Re: [Declude.JunkMail] declude queue / imail spool problems?
Here's what I did to fix it: 1) I turned off declude junkmail (by renaming the global.cfg file) 2) Moved all the files from the overflow directory to the spool directory They all cleared out and things are back to normal. Now (an hour after i turned junkmail off) I am going to turn junkmail back on and see what happens. From what I could tell, most of the extra email was spam. I could not find any trace of a mail loop, though. Our mail server is a Dell 2450 with 2 866processors and 512mb ram. it has a caching raid controller and some very fast drives. How high do you think I could get away with setting that max processes value? In the imail admin for 7.11 there is an advanced tab under the smtp service. One of the values that can be set there is max processes. Is this the same thing? Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 18, 2002 12:37 PM Subject: Re: [Declude.JunkMail] declude queue / imail spool problems? I am having some trouble with my mail server. About once a week, I find my spool folder overflowing. There are usually only about 200 files in that folder, but when this weird thing happens, there are 5000+ in both the spool and in the overflow folder. If there are lots of D*.SMD files in the spool directory, and lots of Q*.SMD files in the overflow directory, then IMail reached its maximum capacity and Declude Queue took over. Without Declude Queue, you would have seen all those files in the spool directory, and they would get sent out more slowly. If I move all the files from the overflow back into the spool, they clear out pretty quickly, but more keep showing up in the overflow at a rate of about 100 per few minutes. What could be causing this? Where do I start to try to figure it out. There is nothing unusual in the imail log and there is nothing about queue in any of the logs. If you run regedit, what is the entry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMTPD32\Parameters\MaxQ ueProc set to? That controls how many processes can be running at once. If your server is capable, you could try increasing that value. Specifically, Declude Queue will start moving those files to the overflow directory when the maximum number of processes is reached (at which point IMail would normally keep the file in the queue, and not even attempt to deliver it until the next queue run, typically 20-30 minutes later). What you really need to do is find out *why* so much E-mail is being sent/received; in many cases, it is a spammer or other undesirable (such as a mail loop). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
I turned it back on and the number of files in the spool started growing at a very fast pace. I'm running declude v1.53 if that helps. We do get lots of dictionary attacks, but they don't actually get in as files do they? don't the emails to bogus users get rejected before they are written to a file? The part about dead tests sounds interesting. Below is a list of the tests that I am running... Thanks, Jim #ORBZIN ip4r inputs.orbz.org 127.0.0.2 5 0 #ORBZOUT ip4r outputs.orbz.org 127.0.0.2 5 0 ORDB ip4r relays.ordb.org * 14 0 OSDUL ip4rrelays.osirusoft.com 127.0.0.3 15 0 OSFORM ip4rrelays.osirusoft.com 127.0.0.8 15 0 OSLIST ip4rrelays.osirusoft.com 127.0.0.7 15 0 OSRELAY ip4rrelays.osirusoft.com 127.0.0.2 14 0 OSSMART ip4rrelays.osirusoft.com 127.0.0.5 15 0 OSSOFT ip4rrelays.osirusoft.com 127.0.0.6 15 0 OSSRC ip4rrelays.osirusoft.com 127.0.0.4 15 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 25 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 15 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 15 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 15 0 ADULT adult x x 30 0 BADHEADERS badheaders x x 10 0 MAILFROMenvfrom x x 15 0 PERCENT percent x x 15 0 REVDNS revdnsexists x x 15 0 ROUTING spamrouting x x 15 0 SPAMHEADERS spamheaders x x 15 0 SNIFFER external nonzero e:\imail\declude\Sniffer\sniffer.exe 29 0 WEIGHT weight x x 30 0 - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 18, 2002 12:59 PM Subject: Re: [Declude.JunkMail] declude queue / imail spool problems? Here's what I did to fix it: 1) I turned off declude junkmail (by renaming the global.cfg file) 2) Moved all the files from the overflow directory to the spool directory They all cleared out and things are back to normal. Now (an hour after i turned junkmail off) I am going to turn junkmail back on and see what happens. Note that you also did something else here -- by turning off Declude JunkMail, you sped up delivery of *new* E-mails, especially if you are using an old spam test that times out (causing the E-mail to be in memory for 10+ extra seconds). That may be a factor. From what I could tell, most of the extra email was spam. It sounds like you may be dealing with a massive distributed spam attack, where a spammer compromises thousands of computers, and sends spam via a dictionary-like attack (sending to thousands and thousands of made-up addresses, hoping a few will receive the E-mail). If you have a nobody alias, this can shut down your server. Our mail server is a Dell 2450 with 2 866processors and 512mb ram. it has a caching raid controller and some very fast drives. How high do you think I could get away with setting that max processes value? It's impossible to say -- only trial and error will tell for sure. The problem is that Microsoft doesn't document the pertinent information about the problem. The problem is that if you go too high, Microsoft will run out of a special type of memory and choke, causing all new processes to fail upon loading. With the best information we can get from Microsoft, it shouldn't be possible for this to happen with recent versions of Declude (although it definitely will happen without Declude). A value of 30 is the default, so if it is lower, you should be able to raise it to 30 with no problem. In the imail admin for 7.11 there is an advanced tab under the smtp service. One of the values that can be set there is max processes. Is this the same thing? Ah, yes -- I forgot about that (a nice new feature). That is the same thing. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] declude queue / imail spool problems?
OK, I confirmed that there are no nobody aliases. I will start pouring through the logs... is there a program that would make that any easier? Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 18, 2002 1:54 PM Subject: Re: [Declude.JunkMail] declude queue / imail spool problems? We do get lots of dictionary attacks, but they don't actually get in as files do they? That depends. If you have a nobody alias, they do come in as files, and are processed by Declude. If you do not have a nobody alias, then they will not be processed (by IMail or Declude). don't the emails to bogus users get rejected before they are written to a file? Yes -- if there is no nobody alias. The part about dead tests sounds interesting. Below is a list of the tests that I am running... All of those tests are still around, so that shouldn't account for the problem. Have you tried looking at the logs to see why there is so much mail? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Get a load of this . . .
I got one too... and replied with questions. I doubt if we'll get answers. Jim - Original Message - From: Tony Gray - Network Administrator To: [EMAIL PROTECTED] Sent: Wednesday, July 03, 2002 1:34 PM Subject: RE: [Declude.JunkMail] Get a load of this . . . I just received one of these today too. I responded asking for the confirmation letters of those who apparently 'opted in'. I have not received any list yet. Surprise, surprise. - Tony -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Glenn \ WCNetSent: Wednesday, July 03, 2002 2:24 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Get a load of this . . . Here are some to add to your Kill file or BlackList! -- Hello Administrators for wcnet.net,Please check to verify that messages being sent to our Opt-in customers that are using your services are not being blocked by any of wcnet.net's servers. If there currently are blocks on any of our IP's, please contact me directly so that we may find a resolution to this.Relevant Marketing Technologies is a leading permission marketing and affinity-based email marketing company. The current client roster is primarily made up of four industries: Music, Sports, Broadcast, and Entertainment. Relevant Marketing Technologies is the leading online opt-in permission based newsletter services provider in each of these industries. Relevant Marketing Technologies has attained this leadership position primarily through the growth and evolution of ENewsNotifier (ENN).The ENN system is opt-in, and permission based, and provides direct live links to the URL to de-active the users individual account automatically imbedded into each and every message sent through our servers. We have modified all of our servers to prohibit open relay access, and have been cleared by MAPS through www.mail-abuse.org on all or our IP addresses. We are not spam.Currently, the servers we use to distribute email messages are:216.234.252.24 ellis1.popmail.com216.234.252.26 campbell1.popmail.com216.234.252.35 feist1.popmail.com216.234.252.36 leguin1.popmail.com216.234.252.40 pohl1.popmail.com216.234.252.44 herbert1.popmail.com216.234.252.45 lucas1.popmail.com216.234.252.46 verne1.popmail.com216.234.252.47 trout1.popmail.com216.234.252.48 simak1.popmail.com216.234.252.49 mail.goglobal.net216.234.252.50 niven1.popmail.com216.234.252.51 wells1.popmail.com216.234.252.52 bova1.popmail.com216.234.252.53 orwell1.popmail.com216.234.252.59 home.popmail.com216.234.252.70 corporate.popmail.com216.234.252.91 home.brownsmail.net216.234.252.92 home.bazaar.com216.234.252.93 home.ennmail.com216.234.252.94 home.broadcastimagemail.com216.234.252.95 home.mykswomail.com216.234.252.96 home.countrystarsmail.com216.234.252.97 home.esife.org216.234.252.98 home.faithmail.com216.234.253.20 mail4.roiinteractive.com216.234.253.214 mail5.roiinteractive.comOur DNS Lookup information is as follows:Administrative Contact, Technical Contact: Host (HO9039-ORG) [EMAIL PROTECTED] Relevant Marketing Technologies Inc. Relevant Marketing Technologies, Inc. 6688 N. Central Expressway, Suite 150 Dallas, Tx 75026 US 469-385-2000 Fax- 469-385-2001 Fax- - 469-385-2001If I can be of any assistance in the expeditious modification of our records with you, please do not hesitate contacting me.Sincerely,Bethann LesnickSenior Client ConsultantStrategic Development MarketingRelevant Marketing Technologies6688 N. Central Expressway, Suite 150Dallas, TX 75206Main - 469.385.2000Direct - 469.385.2022Fax - 469.385.2001[EMAIL PROTECTED]www.RelevantMarketingTechnologies.comemail marketing and communication solutions
[Declude.JunkMail] how do i disable junkmail?
I need to turn off all of declude-junkmail for a little while, but keep declude-virus running. what would be the best way to do this? thanks, Jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] attach and per domain/user config...
We are testing our junkmail system before we deploy it to all our customers. We have several domains that we are testing with, one of which is for our employees only, so it is configured to use the attach action if the weight test fails. In two of our other domains we have 2 to 5 users configured with the attach action. The problem is that when an email is sent to a bunch of people, one of which is configured for the attach action, the email is attached for all the others too, even if they are not configured for it. Is there a way around this? Thanks, Jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting -- Does BlackIce help?
we put that on after having over 100,000 connections to our server in one day for harvesting purposes. We noticed that it was seeing these attacks, but couldn't tell if it was blocking them or not. I wonder if there is a way to configure blackice to automatically block someone that is doing this for one day? also, how has your server been, stability wise, after installing blackice? ours seems to have held up pretty well. thanks, jim - Original Message - From: Roger Heath [EMAIL PROTECTED] To: Jesus Alvarez [EMAIL PROTECTED] Sent: Monday, April 29, 2002 5:16 PM Subject: BLARSBL:Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting Reply to: Jesus Alvarez Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting on Monday 4:26:37 PM The Server version of NetworkIce Black Ice detects these as 'SMTP- too many errors'. When we see this, we set that IP to be blocked for a day or a week if they are persistent. It essentially shuts off their attack for a set time period... You can purchase this Server Firewall at www.networkice.com -- Roger Heath - Copy of Original Message(s): - J Can Declude Hijack help with dictionary attacks and J other attacks that attempt at mail harvesting ? J We had a case recently where someone tried over 5 J email addresses on a domain before we were able to stop J him. Since we have an Imgate front end, the bounce messages J increased our queues and delivery times quite a bit. His J ISP was notified and their account cancelled but that does J not prevent this from happening again. We currently run J Declude Hijack but it normally catches attempts at J massive outgoing deliveries, not cases like this. J Else, how do other Imail Declude users protect themselves J in these cases ? J Thanks. J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. You can E-mail J [EMAIL PROTECTED] for assistance. You can visit our web J site at http://www.declude.com . J -- J ActivatorMail(tm) ver.041902 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] v1.47 (beta) released
What is the syntax for the WHITELIST IP feature? Is it WHITELIST IP 192.168.1.0/24 ? Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, April 22, 2002 8:46 AM Subject: [Declude.JunkMail] v1.47 (beta) released We have just released Declude JunkMail v1.47 ( http://www.declude.com/junkmail/manual.htm ), a beta version. The noticeable changes include: o CIDR ranges can be used in WHITELIST IP entries and ipfile test types o WHITELIST TODOMAIN and WHITELIST TO (for the Pro version) allow easy opt-out for domains/users o New ATTACH action I'd love to hear what people think about the new (unique) ATTACH action. It requires downloading a file from http://www.declude.com/release/147/spamattach.eml , that goes in your \IMail\Delude\ directory (which can be modified to suit your needs), and then using ATTACH as the action (IE WEIGHT20 ATTACH). What this does is it delivers the spam, but in a much less obtrusive way. Instead of a misleading subject of Hi or Here's the information you requested or an annoying subject of MAKE $$$MONEY$$$ NOW, you'll see a subject of You have spam for all spams. By default, the body of the E-mail will show the real subject of the E-mail, the sender's E-mail address, and a list of the tests that failed. If you want to view the spam, you just click a link (depending on your mail client, you may just see the text of the original E-mail body in Notepad, or the original E-mail in its original form). With this, spam becomes extremely easy to identify, easy to filter, less annoying, and false positives are much less of a problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] lots of declude processes and not many smtp... 8000+ files in the spool
Is it normal to have 20 or so declude process running, not many smtp32 processes and 8000+ spool files in the spool folder? there are also 8000+ files in the spool\overflow folder. all of these files ARE from today. we keep our spool directory very clean! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] lots of declude processes and not many smtp... 8000+ files in the spool
no need to answer... sorry for the double post. jim - Original Message - From: Jim Jones, Jr. [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Friday, April 19, 2002 7:36 PM Subject: [Declude.JunkMail] lots of declude processes and not many smtp... 8000+ files in the spool Is it normal to have 20 or so declude process running, not many smtp32 processes and 8000+ spool files in the spool folder? there are also 8000+ files in the spool\overflow folder. all of these files ARE from today. we keep our spool directory very clean! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Declude console
I just tried to install it per the instructions below and i can't seem to get any info out of it... just a header and a bunch of 0's... Any ideas? Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 19, 2002 11:31 AM Subject: Re: [Declude.JunkMail] Declude console : : I've seen some posts about the Declude Console lately. What is that? Can : anyone get it? How? : : It is a console that lets you see some basic information about the recent : E-mails that IMail has received, as well as the log files. You can : download it from http://www.declude.com/release/140/deccon.exe and place it : in your \IMail directory, and edit your Declude config file so that there : is a line that says CONSOLE ON. It is very basic, so it isn't pretty, : but it can offer some useful information. : -Scott : : --- : [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] : : --- : : This E-mail came from the Declude.JunkMail mailing list. To : unsubscribe, just send an E-mail to [EMAIL PROTECTED], and : type unsubscribe Declude.JunkMail. You can E-mail : [EMAIL PROTECTED] for assistance. You can visit our web : site at http://www.declude.com . : --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Declude console
Yup, that was it... Thanks! Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, February 19, 2002 1:51 PM Subject: Re: [Declude.JunkMail] Declude console : : Yep, all three of those things are done... : : Actually, it turns out that you need to have the CONSOLE ON in all your : config files (if you have CONSOLE OFF in any of them, it may override the : CONSOLE ON setting in another). : -Scott : : --- : [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] : : --- : : This E-mail came from the Declude.JunkMail mailing list. To : unsubscribe, just send an E-mail to [EMAIL PROTECTED], and : type unsubscribe Declude.JunkMail. You can E-mail : [EMAIL PROTECTED] for assistance. You can visit our web : site at http://www.declude.com . : --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] User's Managing SPAM
we tried that, using imfilter to put any emails that have been warned into a SpamBox folder in each account. the problem is that customers would either have to use IMAP or the webmail to get to them... and since most use pop3 and only use webmail when they travel, these SpamBox folders could get very large... we then tried to prepend the subject line with [SPAM?] for ones that failed, and then instruct the user how to setup OE or other mail client to sort these to a different box... then we started seeing some false positives marked as [SPAM?] and that pissed off one or two customers... so far, the Spam Review program is the best thing we've found, but there is still one problem with that... who is going to sit and sort throught thousands of emails a day? not me... i don't have time! If Tom adds one feature to this program that will sort the email by either the first few lines of the body or by the subject, and allows multiple selection for the delete, it would greatly improve the chance that I would have time to do the sorting... So, we're just holding off on doing any system wide filtering until a better solution presents itself. Jim - Original Message - From: Chris Bone [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, February 06, 2002 9:24 AM Subject: [Declude.JunkMail] User's Managing SPAM Is it possible to allow SPAM caught by Declude to go into a folder say SPAM This will shift the responsibility of going through all those emails onto the users Is this possible? I have JunkMail Pro which I think does user by user settings Has anyone written any admin screens for the user to manage their settings? (Like Hotmail) thanks! swamped by email Chris Bone Web Engineer Chartway Federal Credit Union http://www.chartway.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Software
can i use a unc to get to the spooled files or does it have to be mapped? thanks!! Jim - Original Message - From: Tom Schwarz [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 26, 2002 12:48 PM Subject: [Declude.JunkMail] Spam Review Software Exactly 15 hours after I sat down at a computer to write a program to review spam email I have a first release. I tell you this so you won't yell at me if you find a bug. Feel free however to report bugs and suggest enhancements. You can locate this software at http://www.slsoft.com/spamreview.htm. Please read the page carefully before downloading. Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Software
I must be missing something, because I have tried it both ways and it just doesn't seem to list any emails... there are over 100 in the spool\spam dir... Thanks, Jim - Original Message - From: Tom Schwarz [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 26, 2002 1:28 PM Subject: RE: [Declude.JunkMail] Spam Review Software Either will work. \\myserver\imail\spool or c:\imail\spool -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Jones, Jr. Sent: Saturday, January 26, 2002 1:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spam Review Software can i use a unc to get to the spooled files or does it have to be mapped? thanks!! Jim - Original Message - From: Tom Schwarz [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 26, 2002 12:48 PM Subject: [Declude.JunkMail] Spam Review Software Exactly 15 hours after I sat down at a computer to write a program to review spam email I have a first release. I tell you this so you won't yell at me if you find a bug. Feel free however to report bugs and suggest enhancements. You can locate this software at http://www.slsoft.com/spamreview.htm. Please read the page carefully before downloading. Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Software
sorry... two major cases of me not reading the manual!!! i figured it out! i was pointing to the spam dir, not the spool! thanks for your great work! jim - Original Message - From: Jim Jones, Jr. [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 26, 2002 1:36 PM Subject: Re: [Declude.JunkMail] Spam Review Software I must be missing something, because I have tried it both ways and it just doesn't seem to list any emails... there are over 100 in the spool\spam dir... Thanks, Jim - Original Message - From: Tom Schwarz [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 26, 2002 1:28 PM Subject: RE: [Declude.JunkMail] Spam Review Software Either will work. \\myserver\imail\spool or c:\imail\spool -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Jones, Jr. Sent: Saturday, January 26, 2002 1:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spam Review Software can i use a unc to get to the spooled files or does it have to be mapped? thanks!! Jim - Original Message - From: Tom Schwarz [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 26, 2002 12:48 PM Subject: [Declude.JunkMail] Spam Review Software Exactly 15 hours after I sat down at a computer to write a program to review spam email I have a first release. I tell you this so you won't yell at me if you find a bug. Feel free however to report bugs and suggest enhancements. You can locate this software at http://www.slsoft.com/spamreview.htm. Please read the page carefully before downloading. Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] adult content test?
ok, i added this to the $default$.junkmail file: ADULT WARN and this to the global.cfg file: ADULT adult x x 5 0 is that all i need to do? also, what's the x-rbl-warning say for emails caught by this? thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, January 20, 2002 6:44 PM Subject: RE: [Declude.JunkMail] adult content test? : : Where would we put ADULT, in both global.cfg file and the $default$.junkmail : file or just the latter? : : You would need to define it in the global.cfg file (ADULT adult), and : list the action in the $default$.JunkMail file (ADULT WARN). : : One other item. I am slowly trying a few of the junkmail tests set to hold. : What is the best method for sorting through those held messages? Is it just : best to use explorer and view each one of them? : : Yes, that seems like the easiest way. : : If they are good, where do I put them to go ahead and be processed without : being held again? : : You need to move the pair of files (D and Q) back to the \IMail\spool : directory, and IMail will send them out on the next queue run (Declude : won't scan them again). : -Scott : : --- : [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] : : --- : : This E-mail came from the Declude.JunkMail mailing list. To : unsubscribe, just send an E-mail to [EMAIL PROTECTED], and : type unsubscribe Declude.JunkMail. You can E-mail : [EMAIL PROTECTED] for assistance. You can visit our web : site at http://www.declude.com . : --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] adult comment in x-rbl-warning?
it seems that all the mail that gets caught by the adult test puts this in the header when the test is set to warn X-RBL-Warning: notice the lack of a reason for failure... this is what i have configured: $default$.junkmail: ADULT WARN global.cfg: ADULT adult x x 5 0 Any ideas? Thanks, Jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] adult comment in x-rbl-warning?
Do I just put in the $default$.junkmail file, ADULT WARN X-RBL-Warning: Failed Adult Test Thanks, Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, January 24, 2002 6:20 PM Subject: Re: [Declude.JunkMail] adult comment in x-rbl-warning? it seems that all the mail that gets caught by the adult test puts this in the header when the test is set to warn That test is neither documented nor officially supported. I would recommend specifying the warning text along with the action, rather than just using WARN. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] adult content test?
Is there a test that filters for adult content? I have a few customers that requested it. Regards, Jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] What test gives this message?
We see any email sent from Eudora getting tagged like this... Is this normal? Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 21, 2001 8:47 AM Subject: Re: [Declude.JunkMail] What test gives this message? Which test generates this message? X-RBL-Warning: This E-mail was sent from a broken mail client [80008002]. That header comes from the BADHEADERS test (which checks for headers that are not formatted properly, which is very common in spam, and should never happen with legitimate mail). The 80008002 code indicates that there was a Message-ID: header in the E-mail, but that it was malformed (probably just blank). -Scott --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] [IMail Forum] undeliverable mail?
What does this message mean? This is from the same domain which has been renewed but they are still getting undeliverables. 20011009 112717 127.0.0.1 SMTP (576) 221 jumpgate.speedlinetech.com SMTP Service closing transmission channel I don't think that they have been blacklisted or anything... so otherpeople's junkmail filters shouldnt be stopping it. Thanks, Jim - Original Message - From: Hermann Strassner [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 09, 2001 6:41 AM Subject: RE: [IMail Forum] undeliverable mail? the domain is kgmoats.com... could you look it up and see what you get ? I found nothing about this domain. Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[no subject]
de.com Subject: [Declude.JunkMail] X-RBL-Warning: domain: whatever.com Date: Thu, 27 Sep 2001 07:27:26 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600. X-Note: This E-mail was scanned for spam viruses by the servers at WTC Communications, Inc. X-Declude-Sender: [EMAIL PROTECTED] [216.147.229.200] X-Declude-Spoolname: D1b3f25a.SMD X-Note: This E-mail was scanned for viruses by Declude (www.declude.com) X-NRecips: 1 X-Reverse-IP: oct.net. Precedence: bulk Sender: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [216.147.229.200] X-Declude-Spoolname: D924526e.LST X-Note: This E-mail was scanned for viruses by Declude (www.declude.com) Organization: Computerized Horizons X-RBL-Warning: domain: whatever.com What test is an email failing when the above is the warning? Thanks, Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[no subject]
[EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] X-RBL-Warning: domain: whatever.com Date: Thu, 27 Sep 2001 08:31:47 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600. X-Note: This E-mail was scanned for spam viruses by the servers at WTC Communications, Inc. X-Declude-Sender: [EMAIL PROTECTED] [216.147.229.200] X-Declude-Spoolname: D2a532a4.SMD X-Note: This E-mail was scanned for viruses by Declude (www.declude.com) X-NRecips: 2 X-Reverse-IP: oct.net. Precedence: bulk Sender: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [216.147.229.200] X-Declude-Spoolname: D2b692a4.LST X-Note: This E-mail was scanned for viruses by Declude (www.declude.com) Organization: Computerized Horizons Scott, It is the MAILFROM that is failing.. but it seems like every email is failing that. Jim - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, September 27, 2001 8:20 AM Subject: Re: [Declude.JunkMail] X-RBL-Warning: domain: whatever.com X-RBL-Warning: domain: whatever.com What test is an email failing when the above is the warning? That's most likely the MAILFROM test that is failing. That test will fail if an E-mail arrives with a return address that is from a domain that does not accept E-mail. There's a slight chance, however, that that could be from another test, if one of the DNS-based tests has a TXT record of domain: whatever.com. You would need to check the logs to be certain. -Scott --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Declude crashing and taking up 99% CPU
should we use this even if we don't have the 99% cpu problem? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 25, 2001 6:44 PM Subject: Re: [Declude.JunkMail] Declude crashing and taking up 99% CPU We now have a new interim declude.exe online, at http://www.declude.com/release/126/declude.exe . This one is based on 1.25a, except that the DNS engine has been modified to make sure that infinite loops are not possible. Right now, the most likely reason for the 99% CPU usage seems to be during DNS queries, since the DNS engine changed quite a bit between 1.20 and 1.25a. If the 99% CPU usage is indeed caused by a problem with the DNS engine, this will take care of it. -Scott --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] more spam lately?
I have seen more spam get through in the last few weeks then ever before. I am still catching a bunch, but it seems that I am not blocking something that I should. Could someone recommend what may be added/changed to this part of my config (see below) to do a better job of catching spam? Thanks, Jim RBL WARN DUL WARN RSS LOG #ORBSINPUTS LOG #ORBSOUTPUTS LOG #ORBSGRACE LOG #ORBSMAN LOG #ORBSSRC LOG #ORBSNET LOG #ORBSSRCNET LOG #ORBSTESTING LOG OSRELAY LOG OSDUL WARN OSSRC WARN OSSMART LOG OSSOFT WARN #IGNORANT LOG MAILFROM WARN BADHEADERS WARN SPAMHEADERS WARN SPAMROUTING WARN REVDNS LOG --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
