RE: [Declude.JunkMail] OT: Yahoo delivery problems [451 Deffered]
Just found this: http://help.yahoo.com/help/us/mail/defer/defer-06.html William Stillwell Systems Architect Professional Staffing-ABTS,Inc. D/B/A Able Body Labor Clearwater, FL wk.727.724.2610 fx.727.724.2680 cl.727.638.6208 DISCLAIMER - This message may contain confidential, proprietary or legally privileged information and is intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby informed that you must not use, disseminate, copy it in any form or take any action in reliance on it. If you have received this message in error please delete it and any copies of it and notify it to the sender. AVISO LEGAL - Este mensaje puede contener información confidencial, propietaria o legalmente protegida y esta dirigida únicamente para el uso de la persona nombrada destinaria arriba. Si usted no es la persona indicada como destinaria de este mensaje, esta notificado que no debe usar, difundir, copiar de ninguna forma, ni tomar ninguna acción con respecto al mensaje. Si usted ha recibido este mensaje por equivocación, por favor borre el mensaje y todas copias del mensaje y notifique al remitente. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, November 02, 2006 11:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo delivery problems Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude and Imail 2006
Title: Declude and Imail 2006 Some say they work fine, others say they don't. Declude's official position is that you have to have 3.x or 4.x for IMail 8.2x or 2006.x Darin. - Original Message - From: Sharyn Schmidt To: declude.junkmail@declude.com Cc: Declude.Virus@declude.com Sent: Wednesday, November 08, 2006 8:08 AM Subject: [Declude.JunkMail] Declude and Imail 2006 Hi, We are getting ready to upgrade to Imail 2006. I am wondering if my older version of declude virus and junkmail (2.0.6) will work with Imail 2006? Thanks, Sharyn ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude and Imail 2006
Title: Message Some say they work fine, others say they don't. Declude's official position is that you have to have 3.x or 4.x for IMail 8.2x or 2006.x Thanks, Darin. I have a current Declude Service Agreement. Does this allow me to upgrade to 4.x? Is anyone using 4.x and Imail 2006.x? Any comments on it? Thanks, Sharyn ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] blocking GIF attachments again ...
You call that a downside -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, November 08, 2006 12:00 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blocking GIF attachments again ... If you are not an ISP get the commtouch ZEROHOUR addin. It will block most of the GIF attachments. The only downside I have noticed is it will also trap the chain emails that users love to send to each other. We added it and I removed some of my less productive tests from declude. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Dodell Sent: Tuesday, November 07, 2006 9:06 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] blocking GIF attachments again ... A few days ago I posted an inquiry asking if there was a way to block GIF attachments ... and several readers discouraged this since GIF could be part of HTML email. However, today noticed at least 10 to 15 spam messages that got through all the tests, that basically were GIF attachments. IF I block GIF attachments in Declude Virus, will this still allow HTML included GIF's to pass through? Or is there a better way to test for attachments that are GIF to solve this problem? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Re: blocking GIF attachments again ...
-Original Message-From: "Kevin Bilbee" [EMAIL PROTECTED]If you are not an ISP get the commtouch ZEROHOUR addin. It will block mostof the GIF attachments. The only downside I have noticed is it will alsotrap the chain emails that users love to send to each other.-Kevin, I can block GIF attachments with Declude Virus too. I just didn't know if there was a downside to doing this? ie does HTML mail embeed GIF's, or are they attachments too?David ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Re: blocking GIF attachments again ...
Yes, if you block GIF attachments in Declude Virus, if a HTML email as embedded GIFs, that email will be blocked. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Dodell Sent: Wednesday, November 08, 2006 7:47 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Re: blocking GIF attachments again ... -Original Message- From: Kevin Bilbee [EMAIL PROTECTED] If you are not an ISP get the commtouch ZEROHOUR addin. It will block most of the GIF attachments. The only downside I have noticed is it will also trap the chain emails that users love to send to each other. - Kevin, I can block GIF attachments with Declude Virus too. I just didn't know if there was a downside to doing this? ie does HTML mail embeed GIF's, or are they attachments too? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] declude not modifying subject line
Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the tests are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are only as defect as the other guys. Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in the first place. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 01, 2006 10:02 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, I need to clarify something here. This source of this problem is that these messages do not conform to the RFC's and are extremely broken and should not be accepted by the mail server in the first place. That is the source of the problem, Declude is showing the symptom. Have you approached SmarterMail/Imail and asked them to fix this issue, either not accept the message or apply message standardization ? What was their response ? With that said, we are working on correcting this problem because clearly the Mail server is not doing it. Secondly, there are alternatives to marking the Subject line and having the mail server take action based on the headers. You could use actions like. # MAILBOX will move the E-mail to a user's folder (no, not a Windows directory) # ROUTETO will re-route the E-mail to an alternate address # HOLD will hold the message in the spool\spam directory. David B --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude not modifying subject line
Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Herb Guenther Sent: Wednesday, November 08, 2006 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the tests are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are only as defect as the other guys. Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in the first place. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 01, 2006 10:02 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, I need to clarify something here. This source of this problem is that these messages do not conform to the RFC's and are extremely broken and should not be accepted by the mail server in the first place. That is the source of the problem, Declude is showing the symptom. Have you approached SmarterMail/Imail and asked them to fix this issue, either not accept the message or apply message standardization ? What was their response ? With that said, we are working on correcting this problem because clearly the Mail server is not doing it. Secondly, there are alternatives to marking the Subject line and having the mail server take action based on the headers. You could use actions like. # MAILBOX will move the E-mail to a user's folder (no, not a Windows directory) # ROUTETO will re-route the E-mail to an alternate address # HOLD will hold the message in the spool\spam directory. David B --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
RE: [Declude.JunkMail] declude not modifying subject line
Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 11:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Herb Guenther Sent: Wednesday, November 08, 2006 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the tests are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are only as defect as the other guys. Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in the first place. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 01, 2006 10:02 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, I need to clarify something here. This source
[Declude.JunkMail] Weighting based on some Imail Tests...?
I'm relatively new to Declude, but have been using Imail and many of its test for quite a while. I'm curious if it is possible to use some of imail's antispam tests (specifically Baysean filter, and url-blacklist) to add weight to declude tests. We have had great results with these two tests and if they were in the weighting systen I think it would help. I'm not sure which part of imail's tests get run before control is passed to declude, but it seems if these are, declude shouldbe able to use them in the weighting system... Is anyone doing anything like this? Or and I off base and duplicating something that declude already offers...? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weighting based on some Imail Tests...?
You can get much of the Bayesian filtering results from Sniffer, and Sniffer and invURIBL can be used to filter based on urls in the content. These are external tests, to cover functionality not built into Declude. Darin. - Original Message - From: Jim Comerford [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 1:10 PM Subject: [Declude.JunkMail] Weighting based on some Imail Tests...? I'm relatively new to Declude, but have been using Imail and many of its test for quite a while. I'm curious if it is possible to use some of imail's antispam tests (specifically Baysean filter, and url-blacklist) to add weight to declude tests. We have had great results with these two tests and if they were in the weighting systen I think it would help. I'm not sure which part of imail's tests get run before control is passed to declude, but it seems if these are, declude shouldbe able to use them in the weighting system... Is anyone doing anything like this? Or and I off base and duplicating something that declude already offers...? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] whitelisting based on rev dns
How can I whitelist based on Reverse DNS? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.com ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] declude not modifying subject line
Andy Schmidt wrote: I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Well said Andy. I completely agree. Bill Green dfn Systems --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisting based on rev dns
How about negative weighting instead of whitelisting. If you want to do it selectively, you can create a quick Declude filter that you give a high negative weight to, and only include the domains that you want to pass through based on having REVDNS entries. Darin. - Original Message - From: Craig Edmonds To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 1:24 PM Subject: [Declude.JunkMail] whitelisting based on rev dns How can I whitelist based on Reverse DNS? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.com ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] declude not modifying subject line
Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 11:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Herb Guenther Sent: Wednesday, November 08, 2006 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the tests are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are only as defect as the other guys. Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in
RE: [Declude.JunkMail] whitelisting based on rev dns
Craig, I don't use any of the Declude WHITELIST features due to the potential for giving the sender carte blanche access; if a known good sender is sending crap, I still want to have a chance to block the crap. What I do is counterweight. I create a filter file called, say, CounterWeight.txt and in the global.cfg I give it zero weight for passing or failing. Inside the filter file, I put in lines like this: #Feb-01-2006 AC SurveyMonkey.com MAILFROM spoofs the email address of whomever is sending out the survey invitationsREMOTEIP -10 CIDR 66.179.50.160/27REVDNS -5 ENDSWITH .surveymonkey.com My preference is to use REMOTEIP tests, then REVDNS, then HELO, then HEADERS, then MAILFROM for reliablityand antispoofedness. Likewise, they get decending amounts of negative weight. Another tip: I put a test at the top of my CounterWeight file(s) that aborts processing if I don't want to reward a message with negative weight, such as if a prior filter test (according to the top-down order in global.cfg) of mine detected a known virus or junk email that I know I want to block regardless of whom it came from, e.g. TESTSFAILED END CONTAINS VIRUSBOUNCE TESTSFAILED END CONTAINS COMBOSNIFFER Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig EdmondsSent: Wednesday, November 08, 2006 10:25 AMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] whitelisting based on rev dnsImportance: HighSensitivity: Confidential How can I whitelist based on Reverse DNS? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.com ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisting based on rev dns
On Nov 8, 2006, at 1:24 PM, Craig Edmonds wrote: How can I whitelist based on Reverse DNS? Create a filter with lines like REVDNS xxx ENDSWITH .abcdefghi.com where xxx is weight to apply. Xxx could be a very high number to cause the message to be deleted or it could be a negative number. In my revdns spam filter I also have the following lines at the top to save processor usage SKIPIFWEIGHT xx STOPATFIRSTHIT If the message's weight already exceeds xx the filter will be skipped. Later, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
Which is what we want to do. I changed my configs and instead of routing to a mailbox, am holding. The only real reason I wanted to separate was because searhing through a mailbox was a PIA. I downloaded the trial of fpReview as suggested by John and will try that (so far it looks like a great utility!). Thanks! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, November 07, 2006 6:19 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Help with Configuration Unless, as some prefer, you want to mark the subject in addition to holding. In that case, the old weight statements fit perfectly instead of the newer weightrange. Darin. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, November 07, 2006 2:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Look at using weightrange instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude not modifying subject line
Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 11:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Herb Guenther Sent: Wednesday, November 08, 2006 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the tests are broken, and I cannot find samples of the config files. Can you tell me where they are, and
Re: [Declude.JunkMail] Weighting based on some Imail Tests...?
Jim, It depends on the Imail test -Some are processed before Declude. I am not exactly sure which ones run before Declude as I do not use any of the Imail tests. Processing Order for IMail Both IMail and Declude have a number of different tests that they run on email. The order used is as follows: 1.. IMail's Control Access file (to block IPs) 2.. IMail's Kill List (to block return addresses) 3.. IMail v8 anti-spam (most tests) 4.. Declude Virus 5.. Declude Hijack 6.. Declude JunkMail 7.. IMail's filters and extra IMail v8 anti-spam tests Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Jim Comerford [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 1:10 PM Subject: [Declude.JunkMail] Weighting based on some Imail Tests...? I'm relatively new to Declude, but have been using Imail and many of its test for quite a while. I'm curious if it is possible to use some of imail's antispam tests (specifically Baysean filter, and url-blacklist) to add weight to declude tests. We have had great results with these two tests and if they were in the weighting systen I think it would help. I'm not sure which part of imail's tests get run before control is passed to declude, but it seems if these are, declude shouldbe able to use them in the weighting system... Is anyone doing anything like this? Or and I off base and duplicating something that declude already offers...? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisting based on rev dns
Craig Edmonds wrote: How can I whitelist based on Reverse DNS? REMOTEIP WHITELIST CIDR 64.4.240.0/20 REVDNS WHITELIST ENDSWITH .paypal.com etc... -Nick Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisting based on rev dns
Absolutely, WHITELIST REVDNS .declude.com You can alsocan create your own RDNSBL zone in your DNS server (that's what I did) and create one for SPF domains that spammers set up to reliably reject mail based on reverse DNS (thank you for them adhering to SPF!). Then you set up a WhiteList zone for known "good" reverse DNS, which you use to subtract weight or combine with a filter to whitelist outright. Best RegardsAndy SchmidtPhone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig EdmondsSent: Wednesday, November 08, 2006 01:25 PMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] whitelisting based on rev dnsImportance: HighSensitivity: Confidential How can I whitelist based on Reverse DNS? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.com ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Weighting based on some Imail Tests...?
The traditional answer on this is that IMail does not mark up the header until after Declude returns control of the message to it, so therefore, Declude can not leverage any of the tests that IMail does. That does not stop you from using any of the IMail features though if you want to think of them as separate layers. I'd suggest that the blacklist tests at least are best run in Declude only. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, November 08, 2006 11:10 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Weighting based on some Imail Tests...? Jim, It depends on the Imail test -Some are processed before Declude. I am not exactly sure which ones run before Declude as I do not use any of the Imail tests. Processing Order for IMail Both IMail and Declude have a number of different tests that they run on email. The order used is as follows: 1.. IMail's Control Access file (to block IPs) 2.. IMail's Kill List (to block return addresses) 3.. IMail v8 anti-spam (most tests) 4.. Declude Virus 5.. Declude Hijack 6.. Declude JunkMail 7.. IMail's filters and extra IMail v8 anti-spam tests Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Jim Comerford [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 1:10 PM Subject: [Declude.JunkMail] Weighting based on some Imail Tests...? I'm relatively new to Declude, but have been using Imail and many of its test for quite a while. I'm curious if it is possible to use some of imail's antispam tests (specifically Baysean filter, and url-blacklist) to add weight to declude tests. We have had great results with these two tests and if they were in the weighting systen I think it would help. I'm not sure which part of imail's tests get run before control is passed to declude, but it seems if these are, declude shouldbe able to use them in the weighting system... Is anyone doing anything like this? Or and I off base and duplicating something that declude already offers...? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] may skip - 1
Could anyone tell me why these test would be skipped? Thanks, Kevin 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #0: WHITLEIST [FROM] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #1: AHBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #2: BLITZEDALL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #3: CBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #4: DSBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #5: ORDB [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #6: SBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #7: SORBS-HTTP [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #8: SORBS-SOCKS [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #9: SORBS-MISC [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #10: SORBS-SMTP [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #11: SORBS-SPAM [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #12: SORBS-WEB [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #13: SORBS-BLOCK [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #14: SORBS-ZOMBIE [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #15: SORBS-DUHL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #16: SPAMCOP [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #17: CHINA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #18: KOREA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #19: BRAZIL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #20: ARGENTINA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #21: HONGKONG [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #22: JAPAN [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #23: MALAYSIA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #24: NIGERIA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #25: RUSSIA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #26: SINGAPORE [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #27: TAIWAN [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #28: THAILAND [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #29: SPAMHAUS [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #30: DSN [rhsbl] - may skip-1 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] may skip - 1
Was it whitelisted in a previous test? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Kevin Stanford [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 3:39 PM Subject: [Declude.JunkMail] may skip - 1 Could anyone tell me why these test would be skipped? Thanks, Kevin 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #0: WHITLEIST [FROM] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #1: AHBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #2: BLITZEDALL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #3: CBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #4: DSBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #5: ORDB [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #6: SBL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #7: SORBS-HTTP [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #8: SORBS-SOCKS [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #9: SORBS-MISC [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #10: SORBS-SMTP [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #11: SORBS-SPAM [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #12: SORBS-WEB [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #13: SORBS-BLOCK [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #14: SORBS-ZOMBIE [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #15: SORBS-DUHL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #16: SPAMCOP [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #17: CHINA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #18: KOREA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #19: BRAZIL [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #20: ARGENTINA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #21: HONGKONG [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #22: JAPAN [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #23: MALAYSIA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #24: NIGERIA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #25: RUSSIA [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #26: SINGAPORE [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #27: TAIWAN [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #28: THAILAND [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #29: SPAMHAUS [ip4r] - may skip-1 11/08/2006 11:37:07.874 Q15c3521000fc8cbd Test #30: DSN [rhsbl] - may skip-1 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisting based on rev dns
Is the Reverse DNS in the headers anywhere? I've just been going out to DNSReports.com and pulling it for the ones I want to add. Easier way? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Evanitsky Sent: Wednesday, November 08, 2006 12:56 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] whitelisting based on rev dns Importance: High On Nov 8, 2006, at 1:24 PM, Craig Edmonds wrote: How can I whitelist based on Reverse DNS? Create a filter with lines like REVDNS xxx ENDSWITH .abcdefghi.com where xxx is weight to apply. Xxx could be a very high number to cause the message to be deleted or it could be a negative number. In my revdns spam filter I also have the following lines at the top to save processor usage SKIPIFWEIGHT xx STOPATFIRSTHIT If the message's weight already exceeds xx the filter will be skipped. Later, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] may skip - 1
Did not have it whitelisted. That is what is so strange. I turned on the declude log in debug mode and here is the top of the log. If anyones sees something I am missing please let me know. I see a log of these may skip - 1 on spams. Kevin 11/08/2006 11:37:07.733 Q15c3521000fc8cbd Setting DNS server to IMail's 10.100.1.7. 11/08/2006 11:37:07.733 Q15c3521000fc8cbd Declude JunkMail Standard Version Registered 11/08/2006 11:37:07.733 Q15c3521000fc8cbd Start 11/08/2006 11:37:07.733 Q15c3521000fc8cbd Locked d:\IMail\spool\Q15c3521000fc8cbd.SMD. 11/08/2006 11:37:07.733 Q15c3521000fc8cbd Getting message envelope 11/08/2006 11:37:07.733 Q15c3521000fc8cbd [EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Qd:\IMail\spool\D15c3521000fc8cbd.SMD 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Hmail.stevenstransport.com 11/08/2006 11:37:07.749 Q15c3521000fc8cbd I15c3521000fc8cbd 11/08/2006 11:37:07.749 Q15c3521000fc8cbd X1 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Wd:\IMail 11/08/2006 11:37:07.749 Q15c3521000fc8cbd E0, 11/08/2006 11:37:07.749 Q15c3521000fc8cbd R[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Recip: R[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting altaddr 0 to [EMAIL PROTECTED] [addr=copyall_account]. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd S[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd NRCPT TO:[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Recip: NRCPT TO:[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd R[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Recip: R[EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting altaddr 1 to [EMAIL PROTECTED] [EMAIL PROTECTED] 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting reciphost to stevenstransport.com 11/08/2006 11:37:07.749 Q15c3521000fc8cbd 11/08/2006 11:37:07.749 Q15c3521000fc8cbd nRecips: 2 (1 RCPT TO lines) 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Starting locality check (sender=bayou.com; nr=2 ca=on). 11/08/2006 11:37:07.749 Q15c3521000fc8cbd CL Opening HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains 11/08/2006 11:37:07.749 Q15c3521000fc8cbd copyall_account [0] is local domain2 11/08/2006 11:37:07.749 Q15c3521000fc8cbd [EMAIL PROTECTED] [1] is local domain2 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Recip 0: copyall_account = [EMAIL PROTECTED] Flags=1 [copyall_account-stevenstransport.com]. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Recip 1: [EMAIL PROTECTED] = [EMAIL PROTECTED] Flags=1 [stevenstransport.com-mail.stevenstransport.com]. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Done getting message envelope 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Getting headers 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Done getting envelope and headers 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Ver=20 verflag=0 11/08/2006 11:37:07.749 Q15c3521000fc8cbd About to run spam tests 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Going through datafile 11/08/2006 11:37:07.749 Q15c3521000fc8cbd LOOKING FOR IP: Received: from imail.stevenstransport.pv 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting [IPTEXT] to 10.100.1.17 11/08/2006 11:37:07.749 Q15c3521000fc8cbd iptext now=10.100.1.17 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Testing IP 10.100.1.17 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Skipping local IP address 10.100.1.17 for country data. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Handling Received: header 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Got IP 10.100.1.17 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting remote IP address to 10.100.1.17 11/08/2006 11:37:07.749 Q15c3521000fc8cbd revdns: Private IP 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Hop 0: Bypassing IP address 10.100.1.17. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd LOOKING FOR IP: Received: From webshield.stevenstranspor 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting [IPTEXT] to 10.100.1.21 11/08/2006 11:37:07.749 Q15c3521000fc8cbd iptext now=10.100.1.21 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Testing IP 10.100.1.21 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Skipping local IP address 10.100.1.21 for country data. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Handling Received: header 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Got IP 10.100.1.21 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting remote IP address to 10.100.1.21 11/08/2006 11:37:07.749 Q15c3521000fc8cbd revdns: Private IP 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Hop 0: Checking IP Address 10.100.1.21. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd iptext=10.100.1.21 myip1=a640115 i=4 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Hop 0: Bypassing ip4r test for local IP Address 10.100.1.21. 11/08/2006 11:37:07.749 Q15c3521000fc8cbd LOOKING FOR IP: Received: From localhost.localdomain ([6 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Setting [IPTEXT] to 62.34.3.235 11/08/2006 11:37:07.749 Q15c3521000fc8cbd iptext now=62.34.3.235 11/08/2006 11:37:07.749 Q15c3521000fc8cbd Testing IP 62.34.3.235 11/08/2006 11:37:07.749 Q15c3521000fc8cbd SPAMROUTING processing
RE: [Declude.JunkMail] declude not modifying subject line
1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 11:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B
Re: [Declude.JunkMail] whitelisting based on rev dns
Todd, As you know headers can be forged so its always best to manually look-up the IP. As you said earlier you are using fpReview. In the headers view you can right click and select resolve ip's to hostnames to get the reverse dns. Than after that you can highlight any of the text and automatically create a revdns entry in a filter. We have a quick overview video showing the basic features at http://www.invariantsystems.com/fpreview/screencaptures.htm under video. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 4:13 PM Subject: RE: [Declude.JunkMail] whitelisting based on rev dns Is the Reverse DNS in the headers anywhere? I've just been going out to DNSReports.com and pulling it for the ones I want to add. Easier way? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Evanitsky Sent: Wednesday, November 08, 2006 12:56 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] whitelisting based on rev dns Importance: High On Nov 8, 2006, at 1:24 PM, Craig Edmonds wrote: How can I whitelist based on Reverse DNS? Create a filter with lines like REVDNS xxx ENDSWITH .abcdefghi.com where xxx is weight to apply. Xxx could be a very high number to cause the message to be deleted or it could be a negative number. In my revdns spam filter I also have the following lines at the top to save processor usage SKIPIFWEIGHT xx STOPATFIRSTHIT If the message's weight already exceeds xx the filter will be skipped. Later, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude not modifying subject line
Hi, As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response I never asked them to address it because Imail prepends the Received headers at the top and appends the other headers in the correct spot, as far as I can tell. It's accepting a message, works around the non-standard line feeds and delivers the message. So there's nothing to fix for them, in my opinion. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 04:37 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt
RE: [Declude.JunkMail] whitelisting based on rev dns
Hi Todd, You can configure Declude to add its own header with diagnostic information, including the Reverse DNS, e.g.: XINHEADER X-Declude: Version %VERSION%; Code 0x%HEADERCODE% from %REVDNS% [%REMOTEIP%] XINHEADER X-Declude: Triggered [%WEIGHT%] %TESTSFAILED% XINHEADER X-Countries: %COUNTRYCHAIN% XINHEADER Return-Path: %MAILFROM% Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Wednesday, November 08, 2006 04:13 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] whitelisting based on rev dns Is the Reverse DNS in the headers anywhere? I've just been going out to DNSReports.com and pulling it for the ones I want to add. Easier way? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Evanitsky Sent: Wednesday, November 08, 2006 12:56 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] whitelisting based on rev dns Importance: High On Nov 8, 2006, at 1:24 PM, Craig Edmonds wrote: How can I whitelist based on Reverse DNS? Create a filter with lines like REVDNS xxx ENDSWITH .abcdefghi.com where xxx is weight to apply. Xxx could be a very high number to cause the message to be deleted or it could be a negative number. In my revdns spam filter I also have the following lines at the top to save processor usage SKIPIFWEIGHT xx STOPATFIRSTHIT If the message's weight already exceeds xx the filter will be skipped. Later, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisting based on rev dns
In the header of the message, look at the last IP address in square brackets, this is the IP address of the sending email server. The text just before it is the HELO sent by it, and is often unreliable with legitimate mail, and practically a work of fiction with spam.To get the REVDNS that you can put in your filter files, go to a command prompt and use the name server lookup program with the IP address as the only parameter, e.g.C:\Tempnslookup 63.246.31.248Server: myinternal.DNS.serverAddress: 192.168.0.1Name: smtp.declude.comAddress: 63.246.31.248C:\TempSome admins don't mind the extra overhead, and use the XINHEADERand/or XOUTHEADER feature in their global.cfg to insertvarious lines into the header of every message that contain Declude variables like REVDNS. One common thing that comes up when doing this is that if you use the ALLRECIPS to document in the header who all the recipients are, you've just "blown the cover" on someone who sent a legitimate email with a BCC list of recipients in your domain(s). Don't do that. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Todd Richards Sent: Wednesday, November 08, 2006 1:13 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] whitelisting based on rev dns Is the Reverse DNS in the headers anywhere? I've just been going out to DNSReports.com and pulling it for the ones I want to add. Easier way? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Greg Evanitsky Sent: Wednesday, November 08, 2006 12:56 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] whitelisting based on rev dns Importance: High On Nov 8, 2006, at 1:24 PM, Craig Edmonds wrote: How can I whitelist based on Reverse DNS? Create a filter with lines like REVDNS xxx ENDSWITH .abcdefghi.com where xxx is weight to apply. Xxx could be a very high number to cause the message to be deleted or it could be a negative number. In my revdns spam filter I also have the following lines at the top to save processor usage SKIPIFWEIGHT xx STOPATFIRSTHIT If the message's weight already exceeds xx the filter will be skipped. Later, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] declude not modifying subject line
David -- The problem exists in Interceptor, as well, so a fix from Ipswitch or Smartermail isn't going to solve all of the problems, unfortunately. If it helps at all, every message that is malformed this way is bad, spam scores off the charts. Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 3:37 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 11:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, 1. This is currently being worked on, there are several other things that need to
RE: [Declude.JunkMail] whitelisting based on rev dns
Thanks Darrell. That's a great feature (and I just purchased an fpReview license)! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, November 08, 2006 3:52 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] whitelisting based on rev dns Todd, As you know headers can be forged so its always best to manually look-up the IP. As you said earlier you are using fpReview. In the headers view you can right click and select resolve ip's to hostnames to get the reverse dns. Than after that you can highlight any of the text and automatically create a revdns entry in a filter. We have a quick overview video showing the basic features at http://www.invariantsystems.com/fpreview/screencaptures.htm under video. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 4:13 PM Subject: RE: [Declude.JunkMail] whitelisting based on rev dns Is the Reverse DNS in the headers anywhere? I've just been going out to DNSReports.com and pulling it for the ones I want to add. Easier way? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Evanitsky Sent: Wednesday, November 08, 2006 12:56 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] whitelisting based on rev dns Importance: High On Nov 8, 2006, at 1:24 PM, Craig Edmonds wrote: How can I whitelist based on Reverse DNS? Create a filter with lines like REVDNS xxx ENDSWITH .abcdefghi.com where xxx is weight to apply. Xxx could be a very high number to cause the message to be deleted or it could be a negative number. In my revdns spam filter I also have the following lines at the top to save processor usage SKIPIFWEIGHT xx STOPATFIRSTHIT If the message's weight already exceeds xx the filter will be skipped. Later, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] may skip - 1
Could anyone tell me why these test would be skipped? That's one of the potentially misleading debug log file entries that I added. :) The debug mode was originally designed as a troubleshooting tool for someone with access to the source code, so there are occasionally comments that could be misleading. In this case, I believe the may skip was added to indicate that even though the test was about to be processed, any pass/fail/whitelist results hadn't yet been determined (so the test could be skipped by a whitelist, for example). -Scott --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] may skip - 1
Well hello there stranger! Hope all is well! Darin. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 5:26 PM Subject: Re: [Declude.JunkMail] may skip - 1 Could anyone tell me why these test would be skipped? That's one of the potentially misleading debug log file entries that I added. :) The debug mode was originally designed as a troubleshooting tool for someone with access to the source code, so there are occasionally comments that could be misleading. In this case, I believe the may skip was added to indicate that even though the test was about to be processed, any pass/fail/whitelist results hadn't yet been determined (so the test could be skipped by a whitelist, for example). -Scott --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude not modifying subject line
Rob, Thanks for the info. Yes we know that these messages are most likely always spam, the problem comes in that some admins just tag their subject lines and rely on either rules at the mail server level or client to process the message based on the subject. But with the altered header in the body theses email get through. There is a work around in that one could use a different action. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Wednesday, November 08, 2006 5:22 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line David -- The problem exists in Interceptor, as well, so a fix from Ipswitch or Smartermail isn't going to solve all of the problems, unfortunately. If it helps at all, every message that is malformed this way is bad, spam scores off the charts. Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 3:37 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be
Re: [Declude.JunkMail] declude not modifying subject line
Hi David, How about today's suggestion that you not fix the message, but just interpret all of the variants of CRLF in order to place added headers with the original headers? An additional test would be nice for the weighting system, but just getting the headers where they need to be is the critical issue. I do agree that permanently fixing the issue by rewriting the message is a good thing, and best handled by the mail server, but if we can handle these exceptions and get headers in the right place, a lot of people would be happy. Darin. - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 4:37 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way, Declude can: A) append it's own header at the proper location (not append it below the message body.) B) determining where the message content starts (so that the content can be properly scanned for Viruses) I get the feeling this issue of end-of-line detection is being made overly complicated. Declude is not a message-fixer-upper. I have enough problems with people using CISCO SMTP FIXUP that breaks everything. Declude's job is to correctly determine the header vs. content and then subject the header and content to appropriate analysis. If a message is found to be malformed, then Declude can make it fail a Test so that the mail admin can decide to accept or reject those messages - but it's not Declude's job to artificially make an incompatible message compatible with email clients. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November
RE: [Declude.JunkMail] declude not modifying subject line
Same in SmarterMail. It is interesting when you receive one of these messages to find the Declude header lines at the end of the message, and the one or two header lines that SmarterMail appends (after Declude hands the message back to SmarterMail) right where they should be at the end of the header. SmarterMail knows where the header is even after Declude has processed the message. Maybe Declude should be talking to SmarterMail to find out how they know where the header is in these malformed messages. Gary Original Message From: Andy Schmidt [EMAIL PROTECTED] Sent: Wednesday, November 08, 2006 5:12 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi, As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response I never asked them to address it because Imail prepends the Received headers at the top and appends the other headers in the correct spot, as far as I can tell. It's accepting a message, works around the non-standard line feeds and delivers the message. So there's nothing to fix for them, in my opinion. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 04:37 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way,
RE: [Declude.JunkMail] declude not modifying subject line
I do not understand why you need to rewrite the message beyond what you already do? Just determine the end of headers properly then rewrite the message with your headers in the proper location. You already rewrite the message when adding headers so why would it take any longer to properly detect the end of headers. If you have two LF sequences next to each other ignoring the CR then you have the end of headers. For example if you have CRLFCRLF OR LFCRLFCR OR LFLF I have never seen a message use CR alone for an end of line. There are two LF bytes in each sequence ignore the CR bytes. Then when writing out the message with the Declude headers include the original byte sequences for each line. And the Declude lines should have the proper CRLF sequences. My two cents! Kevin Bilbee 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude not modifying subject line
Hi David; Thanks for the tip on the resource directory, never thought of looking there, altho would be good to restore the link in your KB as well. I would also like to respond to your reply to others in the thread in which you state that it is not productive to have to repeatedly address the same issue. I would respond as a customer by telling you that we spend a significant amount of our time addressing customer complaints. I know that ourselves, and I am sure many others are not in a position to delete email messages, but need to mark them to give users the ability to create and maintain their own filters. So our pain becomes your pain. So, if our customers are getting hammered on this issue every day and every week, and folks want to know why spam that you are identifying is not being marked as spam, I'd sure like to know an elegant answer to give them other than "it doesn't work and is being worked on". I personally get at least 10-20 of these a day, so I get 10 - 20 reminders that I am unhappy. I am not trying to beat up on you or Declude, we have been a customer for many years, and wish to remain so. I'm sure that it will be some work to solve the problem as it is a non trivial task. However, what do you expect us to do, go quietly into the night? There are two ways to stop getting questions on this subject. 1. Fix the problem and get kudos instead of complaints. or 2. Give a real expected date to address the issue and tell us where in the task stack the issue is. The we can either wait or go elsewhere if the timing on the issue is not going to work for us. Last point, on contacting Smartermail in our case, or Imail in other cases. What we would be asking them to do is not deliver messages that they, Outlook, Outlook Express, Thunderbird, and I would guess most every other mail server and email client handle somehow. Non RFC complaint mail is part of the environment, I don't think that that is really the way to go. My goal is not to discourage you, or pick on yourself and Declude, but to get the issue addressed. Wouldn't it be great to cross this item off your list :) Take care, Herb David Barker wrote: Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Herb Guenther Sent: Wednesday, November 08, 2006 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the "tests" are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are "only as defect as the other guys". Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in the first place. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Barker Sent: Wednesday, November 01, 2006 10:02 AM To: declude.junkmail@declude.com Subject: RE:
[Declude.JunkMail] What works for me so far; how can I improve?
Greetings all, I thought I would put this out here as an offering, both to show what is working for me and to leave myself open for feedback on how to improve things. I still hear complaints about receiving spam, but I imagine that will always be the case no matter how I tweak the system. These statistics are for two of my servers (thank you DLAnalyzer): one does only relay mail (via Smarter Mail 3.x) for MS Exchange servers (inbound and outbound) and the other does only POP mail (I-Mail 2006.1) I delete at a weight of 20, and rewrite the subject at 10. If I read the statistics correctly, then out of 433,849 messages inspected, 327,466 were immediately discarded, 47,981 remaining messages had the subject line rewritten leaving 58,402 messages delivered to my users unmolested. Total Messages Processed:433,849 Messages That Failed Defined Test(s):422,264 Percentage That Failed Defined Test(s): 97.33% Average Message Weight: 37 Average Message Weight/Failed: 38 TEST WEIGHT # FAILED PERCENTAGE WEIGHT10 375,44786.54% WEIGHT15 350,00280.67% WEIGHT20 327,46675.48% INV-URIBL 8 197,05345.42% FIVETEN-SRC 7 181,61141.86% CBL 6 168,30338.79% SNIFFER 10 157,71936.35% SORBS-DUHL 6 143,89433.17% SPAMCOP 8 133,21430.71% DYNHELO 5 124,06828.60% MXRATE-BLOCK7 123,99328.58% HELOBOGUS 5 120,92327.87% FROMNOMATCH 3 106,31024.50% UCEPROTECT-18 89,49620.63% REVDNS 10 80,40918.53% UCEPROTECT-32 77,76217.92% UCEPROTECT-27 64,08014.77% NOABUSE 2 57,17713.18% NOPOSTMASTER1 46,74010.77% SUBCHARS-50 3 43,190 9.96% CMDSPACE8 35,655 8.22% DSBL-CONFIRMED 6 29,369 6.77% SUBCHARS-55 3 27,404 6.32% I do a lot more tests (83 total) but those were the top hitters. Thanks for your time and feedback. Michael Cummins --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
