugge)" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 1:02 PM
Subject: RE: [Declude.JunkMail] This doesnt add up


I've been seeing this for weeks. I reported it, and I believe they are
working on a fix.

Sometimes Declude doesn't put ANYTHING in the headers. Kind of hard to
figure out why something got through in the meantime, though..

Karl Drugge







-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Wednesday, April 05, 2006 1:44 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] This doesnt add up

Todd,

I do not see them in the headers ?

X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:56 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] This doesnt add up

Thanks David,  both of these tests are not hidden and show up in the
headers.

Todd


- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up



To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden

tests,

check your global.cfg you should see the -5

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:22 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] This doesnt add up


A lot of spam has been getting through lately and at first I was

thinking

my
Declude needed some tweaking.  I am seeing some funny stuff though.  I



find
emails where emails contain items that should have triggered filters

but

did
not.  I am on IMail 8.15 and Declude 2.06.

Here is a header of an email where the numbers dont add to the score.

It

should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30

My global.cfg has the following entries for the tests that were

triggered


SUBJECTSPACES7   subjectspaces 7   x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0

0



X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463,

weight

30)
X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)

for

spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS,

SPAMCHK,

GIBBERISH, CATCHALLMAILS [30]
X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).



---
This E-mail came from the Declude.JunkMail mailing list.  To

unsubscribe,

just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
PLEASE NOTE : Florida has a very broad public records law. Most written
communications to or from City officials regarding City business are
public records available to the public and media upon request. Your
E-mail communications may be subject to public disclosure.
PLEASE NOTE : Florida has a very broad public records law. Most written 
communications to or from City officials regarding City business are public 
records available to the public and media upon request. Your E-mail 
communications may be subject to public disclosure.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Scott Fisher]

You are assigning 30/40 points for the failure of the gibberish filter.
Are you also scoring points within the gibberish filter.

a body 15 contains text  would score 15 for that line matching plus the 30 
for the filter matching.


- Original Message - 
From: "Todd" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:33 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



I recently changed the Gibberish weight from 30 to 40.

SPFPASS spf pass x 0 0

GIBBERISH filter d:\imail\declude\filters\gibberish.txt x 
40 0


SPAMCHK external weight "d:\imail\declude\spamchk\spamchk.exe"






- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:21 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



Todd,
Can you post your gibberish, spamchk, and spfpass lines from your 
global.cfg as well.

Darrell
Todd writes:
04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file 
d:\imail\declude\filters\navsmtpspam.txt.txt.

04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK
04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: 
SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN 
GIBBERISH=WARN CATCHALLMAILS=IGNORE
04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this 
email = IGNORE WARN  [LAST ACTION=WARN] - Original Message -  
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:30 AM
Subject: Re: [Declude.JunkMail] This doesnt add up

Todd,
We would really need to see the Declude log entries for that message to 
better determine the issue.  Can you post that message entry.

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes:


A lot of spam has been getting through lately and at first I was 
thinking my Declude needed some tweaking.  I am seeing some funny 
stuff though.  I find emails where emails contain items that should 
have triggered filters but did not.  I am on IMail 8.15 and Declude 
2.06. Here is a header of an email where the numbers dont add to the 
score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead 
shows 30 My global.cfg has the following entries for the tests that 
were triggered SUBJECTSPACES7 subjectspaces 7   x 5 0

SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 
0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.

X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, 
weight 30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) 
for spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, 
SPAMCHK, GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com 
([69.89.85.90]). ---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "un

Re: [Declude.JunkMail] This doesnt add up

[Todd]

I should have been clearer.  They show up in the headers of the emails where 
they are triggered.  Here is an example that again does not add up (30 + 
35 - 15 - 15 + 10 = 45) to the weight of 75 Declude has given it.


FIVETENSRC ip4r blackholes.five-ten-sg.com 127.0.0.2 30 
0


SORBS-DUL ip4r dnsbl.sorbs.net 127.0.0.10 35 0

NOLEGITCONTENT nolegitcontent x x 0 -15

IPNOTINMX ipnotinmx x x 0 -15

SPFUNKNOWN spf unknown x 0 0

COUNTRYFILTER filter d:\imail\declude\filters\countryfilter.txt 
x 0 0 ( weight 10 in filter)


CATCHALLMAILS catchallmails x x 0 0






--

Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net
 (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500
Received: from fxi.com ([84.220.55.194])
by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id 
M2006040314252611030

for ; Mon, 03 Apr 2006 14:25:27 -0500
Message-ID: <[EMAIL PROTECTED]>
Reply-To: "Liviu Gaeth" <[EMAIL PROTECTED]>
From: "Liviu Gaeth" <[EMAIL PROTECTED]>
To: todd
Subject: see new
Date: Mon, 3 Apr 2006 15:23:36 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_0001_01C65732.93DB6C50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-mxGuard-Info: Processed by net.smart-mail.net using mxGuard v1.5.0
X-mxGuard-Spool-ID: 767d01e101566616
X-mxGuard-Sender: [EMAIL PROTECTED]
X-mxGuard-Spam-Score: 0
X-Note: This message has been scanned for spam and viruses using mxGuard for 
IMail

X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com.
X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential 
spam source listed in SORBS-DUL.
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail 
detected.

X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, 
weight 10)

X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75.
X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, 
SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75]

X-Note: Total spam weight of this E-mail is 75 .
X-Country-Chain: ITALY->UNITED STATES->destination
X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it 
([84.220.55.194]).

X-RCPT-TO: 
Status: U
X-UIDL: 400264161

--


- Original Message - 
From: "David Barker" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:44 PM
Subject: RE: [Declude.JunkMail] This doesnt add up



Todd,

I do not see them in the headers ?

X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:56 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] This doesnt add up

Thanks David,  both of these tests are not hidden and show up in the
headers.

Todd


- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up



To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests,
check your global.cfg you should see the -5

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:22 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] This doesnt add up


A lot of spam has been getting through lately and at first I was thinking
my
Declude needed some tweaking.  I am seeing some funny stuff though.  I
find
emails where emails contain items that should have triggered filters but
did
not.  I am on IMail 8.15 and Declude 2.06.

Here is a header of an email where the numbers dont add to the score.  It
should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30

My global.cfg has the following entries for the tests that were triggered

SUBJECTSPACES7   subjectspaces 7   x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0


X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight
30)
X-Declude-Sender: [EMAIL PROTECTED] [

RE: [Declude.JunkMail] This doesnt add up

[IS - Systems Eng. \(Karl Drugge\)]

I've been seeing this for weeks. I reported it, and I believe they are
working on a fix.

Sometimes Declude doesn't put ANYTHING in the headers. Kind of hard to
figure out why something got through in the meantime, though..

Karl Drugge
 
 
 
 
 
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Wednesday, April 05, 2006 1:44 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] This doesnt add up

Todd,

I do not see them in the headers ?

X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:56 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] This doesnt add up

Thanks David,  both of these tests are not hidden and show up in the
headers.

Todd


- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up


> To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden
tests,
> check your global.cfg you should see the -5
>
> David B
> www.declude.com
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Todd
> Sent: Wednesday, April 05, 2006 12:22 PM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] This doesnt add up
>
>
> A lot of spam has been getting through lately and at first I was
thinking 
> my
> Declude needed some tweaking.  I am seeing some funny stuff though.  I

> find
> emails where emails contain items that should have triggered filters
but 
> did
> not.  I am on IMail 8.15 and Declude 2.06.
>
> Here is a header of an email where the numbers dont add to the score.
It
> should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30
>
> My global.cfg has the following entries for the tests that were
triggered
>
> SUBJECTSPACES7   subjectspaces 7   x 5 0
> SUBJECTSPACES10 subjectspaces 10 x 15 0
> SPFPASSspf pass   x 0
0
>
>
> X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
> X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
> X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
> X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
> X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463,
weight
> 30)
> X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
> X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for
> spam.
> X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS,
SPAMCHK,
> GIBBERISH, CATCHALLMAILS [30]
> X-Note: Total spam weight of this E-mail is 30 .
> X-Country-Chain: UNITED STATES->destination
> X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
--
PLEASE NOTE : Florida has a very broad public records law. Most written
communications to or from City officials regarding City business are
public records available to the public and media upon request. Your
E-mail communications may be subject to public disclosure.
PLEASE NOTE : Florida has a very broad public records law. Most written 
communications to or from City officials regarding City business are public 
records available to the public and media upon request. Your E-mail 
communications may be subject to public disclosure.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Todd]

Here is another one.  Spamcheck reports a weight of 90 but Declude only 
gives it a weight of 55.  This is the same reduction of 35 points as on the 
other email.  I have looked through my global.cfg and all my filters for any 
line containing a weight of -35 that might cause the reduction but I do not 
see any.  The only tests in my global.cfg with negative weights are 
BONDEDSENDER  -50,  IPNOTINMX -15,   NOLEGITCONTENT  -15, and none of them 
are triggered here.


--

Received: from host167-139.discord.birch.net [192.168.1.19] by 
net.smart-mail.net

 (SMTPD32-8.15) id A4BB3D2A00C8; Wed, 15 Mar 2006 11:54:03 -0600
X-Bulk:  100
Received: from blue.dnsireland.com ([207.44.154.5])
by host167-139.discord.birch.net (SMSSMTP 4.0.0.59) with SMTP id 
M2006031511535223753

for ; Wed, 15 Mar 2006 11:53:53 -0600
Received: from nobody by blue.dnsireland.com with local (Exim 4.52)
id 1FJaC1-0002Q5-0t
for todd; Wed, 15 Mar 2006 17:53:53 +
To: todd
Subject: Verify your Chase.com account activity
From: Chase Banking <[EMAIL PROTECTED]>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[EMAIL PROTECTED]>
Date: Wed, 15 Mar 2006 17:53:53 +
X-AntiAbuse: This header was added to track abuse, please include it with 
any abuse report

X-AntiAbuse: Primary Hostname - blue.dnsireland.com
X-AntiAbuse: Original Domain - smart-mail.net
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - blue.dnsireland.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-mxGuard-Info: Processed by net.smart-mail.net using mxGuard v1.5.0
X-mxGuard-Spool-ID: 54bb3d2a00c86f8f
X-mxGuard-Sender: [EMAIL PROTECTED]
X-mxGuard-Spam-Score: 0
X-Note: This message has been scanned for spam and viruses using mxGuard for 
IMail

X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 90.
X-RBL-Warning: NAVGATEWAYHEADER: Message failed NAVGATEWAYHEADER test (line 
1, weight 0)

X-Declude-Sender: [EMAIL PROTECTED] [207.44.154.5]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: SPFUNKNOWN, SPAMCHK, NAVGATEWAYHEADER, CATCHALLMAILS 
[55]

X-Note: Total spam weight of this E-mail is 55 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from blue.dnsireland.com ([207.44.154.5]).
X-RCPT-TO: 
Status: R
X-UIDL: 400263651






- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:21 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



Todd,
Can you post your gibberish, spamchk, and spfpass lines from your 
global.cfg as well.

Darrell
Todd writes:
04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file 
d:\imail\declude\filters\navsmtpspam.txt.txt.

04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK
04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: 
SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN 
GIBBERISH=WARN CATCHALLMAILS=IGNORE
04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this 
email = IGNORE WARN  [LAST ACTION=WARN] - Original Message -  
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:30 AM
Subject: Re: [Declude.JunkMail] This doesnt add up


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Hijack Question

[Dean Lawrence]

Hi Nick,
 
Thanks for your input. I didn't see anything related to ALLOWADDR in the manual, are there other commands available?
 
Thanks,
 
Dean 
On 4/5/06, Nick Hayer <[EMAIL PROTECTED]> wrote:
Hi Dean -Dean Lawrence wrote:>> First, what thresholds are most of you using, that causes minimal
> screaming phone calls from client? 8-)RELAYTHRESHOLD11020RELAYTHRESHOLD23040>> Secondly, how are you handling non-fixed IP users that may send large> (over the thresholds), but not absorbent amounts of mail?
ALLOWADDR[EMAIL PROTECTED]-Nick---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to 
[EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.
-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists 

RE: [Declude.JunkMail] This doesnt add up

[David Barker]

Todd,

I do not see them in the headers ?

X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:56 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] This doesnt add up

Thanks David,  both of these tests are not hidden and show up in the
headers.

Todd


- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up


> To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests,
> check your global.cfg you should see the -5
>
> David B
> www.declude.com
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Todd
> Sent: Wednesday, April 05, 2006 12:22 PM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] This doesnt add up
>
>
> A lot of spam has been getting through lately and at first I was thinking 
> my
> Declude needed some tweaking.  I am seeing some funny stuff though.  I 
> find
> emails where emails contain items that should have triggered filters but 
> did
> not.  I am on IMail 8.15 and Declude 2.06.
>
> Here is a header of an email where the numbers dont add to the score.  It
> should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30
>
> My global.cfg has the following entries for the tests that were triggered
>
> SUBJECTSPACES7   subjectspaces 7   x 5 0
> SUBJECTSPACES10 subjectspaces 10 x 15 0
> SPFPASSspf pass   x 0 0
>
>
> X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
> X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
> X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
> X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
> X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight
> 30)
> X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
> X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
> spam.
> X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
> GIBBERISH, CATCHALLMAILS [30]
> X-Note: Total spam weight of this E-mail is 30 .
> X-Country-Chain: UNITED STATES->destination
> X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Todd]

I recently changed the Gibberish weight from 30 to 40.

SPFPASS spf pass x 0 0

GIBBERISH filter d:\imail\declude\filters\gibberish.txt x 40 
0


SPAMCHK external weight "d:\imail\declude\spamchk\spamchk.exe"






- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 12:21 PM
Subject: Re: [Declude.JunkMail] This doesnt add up



Todd,
Can you post your gibberish, spamchk, and spfpass lines from your 
global.cfg as well.

Darrell
Todd writes:
04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file 
d:\imail\declude\filters\navsmtpspam.txt.txt.

04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK
04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: 
SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN 
GIBBERISH=WARN CATCHALLMAILS=IGNORE
04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this 
email = IGNORE WARN  [LAST ACTION=WARN] - Original Message -  
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:30 AM
Subject: Re: [Declude.JunkMail] This doesnt add up

Todd,
We would really need to see the Declude log entries for that message to 
better determine the issue.  Can you post that message entry.

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes:


A lot of spam has been getting through lately and at first I was 
thinking my Declude needed some tweaking.  I am seeing some funny stuff 
though.  I find emails where emails contain items that should have 
triggered filters but did not.  I am on IMail 8.15 and Declude 2.06. 
Here is a header of an email where the numbers dont add to the score. 
It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 
30 My global.cfg has the following entries for the tests that were 
triggered SUBJECTSPACES7 subjectspaces 7   x 5 0

SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0 
X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.

X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, 
weight 30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) 
for spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, 
GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Darrell \([EMAIL PROTECTED])]

Todd, 

Can you post your gibberish, spamchk, and spfpass lines from your global.cfg 
as well. 

Darrell 

Todd writes: 

04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file 
d:\imail\declude\filters\navsmtpspam.txt.txt.

04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK
04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: 
SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN 
GIBBERISH=WARN CATCHALLMAILS=IGNORE
04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this 
email = IGNORE WARN  [LAST ACTION=WARN] 

 

- Original Message - From: "Darrell 
([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:30 AM
Subject: Re: [Declude.JunkMail] This doesnt add up 




Todd,
We would really need to see the Declude log entries for that message to 
better determine the issue.  Can you post that message entry.

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers. 


Todd writes:


A lot of spam has been getting through lately and at first I was 
thinking my Declude needed some tweaking.  I am seeing some funny stuff 
though.  I find emails where emails contain items that should have 
triggered filters but did not.  I am on IMail 8.15 and Declude 2.06. 
Here is a header of an email where the numbers dont add to the score.  
It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 
My global.cfg has the following entries for the tests that were 
triggered SUBJECTSPACES7 subjectspaces 7   x 5 0

SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0 
X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.

X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, 
weight 30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) 
for spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, 
GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
Check out http://www.invariantsystems.com for utilities for Declude, Imail, 
mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, SURBL/URI 
integration, MRTG Integration, and Log Parsers.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] This doesnt add up

[John Carter]

Todd

Check for the possibility of tests that were PASSED, which would also reduce
the score.  "X-Spam-Tests-Failed" will only show those test FAILED.  I went
through this some time back and had to run DEBUG mode for a while to
understand it.

John C

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 11:56 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] This doesnt add up

Thanks David,  both of these tests are not hidden and show up in the
headers.

Todd


- Original Message -
From: "David Barker" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up


> To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests,
> check your global.cfg you should see the -5
>
> David B
> www.declude.com
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Todd
> Sent: Wednesday, April 05, 2006 12:22 PM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] This doesnt add up
>
>
> A lot of spam has been getting through lately and at first I was thinking 
> my
> Declude needed some tweaking.  I am seeing some funny stuff though.  I 
> find
> emails where emails contain items that should have triggered filters but 
> did
> not.  I am on IMail 8.15 and Declude 2.06.
>
> Here is a header of an email where the numbers dont add to the score.  It
> should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30
>
> My global.cfg has the following entries for the tests that were triggered
>
> SUBJECTSPACES7   subjectspaces 7   x 5 0
> SUBJECTSPACES10 subjectspaces 10 x 15 0
> SPFPASSspf pass   x 0 0
>
>
> X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
> X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
> X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
> X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
> X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight
> 30)
> X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
> X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
> spam.
> X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
> GIBBERISH, CATCHALLMAILS [30]
> X-Note: Total spam weight of this E-mail is 30 .
> X-Country-Chain: UNITED STATES->destination
> X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).
>
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Todd]

Thanks David,  both of these tests are not hidden and show up in the 
headers.


Todd


- Original Message - 
From: "David Barker" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up



To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests,
check your global.cfg you should see the -5

David B
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:22 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] This doesnt add up


A lot of spam has been getting through lately and at first I was thinking 
my
Declude needed some tweaking.  I am seeing some funny stuff though.  I 
find
emails where emails contain items that should have triggered filters but 
did

not.  I am on IMail 8.15 and Declude 2.06.

Here is a header of an email where the numbers dont add to the score.  It
should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30

My global.cfg has the following entries for the tests that were triggered

SUBJECTSPACES7   subjectspaces 7   x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0


X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight
30)
X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]
X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Todd]

04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file 
d:\imail\declude\filters\navsmtpspam.txt.txt.

04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK
04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: 
SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN 
GIBBERISH=WARN CATCHALLMAILS=IGNORE
04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this 
email = IGNORE WARN  [LAST ACTION=WARN]




- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 11:30 AM
Subject: Re: [Declude.JunkMail] This doesnt add up



Todd,
We would really need to see the Declude log entries for that message to 
better determine the issue.  Can you post that message entry.

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.


Todd writes:


A lot of spam has been getting through lately and at first I was thinking 
my Declude needed some tweaking.  I am seeing some funny stuff though.  I 
find emails where emails contain items that should have triggered filters 
but did not.  I am on IMail 8.15 and Declude 2.06. Here is a header of an 
email where the numbers dont add to the score.  It should have had a 
score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the 
following entries for the tests that were triggered SUBJECTSPACES7 
subjectspaces 7   x 5 0

SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0 
X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.

X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 
30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, 
GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How to stop these?

[Darrell \([EMAIL PROTECTED])]

Todd, 

The best key on those messages is the URI that is listed in it.  They are 
listed in the common URIBL's.  I have seen that domain being picked up for 
the last couple days with our URI tool (invURIBL). 


masakel . com.multi.surbl.org. 900 IN A   127.0.0.118
masakel . com.multi.uribl.com. 900 IN A   127.0.0.2 


Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude and 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers. 



Todd writes: 



And ideas on how I would stop these from getting through. 

Thanks, 


Todd Hunter
Smart Mail 

-- 
 



Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net
 (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500
Received: from fxi.com ([84.220.55.194])
by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id 
M2006040314252611030

for ; Mon, 03 Apr 2006 14:25:27 -0500
Message-ID: <[EMAIL PROTECTED]>
Reply-To: "Liviu Gaeth" <[EMAIL PROTECTED]>
From: "Liviu Gaeth" <[EMAIL PROTECTED]>
To: todd
Subject: see new
Date: Mon, 3 Apr 2006 15:23:36 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_0001_01C65732.93DB6C50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com.
X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential 
spam source listed in SORBS-DUL.
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail 
detected.

X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, 
weight 10)

X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75.
X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, 
SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75]

X-Note: Total spam weight of this E-mail is 75 .
X-Country-Chain: ITALY->UNITED STATES->destination
X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it 
([84.220.55.194]).

X-RCPT-TO: 
Status: U
X-UIDL: 400264161 

This is a multi-part message in MIME format. 


--=_NextPart_000_0001_01C65732.93DB6C50
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable 


Get ready in 15 minutes - CtALtS SOFT Tabs go to the site
=20 


--=_NextPart_000_0001_01C65732.93DB6C50
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable 









Get ready in 15 minutes - CtALtS SOFT =
Tabs http://menih933.masakel.com";>go to the =
site
--=_NextPart_000_0001_01C65732.93DB6C50-- 

 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] This doesnt add up

[David Barker]

To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests,
check your global.cfg you should see the -5

David B
www.declude.com 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:22 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] This doesnt add up


A lot of spam has been getting through lately and at first I was thinking my
Declude needed some tweaking.  I am seeing some funny stuff though.  I find
emails where emails contain items that should have triggered filters but did
not.  I am on IMail 8.15 and Declude 2.06.

Here is a header of an email where the numbers dont add to the score.  It
should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30

My global.cfg has the following entries for the tests that were triggered

SUBJECTSPACES7   subjectspaces 7   x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0


X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight
30)
X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]
X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).



---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] How to stop these?

[Scott Fisher]

You could use something like Message Sniffer or a URI filter like INVURIBL.

I also add weight for it the reverse dns from a dsl line.

You might also run the reverse dns against the mailpolice dynamic black 
list:

MAILPOLICE-REVDNS dnsbl   %REVDNS%.dynamic.rhs.mailpolice.com 127.0.0.2 0 0


- Original Message - 
From: "Todd" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, April 05, 2006 10:47 AM
Subject: [Declude.JunkMail] How to stop these?




And ideas on how I would stop these from getting through.

Thanks,

Todd Hunter
Smart Mail

--


Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net
 (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500
Received: from fxi.com ([84.220.55.194])
by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id 
M2006040314252611030

for ; Mon, 03 Apr 2006 14:25:27 -0500
Message-ID: <[EMAIL PROTECTED]>
Reply-To: "Liviu Gaeth" <[EMAIL PROTECTED]>
From: "Liviu Gaeth" <[EMAIL PROTECTED]>
To: todd
Subject: see new
Date: Mon, 3 Apr 2006 15:23:36 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_0001_01C65732.93DB6C50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com.
X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential 
spam source listed in SORBS-DUL.
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail 
detected.

X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, 
weight 10)

X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75.
X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, 
SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75]

X-Note: Total spam weight of this E-mail is 75 .
X-Country-Chain: ITALY->UNITED STATES->destination
X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it 
([84.220.55.194]).

X-RCPT-TO: 
Status: U
X-UIDL: 400264161

This is a multi-part message in MIME format.

--=_NextPart_000_0001_01C65732.93DB6C50
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Get ready in 15 minutes - CtALtS SOFT Tabs go to the site
=20

--=_NextPart_000_0001_01C65732.93DB6C50
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable








Get ready in 15 minutes - CtALtS SOFT =
Tabs http://menih933.masakel.com";>go to the =
site
--=_NextPart_000_0001_01C65732.93DB6C50--



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude 4.1 Is Out

[Kevin Bilbee]

I send a request to support on Monday and they said they were waiting for
the notes from development. It supprises me that it takes so long. Not many
people are going to update until the release notes are available.


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Jay Sudowski -
> Handy Networks LLC
> Sent: Wednesday, April 05, 2006 9:22 AM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] Declude 4.1 Is Out
>
>
> Release notes still are not updated.  Guess I will never know what else
> is new/fixed in Declude 4.1
>
> -Jay
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski -
> Handy Networks LLC
> Sent: Monday, April 03, 2006 4:45 PM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] Declude 4.1 Is Out
>
> http://www.declude.com/Articles.asp?ID=186
>
> Aside from the web admin, are there any other fixes or feature
> enhancements?  The release notes reference 4.0.9.4 ...
>
> Thanks!
> -
> Jay Sudowski // Handy Networks LLC
> Director of Technical Operations
> Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003
> Hosting Solutions
> Tel: 877-70 HANDY x882 |  Fax: 888-300-2FAX
> www.handynetworks.com
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] This doesnt add up

[Darrell \([EMAIL PROTECTED])]

Todd, 

We would really need to see the Declude log entries for that message to 
better determine the issue.  Can you post that message entry. 

Darrell 


---
Check out http://www.invariantsystems.com for utilities for Declude, Imail, 
mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, SURBL/URI 
integration, MRTG Integration, and Log Parsers. 



Todd writes: 



A lot of spam has been getting through lately and at first I was thinking 
my Declude needed some tweaking.  I am seeing some funny stuff though.  I 
find emails where emails contain items that should have triggered filters 
but did not.  I am on IMail 8.15 and Declude 2.06. 

Here is a header of an email where the numbers dont add to the score.  It 
should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 

My global.cfg has the following entries for the tests that were triggered 


SUBJECTSPACES7   subjectspaces 7   x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0 



X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 
30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, 
GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). 

 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] This doesnt add up

[Todd]

A lot of spam has been getting through lately and at first I was thinking my 
Declude needed some tweaking.  I am seeing some funny stuff though.  I find 
emails where emails contain items that should have triggered filters but did 
not.  I am on IMail 8.15 and Declude 2.06.


Here is a header of an email where the numbers dont add to the score.  It 
should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30


My global.cfg has the following entries for the tests that were triggered

SUBJECTSPACES7   subjectspaces 7   x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASSspf pass   x 0 0


X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 
30)

X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, 
GIBBERISH, CATCHALLMAILS [30]

X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude 4.1 Is Out

[Jay Sudowski - Handy Networks LLC]

Release notes still are not updated.  Guess I will never know what else
is new/fixed in Declude 4.1

-Jay

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski -
Handy Networks LLC
Sent: Monday, April 03, 2006 4:45 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Declude 4.1 Is Out

http://www.declude.com/Articles.asp?ID=186

Aside from the web admin, are there any other fixes or feature
enhancements?  The release notes reference 4.0.9.4 ...

Thanks!
-
Jay Sudowski // Handy Networks LLC
Director of Technical Operations
Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003
Hosting Solutions
Tel: 877-70 HANDY x882 |  Fax: 888-300-2FAX
www.handynetworks.com

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] How to stop these?

[Todd]

And ideas on how I would stop these from getting through.

Thanks,

Todd Hunter
Smart Mail

--


Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net
 (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500
Received: from fxi.com ([84.220.55.194])
by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id 
M2006040314252611030

for ; Mon, 03 Apr 2006 14:25:27 -0500
Message-ID: <[EMAIL PROTECTED]>
Reply-To: "Liviu Gaeth" <[EMAIL PROTECTED]>
From: "Liviu Gaeth" <[EMAIL PROTECTED]>
To: todd
Subject: see new
Date: Mon, 3 Apr 2006 15:23:36 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_0001_01C65732.93DB6C50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com.
X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential 
spam source listed in SORBS-DUL.
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail 
detected.

X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, 
weight 10)

X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75.
X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.
X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, 
SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75]

X-Note: Total spam weight of this E-mail is 75 .
X-Country-Chain: ITALY->UNITED STATES->destination
X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it 
([84.220.55.194]).

X-RCPT-TO: 
Status: U
X-UIDL: 400264161

This is a multi-part message in MIME format.

--=_NextPart_000_0001_01C65732.93DB6C50
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Get ready in 15 minutes - CtALtS SOFT Tabs go to the site
=20

--=_NextPart_000_0001_01C65732.93DB6C50
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable








Get ready in 15 minutes - CtALtS SOFT =
Tabs http://menih933.masakel.com";>go to the =
site
--=_NextPart_000_0001_01C65732.93DB6C50--



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Live Web Log Analyzer

[Colbeck, Andrew]

It's off-topic for this off-topic thread, but Google Analytics at

http://www.google.com/analytics/

is pretty nifty for non-ISP purposes. To get it working though, you need
to edit every page your want to report on with a bit of javascript which
phones home to Google; it doesn't work by analyzing your web logs.

Andrew 8)


> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
> Sent: Tuesday, April 04, 2006 9:26 AM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] OT: Live Web Log Analyzer
> 
> Hi,
> 
> I've been running LiveStats ISP, but it's been terribly buggy 
> for larger sites (not to speak of the fact, that its database 
> columns are too small to deal with "high" volume sites - 
> e.g., you can have more than 204 GB bandwidth in any given 
> period, such as weekly or monthly).  Now they don't even 
> respond to requests to update me on the status of my reported problems
> - while the system has been down for 2 weeks due to a 
> reproducible failure.
> 
> Webtrends has never been "shining" either, with respect to 
> stability and/or support.
> 
> I do need an IIS web log analyzer that:
> 
> A) offers ad-hoc ('live') reporting
> 
> B) uses a database structure that does not limit volume 
> (e.g., a JET database won't do). 
> 
> What is everyone else out there using?
> 
> Best Regards
> Andy Schmidt
> 
> Phone:  +1 201 934-3414 x20 (Business)
> Fax:+1 201 934-9206 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Hijack Question

[Nick Hayer]

Hi Dean -

Dean Lawrence wrote:

 
First, what thresholds are most of you using, that causes minimal 
screaming phone calls from client? 8-)


RELAYTHRESHOLD11020
RELAYTHRESHOLD23040

 
Secondly, how are you handling non-fixed IP users that may send large 
(over the thresholds), but not absorbent amounts of mail?


ALLOWADDR[EMAIL PROTECTED]

-Nick
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Hijack Question

[Dean Lawrence]

Hi All,
 
I've run Junkmail and EVA Pro products for the past couple of years, but not Hijack. I'm a little confused with the docs though and just want to make sure that I am reading them correctly. With Hijack, there is no per domain and per user configuration, correct? The only way to opt-out someone from being affected by it is by whitelisting their IP, right?

 
If that is the case, I have 2 questions:
 
First, what thresholds are most of you using, that causes minimal screaming phone calls from client? 8-)
 
Secondly, how are you handling non-fixed IP users that may send large (over the thresholds), but not absorbent amounts of mail?
 
Thanks,
 
Dean-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/Corporate Internet Development and Marketing Specialists 

RE: [Declude.JunkMail] SPAMHEADERS question - more confusion

[David Barker]

Hi Dan,

I am not sure that there is a list of codes. I think the codes are generated
and then decoded by the headers page. It is a tool that Scott Perry wrote so
I am not that familiar with it I would have to look into it further.

David B
www.declude.com 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan
Sent: Tuesday, April 04, 2006 8:40 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

David,

Pardon the delayed reply, but I'm curious, how many possible codes are there
and is there a comprehensive inventory or list anywhere?

Thanks,
Dan



On Feb 24, 2006, at 5:56, David Barker wrote:

> You can add the following to your global.cfg file under your headers
> section:
>
> XINHEADER X-Declude-Code: %HEADERCODE%
>
> This will produce a code and you can check it on this web page which 
> will explain to you what problem(s) exist with headers that cause E- 
> mails to fail the BADHEADERS or SPAMHEADERS tests in Declude JunkMail.
>
> http://www.declude.com/tools/header.php
>
> David B
> www.declude.com
> 
>
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Orin Wells
> Sent: Friday, February 24, 2006 3:05 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion
>
>
> Thanks Matt.  I don't spend as much time as some of you folks have 
> spent on both iMail and Declude so there is more than a little bit I 
> still have to learn.
>
> I misread your first response and got off on the wrong track by 
> thinking you had said the message-id header WAS inserted by the mail 
> client.  In re-reading you clearly said it was done by iMail.  OK, I 
> know what to do now.
>
> At 10:47 PM 2/23/2006, Matt wrote:
>
>
>   Outlook does not add a Message-ID header.  The difference between 
> these two messages is that the first is one that is using your server 
> as it's SMTP server and you are scanning the message as it came 
> directly from the E-mail client, while the second example is one that 
> passed through another server before coming to yours.  IMail, like 
> most every E-mail
> server, adds a Message-ID header when one isn't already there.   
> Declude
> detects Message-ID headers inserted by your own IMail box (Message-Id:
> <[EMAIL PROTECTED]> in the first example), and treats the 
> message as if it didn't have one since it didn't actually have one 
> when it was received, and this is what triggers SPAMHEADERS for this 
> message.  The
> second example had a Message-ID header before it hit your server.   
> That
> header was inserted by Charter's server.
>   
>   There is a lesser known solution to this that you definitely should 
> add if you are going to stay on IMail 7.07.  You can add 
> "LOOSENSPAMHEADERS ON" to your Global.cfg to disable the Message-ID 
> test in SPAMHEADERS.  I use this even though I don't have the same 
> issue because I get a lot more false positives on SPAMHEADERS when it 
> checks for the Message-ID.  If you use this alternative switch, you 
> will still get other hits such as CMDSPACE and BADHEADERS on some of 
> the same E-mail clients.  It appears that you aren't using CMDSPACE 
> though because that test would hit every directly connecting Outlook 
> client unless it was whitelisted.  CMDSPACE is a great test, 
> especially in combination with other tests that target zombie spam 
> (XBL/CBL, SpamCop, open relay tests, and to some extent Sniffer).
>   
>   The best solution is to upgrade to IMail 8.x or higher and add a 
> setting to your Global.cfg for "WHITELIST AUTH".  This will whitelist 
> all authenticated E-mail, which I assume included the first example 
> that you provided.  This also saves processing power since WHITELIST 
> AUTH disables most tests in JunkMail.
>   
>   Matt
>   
>   
>   
>   
>   
>   Orin Wells wrote:
>   
>
>   Clearly I am missing something here.  I am still wrestling
> with the SPAMHEADERS issue but with a different sender.  This time the
> sender is using Microsoft Office Outlook.  It appears messages  
> coming from
> this sender do not have the Message-ID header.  But when I look at  
> other
> messages sent by others using the same build of this application  
> sometimes
> they DO have the Message-ID.  What is happening here?  Is there  
> anyway that
> this sender can "fix" this problem?
>   
>   Here is a header set from the chap who is "failing"
>   
>   X-Persona: 
>   Received: from steve2 [216.254.57.135] by consejo-wa.org
> with ESMTP
> (SMTPD32-7.07) id A9111EEB010C; Thu, 23 Feb 2006 14:37:05
> -0800
>   Reply-To: <[EMAIL PROTECTED]>
> 
>   From: "Steve Chupik" <[EMAIL PROTECTED]>
> 
>   To: "'Orin Wells'" 

Re: [Declude.JunkMail] Sorry, have to share

[Nick Hayer]

Actually the grammar reminds me of Matt   :)

-Nick

John Carter wrote:


I know some of you have seen such before, but the text below is the most
extreme (useless) attempt to get around filters I've seen.  It looks like
something my son would text message.  


LOL
John

Your c a redi z t doesn't matter to us ! lf you O n WN real e O st 6 at x e
and want IMMED beIA when TE c 8 ash to spen 7 d ANY way you like, or simply
wish to L b OWER your monthIy pa F f yment S s by a third or more, here are
the de x als we have T U ODbe AY (puke)nbsp;
 u
$ 40 u 4,000 at a 3, 5 36% f q ixed - rat 3 e $ 37 6 3,000 at a 3, B 00%
vari 2 able - rat hi e $ 4 ok 93,000 at a 3, O 4 24% intere u st - onl z y $
2 e 44,000 at a 3,3 G 3% fi oh xed - rat V e $ 1 uh 96,000 at a 3 def ,52%
varia N ble - ra bi te 
 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Sorry, have to share

[Darrell \([EMAIL PROTECTED])]

Yet, it still amazes me that someone out there will respond to that spam 
thus making it worth the senders wild to keep on spamming. 


Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude, 
SmarterMail, and Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI 
integration, MRTG Integration, and Log Parsers. 

John Carter writes: 


I know some of you have seen such before, but the text below is the most
extreme (useless) attempt to get around filters I've seen.  It looks like
something my son would text message.   


LOL
John 


Your c a redi z t doesn't matter to us ! lf you O n WN real e O st 6 at x e
and want IMMED beIA when TE c 8 ash to spen 7 d ANY way you like, or simply
wish to L b OWER your monthIy pa F f yment S s by a third or more, here are
the de x als we have T U ODbe AY (puke)nbsp;
  u
$ 40 u 4,000 at a 3, 5 36% f q ixed - rat 3 e $ 37 6 3,000 at a 3, B 00%
vari 2 able - rat hi e $ 4 ok 93,000 at a 3, O 4 24% intere u st - onl z y $
2 e 44,000 at a 3,3 G 3% fi oh xed - rat V e $ 1 uh 96,000 at a 3 def ,52%
varia N ble - ra bi te 
   


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Sorry, have to share

[John Carter]

I know some of you have seen such before, but the text below is the most
extreme (useless) attempt to get around filters I've seen.  It looks like
something my son would text message.  

LOL
John

Your c a redi z t doesn't matter to us ! lf you O n WN real e O st 6 at x e
and want IMMED beIA when TE c 8 ash to spen 7 d ANY way you like, or simply
wish to L b OWER your monthIy pa F f yment S s by a third or more, here are
the de x als we have T U ODbe AY (puke)nbsp;
  u
$ 40 u 4,000 at a 3, 5 36% f q ixed - rat 3 e $ 37 6 3,000 at a 3, B 00%
vari 2 able - rat hi e $ 4 ok 93,000 at a 3, O 4 24% intere u st - onl z y $
2 e 44,000 at a 3,3 G 3% fi oh xed - rat V e $ 1 uh 96,000 at a 3 def ,52%
varia N ble - ra bi te 
  

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMHEADERS question - more confusion

[Dean Lawrence]

Actually, those variable codes are listed at the bottom of the online manual.
 
Dean 
On 4/4/06, Scott Fisher <[EMAIL PROTECTED]> wrote:
I doubt you'll get a list. I imagine this is proprietary information forDeclude.- Original Message -
From: "Dan" <[EMAIL PROTECTED]>To: Sent: Tuesday, April 04, 2006 7:40 PM
Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion> David,>> Pardon the delayed reply, but I'm curious, how many possible codes  are> there and is there a comprehensive inventory or list anywhere?
>> Thanks,> Dan On Feb 24, 2006, at 5:56, David Barker wrote:>>> You can add the following to your global.cfg file under your headers>> section:
 XINHEADER X-Declude-Code: %HEADERCODE% This will produce a code and you can check it on this web page  which>> will>> explain to you what problem(s) exist with headers that cause E- mails to
>> fail>> the BADHEADERS or SPAMHEADERS tests in Declude JunkMail. http://www.declude.com/tools/header.php David B
>> www.declude.com>>  From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED]] On Behalf Of Orin Wells>> Sent: Friday, February 24, 2006 3:05 AM>> To: 
Declude.JunkMail@declude.com>> Subject: Re: [Declude.JunkMail] SPAMHEADERS question - more confusion>> Thanks Matt.  I don't spend as much time as some of you folks have  spent
>> on>> both iMail and Declude so there is more than a little bit I still  have>> to>> learn. I misread your first response and got off on the wrong track by  thinking
>> you>> had said the message-id header WAS inserted by the mail client.  In>> re-reading you clearly said it was done by iMail.  OK, I know what  to do>> now. At 10:47 PM 2/23/2006, Matt wrote:
>> Outlook does not add a Message-ID header.  The difference between>> these two messages is that the first is one that is using your  server as>> it's SMTP server and you are scanning the message as it came  directly
>> from>> the E-mail client, while the second example is one that passed through>> another server before coming to yours.  IMail, like most every E-mail>> server, adds a Message-ID header when one isn't already there.   Declude
>> detects Message-ID headers inserted by your own IMail box (Message-Id:>> <[EMAIL PROTECTED]> in the first example), and treats the>> message as if it didn't have one since it didn't actually have one  when
>> it>> was received, and this is what triggers SPAMHEADERS for this  message.>> The>> second example had a Message-ID header before it hit your server.   That>> header was inserted by Charter's server.
 There is a lesser known solution to this that you definitely should>> add if you are going to stay on IMail 7.07.  You can add>> "LOOSENSPAMHEADERS>> ON" to your 
Global.cfg to disable the Message-ID test in  SPAMHEADERS.  I>> use>> this even though I don't have the same issue because I get a lot  more>> false>> positives on SPAMHEADERS when it checks for the Message-ID.  If you  use
>> this>> alternative switch, you will still get other hits such as CMDSPACE and>> BADHEADERS on some of the same E-mail clients.  It appears that you>> aren't>> using CMDSPACE though because that test would hit every directly
>> connecting>> Outlook client unless it was whitelisted.  CMDSPACE is a great test,>> especially in combination with other tests that target zombie spam>> (XBL/CBL,>> SpamCop, open relay tests, and to some extent Sniffer).
 The best solution is to upgrade to IMail 8.x or higher and add a>> setting to your Global.cfg for "WHITELIST AUTH".  This will  whitelist>> all>> authenticated E-mail, which I assume included the first example  that you
>> provided.  This also saves processing power since WHITELIST AUTH>> disables>> most tests in JunkMail. Matt>>
>> Orin Wells wrote: Clearly I am missing something here.  I am still wrestling>> with the SPAMHEADERS issue but with a different sender.  This time the>> sender is using Microsoft Office Outlook.  It appears messages  coming
>> from>> this sender do not have the Message-ID header.  But when I look at  other>> messages sent by others using the same build of this application>> sometimes>> they DO have the Message-ID.  What is happening here?  Is there  anyway
>> that>> this sender can "fix" this problem? Here is a header set from the chap who is "failing" X-Persona: >> Received: from steve2 [
216.254.57.135] by consejo-wa.org>> with ESMTP>>   (SMTPD32-7.07) id A9111EEB010C; Thu, 23 Feb 2006 14:37:05>> -0800
>> Reply-To: <[EMAIL PROTECTED]>>> [EMAIL PROTECTED]>>> From: "Steve Chupik" <
[EMAIL PROTECTED]>>> [EMAIL PROTECTED]>>> To: "'Orin Wells'" <
[EMAIL PROTECTED]>>> [EMAIL PROTECTED]>>> Subject: RE: e-mail>> Date: Thu, 23 Feb 2006 14:36:49 -0800>> Organization: Consejo Counseling
>> MIME-Version: 1.0>> Content-Type: multipart/alternative; boundary="=_NextPart_000_03BE_01C63886.9616AF40">> X-Mailer: Microsoft Office Outlook, Build 
11

Re: [Declude.JunkMail] ARIN Unlisted

[Mike Nice]

It means that it wasn't in Declude's local country list database on your 
server.   The IP in question was registered on 30-Jan-2006 so you'll need to 
contact Declude for an update.


- Original Message - 
From: "Gary Steiner" <[EMAIL PROTECTED]>

To: 
Sent: Tuesday, April 04, 2006 10:14 PM
Subject: [Declude.JunkMail] ARIN Unlisted


I received a spam from 209.200.224.192 which Declude reported as

X-Country-Chain: [ARIN Unlisted]->destination

I went to www.arin.net and did a whois, and 209.200.224.192 came up as a 
typical US company.  What is ARIN unlisted?


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.