RE: [Declude.JunkMail] custom delivery executable?
Both of your suggestions have merit. Will a program alias execute after iMail has run the message through it's rules? If rules result in the message going to a particular folder, how would that information be preserved in the hand-off to the executable? As for imail1.exe, does anyone know the extent of what that executable does in the stock iMail install? Are rules processed before, after or inside this executable? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From: [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ;Sent: Jun 23, 2005 11:47:35 AMSubject: Re: [Declude.JunkMail] custom delivery executable?Or another thought to try is renaming your custom delivery app to imail1.exe and replacing theirs Althought I am not sure what else this would break. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Darin Cox writes: > You could change all email addresses to be program aliases. The batch file run by the program alias could then dump the message into a text file, or even post the message straight into your database. > > Darin. > > > - Original Message - > From: Chase Seibert > To: Declude.JunkMail@declude.com > Sent: Thursday, June 23, 2005 9:53 AM > Subject: [Declude.JunkMail] custom delivery executable? > > > Hey guys, > > We have a very non-standard iMail/Declude install. Basically, we only us the system for the SMTP protocol, as well as virus and spam filtering. Once a message has passed through those systems, it's delivered to a mailbox as normal. However, we don't allow POP or IMAP access to our systems. Instead, we parse the mailboxes when they change, pull out new mail and insert it into a SQL Server database for access in our web-based CRM. Messed up, huh? > > We are looking to skip the whole step of delivering the mail to a mailbox and then chunking it out. It's not a speed problem, but rather a reliability concern. Our current solution has about a .1% failure rate, meaning that some messages are not delivered until the next message comes along into that folder to knock it out. > > Ok, here is my question. I am wondering if there is some way to setup iMail/Declude so that it delivers a message right to a stand alone file, as apposed to a mailbox Qmail, for example, can do this. I doubt there is any out of the box support for this, so I started investigating using a custom Declude filter for this. > >>From the manual: >> For more flexibility, you can have Declude JunkMail pass parameters to your program, using variables. For example, you can set up the test as 'TESTNAME external returnvalue "filename %INOROUT%"', which would send the %INOROUT% variable as a parameter to your program (which would be "incoming" for an incoming E-mail, or "outgoing" for an outgoing E-mail). > > Presumably, we could write a custom executable and define a rule for it in Junkmail. The custom executable would get the entire message body and just pipe it to a stand-alone file. If the message was later also delivered to an iMail mailbox, that's fine. > > However, I think the issue with that idea is that the filters will not have executed when that custom executable is called. Accoring to the Declude manaul, the order of execution is: > > 1. IMail's Control Access file (to block IPs) > 2. IMail's Kill List (to block return addresses) > 3. IMail v8 anti-spam (most tests) > 4. Declude Virus > 5. Declude Hijack > 6. Declude JunkMail > 7. IMail's filters and extra IMail v8 anti-spam tests > *we want to insert a custom exectuable here > > Is this even possible, or should I just start looking as Linux mail systems? > > > -Chase > Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] custom delivery executable?
Cool, I didn't know about that. But iMail's rules would not be processed in this case, correct? I know, I'm trying to have my cake and eat it too hehe. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Sanford Whiteman [EMAIL PROTECTED] To: "Chase Seibert" ;Sent: Jun 23, 2005 12:45:10 PMSubject: Re: [Declude.JunkMail] custom delivery executable?> Ok, here is my question. I am wondering if there is some way to > setup iMail/Declude so that it delivers a message right to a stand > alone file, as apposed to a mailbox. Using the Declude DAISYCHAIN directive, you can have Declude pipe messages to a custom executable on exit, rather than to IMail's SMTP32. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] custom delivery executable?
Hey guys, We have a very non-standard iMail/Declude install. Basically, we only us the system for the SMTP protocol, as well as virus and spam filtering. Once a message has passed through those systems, it's delivered to a mailbox as normal. However, we don't allow POP or IMAP access to our systems. Instead, we parse the mailboxes when they change, pull out new mail and insert it into a SQL Server database for access in our web-based CRM. Messed up, huh? We are looking to skip the whole step of delivering the mail to a mailbox and then chunking it out. It's not a speed problem, but rather a reliability concern. Our current solution has about a .1% failure rate, meaning that some messages are not delivered until the next message comes along into that folder to knock it out. Ok, here is my question. I am wondering if there is some way to setup iMail/Declude so that it delivers a message right to a stand alone file, as apposed to a mailbox. Qmail, for example, can do this. I doubt there is any out of the box support for this, so I started investigating using a custom Declude filter for this. From the manual: > For more flexibility, you can have Declude JunkMail pass parameters to your program, using variables. For example, you can set up the test as 'TESTNAME external returnvalue "filename %INOROUT%"', which would send the %INOROUT% variable as a parameter to your program (which would be "incoming" for an incoming E-mail, or "outgoing" for an outgoing E-mail). Presumably, we could write a custom executable and define a rule for it in Junkmail. The custom executable would get the entire message body and just pipe it to a stand-alone file. If the message was later also delivered to an iMail mailbox, that's fine. However, I think the issue with that idea is that the filters will not have executed when that custom executable is called. Accoring to the Declude manaul, the order of execution is: 1. IMails Control Access file (to block IPs)2. IMails Kill List (to block return addresses)3. IMail v8 anti-spam (most tests)4. Declude Virus5. Declude Hijack6. Declude JunkMail7. IMail's filters and extra IMail v8 anti-spam tests *we want to insert a custom exectuable here Is this even possible, or should I just start looking as Linux mail systems? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com
[Declude.JunkMail] Which IPs does WHITELIST look at?
I have recently setup a SMTP load balancer, with 3 iMail servers running declude behind it. Previously, I was using WHITELIST IP to whitelist our local IP range. Mail comming from those internal servers (a web-based email front-end) is guarenteed to have been sent by our users. Now, that whitelist rule is causing all mail to get whitelisted, because external mail now also passes through the load balancer. My question is, if I restrict the whitelist to a CIDR range including the web servers but not the load balancer, will the WHITELIST rule look past the last hop to decide whether to let the message through? Example: Webserver 172.16.0.50 originates a messages. Load Balancer 172.16.0.37 relays the message to an iMail server. The hops read 172.16.0.37, then 172.16.0.50 going from the top to the bottom of the header. If I WHITELIST 172.16.0.50, but NOT 172.16.0.37, will the whitelist rule still fire because this IP was somewhere in the header? Or does it only look at last hop? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com
RE: [Declude.JunkMail] Declude performance question
Turned out to be that one of our two DNS servers was down; causing a timeout on many of the requests. That's fixed, and Declude is now performing at about 3-4 messages per second. Much better, and not that far off the throughput with zero spam filtering. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From: [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ;Sent: Mar 21, 2005 11:32:33 AMSubject: RE: [Declude.JunkMail] Declude performance question Any recommendations for Declude add-ins or log readers that might be able to detect the run times of various tests? If I set logging to high would it log runtimes? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Pete McNeil [EMAIL PROTECTED] To: "Chase Seibert" ;Sent: Mar 21, 2005 11:28:50 AMSubject: Re: [Declude.JunkMail] Declude performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase wrote: CS> I need some help tuning Declude for performance. Up until One other thought (pushed send too fast). You may have a test or two in there that is not responding --- causing things to time out and slow things down. If you can find it and drop it things should speed up quite a bit. _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude performance question
Any recommendations for Declude add-ins or log readers that might be able to detect the run times of various tests? If I set logging to high would it log runtimes? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Pete McNeil [EMAIL PROTECTED] To: "Chase Seibert" ;Sent: Mar 21, 2005 11:28:50 AMSubject: Re: [Declude.JunkMail] Declude performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase wrote: CS> I need some help tuning Declude for performance. Up until One other thought (pushed send too fast). You may have a test or two in there that is not responding --- causing things to time out and slow things down. If you can find it and drop it things should speed up quite a bit. _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude performance question
I don' have UCEPROTECRDO, XBL-DYNA, BLKLST-SURBL and HELOISIP. Can you post your definitions for those? Can I get them off the declude website somehow (I couldn't find them)? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Pete McNeil [EMAIL PROTECTED] To: "Chase Seibert" ;Sent: Mar 21, 2005 11:16:28 AMSubject: Re: [Declude.JunkMail] Declude performance questionOn Monday, March 21, 2005, 11:00:49 AM, Chase wrote: CS> Looking at our test list (posted bellow), we likely have WAY too CS> many dns blacklists. That will be the first thing I look at. Any CS> other suggestions? I have had luck running a DNS server (resolver - bind) locally on the IMail box using the loopback address for the primary DNS (127.0.0.1) to speed things up. YMMV Also, take a look at this data to see which tests are performing best and perhaps weed out some of the others: http://www.sortmonster.com/MDLP/MDLP-Example-Long.html Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude performance question
I need some help tuning Declude for performance. Up until now, I have been adding tests mainly for spam filtering effectiveness. But I notice now that the server can process about 7 messages per second with the spam filtering off, versus only about 1-1.5 messages per second with Declude turned on. I suspect the delays are mostly network IO bound; the processors and ram on the boxes are relatively idle. When Declude is disabled, the CPU is pinned between iMail and come custom database insertion services we have. We do about 200,000 inbound messages a day between two servers, so the speed issue really only comes up when mail has queued up for some reason and needs to be de-queued. Looking at our test list (posted bellow), we likely have WAY too many dns blacklists. That will be the first thing I look at. Any other suggestions? I don't think it's any one test, but this is what we have turned on: AHBL WARNBLITZEDALL WARNCBL WARNDSBL WARNORDB WARNSBL WARNSORBS-HTTP WARNSORBS-SOCKS WARNSORBS-MISC WARNSORBS-SMTP WARNSORBS-SPAM WARNSORBS-WEB WARNSORBS-BLOCK WARNSORBS-ZOMBIE WARNSORBS-DUHL WARNSPAMCOP WARN DSN WARNNOABUSE WARNNOPOSTMASTER WARN BADHEADERS WARNBASE64 WARNCMDSPACE WARNCOMMENTS WARNHELOBOGUS WARNIPNOTINMX IGNOREMAILFROM WARNNOLEGITCONTENT IGNOREPERCENT WARNREVDNS WARNROUTING WARNSPAMHEADERS WARN FIVETENSRC WARNspamhaus WARNdsbl WARNnjabl WARNreynolds WARNOrid WARNJamm WARNAHBL WARNsorbs WARNdnsbl-1 WARNdnsbl-2 WARNsurriel WARN SNIFFER WARNINV-URIBL WARN IMAILSTAT WARN -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com
[Declude.JunkMail] list of allowed rcpthosts
Two or three times a week I see reports of internal mail bouncing with the following error: Diagnostic-Code: smtp;553 sorry, that domain isn't in my list of allowed rcpthosts The message always originates from a MS SMTP mail gateway that should pass the message directly off to one of the iMail/Declude servers. I cannot be sure from the message if MS SMTP is trying to pass it off to the correct server, however. Perhaps it messed up the DNS lookup. I'm enabling more logging on that server to find out. In the meantime, assuming that MS SMTP is routing correctly to one of the iMail servers, what might cause this? Domains are not added/removed frequently enought to be related, although I am running the adddomain/adduser executables every time people change their accounts. I have not tracked it down before, because it's never repeatable. If they send the same message right after they get the error; it goes through. It seems to happen to all domains/users. Because it doesn't happen often enough to effect the same user twice, I havn't really had to look into it. I have no Declude rules set to bounce. Users are allowed to set iMail bounce rules, but this error does not seem to indicate that Any ideas? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Dave Doherty [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ;Sent: Jan 13, 2005 01:54:26 PMSubject: Re: Re[2]: [Declude.JunkMail] Unknown error codeHi Sandy- HEADERS -3 CONTAINS Eudora Would seem to work. But can we make it more specific, like MAILER -3 CONTAINS Eudora -d - Original Message - From: "Sanford Whiteman" <[EMAIL PROTECTED]>To: "Dave Doherty" Sent: Thursday, January 13, 2005 11:56 AM Subject: Re[2]: [Declude.JunkMail] Unknown error code >> Is there a way to make an adjustment where the mailer contains >> "Eudora"? > > Sure, write a filter. > >> Or is that even a good idea? > > It's fine, if the only thing you counterweight is one specific > failure. > >> He also says it's an optional header so it shouldn't matter. > > Nonsense. If you're going to include a header, follow the RFCs for its > syntax. Only what Unix partisans call "toy MUAs" (or similar > pejorative) _don't_ include the Message-ID, so that's a flimsy excuse. > >> Maybe you should communicate directly with Len. > > No comment. > > --Sandy > > > > Sanford Whiteman, Chief Technologist > Broadleaf Systems, a division of > Cypress Integrated Systems, Inc. > e-mail: [EMAIL PROTECTED] > > SpamAssassin plugs into Declude! > > http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ > > Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail > Aliases! > > http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ > > http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] external program with quotes.... topic change
I was unaware that someone else had ported SPAMC. I just compiled SPAMD/C using ActivePerl's perl -> exe tools and cygwin. Then I wrote executPipe.exe in C#, which just reads a file and passes it into the stdin of SPAMC. Works great. SPAMD is about 3-4 times faster than the straight non-daemonized version. However, I actually don't use it anymore. Even with those speed increases, it takes 25% of the processor on my dual 3Ghz servers under moderate load (100,000 msgs/day). I plan to offload SPAMD onto another machine at some point in the future, and resume using spamassassin. It's a pretty good filter, and customers love hearing we use it. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Nick [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ;Sent: Jan 11, 2005 10:45:42 AMSubject: RE: [DecludeJunkMail] external program with quotes topic changeOn 11 Jan 2005 at 10:09, Chase Seibert wrote: Hi Chase - Would you elaborate on spamassassin.exe? I use Sandy's SPAMC32.exe utility to run Spamassassin - I am not familiar with the port you appear to be using however - Thanks! -Nick From: Chase Seibert <[EMAIL PROTECTED]>To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] external program with quotes Date sent: 11 Jan 2005 10:09:28 -0500 Send reply to: Declude.JunkMail@declude.com > > > Here is the exact rule I have: > > SPAMASSASSIN external nonzero > "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c > C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 > > This executes executePipe.exe with the argument -a "-e -L" correctly. > > > > -Chase > > Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | > 617.464.2440 x119 | www.bullhorn.com > > > > -Original Message- > From:Matt [EMAIL PROTECTED] > To: "Declude.JunkMail@declude.com" ; > Sent: Jan 11, 2005 10:04:03 AM > Subject: Re: [Declude.JunkMail] external program with quotes... > My experience was that Declude uses the first two sets of quotes, > regardless of switches. There is no special handling for such things. > > Matt > > > > Chase Seibert wrote: > > >Try: > > > > > > > >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe > >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 > >REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 > > > > > >I believe I have a rule that uses \", and it works. > > > > > > > > -Chase > > > >Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | > >617.464.2440 x119 | www.bullhorn.com > > > > > > > >-Original Message- > >From:Scott Fisher [EMAIL PROTECTED] > >To: "Declude.JunkMail@declude.com" ; > >Sent: Jan 11, 2005 09:34:47 AM > >Subject: Re: [Declude.JunkMail] external program with quotes... > > > > > >I agree. But the %REVDNS% variable may contain [No Reverse DNS] which > >contains spaces... > > > >- Original Message - > >From: Kevin Bilbee > >To: Declude.JunkMail@declude.com > >Sent: Monday, January 10, 2005 10:19 PM > >Subject: RE: [Declude.JunkMail] external program with quotes > > > > > > > > > >Reverse dns should never have spaces in it. > > > > > > > >-Original Message- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher > > Sent: Monday, January 10, 2005 7:22 PM To: > >Declude.JunkMail@declude.com Subject: [Declude.JunkMail] external > >program with quotes > > > > > > > >I'm writing my own external program to compare domain names. > > > >I need to pass the %REVDNS% parameter with quotes around it due to > >possible spaces in it. > > > >Is this possible? > > > > > > > > > > > >Will this work? > > > > > >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe > >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 > >REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 > > > > > > > > -- > = > MailPure custom filters for Declude JunkMail Pro. > http://www.mailpure.com/software/ > = > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] external program with quotes....
Here is the exact rule I have: SPAMASSASSIN external nonzero "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 This executes executePipe.exe with the argument -a "-e -L" correctly. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com -Original Message- From:Matt [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ; Sent: Jan 11, 2005 10:04:03 AM Subject: Re: [Declude.JunkMail] external program with quotes My experience was that Declude uses the first two sets of quotes, regardless of switches. There is no special handling for such things. Matt Chase Seibert wrote: >Try: > > > >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 >REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 > > >I believe I have a rule that uses \", and it works. > > > > -Chase > >Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 >x119 | www.bullhorn.com > > > >-Original Message- >From:Scott Fisher [EMAIL PROTECTED] >To: "Declude.JunkMail@declude.com" ; >Sent: Jan 11, 2005 09:34:47 AM >Subject: Re: [Declude.JunkMail] external program with quotes > > >I agree. But the %REVDNS% variable may contain [No Reverse DNS] which contains >spaces... > >- Original Message - >From: Kevin Bilbee >To: Declude.JunkMail@declude.com >Sent: Monday, January 10, 2005 10:19 PM >Subject: RE: [Declude.JunkMail] external program with quotes > > > > >Reverse dns should never have spaces in it. > > > >-Original Message- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher >Sent: Monday, January 10, 2005 7:22 PM >To: Declude.JunkMail@declude.com >Subject: [Declude.JunkMail] external program with quotes > > > >I'm writing my own external program to compare domain names. > >I need to pass the %REVDNS% parameter with quotes around it due to possible >spaces in it. > >Is this possible? > > > > > >Will this work? > > >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 >REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 > > > -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] external program with quotes....
Try: MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 I believe I have a rule that uses \", and it works. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com -Original Message- From:Scott Fisher [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ; Sent: Jan 11, 2005 09:34:47 AM Subject: Re: [Declude.JunkMail] external program with quotes I agree. But the %REVDNS% variable may contain [No Reverse DNS] which contains spaces... - Original Message - From: Kevin Bilbee To: Declude.JunkMail@declude.com Sent: Monday, January 10, 2005 10:19 PM Subject: RE: [Declude.JunkMail] external program with quotes Reverse dns should never have spaces in it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Monday, January 10, 2005 7:22 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] external program with quotes I'm writing my own external program to compare domain names. I need to pass the %REVDNS% parameter with quotes around it due to possible spaces in it. Is this possible? Will this work? MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0
RE: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download
FYI - I have seen two emails in my personal inbox from this morning that were caught by INV-URIBL but not SNIFFER. I get about 40 spams a day on this account. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com -Original Message- From:Frederick Samarelli [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ; Sent: Dec 28, 2004 10:28:09 AM Subject: Re: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download Since I only implemented it last evening on our test server we are looking at about 500 emails. - Original Message - From: Markus Gufler To: Declude.JunkMail@declude.com Sent: Tuesday, December 28, 2004 10:14 AM Subject: RE: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download based on 10, 100 or 1000 messages? Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Tuesday, December 28, 2004 4:03 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download It looks like it may be a redundant test to sniffer. Everything INV-URIBL catches so does SNIFFER. Fred - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Declude.JunkMail@declude.com Sent: Monday, December 27, 2004 10:32 PM Subject: [Declude.JunkMail] URI Blacklist External Program Beta Now Posted For Download We have released a public beta of our URI lookup tool at http://www.invariantsystems.com/invuribl/default.htm. In addition, we have posted some stats on how effective the tool is on our system at http://www.invariantsystems.com/invuribl/stats.htm. For a more detailed description on the tool please see the below message or send me a note with any questions. Darrell - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Declude.JunkMail@declude.com Sent: Wednesday, December 22, 2004 11:13 PM Subject: URI Blacklist External Program We have wrote an external application that extracts URI's from a message and checks them against a URI Blacklist. For those not familar with URI blacklists here is how the folks at surbl.org describe it. "Surbl blacklists differ from most other RBLs in that they're used to detect spam based on message body URIs (usually web sites). Unlike most other RBLs, SURBLs are not used to block spam senders. Instead they allow you to block messages that have spam domains which occur in message bodies. " We have been running this application in production for the last week against multi.surbl.org. We have also tested the application against several of the other SURBL lists with the same level of sucess. If you are interested in testing or running the software please join the following list [EMAIL PROTECTED] During the beta period this is where we will be communicating about the application. For some of the applications basic features and implementation requirements please see http://www.invariantsystems.com/invuribl/default.htm. We expect to release a beta version within the next couple days. If you would like any additional information prior to joining the list please let me know, Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers.
[Declude.JunkMail] Newbie - Can a declude rule check for a header?
I'm trying to consolidate spam filtering rules on the iMail end, after Declude has processed the message. Before declude, I used the following rule, which basically checks if the message matched more than one blacklist (iMail anti-spam), OR had a statistics rating over .9: H~X-IMAIL-SPAM-DNSBL.*X-IMAIL-SPAM-DNSBL!OR!H~X-IMAIL-SPAM-STAT:Suspected Spam I am currently deploying Declude for spam/virus, and I am hoping I can shorten this rule to just: H~X-RBL-Warning: WEIGHT[1-9]:Suspected Spam This would match WEIGHT10, WEIGHT20 (but not WEIGHT05, which I have added into the system, but to not want filtered by default). My problem is that I want to continue to utilize iMail's anti-spam in addition to Declude. Not for blacklists, but for the statistics filter. My question is, can I add a rule into Declude that will check if the header "X-IMAIL-SPAM-STAT" exists, and give that a weight? I'm sure this has been asked before, but I could not find anything in the message archive or in the Declude documentation. As a side note, IPSwitch really needs to update the message archive search tool. It sucks. Thanks! -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com
RE: [Declude.JunkMail] OT: NO@no.com
I did not file this request, but I do post simular forms to other sites on occasion. Generally, my reasoning is: I don't know you, and I don't trust you not to spam me. It's none of your bussiness. It's pretentious to assume that you can require me to give you my email address. Besides, I like pissing you off by cluttering your database with bad data. Just my two cents. -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com -Original Message-From:Kevin Bilbee [EMAIL PROTECTED] To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>;Sent: Nov 3, 2004 03:22:15 PMSubject: [Declude.JunkMail] OT: [EMAIL PROTECTED]To whome tried to qnwnload my hold analyzer with the following information DLA Downloaded by Name: Why Do You Title: Request Company Name: This Information Number of domains on IMail: 1 Address: 123 No City: No State: NO Zip: NO Phone Number: NO Phone Extension: NO Email Address: [EMAIL PROTECTED] Because it amuses me to see these types of requests. And it is free software so why do you care. We are not marketing the software or using the email addresses to spam. If I wanted to do that I can just harvest address from the declude list. It is free and a condition of the download. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee > Sent: Wednesday, November 03, 2004 12:03 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Vulnerability hold conflicting with > filter > > > look at a program that I wrote. We have been using it very > successfully for > about a year now > > > http://www.ssc-isp.net/holdanalyzer/ > > > Kevin Bilbee > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of John Carter > > Sent: Wednesday, November 03, 2004 11:51 AM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Vulnerability hold conflicting with > > filter > > > > > > Looks like either way I have to go through 100's of held > messages daily to > > find that 99.9% are spam and then manually delete them. I > guess I'll pull > > the ol' Visual Basic out and work up a solution. > > > > Thanks, > > John > > > > (Scott wrote) > > Your option here would be to add a line "AVAFTERJM ON" to the > > \IMail\Declude\virus.cfg file. This will force Declude JunkMail to run > > first, allowing it to delete the E-mail. However, this runs the risk of > > E-mail being held by Declude JunkMail -- in which case it would not be > > scanned by Declude Virus > > > > -Scott > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Solution to death of iMail
Is it totally out of the question to develop a hook in for a Win32 build of
sendmail/postfix? I for one would prefer to be free of yet another corporation on the
"dumb MTA" side of things, and just trust Declude to do all the hard stuff.
-Chase
Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119
| www.bullhorn.com
-Original Message-
From:decjunkmail [EMAIL PROTECTED]
To: "[EMAIL PROTECTED]" ;
Sent: Oct 26, 2004 04:21:43 AM
Subject: [Declude.JunkMail] Solution to "death of IMail"
Here's some "food for thought" for Scott:
Several on the list have suggested that Declude adapt to run with other mail servers
in addition to Imail.
Of course, as Imail servers start getting replaced, it is very unlikely everyone will
choose the same replacement MTA. More than likely, the Imail user base will
fractionalize and probably choose from among 5 to 10 solutions (or more!).
That means the target market only gets smaller and more fragmented. Declude would
probably have to support multiple replacement email servers in order to keep most
customers and that involves a lot of effort - development, testing, support.
Here's a thought - what about a Declude mail server?
It might actually be less work and a better solution to simply provide a replacement
mail server that all declude customers can use.
Afterall, the quality of a declude server, if done right, would be equal to or better
than the hodge-podge of other mail servers out there today!
I would certainly rather stay with Declude than play the lottery picking another
vendor and possibly end-up with another Ipswitch with simply a different name.
Webmail could come later or not at all (there's enough pureplay Webmail stuff that
grafting something in using imap or pop only would be decent at least for a while).
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
