RE: [Declude.JunkMail] dns attacks today
There may be now, but when the pay stuff was launched, there definitely wasn't anything like that. Attached are a couple of the messages I got (I was getting them pretty often ...). -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, February 13, 2007 11:06 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] dns attacks today Jay, Are you sure there was no unsubscribe? I just checked and there is a link which says "To unsubscribe from our periodic e-mail messages, please click the following" if you have an example you can email me that does not have this I will be glad to check this out you. Thanks David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Tuesday, February 13, 2007 12:41 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] dns attacks today Given this, it's even more interesting how DNSStuff.com repeatedly sent me emails asking me to subscribe to their pay services, had no unsubscribe information in their email, no automated unsubscribe link, was not CAN SPAM compliant, etc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, February 12, 2007 2:49 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] dns attacks today Hmmm.. I thought I remembered Scott saying he was keeping DNSStuff to himself when he sold Declude. I guess he changed his mind. I would guess it's good news that there's a larger organization behind DNSStuff now... to keep it going should any one person no longer be part of it. Darin. - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: Sent: Monday, February 12, 2007 4:33 PM Subject: RE: [Declude.JunkMail] dns attacks today FWIW, Paul Parisi is not only the CTO of DNSStuff.com but is also the CTO of Declude.com ... Which helped me frame David's reply! http://www.declude.com/site/news1017.htm http://www.boston.com/business/whoswhat/2006/12/declude_newbury.html Andrew. p.s. I ran a whois on a few typo variations on DNSStuff.com out of curiousity and got a few different domain squatters. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of David Barker > Sent: Thursday, February 08, 2007 5:55 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] dns attacks today > > Don't panic Darin, Scott is still involved with DNSStuff, > just not in a PR role. > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Darin Cox > Sent: Wednesday, February 07, 2007 5:59 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] dns attacks today > > So where's Scott in this picture? And who's Paul Parisi, > other than CTO of DNSstuff.com? Is Scott selling DNSstuff > and DNSreport as well? > > Darin. > > > - Original Message - > From: "Nick Hayer" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, February 07, 2007 5:06 PM > Subject: [Declude.JunkMail] dns attacks today > > > fyi - > http://www.darkreading.com/document.asp?doc_id=116685&WT.svl=news2_1 > > -Nick > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], an
RE: [Declude.JunkMail] dns attacks today
Given this, it's even more interesting how DNSStuff.com repeatedly sent me emails asking me to subscribe to their pay services, had no unsubscribe information in their email, no automated unsubscribe link, was not CAN SPAM compliant, etc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, February 12, 2007 2:49 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] dns attacks today Hmmm.. I thought I remembered Scott saying he was keeping DNSStuff to himself when he sold Declude. I guess he changed his mind. I would guess it's good news that there's a larger organization behind DNSStuff now... to keep it going should any one person no longer be part of it. Darin. - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: Sent: Monday, February 12, 2007 4:33 PM Subject: RE: [Declude.JunkMail] dns attacks today FWIW, Paul Parisi is not only the CTO of DNSStuff.com but is also the CTO of Declude.com ... Which helped me frame David's reply! http://www.declude.com/site/news1017.htm http://www.boston.com/business/whoswhat/2006/12/declude_newbury.html Andrew. p.s. I ran a whois on a few typo variations on DNSStuff.com out of curiousity and got a few different domain squatters. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of David Barker > Sent: Thursday, February 08, 2007 5:55 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] dns attacks today > > Don't panic Darin, Scott is still involved with DNSStuff, > just not in a PR role. > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Darin Cox > Sent: Wednesday, February 07, 2007 5:59 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] dns attacks today > > So where's Scott in this picture? And who's Paul Parisi, > other than CTO of DNSstuff.com? Is Scott selling DNSstuff > and DNSreport as well? > > Darin. > > > - Original Message - > From: "Nick Hayer" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, February 07, 2007 5:06 PM > Subject: [Declude.JunkMail] dns attacks today > > > fyi - > http://www.darkreading.com/document.asp?doc_id=116685&WT.svl=news2_1 > > -Nick > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] roconner -can he be stopped???
? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Thursday, January 04, 2007 4:30 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] roconner -can he be stopped??? Harry Vanderzand inTown Internet & Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [IANA Reserved] ?
Indeed. When we obtained our own IP space from ARIN, it was from 72/8, which had been released only about 6 months prior to it being assigned to us. You wouldn't believe the number of networks that were running with 72/8 in their bogons list and were entirely blocking traffic from our network... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Thursday, January 04, 2007 3:47 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] [IANA Reserved] ? I would be very careful with this. IANA just released (I believe in October) 96/8, 97/8, 98/8, 99/8. With the all_list.dat not being updated frequently I would tred very lightly in this area. Part of 96/8 has been handed out. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "S.J.Stanaitis" <[EMAIL PROTECTED]> To: Sent: Thursday, January 04, 2007 3:29 PM Subject: RE: [Declude.JunkMail] [IANA Reserved] ? Nice. Thanks, Sam SJ.Stanaitis - Network Administrator Decorative Product Source E-commerce Network -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, January 04, 2007 3:16 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] [IANA Reserved] ? sending hop only: COUNTRY 0 IS *R or all hops: COUNTRIES 0 CONTAINS *R - Original Message - From: "S.J.Stanaitis" <[EMAIL PROTECTED]> To: Sent: Thursday, January 04, 2007 1:55 PM Subject: RE: [Declude.JunkMail] [IANA Reserved] ? > Holy [EMAIL PROTECTED], that answers one question! > > Any idea how to incorporate the "IANA Reserved" thing into Declude? > > Thanks, > Sam > > SJ.Stanaitis - Network Administrator > Decorative Product Source E-commerce Network > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott > Fisher > Sent: Thursday, January 04, 2007 2:37 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] [IANA Reserved] ? > > Here are my december totals for the odd-balls (COUNTRY IS test) > > Country Name CountOfMessageID DEL SPAM HELD SPAM Poss SPAM OK > APNIC Unlisted 97 97 0 0 0 > ARIN Unlisted 1426 1395 12 1 18 > Central/South America 89 89 0 0 0 > European Union 1804 1674 8 1 121 > IANA Reserved 11677 11428 91 118 39 > Multi-Regional 23 19 1 1 2 > RIPE Unlisted 1332 1330 1 1 0 > Unknown 4018 3938 13 3 64 > > > # > # Special Codes > # > #*1 Multi-Regional > #*2 Europe > #*3 North America > #*4 Central/South America > #*5 Pacific Rim > #*A ARIN Unlisted (North America/South Africa) > #*B Public Data Network > #*E RIPE Unlisted (Europe, North Africa, Middle East) > #*I Private IP > #*L Loopback > #*M Multicast > #*P APNIC Unlisted (Asia Pacific) > #*R IANA Reserved > #*U Unknown > > > - Original Message - > From: "S.J.Stanaitis" <[EMAIL PROTECTED]> > To: > Sent: Thursday, January 04, 2007 1:02 PM > Subject: [Declude.JunkMail] [IANA Reserved] ? > > >>I currently tag each incoming email from a country other than the US (with >> few exceptions) with a weight of 10. Some emails come in with [IANA >> Reserved] in the X-Country-Chain header and as such these emails >> (originating in places like Amsterdam, etc) aren't affected by the >> FILTER-COUNTRY filter. Any way to add a weight to those IP's too? Do >> American IP's show up as IANA Reserved ever? >> >> Thanks, >> Sam >> >> SJ.Stanaitis - Network Administrator >> Decorative Product Source E-commerce Network >> >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declud
RE: [Declude.JunkMail] Interesting ORF stats
Ditto! 95%+ with Alligate. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Friday, December 15, 2006 9:42 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Interesting ORF stats Hi John, John T (Lists) wrote: > I have 3 gateway servers running IIS with ORF. These are my MX records for > all my domains. > > ORF has identified and blocked 71% of incoming email on my primary gateway. > ORF has identified and blocked 81% of incoming email on my secondary > gateway. I see the secondaries get more traffic as well - although I am not sure its deliberate or its the zombies do not know better - [Regretfully I have abandoned ORF for the Alligate gateway. I am in the high nineties 96%+ with Brian's product...] -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO
DYNHELO dynhelo x x 5 0 This test type, attempts to detect dynamic IPs in HELO/EHLO hostnames. This test should be quite effective, since mailservers on IPs that have dynamic-like reverse DNS entries will *not* normally send an HELO/EHLO that look dynamic. DYNHELO is not an RBL test. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Thomas - Mathbox Sent: Thursday, December 07, 2006 3:06 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] DYNHELO Hi All, Does anyone know what list(s) DYNHELO uses? The mail archive has nothing useful. DYNHELO does not appear in the documentation for 3.1.3 or any of the others that I checked. I just noticed that on 12/1/06, at least one of my web server IP addresses, 63.150.236.34, started returning positive for DYNHELO. I checked that IP address at DNSstuff against 272 lists and all passed. I checked at Spamhaus, SORBS, NJABL, and MAPS (Checked by DNSstuff, but I looked anyway.). Still no listing. It is not a DNS problem. I run a caching only DNS on my mail server and it is working just fine. Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestion for Junkmail....
I just ran into an issue last night with duplicate test notification being logged using .eml and everything else being logged as just , causing DLAnalyzer to think there was double the message volume. I think that it would be advisable to push all logging output through a single function that would standardize the log format, but what do I know :) -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, December 06, 2006 1:59 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Suggestion for Junkmail I agree. But rarely see an issue. Kevin > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS > - Systems Eng. (Karl Drugge) > Sent: Wednesday, December 06, 2006 8:00 AM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] Suggestion for Junkmail > > Just a quick suggestion, may even save programming time... > > > Please leave the log file formats and entries alone.. It REALLY plays > hell with my automated scripts and programs when keywords, field > lengths, and schema are altered ( seemingly at random ) from version to > version. > > I know I can't be alone on this.. > > > Karl Drugge > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Way to delete spam over a certain weight?
Do you have a number of catch-all accounts on your servers? Your spam to ham ratio is extremely high - 97.58% spam, 2.42% ham. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Friday, December 01, 2006 4:51 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Way to delete spam over a certain weight? Not really sure, I don't think the service was restarted since the last reboot which has been 9 days. We have 3 servers running all with 2, dual-core 2.6 Opterons (they rock) in each, 3 - 15K SCSI's in Raid 5, 2 gigs Ram on HP DL385's. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, December 01, 2006 3:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Way to delete spam over a certain weight? Are those stats for a week or a day? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Friday, December 01, 2006 12:03 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Way to delete spam over a certain weight? I am running Smartermail2.6 with Declude 3.11. We are slaying some serious spam, (Total: 4129440 [Spam: 4029758 Virus: 626]), so much we can no longer complete searches for customers who want their spam zipped and sent to them each evening in less than 4 hours. I don't want to delete for individual tests but would rather delete spam with an absurd weight on it. Any ideas for this? Thanks, Chris Patterson, CCNA Network Engineer/Support Manager Rapid Systems --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Way to delete spam over a certain weight?
Are those stats for a week or a day? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Friday, December 01, 2006 12:03 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Way to delete spam over a certain weight? I am running Smartermail2.6 with Declude 3.11. We are slaying some serious spam, (Total: 4129440 [Spam: 4029758 Virus: 626]), so much we can no longer complete searches for customers who want their spam zipped and sent to them each evening in less than 4 hours. I don't want to delete for individual tests but would rather delete spam with an absurd weight on it. Any ideas for this? Thanks, Chris Patterson, CCNA Network Engineer/Support Manager Rapid Systems --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How Accurate is Sniffer?
We weight sniffer enough to move something to the users junk mail folder. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Dodell Sent: Thursday, November 30, 2006 10:25 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How Accurate is Sniffer? I'm doing my 30 day trial of Message Sniffer .. at the moment it is 5 points out of 10 needed to mark something as spam. How accurate is Sniffer?Something that I can raise my weight on? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IronPort
Does anyone know how to get in touch with these folks: http://www.ironport.com/technology/ironport_antispam.html Apparently they have blackedlisted at least one of our IP addresses for one reason or another. - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com <http://www.handynetworks.com/> --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire
Hi Don - Have you considered moving away from iMail? SmarterMail is a great value and it sounds like things are only going to continue to improve with SmarterMail 4.0, which is due early next year. Also, have you looked at Message Sniffer (www.armresearch.com)? It's about $450/yr, but worth every penny. ----- Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Friday, November 10, 2006 6:37 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire Dear Declude List, I am seeking an IMail/Declude/Sniffer, etc. expert for consultation and hire via telephone, e-mail, and remote Terminal Server. Please contact me off list if interested in helping teach this old dog new tricks. Below is some info about our situation. With ongoing issues, bugs, and version changes (both IMail and Declude), we need help with not only decision making moving forward, but the best configurations for our clients filtering Spam and Virus'. All our licenses and SA's are up-to-date, but we remain at IMail 8.22 and Declude 1.82. Our license renewal dates are forthcoming for IMail in December, and Declude next year. Product knowledge with great results of other technologies like MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are certainly would consider if better alternatives can be proven. I recently tried implementing MXGuard and invURIBL with limited success and reverted back to our original set-up, as it seemed to be catching more Spam. Not sure it was these products fault, but perhaps myself in the set-up? We have been using IMail/Declude since early version 4.0 days and with mostly acceptable filtering results until these last few years, and growing worse in recent months with .gif and stock spams. I currently need some concentrated help with set-up, upgrades, and guidance. While we are a small hosting and Coldfusion Dev firm (about 100 hosting clients since the early 90's), we also work with a lot of churches and the recent Spam getting through is not acceptable. Our current issues are not with performance/volume of e-mail as we only process about 30-40k messages in/out daily. We want to upgrade to our licensed latest version of IMail (and Declude), but "any" existing IMail and Web Mail issues would not be acceptable to our clients (i.e. slowness, miscalculated bytes, etc.) Our current set-up and tools are as follows: -Windows 2000 Advanced Server -IMail 8.22 / Declude 1.82 / Sniffer -SQL 7 Database (separate server and do not use IMail registry) -F-Prot -BlackIce (use for intrusion detection and tar-pitting dictionary attacks) -The old Spam Review to ID False Positives I hope some folks here are interested and no problem reimbursing for same. Again, please contact me off list if interested. Thanks. -Don Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] orphaned .hdr files
Same here. Declude support advised me to disable fprot and turn on the builtin scanner. That was about an hour ago, and I haven't had any screwed up messages. Typically, I was getting 2-3 every 10 minutes. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Dobbin Sent: Friday, November 03, 2006 5:31 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] orphaned .hdr files Yes- but real-time protection is disabled. Thanks John Dobbin Pen Publishing Interactive - http://www.penpublishing.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Friday, November 03, 2006 4:10 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] orphaned .hdr files > > Do you run fprot by any chance? > > -Jay > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of John Dobbin > Sent: Thursday, November 02, 2006 4:46 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] orphaned .hdr files > > I seem them from time to time too - never been able to figure > out what's going on with them. > > John > > > Has anyone else using SmarterMail and Declude 4.3.7 > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] orphaned .hdr files
Do you run fprot by any chance? -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Dobbin Sent: Thursday, November 02, 2006 4:46 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] orphaned .hdr files I seem them from time to time too - never been able to figure out what's going on with them. John > Has anyone else using SmarterMail and Declude 4.3.7 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] orphaned .hdr files
In follow up to my own email, I can definitively confirm that these left over .hdr files are messages that Declude is barfing on. I searched all of them and found the .hdr that corresponds to the missing message: 1822213885697.HDR --- [EMAIL PROTECTED] [EMAIL PROTECTED] auth: [EMAIL PROTECTED] Searching Declude's logs for this message ID indicates the following: 11/02/2006 09:09:19.883 1822213885697 Skipping E-mail from authenticated user [EMAIL PROTECTED]; whitelisted. 11/02/2006 09:09:19.883 1822213885697 ERROR: Could not open (for write) recip file c:\SmarterMail\Spool\proc\work\1822213885697.hdr [32] All in all, this appears to be happening on a very low percentage of the emails we process. We process about 200,000 messages per day. Searching the Declude log indicates we've had the "Could not open" error occur 343 times in the past 14 hrs. Even so, this issue is resulting in valid customer email being lost. A search of the archives reveals no similar issues. However, I checked another SmarterMail / Declude server that we manage, and it too is having similar issues. *** Very interesting. The actual mail data file is still in my SmarterMail spool, except it has an x in front of the file name (ex x1822213885697.eml). This really makes me wonder where the issue lies - with SmarterMail or with Declude. Who is responsible for plucking the messages from the spool and putting them into the work directory, Declude or SmarterMail? -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Thursday, November 02, 2006 4:25 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] orphaned .hdr files Has anyone else using SmarterMail and Declude 4.3.7 experienced orphaned .hdr files in spool\proc\work? I have noticed that these have been occurring for a while and really didn't want to have to deal with the issue. However, we have customers reporting that messages are going missing. I can see that SmarterMail is accepting the missing message in the SMTP log, but then there's nothing in Declude's log or SmarterMail's deliver log. - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] orphaned .hdr files
Has anyone else using SmarterMail and Declude 4.3.7 experienced orphaned .hdr files in spool\proc\work? I have noticed that these have been occurring for a while and really didn't want to have to deal with the issue. However, we have customers reporting that messages are going missing. I can see that SmarterMail is accepting the missing message in the SMTP log, but then there's nothing in Declude's log or SmarterMail's deliver log. ----- Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail 4.x beta
Piss poor upgrade policy. What a croc ... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Saturday, October 21, 2006 3:57 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail 4.x beta SmarterTools just announced some information about the next release of SmarterMail. They are releasing SmarterMail 4.x beta around Novemember 6th. Check out the official statements here: http://forums.smartertools.com/forums/thread/21267.aspx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools
No gateway and email is delivered directly to our servers. I still have whitelist 127.0.0.1 with on ill effects I’m aware of. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 5:18 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools Are you using a gateway or is mail delivered directly to your server? We use gateways with IPBYPASS for both of our gateways. This is a migrated configuration from Imail. Do I still need the WHITELIST 127.0.0.1 that was put in because of Imail’s web interface? I am going to take that out to see what happens. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay > Sudowski - Handy Networks LLC > Sent: Wednesday, October 18, 2006 1:34 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] SmarterMail and Subspools > > Hmmm. I'm running 4.3.7 and not seeing that: > > 10/18/2006 13:27:55.114 694158291036 SNIFFER:30 . Total weight = 30. > 10/18/2006 13:27:59.379 694158291036 Using [incoming] CFG file > C:\SMARTERMAIL\Declude\$default$.junkmail. > 10/18/2006 13:27:59.379 694158291036 Tests failed [weight=30]: > SNIFFER=WARN[30] WEIGHT17=IGNORE[17] WEIGHT20=WARN[20] > WEIGHT30=WARN[30] > > 10/18/2006 13:27:59.379 694158291036 Msg failed SNIFFER (Message failed > SNIFFER: 53.). Action=""> > 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT17 (Weight of 30 > reaches or exceeds the limit of 17.). Action=""> > 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT20 (Weight of 30 > reaches or exceeds the limit of 20.). Action=""> > 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT30 (Weight of 30 > reaches or exceeds the limit of 30.). Action=""> > 10/18/2006 13:27:59.379 694158291036 L1 Message OK > 10/18/2006 13:27:59.379 694158291036 Subject: Start a career that > provides a lifetime residual income > 10/18/2006 13:27:59.379 694158291036 From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] IP: 216.150.31.98 ID: nw67avwquycqo1x > 10/18/2006 13:27:59.379 694158291036 Action(s) taken for > [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> > 10/18/2006 13:27:59.379 694158291036 Cumulative action(s) taken on this > email = IGNORE WARN [LAST ACTION=""> > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Kevin Bilbee > Sent: Wednesday, October 18, 2006 3:28 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] SmarterMail and Subspools > > The domain aliases issue has reappeared. I have confirmed it with > Declude. > > We are running "Declude Version 4.3.7 for SmarterMail" > > > Kevin Bilbee > > Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail and Subspools
Hmmm. I'm running 4.3.7 and not seeing that: 10/18/2006 13:27:55.114 694158291036 SNIFFER:30 . Total weight = 30. 10/18/2006 13:27:59.379 694158291036 Using [incoming] CFG file C:\SMARTERMAIL\Declude\$default$.junkmail. 10/18/2006 13:27:59.379 694158291036 Tests failed [weight=30]: SNIFFER=WARN[30] WEIGHT17=IGNORE[17] WEIGHT20=WARN[20] WEIGHT30=WARN[30] 10/18/2006 13:27:59.379 694158291036 Msg failed SNIFFER (Message failed SNIFFER: 53.). Action=WARN. 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT17 (Weight of 30 reaches or exceeds the limit of 17.). Action=IGNORE. 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT20 (Weight of 30 reaches or exceeds the limit of 20.). Action=WARN. 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT30 (Weight of 30 reaches or exceeds the limit of 30.). Action=WARN. 10/18/2006 13:27:59.379 694158291036 L1 Message OK 10/18/2006 13:27:59.379 694158291036 Subject: Start a career that provides a lifetime residual income 10/18/2006 13:27:59.379 694158291036 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.150.31.98 ID: nw67avwquycqo1x 10/18/2006 13:27:59.379 694158291036 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 10/18/2006 13:27:59.379 694158291036 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 3:28 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases issue has reappeared. I have confirmed it with Declude. We are running "Declude Version 4.3.7 for SmarterMail" Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay > Sudowski - Handy Networks LLC > Sent: Wednesday, October 18, 2006 11:56 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] SmarterMail and Subspools > > The domain aliases being treated as outgoing domain has been long since > resolved. When SmarterMail 3.x came out, it was a problem because of > the new file format they used to store configuration data, but the > issue > was fixed quickly. > > As for the sub-spool question, I'm not sure ... I've honestly never > found a need to use the sub-spools. What is your definition of high > volume? We have SmarterMail servers processing 250K inbound messages > per day running a single spool. > > -Jay > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Kevin Bilbee > Sent: Tuesday, October 17, 2006 11:18 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] SmarterMail and Subspools > > I do not know if it does but. I can tell you that you need to be > careful > with domain aliases on SmarterMail. They are treated as outgoing for > junkmail processing. > > > Kevin Bilbee > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Mark Strother > > Sent: Tuesday, October 17, 2006 6:33 PM > > To: declude.junkmail@declude.com > > Subject: [Declude.JunkMail] SmarterMail and Subspools > > > > > > Does Declude work correctly with the subspool feature of > > SmarterMail? I believe I read somewhere that it doesn't. This > > is a requirement of a high volume SmarterMail server and > > seems like it would relatively easy to implement. > > > > Can anyone comment? > > > > Mark Strother > > Pacific Online > > Phone: 604-638-6010 ext. 222 > > Fax: 604-638-6020 > > Toll Free: 1-877-503-9870 > > http://www.pacificonline.com > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Robert Grosshandler > > Sent: Tuesday, October 17, 2006 3:46 PM > > To: declude.junkmail@declude.com > > Subject: [Declude.JunkMail] Test - ignore > > > > Test, please ignore. > > > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be > > found at http://www.mail-archive.com. > > > > > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be > > found at http://www.mail-archive.com. > > > > > > > > --- > This E-mail came from the Declude.Ju
RE: [Declude.JunkMail] Whitelisting flaw in Declude?
Also, realize that on servers processing a large volume of messages per day, the additional IO necessary to create duplicate messages and header files for each specific recipient would be a death sentence... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 9:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darin Cox > Sent: Tuesday, October 17, 2006 12:37 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? > > It's actually more of an issue of how the mail server handles the > message. > In the case of multiple recipients, since there is only one message > file addressed to multiple recipients in the headers, it's either > deliver or not deliver unless you rewrite the headers to modify the > recipient list. I think I'd rather not have the spam filtering system > alter that. Add to the header, yes. Alter the recipients, no. > > Also, I have not come across a situation where I wanted to let a > message go through to one recipient and not to others, except in the > situation of lists which is a whole other topic. > > Darin. > > > - Original Message - > From: "Dave Beckstrom" <[EMAIL PROTECTED]> > To: > Sent: Tuesday, October 17, 2006 3:11 PM > Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? > > > I would call that a flaw, then, in how Declude processes the whitelist. > > I have a listserver email address for which I do not want email spam > checked. This is because I don't want messages going out to the list > that say SPAM in the subject line. Because nobody who is not a member > on the list can post to the list, there is no problem whitelisting the > "TO" > address > for mail sent to the list server email address. > > However, spammers will send an email to a dozen of our mail addresses > (12 > recipients) one of which is the whitelised "TO" address for the > listserver. > Because of the way Declude processes the whitelist, that means that > the other 11 recipient receive the spam even though mail to them is > not whitelisted. > > That is a bad design on Declude's part, wouldn't you agree? Anyone > else feel that this needs to be rectified? > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Darrell > > ([EMAIL PROTECTED]) > > Sent: Tuesday, October 17, 2006 11:25 AM > > To: declude.junkmail@declude.com > > Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? > > > > If one user is whitelisted they all will be whitelisted for that > email. > > There are some things you can do to prevent this like > > BYPASSWHITELIST > test. > > > > Darre;; > > > > > > - > --- > > Check out http://www.invariantsystems.com for utilities for Declude > And > > Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI > integration, > MRTG > > Integration, and Log Parsers. > > > > - Original Message - > > From: "Dave Beckstrom" <[EMAIL PROTECTED]> > > To: > > Sent: Tuesday, October 17, 2006 11:18 AM > > Subject: [Declude.JunkMail] Whitelisting flaw in Declude? > > > > > > If an email is received that is addressed to multiple recipients, > > one > of > > whom is whitelisted, does Declude treat the email as whitelisted for > all > > recipients? > > > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail
RE: [Declude.JunkMail] SmarterMail and Subspools
The domain aliases being treated as outgoing domain has been long since resolved. When SmarterMail 3.x came out, it was a problem because of the new file format they used to store configuration data, but the issue was fixed quickly. As for the sub-spool question, I'm not sure ... I've honestly never found a need to use the sub-spools. What is your definition of high volume? We have SmarterMail servers processing 250K inbound messages per day running a single spool. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 11:18 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools I do not know if it does but. I can tell you that you need to be careful with domain aliases on SmarterMail. They are treated as outgoing for junkmail processing. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Mark Strother > Sent: Tuesday, October 17, 2006 6:33 PM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] SmarterMail and Subspools > > > Does Declude work correctly with the subspool feature of > SmarterMail? I believe I read somewhere that it doesn't. This > is a requirement of a high volume SmarterMail server and > seems like it would relatively easy to implement. > > Can anyone comment? > > Mark Strother > Pacific Online > Phone: 604-638-6010 ext. 222 > Fax: 604-638-6020 > Toll Free: 1-877-503-9870 > http://www.pacificonline.com > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Robert Grosshandler > Sent: Tuesday, October 17, 2006 3:46 PM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] Test - ignore > > Test, please ignore. > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] blackholes.us
Is blackholes.us down for anyone else? All of our RBL tests to them are timing out. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Interesting SMTP connection patterns
Well, it didn't run for us. We tried and it caused random BSOD and ISS wouldn't provide any support. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, October 12, 2006 7:38 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns Blackice runs perfect on Windows 2003 server. I posted the install instructions on this list a couple of weeks ago. Craig -- I believe some email servers will open a secondary connection as part of their spam checking. In that case, you might see 2 connections which would be legitimate. What setting did you change in blackice to drop those IPs with multiple connections? > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay > Sudowski - Handy Networks LLC > Sent: Thursday, October 12, 2006 7:59 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns > > Of course, BlackIce does not support Windows 2003. > > -Jay > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Craig Edmonds > Sent: Thursday, October 12, 2006 3:51 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns > Importance: High > > That's why I now use Blackice Server from IIS. > > It can detect multiple smtp connections and close ips down > automatically. > > Its pretty slick. > > Kindest Regards > Craig Edmonds > 123 Marbella Internet > W: www.123marbella.com > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Thursday, October 12, 2006 11:24 PM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] Interesting SMTP connection patterns > > Yesterday I took a snapshot of the SMTP connections active on our > server. I > then did a reverse IP to find out where they were from. > > Below are the results. You can see someone from Thailand had 5 SMTP > connections active and Spain had 4. You can also see that only 3 of the > IPS > connected were for potentially legitimate email. We don't get any > legitimate email from other Countries so everything not from the USA > would > be spam. > > Any idea why a spammer would open more than one SMTP connection? > > > 202.139.211.241 5 Thailand > 88.0.230.26 4 Spain > 71.55.71.138 2 USA > 87.219.166.9 2 Spain > 213.85.39.108 1 Russian Federation > 84.77.107.183 1 Spain > 83.131.106.2341 Croatia > 84.61.135.61 1 Germany > 83.84.74.219 1 Netherlands > 90.9.36.180 1 France > 83.167.108.79 1 Russian Federation > 67.172.162.33 1 USA > 84.54.248.96 1 Russian Federation > 86.75.242.215 1 France > 201.208.171.250 1 Venezuela > 88.204.240.1771 Kazakstan > 82.158.0.237 1 Spain > 69.30.246.125 1 USA > 200.168.86.2241 Brazil > 83.167.108.44 1 Russian Federation > 75.41.79.203 1 USA > 200.206.252.123 1 Brazil > 84.60.109.148 1 Germany > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Interesting SMTP connection patterns
Of course, BlackIce does not support Windows 2003. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Thursday, October 12, 2006 3:51 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns Importance: High That's why I now use Blackice Server from IIS. It can detect multiple smtp connections and close ips down automatically. Its pretty slick. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, October 12, 2006 11:24 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Interesting SMTP connection patterns Yesterday I took a snapshot of the SMTP connections active on our server. I then did a reverse IP to find out where they were from. Below are the results. You can see someone from Thailand had 5 SMTP connections active and Spain had 4. You can also see that only 3 of the IPS connected were for potentially legitimate email. We don't get any legitimate email from other Countries so everything not from the USA would be spam. Any idea why a spammer would open more than one SMTP connection? 202.139.211.241 5 Thailand 88.0.230.26 4 Spain 71.55.71.1382 USA 87.219.166.92 Spain 213.85.39.108 1 Russian Federation 84.77.107.183 1 Spain 83.131.106.234 1 Croatia 84.61.135.611 Germany 83.84.74.2191 Netherlands 90.9.36.180 1 France 83.167.108.79 1 Russian Federation 67.172.162.33 1 USA 84.54.248.961 Russian Federation 86.75.242.215 1 France 201.208.171.250 1 Venezuela 88.204.240.177 1 Kazakstan 82.158.0.2371 Spain 69.30.246.125 1 USA 200.168.86.224 1 Brazil 83.167.108.44 1 Russian Federation 75.41.79.2031 USA 200.206.252.123 1 Brazil 84.60.109.148 1 Germany --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamHaus
Has anyone been following the SpamHaus debacle? http://www.ibtimes.com/articles/20061009/anti-spam-lawsuit.htm - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Determining Declude Processing Times
Easiest method is to put your declude logs into DEBUG mode and then look at the run time for the individual tests. Note you should only leave debug mode enabled for a few minutes; the log files can grow huge very quickly. From personal experience, I’ve found that proc folder will get backed up because of external test delays (Ex sniffer) or RBL responses being slow due to overloaded / malfunctioning DNS server. -Jay From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Will Sent: Monday, October 09, 2006 11:27 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Determining Declude Processing Times Sensitivity: Confidential My proc folder gets backed up a lot. Often I upgrade the declude version and it runs good for many months and then I start seeing the same problem again. What is the easiest method to determine the declude processing time takes so long? I need a method to determine which test has such a delay and disable it or remedy it. Will ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: CBL Blocking
Have you setup iMail so that it will only use one helo/ehlo hostname? -Jay From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Thursday, September 28, 2006 6:54 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: CBL Blocking Importance: High Sensitivity: Confidential Can anyone help me with this CBL blocking problem/imail?. Twice today they have blacklisted me and trust me I have done absolutely everything they have said. I have run all the tools they have suggested, my server is patched, I have 3 firewalls yet still they find reason to blacklist. This is driving me nuts and costing me headaches becasue all my clients emails are bouncing. This of course translates to thousands of dollars in losses everyday I am blacklisted. Yes, I am running Imail. Does anyone have any ideas? Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ASSP
The only real difference is COST!!! $12,500 for more than 5,000 users - PER YEAR. Wowza ... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, September 19, 2006 5:27 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] ASSP To the best of my knowledge Declude Interceptor is really no different than the regular version of Declude packaged into a gateway. The real benefit of Interceptor is that you are no longer coupled to Imail/Smartermail in the gateway environment. From my testing you had all of the same files under the Declude folder (global.cfg, virus.cfg, declude.cfg, etc). They have a very nice web interface for managing the product. Having the option to have Declude not bundled with Imail or Smartermail is nice. However, I did not see any real difference with the products. David - What is new in Interceptor that I may have missed compared to the version of Declude we run under Imail\Smartermail. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. xx-xx- --x--x writes: > Maybe you should run your assp gateway against the Declude interceptor > > On 9/19/06, Harry Vanderzand <[EMAIL PROTECTED]> wrote: >> >> I am interested in this also. Maybe it can be on list? >> >> Harry Vanderzand >> inTown Internet & Computer Services >> 519-741-1222 >> >> >> >> >> > -Original Message- >> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On >> > Behalf Of Don Brown >> > Sent: Tuesday, September 19, 2006 3:03 PM >> > To: declude.junkmail@declude.com >> > Subject: [Declude.JunkMail] ASSP >> > >> > There were a couple of recent posts from folks who had >> > recently implemented ASSP. We have to do the same due to the >> > vulnerability in Imail 8.22. >> > >> > I'd appreciate any comments, suggestions, etc. OFF LIST, >> > from those who have already fell in the holes, etc. >> > >> > Thanks, >> > >> > >> > >> > Don Brown - Dallas, Texas USA Internet Concepts, Inc. >> > [EMAIL PROTECTED] http://www.inetconcepts.net >> > (972) 788-2364Fax: (972) 788-5049 >> > >> > >> > >> > >> > --- >> > This E-mail came from the Declude.JunkMail mailing list. To >> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> > type "unsubscribe Declude.JunkMail". The archives can be >> > found at http://www.mail-archive.com. >> > >> > >> > >> >> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module
I think it means you have to pick up the phone and call them. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, September 08, 2006 12:12 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module It's a catch-22. You send a message to [EMAIL PROTECTED] and get a reply back saying that they will no longer pay attention to messages sent to [EMAIL PROTECTED] What does it mean when customers have to try to get in touch with Declude so that they "flip the switch" so that the customer can get in touch with Declude? Original Message > From: "Kevin Bilbee" <[EMAIL PROTECTED]> > Sent: Thursday, September 07, 2006 9:32 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module > > Then I would contact customer service to have them flip the switch so you > can place support tickets. > > > Kevin > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Gary Steiner > > Sent: Thursday, September 07, 2006 5:17 PM > > To: declude.junkmail@declude.com > > Subject: [Declude.JunkMail] [EMAIL PROTECTED] versus new > > case management module > > > > > > Interesting. If I log in to my account on the Declude web > > site, there is no option listed for the new CRM module. It > > is not that it is grayed out as described below. It just > > isn't there. And I do have a current service agreement. > > > > So, since according to this message we can no longer use > > [EMAIL PROTECTED], and the supposed new CRM module doesn't > > seem to be available, how do we contact Declude support? > > > > By the way, the reason I was trying to contact Declude > > support is that I was investigating the latest all_list.dat > > file, and found that the download link on the Declude web > > site is now no longer valid. (The download link for the > > Declude GUI didn't work either, as well as the link for the > > demo copy of Sniffer.) Seems that when Declude updated their > > web site they forgot to check the one thing on the web site > > that an existing customer is most likely to use, such as all > > their download links. > > > > And they wonder why we get upset. > > > > > > Original Message > > > From: [EMAIL PROTECTED] > > > Sent: Thursday, September 07, 2006 7:44 PM > > > To: [EMAIL PROTECTED] > > > Subject: re: [17D-0C9324FF-DB7C] Latest all_list.dat > > > > > > Thank you for submitting a ticket to support. Your ticket number is > > > [17D-0C9324FF-DB7C]. > > > > > > Please keep this ticket number for your records and include > > it in the > > > subject (including brackets) of all future emails regarding this > > > issue. > > > > > > The response time during business hours is usually within > > 24 hours, if > > > you have had no response in this time please do not > > hesitate to call > > > our support number 1-866-332-5833 > > > > > > IMPORTANT NOTICE > > > > > > Declude is migrating to a new CRM business solution which > > includes a > > > new case management module. We will begin using this feature > > > beginning the week of 28 August, the result of this action > > means that > > > Declude will no longer accept and create support cases > > using the email > > > address [EMAIL PROTECTED] > > > > > > You will need to login into your Declude account to submit > > a case. If > > > you can not submit a case due to the option being "grayed out" this > > > means that you do not have an active service agreement. > > Call customer > > > care 866-332-5822 #3 to purchase or renew a service agreement. > > > > > > > > > We understand that this will be awkward and/or unwanted, > > however our > > > goal is to continue servicing our paying customers. > > > > > > Thank You. > > > Declude Technical Support > > > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] interesting ...
Interesting: http://www.declude.com/sppurchase.asp?cat=29 Service Providers are not allowed to take advantage of the Commtouch functionality due to strict license restrictions. The good news? Declude will offer you a FREE subscription to Message Sniffer. Message Sniffer ties into Declude as an external test. Using advance pattern matching and artificial intelligence technologies from MicroNeil Research, Message Sniffer applies thousands of heuristic tests to each incoming message in just a fraction of a second. Unlike many anti-spam products that scan for content, Message Sniffer's tests search for combinations of spam features including message sources, common obfuscation techniques, Email and url targets and fragments, and even coding styles. Any questions contact Kristina ([EMAIL PROTECTED]) today at 978.499.2933 x7011. I presume this only applies to folks shelling out $1650 a year for Declude, though. Thanks! ----- Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Goober of the year
We block all POP3 and aliases that forward to aol.com because customers always manage to report the messages forwarded from our server as spam, and consequently blacklist our server with AOL. Customers ... sigh ... From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Butch Andrews Sent: Tuesday, August 01, 2006 10:14 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Goober of the year I must write the list to see if my customer meets the criteria for "goober" of the year. We use Imail and Declude Junkmail. My customer requested over a year ago to be removed from Spam filtering and I did this. Recently he called and requested that we set up Imail to forward his email to a new email account he opened with AOL. Our customer support software makes these changes on our server so the fact that his mail folder was receiving unfiltered mail went undetected. In addition this winner went into his webmail interface and put a vacation notice that was sent to all incoming email that he had a new address at AOL and he included it in the email. I hope you can follow this. "Soo" now his account with us is receiving hundreds of spam that are forwarded to his new AOL account. He sends the spammer his new address with the vacation reply from our server. That email bounces back to my server which forwards it back to AOL. They bounce it back to him which forwards back to them via the mail forwarding he set up. Those spammers that are monitoring bounce back messages have his new address. My mail server becomes blocked by AOL. Isn't it great to be a small facilities based ISP trying to survive in today's Internet with customers like this? I closed his account. Thanks for the time I had to tell someone who might understand. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How is a message score passed to SmarterMail?
SmarterMail content filters can easily search headers … I have been doing this for weeks without issue. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Friday, July 28, 2006 1:27 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] How is a message score passed to SmarterMail? It would be nice if SmarterTools would introduce a simple scoreable text filter that could search at least the headers. That way a score could be passed from any gateway to SmarterMail for actions. Matt Jay Sudowski - Handy Networks LLC wrote: I can confirm this is the only way it will work. Declude communicatesthe score directly to SmarterMail in a way that breaks when a messagehas been relayed from a gateway server. In such instances, it'snecessary to setup SmarterMail content filter rules based up yourDeclude inserted headers and set the appropriate actions. -Jay -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of JohnT (Lists)Sent: Friday, July 28, 2006 3:37 AMTo: declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] How is a message score passed toSmarterMail? I think what he means is serverA is doing the scanning and then themessageis sent to serverB and he wants serverB to know what the score was andtotake action. Why not add a custom header line with the total weight via Declude andthenset up the rules on serverB to look for that line in the header. John TeServices For You "Seek, and ye shall find!" -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin BilbeeSent: Thursday, July 27, 2006 9:51 PMTo: declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] How is a message score passed to SmarterMail? It is passed int the .hdr file. Kevin Bilbee -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] OnBehalf Of Mark StrotherSent: Thursday, July 27, 2006 9:03 PMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] How is a message score passed toSmarterMail? Could someone explain to me how the message score is passedto SmarterMail? I would like to set up a SmarterMail server, running Declude,as a gateway for our mail. The problem with this setup is, inmy tests, SmarterMail doesn't recognize the Declude scoreswhen they are a generated on another server. This means thatusers wouldn't be able to configure their own rules such asdelete mail if the score is >20. Is there anyway I can run Declude on my gateway server andpass the score to SmarterMail on another server? I just wantto tag the messages on the gateway machine and then let usersset custom actions using the SmarterMail interface. Any thoughts would be appreciated! Mark ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can befound at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] How is a message score passed to SmarterMail?
I can confirm this is the only way it will work. Declude communicates the score directly to SmarterMail in a way that breaks when a message has been relayed from a gateway server. In such instances, it's necessary to setup SmarterMail content filter rules based up your Declude inserted headers and set the appropriate actions. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Friday, July 28, 2006 3:37 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] How is a message score passed to SmarterMail? I think what he means is serverA is doing the scanning and then the message is sent to serverB and he wants serverB to know what the score was and to take action. Why not add a custom header line with the total weight via Declude and then set up the rules on serverB to look for that line in the header. John T eServices For You "Seek, and ye shall find!" > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin > Bilbee > Sent: Thursday, July 27, 2006 9:51 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] How is a message score passed to SmarterMail? > > It is passed int the .hdr file. > > > Kevin Bilbee > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > > Behalf Of Mark Strother > > Sent: Thursday, July 27, 2006 9:03 PM > > To: declude.junkmail@declude.com > > Subject: [Declude.JunkMail] How is a message score passed to > > SmarterMail? > > > > > > Could someone explain to me how the message score is passed > > to SmarterMail? > > > > I would like to set up a SmarterMail server, running Declude, > > as a gateway for our mail. The problem with this setup is, in > > my tests, SmarterMail doesn't recognize the Declude scores > > when they are a generated on another server. This means that > > users wouldn't be able to configure their own rules such as > > delete mail if the score is >20. > > > > Is there anyway I can run Declude on my gateway server and > > pass the score to SmarterMail on another server? I just want > > to tag the messages on the gateway machine and then let users > > set custom actions using the SmarterMail interface. > > > > Any thoughts would be appreciated! > > > > Mark > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be > > found at http://www.mail-archive.com. > > > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: ACL Manipulation Tool
I was finally able to get what I needed by using the script here: http://www.serverwatch.com/tutorials/article.php/1476751 and tweaking the following sections: Changed: adsFOLDER_READ = FILE_LIST_DIRECTORY Or FILE_READ_EA Or FILE_TRAVERSE Or _ FILE_READ_ATTRIBUTES Or READ_CONTROL Or SYNCHRONIZE To: adsFolder_READ = FILE_READ_EA OR FILE_READ_ATTRIBUTES OR FILE_LIST_DIRECTORY Changed: oACE.AceFlags = ADS_ACEFLAG_INHERIT_ACE Or ADS_ACEFLAG_UNKNOWN To: oACE.AceFlags = ADS_ACEFLAG_NO_PROPAGATE_INHERIT_ACE Additionally, I commented out the loops in the RecurseACLs sub. What a project this turned out to be. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Thursday, July 27, 2006 4:33 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: ACL Manipulation Tool Well that sucks. Kevin > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay > Sudowski - Handy Networks LLC > Sent: Thursday, July 27, 2006 12:39 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] OT: ACL Manipulation Tool > > > Unfortunately, it seems like the WMI call they make in xcacls.vbs still > ends up enumerating all of the files on the drive ... I'll check > filemon and see the wmi process just hitting all of the files, even > though it's not changing any permissions on those files. Highly > inefficient, but typical MS I suppose :( > > Thanks though. > > -Jay > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Kevin Bilbee > Sent: Thursday, July 27, 2006 3:28 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] OT: ACL Manipulation Tool > > Looking at the code for Xcalcs it should work for you. If you are using > inheritance and do not want it to iterate all the files then you cannot > use the /T, /F, of /S options. If you use one of these do it will > iterate all files on the drive. > > > Kevin Bilbee > > > -----Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Jay > > Sudowski - Handy Networks LLC > > Sent: Thursday, July 27, 2006 9:35 AM > > To: Declude.JunkMail@declude.com > > Subject: [Declude.JunkMail] OT: ACL Manipulation Tool > > > > I am seeking out an ACL manipulation tool that will let me set the > > "Read Attributes" permission on the root of a drive (no inheritance), > > that does not automatically apply the permission to sub-files/folders > > and also does not 'touch' every file on the server. I have tried the > > following tools, but ran into the issues noted: > > > > Cacls - Does not support "Read Attributes" permission. Does not > allow > > inheritance to be specified. However, cacls only modifies ACLs on > the > > specified root drive and nothing more, so performance is very quick. > > > > Xcacls.vbs - Supports "Read Attributes" permission, and allows for > > proper control over inheritance. However, when setting the > permission, > > this tool enumerates every single file on the drive, making the > process > > extremely slow. > > > > Setacl.exe - Supports "read attributes" permission, and allows for > > proper control over inheritance. Unfortunately, it doesn't seem to > set > > permissions properly on the root of a drive. > > > > FileACL.exe - Supports "read attributes" permission, and allows for > > proper control over inheritance. However, when setting the > permission, > > this tool enumerates every single file on the drive, making the > process > > extremely slow. > > > > Xcacls.exe - Does not support "read attributes" permission, and seems > > to insert ACE entries in a non-supported manner on Windows 2003 > > servers. > > > > Dacl.vbs - Does not support "read attributes" permission. > > > > Is anyone aware of any other tools available? > > > > Thanks! > > - > > Jay Sudowski // Handy Networks LLC > > Director of Technical Operations > > Providing Shared, Reseller, Semi Managed and Fully Managed Windows > 2003 > > Hosting Solutions > > Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: ACL Manipulation Tool
Unfortunately, it seems like the WMI call they make in xcacls.vbs still ends up enumerating all of the files on the drive ... I'll check filemon and see the wmi process just hitting all of the files, even though it's not changing any permissions on those files. Highly inefficient, but typical MS I suppose :( Thanks though. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Thursday, July 27, 2006 3:28 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: ACL Manipulation Tool Looking at the code for Xcalcs it should work for you. If you are using inheritance and do not want it to iterate all the files then you cannot use the /T, /F, of /S options. If you use one of these do it will iterate all files on the drive. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay > Sudowski - Handy Networks LLC > Sent: Thursday, July 27, 2006 9:35 AM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] OT: ACL Manipulation Tool > > I am seeking out an ACL manipulation tool that will let me set the > "Read Attributes" permission on the root of a drive (no inheritance), > that does not automatically apply the permission to sub-files/folders > and also does not 'touch' every file on the server. I have tried the > following tools, but ran into the issues noted: > > Cacls - Does not support "Read Attributes" permission. Does not allow > inheritance to be specified. However, cacls only modifies ACLs on the > specified root drive and nothing more, so performance is very quick. > > Xcacls.vbs - Supports "Read Attributes" permission, and allows for > proper control over inheritance. However, when setting the permission, > this tool enumerates every single file on the drive, making the process > extremely slow. > > Setacl.exe - Supports "read attributes" permission, and allows for > proper control over inheritance. Unfortunately, it doesn't seem to set > permissions properly on the root of a drive. > > FileACL.exe - Supports "read attributes" permission, and allows for > proper control over inheritance. However, when setting the permission, > this tool enumerates every single file on the drive, making the process > extremely slow. > > Xcacls.exe - Does not support "read attributes" permission, and seems > to insert ACE entries in a non-supported manner on Windows 2003 > servers. > > Dacl.vbs - Does not support "read attributes" permission. > > Is anyone aware of any other tools available? > > Thanks! > - > Jay Sudowski // Handy Networks LLC > Director of Technical Operations > Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 > Hosting Solutions > Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: ACL Manipulation Tool
I am seeking out an ACL manipulation tool that will let me set the "Read Attributes" permission on the root of a drive (no inheritance), that does not automatically apply the permission to sub-files/folders and also does not 'touch' every file on the server. I have tried the following tools, but ran into the issues noted: Cacls - Does not support "Read Attributes" permission. Does not allow inheritance to be specified. However, cacls only modifies ACLs on the specified root drive and nothing more, so performance is very quick. Xcacls.vbs - Supports "Read Attributes" permission, and allows for proper control over inheritance. However, when setting the permission, this tool enumerates every single file on the drive, making the process extremely slow. Setacl.exe - Supports "read attributes" permission, and allows for proper control over inheritance. Unfortunately, it doesn't seem to set permissions properly on the root of a drive. FileACL.exe - Supports "read attributes" permission, and allows for proper control over inheritance. However, when setting the permission, this tool enumerates every single file on the drive, making the process extremely slow. Xcacls.exe - Does not support "read attributes" permission, and seems to insert ACE entries in a non-supported manner on Windows 2003 servers. Dacl.vbs - Does not support "read attributes" permission. Is anyone aware of any other tools available? Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server
We use PRTG here and it works quite well. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Marchette Sent: Thursday, June 01, 2006 4:25 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server I’ll second the recommendation for Paessler’s PRTG product. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Thursday, June 01, 2006 1:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server MRTG is free but a pain to setup and reporting is limited. Some swear by Cacti, but setup is also complex. A reasonable cost effective tool is Paessler. Windows-specific, but well implemented and supported. http://www.paessler.com/ It has a packet capture mode (aka “sniffer”) which will do a lot more than just snmp counting and exports reports to pdf From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Thursday, June 01, 2006 10:04 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server Hi Robert, All very good questions. The client is paying for piece work as opposed to an hourly rate so monitoring time spent against time billed is not a concern. Mostly they want to know if the developers are using the environment that has been provided to them. 2 SQL servers, 2 web servers, 2 application servers. Comments like did they just upload the new stuff the day before the deliverable date? Are they using the environment that was provided for 5 minutes a day or hours per day? I am thinking of it as more of a validation of the whole support environment for the developers rather than did they update/fix that web page. Monitoring the host machines via SNMP might be an idea. Any simple (but good) tool leap to mind? Thanks Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Wednesday, May 31, 2006 7:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server Let’s start at the high-level: What question are you trying to answer? e.g: “Are the developers spending enough time doing the work they should be doing”? “Are the developers doing things they should not be doing”? “Are the developers competent and performing their job properly”? “Are the developers hours spent working matching their timesheets/project sheets? Etc. There are different solutions depending upon your objectives. Note: Personally, for outsourcing I pay based on a project or deliverable so tracking time/usage is of no interest to me. I pay for a certain result and don’t care if it takes an hour or a week to do it. Also, I audit the quality of the finished product/code/service, I don’t care about the tools/methods used to reach that goal. In your case: Since you have a virtual server environment, you can also audit at the host level. E.g. you can run SNMP tools and measure traffic (bps and total bytes in/out) on the virtual network ports of the virtual machine to see the activity level. You can see the protocol (http, http, netbios, smb, etc.) to see what type of activity is flowing through the machine. If you run the tool in a virtual machine on the same physical host, it can use packet capture to fully analyze the traffic and not just SNMP/WMI. You might consider re-writing your outsourcing contract. You really shouldn’t have to police the project/micromanage it. Afterall, management of outsourcing is the hidden cost that can eat you alive and remove any cost benefits so why allow yourself to fall into that black hole? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Wednesday, May 31, 2006 1:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server It is a dev/staging server running in a virtual server environment so I have to be a bit careful what I turn on or don’t. I tried the auditing a file. Wow talk about generating Security Event Log records. I turned auditing on for two files bginfo.exe and its corresponding config.bgi file. Then I ran it to generate the background on file server. That simple little thing created 15 log entries. If we turn this on we are going to need something to parse the security log file as I can see that it is going to produce a HUGE amount traffic in there. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Mickey Sent: Wednesday, May 31, 2006 3:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Monitoring/Auditing a Windows Server You could also enable au
RE: [Declude.JunkMail] Experience with 4.x
Hi Matt - I am still somewhat confused because you are painting a rather broad picture about your success with Alligate, and not really getting down to the nitty gritty specifics. I can appreciate that you may not want to disclose your exact configuration. However, I can't even figure out if all of the things you're talking about are available in a stock edition of Alligate with the MXRate subscription, or if you've extended the functionality of Alligate in ways that are specific to your installation, using tools or features that I won't have access to. http://www.alligate.com/help/AdvGreyOptions.htm -> this seems to be the case specific greylisting you're talking about ... http://www.alligate.com/help/blocking.htm -> has some tarpitting options ... Even so, I am still pretty confused about this. Any clarification would be appreciated. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, May 25, 2006 6:16 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x Pieced below: Jay Sudowski - Handy Networks LLC wrote: I am contemplating implementing Alligate with SmarterMail in some fashion, and would like to pick your mind on the following: 1) SmarterMail does a great, great job at handling a huge number of SMTP threads so dictionary attacks are not really an issue. We have popped up to 2000 SMTP threads without incident. And since addresses being attacked do not exist, the messages get rejected with a 550 error, connection is closed and there's no real strain on the server (at least in terms of I/O) -- do we get any benefit from putting Alligate in front of SmarterMail for dictionary attack prevention? Definitely. Not all dictionary attacks hit completely bad addresses, but detecting and stopping an should be rare if you configure it carefully. 2) Does SMTP AUTH pass-through and recipient verification actually work, all the time? I don't use this since it is not necessary to do so for pre-scanning purposes. This is really designed to take the load off of a hosted mail server by off-loading this traffic. I can't say personally that it works perfectly, but I'm sure that it does. Other pass-through verification stuff that it does definitely works, and works efficiently. 3) I see greylisting as the real area that could benefit us -- we would avoid a lot of the zombie spam by implementing greylisting, and that would save us tons of resources all around. However, I understand that some zombies are now greylist aware and will retry. Greylisting is huge, but it has fundamental problems that kept me from using it in vanilla form with ORF. I know that Nick used it with ORF and backed off. My big issues are two-fold. By arbitrarily applying greylisting to everyone, you will effectively block E-mail from sending software that doesn't spool (and zombie spamware isn't the only thing with that limitation). It's things like blackboxes and other forms of notification programming that lacks such functionality and can fail greylisting, at least for the first message. Some bulk mail (ecommerce and otherwise) will only send once, or may requeue and send through a different IP subsequently causing delivery failures or long delays. Even more important to me is the fact that greylisting causing issues with delaying legitimate E-mail, and I refused to implement it in ORF solely for this reason. It's not acceptable for the class of service that I want to offer. I want E-mail to pass through our system in less than 5 seconds except in extreme circumstances. I fed Brian a framework for doing what I call "selective greylisting" which resolves these issues. Essentially it only greylists when conditions warrant, and the only drawback is greylisting poorly configured hosts or some that leak spam (but not all of either). It works so well that there is no reason to have it do full greylisting. I won't go into the details of how this is done here because to some extent I consider it to be intellectual property. Also note that Brian isn't just a coding monkey, and he contributed a lot to the end product and filled in many gaps. There are also advanced tarpitting techniques that cause almost as many failures as greylisting does because some spamware detects tarpitting and disconnect, but it is variable according to when and how long it occurs. The last major piece is the MXRate functionality, and it blocks a lot even when limited to just 100% hits (which surely aren't perfect, but they are very near perfect). Whil
RE: [Declude.JunkMail] Experience with 4.x
Hi Matt - I actually have quite a bit of experience with using ORF for address validation purposes to try and keep our iMail 8.0x up and running when we were getting hammered with dictionary attacks (the ~60 connection limit iMail had was not fun, and forced us to migrate to SmarterMail). Since we moved to SmarterMail, I haven't really seen the need for a gateway server, but I am highly interested in using greylisting in some fashion to keep spam down. I am contemplating implementing Alligate with SmarterMail in some fashion, and would like to pick your mind on the following: 1) SmarterMail does a great, great job at handling a huge number of SMTP threads so dictionary attacks are not really an issue. We have popped up to 2000 SMTP threads without incident. And since addresses being attacked do not exist, the messages get rejected with a 550 error, connection is closed and there's no real strain on the server (at least in terms of I/O) -- do we get any benefit from putting Alligate in front of SmarterMail for dictionary attack prevention? 2) Does SMTP AUTH pass-through and recipient verification actually work, all the time? 3) I see greylisting as the real area that could benefit us -- we would avoid a lot of the zombie spam by implementing greylisting, and that would save us tons of resources all around. However, I understand that some zombies are now greylist aware and will retry. While I don't feel like running DLAnalyzer, we typically trend about 85% of email is spam that gets deleted before it's delivered, which means we probably had around 40,000 actual deliveries. If we can eliminate 50% of the spam using MXRate and greylisting, that is a huge burden off of declude and the server in general. >Out of the net 288,842 messages that our gateway blocked, only 40,137 of >them >received permanent 550 errors not related directly to bad recipients. >All of >the others were blocked by methods that are more passive in nature >and >designed to exploit weaknesses of spamware. Is this a reference to greylisting or some other feature in Alligate I'm not seeing? Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, May 25, 2006 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x Jay, I understand the issues that you have seen, but I might suggest that there is a better way. Besides those that need a gateway for address validation, they can also be very effective at saving a server from overload, or at least increasing it's capacity. I threw together some stats from yesterday just to give a good picture of what is going on. I have 4 MX records with 4 different priorities. My MX1 is running Alligate currently, and my MX2, MX3 and MX4 is still on VamSoft's ORF/MS SMTP, but it will be migrated soon to the same as MX1. My config on both of these products is certainly not out of the box, and I was lucky that Brian was willing to create functionality in Alligate that would achieve what I was looking for. There are many ways to block a lot of spam, but there are very few good ways, and none of them out of the box that I know of which can block it and not create a huge false positive problem. Even Pete from Sniffer considers my judgment to be way too liberal as far as spam goes, but in reality, I am just right (Pete mistakes me killing Sniffer rules for me wanting to allow in what some consider spam, but rather I like to kill ones that are too broad and rely on other things to deal with the bad and the good independent of one another). Anyway, I'm certainly not a zealot, and I believe that delivering the good E-mail is #1 on my list. So with that preface, here's yesterday's stats: 326,840 Total Attempted Messages = 173,305 Messages from Dictionary Attacks Rejected at Gateway * - 153,535 Messages that Were Not a Part of a Dictionary Attack 115,537 Messages Properly Addressed Rejected at Gateway - 37,998 Messages Accepted at Gateway and Sent to Declude - 13,794 Messages blocked by Declude JunkMail 81 Messages Blocked by Declude Virus = 24,123 Messages Delivered to Clients * Due to the way that our gateways work, it is impossible to know exactly how many of the rejected messages were part of dictionary attacks or legitimately addressed since some connect
RE: [Declude.JunkMail] Experience with 4.x
Sounds like you have a very intensive setup. We run minimal filter tests, one virus scanner and Sniffer. When we have experienced spool backups, I've tinkered with the number of threads and found 80 seems to result in the best message throughput for our particular configuration. Any lower and we were not using the available resources, and any higher the stress on the system resulted in message processing slow downs. If we're facing a particularly bad queue backup, I will disable Sniffer and can further increase the number of threads without any impact on the overall time to process a single message. For our customers, a small amount of spam leakage is far better than delayed email. We process about 200,000 - 250,000 messages per day, and the majority of those are during normal business hours. As you can imagine, any small disruption to normal queue processing can result in a fairly large queue backup - a 30 minute issue during normal business hour can result in 10,000 queued messages. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, May 24, 2006 9:34 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x Jay, It's not about moving along, it's about limiting the CPU to only 100%, or at least not piling it on when it gets there. I could be wrong in assuming that 1 thread = 1 message (hopefully I will be corrected if so), but 30 average messages being processed at once will most definitely peg my processors, and adding more threads when you are at 100% will actually slow down performance. Another note, not all systems are configured equally. A vanilla install of Declude would likely handle 4 times the number of messages that mine does since I run 4 external filters, two virus scanners, and something like 100 Declude filters (though they mostly get skipped with SKIPIFWEIGHT and END statements as they are targeted). Running a single virus scanner and RBL's is just a fraction of the load. With my pre-scanning gateways blocking more than 90% of all traffic (about half of that is dictionary attacks and most of the rest is done with 'selective greylisting'), I can scale one server to handle over 20,000 addresses, possibly as many as 40,000 (doesn't host the accounts though), so despite the heavy config, it is optimized. But back to the real topic...I'm just guessing that 30 messages/threads is the limit for my box, but I'm sure that it isn't as high as 80, though setting it at 80 would be of no consequence outside of a prolonged heavy load caused by something like a backup of my spool. It would be a bigger mistake to set it too low. Matt Jay Sudowski - Handy Networks LLC wrote: >30 threads seems awfully low. We set ours to 80 on a dual xeon box with a separate drive for spool/logging and we move right along without any issues. > >Thanks! >- >Jay Sudowski // Handy Networks LLC >Director of Technical Operations >Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions >Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX >www.handynetworks.com > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt >Sent: Tuesday, May 23, 2006 3:25 PM >To: Declude.JunkMail@declude.com >Subject: Re: [Declude.JunkMail] Experience with 4.x > >Andrew, > >Thanks for your notes and their history. > >I'm using the following settings right now: >THREADS30 >WAITFORMAIL500 >WAITFORTHREADS200 >WAITBETWEENTHREADS100 >WINSOCKCLEANUPOFF >INVITEFIXON >AUTOREVIEWON >There are a few reasons for trying these values. >THREADS 30 - I'm pretty confident that dual 3.2 Ghz Xeons and RAID can only handle 30 threads with average messages. In reality, one single message can spike the system to 100%, but these are uncommon. I figure that if I open this up too wide and I am dealing with a backup or something, launching more threads when at 100% CPU utilization will actually slow the system down. This was the same with 2.x and before. There is added overhead to managing threads and you don't want that to happen on top of 100% CPU utilization. I am going to back up my server later tonight to see if I can't find what the magic number is since I don't want to be below that magic number, and it would probably be best to be a little above it. > >WAITFORMAIL 500 - On my server, this never kicks in, but if it did, it wouldn't make sense to delay for too long because I could build up messages. A half second seems good. > >WAITFORTHREADS 200 - This apparently kicks in only when I reach my thread limit; sort of like a throttle. I don't want it to be too long because this should only happen when I am hammered
RE: [Declude.JunkMail] Experience with 4.x
30 threads seems awfully low. We set ours to 80 on a dual xeon box with a separate drive for spool/logging and we move right along without any issues. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Tuesday, May 23, 2006 3:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x Andrew, Thanks for your notes and their history. I'm using the following settings right now: THREADS 30 WAITFORMAIL 500 WAITFORTHREADS 200 WAITBETWEENTHREADS 100 WINSOCKCLEANUP OFF INVITEFIX ON AUTOREVIEW ON There are a few reasons for trying these values. THREADS 30 - I'm pretty confident that dual 3.2 Ghz Xeons and RAID can only handle 30 threads with average messages. In reality, one single message can spike the system to 100%, but these are uncommon. I figure that if I open this up too wide and I am dealing with a backup or something, launching more threads when at 100% CPU utilization will actually slow the system down. This was the same with 2.x and before. There is added overhead to managing threads and you don't want that to happen on top of 100% CPU utilization. I am going to back up my server later tonight to see if I can't find what the magic number is since I don't want to be below that magic number, and it would probably be best to be a little above it. WAITFORMAIL 500 - On my server, this never kicks in, but if it did, it wouldn't make sense to delay for too long because I could build up messages. A half second seems good. WAITFORTHREADS 200 - This apparently kicks in only when I reach my thread limit; sort of like a throttle. I don't want it to be too long because this should only happen when I am hammered, but it is wise not to keep hammering when you are at 100%. Sort of a mixed bag choice here. WAITBETWEENTHREADS 100 - I see this setting as being the biggest issue with sizing a server. Setting it at 100 ms means that I can only handle 10 messages per second, and this establishes an upper limit for what the server can do. I currently average about 5 messages per second coming from my gateways at peak hours, so I figured that to be safe, I should double that value. INVITEFIX ON - I have it on because it comes on by default and I don't know any better. I know nothing about the cause for needing this outside of brief comments. It seems strange that my Declude setup could ruin an invitation unless I was using footers. If this is only triggered by footer use, I would like to know so that I could turn it off. I would imagine that this causes extra load to do the check. AUTOREVIEW ON - I have this on for the same reason that Andrew pointed out. When I restart Decludeproc, messages land in my review folder, and I don't wish to keep manually fishing things out. If there is an issue with looping, it would be wise for Declude to make this only trigger say every 15 minutes instead of more regularly. Feel free to add to this if you want. Matt Colbeck, Andrew wrote: I'd second that... on both the observed behaviour and the request for documentation. I'm attaching my highly commented declude.cfg as a reasonable sample. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Tuesday, May 23, 2006 10:36 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x David, That did the trick. I can't even see any messages in my proc folder any more. I might suggest adding your explanation to the comments in the file just in case others feel the need to turn this on like I did. I recalled the issues from the list and I turned it on because I didn't want the possibility of DNS crapping out and the leakage that this would cause. Here's a screen cap of what my processor graph looks like now: Thanks, Matt David Barker wrote: The purpose of WINSOCKCLEANUPON is to reset the winsock, what happens when using this setting is that when the \proc directory hit 0 decludeproc will finish processing all the messages in the \work before checking the \proc again. As WINSOCKCLEANUP is to be used only by those who experience DNS issues I would suggest running your tests again with WINSOCKCLEANUP commented out and see how the behavior differs. Also having the WAITFORMAIL to low can cause the CPU to process very high as it is constantly checking the \proc I would suggest a minimum of 500-1000 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Mon
RE: [Declude.JunkMail] Experience with 4.x
In light of this reference to WINSOCKCLEANUP being an iMail only issue, do I even need to enable this on our SmarterMail servers? -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, May 23, 2006 6:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Experience with 4.x The only way that we have detected this was with Imail and mail being stuck in the spool. "...network stack causing loss of functionality for basic network operations" is generic but if I remember correctly when this happened the admin was not even able to ping an outside server, which would suggest to me other IP communications fail as well. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, May 23, 2006 6:26 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Experience with 4.x Thanks, David. I've read all of the support forum emails that have been posted on the WINSOCKCLEANUP and even reviewed them again via the mail archive website before my own implementation. What I haven't been able to tell is whether I can diagnose this issue if I have it before it becomes an outage. Can it only be detected by it's side-effect of filling up the proc folder? If I have a mechanism on my IMail server that does DNS queries... Will they fail when the WinSock needs being cleaned up? I think not, as at least one posting specifically mentioned that IMail IP4R tests worked when DecludeProc IP4R tests timed out. Your official description for "WINSOCKCLEANUP ON" says "...network stack causing loss of functionality for basic network operations"; is this deliberately generic so that you don't have to explain what a DNS test is, or does it imply that other IP communications will also fail, e.g. SMTP and (critically for me) RDP? Andrew. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of David Barker > Sent: Tuesday, May 23, 2006 3:12 PM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] Experience with 4.x > > Andrew, > > In certain cases we found that Imail would stop resolving, it seemed > that stop/starting the decludeproc or smtp service fixed the problem > by resetting the winsock. So we added WINSOCKCLEANUP to deal with this > specific Imail issue. > > David B > www.declude.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, > Andrew > Sent: Tuesday, May 23, 2006 3:45 PM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] Experience with 4.x > > David, is there a proactive way to detect if an installation would > benefit from the WINSOCKCLEANUP ON directive in declude.cfg? > > I would rather be able to detect this while it's happening than to > react when I find that spam is leaking or that the proc folder is > continually growing. > > Andrew. > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of > David Barker > > Sent: Tuesday, May 23, 2006 7:48 AM > > To: Declude.JunkMail@declude.com > > Subject: RE: [Declude.JunkMail] Experience with 4.x > > > > Mike, > > > > 1. The WINSOCKCLEANUPON activates when the \Proc reaches 0 > > 2. If Decludeproc stops unexpectedly files it is busy with > are move to > > the \review > > 3. You can use AUTOREVIEW ON to have these move back to the \proc > > 4. Be aware though if there is a real problem message you may find > > that the message gets looped 5. Make sure you have the > latest version > > of decludeproc ... There should be a release later today or > tommorow. > > > > David B > > www.declude.com > > > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Mike N > > Sent: Tuesday, May 23, 2006 10:23 AM > > To: Declude.JunkMail@declude.com > > Subject: Re: [Declude.JunkMail] Experience with 4.x > > > > I found that WINSOCKCLEANUP ON would force a reset if the \proc > > directory > > never hits 0. In this case, files build up in the \review > > subfolder which > > require manual processing. > > > > - Original Message - > > From: "David Barker" <[EMAIL PROTECTED]> > > To: > > Sent: Tuesday, May 23, 2006 7:34 AM > > Subject: RE: [Declude.JunkMail] Experience with 4.x > > > > > > > The purpose of WINSOCKCLEANUPON is to reset the > > winsock, what > > > happens when using this setting is that when the \proc > > directory hit 0 > > > decludeproc will finish processing all the messages in the \work > > > before checking the \proc again. > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > --- > > This E-mail came from th
RE: [Declude.JunkMail] OT: Poor man's high reliability?
Your customer is looking at his hosting fees from the wrong perspective. He should be considering what it costs him for his site to be down in lost sales, time required to deal with the issue, stress related to the issue, etc. If he is concerned about downtime, these are the costs he should be thinking about first, not the monthly cost of the hosting. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, May 18, 2006 11:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Poor man's high reliability? Hi Matt- Agreed on all points. I'm not looking for perfection or load balancing. The idea is to provide a low-cost response to the question "So what happens to my site when occurs?" and the customer deos not want to pay the freight for a real solution. This actually happened to me recently: The potential customer, who is now hosting with some $10/month outfit, thinks that $50/month is about all he can muster for a redundant solution. And you have to agree with him, sort of. A 5X increase in his hosting bill seems like an awfully high price to pay for a backup site when he doesn't understand how complex the problems really are. So I'm looking for a low-tech, easy-to-explain "It ain't perfect but it's pretty good and really cheap" answer to his question. -d --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Recommendations? Updgrading Equipment.
One big reason why it sucks is that you it's limited ability to either allow or deny recursion. There's no middle ground, where you can allow recursive lookups from certain IPs but not from others. This reflects poor product and security design. However, I really have no idea why you would need to take your DNS offline to edit your zones. There are many tools available that allow you to edit your zones in a scripted fashion while DNS service remains online. Regardless, even if you take your primary DNS server offline for a few minutes, things should still be functional on your secondary DNS servers ... You can also edit your zone files manually en-mass and then simply restart the service and the changes will be picked up immediately. Or if you need to add a wildcard manually, you can just right click the zone and reload it. As towards the original question, I'm not sure what your budget is but your mail volumes are fairly low. If you get a dual procesor machine, 2 gigs of ram, and have one RAID array for OS/spool/logging and another for your mail data your setup should be very fast and last you a long, long time at your current message volumes. Note that I'm referring to separate physical RAID arrays (ex, different set of physical drives) - not simply different logical partitions on the same RAID array. If you wanted to get really wild and crazy, you could also setup separate RAID arrays or even single drives for your spool and logs, but that shouldn't be necessary given your mail volume. We currently process over 200,000 messages per day on SmarterMail with 2 SATA RAID arrays, also running Declude Suite, Sniffer, F-Prot, etc. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, May 03, 2006 8:46 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Recommendations? Updgrading Equipment. Can you clarify why you think MS DNS sucks? We've used it for years and it has worked perfectly. We also built additional tools to integrate it into our setup and management processes. The only problem or lack of functionality we've experienced is the inability to retrieve a list of subdomains programmatically without parsing the zone file. Darin. - Original Message - From: "William Stillwell" <[EMAIL PROTECTED]> To: Sent: Wednesday, May 03, 2006 8:36 AM Subject: [Declude.JunkMail] OT: Recommendations? Updgrading Equipment. Anybody have any recommendations on a server upgrade? (CPU/RAM/HDD) Suggestions? Running, Imail, Declude JunkMail, Anti-Virus, Mcafee Scanner, Sniffer. As you can tell, we have a ton of "Internal" Mail.. We are currently running a PIII 750 w/512Mb ram, and a 30gig Scsi Mirror. (Two Drives mirrored).. I also want to Dump M$ DNS, as it sucks.. Any Suggestions on a easy to configure alternative, with possible web front end? Here are our STMP Daily Totals for the last couple days. SpamPhrase75 LocalDeliver10519 RemoteDeliver1020 SpamPhrase61 LocalDeliver9401 RemoteDeliver745 SpamPhrase44 LocalDeliver5059 RemoteDeliver73 SpamPhrase38 LocalDeliver5271 RemoteDeliver39 SpamPhrase61 LocalDeliver8657 RemoteDeliver604 SpamPhrase57 LocalDeliver10215 RemoteDeliver865 SpamPhrase77 LocalDeliver10634 RemoteDeliver807 SpamPhrase62 LocalDeliver10504 RemoteDeliver892 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude/smartermail problems
Hi Dave - There have been some bugs with the way Declude handles SmarterMail's XML files, which could result in some issues with mail sent to domain aliases and autowhitelist. However, these are resolved now - as far as I'm aware. Overall, I much prefer having Declude integrated with SmarterMail in the way that it is with SmarterMail 3 - our customers now have real control over their spam handling. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, April 13, 2006 12:17 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude/smartermail problems Jay, We have not upgraded our Declude or Smartermail yet. We were waiting for any bugs in the new releases to be worked out. Have you encountered any bugs or problems with the software? Would you say it's safe for us to upgrade now? Thanks, Dave > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Thursday, April 13, 2006 9:46 AM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] Declude/smartermail problems > > SmarterMail3 / Declude integration is very different than before. > Here is how we have things setup: > > 1) SmarterMail General Settings -> Spool options: No command line > process specificed > > 2) SmarterMail Anti-Spam -> Spam Checks: Decluded enabled for > filtering. Edit the weights to reflect your standard subject, hold, > delete weights > > 3) SmarterMail Anti-Spam -> Filtering: Configure the appropriate > actions based upon your weights. > > 4) SmarterMail Anti-Spam -> Options: We have 'allow domains to > override filter weights and actions' enabled > > Now, in your Declude $default$.junkmail set your WEIGHT tests to WARN. > Declude will pass the weight to SmarterMail, and SmarterMail will > filter according to the actions you set in step 3. > > Thanks! > > - > > Jay Sudowski // Handy Networks LLC > > Director of Technical Operations > Providing Shared, Reseller, Semi Managed and Fully Managed Windows > 2003 Hosting Solutions > Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX > > www.handynetworks.com <http://www.handynetworks.com/> > > > > > > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of scott_powner > Sent: Thursday, April 13, 2006 7:46 AM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] Declude/smartermail problems > > > > We have been periodically experiencing problems with Smartermail not > sending any mail or sending mail to different people than you may have > intended. Smartermail has looked at our configuration numerous times > and never found anything. Yesterday afternoon after a particularly > bad day we called again. Smartermail told us that Declude was set up > incorrectly. > > We are using Declude 3 and Smartermail 3 both Pro versions. We have > about 8,000 users spread across 20 different domains. > > Smartermail told us to remove the c:\smartermail\declude.exe %filepath > statement from the configuration (they had told us to put it there in > the first place). We removed it and mail was no longer being checked > by Declude. We then enabled it under the antispam settings. Mail was > no longer processed. > > We called Declude. They had us send them a copy of our Global.cfg and > $default$.junkmail as well as a log file. They said it would be a few > days. > > Does anyone out there have any idea what could be the problem or at > least a direction we could try. > > > > Thanks! > > Scott T Powner > > Scott T. Powner > > Director of Information Technology > > Midwestern Intermediate Unit IV > > 453 Maple St. > > Grove City, Pa. 16127 > > 724.458.6700 ex 273 > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude/smartermail problems
Do you also have declude.exe in the same path as decludeproc - this is required to move the messages. What version of Declude are you running? make sure it's the latest. Have you checked filemon to see what's happening with the smartermail directory and spools? Do you see Decludeproc in your task manager? Any declude.exe's ? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of scott_powner Sent: Thursday, April 13, 2006 11:42 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude/smartermail problems That's what we tried but nothing gets blocked with it configured that way. The Declproc never seems to correctly do it's thing. Nothing is in the headers of the record. It's just as if it is not running. Maybe I should re-rename the declproc.smartermail and try again. Thanks Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Thursday, April 13, 2006 10:46 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude/smartermail problems SmarterMail3 / Declude integration is very different than before. Here is how we have things setup: 1) SmarterMail General Settings -> Spool options: No command line process specificed 2) SmarterMail Anti-Spam -> Spam Checks: Decluded enabled for filtering. Edit the weights to reflect your standard subject, hold, delete weights 3) SmarterMail Anti-Spam -> Filtering: Configure the appropriate actions based upon your weights. 4) SmarterMail Anti-Spam -> Options: We have 'allow domains to override filter weights and actions' enabled Now, in your Declude $default$.junkmail set your WEIGHT tests to WARN. Declude will pass the weight to SmarterMail, and SmarterMail will filter according to the actions you set in step 3. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com <http://www.handynetworks.com/> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of scott_powner Sent: Thursday, April 13, 2006 7:46 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude/smartermail problems We have been periodically experiencing problems with Smartermail not sending any mail or sending mail to different people than you may have intended. Smartermail has looked at our configuration numerous times and never found anything. Yesterday afternoon after a particularly bad day we called again. Smartermail told us that Declude was set up incorrectly. We are using Declude 3 and Smartermail 3 both Pro versions. We have about 8,000 users spread across 20 different domains. Smartermail told us to remove the c:\smartermail\declude.exe %filepath statement from the configuration (they had told us to put it there in the first place). We removed it and mail was no longer being checked by Declude. We then enabled it under the antispam settings. Mail was no longer processed. We called Declude. They had us send them a copy of our Global.cfg and $default$.junkmail as well as a log file. They said it would be a few days. Does anyone out there have any idea what could be the problem or at least a direction we could try. Thanks! Scott T Powner Scott T. Powner Director of Information Technology Midwestern Intermediate Unit IV 453 Maple St. Grove City, Pa. 16127 724.458.6700 ex 273 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude/smartermail problems
SmarterMail3 / Declude integration is very different than before. Here is how we have things setup: 1) SmarterMail General Settings -> Spool options: No command line process specificed 2) SmarterMail Anti-Spam -> Spam Checks: Decluded enabled for filtering. Edit the weights to reflect your standard subject, hold, delete weights 3) SmarterMail Anti-Spam -> Filtering: Configure the appropriate actions based upon your weights. 4) SmarterMail Anti-Spam -> Options: We have 'allow domains to override filter weights and actions' enabled Now, in your Declude $default$.junkmail set your WEIGHT tests to WARN. Declude will pass the weight to SmarterMail, and SmarterMail will filter according to the actions you set in step 3. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com <http://www.handynetworks.com/> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of scott_powner Sent: Thursday, April 13, 2006 7:46 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude/smartermail problems We have been periodically experiencing problems with Smartermail not sending any mail or sending mail to different people than you may have intended. Smartermail has looked at our configuration numerous times and never found anything. Yesterday afternoon after a particularly bad day we called again. Smartermail told us that Declude was set up incorrectly. We are using Declude 3 and Smartermail 3 both Pro versions. We have about 8,000 users spread across 20 different domains. Smartermail told us to remove the c:\smartermail\declude.exe %filepath statement from the configuration (they had told us to put it there in the first place). We removed it and mail was no longer being checked by Declude. We then enabled it under the antispam settings. Mail was no longer processed. We called Declude. They had us send them a copy of our Global.cfg and $default$.junkmail as well as a log file. They said it would be a few days. Does anyone out there have any idea what could be the problem or at least a direction we could try. Thanks! Scott T Powner Scott T. Powner Director of Information Technology Midwestern Intermediate Unit IV 453 Maple St. Grove City, Pa. 16127 724.458.6700 ex 273 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Software for searching junkmail
Declude has always been lacking by not providing any hold review mechanism. However, when Declude Junkmail Pro was $500 one-time, plus a small yearly service contract it was hard to quibble about short comings. Now they are retailing Declude as at prices up to $1750 per year. If they expect to be able to justify such price increases, they need to provide additional functionality which rounds out the feature set of the product, including spam review / user retrieval of held messages. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Friday, April 07, 2006 6:37 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Software for searching junkmail > Nobody gives a damn about the history of a software product. What they do > care about is whether Declude is fully functional or not. The Declude line of products do what they are intended to do quite well and at this point with a low bug count. As more people such as yourself demand an all-inclusive-packaged-neat product the owners of Declude are doing their best to bend to your desires. By the history of how the Declude line of products were originally created and then developed through time, it is taking a lot of time and effort to "convert" them from the products we have come to love and use into the pretty package people like you are demanding. In my opinion, and the opinion of many others which I am sure is the majority is that Declude is indeed fully functional for what it does. > Providing a means to hold email, without a means to identify email held in > error, is only half of a solution. Its like sending a man to the moon > without giving thought to how to get them back home again. In the beginning, they were given a parachute. Last time I checked, Imail's SMD files and SmarterMail's EML files can be opened and read with Notepad, which is freely included with all Microsoft Operating systems. > Moreover, my purchase decision was based upon discussions that occurred when > I evaluated Declude. So please do not presume to speak for the new owners of > Declude because you don't have a clue what you're talking about. Taken off list. > No...what I said was that only very rarely is it ever necessary to view the > content of a message. That is a huge distinction between the alternative of > using a mail client to sort through spam and seeing the content of every > message. >From the prospective of us admins, viewing a message includes the entire message, starting with the headers and including the envelope and then body if warranted. Therefore, viewing a message is viewing a message is viewing a message. A question about privacy does not care about how it is viewed but about if it is viewed. John T eServices For You "Seek, and ye shall find!" --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.1 Is Out
Release notes still are not updated. Guess I will never know what else is new/fixed in Declude 4.1 -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, April 03, 2006 4:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 4.1 Is Out http://www.declude.com/Articles.asp?ID=186 Aside from the web admin, are there any other fixes or feature enhancements? The release notes reference 4.0.9.4 ... Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.1 Is Out
aths to infect millions of servers. Servers that weren't patched for the specific vulnerability exploited by these worms could not be infected if websites were not installed on the same drive as the system root, or if they had Parent Paths disabled. Most IIS servers that are hacked are done so with some form of directory transversal. The success of these worms caused Microsoft to redesign default permissions and disable Parent Paths by default in IIS 6.0. I'm surprised that there was any debate about this whatsoever. Matt Jay Sudowski - Handy Networks LLC wrote: >Hello Matt - > >With all due respect, if NTFS permissions are not configured properly then you have many, many things to be worried about aside from having Parent Path being enabled or disabled, particularly if you are allowing people to upload executable files remotely (as in, the server is a shared hosting server). In this scenario, a user can literally upload a very simple ASP script that utilizes FSO and they can delete every single file on the server. Would disabling parent paths help you at all in this case? Absolutely not - because it's would be possible to specify the drive root and begin recursively deleting files using some loops. Furthermore, if hackers are exploiting poorly coded web applications that allow executable files to be uploaded and you insecure NTFS permissions, your server is screwed, regardless of having Parent Paths enabled or not. > >Please also understand that second scenario that you note is also related NTFS permissions being insecure. With proper NTFS permissions, one customer cannot access another customer files. This is the whole point of permissions. Without proper permissions in place, your server is a sitting duck. Goodness gracious. > >-Jay > >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt >Sent: Monday, April 03, 2006 6:27 PM >To: Declude.JunkMail@declude.com >Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out > >Kevin, IIS 6 has built in protection from double encoding by default (like "..%5c" or ".%2e/" instead of "../"), and I also still use URLScan to block such things even though Microsoft was saying that it wasn't necessary with IIS 6. The other important addition in IIS 6's security is in only allowing explicitly defined extensions to be returned, and by default, extensions like EXE are not configured. I also don't use default locations, I remove all example code, and I give Web sites the bare minimum permissions. > >Jay, one of the issues with parent paths is the fact that permissions are sometimes configured to allow Everyone access. Script kiddies often deface or hack servers by exploiting poor code and file permissions of popular Web applications. For instance, a lot of the phishers are putting their content on sites where PHP-Nuke is used, and there has been a long history of hacks for all sorts of content management and bulletin board code. Often the attacker adds the directory transversal string as an argument to a script. > >Another very big issue with such a configuration is that Parent Paths can allow an admin for one website to write a simple script that escapes their root and read or write content from/to another site (depending on permissions). For instance, someone could look for a common file in another site such a web.config, and read the SQL Server login and password, and then steal or corrupt another customer's data in the database. Simple as pie! > >The best security is to explicitly define the minimal permissions necessary for every unique site use, and to layer your security. Declude can get around the limitations of disabled Parent Paths by requiring a virtual directory to be created, and using a specific Group with explicitly defined permissions to access the required files. This is not a big deal to do. > >Matt > > > >Kevin Bilbee wrote: >Install url scan and use the IIS lockdown tool. this will stop all ../../../ attacks dead in their tracks. Rerardless of the parent paths setting. > > >Kevin Bilbee > > > > > -Original Message- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt >Sent: Monday, April 03, 2006 2:38 PM >To: Declude.JunkMail@declude.com >Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out >Jay, > >This is incorrect. You can traverse directories within your root using "../" with Parent Paths disabled, but if you enable it, you can go outside your root so long as the file permissions allow it. Here's a quote from the KB article that you linked to: >"The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the c
RE: [Declude.JunkMail] Declude 4.1 Is Out
Hello Matt - With all due respect, if NTFS permissions are not configured properly then you have many, many things to be worried about aside from having Parent Path being enabled or disabled, particularly if you are allowing people to upload executable files remotely (as in, the server is a shared hosting server). In this scenario, a user can literally upload a very simple ASP script that utilizes FSO and they can delete every single file on the server. Would disabling parent paths help you at all in this case? Absolutely not - because it's would be possible to specify the drive root and begin recursively deleting files using some loops. Furthermore, if hackers are exploiting poorly coded web applications that allow executable files to be uploaded and you insecure NTFS permissions, your server is screwed, regardless of having Parent Paths enabled or not. Please also understand that second scenario that you note is also related NTFS permissions being insecure. With proper NTFS permissions, one customer cannot access another customer files. This is the whole point of permissions. Without proper permissions in place, your server is a sitting duck. Goodness gracious. -Jay From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, April 03, 2006 6:27 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out Kevin, IIS 6 has built in protection from double encoding by default (like "..%5c" or ".%2e/" instead of "../"), and I also still use URLScan to block such things even though Microsoft was saying that it wasn't necessary with IIS 6. The other important addition in IIS 6's security is in only allowing explicitly defined extensions to be returned, and by default, extensions like EXE are not configured. I also don't use default locations, I remove all example code, and I give Web sites the bare minimum permissions. Jay, one of the issues with parent paths is the fact that permissions are sometimes configured to allow Everyone access. Script kiddies often deface or hack servers by exploiting poor code and file permissions of popular Web applications. For instance, a lot of the phishers are putting their content on sites where PHP-Nuke is used, and there has been a long history of hacks for all sorts of content management and bulletin board code. Often the attacker adds the directory transversal string as an argument to a script. Another very big issue with such a configuration is that Parent Paths can allow an admin for one website to write a simple script that escapes their root and read or write content from/to another site (depending on permissions). For instance, someone could look for a common file in another site such a web.config, and read the SQL Server login and password, and then steal or corrupt another customer's data in the database. Simple as pie! The best security is to explicitly define the minimal permissions necessary for every unique site use, and to layer your security. Declude can get around the limitations of disabled Parent Paths by requiring a virtual directory to be created, and using a specific Group with explicitly defined permissions to access the required files. This is not a big deal to do. Matt Kevin Bilbee wrote: Install url scan and use the IIS lockdown tool. this will stop all ../../../ attacks dead in their tracks. Rerardless of the parent paths setting. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Sent: Monday, April 03, 2006 2:38 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out Jay, This is incorrect. You can traverse directories within your root using "../" with Parent Paths disabled, but if you enable it, you can go outside your root so long as the file permissions allow it. Here's a quote from the KB article that you linked to: "The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the ..\notation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application." Matt Jay Sudowski - Handy Networks LLC wrote: Wrongg. Enabling parent paths doesn't allow you to actually enter ../../../../../ and transverse directories into your URL string! http://support.microsoft.com/default.aspx?scid=kb;en-us;332117 It simply allows you to use ../ in your ASP and SSI includes! Goodness gracious. PS - Please use plain text unless you have a particularly compelling reason to post in HTML. From: [EMAIL
RE: [Declude.JunkMail] Declude 4.1 Is Out
Matt, For what you describe to occur, your attacker has already managed to upload an ASP file to your web site!!!Do you not see the distinction here? Enabling parent paths allows ASP to use ../ notation to break out of the web root directory and access other resources. For this to be a risk, someone actually has to upload an ASP script that would make use of this notation. And if they can already manage to upload an executable script to your web root, you are pretty much screwed. If they can upload an asp script, you can be assured that they are uploading windows asp based rootkit / mass deface tools. In that case, the only thing that will save you is properly secured NTFS permissions. Enabling parent paths does not allow an attack to enter http://www.mailpure.com/../../../../windows/system32/dns/mailpure.com.dns and download your mailpure zone file. This is not what Parent paths controls in any way! You seem to be confusing the IIS Unicode Directory Transversal Bug with Parent Paths. The two are completely different things. The failed requests that you probably see your log files are trying to exploit the Unicode Directory Transversal bug, not anything related to Parent Paths. http://www.microsoft.com/technet/security/bulletin/MS00-078.mspx - Jay From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, April 03, 2006 5:38 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out Jay, This is incorrect. You can traverse directories within your root using "../" with Parent Paths disabled, but if you enable it, you can go outside your root so long as the file permissions allow it. Here's a quote from the KB article that you linked to: "The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the ..\notation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application." Matt Jay Sudowski - Handy Networks LLC wrote: Wrongg. Enabling parent paths doesn't allow you to actually enter ../../../../../ and transverse directories into your URL string! http://support.microsoft.com/default.aspx?scid=kb;en-us;332117 It simply allows you to use ../ in your ASP and SSI includes! Goodness gracious. PS - Please use plain text unless you have a particularly compelling reason to post in HTML. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, April 03, 2006 5:27 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out I beg to differ. IMO, Enabling Parent Paths is one of the biggest security risks for a Web server, and IIS disables them by default because of this. Most exploits require multiple configuration mistakes to exploit, and if you enable Parent Paths, it increases your likelihood of being hacked many times over. If you look at your logging of websites on your server, you will likely see entries around 200 at a time from script kiddies, most of which are seeking to exploit configurations where parent paths are enabled. The proper way to approach this would be to create a virtual directory under the website, and configure an exclusive group as having permissions for the Declude directory. Matt Jay Sudowski - Handy Networks LLC wrote: Practically speaking, the security risks related to parent paths are near zero. On scale of 0 to 100, having parent paths enabled would be a .01, assuming your NTFS permissions are tight. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Monday, April 03, 2006 5:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.1 Is Out >From the readme.html: "Parent paths must be enabled." Sorry, no they will not be enabled. That is a security risk I am not going to open up on my server. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, April 03, 2006 1:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 4.1 Is Out http://www.declude.com/Articles.asp?ID=186 Aside from the web admin, are there any other fixes or feature enhancements? The release notes reference 4.0.9.4 ... Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-ma
RE: [Declude.JunkMail] Declude 4.1 Is Out
Also: http://support.microsoft.com/kb/184717/ NOTE: Disabling ASP Parent Paths will only affect the execution of dynamic content on .asp pages. This does not affect the server's ability to reference static content using HTML code (whether it is called from .htm, .html or .asp files). The following line in a default.asp would properly display the image without returning an ASP 0131 error, even after AspEnableParentPaths = False: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, April 03, 2006 5:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.1 Is Out Wrongg. Enabling parent paths doesn't allow you to actually enter ../../../../../ and transverse directories into your URL string! http://support.microsoft.com/default.aspx?scid=kb;en-us;332117 It simply allows you to use ../ in your ASP and SSI includes! Goodness gracious. PS - Please use plain text unless you have a particularly compelling reason to post in HTML. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, April 03, 2006 5:27 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out I beg to differ. IMO, Enabling Parent Paths is one of the biggest security risks for a Web server, and IIS disables them by default because of this. Most exploits require multiple configuration mistakes to exploit, and if you enable Parent Paths, it increases your likelihood of being hacked many times over. If you look at your logging of websites on your server, you will likely see entries around 200 at a time from script kiddies, most of which are seeking to exploit configurations where parent paths are enabled. The proper way to approach this would be to create a virtual directory under the website, and configure an exclusive group as having permissions for the Declude directory. Matt Jay Sudowski - Handy Networks LLC wrote: Practically speaking, the security risks related to parent paths are near zero. On scale of 0 to 100, having parent paths enabled would be a .01, assuming your NTFS permissions are tight. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Monday, April 03, 2006 5:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.1 Is Out >From the readme.html: "Parent paths must be enabled." Sorry, no they will not be enabled. That is a security risk I am not going to open up on my server. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, April 03, 2006 1:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 4.1 Is Out http://www.declude.com/Articles.asp?ID=186 Aside from the web admin, are there any other fixes or feature enhancements? The release notes reference 4.0.9.4 ... Thanks! ----- Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.1 Is Out
Wrongg. Enabling parent paths doesn't allow you to actually enter ../../../../../ and transverse directories into your URL string! http://support.microsoft.com/default.aspx?scid=kb;en-us;332117 It simply allows you to use ../ in your ASP and SSI includes! Goodness gracious. PS - Please use plain text unless you have a particularly compelling reason to post in HTML. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, April 03, 2006 5:27 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.1 Is Out I beg to differ. IMO, Enabling Parent Paths is one of the biggest security risks for a Web server, and IIS disables them by default because of this. Most exploits require multiple configuration mistakes to exploit, and if you enable Parent Paths, it increases your likelihood of being hacked many times over. If you look at your logging of websites on your server, you will likely see entries around 200 at a time from script kiddies, most of which are seeking to exploit configurations where parent paths are enabled. The proper way to approach this would be to create a virtual directory under the website, and configure an exclusive group as having permissions for the Declude directory. Matt Jay Sudowski - Handy Networks LLC wrote: Practically speaking, the security risks related to parent paths are near zero. On scale of 0 to 100, having parent paths enabled would be a .01, assuming your NTFS permissions are tight. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Monday, April 03, 2006 5:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.1 Is Out >From the readme.html: "Parent paths must be enabled." Sorry, no they will not be enabled. That is a security risk I am not going to open up on my server. John T eServices For You "Seek, and ye shall find!" -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, April 03, 2006 1:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 4.1 Is Out http://www.declude.com/Articles.asp?ID=186 Aside from the web admin, are there any other fixes or feature enhancements? The release notes reference 4.0.9.4 ... Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.1 Is Out
Practically speaking, the security risks related to parent paths are near zero. On scale of 0 to 100, having parent paths enabled would be a .01, assuming your NTFS permissions are tight. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Monday, April 03, 2006 5:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.1 Is Out >From the readme.html: "Parent paths must be enabled." Sorry, no they will not be enabled. That is a security risk I am not going to open up on my server. John T eServices For You "Seek, and ye shall find!" > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Monday, April 03, 2006 1:45 PM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] Declude 4.1 Is Out > > http://www.declude.com/Articles.asp?ID=186 > > Aside from the web admin, are there any other fixes or feature > enhancements? The release notes reference 4.0.9.4 ... > > Thanks! > - > Jay Sudowski // Handy Networks LLC > Director of Technical Operations > Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 > Hosting Solutions > Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX > www.handynetworks.com > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack Notification
QueueMon is excellent for monitoring and logging these things, and very
affordable too. http://www.invariantsystems.com/queuemon/
FYI, it doesn't official support SmarterMail, but it works perfectly fine on my
SmarterMail servers.
Thanks!
-----
Jay Sudowski // Handy Networks LLC
Director of Technical Operations
Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting
Solutions
Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX
www.handynetworks.com
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Doyle
Sent: Monday, April 03, 2006 4:51 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Hijack Notification
I think I understand, I'm not a programmer and it's semi Greek to me.
I like the idea of getting notified if the spool file begins to fill up, I
check it now and then and if would be nice
To simply be notified if it begins to back up for whatever reason.
John
.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Monday, April 03, 2006 11:03 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Hijack Notification
Hi John,
>John Doyle wrote:
>this guy suggested this.
>I'm not sure exactly how. looks like if a count is > some value send the
>mail.
I was just suggesting that the number of files in the spool dir exceed some
number [100?] then send an email. I got the idea from the hijack vbs code
[Thanks!] on the declude website which I kludged to work to notify for the
spool overflows..
-Nick
# spool_mon.vbs
fSpool = "e:\imaillogs\spool"
aMail = "e:\imail\imail1.exe "
mFrom = "-u '[EMAIL PROTECTED]' "
mTo1 = "-t '[EMAIL PROTECTED],[EMAIL PROTECTED]' "
if GetFileCount(fSpool) > 100 then
MailNotice "Spool", GetFileCount(fSpool), mTo1
end if
Function GetFileCount(folderspec)
Dim fso, f, f1, fc
Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.GetFolder(folderspec)
Set fc = f.Files
GetFileCount = fc.count
End Function
Function MailNotice(fname, fcount, mTo)
Dim mCmd, mSubj, WshShell
set WshShell = WScript.CreateObject("WScript.Shell")
mSubj = "-s 'Mail held in " & fname & ": " & fcount & "' "
mCmd = aMail & mFrom & mTo & mSubj & "-f placeholder.txt"
Return = WshShell.Run(mCmd , 1, TRUE)
End Function
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Nick Hayer
Sent: Sunday, April 02, 2006 7:59 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Hijack Notification
Hi Craig,
Although you may already do this figured I mention it anyway - this
technique works well to monitor spool traffic eg when a threshold is
reached I get an email - so for example in your code below IF
FFunc.Count > 100 [altered path for the spool dir] > send me an email...
-Nick
Craig Edmonds wrote:
Hi John,
Not sure if this is any help but I found a basic way to handle this as I
had
problems with clients ringing up saying "I sent out some mails and they
have
not gone"...etc etc etc, and of course when I check the hold2 directory
there are 500 emails in there.
What I do is have a basic setup that checks for me every 30 minutes if
there
are some .smd files in the C:\IMAIL\spool\spam\hold2 folder and if it finds
any, it emails me a simple email telling me how many *smd files there are
which then goes to my blackberry letting me know.
I am pretty sure there is an easier way but this is my 10 minute solution
and it works for me.
1) I installed the following object on the mail server
http://www.xs4all.nl/~jarit/asp/filefunc/download.html
2) made a .vbs file called check4files.vbs and put it in the
C:\IMAIL\spool\spam\hold2 dir.
The code in the .vbs file is like this..
===
filepath="C:\IMAIL\spool\spam\hold2\*.smd"
emailfrom="[EMAIL PROTECTED]"
emailto="[EMAIL PROTECTED]"
Set FFunc = CreateObject("FileFunctions.files")
if FFunc.Exists(filepath) then
FFunc.GetFileList(filepath)
Set objMessage = CreateObject("CDO.Message")
objMessage.Subject = "(Alert) " & FFunc.Count & " Messages in The Hold
Queue"
objMessage.From = emailfrom
objMessage.To = emailto
strBody = strBody & "There are currently " & FFunc.Count & " files in
the
Hold Queue" & vbCRLF
strBody = strBody & "" & vbCRLF
strBody = strBody & "Date: " & FormatDateTime(Date, 1) & " - " &
FormatDateTime(Now, 4)
objMessage.TextBody = strBody
objMessage.Send
end if
3) Then I set u
[Declude.JunkMail] Declude 4.1 Is Out
http://www.declude.com/Articles.asp?ID=186 Aside from the web admin, are there any other fixes or feature enhancements? The release notes reference 4.0.9.4 ... Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Slightly OT: Imail 8.15 vs. SM 3 CPU Usage
iMail 8.1x doesn't have the multi-threaded SMTP engine yet, which effectively limits you to 60 or so SMTP sessions at once. SmarterMail can easily handle several hundred SMTP sessions ... you will get more milage out of your hardware by moving to SmarterMail 3. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Thursday, March 30, 2006 4:37 PM To: Matt Subject: Re[2]: [Declude.JunkMail] Slightly OT: Imail 8.15 vs. SM 3 CPU Usage Hello Matt, Thanks Matt, I'm running as a gateway so Webmail/POP/etc are completely out of the picture. Just trying to squeeze all the proc utilization I can out of this thing. Thursday, March 30, 2006, 4:27:56 PM, you wrote: M> Since the Declude part of the setup accounts for more than 90% of the M> utilization, you aren't likely to notice a difference on a heavily M> trafficked machine. There is however no doubt that SmarterMail is M> leaner. One of IMail's biggest dogs was their webmail, however in the M> latest versions, they use IIS just like SmarterMail does. M> If I was comparing the two solutions, I would suggest focusing more so M> on functionality; all the way down to the nitty gritty. M> If you are looking to save CPU as your main goal, I have consistantly M> been able to find ways to steal it back from my Declude setup by being M> more efficient about the things that I do. Some things like running AV M> after JM can save noticeably. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FYI - SM3 / Declude4 - message bouncing issue
So you are basically saying that Declude is completely unaware of all domain aliases as configured in SmarterMail? -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, March 24, 2006 3:17 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] FYI - SM3 / Declude4 - message bouncing issue Hi, All- Sorry for the long-winded nature of this post, but I think it shuold be detailed enough to document the issue, and it's not really an obvious cause and effect relationship. So here goes: There are two types of domains at which I can receive mail. Let's call them "home" domains and "alias" domains. In my case the "home" domain is newsource.com. I have several alias domains, including skywaves.net, which is where I get nearly all of my messages. Incoming messages for the home domain are considered inbound (duh!), and they are processed according to the instructions contained in default.junkmail. If the action is "mailbox spam" the message goes into the spam folder. Incoming messages for the alias domains are considered outbound (not duh!), and they are processed according to the outbound section of global.cfg. If the action is "mailbox spam" the message is actually readddressed to dave+spam, after which it appears that it is reintroduced to the system with that address. Here there can be a problem. If plus addressing is not enabled for the user, or if the action is "put the message in the folder if it exists" and the folder doesn't exist, the message will be bounced with an "user unknown" error, confusing the sender who clearly did not send a message to dave+spam. So if someone sends me a message at newsource.com, the action can be quite different than if he sends the same message to me at skywaves.net. Of course, this is true also if there are different entries in global.cfg's outbound actions and default.junkmail's inbounds, also, but the bounce mechanism I described is not one that would necessarily be obvious. Since the default in SM is plus addressing disabled, and the default action when it is first enabled is "put the message in the folder if it exists", there are two individual actions that must be taken in SM to rectify this problem. This can only be done on the domain and user levels, so it must be set for each new domain. I would expect this to be first-time-user or just-added-a-domain kind of issue in most cases. - Dave Doherty Skywaves, Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Microsoft Open License
FWIW, we have been in the SPLA program for 3 years now and we have never been a Microsoft Certified Partner. -Jay From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Saturday, March 11, 2006 11:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Microsoft Open License Robert, I think that did a good amount of research and I do in fact have my facts straight. It appears rather that you just simply didn't read my message fully. At this moment, SPLA isn't a good deal for me, though I recognize that in some situations it can be. I like to buy full retail versions of Windows in the gray market of eBay, and when you compare gray market prices to SPLA, the gray market compares much more favorably when you are buying for yourself. I also have been basing all of my servers on dual processor systems as a way to maximize the value of the software running on them, and the terms for dual-processor licenses under SPLA is not competitive whatsoever for servers. In my original reply, I linked to a pricing sheet that is freely available from the public website of one of Microsoft's two main suppliers of SPLA licenses, so I am in fact aware of the prices. As I said before, this is something like the third iteration of a pay-as-you-go licensing scheme by Microsoft in just 5 years. In fact, up until last year you also had to be a MCP and join the Microsoft Partner Program at $1,500/year. For a small hosting provider, adding that cost overhead and time to one or a few licenses makes it cost prohibitive. While they did change this, they only did so recently, and parts of their site are still out of date with the changes. The frequency of changes and their admission on their own site that they screwed up badly in the past by having confusing terms and uncompetitive pricing doesn't make me feel at ease with this. I also don't like grossly uncompetitive markets such as limited availability and a requirement for membership in three different Microsoft programs. By limiting access to primarily two resellers of SPLA licenses, they have also created an anti-competitive market. I also don't work for Microsoft, and I don't wish to be reporting back to them or their partners on a monthly basis for the type of operations that I currently have. Microsoft didn't create SPLA to lose money. Part of this was due to competitive pressures from the low overhead of a rapid Linux build-out in bulk hosting, but another part of it was clearly to establish a method of charging based on the success of their customers (per-processor licensing) instead of being based on the software's capabilities itself, and to force more rapid adoption of their latest technologies by removing the asset of purchased software and lowering the overhead to upgrading. Unfortunately for Microsoft, Windows 2000 still works great as a Web server 6 years after it's release. If Microsoft wanted to stay competitive in all senses, they would have made SPLA completely optional as far as their EULA goes, but they purposefully change it. This change was anti-consumer. I don't like anti-consumer changes. I'm considering SPLA for possibly doing some managed server co-location because I recognize the high upfront costs and competitive pressures where some expect their colo to provide such things in one package. I agree that SPLA makes perfect sense for single processor servers leased in bulk to customers. For my own servers however, I already own licenses for everything and I would definitely be paying substantially more with SPLA over the life of the software under the present terms. I purchased my retail versions of Microsoft software to be used exactly as they were clearly and consistently represented to me by Microsoft, and I will continue to use them that way. In the mean time, I am going to start working on getting a Linux hosting environment going because I don't want to get trapped by Microsoft's licensing going forward. Matt Robert E. Spivack wrote: Matt, get the facts before you "rant". If you are running a business then you should be adhering to the rules. I can't believe you have been hosting sites/email services for so long and not been aware of SPLA. I think your rant is totally offbase. Let me give you (and others lurking) the overall view: 1. The SPLA is an incredibly great program for service providers (which you are). It allows you to completely avoid buying expensive software upfront and is entirely a pay-as-you-go program. 2. For those not familiar with it, you report to Microsoft on a monthly basis what product licenses you are using and you pay only for the licenses in use. Specific example: You are a small hosting company and land a client that wants a dedicated server with dual Xeons running SQL Server 2000 or 2005. With a retail license (which isn't legal for hosting anyway) y
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
Per a direct email to me, AUTOWHITELIST cobbles together the path for a user's XML file by taking the settings for SmarterMail's default 'domain path', not the actual 'domain path' that exists in the SmarterMail configuration for the domain. This is a huge problem if you run servers with mail spread across multiple drives, because currently AUTOWHITELIST will only work for your domains that are on one drive. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 2:53 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Ok. I finally got Declude running. But it seems that AUTOWHITELIST is broken ... ARGH. [EMAIL PROTECTED]@[EMAIL PROTECTED] Declude is looking in the wrong damn spot for the SmarterMail address book. 03/10/2006 00:23:00.043 1631193701 [EMAIL PROTECTED] [EMAIL PROTECTED]@milehighnetworks.com] *local* 03/10/2006 00:23:00.043 1631193701 No d:\smartermail\domainsDomains\milehighnetworks.com\Users\jay\addressBook .xml 03/10/2006 00:23:00.043 1631193701 No d:\smartermail\domainsDomains\milehighnetworks.com\Users\jay\userconfig. xml 03/10/2006 00:23:00.043 1631193701 Domain name = milehighnetworks.com, User name = jay. I have left *three* unanswered voicemails on the Urgent declude number, and sent two emails to [EMAIL PROTECTED] with NO RESPONSE. If you are going to advertise after hours support for urgent issues, it should actually exist. This is completely rediculous. Only adding insult to injury, my service agreement expires in 4 days, so I get to pay Declude for this misery. Thanks Declude. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 1:32 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 What buckets of flaming fun I'm having tonight. Declude 4 installer is giving me errors; I've got Declude 4 files dropped all over the place in unexpected places, and I've got no clue how to fix this because I can't find any documentation as to what a proper installation of Declude 4.0 is supposed to look like I'd much prefer command line and READ ME based installation over some crap-ass, bug ridden installation process.I hope someone can point me in the right direction as to what's required for patching together a manual install of Declude 4 into SmarterMail 3. My guess is at this hour, I am SOL. What a disaster. Right now I've got Declude completely disabled and I am already leaking spam like crazy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 12:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Grr. This is seriously infuriating. I wonder what the real extent of this issue is: http://forums.webhostautomation.com/viewtopic.php?t=16274 http://forums.smartertools.com/forums/13425/ShowPost.aspx Worst case I'll have to go back to subject tagging and deleting in Declude directly. What a drag. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Tuesday, March 07, 2006 1:53 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 One limitation in SmarterMail is you can't turn off the built-in webmail commands for "mark as spam" which is used to build the spam/ham queues for the internal Bayesian filters. Since we aren't using the SmarterMail filters, this is basically a confusing "no op" option for our users and we would prefer to hide this choice but there is no option to turn it off and the "skins" customization does not allow this kind of change (at this time the entire skins thing is broken as it has not been upgraded to v3.) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 11:14 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
Ok. I finally got Declude running. But it seems that AUTOWHITELIST is broken ... ARGH. [EMAIL PROTECTED]@[EMAIL PROTECTED] Declude is looking in the wrong damn spot for the SmarterMail address book. 03/10/2006 00:23:00.043 1631193701 [EMAIL PROTECTED] [EMAIL PROTECTED]@milehighnetworks.com] *local* 03/10/2006 00:23:00.043 1631193701 No d:\smartermail\domainsDomains\milehighnetworks.com\Users\jay\addressBook .xml 03/10/2006 00:23:00.043 1631193701 No d:\smartermail\domainsDomains\milehighnetworks.com\Users\jay\userconfig. xml 03/10/2006 00:23:00.043 1631193701 Domain name = milehighnetworks.com, User name = jay. I have left *three* unanswered voicemails on the Urgent declude number, and sent two emails to [EMAIL PROTECTED] with NO RESPONSE. If you are going to advertise after hours support for urgent issues, it should actually exist. This is completely rediculous. Only adding insult to injury, my service agreement expires in 4 days, so I get to pay Declude for this misery. Thanks Declude. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 1:32 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 What buckets of flaming fun I'm having tonight. Declude 4 installer is giving me errors; I've got Declude 4 files dropped all over the place in unexpected places, and I've got no clue how to fix this because I can't find any documentation as to what a proper installation of Declude 4.0 is supposed to look like I'd much prefer command line and READ ME based installation over some crap-ass, bug ridden installation process.I hope someone can point me in the right direction as to what's required for patching together a manual install of Declude 4 into SmarterMail 3. My guess is at this hour, I am SOL. What a disaster. Right now I've got Declude completely disabled and I am already leaking spam like crazy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 12:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Grr. This is seriously infuriating. I wonder what the real extent of this issue is: http://forums.webhostautomation.com/viewtopic.php?t=16274 http://forums.smartertools.com/forums/13425/ShowPost.aspx Worst case I'll have to go back to subject tagging and deleting in Declude directly. What a drag. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Tuesday, March 07, 2006 1:53 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 One limitation in SmarterMail is you can't turn off the built-in webmail commands for "mark as spam" which is used to build the spam/ham queues for the internal Bayesian filters. Since we aren't using the SmarterMail filters, this is basically a confusing "no op" option for our users and we would prefer to hide this choice but there is no option to turn it off and the "skins" customization does not allow this kind of change (at this time the entire skins thing is broken as it has not been upgraded to v3.) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 11:14 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books and "Unmark as Spam"; and whitelisting thru SM only applies to the user/domain it was set for (whereas whitelisting thru Declude would whitelist the message for every recipient). In addition, the SM spam setting for message forwarding (i.e. - "Do not forward spam level medium and above") actually works. Very useful. In short, the SM 3/Declude 4 combo is an incredible improvement over the previous version. Declude just assigns the weight -- SM handles delivering, modifying or deleting the message. I can't comment on SMTP blocking. We use gateways to filter all incoming mail, so we don't use that feature. I'd be interested to hear wh
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
It was saved to the desktop before I ran it. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Friday, March 10, 2006 1:49 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 It looks like you rand this from the web site. I would try downloading then installing. Running from a web site will run the app froma temporary folder which in my experience sometimes has a problem. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Thursday, March 09, 2006 10:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Sorry for the HTML and inline image, but I want to puke: -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 12:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Grr. This is seriously infuriating. I wonder what the real extent of this issue is: http://forums.webhostautomation.com/viewtopic.php?t=16274 http://forums.smartertools.com/forums/13425/ShowPost.aspx Worst case I'll have to go back to subject tagging and deleting in Declude directly. What a drag. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Tuesday, March 07, 2006 1:53 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 One limitation in SmarterMail is you can't turn off the built-in webmail commands for "mark as spam" which is used to build the spam/ham queues for the internal Bayesian filters. Since we aren't using the SmarterMail filters, this is basically a confusing "no op" option for our users and we would prefer to hide this choice but there is no option to turn it off and the "skins" customization does not allow this kind of change (at this time the entire skins thing is broken as it has not been upgraded to v3.) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 11:14 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books and "Unmark as Spam"; and whitelisting thru SM only applies to the user/domain it was set for (whereas whitelisting thru Declude would whitelist the message for every recipient). In addition, the SM spam setting for message forwarding (i.e. - "Do not forward spam level medium and above") actually works. Very useful. In short, the SM 3/Declude 4 combo is an incredible improvement over the previous version. Declude just assigns the weight -- SM handles delivering, modifying or deleting the message. I can't comment on SMTP blocking. We use gateways to filter all incoming mail, so we don't use that feature. I'd be interested to hear whether it actually does use Declude to block at the SMTP level. Hope that helps, Jeff > -Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Monday, March 06, 2006 9:51 AM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] SmarterMail 3 / Declude 4 > > I'm wondering if anyone is running SmarterMail 3 / Declude 4 and can > explain the greater integration that SmarterMail now has with Declude, > and how you've been dealing with that so far. Most intriguing is this > potential feature from SmarterMail manual: > > Declude > Declude integration allows you to use Declude products in conjunction > with the SmarterMail weighting system. Configuration of Declude is done > through the Declude product, and all you need to do in SmarterMail is > enable the spam check. > > -- AND -- > > SMTP Blocking > This tab allows you to set up extra spam checks that block emails at > delivery if a certain amount of spam checks fail. > > Enable SMTP Spam Blocking - Check this box to turn on this feature. > > SMT
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
What buckets of flaming fun I'm having tonight. Declude 4 installer is giving me errors; I've got Declude 4 files dropped all over the place in unexpected places, and I've got no clue how to fix this because I can't find any documentation as to what a proper installation of Declude 4.0 is supposed to look like I'd much prefer command line and READ ME based installation over some crap-ass, bug ridden installation process.I hope someone can point me in the right direction as to what's required for patching together a manual install of Declude 4 into SmarterMail 3. My guess is at this hour, I am SOL. What a disaster. Right now I've got Declude completely disabled and I am already leaking spam like crazy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, March 10, 2006 12:59 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Grr. This is seriously infuriating. I wonder what the real extent of this issue is: http://forums.webhostautomation.com/viewtopic.php?t=16274 http://forums.smartertools.com/forums/13425/ShowPost.aspx Worst case I'll have to go back to subject tagging and deleting in Declude directly. What a drag. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Tuesday, March 07, 2006 1:53 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 One limitation in SmarterMail is you can't turn off the built-in webmail commands for "mark as spam" which is used to build the spam/ham queues for the internal Bayesian filters. Since we aren't using the SmarterMail filters, this is basically a confusing "no op" option for our users and we would prefer to hide this choice but there is no option to turn it off and the "skins" customization does not allow this kind of change (at this time the entire skins thing is broken as it has not been upgraded to v3.) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 11:14 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books and "Unmark as Spam"; and whitelisting thru SM only applies to the user/domain it was set for (whereas whitelisting thru Declude would whitelist the message for every recipient). In addition, the SM spam setting for message forwarding (i.e. - "Do not forward spam level medium and above") actually works. Very useful. In short, the SM 3/Declude 4 combo is an incredible improvement over the previous version. Declude just assigns the weight -- SM handles delivering, modifying or deleting the message. I can't comment on SMTP blocking. We use gateways to filter all incoming mail, so we don't use that feature. I'd be interested to hear whether it actually does use Declude to block at the SMTP level. Hope that helps, Jeff > -----Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Monday, March 06, 2006 9:51 AM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] SmarterMail 3 / Declude 4 > > I'm wondering if anyone is running SmarterMail 3 / Declude 4 and can > explain the greater integration that SmarterMail now has with Declude, > and how you've been dealing with that so far. Most intriguing is this > potential feature from SmarterMail manual: > > Declude > Declude integration allows you to use Declude products in conjunction > with the SmarterMail weighting system. Configuration of Declude is done > through the Declude product, and all you need to do in SmarterMail is > enable the spam check. > > -- AND -- > > SMTP Blocking > This tab allows you to set up extra spam checks that block emails at > delivery if a certain amount of spam checks fail. > > Enable SMTP Spam Blocking - Check this box to turn on this feature. > > SMTP Block Threshold - An email must score this value or higher in order &g
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
Grr. This is seriously infuriating. I wonder what the real extent of this issue is: http://forums.webhostautomation.com/viewtopic.php?t=16274 http://forums.smartertools.com/forums/13425/ShowPost.aspx Worst case I'll have to go back to subject tagging and deleting in Declude directly. What a drag. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. Spivack Sent: Tuesday, March 07, 2006 1:53 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 One limitation in SmarterMail is you can't turn off the built-in webmail commands for "mark as spam" which is used to build the spam/ham queues for the internal Bayesian filters. Since we aren't using the SmarterMail filters, this is basically a confusing "no op" option for our users and we would prefer to hide this choice but there is no option to turn it off and the "skins" customization does not allow this kind of change (at this time the entire skins thing is broken as it has not been upgraded to v3.) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 11:14 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books and "Unmark as Spam"; and whitelisting thru SM only applies to the user/domain it was set for (whereas whitelisting thru Declude would whitelist the message for every recipient). In addition, the SM spam setting for message forwarding (i.e. - "Do not forward spam level medium and above") actually works. Very useful. In short, the SM 3/Declude 4 combo is an incredible improvement over the previous version. Declude just assigns the weight -- SM handles delivering, modifying or deleting the message. I can't comment on SMTP blocking. We use gateways to filter all incoming mail, so we don't use that feature. I'd be interested to hear whether it actually does use Declude to block at the SMTP level. Hope that helps, Jeff > -Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Monday, March 06, 2006 9:51 AM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] SmarterMail 3 / Declude 4 > > I'm wondering if anyone is running SmarterMail 3 / Declude 4 and can > explain the greater integration that SmarterMail now has with Declude, > and how you've been dealing with that so far. Most intriguing is this > potential feature from SmarterMail manual: > > Declude > Declude integration allows you to use Declude products in conjunction > with the SmarterMail weighting system. Configuration of Declude is done > through the Declude product, and all you need to do in SmarterMail is > enable the spam check. > > -- AND -- > > SMTP Blocking > This tab allows you to set up extra spam checks that block emails at > delivery if a certain amount of spam checks fail. > > Enable SMTP Spam Blocking - Check this box to turn on this feature. > > SMTP Block Threshold - An email must score this value or higher in order > to be blocked. The score is established by the settings on the Spam > Checks tab. > > Does this mean that it's now possible to reject messages using Declude > at the SMTP session level? > > Thanks! > - > Jay Sudowski // Handy Networks LLC > Director of Technical Operations > Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 > Hosting Solutions > Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX > www.handynetworks.com > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the De
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
That seems like a pretty big issue ... Currently actions in global.cfg only apply to outgoing mail, no? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Baranowski Sent: Monday, March 06, 2006 4:39 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 FYI, David informed me that the SM3/Declude 4.x will us the global.cfg for actions instead of the $default$.junkmail file. This was more then a week ago, so I don't know if this has been changed yet. (SM3 issue) Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, March 06, 2006 2:06 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 So in your Declude configuration, you have everything set to WARN only? And then in SmarterMail, you decide what actions to take? What impact does "unmark as spam" have, in relation to Declude? I get the feeling that this could be very powerful, in terms of dealing with false positives, etc ... assuming that it works as it should. Using SmarterMail based rules, it'd be possible to move spam to the customer's junk e-mail folder and then also use SmarterMail's auto-purge settings to keep the size of the junkmail folder under control. We can also give our customers more power to whitelist through SmarterMail trusted senders. We are planning on upgrading later this week and I want to do it right. I just hope that the transition between essentially what was Declude setup for iMail originally, to Declude integrated with SmarterMail will be smooth. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 2:14 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books and "Unmark as Spam"; and whitelisting thru SM only applies to the user/domain it was set for (whereas whitelisting thru Declude would whitelist the message for every recipient). In addition, the SM spam setting for message forwarding (i.e. - "Do not forward spam level medium and above") actually works. Very useful. In short, the SM 3/Declude 4 combo is an incredible improvement over the previous version. Declude just assigns the weight -- SM handles delivering, modifying or deleting the message. I can't comment on SMTP blocking. We use gateways to filter all incoming mail, so we don't use that feature. I'd be interested to hear whether it actually does use Declude to block at the SMTP level. Hope that helps, Jeff > -Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Monday, March 06, 2006 9:51 AM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] SmarterMail 3 / Declude 4 > > I'm wondering if anyone is running SmarterMail 3 / Declude 4 and can > explain the greater integration that SmarterMail now has with Declude, > and how you've been dealing with that so far. Most intriguing is this > potential feature from SmarterMail manual: > > Declude > Declude integration allows you to use Declude products in conjunction > with the SmarterMail weighting system. Configuration of Declude is done > through the Declude product, and all you need to do in SmarterMail is > enable the spam check. > > -- AND -- > > SMTP Blocking > This tab allows you to set up extra spam checks that block emails at > delivery if a certain amount of spam checks fail. > > Enable SMTP Spam Blocking - Check this box to turn on this feature. > > SMTP Block Threshold - An email must score this value or higher in order > to be blocked. The score is established by the settings on the Spam > Checks tab. > > Does this mean that it's now possible to reject messages using Declude > at the SMTP session level? > > Thanks! > - > Jay Sudowski // Handy Networks LLC > Director of Technical Operations > Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 > Hosting Solutions
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
Our setup is across multiple drives. I'm curious to know what issues you had. I know on another server where we recently installed Declude 3, we had an issue with Declude proc getting installed to D:\ when everything else was on C:\. This was resolved by moving the exe to C:\ and updating the service to reference the proper location. Did you face something similar? >We did have some trouble getting Declude to install. We're fairly sure it >was because we had done a manual install of version 2.x that used several >drives. I haven't heard of many problems from other people, and in our >case a little registry editing took care of it. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail 3 / Declude 4
So in your Declude configuration, you have everything set to WARN only? And then in SmarterMail, you decide what actions to take? What impact does "unmark as spam" have, in relation to Declude? I get the feeling that this could be very powerful, in terms of dealing with false positives, etc ... assuming that it works as it should. Using SmarterMail based rules, it'd be possible to move spam to the customer's junk e-mail folder and then also use SmarterMail's auto-purge settings to keep the size of the junkmail folder under control. We can also give our customers more power to whitelist through SmarterMail trusted senders. We are planning on upgrading later this week and I want to do it right. I just hope that the transition between essentially what was Declude setup for iMail originally, to Declude integrated with SmarterMail will be smooth. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Monday, March 06, 2006 2:14 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail 3 / Declude 4 Declude's integration with SmarterMail's spam system is something we had been waiting on for over a year. Declude passes the final weight back to SM, and SM decides what to do with the message. This means you can set different actions for each user or domain based on whatever weight is best for them. Some admins might take this for granted, but using SM 2.x with Declude always felt like you were patching together content filters to try to trick SM into reading Declude's recommendation. Basically everything built into SM to handle spam now works, including: domain and user level "trusted senders"; whitelisting from address books and "Unmark as Spam"; and whitelisting thru SM only applies to the user/domain it was set for (whereas whitelisting thru Declude would whitelist the message for every recipient). In addition, the SM spam setting for message forwarding (i.e. - "Do not forward spam level medium and above") actually works. Very useful. In short, the SM 3/Declude 4 combo is an incredible improvement over the previous version. Declude just assigns the weight -- SM handles delivering, modifying or deleting the message. I can't comment on SMTP blocking. We use gateways to filter all incoming mail, so we don't use that feature. I'd be interested to hear whether it actually does use Declude to block at the SMTP level. Hope that helps, Jeff > -Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC > Sent: Monday, March 06, 2006 9:51 AM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] SmarterMail 3 / Declude 4 > > I'm wondering if anyone is running SmarterMail 3 / Declude 4 and can > explain the greater integration that SmarterMail now has with Declude, > and how you've been dealing with that so far. Most intriguing is this > potential feature from SmarterMail manual: > > Declude > Declude integration allows you to use Declude products in conjunction > with the SmarterMail weighting system. Configuration of Declude is done > through the Declude product, and all you need to do in SmarterMail is > enable the spam check. > > -- AND -- > > SMTP Blocking > This tab allows you to set up extra spam checks that block emails at > delivery if a certain amount of spam checks fail. > > Enable SMTP Spam Blocking - Check this box to turn on this feature. > > SMTP Block Threshold - An email must score this value or higher in order > to be blocked. The score is established by the settings on the Spam > Checks tab. > > Does this mean that it's now possible to reject messages using Declude > at the SMTP session level? > > Thanks! > - > Jay Sudowski // Handy Networks LLC > Director of Technical Operations > Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 > Hosting Solutions > Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX > www.handynetworks.com > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterMail 3 / Declude 4
I'm wondering if anyone is running SmarterMail 3 / Declude 4 and can explain the greater integration that SmarterMail now has with Declude, and how you've been dealing with that so far. Most intriguing is this potential feature from SmarterMail manual: Declude Declude integration allows you to use Declude products in conjunction with the SmarterMail weighting system. Configuration of Declude is done through the Declude product, and all you need to do in SmarterMail is enable the spam check. -- AND -- SMTP Blocking This tab allows you to set up extra spam checks that block emails at delivery if a certain amount of spam checks fail. Enable SMTP Spam Blocking - Check this box to turn on this feature. SMTP Block Threshold - An email must score this value or higher in order to be blocked. The score is established by the settings on the Spam Checks tab. Does this mean that it's now possible to reject messages using Declude at the SMTP session level? Thanks! ----- Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Damaged Image Files
Title: Message We had an issue with Declude “corrupting” images from SmarterStats long ago. It turned out the SmarterStats wasn’t inserting line breaks in their images, and thus single lines were going out past 8,000 characters, at which point Declude truncated the line. I wouldn’t be surprised if the spamware being used to send these was doing something similar. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 28, 2006 2:54 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files Interesting. As Matt, said, if you can get an original D*.SMD that would be great for following this trail. I would note that in addition, use the headers that were received to track the sending IP and time, and check your IMail log, and from there you will have the GUID for the message. Then check the Declude log for that GUID (but do a case-insensitive search). That will tell you whether Declude processed the message at all; it could be that Declude processed the message but failed to insert the headers, or failed to lock the file and had to "fail open" and allow IMail to deliver the message without being able to insert the headers. For more information, I found all 94 of the messages with this title sent to my server in today and yesterday, and found that they were all held as spam. I then copied each to my workstation and compared the filesize to see if I could spot any that were obviously different. They were all with 1 or 2 KB of each other, so I opened quite a few and found them all intact, and all with the Declude headers correctly placed. My mileage will vary from yours, but it doesn't seem that I received any broken images in this particular spam run, and I've had no user feedback indicating spam received today. Hopefully, this counter-example will help narrow down the problem. I'm using Declude v2.0.6.16 from 2005-05-25 and IMail v8.14 with whatever hotfixes. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Tuesday, February 28, 2006 10:51 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files Yes, they are passing SNIFFER and Darrell's INV-URIBL at this time. But what Evans wrote is true. Either this "spammer" has corrected "his" image.. the fact remains that in the past when it was a corrupted; Declude failed in our version. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 28, 2006 7:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files Ditto. I've received and held 24 messages with the same title. Re-queuing 3 of these to myself, they had an image that was intact. They fail the usual RBL tests plus Message Sniffer. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Tuesday, February 28, 2006 10:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files Judgement is quick to pass for some around here. These are getting caught by my system X-Note: Spam Tests Failed: SBL [28], SORBS-DUHL [4], HELOBOGUS [3], SNIFFER [13] Harry Vanderzand inTown Internet & Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Tuesday, February 28, 2006 12:49 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Damaged Image Files The problem that we've seen this "spammer" is that the image is corrupted as you mentioned... and Declude is exiting; thus why it's being allowed to be delivered. "Smart" coding on the spammer... Not so smart on Declude. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, February 28, 2006 6:41 PM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Damaged Image Files We’re getting the same. Also using Declude with smartermail. Because Declude doesn’t appear to be scanning the headers there is no way for us to stop them. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Tuesday, February 28, 2006 12:38 AM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Damaged Image Files I’m getting a lot of messages that have only a graphic in them. The graphic appears to have been damaged as only about ½ of it displays. Declude
RE: [Declude.JunkMail] Sniffer Slow / Declude Problem?
I'll be damned. Apparently Diskeeper believes that "Start Time" really means "End Time" and vice versa. Therefore, when I set a new defrag schedule last night, it really decided to defrag between 7AM and 9PM, not between 9PM and 7AM It has been one of those weeks from hell over here. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Thursday, February 16, 2006 3:18 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Sniffer Slow / Declude Problem? I have mails backing up in my proc because Sniffer seems to be running slow, or is this a Declude issue? I'm not really sure because Sniffer seems to be processing the message very quickly, but Declude shows about a 30 second lag time between calling Sniffer and getting any results back ... 02/16/2006 12:59:22.069 29799040189 SNIFFER: External program started: c:\sniffer\***.exe c:\SmarterMail\Spool\proc\work\29799040189.eml 02/16/2006 12:59:57.335 29799040189 SNIFFER: External program reports exit code of 57 02/16/2006 12:59:57.335 29799040189 External program triggered spam (1). 02/16/2006 12:59:57.351 29799040189 Finished Final Test #100: SNIFFER [external] 02/16/2006 12:59:57.351 29799040189 SNIFFERPORN: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:57.523 29799040189 Finished Final Test #101: SNIFFERPORN [external] 02/16/2006 12:59:57.820 29799040189 SNIFFERAV: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:58.148 29799040189 Finished Final Test #102: SNIFFERAV [external] 02/16/2006 12:59:58.288 29799040189 SNIFFERSPAM: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:58.288 29799040189 Finished Final Test #103: SNIFFERSPAM [external] 02/16/2006 12:59:58.491 29799040189 SNIFFERMEDIA: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:59.085 29799040189 Finished Final Test #104: SNIFFERMEDIA [external] 02/16/2006 12:59:59.085 29799040189 SNIFFERSCAM: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:59.085 29799040189 Finished Final Test #105: SNIFFERSCAM [external] 02/16/2006 12:59:59.351 29799040189 SNIFFERTONER: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:59.351 29799040189 Finished Final Test #106: SNIFFERTONER [external] 02/16/2006 13:00:01.351 29799040189 SNIFFERMLM: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.023 29799040189 External program triggered spam (2) [57*7*57]. 02/16/2006 13:00:02.023 29799040189 Finished Final Test #107: SNIFFERMLM [external] 02/16/2006 13:00:02.023 29799040189 SNIFFERGREY: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.210 29799040189 Finished Final Test #108: SNIFFERGREY [external] 02/16/2006 13:00:02.210 29799040189 SNIFFERGAMBLE: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.617 29799040189 Finished Final Test #109: SNIFFERGAMBLE [external] 02/16/2006 13:00:02.617 29799040189 SNIFFERSNAKEOIL: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.632 29799040189 Finished Final Test #110: SNIFFERSNAKEOIL [external] 02/16/2006 13:00:02.898 29799040189 SNIFFERGREETING: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.913 29799040189 Finished Final Test #111: SNIFFERGREETING [external] 02/16/2006 13:00:02.913 29799040189 SNIFFERDEBT: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.929 29799040189 Finished Final Test #112: SNIFFERDEBT [external] 02/16/2006 13:00:02.929 29799040189 SNIFFERTRAVEL: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.929 29799040189 Finished Final Test #113: SNIFFERTRAVEL [external] 02/16/2006 13:00:02.929 29799040189 SNIFFERINSURANCE: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.929 29799040189 Finished Final Test #114: SNIFFERINSURANCE [external] diq8a1yi20060216195953 29799040189.eml 148515 Match 833560 57 636 650 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 837417 57 730 756 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 833561 57 726 756 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 819460 57 898 948 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 616785 57 3454346459 diq8a1yi20060216195953 29799040189.eml 148515 Match 467699 62 3515352459 diq8a1yi20060216195953 29799040189.eml 148515 Match 616790 62 3551356659 diq8a1yi20060216195953 29799040189.eml 148515 Match 616791 62 3579358959 diq8a1yi20060216195953 29799040189.eml 148515
[Declude.JunkMail] Sniffer Slow / Declude Problem?
I have mails backing up in my proc because Sniffer seems to be running slow, or is this a Declude issue? I'm not really sure because Sniffer seems to be processing the message very quickly, but Declude shows about a 30 second lag time between calling Sniffer and getting any results back ... 02/16/2006 12:59:22.069 29799040189 SNIFFER: External program started: c:\sniffer\***.exe c:\SmarterMail\Spool\proc\work\29799040189.eml 02/16/2006 12:59:57.335 29799040189 SNIFFER: External program reports exit code of 57 02/16/2006 12:59:57.335 29799040189 External program triggered spam (1). 02/16/2006 12:59:57.351 29799040189 Finished Final Test #100: SNIFFER [external] 02/16/2006 12:59:57.351 29799040189 SNIFFERPORN: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:57.523 29799040189 Finished Final Test #101: SNIFFERPORN [external] 02/16/2006 12:59:57.820 29799040189 SNIFFERAV: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:58.148 29799040189 Finished Final Test #102: SNIFFERAV [external] 02/16/2006 12:59:58.288 29799040189 SNIFFERSPAM: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:58.288 29799040189 Finished Final Test #103: SNIFFERSPAM [external] 02/16/2006 12:59:58.491 29799040189 SNIFFERMEDIA: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:59.085 29799040189 Finished Final Test #104: SNIFFERMEDIA [external] 02/16/2006 12:59:59.085 29799040189 SNIFFERSCAM: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:59.085 29799040189 Finished Final Test #105: SNIFFERSCAM [external] 02/16/2006 12:59:59.351 29799040189 SNIFFERTONER: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 12:59:59.351 29799040189 Finished Final Test #106: SNIFFERTONER [external] 02/16/2006 13:00:01.351 29799040189 SNIFFERMLM: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.023 29799040189 External program triggered spam (2) [57*7*57]. 02/16/2006 13:00:02.023 29799040189 Finished Final Test #107: SNIFFERMLM [external] 02/16/2006 13:00:02.023 29799040189 SNIFFERGREY: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.210 29799040189 Finished Final Test #108: SNIFFERGREY [external] 02/16/2006 13:00:02.210 29799040189 SNIFFERGAMBLE: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.617 29799040189 Finished Final Test #109: SNIFFERGAMBLE [external] 02/16/2006 13:00:02.617 29799040189 SNIFFERSNAKEOIL: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.632 29799040189 Finished Final Test #110: SNIFFERSNAKEOIL [external] 02/16/2006 13:00:02.898 29799040189 SNIFFERGREETING: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.913 29799040189 Finished Final Test #111: SNIFFERGREETING [external] 02/16/2006 13:00:02.913 29799040189 SNIFFERDEBT: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.929 29799040189 Finished Final Test #112: SNIFFERDEBT [external] 02/16/2006 13:00:02.929 29799040189 SNIFFERTRAVEL: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.929 29799040189 Finished Final Test #113: SNIFFERTRAVEL [external] 02/16/2006 13:00:02.929 29799040189 SNIFFERINSURANCE: External test using cached exit code of 57 [from SNIFFER]. 02/16/2006 13:00:02.929 29799040189 Finished Final Test #114: SNIFFERINSURANCE [external] diq8a1yi20060216195953 29799040189.eml 148515 Match 833560 57 636 650 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 837417 57 730 756 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 833561 57 726 756 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 819460 57 898 948 59 diq8a1yi20060216195953 29799040189.eml 148515 Match 616785 57 3454346459 diq8a1yi20060216195953 29799040189.eml 148515 Match 467699 62 3515352459 diq8a1yi20060216195953 29799040189.eml 148515 Match 616790 62 3551356659 diq8a1yi20060216195953 29799040189.eml 148515 Match 616791 62 3579358959 diq8a1yi20060216195953 29799040189.eml 148515 Match 616793 62 3600361159 diq8a1yi20060216195953 29799040189.eml 148515 Match 616794 62 3614362059 diq8a1yi20060216195953 29799040189.eml 148515 Match 616795 62 3630364059 diq8a1yi20060216195953 29799040189.eml 148515 Final 833560 57 0 373759 Of course, I've also now got Sniffer disabled and mail isn't moving very quickly either. Any help or ideas would be appreciated. I've had so many issues with Declude and Sniffer this week, I'm seriously ready to can the whole setup. -
RE: [Declude.JunkMail] SmarterMail 3.0 and Declude
Automatic Whitelisting per user from the recipient's Web Messaging Address Book ->> As far as I know, this has been supported for quite sometime by Deculde / SmarterMail. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Green dfn Systems Sent: Friday, February 10, 2006 4:58 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail 3.0 and Declude Now that SmarterMail 3.0 is released, I have been perusing their site as well as Declude's site to see if the new integrated functionality and features provide the last two pieces I have been waiting for. Action - Mailbox -- send spam by weight to users web spam folder Automatic Whitelisting per user from the recipient's Web Messaging Address Book Can any early adopters enlighten me? Bill Green dfn Systems --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [OT] SmarterMail 3.x
SmarterMail file format is not one message per file -- it used to be, however. They group each days messages into a _M_D.grp file, at least with version 2.6.x. They also have a mailbox.cfg file per mailbox that contains message read status and some other indexing information. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Thomas - Mathbox Sent: Thursday, February 09, 2006 7:03 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] [OT] SmarterMail 3.x Kevin, As I recall, yes. Also note that SmarterMail provides a COM object interface for pulling the message out of the file. I believe The COM object also provides for disposing of the message when you are done with it. If I am little vague, I apologize. I haven't looked at it in quite a while, even though I am licensed for the 2.x version. Mike - Original Message - From: "Kevin Bilbee" <[EMAIL PROTECTED]> To: Sent: Thursday, February 09, 2006 6:30 PM Subject: [Declude.JunkMail] [OT] SmarterMail 3.x > Are you saying the mailbox is a folder and it contains one message per file? > > > Kevin > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Michael Thomas - > > Mathbox > > Sent: Thursday, February 09, 2006 3:21 PM > > To: Declude.JunkMail@declude.com > > Subject: Re: [Declude.JunkMail] SmarterMail 3.x > > > > > > Kevin, > > > > Just a thought here. With the IMail single file storage > > environment, having an alias trigger a program was a convenient > > solution. However, the SmarterMail storage is one file per > > message. It should be fairly simple to set up a directory monitor > > that watches/checks for new files and processes whatever it finds. > > > > Mike > > > > - Original Message - > > From: "Kevin Bilbee" <[EMAIL PROTECTED]> > > To: "JunkMail Declude" > > Sent: Thursday, February 09, 2006 3:19 PM > > Subject: [Declude.JunkMail] SmarterMail 3.x > > > > > > > Does anyone know if SmarterMail has Program aliases. I have > > checked the docs > > > and am going back and forth with SmarterTools sales, but not to > > be found. > > > > > > It is the only missing feature I would need to move away from Imail. > > > > > > > > > > > > So now here is my declude question. > > > > > > Could I use smartermail/declude, with an external test, to identify a > > > message form a specific account then process and move the > > message/delete a > > > message to where I would like. What would happen when declude > > gets control > > > back and the message no longer exists? > > > > > > > > > We currently use program aliases to process EDI orders from customers. > > > > > > > > > Kevin Bilbee > > > Network Administrator > > > Standard Abrasives, Inc. > > > [EMAIL PROTECTED] > > > (805) 520-5800 x7332 > > > > > > Changing the way industry works. > > > > > > --- > > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > > > N-±¢®±yuu¹¢Sjj®.rx---N²rz¶uT¶j®ryjÊz±mrx.jSqy?ÿÂ.? > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > N¬f¢—¬±Æ§ç_¢»â®ë ±¼ƒyÉnuá 0uç%¹×œ¢dáŠÁ&j)\jgŸ®‰…àÞr[x›§Æ¢–f¢–)à–+-N‹§²æìr¸›z;¬¶Ç§u©Ä™¨¥¶ˆ¦j)l®÷^r[yÊ&jwmÊ—®žË›±ÊâmàÞr[x›§Æ¢•8^j·!Š÷¬q©Ûyú.Ö†Ûiÿü0Âf¢•ªÜ†+Þ
[Declude.JunkMail] Declude 3.0x
I am having mail processing issues on Declude 3.0x server. In addition to seeing the decludeproc.exe and my sniffer processes, I occasionally also see many declude.exe tasks kicking off. Should this be happening? Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterMail: Doesn't log authenitcated user to log file
I am currently trying to clean up a very nasty spam run someone initiated through our SmarterMail server. Much to my dismay, it appears that SmarterMail does not log which user authenticates a SMTP session, only that the session is authenticated to the SMTP log file. How is this possible ??? 13:06:53 [200.181.148.244][456908] rsp: 220 mail3.denver.wehostwebsites.com 13:06:53 [200.181.148.244][456908] connected at 1/29/2006 1:06:53 PM 13:06:54 [200.181.148.244][456908] cmd: EHLO 192.168.7.100 13:06:54 [200.181.148.244][456908] rsp: 250-imail3 Hello [200.181.148.244] 250-SIZE 31457280 250-AUTH LOGIN CRAM-MD5 250 OK 13:06:54 [200.181.148.244][456908] cmd: AUTH LOGIN 13:06:54 [200.181.148.244][456908] rsp: 334 VXNlcm5hbWU6 13:06:55 [200.181.148.244][456908] rsp: 334 UGFzc3dvcmQ6 13:06:55 [200.181.148.244][456908] rsp: 235 Authentication successful 13:06:55 [200.181.148.244][456908] cmd: MAIL FROM:<[EMAIL PROTECTED]> 13:06:55 [200.181.148.244][456908] rsp: 250 OK <[EMAIL PROTECTED]> Sender ok 13:06:56 [200.181.148.244][456908] cmd: RCPT TO:<[EMAIL PROTECTED]> 13:06:56 [200.181.148.244][456908] rsp: 250 OK <[EMAIL PROTECTED]> Recipient ok 13:06:57 [200.181.148.244][456908] cmd: DATA This is just un-***-believable ... If anyone has any suggestions on how I can track down the customer abusing my SMTP via SmarterMail logs, please email me directly to [EMAIL PROTECTED], since my main email is currently outbound only. Thanks! ----- Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview / HoldAnalyzer
Hi All - I'm trying to find a utility that will let me analyze Declude's hold directory (well, sub-directories now) and ultimately deliver and held mail. From reviewing the archives, it looks like SpamReview and HoldAnalyzer are the two most frequently discussed programs, but I'm having issues with both: SpamReview All of the links to SpamReview get redirected to the main page for slsoft.com. I did manage to get a copy of this app installed by downloading from declude.com, but it doesn't seem to actually see any held mail. I'm not sure if I need to move the mail that's in each subdirectory (eg 05Dec2005) into a particular directory so that SpamReview will see the messages. If this is the case, I guess I can live with it but it does seem a bit clunky, since my goal is to eventually turn this over to this particular customer's administrative assistant so she can just confirm that no legit mail is being held. Is this tool still a valid tool to use? The fact that all external links to the tool get redirected is somewhat concerning. HoldAnalyzer I got this working, but it seems more like a reporting tool, rather than a reviewing and requeuing tool. One thing I seem to be missing, though, is how the whole DLA.MSI installer plays into things. I think it's supposed to setup some IIS stuff (given the reference to 'virtual directory' and port 80), but it doesn't seem to be creating a virtual directory on any sites in IIS. If anyone has any insight into what I'm doing wrong, it would be much appreciated. I think I just need a nudge in the right direction. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
