RE: [Declude.JunkMail] SPF vs. Form Mail
Scott, I just wanted to post and let you know that I started a website www.adminforums.com and have added a Declude and Imail section, so that this community can post their configurations without wasting list bandwidth. I for one am interested in seeing what is working for people. I would really like to see some of the test configurations that Declude runs itself...hint ...hint -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, December 19, 2003 9:16 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPF vs. Form Mail This is kind of a response to all the follow ups this morning. I can't afford to use this test on the majority of my domains because I can't currently make use of WHITELIST AUTH, and I have enough customers that use third-party outgoing mail servers for one reason or another that this would cause issues there as well. It seems that a lot of people don't really understand the full power of SPF. Most people assume it is pass/fail, but it is actuall pass/fail/unknown. What this means is that you can set up an SPF record that instead of saying E-mail from @example.com that comes from 192.0.2.25 is definitely legitimate, but everything else is bogus (v=spf1 +ip4:192.0.2.25 -all), you can say E-mail from @example.com that +comes from 192.0.2.25 is definitely legitimate, but any E-mail from @example.com from other IPs may or may not be bogus (v=spf1 +ip4:192.0.2.25 ?all). This is *guaranteed* to give you better results than no SPF record, even if many of your users do not send mail directly through your mailserver. I was already debating what to do with a spamdomains variant that was coded for local domains, and I was only scoring that at 20% of my fail weight. I could remove that test and replace it with SPF scored at 20%, however the effects of the SPF would carry over to other sources that would potentially have problems and over which I would have no control over. But that's exactly the point -- you have no control over it! If we set up declude.com as v=spf1 +mx -all, and I send an E-mail from another IP and it gets caught on your server, that is *my* fault (or the fault of whoever authorized the SPF record for declude.com). In this case, if one of your users says But my friend with a competing ISP can get mail from Scott!, you can tell him But, the company Scott works for does not allow mail to be sent except from their servers. Often, you get stuck telling a customer That company has serious problems (open relay, no reverse DNS, etc.). But with SPF, it is company policy, which you are honoring. There is some potential with this as a negative weight test, however once the spammers catch on, the value would be diminished greatly, and of course legit mail servers are sources of spam, just not as often as the illegitimate ones, and I don't see the need to credit senders based only on the fact that they matched their SPF records. ... Considering these issues, I don't see why I should push something forward with such a flaw. This might be best discussed on the SPF mailing list, where the creator of SPF and others can better comment on how SPF will deal with this. Only time will tell if spammers will be able to successfully abuse SPF, but at the very least it will give them more work to do, costing them more money. I'm very sorry to have not liked either this effort or the Web-O-Trust thing, and I don't want to sound like I'm just being critical for the sake of it (though sometimes I am overly critical), but I feel that it is constructive for me to say this if for no other reason than to warn others about the potential of issues, but hopefully rather to influence the process for the better. I'm sure there are others around here that feel the same way, but choose not to voice their opinions out of fear of insulting someone else...or maybe I'm just whacked :) That's fine -- if there are flaws with an idea and nobody comes out and says it, everybody loses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Public DJM Config Files
I would be interested in having a mirror, we have plenty of horsepower to spare! Aaron [EMAIL PROTECTED] www.vantech.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Thursday, December 18, 2003 11:01 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Public DJM Config Files Hi; It would be great John.. What would be even greater is a site and mirrors that can host filters from everyone who is willing to share them. This way the network traffic on a single site is reduced. I think that can add a lot of value to Declude and reduce coming online by those that start using it much shorter. Out filter files are updated four times a day and if we can create a network of such sites and mirror sites.. Stopping a spam, a hoax or a scam can be done much faster among the group. One major suggestion: If filters are shared - I really think no negative filters should be shared. Negative words and filters getting in the hands of our beloved spammer would hurt everyone. But that is just my 2 cents. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, December 18, 2003 1:44 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Public DJM Config Files FYI to all: I am going ahead with my idea of hosting a site where people can post their files and others can read them. It would have FTP capabilities for use with scripts and such. Unfortunately, the flu has invaded my house and so things are behind right now. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Burzin Sumariwalla Sent: Thursday, December 18, 2003 10:12 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Public DJM Config Files I don't mind doing so, but I don't want to clog the list with config files. I have sent them off list upon request. Burzin At 05:44 PM 12/17/2003, you wrote: Hello, All, Is there anyone on this list besides Kami who makes their Declude JunkMail files publically viewable as he does? Just curious. I'm always looking for new ideas. Thanks, Much! Dan Geiser [EMAIL PROTECTED] - -- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Custom ASP for Declude Pro?
I would love to find some as well! -- Thanks, Aaron mailto:[EMAIL PROTECTED] VanTech.Net www.vantech.net Phone 559.732.3952 Fax 559.732.1509 6707 W. Goshen Avenue Visalia, CA 93291 Monday, September 23, 2002, 3:00:32 PM, you wrote: ZW Does anyone have custom .asp code to allow customers to set some of their ZW own Declude pro settings? ZW Thank you, ZW Zachery Wolfinger ZW Director of IT/IS - Galaxy Holdings, Inc. ZW 888-758-3910 ZW [EMAIL PROTECTED] ZW ICQ#: 28221108 ZW --- ZW Outgoing mail is certified Virus Free. ZW Checked by AVG anti-virus system (http://www.grisoft.com). ZW Version: 6.0.391 / Virus Database: 222 - Release Date: 9/19/2002 ZW --- ZW [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] ZW --- ZW This E-mail came from the Declude.JunkMail mailing list. To ZW unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ZW type unsubscribe Declude.JunkMail. The archives can be found ZW at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Allowing all sites through
Scott, I think this will solve a problem I'm having but is I have another one now... ;) Here is my dilemma; I have 3 weighted tests. WEIGHT10 is warn WEIGHT20 Adds Text to the subject line WEIGHT30 Deletes the e-mail Now even when I whitelist FROM @company.com it can still get the text added to the subject line. Does this make sense? I need it so that if its whitelisted from @company.com their e-mails won't even be scanned... Is this possible? Thanks, Aaron Caviglia -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, July 23, 2002 7:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Allowing all sites through I have one domain that does not want to use the spam filtering...how do I allow just one of the virtual domains on the email server to not use the spam filtering...seems like I heard on this group to just make a domain folder for them and not include the global.cfg fileis this correct? Actually, there is now an easier way with the latest release (1.53) -- you can add a line WHITELIST TODOMAIN @example.com, which will whitelist all E-mail to the @example.com domain. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] High CPU Usage
Not only that, but what traffic are you seeing and what is your hardware? Aaron Caviglia [EMAIL PROTECTED] - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, May 06, 2002 9:37 AM Subject: Re: [Declude.JunkMail] High CPU Usage I am seeing a really high CPU usage for Declude. Anywhere between 35 - 55 % utilization. Is this normal? Is there tuning for Declude to reduce this usage (turning off logging, IGNORE instead of WARN in default junkmail file). Thanks. I am running NT 4.0, Declude 1.46, and Imail 6.06. The CPU usage you are seeing seems very high (unless you are using the DEBUG mode, which could account for high CPU usage). How long does the high CPU usage last? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] consensus
Kevin, I have about 100 users so far and roughly 3000 emails per day. Declude JunkMail catches about 50% of those 1500 e-mails. Rarely do I get a false positive, maybe once every two weeks and then its easy enough to fix. As far as declude goes, its been one of the best companies I have EVER made a purchase from. If every company stood behind their product like declude I would be a very happy man. Part of the reason I stay with IMail and IPSwitch is because of declude. Lets face it IPSwitch is not all that responsive! But Scott and Declude are the best! My 2 cents worth! Aaron Caviglia -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Crawford Sent: Saturday, April 27, 2002 3:14 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] consensus Hello - I have taken my credit card out of my wallet two or three times now, headed to buy declude junkmail - on the fence so to speak. I know how well declude works for AV - and I am very impressed with Scott as a helpful and courteous individual - and he seems real smart too - lots of knowledge on the workings of mail etc I am trying to drum up support (funds) for it from a few of my business customers. I would like some reviews if possible - what kind of kill rate some of you get without paying some of the db's services out there - just using the free stuff. Cold hard percentages would be good. I am using imgate at the moment, but the ability to just mark spam would be so much better than deleting it - and weighting sounds immensely better that pass or fail on one test, then on to the next. I have gone down to only blocking open relays (since no reason exists to have one - and if you are legit, you shouldn't want one anyway) Also, what kind of performance hits do you take - sorry to break in on such a quiet day - thanks Kevin --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
