[Declude.JunkMail] akamai.net Redirect/obfuscation
What's the best way to block the akamai.net URL redirect/obfuscation, ie. //a248.e.akamai.net/7/248/1856/90m/www.wellsfargo.com/img/hp/logo_62sq.gif Block everything with akamai.net in it or ...? Thanks, ---- Don Brown - Dallas, Texas USA Internet Concepts® [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SMTP_DELIV_FAILED
;> specific domains. It looks like the error we used to get before >>>>>>>>>> we had a PTR record setup correctly - certain domains refusing to >>>>>>>>>> connect with us. But I believe our PTR record is setup >>>>>>>>>> correctly. We upgraded our server, and so it has a different >>>>>>>>>> local IP address, but the same external IP, so our PTR record >>>>>>>>>> shouldn't have to change. The domain is rogersbenefit.com >>>>>>>>>> >>>>>>>>>> The errors in the imail log look like this: >>>>>>>>>> 10:08 13:20 SMTP-(57f5021f4794) Trying LifeWiseHealth.com (0) >>>>>>>>>> 10:08 13:20 SMTP-(5b9502064c35) Trying healthnet.com (0) >>>>>>>>>> 10:08 13:20 SMTP-(66fa0818097c) Trying healthnet.com (0) >>>>>>>>>> 10:08 13:20 SMTP-(593902374927) Trying healthnet.com (0) >>>>>>>>>> 10:08 13:20 SMTP-(69ac02185d9b) Trying taylorjohnsongroup.com >>>>>>>>>> >>>> (0) >>>> >>>>>>>>>> 10:08 13:20 SMTP-(64bd009a57db) Trying heiworld.com (0) >>>>>>>>>> >>>>>>>>>> and end like this: >>>>>>>>>> >>>>>>>>>> 10:08 13:20 SMTP-(6863023f5c41) 421 Service not available, >>>>>>>>>> closing transmission channel >>>>>>>>>> 10:08 13:20 SMTP-(6863023f5c41) SMTP_DELIV_FAILED >>>>>>>>>> 10:08 13:20 SMTP-(6863023f5c41) >QUIT >>>>>>>>>> >>>>>>>>>> I can ping our DNS servers fine. >>>>>>>>>> >>>>>>>>>> Any ideas? >>>>>>>>>> >>>>>>>>>> Thanks - Kevin >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> --- >>>>>>>>>> This E-mail came from the Declude.JunkMail mailing list. To >>>>>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>>>>>>>> at http://www.mail-archive.com. >>>>>>>>>> >>>>>>>>>> >>>>>>>> --- >>>>>>>> This E-mail came from the Declude.JunkMail mailing list. To >>>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>>>>>> at http://www.mail-archive.com. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> --- >>>>>>> This E-mail came from the Declude.JunkMail mailing list. To >>>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>>>>> at http://www.mail-archive.com. >>>>>>> >>>>>>> [This E-mail scanned for viruses by Declude] >>>>>>> >>>>>>> >>>>>>> >>>>>> [This E-mail scanned for viruses by Declude] >>>>>> >>>>>> >>>>>> >>>>>> --- >>>>>> This E-mail came from the Declude.JunkMail mailing list. To >>>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>>>> at http://www.mail-archive.com. >>>>>> >>>>>> >>>>>> >>>>>> >>>>> --- >>>>> This E-mail came from the Declude.JunkMail mailing list. To >>>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>>> at http://www.mail-archive.com. >>>>> >>>> >>>> >>>> >>>> >>>> --- >>>> This E-mail came from the Declude.JunkMail mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>> at http://www.mail-archive.com. >>>> >>>> >>>> >>>> >>> >>> >>> --- >>> This E-mail came from the Declude.JunkMail mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.JunkMail". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> >> KR> --- KR> This E-mail came from the Declude.JunkMail mailing list. To KR> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and KR> type "unsubscribe Declude.JunkMail". The archives can be found KR> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts® [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New PDF worm?
an be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts® [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364 Fax: (972) 788-5049 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] ZEN test
[EMAIL PROTECTED]> > Subject: [SPAM: 22]RE: 5 augustus > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="_=_NextPart_001_01C7D27B.467F4FA9" > Date: Mon, 30 Jul 2007 09:28:50 +0200 > Content-class: urn:content-classes:message > X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 > Message-ID: > <[EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]>> > X-MS-Has-Attach: > X-MS-TNEF-Correlator: > Thread-Topic: 5 augustus > thread-index: AcfSClRkqB1y6CB4TkymtwIq3Exp3QAZtfQA > From: "Erve Hulsbeek" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>> > Sender: "Piet Heuvelmans" <[EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]>> > To: "Nienke Koster" <[EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]>> > X-RBL-Warning: FIVETEN-SRC: 41.227.116.83.blackholes.five-ten-sg.com. > X-RBL-Warning: MXRATE-BLOCK: > "http://www.mxrate.com/lookup/refused.asp?ipaddress=193.252.22.249" > X-RBL-Warning: ZEN: "http://www.spamhaus.org/query/bl?ip=83.116.227.41" > X-RBL-Warning: SPAMCANNIBAL: "blocked, See: > http://www.spamcannibal.org/cannibal.cgi?page=lookup&lookup=193.252.22.249 > <http://www.spamcannibal.org/cannibal.cgi?page=lookup&lookup=193.252.22.249>" > X-RBL-Warning: FROMNOMATCH: Env sender ([EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]>) From: ([EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]>) mismatch. > X-Declude-Sender: [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> [193.252.22.249] > X-Declude-Spoolname: D933701b3b7de.smd > X-Declude-RefID: str=0001.0A0B0204.46AD933D.0104,ss=1,fgs=0 > X-Declude-Note: Scanned by Declude 4.3.46 for spam. > "http://www.declude.com/x-note.htm" > X-Declude-Scan: Incoming Score [22] at 09:29:18 on 30 Jul 2007 > X-Declude-Fail: FIVETEN-SRC [3], MXRATE-BLOCK [7], ZEN [7], SPAMCANNIBAL > [2], FROMNOMATCH [3], SPAMSUBJECT [12], SPAMHOLD [20], ZEROHOUR [0] > X-Country-Chain: NETHERLANDS->FRANCE->destination > X-fpReview-Weight: 22 > > -- > > Met vriendelijke groet, > Bonno Bloksma > hoofd systeembeheer > > tio hogeschool hotelmanagement en toerisme > begijnenhof 8-12 / 5611 el eindhoven > t 040 296 28 28 / f 040 237 35 20 > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> / www.tio.nl > <http://www.tio.nl> > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts® [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364 Fax: (972) 788-5049 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Possible bug after upgrading to 4.3.46
PROTECTED] DB> DB> (626) 737-6003 DB> DB> Fax (626) 737-6004 DB> DB> DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Config Files (Upgrades)
Are the latest versions of global.cfg, declude.cfg, $default$.junkmail, etc. always written to X:\IMail\Declude\resource with the installation of each upgrade? Thursday, April 19, 2007, 8:06:45 AM, David Barker <[EMAIL PROTECTED]> wrote: DB> Also if you check our release notes DB> http://www.declude.com/searchresults.asp?Cat=89 you will see that we had DB> suggested lowering the weights on UCEPROTECT1 and UCEPROTECT2 DB> David Barker DB> Your Email Security is our business DB> O: 978.499.2933 x7007 DB> F: 978.988.1311 DB> E: [EMAIL PROTECTED] Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Body Filter - Stupid/Simple Question
I should know the answer to this, but obviously . . . How do I filter on cialis and not catch specialist? I don't know anything but 'Contains' that will catch it, but it also catches specialist. There has to be a way to look for just a word . . . Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How to condition on attained weight
Can anyone tell me how to condition a filter on the attained weight of the e-mail? Much the same as the following statement, I want to end the test unless the message has a score of 10 or more. Is there a way to do that? BODYEND NOTCONTAINS Content-Type: image/ Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 8.22 to 2006 Upgrade
How do we get a copy of the JunkMail.cfg without running the full installer? I don't see it otherwise available in the client logon interface or elsewhere on the Declude site. Thursday, December 14, 2006, 2:15:03 PM, Matt <[EMAIL PROTECTED]> wrote: M> Chris, M> 3.x or 4.x will work with IMail 8.2+. Some have said that 1.x and 2.x M> works with the newer IMail, but there have also been many reports of M> issues, and it would make sense to upgrade both at the same time. M> I have been running a 4.x version for over 6 months, and after you tune M> the Declude.cfg properly and address the 'review' issue, it is very M> solid and likely performs slightly better on my system than the 2.x M> version. Note that there have been bugs that crop up in the newer M> releases, so I don't recommend chasing after the latest code whenver it M> is released unless you believe it will fix an issue that you are M> having. If it matters, I have not seen any reports here about bugs in M> the latest 4.x release, though there were bugs in the release before that. M> Another note, make sure that you get the new CODE from Declude's site M> and place it in your Declude.cfg. The old CODE's that were in the M> JunkMail.cfg and Virus.cfg are no longer used and are not compatible M> with the new code, though it will run with a time bomb if you don't have M> the correct code in the correct place. M> Matt M> Chris Anton wrote: >> Hi... Checked the archives, but didn't find anything definitive. What >> version should / need we be running to upgrade to 2006. Any special >> considerations? We are running Declude 2.0.6 Junkmail Pro (with sniffer), >> Virus Standard. Thanks >> -Chris >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> M> --- M> This E-mail came from the Declude.JunkMail mailing list. To M> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and M> type "unsubscribe Declude.JunkMail". The archives can be found M> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] blklst ON
I must have missed part of this thread. What does blklst do? Monday, December 11, 2006, 4:12:03 PM, David Barker <[EMAIL PROTECTED]> wrote: DB> I must have posted the global.cfg sorry, if it is working in the declude.cfg DB> then that's where it should go. Hey I said it was undocumented ;) DB> David B DB> www.declude.com DB> -Original Message- DB> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephen DB> King DB> Sent: Monday, December 11, 2006 4:47 PM DB> To: declude.junkmail@declude.com DB> Subject: RE: [Declude.JunkMail] blklst ON DB> I just tried entering blklst on in declude.cfg instead of global.cfg and the DB> file is now being populated. DB> ________ [SNIP] Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ClamAV Spam Image Filter
Since this deals with Spam, I sent this to the Junkmail list, instead of AV. We tried Clam's Image Spam filter - MSRBL-Images - http://www.msrbl.com/site/ - but started logging these errors: q6acd021fb9ad.smd ERROR: Virus scanner 2 didn't finish after 15 seconds; terminating. q6acd021fb9ad.smd Virus scanner 2 reports exit code of 0 q6acd021fb9ad.smd Couldn't delete X:\IMail\spool\proc\work\D6acd021fb9ad.vir\0: 32. Error String: [The process cannot access the file because it is being used by another process.] We're running Declude Junkmail and AV v 4.3.14 and ClamWin AV 0.88.5 Scanner 0 = AVG built in Scanner 1 = F-Prot Scanner 2 = ClamWin Anyone else seeing this behavior? Any suggestions? Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Clam AV Updates
We've been running Clam for Windows and getting a lot of time-outs and 'unable to delete - file in use . . .". The C:\Temp folder fills up with left over vir files. We also have synch problems for updates. We took it out of production today, since it was keeping dual xeon CPU's continuously at 100% and we didn't have time to drop everything to trouble-shoot it. Any input is appreciated. Thursday, November 9, 2006, 7:07:01 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> Dsic> Dsic> I tend to have clamav update issues. For some reason Dsic> freshclam will start taking 100% cpu and just run on. This Dsic> caused a few queue backups all caught early thanks to Dsic> QueueMon. I changed the task to kill it after 5 minutes. When Dsic> watching the server its not uncommon to see clam sync issues with the daily.inc folder. Dsic> Dsic> Dsic> Dsic> Darrell Dsic> Dsic> Dsic> Check out http://www.invariantsystems.com for utilities for Dsic> Declude And Imail. IMail/Declude Overflow Queue Monitoring, Dsic> SURBL/URI integration, MRTG Integration, and Log Parsers. Dsic> Dsic> Dsic> - Original Message - Dsic> Dsic> From: MarkReimer Dsic> Dsic> To: Declude JunkMail Dsic> Dsic> Sent: Thursday, November 09, 2006 5:52PM Dsic> Dsic> Subject: [Declude.JunkMail] Clam AVUpdates Dsic> Dsic> Dsic> Dsic> Today I noticed that my daily.incfolder was gone and when I Dsic> ran freshclam it gave me a mirror is notsynchronized error. Anyone else see this? Dsic> Dsic> Dsic> Dsic> MarkReimer Dsic> Dsic> IT System Admin Dsic> Dsic> American CareSource Dsic> Dsic> 972-308-6887 Dsic> Dsic> Dsic> --- Dsic> ThisE-mail came from the Declude.JunkMail mailing list. To Dsic> unsubscribe, justsend an E-mail to [EMAIL PROTECTED], and Dsic> type"unsubscribe Declude.JunkMail". The archives can be found Dsic> athttp://www.mail-archive.com. Dsic> Dsic> --- Dsic> This E-mail came from the Declude.JunkMail mailing list. To Dsic> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and Dsic> type "unsubscribe Declude.JunkMail". The archives can be found Dsic> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ASSP
There were a couple of recent posts from folks who had recently implemented ASSP. We have to do the same due to the vulnerability in Imail 8.22. I'd appreciate any comments, suggestions, etc. OFF LIST, from those who have already fell in the holes, etc. Thanks, ---- Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Crashes
ts and MS> others are being whitelisted becasue he is an authenticated user. MS> MS> MS> MS> MS> MS> MS> MS> example (Skipping E-mail from authenticated user MS> [EMAIL PROTECTED]@mydomain.com; whitelisted) MS> MS> MS> MS> MS> MS> MS> MS> I have checked his machine and he has everything set up perfectly MS> including smtp authentication etc. MS> MS> MS> MS> MS> MS> MS> MS> Why would some email be run through declude and other not? MS> MS> MS> MS> MS> MS> MS> MS> I am using IMAIL 8.11, Declude 4 (security suite) MS> MS> MS> MS> MS> MS> MS> Kindest Regards MS> Craig Edmonds MS> 123 Marbella Internet MS> W: www.123marbella.com MS> MS> MS> MS> MS> MS> MS> MS> MS> --- MS> This E-mail came from the Declude.JunkMail mailing list. To MS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and MS> type "unsubscribe Declude.JunkMail". The archives can be found MS> at http://www.mail-archive.com. MS> --- MS> This E-mail came from the Declude.JunkMail mailing list. To MS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and MS> type "unsubscribe Declude.JunkMail". The archives can be found MS> at http://www.mail-archive.com. MS> MS> MS> MS> --- MS> This E-mail came from the Declude.JunkMail mailing list. To MS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and MS> type "unsubscribe Declude.JunkMail". The archives can be found MS> at http://www.mail-archive.com. MS> --- MS> This E-mail came from the Declude.JunkMail mailing list. To MS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and MS> type "unsubscribe Declude.JunkMail". The archives can be found MS> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
JunkMail] Declude 4.3 >> >> >> Then I just do not get it. If revenue would not be lost without it and >> it >> costs you money to provide then what is the business case for providing >> the >> service? >> >> Last I checked business, are in business to make money on capital >> investments/expenditures. Not spend money for things that do not make >> money. >> >> An analogy: Does a restaurant make revenue from toilet paper? >> >> >> Kevin Bilbee >> >> >> > -Original Message- >> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of >> > Matt Robertson >> > Sent: Wednesday, July 19, 2006 12:57 PM >> > To: declude.junkmail@declude.com >> > Subject: Re: [Declude.JunkMail] Declude 4.3 >> > >> > On 7/19/06, Kevin Bilbee <[EMAIL PROTECTED]> wrote: >> > > So then indirectly it does generate revenue. Because without it >> > > revenue would be lost. >> > >> > Hardly. Carry that argument out to prove how wrong it is. By virtue >> > of the fact that they allow me to be in business in the first place I >> > can expect a knock on the door from Microsoft since they make the >> > server o/s... and Dell since they make the servers. So just being a >> > part of the show lets the pig belly up to the trough. >> > >> > Not in this universe. >> > >> > -- >> > [EMAIL PROTECTED] >> > Janitor, MSB Web Systems >> > mysecretbase.com >> > >> > >> > --- >> > This E-mail came from the Declude.JunkMail mailing list. To >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> > type "unsubscribe Declude.JunkMail". The archives can be found >> > at http://www.mail-archive.com. >> > >> >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> DC> --- DC> This E-mail came from the Declude.JunkMail mailing list. To DC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DC> type "unsubscribe Declude.JunkMail". The archives can be found DC> at http://www.mail-archive.com. DC> --- DC> This E-mail came from the Declude.JunkMail mailing list. To DC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DC> type "unsubscribe Declude.JunkMail". The archives can be found DC> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Commtouch, etc
Wednesday, July 19, 2006, 2:01:41 PM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >> Contrary to your comments on the use of this forum, it has always RSP> been for all things Declude when Scott >> was the sole player he never complained about the conversation RSP> threads. Positive or negative. I think you >> could complain if say we were talking about phone systems. RSP> On the other hand, I would be saying "Hey, wait a minute here..." :) Yes you would, but you never failed to listen and to soak in the comments from your customers and respond to them. You stood your ground tactfully when appropriate, but I can't remember when you ever devalued comments from the customer base as 'negative' nor suggest that follow-up posts about a topic you introduced to the list were inappropriate. RSP> I would explain that Commtouch should indeed be treated as an addon to RSP> Declude, not part of the base package (since it requires a huge amount RSP> of manpower in the background). I would then explain that while the RSP> revenue share plan may not seem ideal to everyone, people who don't find RSP> the revenue share plan acceptable can either [1] continue using Declude RSP> as they have with no extra cost, or [2] if they want to add real-time RSP> scanning, they can go with an alternative like Message Sniffer. RSP> It's encouraging that customers see this as a "gotta have it" addon, but RSP> it is important to recognize that it should still be treated as an addon. I don't think there is an issue with understanding that Commtouch is an optional add-on, just the same as was Declude Virus and Declude Junkmail. I also don't think that the majority of customers consider it as a "gotta have it," either, much the same as we didn't think Hijack was to die for. A close read of the many recent posts will disclose that the core issues are much more fundamental. There was a time when I thought that much of the criticism of Declude was exemplary of impatience and youth. I verbalize that to Barry and did the same in an e-mail message to David. However, at this juncture, enough time has passed for the new regime to be up to speed and in-touch with its customer base. Unfortunately, current performance doesn't make a dent in the performance when Scott Perry was running the firm, and that was with more limited resources, to boot. There always comes a time when people say "enough is enough" and if I were running Declude and saw all of these 'negative' posts, frankly, I'd be worried and get real busy listening, understanding and fixing what's broken. Moreover, I'd much rather deal with a customer who was willing to tell me what was broken and give me a chance to fix it rather than dealing with the silent customer who just went away. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3 - Commtouch trial ?
be found at >>> http://www.mail-archive.com. >>> >>> >>> >>> --- >>> This E-mail came from the Declude.JunkMail mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >>> "unsubscribe Declude.JunkMail". The archives can be found at >>> http://www.mail-archive.com. >>> >>> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >> "unsubscribe Declude.JunkMail". The archives can be found at >> http://www.mail-archive.com. >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >> "unsubscribe Declude.JunkMail". The archives can be found at >> http://www.mail-archive.com. >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >> "unsubscribe Declude.JunkMail". The archives can be found at >> http://www.mail-archive.com. >> DB> DB> --- DB> Check out http://www.invariantsystems.com for utilities for Declude, Imail, DB> mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI DB> integration, MRTG Integration, and Log Parsers. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, DB> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe DB> Declude.JunkMail". The archives can be found at DB> http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Commtouch, etc
Yes. Obviously, you don't get it. Wednesday, July 19, 2006, 11:35:17 AM, David Barker <[EMAIL PROTECTED]> wrote: DB> Ouch' let keep it in context. We have added an option that is comparable to DB> Message Sniffer at 1/2 the price of Message Sniffer and I don't get it. ;) DB> -Original Message- DB> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt DB> Sent: Wednesday, July 19, 2006 12:18 PM DB> To: declude.junkmail@declude.com DB> Subject: Re: [Declude.JunkMail] Commtouch, etc DB> David Barker wrote: >>I don't understand why this is a problem. >> >> >> DB> That in fact IS the problem, isn't it? DB> :) DB> Matt DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, DB> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe DB> Declude.JunkMail". The archives can be found at DB> http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
r example, You may not embed the Licensed Program into DB> another DB>> application and then distribute such to third parties unless DB>> You first DB>> acquire an OEM License from Declude, Inc.). As of June 1, DB>> 2006, ISP's and DB>> other service providers are not permitted to use Declude DB>> software to clean DB>> and forward mail to customers unless a separate revenue DB>> share agreement has DB>> been established with Declude. DB>> DB>> http://www.declude.com/Articles.asp?ID=121 DB>> DB>> Is Declude trying to put us out of business? We pay for the DB>> software and now DB>> have to pay them some of your meager profits? DB>> DB>> John T DB>> eServices For You DB>> DB>> "Seek, and ye shall find!" DB>> DB>> DB>> -Original Message- DB>> From: [EMAIL PROTECTED] DB>> [mailto:[EMAIL PROTECTED] On Behalf Of DB>> Gary Steiner DB>> Sent: Tuesday, July 18, 2006 11:24 AM DB>> To: declude.junkmail@declude.com DB>> Subject: [Declude.JunkMail] Declude 4.3 DB>> DB>> I guess someone is going to make an official DB>> announcement today about DB>> DB>> Declude 4.3? DB>> DB>> I see that its downloadable in my account, but it DB>> would be nice to DB>> know DB>> DB>> what I'm DB>> DB>> getting before I install it, especially the new DB>> Commtouch stuff. DB>> DB>> The "Restrictions" listed next to the Add Commtouch DB>> section are DB>> especially DB>> DB>> confusing. DB>> DB>> https://www.declude.com/articles.asp?ID=205 DB>> DB>> Who would use Declude and not fit the definitions of DB>> the restrictions? DB>> DB>> Based on my DB>> DB>> reading of the Restrictions, nobody who uses Declude DB>> will ever be able DB>> to DB>> DB>> use DB>> DB>> Commtouch. If I am misreading this, would someone DB>> please explain it DB>> to DB>> DB>> me? DB>> DB>> Gary DB>> DB>> DB>> DB>> DB>> DB>> --- DB>> This E-mail came from the Declude.JunkMail mailing DB>> list. To DB>> unsubscribe, just send an E-mail to DB>> [EMAIL PROTECTED], and type DB>> "unsubscribe Declude.JunkMail". The archives can be DB>> found at DB>> http://www.mail-archive.com. DB>> DB>> DB>> DB>> DB>> DB>> --- DB>> This E-mail came from the Declude.JunkMail mailing list. To DB>> unsubscribe, DB>> just send an E-mail to [EMAIL PROTECTED], and type DB> "unsubscribe DB>> Declude.JunkMail". The archives can be found at DB>> http://www.mail-archive.com. DB>> DB>> DB>> DB>> --- DB>> This E-mail came from the Declude.JunkMail mailing list. To DB>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB>> type "unsubscribe Declude.JunkMail". The archives can be found DB>> at http://www.mail-archive.com. DB>> DB>> DB>> DB>> DB>> --- DB>> This E-mail came from the Declude.JunkMail mailing list. To DB>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type DB>> "unsubscribe Declude.JunkMail". The archives can be found at DB> http://www.mail-archive.com. DB>> --- DB>> This E-mail came from the Declude.JunkMail mailing list. To DB>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type DB>> "unsubscribe Declude.JunkMail". The archives can be found at DB>> http://www.mail-archive.com. DB>> --- DB>> This E-mail came from the Declude.JunkMail mailing list. To DB>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type DB>> "unsubscribe Declude.JunkMail". The archives can be found at DB>> http://www.mail-archive.com. DB> DB> Don Brown - Dallas, Texas USA Internet Concepts, Inc. DB> [EMAIL PROTECTED] http://www.inetconcepts.net DB> (972) 788-2364Fax: (972) 788-5049 DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, DB> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe DB> Declude.JunkMail". The archives can be found at DB> http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
If we could get away with it, we wouldn't offer any e-mail service. There is more tech support overhead and other costs with e-mail than everything else combined. Unfortunately, not offering e-mail and Spam/Virus protection is not an option, from a competitive stand-point. Tuesday, July 18, 2006, 10:22:00 PM, Kevin Bilbee <[EMAIL PROTECTED]> wrote: KB> KB> KB> Question to thoes that are saying that spam/virus protestion is a KB> lost leader/not a revenue builder. KB> KB> KB> KB> If it does not generate revenue then why don't you stop offering spam/virus protection? KB> KB> KB> KB> KB> KB> KB> KB> Kevin Bilbee KB> KB> --- KB> This E-mail came from the Declude.JunkMail mailing list. To KB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and KB> type "unsubscribe Declude.JunkMail". The archives can be found KB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
http://www.mail-archive.com. DB> DB> DB> DB> DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, DB> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe DB> Declude.JunkMail". The archives can be found at DB> http://www.mail-archive.com. DB> DB> DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. DB> DB> DB> DB> DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, DB> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe DB> Declude.JunkMail". The archives can be found at http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, DB> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe DB> Declude.JunkMail". The archives can be found at DB> http://www.mail-archive.com. DB> --- DB> This E-mail came from the Declude.JunkMail mailing list. To DB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DB> type "unsubscribe Declude.JunkMail". The archives can be found DB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Licensing
What is the URL to Brian Burns' port? Monday, July 17, 2006, 2:05:34 PM, Nick Hayer <[EMAIL PROTECTED]> wrote: NH> David Barker wrote: >> Declude has >> this process and functionality built in to the Declude product which enables >> customers to use a command line scanners like ClamWin NH> NH> Brian Burns port called ClamAV supports clamd which is wicked fast [and NH> free]. This is a different product from ClamWin. NH> I had done some comparison on the scanners - and had sent this to the NH> Declude Virus list: NH> "I just switched to 4x and noticed in the logs that scan times are NH> recorded - NH> here are some sample scan times against the same email - NH> 2062ms Clamscan NH> 468ms Mcafee scan.exe NH> 171ms fprot NH> These relative scan time proportional differences appear to remain the NH> same against other emails. NH> Switching from clamscan.exe to clamdscan.exe ClamAV averages 15ms NH> against all emails it sees. That is like a factor of 10 faster than NH> fprot its closest performance competitor. Since its free and NH> w/Sanesecurity phish sigs I give it an editors choice :) NH> It would be nice to see [feature request?] the ms response time for AVG - " NH> -Nick >> NH> --- NH> This E-mail came from the Declude.JunkMail mailing list. To NH> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and NH> type "unsubscribe Declude.JunkMail". The archives can be found NH> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Licensing
Is the subscription to AVG part of Declude now or does the user need to purchase a subscription from AVG in order to get definition updates? Monday, July 17, 2006, 1:32:29 PM, David Barker <[EMAIL PROTECTED]> wrote: DB> Just a comment on this Licensing thread DB> [Snip] DB> Not to mention AVG which is built into Declude Security Suite, which DB> hopefully customers will now begin to really understand the value and DB> financial benefits to this integration. DB>[Snip] Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Over Hold Weight, but Delivered
Declude support says it is a known problem and they are currently working on a resolution. Saturday, July 15, 2006, 11:46:16 AM, John T (Lists) <[EMAIL PROTECTED]> wrote: >> We've had Hijack shut-down for about 24 hours and we are still seeing >> mail delivery with scores well over our hold weight. JTL> Time to put the JunkMail log into DEBUG mode, run it until you know the JTL> problem has occurred, put it back into what ever log mode you desire, then JTL> copy out all the lines for a message in question. Feel free to post those JTL> lines here or send it off list if you want. JTL> John T JTL> eServices For You JTL> "Seek, and ye shall find!" JTL> --- JTL> This E-mail came from the Declude.JunkMail mailing list. To JTL> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL> type "unsubscribe Declude.JunkMail". The archives can be found JTL> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Licensing
All of these folks must think that the ISP business is high margin and we're just looking for ways to reduce taxes by paying all of these exorbitant fees. A mind is such a terrible thing to waste . . . Friday, July 14, 2006, 8:59:38 PM, John T (Lists) <[EMAIL PROTECTED]> wrote: JTL> JTL> JTL> JTL> Sounds like F-Prot has been talking to McCrappy. JTL> JTL> JTL> JTL> JTL> John T JTL> JTL> eServices For You JTL> JTL> JTL> JTL> "Seek, and ye shall find!" JTL> JTL> JTL> JTL> JTL> JTL> -Original Message- JTL> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic JTL> Sent: Friday, July 14, 2006 4:40 PM JTL> To: declude.junkmail@declude.com JTL> Subject: RE: [Declude.JunkMail] F-Prot Licensing JTL> JTL> JTL> JTL> As my kids have become fond of saying JTL> JTL> JTL> JTL> This sucks JTL> JTL> JTL> JTL> JTL> Goran Jovanovic JTL> JTL> Omega Network Solutions JTL> JTL> JTL> JTL> JTL> JTL> --- JTL> This E-mail came from the Declude.JunkMail mailing list. To JTL> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL> type "unsubscribe Declude.JunkMail". The archives can be found JTL> at http://www.mail-archive.com. JTL> --- JTL> This E-mail came from the Declude.JunkMail mailing list. To JTL> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL> type "unsubscribe Declude.JunkMail". The archives can be found JTL> at http://www.mail-archive.com. JTL> --- JTL> This E-mail came from the Declude.JunkMail mailing list. To JTL> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL> type "unsubscribe Declude.JunkMail". The archives can be found JTL> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Licensing
Let us know what you find, please. Friday, July 14, 2006, 5:48:25 PM, Heimir Eidskrem <[EMAIL PROTECTED]> wrote: HE> Markus Gufler wrote: >> This pricing is just another way of saying "Go Away". >> Suggestions? >> >> Markus >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. HE> I am going away for sure. HE> Its NO way I will pay that much money to use a command line scanner. HE> There are no difference between the mail server version and the regular HE> version besides the license. HE> Its a rip off. HE> I will NOT spend 1750 bucks on Declude for that matter. HE> I guess I will be busy finding replacements. HE> --- HE> This E-mail came from the Declude.JunkMail mailing list. To HE> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and HE> type "unsubscribe Declude.JunkMail". The archives can be found HE> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Over Hold Weight, but Delivered
Turning-off Hijack had no affect. The issue continued. Are you referring to the "Forward" field, just below the "reply-to" field of the User's record in Imail? Are you saying that using that field, (instead of setting up an Alias record, instead) will somehow let mail through, when it is over the hold weight? Thanks, Saturday, July 15, 2006, 12:57:30 AM, John T (Lists) <[EMAIL PROTECTED]> wrote: JTL> Note, if this is related to Hijack, there either there is a new bug in JTL> Hijack or there is a misconfiguration somewhere, as Hijack only checks JTL> outbound messages. NOTE: If you are doing gateway service rather than using JTL> aliases, you can be caught by this. Another reason that gateway service JTL> (Store and Forward) is no longer a recommended practice. JTL> John T JTL> eServices For You JTL> "Seek, and ye shall find!" >> -Original Message- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - >> Systems Eng. (Karl Drugge) >> Sent: Friday, July 14, 2006 6:38 AM >> To: declude.junkmail@declude.com >> Subject: RE: [Declude.JunkMail] Over Hold Weight, but Delivered >> >> I've been seeing it too. I finally tracked it down to Hi-Jack. Disable >> Hi-Jack, and you should be good ( I just renamed the config file, so I >> can restart it as soon as this is fixed ). Somehow, Hi-jack grabs the >> message before Declude kills it. >> >> >> Karl Drugge >> >> >> >> >> >> >> >> -Original Message- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of >> Linda Pagillo >> Sent: Friday, July 14, 2006 8:34 AM >> To: declude.junkmail@declude.com >> Subject: Re: [Declude.JunkMail] Over Hold Weight, but Delivered >> >> Don: >> >> We are aware of this issue and it has been escalated to our engineering >> department. >> >> Linda Pagillo >> Technical Support Engineer >> Declude - Your Email security is our businessT >> >> - Original Message - >> From: "Don Brown" <[EMAIL PROTECTED]> >> To: >> Sent: Friday, July 14, 2006 5:09 AM >> Subject: [Declude.JunkMail] Over Hold Weight, but Delivered >> >> >> > We have been seeing mail being delivered, when it has scored higher >> > than our hold weight. >> > >> > The common denominator with these messages seems to be that it is >> > addressed to multiple recipients. These recipients are sometimes of >> > the same domain and other times of different domains. >> > >> > We are running the latest 4.xx release with Imail 8.xx, but this >> > behavior isn't new to this release. We've noticed it for the last few >> > releases, although I'm not sure which release marked the start of it. >> > >> > Has anyone else been seeing this behavior or are we just lucky? >> > >> > Thanks, >> > >> > >> > >> > Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> > [EMAIL PROTECTED] http://www.inetconcepts.net >> > (972) 788-2364Fax: (972) 788-5049 >> > >> > >> > >> > >> > --- >> > This E-mail came from the Declude.JunkMail mailing list. To >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> > type "unsubscribe Declude.JunkMail". The archives can be found >> > at http://www.mail-archive.com. >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. JTL> --- JTL> This E-mail came from the Declude.JunkMail mailing list. To JTL> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL> type "unsubscribe Declude.JunkMail". The archives can be found JTL> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Over Hold Weight, but Delivered
We've had Hijack shut-down for about 24 hours and we are still seeing mail delivery with scores well over our hold weight. Friday, July 14, 2006, 8:37:38 AM, IS - Systems Eng. (Karl Drugge) <[EMAIL PROTECTED]> wrote: ISEKD> I've been seeing it too. I finally tracked it down to Hi-Jack. Disable ISEKD> Hi-Jack, and you should be good ( I just renamed the config file, so I ISEKD> can restart it as soon as this is fixed ). Somehow, Hi-jack grabs the ISEKD> message before Declude kills it. ISEKD> Karl Drugge ISEKD> ISEKD> ISEKD> ISEKD> ISEKD> ISEKD> ISEKD> -Original Message- ISEKD> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ISEKD> Linda Pagillo ISEKD> Sent: Friday, July 14, 2006 8:34 AM ISEKD> To: declude.junkmail@declude.com ISEKD> Subject: Re: [Declude.JunkMail] Over Hold Weight, but Delivered ISEKD> Don: ISEKD> We are aware of this issue and it has been escalated to our engineering ISEKD> department. ISEKD> Linda Pagillo ISEKD> Technical Support Engineer ISEKD> Declude - Your Email security is our businessT ISEKD> - Original Message - ISEKD> From: "Don Brown" <[EMAIL PROTECTED]> ISEKD> To: ISEKD> Sent: Friday, July 14, 2006 5:09 AM ISEKD> Subject: [Declude.JunkMail] Over Hold Weight, but Delivered >> We have been seeing mail being delivered, when it has scored higher >> than our hold weight. >> >> The common denominator with these messages seems to be that it is >> addressed to multiple recipients. These recipients are sometimes of >> the same domain and other times of different domains. >> >> We are running the latest 4.xx release with Imail 8.xx, but this >> behavior isn't new to this release. We've noticed it for the last few >> releases, although I'm not sure which release marked the start of it. >> >> Has anyone else been seeing this behavior or are we just lucky? >> >> Thanks, >> >> >> >> Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> [EMAIL PROTECTED] http://www.inetconcepts.net >> (972) 788-2364Fax: (972) 788-5049 >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. ISEKD> --- ISEKD> This E-mail came from the Declude.JunkMail mailing list. To ISEKD> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ISEKD> type "unsubscribe Declude.JunkMail". The archives can be found ISEKD> at http://www.mail-archive.com. ISEKD> --- ISEKD> This E-mail came from the Declude.JunkMail mailing list. To ISEKD> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ISEKD> type "unsubscribe Declude.JunkMail". The archives can be found ISEKD> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Which way to upgrade - SmarterMail or IMail
Friday, July 14, 2006, 7:03:29 AM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: [Snip] Dsic> The cost of renewal of IMail Server Standalone: Dsic> 25 Users-$349.00 Dsic> 100 Users-$495.00 Dsic> 250 Users-$649.00 Dsic> 1000 Users-$849.00 Dsic> Unlimited Users-$995.00 [Snip] There are a lot of available alternatives to a $1,000 annual subscription cost. I suspect we'll be history, when, or shortly after, our current support agreement comes up for renewal. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Over Hold Weight, but Delivered
Thanks good to know, but I think it started before we began running HiJack. I'll disable hijack, though. Friday, July 14, 2006, 8:37:38 AM, IS - Systems Eng. (Karl Drugge) <[EMAIL PROTECTED]> wrote: ISEKD> I've been seeing it too. I finally tracked it down to Hi-Jack. Disable ISEKD> Hi-Jack, and you should be good ( I just renamed the config file, so I ISEKD> can restart it as soon as this is fixed ). Somehow, Hi-jack grabs the ISEKD> message before Declude kills it. ISEKD> Karl Drugge ISEKD> ISEKD> ISEKD> ISEKD> ISEKD> ISEKD> ISEKD> -Original Message- ISEKD> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ISEKD> Linda Pagillo ISEKD> Sent: Friday, July 14, 2006 8:34 AM ISEKD> To: declude.junkmail@declude.com ISEKD> Subject: Re: [Declude.JunkMail] Over Hold Weight, but Delivered ISEKD> Don: ISEKD> We are aware of this issue and it has been escalated to our engineering ISEKD> department. ISEKD> Linda Pagillo ISEKD> Technical Support Engineer ISEKD> Declude - Your Email security is our businessT ISEKD> - Original Message - ISEKD> From: "Don Brown" <[EMAIL PROTECTED]> ISEKD> To: ISEKD> Sent: Friday, July 14, 2006 5:09 AM ISEKD> Subject: [Declude.JunkMail] Over Hold Weight, but Delivered >> We have been seeing mail being delivered, when it has scored higher >> than our hold weight. >> >> The common denominator with these messages seems to be that it is >> addressed to multiple recipients. These recipients are sometimes of >> the same domain and other times of different domains. >> >> We are running the latest 4.xx release with Imail 8.xx, but this >> behavior isn't new to this release. We've noticed it for the last few >> releases, although I'm not sure which release marked the start of it. >> >> Has anyone else been seeing this behavior or are we just lucky? >> >> Thanks, >> >> >> >> Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> [EMAIL PROTECTED] http://www.inetconcepts.net >> (972) 788-2364Fax: (972) 788-5049 >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. ISEKD> --- ISEKD> This E-mail came from the Declude.JunkMail mailing list. To ISEKD> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ISEKD> type "unsubscribe Declude.JunkMail". The archives can be found ISEKD> at http://www.mail-archive.com. ISEKD> --- ISEKD> This E-mail came from the Declude.JunkMail mailing list. To ISEKD> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ISEKD> type "unsubscribe Declude.JunkMail". The archives can be found ISEKD> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Over Hold Weight, but Delivered
We have been seeing mail being delivered, when it has scored higher than our hold weight. The common denominator with these messages seems to be that it is addressed to multiple recipients. These recipients are sometimes of the same domain and other times of different domains. We are running the latest 4.xx release with Imail 8.xx, but this behavior isn't new to this release. We've noticed it for the last few releases, although I'm not sure which release marked the start of it. Has anyone else been seeing this behavior or are we just lucky? Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Counting Instances
We're also looking for a solution to killing that kind of Spam. Thursday, June 1, 2006, 5:33:53 AM, Dan <[EMAIL PROTECTED]> wrote: D> I'm looking at spam like this (this is but a small piece) and D> wondering if there is a way to count the number of instances of a D> particular entry, the number of times a word or other feature D> appears in the body or other part of a message: D> ="float :right">> c ea ="float :right">> a r H ="float :right">> l om ="float :right">> u e O Perhaps something I missed, a new use of a old system or whole new system, something like: D> body 0 contains ='float D> CountInstances countfilterd:\IMail\Declude\Count.txt 400 0 D> Where 40 instances of a single entry or 40 different entries in D> the same file, triggers the test. Thoughts/Reactions? D> Thanks, D> Dan D> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hijack Held Notifier
Thanks, Craig.
I don't have the FileFunctions object installed (the script errors on
it). Where do I get it?
Also, shouldn't the last line of the script be
Set FFunc = Nothing ?
Thanks,
Sunday, May 28, 2006, 11:20:41 AM, Craig Edmonds <[EMAIL PROTECTED]> wrote:
CE>
CE> Hi Don,
CE> Try this.
CE> Set up a scheduled task to run every 15 minutes
CE> I do it on the hold1 folder too.
CE> If there is nothing in the hold queue then nothing happens.
CE> You might need to install the FileFunctions object but that takes allof two
CE> seconds.
CE> <---
CE> filepath="C:\IMAIL\spool\spam\hold2\*.smd"
CE> emailfrom="[EMAIL PROTECTED]"
CE> emailto="[EMAIL PROTECTED]"
CE> Set FFunc = CreateObject("FileFunctions.files")
CE> if FFunc.Exists(filepath) then
CE> FFunc.GetFileList(filepath)
CE>Set objMessage = CreateObject("CDO.Message")
CE>objMessage.Subject = "(Alert) " & FFunc.Count & " Messages in The Hold
CE> Queue at " & FormatDateTime(Now, 4)
CE>objMessage.From = emailfrom
CE>objMessage.To = emailto
CE>strBody = strBody & "There are currently " & FFunc.Count & " files in the
CE> Hold Queue" & vbCRLF
CE>strBody = strBody & "" & vbCRLF
CE>strBody = strBody & "Date: " & FormatDateTime(Date, 1) & " - " &
CE> FormatDateTime(Now, 4)
CE>objMessage.TextBody = strBody
CE>objMessage.Send
CE> end if
->>
CE> Kindest Regards
CE> Craig Edmonds
CE> 123 Marbella Internet
CE> W: www.123marbella.com
CE> E : [EMAIL PROTECTED]
CE>
CE> Marbella Guide Web Portal
CE> W: www.marbellaguide.com
CE> E: [EMAIL PROTECTED]
CE> -Original Message-
CE> From: [EMAIL PROTECTED]
CE> [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown
CE> Sent: Sunday, May 28, 2006 6:04 PM
CE> To: Declude.JunkMail@declude.com
CE> Subject: [Declude.JunkMail] Hijack Held Notifier
CE> Does anyone have a copy of "Hijack Held Notifier" (A VBscript program that
CE> sends an E-mail whenever Declude Hijack holds any messages)? The link on
CE> Declude's Web Tools page is broken.
CE>
CE> Don Brown - Dallas, Texas USA Internet Concepts, Inc.
CE> [EMAIL PROTECTED] http://www.inetconcepts.net
CE> (972) 788-2364Fax: (972) 788-5049
CE>
CE> ---
CE> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
CE> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
CE> Declude.JunkMail". The archives can be found at
CE> http://www.mail-archive.com.
CE> [ This E-mail has been scanned for Spam and Viruses by Declude ] [ Thank You
CE> For Using 123 Marbella Internet ]
CE> [ This E-mail has been scanned for Spam and Viruses by Declude ]
CE> [ Thank You For Using 123 Marbella Internet ]
CE> ---
CE> This E-mail came from the Declude.JunkMail mailing list. To
CE> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
CE> type "unsubscribe Declude.JunkMail". The archives can be found
CE> at http://www.mail-archive.com.
Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED] http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Hijack Held Notifier
Does anyone have a copy of "Hijack Held Notifier" (A VBscript program that sends an E-mail whenever Declude Hijack holds any messages)? The link on Declude's Web Tools page is broken. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT Undeliverable Mail to ATT.net
We have seen this issue alot. We attempted contacting ATT and getting higher than 1st level tech support, but found that to be more difficult than exposing a covert, undercover CIA agent. Finally, we connected with a supervisor, who, with a phone in each ear, told us that the real tech support guys said they were aware of it but nothing could be done. I later was told about an article which indicated that ATT was going to introduce a new service called 'fast e-mail' (or something similar) for an additional fee. Go figure. Tuesday, May 23, 2006, 5:42:54 PM, Lenny Bauman <[EMAIL PROTECTED]> wrote: LB> Hello all, LB> A little off topic but is any one seeing undeliverable mail to att.net. I LB> have been seeing "450-Busy try again later" evertime we connect to att.net. LB> Any idea on what is going on with att.net LB> Lenny Bauman LB> President LB> LRBCG.COM, Inc. LB> 419-621-5770 LB> 1-888-621-6475 LB> --- LB> [This E-mail scanned for viruses by LRBCG.COM, Inc.] LB> --- LB> This E-mail came from the Declude.JunkMail mailing list. To LB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and LB> type "unsubscribe Declude.JunkMail". The archives can be found LB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AHBL:AHBL & SBL False Positives
FWIW AHBL blocks entire /18 address space, when only a few IP's are responsible for sending Spam. They are also non-responsive to removal requests from innocent bystanders who are blocked due to their irresponsibly large IP blocks. See http://www.dnsstuff.com/tools/ip4r.ch?ip=216.14.34.65 SBL also blocks entire /18 address space. They are responsive to removal requests but actually "refuse" to change the large IP block, so that innocent bystanders are not blocked. Both lists are going to produce false positives, due to irresponsibly blocking very large address space. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT Smarter Mail Installation
No import. Brand New box. They are migrating from a Open Source Mail Solution to Windows 2003/SmarterMail. I'm assuming we'll have to enter every user by hand. I'm trying to get a feel for how much time I should reasonably quote. When I say reasonable, I mean that I don't want to bill the client for our learning curve and RTFM time. Thursday, March 23, 2006, 12:13:12 PM, Dave Doherty <[EMAIL PROTECTED]> wrote: DD> Are you importing from an IMail installation? My experience with that was DD> very good, except they forgot to do the domain aliases. I didn't try DD> autoresponders, but that should be minimal. It brought over all the mail as DD> well. DD> Most of the time I spent on the project was in configruing add-ons like DD> Declude, Sniffer, inv-uribl, etc., not the main product. DD> Installation of the product itself is pretty straightforward. I read the DD> forum posts and decided that, even though I didn't like the paths they DD> chose, I should accept the defaults. It seems that most of the people who DD> were having really odd problems were using different paths. Having said DD> that, all the path-problem type posts I saw were with V2 and the current V3 DD> should be a lot better. DD> As an example, the product installs in "c:\program DD> files\smartertools\smartermail" where I would much rather have it in DD> "c:\smartermail" to make it easier to get to. DD> One word of caution: there appear to be oddball problems with the alternate DD> "skins," which are really just color schemes. Conventional wisdom on the DD> forums seems to be "just use the default skin"... DD> -Dave Doherty DD> Skywaves, Inc. DD> - Original Message - DD> From: "Don Brown" <[EMAIL PROTECTED]> DD> To: DD> Sent: Thursday, March 23, 2006 12:42 PM DD> Subject: [Declude.JunkMail] OT Smarter Mail Installation >> We've been asked to estimate/quote an installation of SmarterMail, >> which we've not actually installed before. >> >> There are 4 domains with fixed IP addresses, 64 POP boxes & WebMail >> and 5 two-three sentence auto-responders. >> >> For those of you who have been through it before, could you give me an >> idea of how much time you feel is reasonable, not including our own >> RTFM and learning curve time. >> >> Thanks, >> >> >> >> Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> [EMAIL PROTECTED] http://www.inetconcepts.net >> (972) 788-2364Fax: (972) 788-5049 >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> DD> --- DD> This E-mail came from the Declude.JunkMail mailing list. To DD> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DD> type "unsubscribe Declude.JunkMail". The archives can be found DD> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT Smarter Mail Installation
We've been asked to estimate/quote an installation of SmarterMail, which we've not actually installed before. There are 4 domains with fixed IP addresses, 64 POP boxes & WebMail and 5 two-three sentence auto-responders. For those of you who have been through it before, could you give me an idea of how much time you feel is reasonable, not including our own RTFM and learning curve time. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ? Name Voting Time
I second that one, but maybe e-mail instead of mail. Wednesday, February 15, 2006, 10:18:11 PM, Darin Cox <[EMAIL PROTECTED]> wrote: DC> I'd like to vote for a write-in DC> Declude Mail Security Suite DC> You can add a 4 in there if you want...as in DC> Declude Mail Security Suite 4.0 DC> Darin. DC> - Original Message - DC> From: "Barry Simpson" <[EMAIL PROTECTED]> DC> To: ; DC> Sent: Wednesday, February 15, 2006 5:39 PM DC> Subject: [Declude.JunkMail] ? Name Voting Time DC> Here are the choices: DC> Please send your votes to [EMAIL PROTECTED] no later than 5pm Eastern Time DC> Friday 17th February. DC> - Declude Quattro DC> - DEC4 DC> - Suite4 DC> - R/4 (release four) DC> - Declude Total DC> - Declude Power Suite 4 DC> - Declude Max4 DC> - Declude ForePlay just making sure you're paying attention) DC> - Declude-ES4 (E-mail security 4) DC> Thanks DC> Barry DC> --- DC> [This E-mail was scanned for viruses by Declude EVA www.declude.com] DC> --- DC> This E-mail came from the Declude.JunkMail mailing list. To DC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DC> type "unsubscribe Declude.JunkMail". The archives can be found DC> at http://www.mail-archive.com. DC> --- DC> [This E-mail was scanned for viruses by Declude EVA www.declude.com] DC> --- DC> This E-mail came from the Declude.JunkMail mailing list. To DC> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DC> type "unsubscribe Declude.JunkMail". The archives can be found DC> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 3.0 / 4.0
Saturday, February 11, 2006, 9:47:07 AM, David Barker <[EMAIL PROTECTED]> wrote: DB> [Snip] DB> 5. With regards to Version 3.0 and 4.0 there is NO major difference in DB> functionality except that 4.0 runs as a single product with Declude EVA PRO, DB> Junkmail PRO and Hijack. Where as Version 3.0 still supports 3 individual DB> products. DB> [Snip] DB> 7. I am pulling together some additional release notes on a comparison DB> between version version 3.0 and 4.0 which I hope to have available next DB> week. DB> David B DB> www.declude.com DB> [Snip] Items 5 & 7 are contradictory, to the extent that no comparison, as promised in 7, would be needed, if the only difference was, as quoted in 5. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ANN: SMTP Gateway
Scott was not assaulted on the Imail list and even if he was, it is not relevant to what is appropriate and acceptable on this list. Never-the-less, Scott had a working relationship with Imail and Declude was not a competitor to Imail until Imail introduced their own Spam solution (which was poor and thank God for Declude, in our humble opinion). Even today, Declude is still listed on Imail's "Utilities and Helper Applications" page: http://www.ipswitch.com/support/imail/helperapps.asp#User Another example is Len Conrad's IMGate solution, which is also listed on Imail's Utilities and Helper Application page. Len frequents the Imail list, but you won't see him on the Declude list because he considers IMGate a direct competitor to Declude. That may be a questionable position in some minds but given the benefit of the doubt, Len respects proper decorum by not posting here. Respectfully, your position is not based upon the facts and it also defies common sense. Thanks, Thursday, January 26, 2006, 1:30:25 PM, Lists - Declude JunkMail <[EMAIL PROTECTED]> wrote: LDJ>[SNIP] LDJ> R. Scott Perry got assaulted on the Imail list repeatedly for years for LDJ> pushing his wares. Imail had a gap-in-functionality, Declude seized the LDJ> moment and profited by patching that gap. I was thankful for his LDJ> repeated input/arguments and purchased his product - against Imail's own LDJ> later offering. LDJ> [SNIP] LDJ> Maintain, LDJ> Babul LDJ> LDJ> (210) 696-1130, ext. 102 LDJ> (210) 696-0572 [fax] LDJ> Text Pager Email: [EMAIL PROTECTED] LDJ> LDJ> The Montopolis Group, Ltd. - www.montopolis.com LDJ> "Building stronger businesses... with Technology" [SNIP] Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Incomplete headers - theory
4a54.smd KM> X-Declude-Note: Scanned by Declude 3.0.5.23 KM> (http://www.declude.com/x-note.htm) for spam. KM> X-Declude-Scan: Score [21] at 19:36:39 on 24 Jan 2006 KM> X-Declude-Tests: BADHEADERS, CMDSPACE, HELOBOGUS, ROUTING, WEIGHT10, WEIGHT13 >>I wish to stop getting these, thanks! - f=0A =0A> KM> =0A=0A KM>=0A=0A > KM> =0A=0A=0A KM> 693861316335815-- KM> --- KM> [This E-mail was scanned for viruses by Declude EVA www.declude.com] KM> --- KM> This E-mail came from the Declude.JunkMail mailing list. To KM> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and KM> type "unsubscribe Declude.JunkMail". The archives can be found KM> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: IMail vs. Merak
Does it support port 587 for authentication? Wednesday, December 28, 2005, 1:44:10 PM, Jeff Kratka <[EMAIL PROTECTED]> wrote: JK> Not to get anyone bent at all but I have a second mail server running that JK> is hMailServer www.hmailserver.com. It is open source for Windows and has JK> been very stable. Very good support from it's forums. I am working to a few JK> things to get my Declude system to work with it properly. Presently have JK> ASSP (it's like Spam Assassin but easier to setup) but would really like to JK> get my Declude set-up working with it. JK> Just a suggestion. JK> Jeff Kratka JK> JK> TymeWyse Internet JK> P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 JK> tel: (541) 643-2023 - [EMAIL PROTECTED] JK> JK> -Original Message- JK> From: [EMAIL PROTECTED] JK> [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser JK> Sent: Wednesday, December 28, 2005 7:35 AM JK> To: DECLUDE.JUNKMAIL@DECLUDE.COM JK> Subject: [Declude.JunkMail] OT: IMail vs. Merak JK> Hello, All, JK> We are re-architecting our e-mail hosting and are going to be upgrading from JK> IMail 6.06 to a new e-mail platform. We are familiar with IMail can do so JK> we are currently evaluating Merak e-mail server to see what else is out JK> there. Has anyone on this list done a similiar evaluation between IMail and JK> Merak? If so, did you find any clear benefits that IMail had over Merak or JK> vice versa? JK> We already know that Merak is going to be a more expensive upgrade then JK> IMail. And obviously the current version of Declude doesn't support Merak. JK> Anything else that made the decision to stay with IMail easier for you? JK> Thanks In Advance, JK> Dan Geiser JK> [EMAIL PROTECTED] JK> --- JK> E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) JK> --- JK> [This E-mail was scanned for viruses by Declude EVA www.declude.com] JK> --- JK> This E-mail came from the Declude.JunkMail mailing list. To JK> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JK> type "unsubscribe Declude.JunkMail". The archives can be found JK> at http://www.mail-archive.com. JK> --- JK> [This E-mail was scanned for viruses by Declude EVA www.declude.com] JK> --- JK> This E-mail came from the Declude.JunkMail mailing list. To JK> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JK> type "unsubscribe Declude.JunkMail". The archives can be found JK> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [Declude.Virus] Declude Hardware Issue
Mine started 12/24 at 12:20 Central Time. That's the first incidence of "Sorry, filters [] are only available in Declude JunkMail Pro," anyway. Monday, December 26, 2005, 4:02:33 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> Dsic> Dsic> FYI - For the other affected by this I put 3.0.5.22 back on Dsic> and everything is flying along with no issues. Processing messages as fast as could be. Dsic> Dsic> Dsic> Dsic> FWIW - My issues started on December 24th at approximatly - 2:10pm EST. Dsic> Dsic> Dsic> Dsic> I will follow-up with Declude tomorrow to determine why my Dsic> version decided to downgrade itself. Dsic> Dsic> Dsic> Dsic> Darrell Dsic> Dsic> Dsic> Check out http://www.invariantsystems.com for utilities for Dsic> Declude And Imail. IMail/Declude Overflow Queue Monitoring, Dsic> SURBL/URI integration, MRTG Integration, and Log Parsers. Dsic> Dsic> Dsic> - Original Message - Dsic> Dsic> From: DavidFranco-Rocha Dsic> Dsic> To: Declude.JunkMail@declude.com Dsic> Dsic> Cc: Declude.Virus@declude.com Dsic> Dsic> Sent: Monday, December 26, 2005 4:00PM Dsic> Dsic> Subject: [Declude.Virus] Declude HardwareIssue Dsic> Dsic> Dsic> Please note that the hardware issue preventingcommunication Dsic> with Declude has been resolved. Key authentication has resumed as normal. Dsic> Dsic> Dsic> Dsic> There appear to be some misconceptions on thelists Dsic> regarding the key authentication system. In the event that your Dsic> keycannot be authenticated (either due to communication Dsic> failure or because thekey was never issued): Dsic> Dsic> Dsic> Dsic> A) Your software will continue tofunction Dsic> Dsic> Dsic> Dsic> B) Your software is NEVER downgraded for anyreason, either automatically or otherwise Dsic> Dsic> Dsic> Dsic> We have had a few reports from customers who havelicensed Dsic> versions of Pro, saying that they are receiving messages in Dsic> their logfiles that they do not have the Pro version. We Dsic> will identify the source ofthat issue tomorrow when the Dsic> office reopens and will resolve it. It does nothave any Dsic> relation to the key authentication mechanism with the server, Dsic> sincethe actual authentication with IMail versions of Dsic> Declude continues to be viathe old codes entered into the configuration files. Dsic> Dsic> Dsic> Dsic> David Franco-Rocha Dsic> Dsic> Declude Technical / Engineering Dsic> Dsic> Dsic> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hardware Issue
Software and hardware breaks. Nothing is bulletproof. Some are just better than others. Monday, December 26, 2005, 11:50:20 AM, John T (Lists) <[EMAIL PROTECTED]> wrote: JTL> JTL> JTL> JTL> OUCH! JTL> JTL> JTL> JTL> Gee, I thought this is the kind of thing that we were told no way would happen. JTL> JTL> JTL> JTL> JTL> John T JTL> JTL> eServices For You JTL> JTL> JTL> JTL> JTL> JTL> -Original Message- JTL> From: [EMAIL PROTECTED] JTL> [mailto:[EMAIL PROTECTED] On Behalf Of David Franco-Rocha JTL> Sent: Monday, December 26, 2005 9:29 AM JTL> To: Declude.JunkMail@declude.com JTL> Cc: Declude.Virus@declude.com JTL> Subject: [Declude.JunkMail] Hardware Issue JTL> JTL> JTL> JTL> JTL> Due to the long holiday weekend, we have been away from the JTL> office for a few days. Unfortunately it has come to our attention JTL> that there could be a problem with key validation on the server JTL> there. After some testing, we have determined that there is in JTL> fact a hardware issue that we expect to have resolved today. JTL> JTL> JTL> JTL> JTL> JTL> JTL> JTL> We appreciate that you have taken the time to bring this matter JTL> to our attention and appreciate your patience while we rectify JTL> the situation. We will once again post to this list when the issue has been corrected. JTL> JTL> JTL> JTL> JTL> JTL> JTL> JTL> Declude Technical / Engineering JTL> JTL> JTL> JTL> JTL> JTL> JTL> JTL> JTL> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] License Downgraded [was All I wan't for Christmas is not to be paged!)
There was no human intervention here. Perhaps there was on the Declude side of the equation. I have never liked the 'ET call home' method of license validation. It is a security risk on its face - nothing personal to Declude and it is something else that can break. A new license key upon each renewal would be better IMHO. Monday, December 26, 2005, 10:05:20 AM, Andy Schmidt <[EMAIL PROTECTED]> wrote: AS> Hi Darrell: AS> I had been assured by the highest authority that it would require HUMAN AS> intervention if there was ever going to be a licensing "mismatch" detected, AS> before the "remote deactivation" of a license. AS> We will need to watch for their explanation to see whether that policy has AS> now changed for the worse -- with the very obvious result everyone had been AS> fearful of (that any automatic process WILL fail at SOME point.) AS> I cannot afford to run mission critical applications 24x365, if I have to AS> blindly rely on the availability of third party resources that I know AS> nothing about. AS> Best Regards AS> Andy Schmidt AS> Phone: +1 201 934-3414 x20 (Business) AS> Fax:+1 201 934-9206 AS> -Original Message- AS> From: [EMAIL PROTECTED] AS> [mailto:[EMAIL PROTECTED] On Behalf Of Darrell AS> ([EMAIL PROTECTED]) AS> Sent: Monday, December 26, 2005 10:49 AM AS> To: Declude.JunkMail@declude.com AS> Subject: Re: [Declude.JunkMail] License Downgraded [was All I wan't for AS> Christmas is not to be paged!) AS> I sent an email back into support last night as I started having slow AS> processing again. I have reverted back to 2.0.6 and all is running well. >>From what I can tell (AND I COULD BE WRONG) it appears that the >>licensing AS> process is broke at the Declude end. I *think* one of the name servers they AS> run (ns.decludekey.us ) for a domain cphzkey.com is/was down over the AS> weekend. I am still waiting for support to respond. AS> I am not going to go into speculation about the licensing process, because I AS> don't want to feed any bad info because I have no idea how it works. AS> However, from what I troubleshoot on my system coupled with reviewing a AS> user.dmp/dr. watson from the decludeproc during the issue I feel comfortable AS> in saying my problems that I seen on my system over the weekend are caused AS> by a failure to validate its license. AS> Darrell AS> AS> Check out http://www.invariantsystems.com for utilities for Declude And AS> Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG AS> Integration, and Log Parsers. AS> - Original Message - AS> From: "Dave Doherty" <[EMAIL PROTECTED]> AS> To: AS> Sent: Monday, December 26, 2005 10:27 AM AS> Subject: Re: [Declude.JunkMail] License Downgraded [was All I wan't for AS> Christmas is not to be paged!) >> FWIW, >> >> We are not seeing this problem. >> >> -d >> >> >> - Original Message - >> From: "Don Brown" <[EMAIL PROTECTED]> >> To: ; <[EMAIL PROTECTED]> >> Sent: Monday, December 26, 2005 10:10 AM >> Subject: Re: [Declude.JunkMail] License Downgraded [was All I wan't >> for Christmas is not to be paged!) >> >> >>> Our install of Junkmail Pro is also running as standard. We've >>> rebooted several times and can't get it to restore to Pro. >>> >>> >>> Saturday, December 24, 2005, 10:36:37 PM, Darrell >>> ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: >>> Dsic> So here it is the night before Christmas and all though the >>> Dsic> house >>> not a >>> Dsic> creature was stirring not even a mouse. >>> Dsic> My pager starts going off incenstantly - so I jump up to see >>> Dsic> what's >>> the >>> Dsic> matter - oh my queues are filling up faster and faster... >>> Dsic> Sorry about that - maybe its the Christmas spirit that grabbed >>> me... >>> >>> Dsic> When I got into the server my proc folder was around 2500+ >>> Dsic> q*.smd >>> files. >>> Dsic> Thank god for QueueMon :) >>> >>> Dsic> At first I had no idea what was going on - my proc folder was >>> growing and >>> Dsic> growing. I checked the usual suspects (DNS, etc) and >>> Dsic> everything >>> was working >>> Dsic> fine. I started to sift through the logs and noticed a huge >>> Dsic> amount >>> of >>> Dsic> messages that were failing a lot of tests
Re: [Declude.JunkMail] License Downgraded [was All I wan't for Christmas is not to be paged!)
I upgraded to 3.05.22 from 3.05.20 and it cleared the issue, for now. Monday, December 26, 2005, 9:48:54 AM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> I sent an email back into support last night as I started having slow Dsic> processing again. I have reverted back to 2.0.6 and all is running well. >>From what I can tell (AND I COULD BE WRONG) it appears that the licensing Dsic> process is broke at the Declude end. I *think* one of the name servers they Dsic> run (ns.decludekey.us ) for a domain cphzkey.com is/was down over the Dsic> weekend. I am still waiting for support to respond. Dsic> I am not going to go into speculation about the licensing process, because I Dsic> don't want to feed any bad info because I have no idea how it works. Dsic> However, from what I troubleshoot on my system coupled with reviewing a Dsic> user.dmp/dr. watson from the decludeproc during the issue I feel comfortable Dsic> in saying my problems that I seen on my system over the weekend are caused Dsic> by a failure to validate its license. Dsic> Darrell Dsic> Dsic> Check out http://www.invariantsystems.com for utilities for Declude And Dsic> Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Dsic> Integration, and Log Parsers. Dsic> - Original Message - Dsic> From: "Dave Doherty" <[EMAIL PROTECTED]> Dsic> To: Dsic> Sent: Monday, December 26, 2005 10:27 AM Dsic> Subject: Re: [Declude.JunkMail] License Downgraded [was All I wan't for Dsic> Christmas is not to be paged!) >> FWIW, >> >> We are not seeing this problem. >> >> -d >> >> >> - Original Message - >> From: "Don Brown" <[EMAIL PROTECTED]> >> To: ; <[EMAIL PROTECTED]> >> Sent: Monday, December 26, 2005 10:10 AM >> Subject: Re: [Declude.JunkMail] License Downgraded [was All I wan't for >> Christmas is not to be paged!) >> >> >>> Our install of Junkmail Pro is also running as standard. We've >>> rebooted several times and can't get it to restore to Pro. >>> >>> >>> Saturday, December 24, 2005, 10:36:37 PM, Darrell >>> ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: >>> Dsic> So here it is the night before Christmas and all though the house >>> not a >>> Dsic> creature was stirring not even a mouse. >>> Dsic> My pager starts going off incenstantly - so I jump up to see what's >>> the >>> Dsic> matter - oh my queues are filling up faster and faster... >>> Dsic> Sorry about that - maybe its the Christmas spirit that grabbed >>> me... >>> >>> Dsic> When I got into the server my proc folder was around 2500+ q*.smd >>> files. >>> Dsic> Thank god for QueueMon :) >>> >>> Dsic> At first I had no idea what was going on - my proc folder was >>> growing and >>> Dsic> growing. I checked the usual suspects (DNS, etc) and everything >>> was working >>> Dsic> fine. I started to sift through the logs and noticed a huge amount >>> of >>> Dsic> messages that were failing a lot of tests and should have been held >>> or >>> Dsic> deleted but were being marked with "LAST ACTION=IGNORE". >>> >>> Dsic> I bumped up the log levels and started to see the following: >>> >>> Dsic> Sorry, filters [REVERSEWEIGHTDNS] are only available in Declude >>> JunkMail Pro >>> Dsic> Using [no] CFG file outgoing. Pro version required for outgoing >>> mail. >>> >>> Dsic> Not to mention I noticed messages being cleared very slowly. After >>> several >>> Dsic> restarts of the "Declude Proc" service things started to move >>> again - I am >>> Dsic> not sure if it was because of the multiple Declude proc restarts or >>> putting >>> Dsic> in the DNSOVERIDE command that we used back under 2.0.6 see - >>> Dsic> >>> http://www.mail-archive.com/declude.junkmail@declude.com/msg24661.html >>> >>> Dsic> After a couple of restarts of the decludeproc service and the >>> DNSOVERIDE >>> Dsic> command my Declude started working again as a PRO version and >>> messages >>> Dsic> started being blocked and processing very quickly. My queues than >>> cleared >>> Dsic> up. >>> >>> Dsic> I am a bit sick to my stomach over this as I leaked to my c
Re: [Declude.JunkMail] License Downgraded [was All I wan't for Christmas is not to be paged!)
Our install of Junkmail Pro is also running as standard. We've rebooted several times and can't get it to restore to Pro. Saturday, December 24, 2005, 10:36:37 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> So here it is the night before Christmas and all though the house not a Dsic> creature was stirring not even a mouse. Dsic> My pager starts going off incenstantly - so I jump up to see what's the Dsic> matter - oh my queues are filling up faster and faster... Dsic> Sorry about that - maybe its the Christmas spirit that grabbed me... Dsic> When I got into the server my proc folder was around 2500+ q*.smd files. Dsic> Thank god for QueueMon :) Dsic> At first I had no idea what was going on - my proc folder was growing and Dsic> growing. I checked the usual suspects (DNS, etc) and everything was working Dsic> fine. I started to sift through the logs and noticed a huge amount of Dsic> messages that were failing a lot of tests and should have been held or Dsic> deleted but were being marked with "LAST ACTION=IGNORE". Dsic> I bumped up the log levels and started to see the following: Dsic> Sorry, filters [REVERSEWEIGHTDNS] are only available in Declude JunkMail Pro Dsic> Using [no] CFG file outgoing. Pro version required for outgoing mail. Dsic> Not to mention I noticed messages being cleared very slowly. After several Dsic> restarts of the "Declude Proc" service things started to move again - I am Dsic> not sure if it was because of the multiple Declude proc restarts or putting Dsic> in the DNSOVERIDE command that we used back under 2.0.6 see - Dsic> http://www.mail-archive.com/declude.junkmail@declude.com/msg24661.html Dsic> After a couple of restarts of the decludeproc service and the DNSOVERIDE Dsic> command my Declude started working again as a PRO version and messages Dsic> started being blocked and processing very quickly. My queues than cleared Dsic> up. Dsic> I am a bit sick to my stomach over this as I leaked to my customers probably Dsic> 4-6K spam's over the entire 3 hour period from when this started to when it Dsic> was finished. I will have a bit of explaining to do I imagine on Tuesday if Dsic> not sooner. Dsic> Has anyone seen this? Any explanations on what could have caused this. I Dsic> just keep thinking what if I did not have monitoring to catch this in time - Dsic> I probably would not have checked the servers until Tuesday. My only guess Dsic> is that my server failed in the "phone home" license check and downgraded Dsic> itself. Dsic> Darrell Dsic> Dsic> Check out http://www.invariantsystems.com for utilities for Declude And Dsic> Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Dsic> Integration, and Log Parsers. Dsic> --- Dsic> [This E-mail was scanned for viruses by Declude EVA www.declude.com] Dsic> --- Dsic> This E-mail came from the Declude.JunkMail mailing list. To Dsic> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and Dsic> type "unsubscribe Declude.JunkMail". The archives can be found Dsic> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Decludeproc abend
I think so, too and I don't think it had anything to do with Microsoft, either. It was a common term around a mainframe shop. Wednesday, December 21, 2005, 4:09:03 PM, Darin Cox <[EMAIL PROTECTED]> wrote: DC> DC> DC> I thought that went further back than that. I remember hearing DC> it a lot from mainframe types prior to Windows 1.1early 80's... DC> DC> Darin. DC> DC> DC> DC> DC> DC> - Original Message - DC> From: Nick Hayer DC> DC> To: Declude.JunkMail@declude.com DC> DC> Sent: Wednesday, December 21, 2005 4:51 PM DC> DC> Subject: Re: [Declude.JunkMail] Decludeproc abend DC> DC> John T (Lists) wrote: DC> DC> DC> Is abend some kindof French word? DC> AbnormalEnding. - circa 1985 - coined with the introduction of Microsoft products. DC> -Nicko DC> DC> DC> DC> DC> ;) DC> DC> DC> DC> DC> JohnT DC> DC> eServices ForYou DC> DC> DC> DC> DC> -OriginalMessage- DC> From: [EMAIL PROTECTED] DC> [mailto:[EMAIL PROTECTED] On Behalf Of GoranJovanovic DC> Sent: Wednesday, December 21,2005 1:13PM DC> To: Declude.JunkMail@declude.com DC> Subject: [Declude.JunkMail] Decludeprocabend DC> DC> DC> DC> I have haddecludeproc 3.0.5.22 abend on me twice today. Is DC> there anything I should bedoing to capture information about DC> this? I have automatic restart enabled soit starts again but I DC> am not super happy with it abending. DC> DC> DC> DC> Any hints on what (ifanything) I can/should be doing? DC> DC> DC> DC> DC> GoranJovanovic DC> DC> OmegaNetwork Solutions DC> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Decludeproc abend
abend = crash. I remember when RAM was called core, too. Wednesday, December 21, 2005, 3:29:49 PM, Markus Gufler <[EMAIL PROTECTED]> wrote: MG> MG> MG> "abend" in German means "evening". MG> MG> MG> MG> good Abend! :-) MG> MG> Markus MG> MG> MG> MG> MG> MG> MG> MG> From: [EMAIL PROTECTED] MG> [mailto:[EMAIL PROTECTED] On Behalf Of John T(Lists) MG> Sent: Wednesday, December 21, 2005 10:23 PM MG> To: Declude.JunkMail@declude.com MG> Subject: RE: [Declude.JunkMail]Decludeproc abend MG> MG> MG> MG> Is abend some kindof French word? MG> MG> MG> MG> ;) MG> MG> MG> MG> MG> JohnT MG> MG> eServices ForYou MG> MG> MG> MG> MG> -OriginalMessage- MG> From: [EMAIL PROTECTED] MG> [mailto:[EMAIL PROTECTED] On Behalf Of GoranJovanovic MG> Sent: Wednesday, December 21,2005 1:13PM MG> To: Declude.JunkMail@declude.com MG> Subject: [Declude.JunkMail] Decludeprocabend MG> MG> MG> MG> I have haddecludeproc 3.0.5.22 abend on me twice today. Is MG> there anything I should bedoing to capture information about MG> this? I have automatic restart enabled soit starts again but I MG> am not super happy with it abending. MG> MG> MG> MG> Any hints on what (ifanything) I can/should be doing? MG> MG> MG> MG> MG> GoranJovanovic MG> MG> OmegaNetwork Solutions MG> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SBL Blocking FYI
Just as a FYI. SBL does block an entire /18, when only 1 or 2 /24's are responsible for sending Spam. What's worse is that if you have an assignment in that /18, but your IP's are totally clean (innocent bystander), they will Not remove the block for your Address Space. I know this for a fact, first hand. As a result, their list is surely going to produce many false positives, and that's too bad. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Interesting thought on some tests when a front end gateway is involved.
I think SPF worked correctly in your scenario, since SPF is based upon the envelope sender address and the delivering MTA (forwarding or originating). The problem here is that the wrong receiving MTA is doing the SPF check. |(A) Send MTA|>|(B) Rec MTA|>|(C) Rec MTA| SPF should be checked by server (B). I'd expect all SFP checks by Server (C) to fail when the SPF record in DNS is configured for a hard fail "-all", unless of course, there is some special coding so that the IP of (A) is used, instead of the IP of (B), in the SPF check. WRT your question about SPF, REVDNS and HELOBOGUS, when an inbound gateway is used, I'd expect HELOBOGUS to be useless, but for SPF and REVDNS to be functional. I'd like to know Declude's official response to your question, though. Friday, November 4, 2005, 5:09:14 AM, John T (Lists) <[EMAIL PROTECTED]> wrote: JTL> I sent an e-mail to a software vendor requesting answers to some questions. JTL> That message was rejected based on a SPF Fail. Yes, I have SPF records setup JTL> for my domains. So how did it fail, bad configuration on the recipient side. JTL> By reviewing the heads and the rejection notice, I found that my server JTL> handed the message of to the MX record for the recipient server as expected. JTL> However, the server listed in the MX then forwarded to a different e-mail JTL> address on a different server, mail13.atl.registeredsite.com. In this case, JTL> the MX record is a Imail 6.06 server. It appears that the Imail 6.06 server JTL> recorded its own IP address as being mine during the handshake. (Is this a JTL> known bug in Imail 6.06?) It appears that JTL> mail13.atl.registeredsite.com then JTL> tried to hand the message to mx03.csee.siteprotect.com, but that server ran JTL> a SPF query, found my record, saw that the connecting IP was 216.247.37.27 JTL> which is the IP for mail13.atl.registeredsite.com and correctly saw a SPF JTL> Fail. The problem is, it should not be looking at that IP since it was a JTL> forwarded message. Duh. The problem is why are they looking at the wrong IP? JTL> Now, my thought on Declude tests such as SPF, REVDNS, HELOBOGUS. If my JTL> server which is running those tests is sitting behind other servers of mine JTL> which are the front door gateway and MX records, and if I have SKIPIP and JTL> listing the IP of my gateway servers, does that effectively make those types JTL> of tests useless? JTL> SMTP (3090095d44d9) processing F:\Spool\q3090095d44d9.smd JTL> SMTP (3090095d44d9) [x] looking up recipientdomain.moc in HOSTS and MX JTL> SMTP (3090095d44d9) Trying recipientdomain.moc (0) JTL> SMTP (3090095d44d9) [x] Connecting socket to service on host JTL> using protocol JTL> SMTP (3090095d44d9) [x] using source IP for mail.eservicesforyou.net JTL> [67.94.227.39] JTL> SMTP (3090095d44d9) Connect recipientdomain.moc [216.25.47.197:25] (1) JTL> SMTP (3090095d44d9) 220 X1 NT-ESMTP Server mail.recipientdomain.moc JTL> (IMail 6.06 8010-10) JTL> SMTP (3090095d44d9) >EHLO mail.eservicesforyou.net JTL> SMTP (3090095d44d9) 250-mail.recipientdomain.moc says hello JTL> SMTP (3090095d44d9) 250-SIZE 0 JTL> SMTP (3090095d44d9) 250-8BITMIME JTL> SMTP (3090095d44d9) 250-DSN JTL> SMTP (3090095d44d9) 250-ETRN JTL> SMTP (3090095d44d9) 250 EXPN JTL> Received: from mail.recipientdomain.moc (mail.recipientdomain.moc JTL> [216.25.47.197]) JTL> by mail13.atl.registeredsite.com (8.12.11/8.12.11) with ESMTP id JTL> jA49vpJ2009604 JTL> for <[EMAIL PROTECTED]>; Fri, 4 Nov 2005 04:57:51 JTL> -0500 JTL> Received: from SMTP32-FWD by mail.recipientdomain.moc JTL> (SMTP32) id A03AC; Fri, 4 Nov 2005 04:57:50 -0500 JTL> Received: from mail.eservicesforyou.net [216.25.47.197] by JTL> mail.recipientdomain.moc with ESMTP JTL> (SMTPD32-6.06) id A09D5D1300B8; Fri, 04 Nov 2005 04:57:49 -0500 JTL> Received: from wks1 [192.168.16.11] by mail.eservicesforyou.net with ESMTP JTL> (SMTPD-8.20) id A09006A0; Fri, 04 Nov 2005 01:57:36 -0800 JTL> John T JTL> eServices For You JTL> --- JTL> This E-mail came from the Declude.JunkMail mailing list. To JTL> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JTL> type "unsubscribe Declude.JunkMail". The archives can be found JTL> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blackholes.us Dead
Blackholes.us no longer resolves and it looks like it is dead. I picked up this msg, among others, from google. <http://mail.stalker.com/Lists/CGatePro/Message/79169.html?Language=> Okean.com and br.countries.nerd.dk, cn.countries.nerd.dk and kr.countries.nerd.dk have been suggested. Anyone know of any other country BL's? Thanks, ---- Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Interesting spam footer
Just kids with more imagination than knowledge Sunday, September 18, 2005, 6:38:03 PM, Darin Cox <[EMAIL PROTECTED]> wrote: DC> DC> DC> Thought this was interesting... a spammer trying to use fear of DC> prosecution to stop people from reporting their email as spam. DC> DC> DC> DC> The spam was sent to a postmaster address never used for outgoing mail... DC> DC> DC> DC> Darin. DC> DC> DC> DC> = DC> IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGE DC> IN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003 DC> This is one of a number of commercial email messages that you, DC> or someone using your computer, agreed to receive this message DC> WARNING!!! DC> ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs DC> OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF DC> BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED DC> TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION DC> RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE DC> COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN DC> UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT DC> DC> DC> DC> DC> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Stop Multi-Hop Spam
What is the best way to catch this multi-hop Spam delivery? 195.146.36.25 is an open relay/proxy. Thanks, Received: from SMTP32-FWD by edataweb.net (SMTP32) id A77D004887CA3; Sat, 10 Sep 2005 01:06:08 -0500 Received: from SMTP32-FWD by edataweb.net (SMTP32) id A77120297027608B8; Sat, 10 Sep 2005 01:06:08 -0500 Received: from eforward4.name-services.com [64.74.96.246] by edataweb.net with ESMTP (SMTPD32-8.15) id A7122970276; Sat, 10 Sep 2005 01:02:58 -0500 Received: from c9mailgw22.amadis.com ([216.163.188.220]) by eforward4.name-services.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 9 Sep 2005 23:06:43 -0700 Received: from 216.163.188.58 (unknown [195.146.36.25]) by c9mailgw22.amadis.com (Postfix) with SMTP id 7E02E8BEC3 for <[EMAIL PROTECTED]>; Fri, 9 Sep 2005 23:00:38 -0700 (PDT) Received: from localhost.localdomain (HELO localhost.localdomain [127.0.0.1]) by darling.graffiti.net (Mostfix) with ESMTP id BAD5743BFF for <[EMAIL PROTECTED]>; Fri, 09 Sep 2005 17:54:11 -0100 Message-Id: <[EMAIL PROTECTED]> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT - iMail 7.x and Windows 2003
I don't see that as a big issue. They can't Auth when 'Account Access Disabled' is checked in the user gui. If the user has a POP box, uncheck 'Account Access Disabled' and use their unique password. If the user is for forwarding, then make sure that 'Account Access Disabled' is checked. They can't Auth, so they can't send. Thursday, September 8, 2005, 8:15:20 AM, Matt <[EMAIL PROTECTED]> wrote: M> M> One other thing to add to this. Ipswitch in their brilliance, M> decided to make a default password of "password" for any newly M> created account including root. One must take great care to change M> these otherwise they can become susceptible to AUTH hacking with a M> great deal of ease, and you then become essentially an open relay M> even though you are configured not to be. M> M> Matt M> M> M> M> Dan Horne wrote: M> M> Orin Wells <> wrote on Thursday, September 08, 2005 1:15 AM: M> M> M> Regarding telnet - apparently there is a problem with windows 2003 M> and iMail. If my source is correct one can telnet into a Windows M> 2003 system running iMail (pick a version) on port 25 and get by the M> authentication. Again, my source told me that neither Micosoft nor M> Ipswitch has come up with a way to stop this. It appears only to be M> a problem on Windows 2003, not Windows 2000. M> M> M> This is FUD and is patently false. Telnetting on port 25 is not true M> "telnet" which runs on port 23. When you connect on port 25 you are M> connecting to an SMTP session just like any other SMTP server. It is M> not possible to bypass Authentication in this manner. If your source is M> trying to do this from your network, and you have your network in the M> "relay mail for addresses" list, then no authentication is necessary. M> The proper way to test this would be to make the attempt from an outside M> network. If you have your relay settings set to anything other than "No M> mail relay" or "relay for addresses", then no authentication is M> necessary from any network and you ARE an open relay. Your source has M> his facts wrong. The OS (windows 2003/2000) has nothing to do with M> Imail's SMTP service and whether it requires auth. M> Dan Horne M> --- M> This E-mail came from the Declude.JunkMail mailing list. To M> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and M> type "unsubscribe Declude.JunkMail". The archives can be found M> at http://www.mail-archive.com. M> M> M> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 8.2
We upgraded to 8.21 and experienced an extremely slow smtp. It got so bad that connecting MTA's we giving up and retrying, when the message was actually received but Imail was too slow to acknowledge it. We rolled back to 8.15. That was on a box running 2003 WEB edition. We've since tested (o.k.) on 2000 Server (Std) and will be building a 2003 Server (Std) box for test/implementation. The tech at Ipswitch said they hadn't seen our issue before, but he didn't think the diff between Web and Std editions would make any difference, either. Friday, September 2, 2005, 11:37:47 AM, Timothy Bohen <[EMAIL PROTECTED]> wrote: TB> Ok of course I upgraded and never thought to check this mailing TB> list, I'm trying to catch up, but what are the issues with Declude TB> and Imail 8.2? Should I disable declude? TB> Big reason I'm asking is I'm getting slow delivery, wondering if TB> this is because of 8.2 and declude not getting along?? I'm running Declude 2.0.5 Thanks TB> TB> __ __ __ __ TB> Sent via the CMS Internet Webmail system at mail1.cmsinter.net TB> TB> TB> --- TB> This E-mail came from the Declude.JunkMail mailing list. To TB> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and TB> type "unsubscribe Declude.JunkMail". The archives can be found TB> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SMTP Delay
In the last few days, I have noticed a delay in the process of sending a message. It seems there is a delay until the actual Auth part of the sending process starts. Instead of it being more/less instantaneous, as usual, it may take a second or so for the client to deliver the mail to the smtp server. We are using port 587 on Imail 8.21. We are not running any virus scans, except on-demand via Declude 1.82. I haven't tested using port 25, yet, to see if there is any difference. Has anyone else seen this behavior? Thanks, ---- Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP4r Tests not running (RESOLVED)
I added this line to the global.cfg and the IP4R tests and all other
tests are now running:
HOP 0
The Declude Junkmail manual says "When set to 0 (the default), Declude
JunkMail uses the IP address of the mail server that connected to the
{MAILSERVER}."
Obviously, HOP 0 must not be the default, given the fact it had to be
set in the global.cfg, in order to get tests to run.
Thanks,
Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED] http://www.inetconcepts.net
(972) 788-2364Fax: (972) 788-5049
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP4r Tests not running
Imail 8.21, Declude 1.82. MS DNS is running on the same box as Imail. Imail is set to use 127.0.0.1 for DNS resolution. Declude is also set to use 127.0.0.1 for DNS resolution - in both the global.cfg and in the Declude.cfg. MS DNS is setup as a caching server, using forwarders. The forwarders are our 4 DNS servers. Imail is having no problems resolving, using 127.0.0.1. There is no problem resolving with NSlookup at the command prompt, either. Here's the start of a message in the Debug log: 08/22/2005 09:31:16.828 DNS: Set DNS server to 127.0.0.1 08/22/2005 09:31:16.828 Console turned OFF 08/22/2005 09:31:16.828 CFG: Bypassing IP 127.0.0.1. 08/22/2005 09:31:16.828 CFG: Bypassing IP 216.14.35.4. 08/22/2005 09:31:16.828 CFG: Bypassing IP 216.14.35.5. 08/22/2005 09:31:16.828 CFG: Bypassing IP 216.14.35.8. 08/22/2005 09:31:16.828 CFG: Setting XSENDER to ON 08/22/2005 09:31:16.828 CFG: Setting XSPOOLNAME to ON 08/22/2005 09:31:16.828 Setting AUTOWHITELIST to ON 08/22/2005 09:31:16.828 External test weighting set to 0 (antiweight 0) 08/22/2005 09:31:16.828 Declude v1.82 08/22/2005 09:31:16.828 Setting HOLD directory to: D:\IMail\spool\spam. 08/22/2005 09:31:16.828 Qe1b102140124 Declude JunkMail Pro Version Registered Here's more: 08/22/2005 09:31:16.875 Qe1b102140124 LOOKING FOR IP: Received: from pacific41.youroptinmail.c 08/22/2005 09:31:16.875 Qe1b102140124 Setting [IPTEXT] to 198.65.165.70 08/22/2005 09:31:16.875 Qe1b102140124 iptext now=198.65.165.70 08/22/2005 09:31:16.875 Qe1b102140124 Testing IP 198.65.165.70 08/22/2005 09:31:16.875 Qe1b102140124 Doing COUNTRYCHAIN=0 08/22/2005 09:31:16.875 Qe1b102140124 Handling Received: header 08/22/2005 09:31:16.875 Qe1b102140124 Got IP 198.65.165.70 08/22/2005 09:31:16.875 Qe1b102140124 Skipping received line (hop 0) 08/22/2005 09:31:16.875 Qe1b102140124 Time sent: 22 8 2005 12:1:31 GMT (zone was -0800; offset=480). Delta=149 minutes. 08/22/2005 09:31:16.875 Qe1b102140124 Time2: 22 8 2005 14:31:16 GMT (zone was -0800; offset=480). Delta=149 minutes. 08/22/2005 09:31:16.875 Qe1b102140124 Last line of headers: Content-type: text/html; chars 08/22/2005 09:31:17.000 Qe1b102140124 Test #12 [AHBL-HOP1] is same as Test #12 [AHBL-HOP1=127.0.0.9; 70.165.65.198.dnsbl.ahbl.org]. Answer=admins.sosdg.org.? 08/22/2005 09:31:17.000 Qe1b102140124 Test #26 [NJABL-HOP1] is same as Test #26 [NJABL-HOP1=127.0.0.3; 70.165.65.198.dnsbl.njabl.org]. Answer=help.njabl.org.? 08/22/2005 09:31:17.000 Qe1b102140124 DNSBL checks done 08/22/2005 09:31:17.000 Qe1b102140124 Test #0: DYNHELO [dynhelo] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #1: BLACKIP [ipfile] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #2: UCEPROTECRDO [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #3: UCEPROTECMUL [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #4: FILT-UCEPROTECT [filter] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #5: MXRATE-BLACK [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #6: MXRATE-PROBABLE [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #7: AHBLRELAYS [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #8: AHBLPROXIES [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #9: AHBLSOURCES [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #10: AHBLPSSL [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #11: AHBLFORMMAIL [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #12: AHBL-HOP1 [dnsbl] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #13: AHBLSHOOT [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #14: AHBLCOMPDDOS [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #15: AHBLCOMPRELAY [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #16: AHBLCOMPSCANNER [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #17: AHBLCOMPWORM [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #18: AHBLCOMPVIRUS [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #19: AHBLOTHER [ip4r] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Test #20: AHBLDOMAINS [rhsbl] - may skip-1 08/22/2005 09:31:17.000 Qe1b102140124 Testing RHSBL at mbox-bay.com.rhsbl.ahbl.org [0]. 08/22/2005 09:31:20.687 Qe1b102140124 Finished Final Test #20: AHBLDOMAINS [rhsbl] Wednesday, August 24, 2005, 10:10:23 PM, Darin Cox <[EMAIL PROTECTED]> wrote: DC> A few questions that may help shed light on the problem... DC> Which versions of IMail and Declude are you running? DC> Do the logs in DEBUG mode show anything regarding the DNS lookups? DC> Can you do these DNS lookups manually at a command prompt on the server? DC> Darin. DC> - Original Message - DC> From: &
Re: [Declude.JunkMail] IP4r Tests not running
No. They are not running either. Tuesday, August 23, 2005, 10:43:57 AM, Scott Fisher <[EMAIL PROTECTED]> wrote: SF> Are the dunhelo and blackip tests running? These aren't dns based tests. SF> - Original Message ----- SF> From: "Don Brown" <[EMAIL PROTECTED]> SF> To: SF> Sent: Wednesday, August 24, 2005 8:29 AM SF> Subject: [Declude.JunkMail] IP4r Tests not running >>I am looking for some trouble-shooting ideas. Our IP4R tests are Not >> running, but all other tests seem to be running fine. >> >> Imail 8.21, Declude 1.82 >> >> The below snip is from the Declude Junkmail log is Debug mode. Declude >> Support confirms that the log shows the IP4R tests are Not running and >> they have already looked at our configs and find no issues. The only >> trouble-shooting suggestion we have, right now, is to change the order >> of the tests in the Global.cfg, which shouldn't make any difference. >> >> There are no DNS failure errors in the log or anything else that would >> logically point to some potential issue. >> >> Any ideas? >> >> >> 08/24/2005 08:09:17.281 Q717402002ebf Test #0: DYNHELO [dynhelo] - may >> skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #1: BLACKIP [ipfile] - may >> skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #2: UCEPROTECRDO [ip4r] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #3: UCEPROTECMUL [ip4r] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #4: FILT-UCEPROTECT >> [filter] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #5: MXRATE-BLACK [ip4r] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #6: MXRATE-PROBABLE >> [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #7: AHBLRELAYS [ip4r] - may >> skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #8: AHBLPROXIES [ip4r] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #9: AHBLSOURCES [ip4r] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #10: AHBLPSSL [ip4r] - may >> skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #11: AHBLFORMMAIL [ip4r] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #12: AHBL-HOP1 [dnsbl] - >> may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #13: AHBLSHOOT [ip4r] - may >> skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #14: AHBLCOMPDDOS [ip4r] - >> may skip-1 >> >> >> >> Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> [EMAIL PROTECTED] http://www.inetconcepts.net >> (972) 788-2364Fax: (972) 788-5049 >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> SF> --- SF> This E-mail came from the Declude.JunkMail mailing list. To SF> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and SF> type "unsubscribe Declude.JunkMail". The archives can be found SF> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP4r Tests not running
C:\>nslookup yahoo.com localhost Server: localhost Address: 127.0.0.1 Non-authoritative answer: Name:yahoo.com Addresses: 66.94.234.13, 216.109.112.135 C:\> C:\>nslookup august.net localhost Server: localhost Address: 127.0.0.1 Name:august.net Address: 216.87.129.110 C:\> Wednesday, August 24, 2005, 8:35:06 AM, Markus Gufler <[EMAIL PROTECTED]> wrote: MG> What happens if you nslookup from the imail/declude server to your MG> configured Nameservers and querry something? MG> Markus >> -Original Message- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown >> Sent: Wednesday, August 24, 2005 3:29 PM >> To: Declude.JunkMail@declude.com >> Subject: [Declude.JunkMail] IP4r Tests not running >> >> I am looking for some trouble-shooting ideas. Our IP4R tests >> are Not running, but all other tests seem to be running fine. >> >> Imail 8.21, Declude 1.82 >> >> The below snip is from the Declude Junkmail log is Debug >> mode. Declude Support confirms that the log shows the IP4R >> tests are Not running and they have already looked at our >> configs and find no issues. The only trouble-shooting >> suggestion we have, right now, is to change the order of the >> tests in the Global.cfg, which shouldn't make any difference. >> >> There are no DNS failure errors in the log or anything else >> that would logically point to some potential issue. >> >> Any ideas? >> >> >> 08/24/2005 08:09:17.281 Q717402002ebf Test #0: DYNHELO >> [dynhelo] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #1: BLACKIP >> [ipfile] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #2: >> UCEPROTECRDO [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #3: >> UCEPROTECMUL [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #4: >> FILT-UCEPROTECT [filter] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #5: >> MXRATE-BLACK [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #6: >> MXRATE-PROBABLE [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #7: AHBLRELAYS >> [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #8: >> AHBLPROXIES [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #9: >> AHBLSOURCES [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #10: AHBLPSSL >> [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #11: >> AHBLFORMMAIL [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #12: AHBL-HOP1 >> [dnsbl] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #13: AHBLSHOOT >> [ip4r] - may skip-1 >> 08/24/2005 08:09:17.281 Q717402002ebf Test #14: >> AHBLCOMPDDOS [ip4r] - may skip-1 >> >> >> >> Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> [EMAIL PROTECTED] http://www.inetconcepts.net >> (972) 788-2364Fax: (972) 788-5049 >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be >> found at http://www.mail-archive.com. >> MG> --- MG> This E-mail came from the Declude.JunkMail mailing list. To MG> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and MG> type "unsubscribe Declude.JunkMail". The archives can be found MG> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP4r Tests not running
I copied the global.cfg and deleted every test except Spamcop. I put that global.cfg in production, with Logging Debug. The log showed: '08/24/2005 19:24:27.077 Q0fa700978875 Test #0: SPAMCOP [ip4r] - may skip-1' There was no indication in the log that the test ever ran for several messages. Could this be a licensing issue, where 'ET (Declude) call home' can't get through our firewall and has, therefore, shut down most/all tests? Is this yet another issue due to the re-engineering of Imail? I'd guess not. There has to be some explanation for this behavior and my guess is that it will be something simple/stupid, as usual. We've paid for support agreements for a number of years and we have a paid support agreement in place now. So, you may be wondering why I've come to the list for some ideas about how to trouble-shoot this issue. Well, I guess my expectations are just too high. I expected that when I turned in a trouble ticket on this issue on Aug 4th, I'd be a bit further along. The only advice, so far, is to change the order of the tests in the global.cfg, which shouldn't make any difference, anyway. That's called a 'brush off.' Well, I did more than that by just trying to get one test to run. Yes, of course, we sent Debug logs and a copy of our config files. Maybe the focus really is on the new release. It surely can't be on support and customer service. In fact, I'll bet that's what our customers are saying about us, right now, with the increased flow of junk to their POP boxes. There was a time, a long time, when I couldn't say enough about Declude, the support and the continuing innovation. I don't do that anymore and I sure am not about to resell any of the products to any more of our customers, either. I am really disappointed in what has happened to what used to be a fine product and a fine organization -- even if that organization was only Scott. What matters is the result - not the marketing, window dressing or the other hype. I didn't intend to write all of this when I started. Frustration and disappointment are both understatements. Get nickle whiskey, Barry - the beer isn't going to cut it. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IP4r Tests not running
I am looking for some trouble-shooting ideas. Our IP4R tests are Not running, but all other tests seem to be running fine. Imail 8.21, Declude 1.82 The below snip is from the Declude Junkmail log is Debug mode. Declude Support confirms that the log shows the IP4R tests are Not running and they have already looked at our configs and find no issues. The only trouble-shooting suggestion we have, right now, is to change the order of the tests in the Global.cfg, which shouldn't make any difference. There are no DNS failure errors in the log or anything else that would logically point to some potential issue. Any ideas? 08/24/2005 08:09:17.281 Q717402002ebf Test #0: DYNHELO [dynhelo] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #1: BLACKIP [ipfile] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #2: UCEPROTECRDO [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #3: UCEPROTECMUL [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #4: FILT-UCEPROTECT [filter] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #5: MXRATE-BLACK [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #6: MXRATE-PROBABLE [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #7: AHBLRELAYS [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #8: AHBLPROXIES [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #9: AHBLSOURCES [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #10: AHBLPSSL [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #11: AHBLFORMMAIL [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #12: AHBL-HOP1 [dnsbl] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #13: AHBLSHOOT [ip4r] - may skip-1 08/24/2005 08:09:17.281 Q717402002ebf Test #14: AHBLCOMPDDOS [ip4r] - may skip-1 ---- Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP Blacklist Help
Wednesday, August 10, 2005, 9:58:05 AM, Matt <[EMAIL PROTECTED]> wrote: M> M> Don, M> M> Maybe try looking in the log to see if there are any errors. No errors. M> Check your global.cfg for multiple test entries named BLACKIP. Only one. M> Unless something has changed, I don't believe the following lines are appropriate for an ipfile: M> M> SKIPIFWEIGHT 30 M> MAXWEIGHT 30 M> STOPATFIRSTHIT The release notes say filters only. I removed those from the IP file. M> M> Maybe also remove the "#" following the CIDR range as this might M> be causing a parsing error and it is not required. Anything after M> the IP/CIDR range and a space is treated as a comment. Maybe M> shorten your comments also to see if you can't isolate a condition that would cause this to miss. Done. M> P.S. Please don't press Reply-All as that caused me to reply M> directly to you before getting the copy that was sent to the list. o.k. M> M> Matt M> M> M> M> M> M> Don Brown wrote: M> M> No. There is a line break. Any other ideas? M> Wednesday, August 10, 2005, 9:14:04 AM, Matt <[EMAIL PROTECTED]> wrote: M>> Just guessing that there might not be a line break in your IPFILE after M>> that line. M>> Matt M>> Don Brown wrote: M> M> M> M> Anyone see any reason why 30 points wasn't assessed from the IP Black M> list? Running Junkmail Pro 2.0.6.16 M> Received: from SMTP32-FWD by inetconcepts.net M> (SMTP32) id AC77C106B02A4EC42; Wed, 10 Aug 2005 04:23:18 -0500 M> Received: from peace.happysupport.com [70.84.49.210] by inetconcepts.net with ESMTP M> (SMTPD32-8.14) id A77C106B02A4; Wed, 10 Aug 2005 04:23:08 -0500 M> Received: from nobody by peace.happysupport.com with local (Exim 4.51) M> id 1E2mij-0006ZF-Hy M> for [EMAIL PROTECTED]; Wed, 10 Aug 2005 04:17:57 -0500 M> To: [EMAIL PROTECTED]: Domain Notification: Frank M> Graham This is your Final Notice of Domain Listing M> From: Domain Updates <[EMAIL PROTECTED]>MIME-Version: 1.0 M> Content-Type: text/html; M> X-Mailer: ESUB M> Priority: High M> Importance: High M> Precedence: FINALNOTlCE M> Message-Id: <[EMAIL PROTECTED]>Date: Wed, 10 Aug 2005 04:17:57 -0500 M> X-cPanel-MailScanner-Information: Please contact the ISP for more information M> X-cPanel-MailScanner: Not scanned: please contact your Internet M> E-Mail Service Provider for details M> X-cPanel-MailScanner-SpamCheck: M> X-MailScanner-From: [EMAIL PROTECTED]: This M> header was added to track abuse, please include it with any abuse report M> X-AntiAbuse: Primary Hostname - peace.happysupport.com M> X-AntiAbuse: Original Domain - inetconcepts.net M> X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] M> X-AntiAbuse: Sender Address Domain - empiredatatech.com M> X-Source: M> X-Source-Args: M> X-Source-Dir: M> X-Declude-Sender: [EMAIL PROTECTED] [70.84.49.210] M> X-Declude-Spoolname: DC77C106B02A4EC42.SMD M> X-Note: This E-mail was sent from peace.happysupport.com ([70.84.49.210]). M> X-Note: The Server Helo Handshake was . M> X-Note: Mail-From support.empiredatatech.com. M> X-Note: Mail-From for Spam Reporting is [EMAIL PROTECTED] M> X-Note: Initial Recipients: [EMAIL PROTECTED] M> X-Note: Final Recipients: [EMAIL PROTECTED] M> X-Note: Origin Country - UNITED STATES->destination. M> X-Note: Failed: SPFUNKNOWN [0], HELOBOGUS [5], LONGSUBJECT [4]. M> X-Note: Total Failed Weight: 9. Version: 2.0.6.16. M> X-Note: Checked for SPAM and Viruses by Internet Concepts® - http://www.inetconcepts.net. M> X-RCPT-TO: <[EMAIL PROTECTED]>Status: U M> X-UIDL: 397067606 M> -- M> Global Config: M> BLACKIP ipfile D:\IMail\Declude\_BlackLists\IPBlack.txt x 30 0 M> - M> IPBlack.txt: # Version>>= 1.27i28: Skip the test if weight is reached M> SKIPIFWEIGHT 30 # Version>>= 1.27i28: Exit the test if weight is reached M> MAXWEIGHT 30 M> STOPATFIRSTHIT M> # M> # There is no limit to the Number of entries in this file M> # Spamming Locations, the get delete weight M> # M> # M> 70.84.49.208/29 # Planet Space - Allocated to HappySupport in GB - M> Bogus ANNUAL WEBSITE SEARCH ENGINE LISTING M> M> Don Brown - Dallas, Texas USA Internet Concepts, M> [EMAIL PROTECTED] http://www.inetconcepts.net(972) M> 788-2364Fax: (972) 788-5049 M> M> --- M> This E-mail came from the Declude.JunkMail mailing list. To M> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and M> type "unsubscribe Declude.JunkMail". The archives can be found M> at http://ww
Re: [Declude.JunkMail] IP Blacklist Help
No. There is a line break. Any other ideas? Wednesday, August 10, 2005, 9:14:04 AM, Matt <[EMAIL PROTECTED]> wrote: M> Just guessing that there might not be a line break in your IPFILE after M> that line. M> Matt M> Don Brown wrote: >>Anyone see any reason why 30 points wasn't assessed from the IP Black >>list? Running Junkmail Pro 2.0.6.16 >> >> >>Received: from SMTP32-FWD by inetconcepts.net >>(SMTP32) id AC77C106B02A4EC42; Wed, 10 Aug 2005 04:23:18 -0500 >>Received: from peace.happysupport.com [70.84.49.210] by inetconcepts.net with >>ESMTP >>(SMTPD32-8.14) id A77C106B02A4; Wed, 10 Aug 2005 04:23:08 -0500 >>Received: from nobody by peace.happysupport.com with local (Exim 4.51) >>id 1E2mij-0006ZF-Hy >>for [EMAIL PROTECTED]; Wed, 10 Aug 2005 04:17:57 -0500 >>To: [EMAIL PROTECTED] >>Subject: Domain Notification: Frank Graham This is your Final Notice of >>Domain Listing >>From: Domain Updates <[EMAIL PROTECTED]> >>MIME-Version: 1.0 >>Content-Type: text/html; >>X-Mailer: ESUB >>Priority: High >>Importance: High >>Precedence: FINALNOTlCE >>Message-Id: <[EMAIL PROTECTED]> >>Date: Wed, 10 Aug 2005 04:17:57 -0500 >>X-cPanel-MailScanner-Information: Please contact the ISP for more information >>X-cPanel-MailScanner: Not scanned: please contact your Internet E-Mail >>Service Provider for details >>X-cPanel-MailScanner-SpamCheck: >>X-MailScanner-From: [EMAIL PROTECTED] >>X-AntiAbuse: This header was added to track abuse, please include it with any >>abuse report >>X-AntiAbuse: Primary Hostname - peace.happysupport.com >>X-AntiAbuse: Original Domain - inetconcepts.net >>X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] >>X-AntiAbuse: Sender Address Domain - empiredatatech.com >>X-Source: >>X-Source-Args: >>X-Source-Dir: >>X-Declude-Sender: [EMAIL PROTECTED] [70.84.49.210] >>X-Declude-Spoolname: DC77C106B02A4EC42.SMD >>X-Note: This E-mail was sent from peace.happysupport.com ([70.84.49.210]). >>X-Note: The Server Helo Handshake was . >>X-Note: Mail-From support.empiredatatech.com. >>X-Note: Mail-From for Spam Reporting is [EMAIL PROTECTED] >>X-Note: Initial Recipients: [EMAIL PROTECTED] >>X-Note: Final Recipients: [EMAIL PROTECTED] >>X-Note: Origin Country - UNITED STATES->destination. >>X-Note: Failed: SPFUNKNOWN [0], HELOBOGUS [5], LONGSUBJECT [4]. >>X-Note: Total Failed Weight: 9. Version: 2.0.6.16. >>X-Note: Checked for SPAM and Viruses by Internet Concepts® - >>http://www.inetconcepts.net. >>X-RCPT-TO: <[EMAIL PROTECTED]> >>Status: U >>X-UIDL: 397067606 >> >>-- >> >>Global Config: >> >>BLACKIP ipfile D:\IMail\Declude\_BlackLists\IPBlack.txt x 30 0 >> >>- >> >>IPBlack.txt: >> >># Version>= 1.27i28: Skip the test if weight is reached >>SKIPIFWEIGHT 30 >># Version>= 1.27i28: Exit the test if weight is reached >>MAXWEIGHT 30 >>STOPATFIRSTHIT >># >># There is no limit to the Number of entries in this file >># Spamming Locations, the get delete weight >># >># >>70.84.49.208/29 # Planet Space - Allocated to HappySupport in GB - Bogus >>ANNUAL WEBSITE SEARCH ENGINE LISTING >> >> >> >> >>Don Brown - Dallas, Texas USA Internet Concepts, Inc. >>[EMAIL PROTECTED] http://www.inetconcepts.net >>(972) 788-2364Fax: (972) 788-5049 >> >> >>--- >>This E-mail came from the Declude.JunkMail mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.JunkMail". The archives can be found >>at http://www.mail-archive.com. >> >> >> >> M> --- M> This E-mail came from the Declude.JunkMail mailing list. To M> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and M> type "unsubscribe Declude.JunkMail". The archives can be found M> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IP Blacklist Help
Anyone see any reason why 30 points wasn't assessed from the IP Black list? Running Junkmail Pro 2.0.6.16 Received: from SMTP32-FWD by inetconcepts.net (SMTP32) id AC77C106B02A4EC42; Wed, 10 Aug 2005 04:23:18 -0500 Received: from peace.happysupport.com [70.84.49.210] by inetconcepts.net with ESMTP (SMTPD32-8.14) id A77C106B02A4; Wed, 10 Aug 2005 04:23:08 -0500 Received: from nobody by peace.happysupport.com with local (Exim 4.51) id 1E2mij-0006ZF-Hy for [EMAIL PROTECTED]; Wed, 10 Aug 2005 04:17:57 -0500 To: [EMAIL PROTECTED] Subject: Domain Notification: Frank Graham This is your Final Notice of Domain Listing From: Domain Updates <[EMAIL PROTECTED]> MIME-Version: 1.0 Content-Type: text/html; X-Mailer: ESUB Priority: High Importance: High Precedence: FINALNOTlCE Message-Id: <[EMAIL PROTECTED]> Date: Wed, 10 Aug 2005 04:17:57 -0500 X-cPanel-MailScanner-Information: Please contact the ISP for more information X-cPanel-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details X-cPanel-MailScanner-SpamCheck: X-MailScanner-From: [EMAIL PROTECTED] X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - peace.happysupport.com X-AntiAbuse: Original Domain - inetconcepts.net X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - empiredatatech.com X-Source: X-Source-Args: X-Source-Dir: X-Declude-Sender: [EMAIL PROTECTED] [70.84.49.210] X-Declude-Spoolname: DC77C106B02A4EC42.SMD X-Note: This E-mail was sent from peace.happysupport.com ([70.84.49.210]). X-Note: The Server Helo Handshake was . X-Note: Mail-From support.empiredatatech.com. X-Note: Mail-From for Spam Reporting is [EMAIL PROTECTED] X-Note: Initial Recipients: [EMAIL PROTECTED] X-Note: Final Recipients: [EMAIL PROTECTED] X-Note: Origin Country - UNITED STATES->destination. X-Note: Failed: SPFUNKNOWN [0], HELOBOGUS [5], LONGSUBJECT [4]. X-Note: Total Failed Weight: 9. Version: 2.0.6.16. X-Note: Checked for SPAM and Viruses by Internet Concepts® - http://www.inetconcepts.net. X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 397067606 -- Global Config: BLACKIP ipfile D:\IMail\Declude\_BlackLists\IPBlack.txt x 30 0 - IPBlack.txt: # Version>= 1.27i28: Skip the test if weight is reached SKIPIFWEIGHT 30 # Version>= 1.27i28: Exit the test if weight is reached MAXWEIGHT 30 STOPATFIRSTHIT # # There is no limit to the Number of entries in this file # Spamming Locations, the get delete weight # # 70.84.49.208/29 # Planet Space - Allocated to HappySupport in GB - Bogus ANNUAL WEBSITE SEARCH ENGINE LISTING Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IP Blacklist
What's the difference between: pub.mxrate.net and pub.senderdb.net Tuesday, August 9, 2005, 11:37:21 AM, Chris Kuske <[EMAIL PROTECTED]> wrote: CK> A shameless plug, but here goes since we have quite a few Declude users CK> now that we're on the default IP4r test list... CK> Check out MXRate, at http://www.mxrate.com CK> We have a public DNS test that outperforms SBL/Spamcop on a consistent CK> basis, and can also offer our list for subscription with hourly updates. CK> As an added bonus, we don't block entire subnets which gets other CK> blacklists in trouble (like SORBS, for example). We can provide Bind 9 CK> zone files as well. CK> If you use our list and purchase the MXRate server software, you can CK> also customize the threshold for what IP address is returned when CK> queried (127.0.0.2 .3 .4 etc). CK> Also, you can also have IPs tagged by what country they originate from CK> which is useful if you only want to get email from the US for example. CK> Chris Kuske CK> Solid Oak Software, Inc. CK> www.mxrate.net CK> www.alligate.com CK> Richard Farris wrote: >> Is there a good IP Blacklist that can be downloaded everyday that is >> constantly updated..thanxs..I noticed that all the spam I got today was >> from the same block 216.41.254.0/24 >> >> Richard Farris >> Ethixs Online >> 1.270.247. Office >> 1.800.548.3877 Tech Support >> "Crossroads to a Cleaner Internet" CK> --- CK> This E-mail came from the Declude.JunkMail mailing list. To CK> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and CK> type "unsubscribe Declude.JunkMail". The archives can be found CK> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] PIDDEBUG
Could Scott be the proverbial Calvary? That would be good. Friday, August 5, 2005, 5:20:20 PM, Michael Hardrick <[EMAIL PROTECTED]> wrote: MH> I'm just curious when this bug will be fixed. It was reported months ago. MH> I've got three more months left on my support contract and don't think I'm MH> going to renew if it takes six months for the Declude dev team to fix one MH> bug. Sorry yall, but my confidence is waning. I was told some time ago MH> this would be a quick fix. Well, weeks have now turned into months. MH> I hope this doesn't end up in file #13 along with the new manual. MH> Mike H MH> TNWEB MH> -Original Message- MH> From: [EMAIL PROTECTED] MH> [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff MH> (Lists) MH> Sent: Friday, August 05, 2005 13:50 MH> To: Declude.JunkMail@declude.com MH> Subject: [Declude.JunkMail] PIDDEBUG MH> Is PIDDEBUG still available to use in 2.0.6.x? MH> I am seeing a problem where after a couple days I notice there are 15 MH> Declude processes running but not doing anything. This is on the 0xc142 MH> error. There are no Q or D files in limbo. I can not stop the processes, I MH> must restart the server. (This is remotely through TS.) MH> I am wondering if turning PIDDEBUG will help track down the problem with MH> those errors. MH> John T MH> eServices For You MH> --- MH> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, MH> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe MH> Declude.JunkMail". The archives can be found at MH> http://www.mail-archive.com. MH> --- MH> [This E-mail scanned for viruses at TNWEB LLC] MH> --- MH> [This E-mail scanned for viruses at TNWEB LLC] MH> --- MH> This E-mail came from the Declude.JunkMail mailing list. To MH> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and MH> type "unsubscribe Declude.JunkMail". The archives can be found MH> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses
One of the expenses of living in a democracy is that the courts are open to everyone; even to the spammers and the other parasites of society. It's not cause for alarm when it's recognized that there will always be those who take unfair advantage and abuse privilege. That reality is a good reason for there to be cops and courts. However, what is increasing cause for alarm is when people are denied equal access to the courts, by well lobbied politicians who set caps and grant immunity for those with the gold at the expense of the people they are suppose to be serving. Thanks, Wednesday, May 18, 2005, 7:55:52 PM, Matt <[EMAIL PROTECTED]> wrote: M>[Snip] M> On the other hand, I'm also very alarmed at how the courts M> have been so accepting of SLAPP suits brought by spammers against M> the blacklists. The net outcome is that the spammer always wins M> regardless of the outcome unless the courts hold them liable for M> the defense's costs, and those are rarely enough to cover actual M> expenses and time, nor have I heard of it happening. M> Matt M> Don Brown wrote: M> [Snip] Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses
I think you're reading more into it than is there. Verizon didn't deliver what it promised or, to say it differently, Verizon didn't deliver what their customers had a reasonable expectation of receiving. That's the issue. The allegation, and I think it is probably true, is that Verizon indiscriminately decided to block the IP space of certain countries. We also block the IP space of Korea, China - you know the list, but the difference is that all of our customers know we do it and don't have a problem with it. We only have a couple of customers who want mail from certain of the bad venues and we don't block those venues WRT their mail delivery. As long as your customers buy into what you are doing or at least know up front, there is no issue with blocking countries or doing just about anything else. No damage has been done to anyone. OTOH, when some refugee from McDonalds tech tells the customer that's what we're doing and tough luck, well, that's where the rubber meets the road. A class action makes sense because the individual damages are probably small, but there are a lot of customers who were affected. Yeah, the lawyers will make a lot of money, but if it wasn't for them, all of us Mickey Rooney sized peons wouldn't have a snow ball's chance to make the Jolly Green Giant stop stepping on all our rose bushes. All of our customers want us to do whatever we can to kill the flow of Spam. They know there will be some false positives, but we deal with them on a case by case basis. My $0.02 FWIW. Thanks, Wednesday, May 18, 2005, 1:56:02 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> This kinda scares me. Could this potentially set a precedence that Dsic> companies can be sued for blocking mail? i.e. You get sued for blocking Dsic> mail. We all block some legitimate mail at some point.. Thats the nature Dsic> of the game. Dsic> Darrell Dsic> -- Dsic> invURIBL - Intelligent URI filtering plug-in for Declude. Stops 85%+ of Dsic> SPAM with the default configuration. Download it today - Dsic> http://www.invariantsystems.com Dsic> Marc Catuogno writes: >> >> That is f-ed up right there... >> >> The damned lawyers are gonna get rich and every VZ customer will get a >> coupon for a free day of service. >> >> Marc >> >> -Original Message- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] On Behalf Of Darrell >> ([EMAIL PROTECTED]) >> Sent: Wednesday, May 18, 2005 2:02 PM >> To: Declude.JunkMail@declude.com >> Subject: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail >>>From Foreign IP Addresses >> >> Verizon Communications has been hit with several lawsuits as a result of the >> >> company's policy of blocking email from IP addresses in foreign countries in >> >> an effort to reduce spam. The complaint asks that Verizon cease blocking >> email and that it compensate customers for losses on behalf of business >> customers. A second class action lawsuit was filed on behalf of residential >> >> customers. In addition, a New Jersey businessman has filed a lawsuit >> against Verizon because he says his email has been blocked from getting to >> his customers. >> >> http://www.securitypipeline.com/showArticle.jhtml?articleID=163101524 >> >> >> >> DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus. >> Download a copy today - http://www.invariantsystems.com >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> --- >> [This E-mail scanned for viruses by Declude Virus] >> >> >> >> --- >> [This E-mail scanned for viruses by Declude Virus] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. Dsic> Dsic> Dsic> Check out http://www.invariantsystems.com for utilities for Declude And Dsic> Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Dsic> Integration, and Log Parsers. Dsic> --- Dsic> This E-mail came from the Declude.JunkMail mailing list. To Dsic> uns
Re: [Declude.JunkMail] [157-09FD1BD3-C20C] Tests Running when WhiteListed
Exactly which WhiteLists do NOT prevent tests from running with PREWHITELIST ON? -OR- If it is easier, exactly which Whitelists DO prevent tests from running with PREWHITELIST ON? I think the entry WHITELIST IP 64.90.56.0/23 with PREWHITELIST ON is a case in which test should NOT be run. I'll copy the list to see if anyone agrees/disagrees from experience (I don't remember for sure). Thanks, Monday, May 16, 2005, 1:16:44 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: sdc> Don, sdc> The JunkMail manual contains the following regarding the PREWHITELIST ON directive: sdc> This option takes one parameter, ON, which indicates that sdc> Declude JunkMail should try to run whitelists before tests are sdc> run. If the E-mail is whitelisted, the tests should not be run. sdc> Note: sdc> [1] not all whitelists will be run this way, in which case sdc> the E-mail will be whitelisted but the tests will be run. sdc> [2] some people do not want this option enabled (to ensure sdc> that external tests are run on legitimate mail, too). sdc> David Franco-Rocha sdc> Declude Technical Support sdc> From: Don Brown <[EMAIL PROTECTED]> sdc> Sent: Sun, 08 May 2005 11:30:36 -0500 sdc> To: [EMAIL PROTECTED] sdc> Subject: Re: [157-09FD1BD3-C20C] Tests Running when WhiteListed sdc> Yes it was whitelisted, but after tests were ran. sdc> Monday, May 2, 2005, 2:15:49 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: sdc>> Don, sdc>> We are still looking into the sequence of events regarding sdc>> test execution and whitelisting. sdc>> In the interim, please confirm that this email was in fact sdc>> whitelisted, as the logs would seem to indicate. Thanks. sdc>> From: Don Brown <[EMAIL PROTECTED]> sdc>> Sent: Tue, 26 Apr 2005 16:23:06 -0500 sdc>> To: [EMAIL PROTECTED] sdc>> Subject: Re: [157-09FD1BD3-C20C] Tests Running when WhiteListed sdc>> 64.90.56.0/24 and 64.90.57.0/24 a/k/a 64.90.56.0/23 sdc>> From the log entries listed below sdc>> 04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - sdc>> automatically passing all spam tests [64.90.56.0/23] sdc>> You'll see from in our global.cnf sdc>> WHITELIST IP 64.90.56.0/23 # Anything from Our Address Space sdc>> Thanks, sdc>> Tuesday, April 26, 2005, 3:45:31 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: sdc>>> Don, sdc>>> What is the range of addresses you are trying to whitelist? sdc>>> 88.88.88.0/88 is not a valid CIDR range specification. sdc>>> From: Don Brown <[EMAIL PROTECTED]> sdc>>> Sent: Tue, 26 Apr 2005 14:50:31 -0500 sdc>>> To: [EMAIL PROTECTED] sdc>>> Subject: Re: [157-09FD1BD3-C20C] Tests Running when WhiteListed sdc>>> Here is the actual log entries. This was a form to e-mail, which was sdc>>> generated from a web site on our network. The e-mail did not auth, sdc>>> but was whitelisted by the IP address. The tests ran before the sdc>>> whitelist kicked in. sdc>>> 04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 sdc>>> SPAMHEADERS:6 FILT-HELO:30 . Total weight = 42. sdc>>> 04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - sdc>>> automatically passing all spam tests [64.90.56.0/23] sdc>>> 04/23/2005 14:27:06 QA1881154025C35BA Subject: Form Submission sdc>>> 04/23/2005 14:27:06 QA1881154025C35BA From: sdc>>> [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: sdc>>> 64.90.56.14 ID: sdc>>> 04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for sdc>>> [EMAIL PROTECTED] = WHITELISTED [LAST ACTION=WHITELISTED] sdc>>> 04/23/2005 14:27:06 QA1881154025C35BA Cumulative action(s) sdc>>> taken on this email = NO ACTIONS WERE TAKEN sdc>>> Tuesday, April 26, 2005, 12:46:25 PM, sdc>>> [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: sdc>>>> Are you running 2.0.6? If so please do a Declude -diagsend sdc>>>> at the command line, if you have a previous version, please do a sdc>>>> Declude -diag > c:\declude.txt and send us the txt file, your cfg sdc>>>> files and your junkmail files. sdc>>>> Please contact me if you have any other questions. sdc>>>> Thank you, sdc>>>> Ralph Krausse sdc>>>> (978)-499-2933 sdc>>>> From: Don Brown <[EMAIL PROTECTED]> sdc>>>> Sent: Sat, 23 Apr 2005 14:44:35 -0500 sdc>>>> To: Declude.JunkMail@declude.com sdc>>>> Subject: Tests Running when WhiteListed sdc>>>> The below log entries tend to indicate that tests, including sdc>>>> filter tests, are running, when the mail is whitelisted. Below are sdc>>>&
[Declude.JunkMail] %WEIGHT% is broken - v 2.0.6.12 (Pro)
In $default$.junkmail, "WEIGHT10 SUBJECT [SPAM %WEIGHT%]" used to change the subject line to: "[SPAM 30] Quality Opportunity in 24 hours." The new version now changes it to: "[SPAMQuality Opportunity in 24 hours." Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [06E-0A14DA25-BC32] WHITELIST LOCAL v2.0.6.12
What I'm saying is that mail from outside to local users is getting whitelisted. Below is alog snip and the header of one. Please also note that the tests were run, even though the e-mail was whitelisted. 05/11/2005 14:09:42 Q5849100902EC85DC AHBLDOMAINS:6 CMDSPACE:10 DYNHELO:10 INV-URIBL:70 . Total weight = 96. 05/11/2005 14:09:42 Q5849100902EC85DC E-mail whitelisted - automatically passing all spam tests [] 05/11/2005 14:09:42 Q5849100902EC85DC Tests failed [weight=0]: 05/11/2005 14:09:42 Q5849100902EC85DC Subject: Lowest rate approval 05/11/2005 14:09:42 Q5849100902EC85DC From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 83.132.72.248 ID: 9CC2A77D4B 05/11/2005 14:09:42 Q5849100902EC85DC Action(s) taken for [EMAIL PROTECTED] = WHITELISTED [LAST ACTION=WHITELISTED] 05/11/2005 14:09:42 Q5849100902EC85DC Tests failed [weight=0]: 05/11/2005 14:09:42 Q5849100902EC85DC Subject: Lowest rate approval 05/11/2005 14:09:42 Q5849100902EC85DC From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 83.132.72.248 ID: 9CC2A77D4B 05/11/2005 14:09:42 Q5849100902EC85DC Action(s) taken for [EMAIL PROTECTED] = WHITELISTED [LAST ACTION=WHITELISTED] 05/11/2005 14:09:42 Q5849100902EC85DC Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN Received: from a83-132-72-248.netcabo.pt [83.132.72.248] by inetconcepts.net (SMTPD32-8.14) id A84E100902EC; Wed, 11 May 2005 14:09:02 -0500 Delivered-To: [EMAIL PROTECTED] Received: from dillon.dreamhost.com by droop.dreamhost.com (Pingofix) with ESMTP id 9CC2A77D4B for <[EMAIL PROTECTED]>; Wed, 11 May 2005 23:04:15 +0300 Message-ID: <[EMAIL PROTECTED]> Date: Wed, 11 May 2005 22:01:15 +0200 From: "Zachery Fowler" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Lowest rate approval X-Mailer: Mailman v2.0.6 X-SpamTest-Info: Profile: Formal (167/041162) X-SpamTest-Info: Profile: Detect Hard No RBL (4/030548) X-Declude-Sender: [EMAIL PROTECTED] [83.132.72.248] X-Declude-Spoolname: D5849100902EC85DC.SMD X-Note: This E-mail was sent from (timeout) ([83.132.72.248]). X-Note: The Server Helo Handshake was a83-132-72-248.netcabo.pt. X-Note: Mail-From wagar.yebox.com. X-Note: Mail-From for Spam Reporting is [EMAIL PROTECTED] X-Note: Initial Recipients: [EMAIL PROTECTED], [EMAIL PROTECTED] X-Note: Final Recipients: [EMAIL PROTECTED], [EMAIL PROTECTED] X-Note: Origin Country - PORTUGAL->destination. X-Note: Failed: Whitelisted. X-Note: Total Failed Weight: 0. Version: 2.0.6.12. X-Note: Checked for SPAM and Viruses by Internet Concepts® - http://www.inetconcepts.net. X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 391874040 Wednesday, May 11, 2005, 3:08:21 PM, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: sdc> That is in act how WHITELIST LOCAL is supposed to work sdc> (local -> local). We will look at the code for this. sdc> From: Don Brown <[EMAIL PROTECTED]> sdc> Sent: Wed, 11 May 2005 14:58:45 -0500 sdc> To: Declude.JunkMail@declude.com sdc> Subject: WHITELIST LOCAL v2.0.6.12 sdc> I added WHITELIST LOCAL to the Global.cfg and all (and I mean ALL) sdc> inbound e-mail to local users was whitelisted. sdc> My read was that this would whitelist e-mail from local users to other sdc> local users. Is that not correct? sdc> Thanks, sdc> sdc> Don Brown - Dallas, Texas USA Internet Concepts, Inc. sdc> [EMAIL PROTECTED] http://www.inetconcepts.net sdc> (972) 788-2364 Fax: (972) 788-5049 sdc> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WHITELIST LOCAL v2.0.6.12
I added WHITELIST LOCAL to the Global.cfg and all (and I mean ALL) inbound e-mail to local users was whitelisted. My read was that this would whitelist e-mail from local users to other local users. Is that not correct? Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Tests Running when WhiteListed
The IP Address for the failure I noted was in our own address space. The log shows that whitelist Auth works and Whitelisting of foreign address space (like this listserve) seems to works. Looks like the prob has something to do with local address space. Saturday, April 23, 2005, 10:22:16 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> The whitelisted IP address is in foreign address space. Dsic> Darrell Dsic> Don Brown writes: >> The the whitelisted IP in your own IP address space or was it a >> foreign IP address? >> >> >> Saturday, April 23, 2005, 4:20:51 PM, Darrell >> ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: >> Dsic> The IP in question for the line I showed was listed in the global.cfg >> and >> Dsic> after the associated PREWHITELIST / and other WHITELIST options. >> >> Dsic> Darrell >> Dsic> --- >> Dsic> Check out http://www.invariantsystems.com for utilities for Declude And >> Dsic> Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, >> SURBL/URI >> Dsic> integration, MRTG Integration, and Log Parsers. >> >> Dsic> - Original Message - >> Dsic> From: "Don Brown" <[EMAIL PROTECTED]> >> Dsic> To: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> >> Dsic> Cc: >> Dsic> Sent: Saturday, April 23, 2005 5:05 PM >> Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed >> >> >>>> O.K. Where do you have that whitelisted IP address configured? Is it >>>> a line item in the global config. like mine was or is it elsewhere? >>>> >>>> The line item white list entries and all of the other items i >>>> previously listed from the global.cfg, appear long before any tests >>>> are configured in the global.cfg. >>>> >>>> >>>> >>>> Saturday, April 23, 2005, 3:19:11 PM, Darrell >> Dsic> ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: >>>> Dsic> PREWHITELIST ON is working on 2.0.6 for me. >>>> >>>> Dsic> 04/23/2005 23:59:59 Qb45c04ab008c9990 Skipping E-mail from IP >>>> Dsic> xxx.xxx.xxx.xxx ; whitelisted >>>> >>>> Dsic> Looking in the manual it indicates this >>>> Dsic> "This option takes one parameter, ON, which indicates that Declude >> Dsic> JunkMail >>>> Dsic> should try to run whitelists before tests are run. If the E-mail is >>>> Dsic> whitelisted, the tests should not be run. Note that [1] not all >> Dsic> whitelists >>>> Dsic> will be run this way (check the code to see which are run), in which >> Dsic> case >>>> Dsic> the E-mail will be whitelisted but the tests will be run, an " >>>> >>>> Dsic> I suspect the (check code to see which are run) is an internal >> Dsic> comment and >>>> Dsic> was suppose to indicate the circumstances under which prewhitelist >> Dsic> does not >>>> Dsic> kick in. >>>> >>>> Dsic> Darrell >>>> Dsic> --- >>>> Dsic> DLAnalyzer - Comprehensive Declude Junkmail and Virus reporting - >>>> Dsic> http://www.invariantsystems.com >>>> >>>> >>>> Dsic> - Original Message - >>>> Dsic> From: "Matt" <[EMAIL PROTECTED]> >>>> Dsic> To: >>>> Dsic> Sent: Saturday, April 23, 2005 4:09 PM >>>> Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed >>>> >>>> >>>> >> If PREWHITELIST ON stopped working in 2.06, that would definitely be a >>>> >> bummer. Good E-mail being scanned takes the most processing power on >>>> >> systems with SKIPIFWEIGHT settings and other similar mechanisms, and >>>> >> whitelisting all AUTH traffic or things from one's address space is >>>> >> fairly important if you want to save processing power. Maybe the >> Dsic> change >>>> >> explains why some have reported a spike in CPU utilization??? >>>> >> >>>> >> IMO, with the switch PREWHITELIST ON, processing of an E-mail should be >>>> >> stopped and handled as a whitelisted item as soon as a condition is >>>> >> met. Understandably some conditions are met much sooner than others >> Dsic> a
Re: [Declude.JunkMail] Tests Running when WhiteListed
The the whitelisted IP in your own IP address space or was it a foreign IP address? Saturday, April 23, 2005, 4:20:51 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> The IP in question for the line I showed was listed in the global.cfg and Dsic> after the associated PREWHITELIST / and other WHITELIST options. Dsic> Darrell Dsic> --- Dsic> Check out http://www.invariantsystems.com for utilities for Declude And Dsic> Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI Dsic> integration, MRTG Integration, and Log Parsers. Dsic> - Original Message - Dsic> From: "Don Brown" <[EMAIL PROTECTED]> Dsic> To: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> Dsic> Cc: Dsic> Sent: Saturday, April 23, 2005 5:05 PM Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed >> O.K. Where do you have that whitelisted IP address configured? Is it >> a line item in the global config. like mine was or is it elsewhere? >> >> The line item white list entries and all of the other items i >> previously listed from the global.cfg, appear long before any tests >> are configured in the global.cfg. >> >> >> >> Saturday, April 23, 2005, 3:19:11 PM, Darrell Dsic> ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: >> Dsic> PREWHITELIST ON is working on 2.0.6 for me. >> >> Dsic> 04/23/2005 23:59:59 Qb45c04ab008c9990 Skipping E-mail from IP >> Dsic> xxx.xxx.xxx.xxx ; whitelisted >> >> Dsic> Looking in the manual it indicates this >> Dsic> "This option takes one parameter, ON, which indicates that Declude Dsic> JunkMail >> Dsic> should try to run whitelists before tests are run. If the E-mail is >> Dsic> whitelisted, the tests should not be run. Note that [1] not all Dsic> whitelists >> Dsic> will be run this way (check the code to see which are run), in which Dsic> case >> Dsic> the E-mail will be whitelisted but the tests will be run, an " >> >> Dsic> I suspect the (check code to see which are run) is an internal Dsic> comment and >> Dsic> was suppose to indicate the circumstances under which prewhitelist Dsic> does not >> Dsic> kick in. >> >> Dsic> Darrell >> Dsic> --- >> Dsic> DLAnalyzer - Comprehensive Declude Junkmail and Virus reporting - >> Dsic> http://www.invariantsystems.com >> >> >> Dsic> - Original Message - >> Dsic> From: "Matt" <[EMAIL PROTECTED]> >> Dsic> To: >> Dsic> Sent: Saturday, April 23, 2005 4:09 PM >> Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed >> >> >> >> If PREWHITELIST ON stopped working in 2.06, that would definitely be a >> >> bummer. Good E-mail being scanned takes the most processing power on >> >> systems with SKIPIFWEIGHT settings and other similar mechanisms, and >> >> whitelisting all AUTH traffic or things from one's address space is >> >> fairly important if you want to save processing power. Maybe the Dsic> change >> >> explains why some have reported a spike in CPU utilization??? >> >> >> >> IMO, with the switch PREWHITELIST ON, processing of an E-mail should be >> >> stopped and handled as a whitelisted item as soon as a condition is >> >> met. Understandably some conditions are met much sooner than others Dsic> and >> >> not all whitelisting used to work like that, but it would be nice if it >> Dsic> did. >> >> >> >> Matt >> >> >> >> >> >> >> >> Don Brown wrote: >> >> >> >> >The below log entries tend to indicate that tests, including >> >> >filter tests, are running, when the mail is whitelisted. Below are >> >> >snips (in order) from the Global.cfg. PreWhiteList is ON. >> >> > >> >> >This apparently started with the 2.X upgrade. According to the logs >> >> >before the upgrade, the below whitelist was preventing tests from >> >> >running - in 2.x the test are obviously running. >> >> > >> >> >04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6 >> Dsic> FILT-HELO:30 . Total weight = 42. >> >> >04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - Dsic> automatically >> Dsic> passing all spam tests [88.88.88.0/88] >> >> >04/23/2005 14:27:06 QA1881154025C35BA
Re: [Declude.JunkMail] Tests Running when WhiteListed
O.K. Where do you have that whitelisted IP address configured? Is it a line item in the global config. like mine was or is it elsewhere? The line item white list entries and all of the other items i previously listed from the global.cfg, appear long before any tests are configured in the global.cfg. Saturday, April 23, 2005, 3:19:11 PM, Darrell ([EMAIL PROTECTED]) <[EMAIL PROTECTED]> wrote: Dsic> PREWHITELIST ON is working on 2.0.6 for me. Dsic> 04/23/2005 23:59:59 Qb45c04ab008c9990 Skipping E-mail from IP Dsic> xxx.xxx.xxx.xxx ; whitelisted Dsic> Looking in the manual it indicates this Dsic> "This option takes one parameter, ON, which indicates that Declude JunkMail Dsic> should try to run whitelists before tests are run. If the E-mail is Dsic> whitelisted, the tests should not be run. Note that [1] not all whitelists Dsic> will be run this way (check the code to see which are run), in which case Dsic> the E-mail will be whitelisted but the tests will be run, an " Dsic> I suspect the (check code to see which are run) is an internal comment and Dsic> was suppose to indicate the circumstances under which prewhitelist does not Dsic> kick in. Dsic> Darrell Dsic> --- Dsic> DLAnalyzer - Comprehensive Declude Junkmail and Virus reporting - Dsic> http://www.invariantsystems.com Dsic> - Original Message - Dsic> From: "Matt" <[EMAIL PROTECTED]> Dsic> To: Dsic> Sent: Saturday, April 23, 2005 4:09 PM Dsic> Subject: Re: [Declude.JunkMail] Tests Running when WhiteListed >> If PREWHITELIST ON stopped working in 2.06, that would definitely be a >> bummer. Good E-mail being scanned takes the most processing power on >> systems with SKIPIFWEIGHT settings and other similar mechanisms, and >> whitelisting all AUTH traffic or things from one's address space is >> fairly important if you want to save processing power. Maybe the change >> explains why some have reported a spike in CPU utilization??? >> >> IMO, with the switch PREWHITELIST ON, processing of an E-mail should be >> stopped and handled as a whitelisted item as soon as a condition is >> met. Understandably some conditions are met much sooner than others and >> not all whitelisting used to work like that, but it would be nice if it Dsic> did. >> >> Matt >> >> >> >> Don Brown wrote: >> >> >The below log entries tend to indicate that tests, including >> >filter tests, are running, when the mail is whitelisted. Below are >> >snips (in order) from the Global.cfg. PreWhiteList is ON. >> > >> >This apparently started with the 2.X upgrade. According to the logs >> >before the upgrade, the below whitelist was preventing tests from >> >running - in 2.x the test are obviously running. >> > >> >04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6 Dsic> FILT-HELO:30 . Total weight = 42. >> >04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - automatically Dsic> passing all spam tests [88.88.88.0/88] >> >04/23/2005 14:27:06 QA1881154025C35BA Subject: subject >> >04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To: [EMAIL >> >PROTECTED] Dsic> IP: 88.88.88.89 ID: >> >04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for [EMAIL PROTECTED] Dsic> = WHITELISTED [LAST ACTION=WHITELISTED] >> > >> >Snips from the Global.cfg >> ># WHITELIST AUTH automatically whitelists authenticated senders (for Dsic> IMail v8 and later). >> >WHITELIST AUTH >> ># Whitelist all entries in users Imail address book >> >AUTOWHITELIST ON >> ># Automatically bypass spam tests for E-mail from whitelisted IPs or Dsic> whitelisted return addresses. >> >PREWHITELISTON >> ># Per Domain Whitelist Files - >> \Imail\Declude\example.com\whitelist.txt >> >DOMAINWHITELISTSON >> >WHITELIST IP 88.88.88.0/88 # Anything from Our Dsic> Address Space >> > >> > >> > >> > >> >Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> >[EMAIL PROTECTED] http://www.inetconcepts.net >> >(972) 788-2364Fax: (972) 788-5049 >> > >> > >> >--- >> >This E-mail came from the Declude.JunkMail mailing list. To >> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> >type "unsubscribe Declude.JunkMail". The archives can be found >> >at http://www.mail-archive.com. >> > >> > >> > >> > >> >> -- >> =
[Declude.JunkMail] Tests Running when WhiteListed
The below log entries tend to indicate that tests, including filter tests, are running, when the mail is whitelisted. Below are snips (in order) from the Global.cfg. PreWhiteList is ON. This apparently started with the 2.X upgrade. According to the logs before the upgrade, the below whitelist was preventing tests from running - in 2.x the test are obviously running. 04/23/2005 14:27:06 QA1881154025C35BA BADHEADERS:6 SPAMHEADERS:6 FILT-HELO:30 . Total weight = 42. 04/23/2005 14:27:06 QA1881154025C35BA E-mail whitelisted - automatically passing all spam tests [88.88.88.0/88] 04/23/2005 14:27:06 QA1881154025C35BA Subject: subject 04/23/2005 14:27:06 QA1881154025C35BA From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 88.88.88.89 ID: 04/23/2005 14:27:06 QA1881154025C35BA Action(s) taken for [EMAIL PROTECTED] = WHITELISTED [LAST ACTION=WHITELISTED] Snips from the Global.cfg # WHITELIST AUTH automatically whitelists authenticated senders (for IMail v8 and later). WHITELIST AUTH # Whitelist all entries in users Imail address book AUTOWHITELIST ON # Automatically bypass spam tests for E-mail from whitelisted IPs or whitelisted return addresses. PREWHITELISTON # Per Domain Whitelist Files - \Imail\Declude\example.com\whitelist.txt DOMAINWHITELISTSON WHITELIST IP 88.88.88.0/88 # Anything from Our Address Space Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SMD Files
SMTP is a chatty protocol and it's likely that connectivity problems will show up with SMTP and POP, before they are detected with most other protocols. These connection issues could easily be the client's problem, due to a faulty T-1 connection, i.e. dirty bandwidth, a failing local loop (SBC is famous for using anything for a bridge tap in our venue), etc. The left over T files, however, point to the problem being on your end. Check your router for CRC, Framing and other data comm errors as well as interface resets and lost carrier. Most routers have counters you can display. In my experience, that's the most likely cause of the problem. If the router is clean, then start eliminating the other possibilities on the circuit to your mail server. Ipswitch will tell you to replace your NIC with a high dollar 3COM card. (I think Tech support reps gets that tattooed on the back of their hand, as a pre-requisite to being hired.) That's more likely to be a rabbit trail, which frees up a tech support line and engineer. There's no silver bullet, unfortunately. You just need to start eliminating possibilities, starting with the most likely and followed by the simple-stupid things like even patch cords. HTH Thanks, Saturday, April 23, 2005, 1:40:53 AM, Kyle Fisher <[EMAIL PROTECTED]> wrote: KF> Ok thanks John. Why do you think this just started happening KF> the past 3 days I went from about 200 spool files to 1000 during KF> the day and then 2 days later there are all of those left over KF> files. KF> KF> Do you mean the SMTP session from the client. I have had KF> some complaints (for about two weeks) from clients (connected by KF> T1) saying they are getting SMTP errors occasionally. They have KF> there client set to check mail every 5 minutes and throughout the KF> day they get SMTP connection errors. KF> KF> I mean I really dont know I am just searching at this point, but thanks for the info KF> KF> Kyle KF> KF> From: [EMAIL PROTECTED] KF> [mailto:[EMAIL PROTECTED] On Behalf Of John KF> Tolmachoff (Lists) KF> Sent: Saturday, April 23, 2005 12:28 AM KF> To:Declude.JunkMail@declude.com KF> Subject: RE: [Declude.JunkMail] SMD Files KF> KF> T files are incomplete Q files, where by some how the SMTP KF> session was not completed. They along with the associated D file KF> can be deleted. The reason it looks like they have already been KF> sent is that the sending server/user upon disconnection of the KF> SMTP session the resent the message in full. KF> KF> John T KF> eServices For You KF> KF> -Original Message- KF> From: [EMAIL PROTECTED] KF> [mailto:[EMAIL PROTECTED] On Behalf Of Kyle KF> Fisher KF> Sent: Friday, April 22, 2005 2:49 PM KF> To:Declude.JunkMail@declude.com KF> Subject: RE: [Declude.JunkMail] SMD Files KF> KF> Looking at some of these it looks like they have already been KF> sent and it is trying to resend them again. Also in some of these KF> it is going to [EMAIL PROTECTED] KF> KF> From: [EMAIL PROTECTED] KF> [mailto:[EMAIL PROTECTED] On Behalf Of Kyle KF> Fisher KF> Sent: Friday, April 22, 2005 3:50 PM KF> To:Declude.JunkMail@declude.com KF> Subject: [Declude.JunkMail] SMD Files KF> KF> I am trying to find the article that explains the build up of KF> Txx.smd and Dxx.smd files in the spool directory. The KF> past few days I have quite a few of these hanging around in the KF> spool directory. KF> KF> Here is a sample of whats in the files. Some are from my KF> local clients and some or from other mail servers. KF> KF> Kyle KF> KF> Imail 8.15 KF> 2.0.6 Junkmail and Antivirus KF> 3.16b F-Prot KF> Message Sniffer 2.3 KF> KF> D03bc03690136cf5a.SMD KF> KF> Received: from gwmsrm42 [172.16.52.2] by esc5.net with ESMTP KF> (SMTPD32-8.15) id A3BC3690136; Thu, 21 Apr 2005 14:49:16 -0500 KF> KF> KF> T03bc03690136cf5a.SMD KF> KF> QD:\IMail\spool\D03bc03690136cf5a.SMD KF> Hesc5.net KF> I03bc03690136cf5a KF> X1 KF> WE:\IMail KF> E0, KF> R<[EMAIL PROTECTED]> KF> S<[EMAIL PROTECTED]> KF> NRCPT TO: <[EMAIL PROTECTED]> KF> R<[EMAIL PROTECTED]> KF> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Legalities of adding header info
As a practical matter, I think the client has a reasonable expectation that blind copies will be blind, unless your terms or policies state otherwise and he has agreed to those terms or policies. You should talk to a lawyer, if this issue is really a concern. Friday, April 8, 2005, 9:16:35 AM, Dan Horne <[EMAIL PROTECTED]> wrote: DH> I have a customer that is PO'ed at us. We put the recipients of emails DH> into the headers of every email using Declude's %ALLRECIPS% variable. DH> This is so we can identify the people who incorrectly report us as DH> spammers to AOL just because we forward their mail for them. Since AOL DH> strips that out, we use Declude to figure out who the message was sent DH> to. DH> So this customer gets a bounce message from an email he sent to his DH> clients making extensive use of BCC:. In the headers of the bounced DH> email, he saw his whole client list. Now he's PO'ed, threatening legal DH> action, etc, claiming we are "intentionally forwarding identifying DH> information a user thought was confidential". DH> Any thoughts on the legal liabilities of bypassing the BCC: DH> functionality in this way? My supes has tasked me with finding out DH> about our responsibility in this matter (the email admin instead of the DH> lawyer, natch). DH> -Dan Horne DH> --- DH> This E-mail came from the Declude.JunkMail mailing list. To DH> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DH> type "unsubscribe Declude.JunkMail". The archives can be found DH> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Version 1.80 Logfile Changes
Tuesday, September 28, 2004, 3:48:59 PM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >>>Details? Are you seeing the "Message OK" lines? >> >>Typical log entries: >> >>09/28/2004 15:59:07 Qc28b026d0172aa34 L1 Message OK RSP> Is this with "LOG_OK NONE"? That line should prevent this log file entry RSP> from appearing. RSP> The others, such as Subject/From/etc. should appear if you are using RSP> LOGLEVEL HIGH, though (with or without LOG_OK NONE). RSP> -Scott We're using LOG_OK NONE and LOGLEVEL MID. The Subject/From/etc. lines are still written to the log (That's good - NOT asking for that to change.) The only time we see the 'L1 Message OK' is when the e-mail did fail a test, but it either had a weight of 0 or it was whitelisted, and the Subject/From/etc. lines are also written (no prob there, either). I initially thought the Subject/From/etc. were taken out of Log MID and added to Log HIGH. Hope that wasn't the intent . . . Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hotmail not accept inbound mail?
substitute 'backup' for the 'www' in the url. Tuesday, May 18, 2004, 8:14:36 AM, Jeff Maze <[EMAIL PROTECTED]> wrote: JM> When clicking the link below, I get a "unable to connect to server" (using JM> Opera 7.5).. JM> -Original Message- JM> From: [EMAIL PROTECTED] JM> [mailto:[EMAIL PROTECTED] On Behalf Of Robert JM> Sent: Tuesday, May 18, 2004 9:05 AM JM> To: [EMAIL PROTECTED] JM> Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail? JM> dnsreprots.com hasn't worked for two day for me. JM> the link doesn't work either? JM> I keep getting different pages that want to see me free web space. JM> Is it just me? JM> Robert JM> - Original Message - JM> From: David Lewis-Waller <[EMAIL PROTECTED]> JM> To: <[EMAIL PROTECTED]> JM> Sent: Tuesday, May 18, 2004 5:52 AM JM> Subject: RE: [Declude.JunkMail] Hotmail not accept inbound mail? >> This looks like it's an ongoing, long term issue. DNReports MX >> connection problems. >> >> http://www.dnsreport.com/tools/dnsreport.ch?domain=hotmail.com >> >> >> > -Original Message- >> > From: [EMAIL PROTECTED] >> > [mailto:[EMAIL PROTECTED] On Behalf Of Rick >> > Davidson >> > Sent: 11 May 2004 20:29 >> > To: [EMAIL PROTECTED] >> > Subject: Re: [Declude.JunkMail] Hotmail not accept inbound mail? >> > >> > Yep hotmail is not accepting from us either, I am seeing connection >> > resets from them >> > >> > Rick Davidson >> > National Systems Manager >> > North American Title Group >> > - >> > - Original Message - >> > From: "Colbeck, Andrew" <[EMAIL PROTECTED]> >> > To: <[EMAIL PROTECTED]> >> > Sent: Tuesday, May 11, 2004 2:44 PM >> > Subject: [Declude.JunkMail] Hotmail not accept inbound mail? >> > >> >> --- >> [This E-mail was scanned for viruses by Declude Virus JM> (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type >> "unsubscribe Declude.JunkMail". The archives can be found at >> http://www.mail-archive.com. >> JM> --- JM> [This E-mail was scanned for viruses by Declude Virus JM> (http://www.declude.com)] JM> --- JM> This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, JM> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe JM> Declude.JunkMail". The archives can be found at JM> http://www.mail-archive.com. JM> --- JM> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] JM> --- JM> This E-mail came from the Declude.JunkMail mailing list. To JM> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and JM> type "unsubscribe Declude.JunkMail". The archives can be found JM> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Misunderstood DUL/DYNA
Being able to whitelist "all" users is important. This can be done with Imail 8 and by using WHITELISTED AUTH in Declude's Global.cfg. However, whether or not "all" users do actually AUTH, still depends upon the SMTP SECURITY setting in Imail 8. For instance, if SMTP SECURITY is set to relay for addresses, then some users may not AUTH and, therefore, not get whitelisted with WHITELIST AUTH. Thanks, Monday, May 17, 2004, 10:48:27 AM, Matt <[EMAIL PROTECTED]> wrote: M> Andy, M> I think there is some confusion here on your part. M> What was discovered and initially discussed in this thread M> though isthat Declude will not test the last hot with such tests M> when the Mail>From matches a local address. That was also good M> design, but if youcan whitelist all local senders, it is best to M> turn this off. Asuitable work around for this issue has been M> provided. The work aroundthat was discussed will only test the M> last hop. When Decludeuses the %IP4R% variable, this comes from M> the connecting IP (unlessIPBYPASSed), and there is only one value M> tested. M> Matt M> Andy Schmidt wrote: M> >> You don't haveto remove the tests, you just have to M> rename them. I renamed mine withDYN, that way Declude doesn't see M> them as matching DUL/DYNA/DUHL andtherefore will not skip them when M> the Mail From matches a local address. << M> M> But Matt - please correct me if I'm wrong. Ibelieve we manage M> to talk about two different things. You are focusedon the LAST hop M> - but I believe, you have lost sight of the purpose ofDUL/DYNA/DUHL M> - which is the FIRST hop. M> M> Let's look at a sample to make sure thatwe're talking apples and apples: M> M> Sender: [EMAIL PROTECTED] M> 2nd hop: M> smtp.cable.com -> mymailserver.andy.com M> 1st hop: M> some-dynamic-ip-host.cable.com ->smtp.cable.com M> M> The "some-dynamic-ip-host.cable.com" islisted in the M> "DYNA/DUHL" lists - and it should be. M> M> As long as I have "DYNA/DUHL" in the name,Declude will NOT M> test the first hop - e.g., it will correctlypermit the rest of the M> world to reach me through their providers' SMTPservers. The M> DYNA/DUHL tests only test the 2nd and subsequent hops- because M> THOSE should not be on a blacklist. Most importantly, theytest the M> LAST hop (the one to my mail server) - because a DYNA/DUHL IPshould M> never try to relay off me (unless it's using SMTP AUTH). M> M> Now, if I were to follow your example andremove DYNA/DUHL M> from the name, then these tests will also test theFIRST hop - and M> thus I'd be swamped with false positives for anydialup/broadband M> user who CORRECTLY uses his/her provider's smtp server. M> M> M> It seems that you are focused only on theLAST hop - but by M> removing DYNA/DUHL from the name, you end up hurtingthe FIRST hop. M> M> The "conditional" check at the lasthop was NOT the reason to M> introduce DYNA/DUHL, that's just a quirky"quick-fix" which should M> be optional for those who don't need thisbackdoor open. The reason M> for DYNA/DUHL was proper handling of the first hop - and that's why M> it can't be removed. M> Best Regards M> Andy Schmidt M> H M Systems Software, Inc. M> 600 East Crescent Avenue, Suite 203 M> Upper Saddle River, NJ 07458-1846 M> Phone: +1 201 934-3414x20 (Business) M> Fax: +1 201 934-9206 M> http://www.HM-Software.com/ Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank
Hi Andy, Look at the example, again and note the %IP4R%. That tests ONLY the 1st HOP (or for clarity, the IP which delivered the mail to your server). "Change this: NJABL-DUL ip4r dnsbl.njabl.org 127.0.0.3 10 0 To this: NJABL-HOP1 dnsbl %IP4R%.dnsbl.njabl.org 127.0.0.3 10 0" Saturday, May 15, 2004, 5:01:47 PM, Andy Schmidt <[EMAIL PROTECTED]> wrote: >>> Then, in either cases, scanning the first hop is a simple matter of AS> changing the test name to eliminate the reserved string of DUL, DYNA or DUHL AS> and using the hack which Matt found. << AS> NO - removing DUL/DYNA/DUHL is NOT an option. Because MUCH of the private AS> emails originate from some address that is on that list - but only on the AS> FIRST hope. Thus, the DUL/DYNA/DUHL skip tests on the FIRST hop! AS> They can't be omitted - otherwise we'd block most private mail relayed AS> through other providers SMTP servers. AS> Best Regards AS> Andy Schmidt AS> Phone: +1 201 934-3414 x20 (Business) AS> Fax:+1 201 934-9206 AS> -Original Message----- AS> From: [EMAIL PROTECTED] AS> [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown AS> Sent: Saturday, May 15, 2004 04:19 PM AS> To: Matt AS> Cc: [EMAIL PROTECTED] AS> Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank AS> This wasn't a bug or a larger issue of Declude trust based upon the 'from AS> Address.' There was no choice but to skip DUL/DYNA/DUHL tests (which were AS> the only ones skipped) when the 'from address' was spoofed as a local AS> address. Imail 8 and WHITELIST AUTH help, but they don't solve this issue, AS> either. AS> Imail 8 can still be configured where the Client is NOT required to Auth in AS> order to send. One example of that is 'Relay for Addresses.' AS> So, if we have IPs on a DUL/DYNA/DUHL list, are using anything but 'No Mail AS> Relay' in Imail 8 and we run a DYNA/DUL/DUHL test on the first hop, we will AS> definitely tag our own customers. AS> So, the way I see it, running DYNA/DUL/DUHL tests on the first hop of ALL AS> mail, is only safe for those folks who: (1) are sure that none of their IP AS> addresses are on any DYNA/DUL/DUHL list (and will never be on AS> one) -OR- (2) run Imail 8, have it configured for 'No Mail Relay' and have AS> WHITELIST AUTH specified in the Declude's Global.cfg. Then, in either cases, AS> scanning the first hop is a simple matter of changing the test name to AS> eliminate the reserved string of DUL, DYNA or DUHL and using the hack which AS> Matt found. For instance: AS> Change this: AS> NJABL-DUL ip4r dnsbl.njabl.org 127.0.0.3 10 0 AS> To this: AS> NJABL-HOP1 dnsbl %IP4R%.dnsbl.njabl.org 127.0.0.3 10 0 AS> I don't think a switch in Declude is really needed. AS> Thanks, AS> Saturday, May 15, 2004, 10:01:11 AM, Matt <[EMAIL PROTECTED]> wrote: M>> Andy, M>> It's only been a matter of months since a realistic work around M>> wasavailable for most users (using WHITELIST AUTH). To the best of M>> myknowledge, I'm the only one of us that has said anything about it M>> onthis list (first time in March, but of course I could be wrong). M>> LikeI indicated though, there is a way to fix the problem using the M>> dnsbltrick, and it works immediately. I would however like to see a M>> switchgiven also, but this seems more like a convenience if you M>> useDUL/DYNA/DUHL the way that they were meant to be used in the M>> firstplace (which I was not), but still, it only means some extra M>> lookups. M>> Matt M>> Andy Schmidt wrote: M>> Thanks - ouch. M>> M>> I'd say that's a bug in design. M>> M>> Since AUTH is supported in Imail 8 and sinceothers may not allow M>> local users to send through their Imail server (myoutbound is going M>> through IIS SMTP with SMTP AUTH), there should be ATLEAST a config M>> option to turn this "spam me by faking sender" featureoff! M>> Best Regards M>> Andy Schmidt M>> Phone: +1 201 934-3414 x20(Business) M>> Fax: +1 201 934-9206 M>> -Original Message- M>> M>> From:[EMAIL PROTECTED]:Declude.JunkMail-owner M>> @declude.com] M>> On Behalf Of Matt M>> Sent: Saturday, May 15, 2004 01:49 AM M>> To:[EMAIL PROTECTED] M>> Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK isblank M>> In absentia... M>> M>> http://www.mail-archive.com/[EMAIL PROTECTED]/msg17162.htm M>> l M>> This made a lot of sense before, and it was the only way to disable M>> DULtests for local
Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank
Saturday, May 15, 2004, 4:58:34 PM, Andy Schmidt <[EMAIL PROTECTED]> wrote: [SNIP] AS> It should be an option. Those who need to bypass the DYNA tests on the AS> first hop should be able to - those who don't need to should not lose those AS> tests! But that was the point - You CAN do it NOW! No change to Declude is required and it doesn't matter if you are running Imail 8 or Imail 7, etc. The second point was that Imail 8 and WHITELIST AUTH doesn't universally solve the problem. It depends upon the SMTP SECURITY configuration in Imail 8 and your particular situation. If you don't know exactly, without any doubt, what I mean by that, then you could easily generate a lot of false positives by changing the 'out of the box' behavior of the DUL/DYNA/DUHL tests. Thanks, AS> Best Regards AS> Andy Schmidt AS> Phone: +1 201 934-3414 x20 (Business) AS> Fax:+1 201 934-9206 AS> -Original Message- AS> From: [EMAIL PROTECTED] AS> [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown AS> Sent: Saturday, May 15, 2004 04:19 PM AS> To: Matt AS> Cc: [EMAIL PROTECTED] AS> Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank AS> This wasn't a bug or a larger issue of Declude trust based upon the 'from AS> Address.' There was no choice but to skip DUL/DYNA/DUHL tests (which were AS> the only ones skipped) when the 'from address' was spoofed as a local AS> address. Imail 8 and WHITELIST AUTH help, but they don't solve this issue, AS> either. AS> Imail 8 can still be configured where the Client is NOT required to Auth in AS> order to send. One example of that is 'Relay for Addresses.' AS> So, if we have IPs on a DUL/DYNA/DUHL list, are using anything but 'No Mail AS> Relay' in Imail 8 and we run a DYNA/DUL/DUHL test on the first hop, we will AS> definitely tag our own customers. AS> So, the way I see it, running DYNA/DUL/DUHL tests on the first hop of ALL AS> mail, is only safe for those folks who: (1) are sure that none of their IP AS> addresses are on any DYNA/DUL/DUHL list (and will never be on AS> one) -OR- (2) run Imail 8, have it configured for 'No Mail Relay' and have AS> WHITELIST AUTH specified in the Declude's Global.cfg. Then, in either cases, AS> scanning the first hop is a simple matter of changing the test name to AS> eliminate the reserved string of DUL, DYNA or DUHL and using the hack which AS> Matt found. For instance: AS> Change this: AS> NJABL-DUL ip4r dnsbl.njabl.org 127.0.0.3 10 0 AS> To this: AS> NJABL-HOP1 dnsbl %IP4R%.dnsbl.njabl.org 127.0.0.3 10 0 AS> I don't think a switch in Declude is really needed. AS> Thanks, AS> Saturday, May 15, 2004, 10:01:11 AM, Matt <[EMAIL PROTECTED]> wrote: M>> Andy, M>> It's only been a matter of months since a realistic work around M>> wasavailable for most users (using WHITELIST AUTH). To the best of M>> myknowledge, I'm the only one of us that has said anything about it M>> onthis list (first time in March, but of course I could be wrong). M>> LikeI indicated though, there is a way to fix the problem using the M>> dnsbltrick, and it works immediately. I would however like to see a M>> switchgiven also, but this seems more like a convenience if you M>> useDUL/DYNA/DUHL the way that they were meant to be used in the M>> firstplace (which I was not), but still, it only means some extra M>> lookups. M>> Matt M>> Andy Schmidt wrote: M>> Thanks - ouch. M>> M>> I'd say that's a bug in design. M>> M>> Since AUTH is supported in Imail 8 and sinceothers may not allow M>> local users to send through their Imail server (myoutbound is going M>> through IIS SMTP with SMTP AUTH), there should be ATLEAST a config M>> option to turn this "spam me by faking sender" featureoff! M>> Best Regards M>> Andy Schmidt M>> Phone: +1 201 934-3414 x20(Business) M>> Fax: +1 201 934-9206 M>> -Original Message- M>> M>> From:[EMAIL PROTECTED]:Declude.JunkMail-owner M>> @declude.com] M>> On Behalf Of Matt M>> Sent: Saturday, May 15, 2004 01:49 AM M>> To:[EMAIL PROTECTED] M>> Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK isblank M>> In absentia... M>> M>> http://www.mail-archive.com/[EMAIL PROTECTED]/msg17162.htm M>> l M>> This made a lot of sense before, and it was the only way to disable M>> DULtests for local users prior to IMail 8 and JunkMail ~1.76. M>> Decludewon't disable the tests for gatewayed domains, only where an M>> addressmatches a local
Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank
This wasn't a bug or a larger issue of Declude trust based upon the 'from Address.' There was no choice but to skip DUL/DYNA/DUHL tests (which were the only ones skipped) when the 'from address' was spoofed as a local address. Imail 8 and WHITELIST AUTH help, but they don't solve this issue, either. Imail 8 can still be configured where the Client is NOT required to Auth in order to send. One example of that is 'Relay for Addresses.' So, if we have IPs on a DUL/DYNA/DUHL list, are using anything but 'No Mail Relay' in Imail 8 and we run a DYNA/DUL/DUHL test on the first hop, we will definitely tag our own customers. So, the way I see it, running DYNA/DUL/DUHL tests on the first hop of ALL mail, is only safe for those folks who: (1) are sure that none of their IP addresses are on any DYNA/DUL/DUHL list (and will never be on one) -OR- (2) run Imail 8, have it configured for 'No Mail Relay' and have WHITELIST AUTH specified in the Declude's Global.cfg. Then, in either cases, scanning the first hop is a simple matter of changing the test name to eliminate the reserved string of DUL, DYNA or DUHL and using the hack which Matt found. For instance: Change this: NJABL-DUL ip4r dnsbl.njabl.org 127.0.0.3 10 0 To this: NJABL-HOP1 dnsbl %IP4R%.dnsbl.njabl.org 127.0.0.3 10 0 I don't think a switch in Declude is really needed. Thanks, Saturday, May 15, 2004, 10:01:11 AM, Matt <[EMAIL PROTECTED]> wrote: M> Andy, M> It's only been a matter of months since a realistic work around M> wasavailable for most users (using WHITELIST AUTH). To the best of M> myknowledge, I'm the only one of us that has said anything about it M> onthis list (first time in March, but of course I could be wrong). M> LikeI indicated though, there is a way to fix the problem using the M> dnsbltrick, and it works immediately. I would however like to see M> a switchgiven also, but this seems more like a convenience if you M> useDUL/DYNA/DUHL the way that they were meant to be used in the M> firstplace (which I was not), but still, it only means some extra M> lookups. M> Matt M> Andy Schmidt wrote: M> Thanks - ouch. M> M> I'd say that's a bug in design. M> M> Since AUTH is supported in Imail 8 and sinceothers may not M> allow local users to send through their Imail server (myoutbound is M> going through IIS SMTP with SMTP AUTH), there should be ATLEAST a M> config option to turn this "spam me by faking sender" featureoff! M> Best Regards M> Andy Schmidt M> Phone: +1 201 934-3414 x20(Business) M> Fax: +1 201 934-9206 M> -Original Message- M> M> From:[EMAIL PROTECTED]:[EMAIL PROTECTED] M> On Behalf Of Matt M> Sent: Saturday, May 15, 2004 01:49 AM M> To:[EMAIL PROTECTED] M> Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK isblank M> In absentia... M> M> http://www.mail-archive.com/[EMAIL PROTECTED]/msg17162.html M> This made a lot of sense before, and it was the only way to M> disable DULtests for local users prior to IMail 8 and JunkMail M> ~1.76. Decludewon't disable the tests for gatewayed domains, only M> where an addressmatches a local account. You can also work around M> this by using thednsbl trick like so: M> DNSRBL-DYN dnsbl %IP4R%.dun.dnsrbl.net 127.0.0.3 0 0 M> NJABL-DYN-A dnsbl %IP4R%.dnsbl.njabl.org 127.0.0.3 0 0 M> NJABL-DYN-B dnsbl %IP4R%.dynablock.njabl.org 127.0.0.3 0 0 M> SORBS-DYN dnsbl %IP4R%.dnsbl.sorbs.net 127.0.0.10 0 0 M> Note that I changed the names of the tests to exclude the M> stringsDUL/DYNA/DUHL. This took me a long time to figure out, so M> the trickisn't that common, however I started using these strings M> to limit somenon-DUL tests to just the last hop with higher M> scoring, and did impactmy ability to block spam on local accounts, M> however it took me quite awhile to notice that it was going on M> (several months). M> Matt M> Andy Schmidt wrote: M> Scott (in case you're not gone yet): M> M> >> At this moment, Declude will not apply scoresfrom any M> dnsbl, ip4r or rhsbl tests if they have either DUL, DYNA orDUHL in M> the name AND the Mail From matches a local user. << M> M> Does Declude REALLY trust the mail from andwill bypass M> DUL/DYNA/DUHL test just by someone forging the mail from? M> M> Never heard about that "bug"/behavior before? M> Best Regards M> Andy Schmidt M> Phone: +1 201 934-3414 x20(Business) M> Fax: +1 201 934-9206 M> -- M> =
Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank
the connecting M> IP high thanon a relaying IP. I am doing this because some spam is M> relayed fromone machine to another and even through an ISP's M> mailserver, but at thesame time, there is a higher false positive M> rate with relaying IP'sbecause some lists keep IP's in their M> database for many months or evenyears after they are nominated, and M> without an attempt to clean up thelisting. ORDB for instance is M> very bad about this, and their removalprocess is useless in this M> regard since most broadband IP's don't havemail servers to receive M> the removal requests on. M> Take a look at the reply to Bill from two messages ago for M> furtherexplanation of why this is done, and note that I was only M> naming testslike XBL(DYNA) to make that one test only score on the M> last hop, andthe one marked XBL(ALL) would score on any hop that M> matched, includingthe first. I have HOPHIGH set to 3 which means M> (I believe) that I amchecking as many as 4 hops (or 3 hops plus the M> connecting IP). I understand the weighting concept, but it is apples and oranges with the previous part of the thread. In the prior e-mail you talked about what I was potentially confused about and I hope that this response gives you a better picture of that. Thanks, M> Matt M> Best Regards M> Andy Schmidt M> H M Systems Software, Inc. M> 600 East Crescent Avenue, Suite 203 M> Upper Saddle River, NJ 07458-1846 M> Phone: +1 201 934-3414x20 (Business) M> Fax: +1 201 934-9206 M> http://www.HM-Software.com/ M> -Original Message- M> M> From:[EMAIL PROTECTED]:[EMAIL PROTECTED] M> On Behalf Of Matt M> Sent: Friday, May 14, 2004 02:41 PM M> To:[EMAIL PROTECTED] M> Subject: Re: [Declude.JunkMail] DUL skipping was ISBLANK isblank M> Don, M> Since I started this thread, I'll try to answer what's at issue here. M> Declude has functionality to only scan the last hop on any M> dnsbl, ip4rand rhsbl test when it has either DUL, DYNA or DUHL in M> the name of thetest. This is done in order to protect you from M> scoring hits ondial-up or residential IP's when they weren't the M> connecting server andwhen you are using Declude to score on M> multiple hops (I believe this isversion restricted). M> In order to keep these DUL/DYNA/DUHL tests from hitting your M> own localusers when they are sending E-mail (only one hop and M> typicallydynamic/residential), Declude disables any dnsbl, ip4r or M> rhsbl testwhen they have one of those strings in the name. This M> was very usefuluntil IMail 8 came along and they started providing M> an indication ofwhether or not AUTH was used in the Q*.SMD file. M> When IMail 8 didthat, Scott introduced a function called WHITELIST M> AUTH that willwhitelist any E-mail that is AUTH'd. M> Every user on my system uses AUTH and I'm on IMail 8 so I can M> takeadvantage of WHITELIST AUTH. The issue now is that when a M> spammerforges a locally hosted address in the Mail From, Declude is M> stilldisabling all dnsbl, ip4r and rhsbl tests that contain either M> DUL, DYNAor DUHL in the name, and this now represents a weakness M> instead of abenefit. So for users that have IMail 8, where all of M> their users arewhitelisted either by IP or by AUTH, it would be M> nice to turn thisfunctionality off. M> Something that seemed to confuse you was the fact that I am M> usingseveral tests twice like so: M> XBL(LAST) dnsbl %IP4R%.sbl-xbl.spamhaus.org 127.0.0.4 6 0 M> XBL(ALL) ip4r sbl-xbl.spamhaus.org 127.0.0.4 2 0 M> The reason why I do this is because I score on multiple hops, M> andinstead of having XBL score exactly the same on every hop, I M> created awork around so that it would score higher on the last hop, M> and lower ifit only hit one of the prior hops. The prior hop M> functionality helpswith catching spam that is relayed from one open M> relay to another openrelay, or worse yet, from an open relay to a M> legitimate mail server. At the same time there are lots of IP's in M> some of these lists thathave long since been fixed/closed and are M> sending only legitimateE-mail through legitimate servers, and only M> adding a few points helpsprotect from false positives. M> The former kludge that I used was to use (DYNA) in the name of M> the testthat I only wanted to score on the last hop, but this M> morning, I foundthat on locally hosted E-mail, this test would be M> defeated if thespammer forged a local address. By changing the M> test to how it appearsas XBL(LAST) in the above example, I'm M> creating a way to score only thelast hop without it being defeated M> when a l
Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank
Friday, May 14, 2004, 11:36:22 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >>I seem to have broken things worse :) Is there any reason why the >>following wouldn't work? >> >>XBL(LAST)dnsbl%REMOTEIP%.sbl-xbl.spamhaus.org127.0.0.4 >>60 >> >>I tested the DUL lists using this format and it seemed to be >>working. Here's the headers from a single hop test that tripped on the >>ip4r version of XBL and returned the proper %REMOTEIP% in the headers: RSP> The problem here is that the remote IP is 192.0.2.25, so Declude JunkMail RSP> will create "192.0.2.25.sbl-xbl.spamhaus.org". But, you really want RSP> "25.2.0.192.sbl-xbl.spamhaus.org". Fortunately, you can use: RSP> XBL(LAST)dnsbl%IP4R%.sbl-xbl.spamhaus.org 127.0.0.46 RSP> 0 RSP> which should do what you want. RSP> -Scott Since sbl-xbl.spamhaus.org is an ip4r list, doesn't the below do the same thing as using %IP4R% as shown above? If not, what is the difference? SBL-ALL ip4r sbl-xbl.spamhaus.org Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Using RHSBL's for reverse DNS entries
So in the global we'd have: First the actual tests with no value for failure MAILPOLICE-BULK-REVDNS dnsbl %REVDNS%.bulkk.rhs.mailpolice.com * 0 0 MAILPOLICE, etc. Then the Filter (Using the example construct below) with a weight MAILPOLICE filter X:\imail\declude\MailPolice.txt x 10 0 Is that correct? Thanks, Thursday, May 13, 2004, 4:17:58 PM, Matt <[EMAIL PROTECTED]> wrote: M> That would be awesome if it really does work. I'll give it a try this M> evening! Am I also to assume that this will work with the %HELO% as M> well? That would rock :) M> Just a note of caution to others, if you use MailPolice Bulk on the Mail M> From, and you try this technique, you probably don't want to be scoring M> a double hit, instead a combo filter using TESTSFAILED to assess one M> value for either failure would be the best, i.e. M> - MailPolice.txt - M> TESTSFAILED 0 CONTAINS MAILPOLICE-BULK M> TESTSFAILED 0 CONTAINS MAILPOLICE-BULK-REVDNS M> ...and then give it one score in the Global.cfg. M> Thanks, M> Matt M> R. Scott Perry wrote: >> >>> Is there any shot of you enabling a different type of test built to >>> do RHS lookups from the reverse DNS value? >> >> >> Actually, you can use something like: >> >> BULK-REVDNS dnsbl %REVDNS%.bulk.rhs.mailpolice.com >> * x 0 >> >> >>-Scott >> --- >> Declude JunkMail: The advanced anti-spam solution for IMail >> mailservers since 2000. >> Declude Virus: Ultra reliable virus detection and the leader in >> mailserver vulnerability detection. >> Find out what you've been missing: Ask for a free 30-day evaluation. >> >> --- >> [This E-mail was scanned for viruses by Declude Virus >> (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blackholes.us Resolution Problems
To save some trouble shooting time, see below <==Original message text===> On Apr 19, 2004, at 7:29 AM, Don Brown wrote: > Are you having issues with your DNS servers or are you getting DOS'ed? > We have noticed several connection failures in our log, starting > yesterday morning. > > Thanks, > > > Don Brown - Dallas, Texas USA Internet Concepts, Inc. Date: Monday, April 19, 2004, 12:57:59 PM Subject: DNS Issues? My poor servers are very overworked - just about everyone providing secondary service had to quit recently due to DDoS attacks or poor connectivity. However, someone has just donated two older Sun boxes to help with the problem and hopefully things will improve very soon. - Matthew <===End of original message text===> Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED]http://www.inetconcepts.net PGP Key ID: 04C99A55(972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamRouting?
82.49.169.148 is registered with RIPE. What source does declude use to determine it is US, German or whatever? Not being argumentative - curious and so I'll understand . . . Wednesday, April 7, 2004, 3:50:53 PM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >>This one started in the US, bounced off an Italian server, and arrived >>here in the US. Why didn't SpamRouting catch this one? >> >>Received: from host148-169.pool8249.interbusiness.it [82.49.169.148] by >>lovt.com >> (SMTPD32-8.05) id A7BA1160358; Wed, 07 Apr 2004 14:34:18 -0500 >>Received: from olympicdrinkingteam.com (mail3.surgeweb.com [216.65.64.234]) >> by host148-169.pool8249.interbusiness.it (Postfix) with ESMTP id >> F9F1F16538 >> for <[EMAIL PROTECTED]>; Wed, 07 Apr 2004 12:31:14 -0700 RSP> It went from 216.65.64.234 to 82.49.169.148 to your server. Neither of RSP> those IP ranges is recognized as being outside of North America. RSP> Remember, the ROUTING test is not very granular, and not exact. RSP> -Scott RSP> --- RSP> Declude JunkMail: The advanced anti-spam solution for IMail mailservers RSP> since 2000. RSP> Declude Virus: Ultra reliable virus detection and the leader in mailserver RSP> vulnerability detection. RSP> Find out what you've been missing: Ask for a free 30-day evaluation. RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP> --- RSP> This E-mail came from the Declude.JunkMail mailing list. To RSP> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP> type "unsubscribe Declude.JunkMail". The archives can be found RSP> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamRouting?
This one started in the US, bounced off an Italian server, and arrived here in the US. Why didn't SpamRouting catch this one? The %countrychain% variable showed the same per the X-Note below. Received: from host148-169.pool8249.interbusiness.it [82.49.169.148] by lovt.com (SMTPD32-8.05) id A7BA1160358; Wed, 07 Apr 2004 14:34:18 -0500 Received: from olympicdrinkingteam.com (mail3.surgeweb.com [216.65.64.234]) by host148-169.pool8249.interbusiness.it (Postfix) with ESMTP id F9F1F16538 for <[EMAIL PROTECTED]>; Wed, 07 Apr 2004 12:31:14 -0700 Message-ID: <[EMAIL PROTECTED]> From: "Trifle H. Bestowing" <[EMAIL PROTECTED]> To: Postmaster <[EMAIL PROTECTED]> Subject: [SPAM]Postmaster, Quality medication for you! Date: Wed, 07 Apr 2004 12:31:14 -0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_0030_1BA95A40.03BD390A" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1081 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Declude-Sender: [EMAIL PROTECTED] [82.49.169.148] X-Declude-Spoolname: D57ba011603585c69.SMD X-Note: This E-mail was sent from host148-169.pool8249.interbusiness.it ([82.49.169.148]). X-Note: The Server Helo Handshake was host148-169.pool8249.interbusiness.it. X-Note: Mail-From clothing.olympicdrinkingteam.com. X-Note: Mail-From for Spam Reporting is [EMAIL PROTECTED] X-Note: Initial Recipients: [EMAIL PROTECTED], [EMAIL PROTECTED] X-Note: Final Recipients: [EMAIL PROTECTED], [EMAIL PROTECTED] X-Note: Origin Country - UNITED STATES->ITALY->destination. X-Note: Failed: BH-INTERBUS [5], FIVETENSRC [1], IPNOTINMX [1], FILT-COUNTRY [1], FILT-FREEMAIL [2], WEIGHT10 [10]. X-Note: Total Failed Weight: 10. Version: 1.79. X-Note: Checked for SPAM and Viruses by Internet Concepts - http://www.inetconcepts.net. X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 369013728 Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamRouting Broken?
Then, does %countrychain% get its info from a different, more correct source? It showed Chile in the flow. Tuesday, April 6, 2004, 3:29:35 PM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >>RSP> It went from 216.65.3.237 to 164.77.48.71 to your mailserver. Both those >>RSP> IPs are from North America, so the ROUTING test does not get triggered. >> >>However, when I just did a ARIN lookup on 164.77.48.71, it says that >>IP belongs to LACNIC. A LACNIC lookup says the IP is located in Chile. >>So, the spamrouting test should have failed, right? RSP> Actually, what is happening here is that the IP was originally registered RSP> through ARIN, and only recently switched to use LACNIC. In general, the RSP> ROUTING test tries to determine whether the IP was registered to ARIN, RSP> APNIC, or RIPE, and works on those three large areas. RSP> -Scott RSP> --- RSP> Declude JunkMail: The advanced anti-spam solution for IMail mailservers RSP> since 2000. RSP> Declude Virus: Ultra reliable virus detection and the leader in mailserver RSP> vulnerability detection. RSP> Find out what you've been missing: Ask for a free 30-day evaluation. RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP> --- RSP> This E-mail came from the Declude.JunkMail mailing list. To RSP> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP> type "unsubscribe Declude.JunkMail". The archives can be found RSP> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamRouting Broken?
>>It looks to me like this e-mail should have failed SpamRouting, but it >>passed. Declude headers show it was routed US--->Chile-->Destination (US). >>Using Pro ver 1.78i31, but upgrading to 1.79 beta momentarily. >> >>Received: from dutch-courage.com [164.77.48.71] by inetconcepts.net >> (SMTPD32-8.05) id AB8A21703BC; Tue, 06 Apr 2004 11:32:10 -0500 >>Received: from chicky-babe.com (mail4.surgeweb.com [216.65.3.237]) >> by dutch-courage.com (Postfix) with ESMTP id 6246E890F3 >> for <[EMAIL PROTECTED]>; Tue, 06 Apr 2004 08:31:24 -0700 Tuesday, April 6, 2004, 12:05:26 PM, R. Scott Perry <[EMAIL PROTECTED]> wrote: RSP> It went from 216.65.3.237 to 164.77.48.71 to your mailserver. Both those RSP> IPs are from North America, so the ROUTING test does not get triggered. RSP> -Scott RSP> --- I didn't check the IP numbers because the %COUNTRYCHAIN% showed: "X-Note: Origin Country - UNITED STATES->CHILE->destination." However, when I just did a ARIN lookup on 164.77.48.71, it says that IP belongs to LACNIC. A LACNIC lookup says the IP is located in Chile. So, the spamrouting test should have failed, right? The output from both lookups is below. Thanks, [Query: 164.77.48.71, Server: whois.arin.net] OrgName:Latin American and Caribbean IP address Regional Registry OrgID: LACNIC Address:Potosi 1517 City: Montevideo StateProv: PostalCode: 11500 Country:UY ReferralServer: whois://whois.lacnic.net NetRange: 164.77.0.0 - 164.77.255.255 CIDR: 164.77.0.0/16 NetName:LACNIC-ERX-164-77-0-0 NetHandle: NET-164-77-0-0-1 Parent: NET-164-0-0-0-0 NetType:Early Registrations, Transferred to LACNIC Comment:This IP address range is under LACNIC responsibility Comment:for further allocations to users in LACNIC region. Comment:Please see http://www.lacnic.net/ for further details, Comment:or check the WHOIS server located at whois.lacnic.net RegDate:2003-07-23 Updated:2003-08-06 OrgTechHandle: LACNIC-ARIN OrgTechName: LACNIC Hostmaster OrgTechPhone: (+55) 11 5509-3522 OrgTechEmail: [EMAIL PROTECTED] # ARIN WHOIS database, last updated 2004-04-05 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. [End of Data] - inetnum: 164.77.32/19 status: reallocated owner: ENTEL CHILE S.A. ownerid: CL-ECSA6-LACNIC address: Av. Andres Bello 2687, Piso 9 address: Santiago, country: CL owner-c: LE89-ARIN remarks: Reassignment information for this block can be found at rs.entelchile.net created: 20010410 changed: 20010926 inetnum-up: 164.77/16 source: ARIN-LACNIC-TRANSITION nic-hdl: LE89-ARIN person: Luis Espinoza e-mail: [EMAIL PROTECTED] address: Entel Chile S.A. address: Amunategui 20, Piso 14 address: Santiago, Chile country: CL phone: 562-360-2663 source: ARIN-LACNIC-TRANSITION Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamRouting Broken?
It looks to me like this e-mail should have failed SpamRouting, but it passed. Declude headers show it was routed US--->Chile-->Destination (US). Using Pro ver 1.78i31, but upgrading to 1.79 beta momentarily. Received: from SMTP32-FWD by inetconcepts.net (SMTP32) id A07AC9635; Tue, 6 Apr 2004 11:32:55 -0500 Received: from dutch-courage.com [164.77.48.71] by inetconcepts.net (SMTPD32-8.05) id AB8A21703BC; Tue, 06 Apr 2004 11:32:10 -0500 Received: from chicky-babe.com (mail4.surgeweb.com [216.65.3.237]) by dutch-courage.com (Postfix) with ESMTP id 6246E890F3 for <[EMAIL PROTECTED]>; Tue, 06 Apr 2004 08:31:24 -0700 Message-ID: <[EMAIL PROTECTED]> From: "Coagulate F. Giraffes" <[EMAIL PROTECTED]> To: Websites <[EMAIL PROTECTED]> Subject: Biggest medication site on net, Websites. Best offers for you! Date: Tue, 06 Apr 2004 08:31:24 -0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_0035_F284D45F.DDA9D0F6" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2720.3000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 X-Declude-Sender: [EMAIL PROTECTED] [164.77.48.71] X-Declude-Spoolname: Ddb8a021703bc4a41.SMD X-Note: This E-mail was sent from [No Reverse DNS] ([164.77.48.71]). X-Note: The Server Helo Handshake was dutch-courage.com. X-Note: Mail-From singer.chicky-babe.com. X-Note: Mail-From for Spam Reporting is [EMAIL PROTECTED] X-Note: Initial Recipients: [EMAIL PROTECTED] X-Note: Final Recipients: [EMAIL PROTECTED] X-Note: Origin Country - UNITED STATES->CHILE->destination. X-Note: Failed: REVDNS [1], IPNOTINMX [1], FILT-COUNTRY [1], FILT-FREEMAIL [2]. X-Note: Total Failed Weight: 5. X-Note: Checked for SPAM and Viruses by Internet Concepts - http://www.inetconcepts.net. Status: U X-UIDL: 369013565 Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Strange MONKEYFORMMAIL problems
See below -- Tuesday, March 23, 2004, 8:31:36 AM, Troy D. Hilton <[EMAIL PROTECTED]> wrote: TDH> Dude, You meant Don. TDH> Basically, I just need to do a regular update to my global.cfg TDH> file. Yes. You can't prevent the problem you encountered without routinely maintaining the system. Scott is very responsive to changes, like the recent encrypted zip virus, etc. and he is very responsive to this list. Declude is a dynamic work in the process of rapid change. It will also serve you well to follow this list closely, since there is good functionality in Declude, which is not documented. The various threads will also help you understand how certain features work and about whether or not they make a good fit for your situation. Our config, and I suspect most others out there, is not a carbon copy of the config available for download. Our config works pretty well for us, but I wouldn't expect it to work well for others. We tweak, and change it, frequently, due to new functionality and due to our own situation. TDH> I'm sure the information about the list dying was posted TDH> to the NG but I obviously missed it. Yes and it was also in the press, elsewhere on the Internt. WRT new/dead test sources, you can check this URL, too: http://www.declude.com/junkmail/support/ip4r.htm Navigate to the bottom of the page for recent changes/additions, etc. The demise of Monkeys is so old it is no longer listed. Thanks, TDH> Troy D. Hilton TDH> SofWerks LLC. TDH> [EMAIL PROTECTED] TDH> -Original Message- TDH> From: [EMAIL PROTECTED] TDH> [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown TDH> Sent: Monday, March 22, 2004 8:48 PM TDH> To: [EMAIL PROTECTED]; Troy D. Hilton TDH> Cc: Declude Junkmail Forum TDH> Subject: Re: [Declude.JunkMail] Strange MONKEYFORMMAIL problems TDH> No offense, but when you know the list is a dead soldier, why are you TDH> still trying to use it -- and when it doesn't work -- why are you TDH> complaining about it here? Let's move on to something constructive TDH> and challenging. Dead puppies aren't very much fun. TDH> Thanks, TDH> Monday, March 22, 2004, 1:34:46 PM, Troy D. Hilton <[EMAIL PROTECTED]> TDH> wrote: TDH>> Hello All, TDH>> I know that the MONKEYFORMMAIL and MONKEYPROXIES list are dead and TDH>> apparently has been for a while but we had a problem last Monday in TDH> that TDH>> hundreds of legitimate emails started getting caught with these lists. TDH> I've TDH>> since disabled the tests in Junkmail. I saw that someone else had a TDH> problem TDH>> with these tests and someone mentioned that these lists had been dead TDH> for a TDH>> while. Can someone please explain why all of a sudden my Junkmail TDH> started TDH>> failing emails with these when these lists had been dead? Also, how do TDH> I TDH>> avoid something like this form happening again? TDH>> Troy D. Hilton TDH>> SofWerks LLC. TDH>> [EMAIL PROTECTED] TDH>> 302-529-1961 TDH> TDH> Don Brown - Dallas, Texas USA Internet Concepts, Inc. TDH> [EMAIL PROTECTED] http://www.inetconcepts.net TDH> PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 TDH> Providing Internet Solutions Worldwide - An eDataWeb Affiliate TDH> TDH> --- TDH> [This E-mail was scanned for viruses by Declude Virus TDH> (http://www.declude.com)] TDH> --- TDH> This E-mail came from the Declude.JunkMail mailing list. To TDH> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and TDH> type "unsubscribe Declude.JunkMail". The archives can be found TDH> at http://www.mail-archive.com. TDH> --- TDH> [This E-mail scanned for viruses by Declude Virus] TDH> --- TDH> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] TDH> --- TDH> This E-mail came from the Declude.JunkMail mailing list. To TDH> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and TDH> type "unsubscribe Declude.JunkMail". The archives can be found TDH> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Strange MONKEYFORMMAIL problems
No offense, but when you know the list is a dead soldier, why are you still trying to use it -- and when it doesn't work -- why are you complaining about it here? Let's move on to something constructive and challenging. Dead puppies aren't very much fun. Thanks, Monday, March 22, 2004, 1:34:46 PM, Troy D. Hilton <[EMAIL PROTECTED]> wrote: TDH> Hello All, TDH> I know that the MONKEYFORMMAIL and MONKEYPROXIES list are dead and TDH> apparently has been for a while but we had a problem last Monday in that TDH> hundreds of legitimate emails started getting caught with these lists. I've TDH> since disabled the tests in Junkmail. I saw that someone else had a problem TDH> with these tests and someone mentioned that these lists had been dead for a TDH> while. Can someone please explain why all of a sudden my Junkmail started TDH> failing emails with these when these lists had been dead? Also, how do I TDH> avoid something like this form happening again? TDH> Troy D. Hilton TDH> SofWerks LLC. TDH> [EMAIL PROTECTED] TDH> 302-529-1961 Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Error - BOUNCE is not an ACTION. May be a duplicate test definiti on? on?
Change the action from "BOUNCE" to "BOUNCEONLYIFYOUMUST" Thursday, December 4, 2003, 9:50:49 AM, Hirthe, Alexander <[EMAIL PROTECTED]> wrote: HA> Hello, HA> I'm getting "12/04/2003 00:02:26 Warning: misconfiguration in following line HA> in configuration file (BOUNCE is not an ACTION). May be a duplicate test HA> definition?" HA> I "think" this comes since the update to v1.76i30. Does anyone see this? HA> I went down to 1.76i, now I'm waiting for the next Bounce :-) HA> Alex HA> --- HA> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] HA> --- HA> This E-mail came from the Declude.JunkMail mailing list. To HA> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and HA> type "unsubscribe Declude.JunkMail". The archives can be found HA> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude does not see email
I wonder if this has something to do with Declude crashing every now and then -- it only shows up in the event viewer under W2K3 -- no declude error files are written. Thursday, December 4, 2003, 6:32:39 AM, R. Scott Perry <[EMAIL PROTECTED]> wrote: >>Scott, what information can we provide you to help you track down whether >>IMail is calling Declude for each message or whether it is calling Declude >>twice for the same message? RSP> We have already confirmed cases of IMail v8 not calling Declude. We have RSP> "almost confirmed" cases of IMail calling Declude more than once, but have RSP> not officially confirmed it yet. RSP> With the latest interim release, if the E-mail is not referenced in the RSP> C:\Declude.log file, then IMail didn't start Declude. If it is listed more RSP> than once in the C:\Declude.log file, IMail probably (but not definitely) RSP> started Declude more than once. RSP> -Scott RSP> --- RSP> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. RSP> Declude Virus: Catches known viruses and is the leader in mailserver RSP> vulnerability detection. RSP> Find out what you've been missing: Ask about our free 30-day evaluation. RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP> --- RSP> This E-mail came from the Declude.JunkMail mailing list. To RSP> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP> type "unsubscribe Declude.JunkMail". The archives can be found RSP> at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
