RE: [Declude.JunkMail] Bounce not an action??

[Jim Rooth]

Title: Message



After reading 
archives for the past two hours, I still do not understand why this is 
happening. I completely removed BOUNCE from $default$.junkmail and 
global.cfg. I changed it to delete.

As is evidenced 
by the lines below, WEIGHT40 is set to LOG and WEIGHT50=IGNORE. But in my 
cfg files I have them both set to DELETE. Redundant, I realize but I am 
going bald right now trying to figure this out.

I believe this 
file should have been deleted with a weight of 60. Am I wrong in this 
belief and if so, how do I make it so?

03/05/2004 07:26:33 Q800304f9037efdbb SBL:20 SPAMHEADERS:20 FLOWGO:20 
. Total weight = 60.03/05/2004 07:26:33 Q800304f9037efdbb Warning: 
misconfiguration in following line in configuration file (bounce is not an 
ACTION). May be a duplicate test definition?03/05/2004 07:26:33 
Q800304f9037efdbb L1 Message OK03/05/2004 07:26:33 Q800304f9037efdbb 
Subject: *^*^*^ Good Morning !!*^*^*^*3/5/0403/05/2004 07:26:33 
Q800304f9037efdbb From: [EMAIL PROTECTED] 
To: [EMAIL PROTECTED] 
IP: 12.129.205.75 ID: h9208m03u7o603/05/2004 07:26:33 Q800304f9037efdbb 
Tests failed [weight=60]: SBL=IGNORE SPAMHEADERS=WARN WEIGHT40=LOG 
WEIGHT50=IGNORE CATCHALLMAILS=IGNORE FLOWGO=WARN

$default$.junkmail
DSBLWARNORDBWARNOSDULWARNOSFORMWARNOSLISTWARNOSRELAYWARNOSSMARTWARNOSSOFT 
WARNOSSRC 
WARNSPAMCOPWARNSPAMSUBJ 
WARNDSNWARNNOABUSEWARNNOPOSTMASTERWARNMYFILTERWARNBADHEADERSWARNHELOBOGUSWARNMAILFROM 
WARNPERCENTWARNREVDNSWARNROUTINGWARNSPAMHEADERSWARN#SNIFFERWARN

WEIGHT20WARNWEIGHT30WARNWEIGHT40DELETEWEIGHT50DELETEMAILTOWARNKFROMWARNCOUNTRYWARNCOMMENTS20WARNCOMMENTS40WARNCOMMENTS60WARNCOMMENTS80WARNCOMMENTS100WARNCOMMENTS120WARN

global.cfg
DSBLWARNORDBWARN#OSDULWARNOSFORMWARNOSLISTWARNOSRELAYWARNOSSMARTWARNOSSOFT 
WARNOSSRC 
WARNSPAMCOPWARNDSNWARNNOABUSEWARNNOPOSTMASTERWARNBADHEADERSWARNHELOBOGUSWARNKFROMWARNMAILFROM 
WARNMAILTOWARNPERCENTWARNREVDNSWARNROUTINGWARNSPAMHEADERSWARNSPAMSUBJWARN#SNIFFERWARNWEIGHT10WARNWEIGHT20WARNWEIGHT40DELETEWEIGHT50DELETE



Jim 
Rooth
Clotron, 
Inc 
[EMAIL PROTECTED]
214.244.0979
If 
you can read thisthank a teacher
If you 
are reading this in English, thank a veteran!


  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of MattSent: Thursday, March 04, 2004 7:53 
  PMTo: [EMAIL PROTECTED]Subject: Re: 
  [Declude.JunkMail] Bounce not an action??Jim,It's 
  the fact that administrators bounce spam or unaddressable E-mail accepted by 
  gateways for large sites like AOL and Yahoo that have completely ruined the 
  use of the nobody alias for my domains because this forged stuff is constantly 
  hitting my server, bounced from someone like you or someone like Yahoo and 
  AOL. I've had a single person get over 200 bounce messages a day for 
  things they didn't receive. As a result of this, I now have to score 
  system notifications from other servers high in order to hopefully catch them 
  on a single bit of content returned that I also sometimes false positive on 
  legitimate bounces. If people stopped bouncing trash, none of this would 
  be necessary.As far as your customer goes, allowing them to tell you 
  to bounce spam is the equivalent of telling you to spam for them IMO. I 
  will not bounce for my customers, I will capture in an account and they can go 
  through that account looking for false positives if they wish, but being to 
  lazy to want to bother is no excuse to bounce.It doesn't matter if you 
  only get 100 spams a day, you just shouldn't bounce. The same thing goes 
  for virus notifications IMO. Don't send me notices for any virus to my 
  postmaster address, and please don't send notices to my customers...reason 
  being, 99.9% of them are from forged addresses these days, and this causes 100 
  times more harm than good.MattJim Rooth wrote:
  Heck, I thought they had 10 gears but the 10th and 9th were reversed to
give you a great overdrive.  Shows what I know.  I will check the
archives again and see if I can find something that tells me different
than don't use BOUNCE!  That would be the simplest solution...

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
"If you can read this.thank a teacher
If you are reading this in English, thank a veteran!"



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
(Lists)
Sent: Thursday, March 04, 2004 6:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Bounce not an action??


Jim Jim Jim. What can I say. Sometimes, it is hard to use that new
fangled transmission that only has 9 gears instead of 13.

Check the current JunkMail manual and archives, and you will be
surprised.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


  
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
[EMAIL PROTECTED]] On Behalf Of Jim Rooth
Sent: Thursday, March 04, 2004 4:12 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Bounce not

RE: [Declude.JunkMail] Bounce not an action??

[Jim Rooth]

I AGREE with you 100%  Where besides the global.cfg and the
$default$.junkmail could I have BOUNCE set up?  I can't find it
anywhere.

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read this.thank a teacher
If you are reading this in English, thank a veteran!



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, March 05, 2004 7:43 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Bounce not an action??



After reading archives for the past two hours, I still do not 
understand
why this is happening.  I completely removed BOUNCE from 
$default$.junkmail and global.cfg.  I changed it to delete.

Great!

As is evidenced by the lines below, WEIGHT40 is set to LOG and
WEIGHT50=IGNORE.  But in my cfg files I have them both set to 
DELETE.  Redundant, I realize but I am going bald right now trying to 
figure this out.

I believe this file should have been deleted with a weight of 60.  Am I
wrong in this belief and if so, how do I make it so?

03/05/2004 07:26:33 Q800304f9037efdbb SBL:20 SPAMHEADERS:20 FLOWGO:20
.  Total weight = 60.
03/05/2004 07:26:33 Q800304f9037efdbb Warning: misconfiguration in 
following line in configuration file (bounce is not an ACTION). May be
a 
duplicate test definition?

This warning: indicates that you are still using the BOUNCE action
somewhere.

If you are insistent upon letting them do this, here's what I wrote
yesterday:

---
What I would recommend is having them sign a contract that they will be 
liable for any issues resulting from the bounces.

Specifically, about 99.9% of the E-mail that is bouncing (E-mail that
fails 
the WEIGHT40 test) is spam.  Since about 99% of spam sent with a fake 
return address, that's 100,000s of spams a year your customer is sending

out.  If I were you, I would only do it if they assume liability for it.

In any case, if you feel that it is appropriate to do so, you can rename

the BOUNCE action to BOUNCEONLYIFYOUMUST, and it will start working
again.
---

Remember that even if they pay their bills like clockwork, there are
some 
spammers out there that pay their bills like clockwork too.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---


---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Bounce not an action??

[Jim Rooth]

Thanks Scott, found it hidden in a per user file!

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read this.thank a teacher
If you are reading this in English, thank a veteran!



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, March 05, 2004 8:05 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Bounce not an action??



I AGREE with you 100%  Where besides the global.cfg and the 
$default$.junkmail could I have BOUNCE set up?  I can't find it 
anywhere.

You can use LOGLEVEL HIGH to see which config files Declude JunkMail is
using.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---


---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Bounce not an action??

[Jim Rooth]

One last thing...I have figured a way to keep the customer happy and
still be bouncing everything.  I have this particular client set up per
domain.  They are the only one out of 75 that are set that way.  I have
gone into their domain $default$.junkmail file and added WEIGHT40
ROUTETO [EMAIL PROTECTED] domain .com.

I am of the opinion that this will send all mail with a weight of 40 or
higher (to WEIGHT 60 which is set to delete) that is sent to their
domain but will not send any other mail from other domains.  Is that
correct?

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read this.thank a teacher
If you are reading this in English, thank a veteran!



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, March 05, 2004 8:05 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Bounce not an action??



I AGREE with you 100%  Where besides the global.cfg and the 
$default$.junkmail could I have BOUNCE set up?  I can't find it 
anywhere.

You can use LOGLEVEL HIGH to see which config files Declude JunkMail is
using.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---


---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Bounce not an action??

[Jim Rooth]

Title: Bounce not an action??






Scott, I have been noticing this for a couple of days. I didn't say anything because of the tremendous load you have had for the last three days. Good job in getting under control!

I am running v1.78i9. But even before that (running with v1.65) I was getting the error below:


03/04/2004 00:01:04 Qc6110a10001ca68e Tests failed [weight=260]: DSN=WARN NOABUSE=WARN NOPOSTMASTER=WARN BADHEADERS=WARN MYFILTER=WARN BASE64=IGNORE COUNTRY=WARN ipfile=IGNORE WEIGHT40=LOG WEIGHT60=DELETE CATCHALLMAILS=IGNORE BADWHOIS=WARN 

03/04/2004 00:01:06 Warning: misconfiguration in following line in configuration file (BOUNCE is not an ACTION). May be a duplicate test definition?

03/04/2004 00:01:06 WEIGHT40 BOUNCE 

03/04/2004 00:01:07 Warning: misconfiguration in following line in configuration file (BOUNCE is not an ACTION). May be a duplicate test definition?

I have WEIGHT40 set to bounce in the global.cfg. It has been working without fail until the last four or five days. I could find no location that had WEIGHT40=LOG.

Any ideas?


Jim Rooth

Clotron, Inc 

[EMAIL PROTECTED]

214.244.0979

If you can read thisthank a teacher

If you are reading this in English, thank a veteran!

RE: [Declude.JunkMail] Bounce not an action??

[Jim Rooth]

Not because I want to, that's for sure.  But I have my largest customer
who wants all mail to be sent back so the sender can see their email
didn't go through.  They average 900 emails a day just from bounces!
The overhead caused by it is extremely detrimental but they pay the bill
like clockwork.

I just went through and I lied to you.  It started yesterday at 1311
which is when I loaded the v178.i9 on the server.

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read this.thank a teacher
If you are reading this in English, thank a veteran!



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, March 04, 2004 5:58 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Bounce not an action??



I have WEIGHT40 set to bounce in the global.cfg.

I know you're looking for an answer, but before I give it to you, can I
ask 
why you are using WEIGHT40 BOUNCE?

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---


---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Bounce not an action??

[Jim Rooth]

Heck, I thought they had 10 gears but the 10th and 9th were reversed to
give you a great overdrive.  Shows what I know.  I will check the
archives again and see if I can find something that tells me different
than don't use BOUNCE!  That would be the simplest solution...

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read this.thank a teacher
If you are reading this in English, thank a veteran!



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Thursday, March 04, 2004 6:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Bounce not an action??


Jim Jim Jim. What can I say. Sometimes, it is hard to use that new
fangled transmission that only has 9 gears instead of 13.

Check the current JunkMail manual and archives, and you will be
surprised.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
 [EMAIL PROTECTED] On Behalf Of Jim Rooth
 Sent: Thursday, March 04, 2004 4:12 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Bounce not an action??
 
 Not because I want to, that's for sure.  But I have my largest 
 customer who wants all mail to be sent back so the sender can see 
 their email didn't go through.  They average 900 emails a day just 
 from bounces! The overhead caused by it is extremely detrimental but 
 they pay the bill like clockwork.
 
 I just went through and I lied to you.  It started yesterday at 1311 
 which is when I loaded the v178.i9 on the server.
 
 Jim Rooth
 Clotron, Inc
 [EMAIL PROTECTED]
 214.244.0979
 If you can read this.thank a teacher
 If you are reading this in English, thank a veteran!
 
 
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott 
 Perry
 Sent: Thursday, March 04, 2004 5:58 PM
 To: [EMAIL PROTECTED]
 Subject: Re: [Declude.JunkMail] Bounce not an action??
 
 
 
 I have WEIGHT40 set to bounce in the global.cfg.
 
 I know you're looking for an answer, but before I give it to you, can 
 I ask why you are using WEIGHT40 BOUNCE?
 
 -Scott
 ---
 Declude JunkMail: The advanced anti-spam solution for IMail 
 mailservers since 2000. Declude Virus: Catches known viruses and is 
 the leader in mailserver vulnerability detection.
 Find out what you've been missing: Ask for a free 30-day evaluation.
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To 
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
 unsubscribe Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.
 ---
 
 
 ---
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To 
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
 unsubscribe Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---


---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Capital One

[Jim Rooth]

Hen how about fixing us up with any good active account?

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read thisthank a teacher
If you are reading this in English, thank a veteran!


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 21, 2003 2:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Capital One

Sorry, not my account. 

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
 [EMAIL PROTECTED] On Behalf Of Todd Holt
 Sent: Friday, November 21, 2003 12:31 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Capital One
 
 ROFLOL! :)
 
 Todd Holt
 Xidix Technologies, Inc
 Las Vegas, NV  USA
 www.xidix.com
 702.319.4349
 
 
 
  -Original Message-
  From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
  [EMAIL PROTECTED] On Behalf Of nick
  Sent: Friday, November 21, 2003 11:48 AM
  To: [EMAIL PROTECTED]
  Subject: Re: [Declude.JunkMail] Capital One
 
 
  John,
 
  If you would send your username  password we all can really confirm
  if its real :))
 
 
-Nick
  -- Original Message --
  From: Matthew Bramble [EMAIL PROTECTED]
  Reply-To: [EMAIL PROTECTED]
  Date:  Fri, 21 Nov 2003 14:11:31 -0500
 
  John,
  
  I think that one is actually real :)  the bfi01[dot]com link is
 actually
  a redirection for BigFoot Interactive which handles the mailings for
  CapitalOne.  It goes to the real site.
  
  Matt
  
  
  
  John Tolmachoff (Lists) wrote:
  
  Here is a nice deceptive one purporting to be from Capital One,
 even
  going
  so far as to tell you the from address will change periodically and
 the
  site
  may be down from time to time:
  
  --ABCD-TATH06CBF112C4836245D2E4AC5E7-EFGH
  Content-Type: text/plain; charset=us-ascii
  Content-Transfer-Encoding: quoted-printable
  
  Capital One(R)--what's in your wallet?(SM)
  
  *
  Log in to see your Capital One statement
  *  =
  
=
  
  RE: Your account ending in 4727
  
  Your current Capital One statement is now available for viewing =
  
  online. Simply log in to Online Account Services at =
  
  http://capitalone.bfi0.com/TART0524EF6B34836245D2E4AC5E7
  and click the My Statement tab.
  
  While you're in Online Account Services, click on the Customer  =
  
  Service Tab to . . .
   =
  
  - Update your e-mail address  =
  
  - Change your payment due date  =
  
  - Change your password  =
  
  - Request your PIN  =
  
  - View your account terms  =
  
  - View your online account history  =
  
  
  Is all your information reaching you?
  **
  To help ensure this time-sensitive message reaches your inbox =
  
  each month, add the Capital One address that appears in the =
  
  From line above to your electronic address book. This is =
  
  especially important if you or your service provider uses e-mail =
  
  filters.
  
  Pay your bill for free
  ***
  You can make payments safely and securely through Online Account =
  
  Services. Just click the Pay My Bill tab and complete the payment =
  
  profile. Online payments post the same day when they're made =
  
  before 3:00 p.m. ET Monday through Saturday.*
  
  Use our Web site as a resource to access a variety of consumer =
  
  lending products and special services. Please visit
  http://capitalone.bfi0.com/TART0524EF8B24836245D2E4AC5E7
  
  Thanks for using Capital One's Online Account Services.
  
  To log in, visit
  http://capitalone.bfi0.com/TART0524EF4BD4836245D2E4AC5E7
  
  
  -
  Important Information from Capital One
  
  The site may be unavailable during normal weekly maintenance or =
  
  due to unforeseen circumstances. =
  
  
  *Your online payment posts the same day when it's made before =
  
  3:00 p.m. ET Monday through Saturday. Payments made after =
  
  3:00 p.m. ET Monday through Friday will post the following day. =
  
  Payments made after 3:00 p.m. ET on Saturday and anytime on =
  
  Sunday will post to your account on Monday. Payments will not be =
  
  posted on Thanksgiving, Christmas and New Years day. =
  
  
  Capital One and its service providers are committed to providing =
  
  meaningful privacy protection for their customers. To protect =
  
  your privacy, please do not send sensitive account information =
  
  through e-mail. For information on our privacy policy or how to =
  
  contact us, please visit our web site at =
  
  http://capitalone.bfi0.com/TART0524EF6BC4836245D2E4AC5E7
  
  Copyright 2003 Capital One Services, Inc. Capital One is a =
  
  federally registered service mark. All rights reserved.
  
  
  
  --ABCD-TATH06CBF112C4836245D2E4AC5E7-EFGH
  Content-Type: text/html; charset=us

RE: [Declude.JunkMail] Capital One

[Jim Rooth]

Them were the good old days...thinking about retiring and driving a diesel
again...in a motor home!

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979
If you can read thisthank a teacher
If you are reading this in English, thank a veteran!


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 21, 2003 7:09 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Capital One

Well hello Jim. I thought the Diesel got to you. Haven't heard from you in
awhile.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


 -Original Message-
 From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
 [EMAIL PROTECTED] On Behalf Of Jim Rooth
 Sent: Friday, November 21, 2003 4:24 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Capital One
 
 Hen how about fixing us up with any good active account?
 
 Jim Rooth
 Clotron, Inc
 [EMAIL PROTECTED]
 214.244.0979
 If you can read this.thank a teacher
 If you are reading this in English, thank a veteran!
 
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
 (Lists)
 Sent: Friday, November 21, 2003 2:55 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Capital One
 
 Sorry, not my account.
 
 John Tolmachoff
 Engineer/Consultant/Owner
 eServices For You
 
 
  -Original Message-
  From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
  [EMAIL PROTECTED] On Behalf Of Todd Holt
  Sent: Friday, November 21, 2003 12:31 PM
  To: [EMAIL PROTECTED]
  Subject: RE: [Declude.JunkMail] Capital One
 
  ROFLOL! :)
 
  Todd Holt
  Xidix Technologies, Inc
  Las Vegas, NV  USA
  www.xidix.com
  702.319.4349
 
 
 
   -Original Message-
   From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
   [EMAIL PROTECTED] On Behalf Of nick
   Sent: Friday, November 21, 2003 11:48 AM
   To: [EMAIL PROTECTED]
   Subject: Re: [Declude.JunkMail] Capital One
  
  
   John,
  
   If you would send your username  password we all can really confirm
   if its real :))
  
  
 -Nick
   -- Original Message --
   From: Matthew Bramble [EMAIL PROTECTED]
   Reply-To: [EMAIL PROTECTED]
   Date:  Fri, 21 Nov 2003 14:11:31 -0500
  
   John,
   
   I think that one is actually real :)  the bfi01[dot]com link is
  actually
   a redirection for BigFoot Interactive which handles the mailings for
   CapitalOne.  It goes to the real site.
   
   Matt
   
   
   
   John Tolmachoff (Lists) wrote:
   
   Here is a nice deceptive one purporting to be from Capital One,
  even
   going
   so far as to tell you the from address will change periodically and
  the
   site
   may be down from time to time:
   
   --ABCD-TATH06CBF112C4836245D2E4AC5E7-EFGH
   Content-Type: text/plain; charset=us-ascii
   Content-Transfer-Encoding: quoted-printable
   
   Capital One(R)--what's in your wallet?(SM)
   
   *
   Log in to see your Capital One statement
   *  =
   
 =
   
   RE: Your account ending in 4727
   
   Your current Capital One statement is now available for viewing =
   
   online. Simply log in to Online Account Services at =
   
   http://capitalone.bfi0.com/TART0524EF6B34836245D2E4AC5E7
   and click the My Statement tab.
   
   While you're in Online Account Services, click on the Customer  =
   
   Service Tab to . . .
=
   
   - Update your e-mail address  =
   
   - Change your payment due date  =
   
   - Change your password  =
   
   - Request your PIN  =
   
   - View your account terms  =
   
   - View your online account history  =
   
   
   Is all your information reaching you?
   **
   To help ensure this time-sensitive message reaches your inbox =
   
   each month, add the Capital One address that appears in the =
   
   From line above to your electronic address book. This is =
   
   especially important if you or your service provider uses e-mail =
   
   filters.
   
   Pay your bill for free
   ***
   You can make payments safely and securely through Online Account =
   
   Services. Just click the Pay My Bill tab and complete the payment =
   
   profile. Online payments post the same day when they're made =
   
   before 3:00 p.m. ET Monday through Saturday.*
   
   Use our Web site as a resource to access a variety of consumer =
   
   lending products and special services. Please visit
   http://capitalone.bfi0.com/TART0524EF8B24836245D2E4AC5E7
   
   Thanks for using Capital One's Online Account Services.
   
   To log in, visit
   http://capitalone.bfi0.com/TART0524EF4BD4836245D2E4AC5E7
   
   
   -
   Important Information from Capital One
   
   The site may be unavailable during normal weekly maintenance or =
   
   due to unforeseen circumstances. =
   
   
   *Your

RE: [Declude.JunkMail] Is the list down?

[Jim Rooth]

Let me guess...the mode of transportation will be a short wheel base,
Diamond T w/Browning 4X4 tranny and no trailer!

There is something down though that is affecting a lot opf people.  Network
Solutions have 4 DNS servers that are down.  Anyone with the misfortune of
having their A or MX records based on those servers are out of luck.  I have
six domains that are not accessible as of right now.

Jim Rooth
Clotron, Inc 
[EMAIL PROTECTED]
214.244.0979


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Thursday, July 31, 2003 11:28 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Is the list down?

 I don't want to go home, I want a vacation!

Dear Mr. Sheldon Koehler;

It is with great pleasure that I can announce that you are hereby granted an
official vacation.

You MUST take this vacation immediately, or forfeit the right to use it
forever.

To claim your official vacation, you must call this number within the next
30 seconds, or this vacation will be gone forever.

Should you fail to call in time, or to take your vacation once confirmed,
you will then be disallowed any further opportunities to take a vacation in
the foreseeable future.

Good luck and enjoy.

John Tolmachoff MCSE CSSA

(Moonlighting Travel Agent Extraordinaire) ;-)

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.504 / Virus Database: 302 - Release Date: 7/24/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.504 / Virus Database: 302 - Release Date: 7/24/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Different bounce messages?

[Jim Rooth]

Based on failing a weight of 40, I have a WEIGHT40 that bounces.  I also
have a weight of 60 that will delete.  What happens to the mail that falls
in between 41 and 59?

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Saturday, March 15, 2003 1:03 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Different bounce messages?


Can we have different bounce messages?  Lets say if we can define a 
certain test and for that test a certain message be sent out!?

Yes.  Declude JunkMail uses the name of the test in the name of the .eml 
file it uses for the bounce message, so if you have TEST1 and TEST2, 
you would use the files \IMail\Declude\TEST1bounce.eml and 
\IMail\Declude\TEST2bounce.eml.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.462 / Virus Database: 261 - Release Date: 3/13/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.463 / Virus Database: 262 - Release Date: 3/17/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Sending out a bounced message

[Jim Rooth]

Does Declude JunkMail have an email file similar to
the virus file recip.eml? I have a client that wants to be notified when
they have an email they don’t receive. We are having an unusual
amount of lost emails and they are (and I am) trying to finds out why.
Almost all attachments with .pdf are being lost. I believe it is a bad
mail client issue but need to verify this. The broken mail client is
caught by Declude Virus but I am unable to capture all of them as I can not sit
in front of the tube constantly. So some sort of notification will
help. 



Also can I direct this to one domain only? Mt biggest
client wants it but I do not want all our clients to be inconvenienced by it.



I see where attbi.com is without an abuse account…sorry
about that! SPEWS listed my ISP …3 Class C blocks because of an
email from one account. Makes sense to me.



Jim Rooth 
Klotron, Inc. 
214.244.0979 
[EMAIL PROTECTED] 










---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

RE: [Declude.JunkMail] Sending out a bounced message

[Jim Rooth]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, February 19, 2003 12:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Sending out a bounced message





Does Declude JunkMail have an email file similar to the virus
file 

recip.eml? I have a client that wants to be notified when
they have an 

email they don't receive.



In that case, you could use the ATTACH action, and modify the 

\IMail\Declude\spamattach.eml file to not include the original spam.



I would use the ATTACH
action instead of DELETE or HOLD? Won't that send all spam forward or at
least notification of receiving spam?



We are having an unusual amount of lost emails and they are (and I
am) 

trying to finds out why. Almost all attachments with .pdf are
being lost.



Have you checked your IMail rules? That's a common reason for
.pdfs 

getting lost.



I looked at the rules section…all
are blank as nothing had ever been set up in them. I am checking with
IMAIL as that seems to be their area.



You might also want to check the IMail log file -- it should have
SMTPD 

lines for the E-mail arriving (before Declude scans it), and
SMTP- or 

SMTP lines afterwards for the actual delivery of the E-mail.



After checking the logs I
do see the SMTPD and SMTP entries as stated. So that portion is working…now
to find out why I am losing attachments. It seems like any attachment is
subject but pdf’s never make it through. Except to me and my Boss…we
are both using the latest and greatest Outlook and have not had any problems.
That is why I am prone to think there is an issue with older Email platforms.


-Scott



---

[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]



---

This E-mail came from the Declude.JunkMail mailing list. To

unsubscribe, just send an E-mail to [EMAIL PROTECTED], and

type unsubscribe Declude.JunkMail. The archives can
be found

at http://www.mail-archive.com.

---





---

Incoming mail is certified Virus Free.

Checked by AVG anti-virus system (http://www.grisoft.com).

Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003










---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

RE: [Declude.JunkMail] Sending out a bounced message

[Jim Rooth]

That was the first place I went to, the security settings.  I had Imail send
one to the client that was complaining and of course,  it went through
without a hiccup...thanks anyway.

Thanks Scott for your help.  Yes that is what I wanted but I had in mind
trying to just send it to the one domain. But as much flak as I have been
getting lately about spam, I think I will let everyone see they are getting
spam blocked!

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Helpdesk
Sent: Wednesday, February 19, 2003 2:03 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Sending out a bounced message

on 2/19/03 2:54 PM, R. Scott Perry wrote:

 After checking the logs I do see the SMTPD and SMTP entries as stated.
So
 that portion is working…now to find out why I am losing attachments.
 
 Is it the whole E-mail being lost, or just the attachment?  Neither
Declude
 nor IMail will remove attachments, so if the attachment is missing, it's
 almost certainly a mail client issue.

If it is just the attachments, and the client is running Outlook Express 6,
the problem is their security settings.

Microsoft's instructions for changing the security settings in Outlook
Express and Internet Explorer can be found at
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q291387 .

Later,
Greg

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Sending out a bounced message

[Jim Rooth]

You have no idea

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Wednesday, February 19, 2003 2:34 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Sending out a bounced message

 trying to just send it to the one domain. But as much flak as I have been
 getting lately about spam, I think I will let everyone see they are
getting
 spam blocked!

I don't know Jim. 

The smell of diesel is calling stronger and stronger.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Sending out a bounced message

[Jim Rooth]

Larry, this is why we really do not want to send out messages about
receiving spam.  This is from the man who programs the Declude program.  

While I understand you do not want spam bounced, the email that gets caught
is going to bounce, along with any spam email.  As stated below, most spam
is shown to be sent from a forged address and that means that some poor soul
gets told he or she is sending out spam.  Before it is over, tempers flare
and we get sent to a blacklist for sending out bogus email.  It is a vicious
circle.

I am going to turn it back off and wait for a decision from John before I
turn it on and leave us liable...

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, February 19, 2003 4:01 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Sending out a bounced message

The problem is that if you bounce obvious spam -- which is almost always 
sent with a fake return address -- the legitimate user of the return 
address is going to get the bounce messages, which does nobody any 
good.  For example, if some spammer used [EMAIL PROTECTED] as the 
return address of their spam, would your client really want a ton of bounce 
messages?

Bouncing spam just makes the spam problem worse, as it spreads the spam 
further.
  -Scott

 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 2/18/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Tuning Declude

[Jim Rooth]

Set your virus to hold and not delete...then you will see many a spam in
there being held because of broken email clients.  They were caught by the
Virus program...

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser
Sent: Tuesday, February 18, 2003 2:36 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Tuning Declude

Hey, Scott!

  From my point of view, a false positive is a false positive is a false
 positive.  I just need to make sure that a message has to fail more than
the
 BADHEADERS test to get rejected.

 On the other hand, with this attitude, it will be impossible to stop
 viruses in the future.

I guess I'm a little unclear on why virus checking would have any overlap
with spam checking.

 The problem is that detecting malformed E-mail is a very important part of
 the process in stopping spam and viruses, as many spamware programs use
 broken headers (or let the spammers create their own headers), and viruses
 will take advantage of known vulnerabilities.

I understand that it is an important part of the process for spam.  I don't
necessarily see what that has to do with viruses.  Are a lot of Virus
Protection Vendors checking broken e-mail headers to intercept spam?

 Having an occasional spam come through so you can get legitimate E-mail
 from broken mailers may be acceptable.  But what happens when you have to
 choose between accepting legitimate mail from broken mailers or protecting
 yourself against viruses?

Obviously protecting yourself from viruses would always win out over
receiving legitimate e-mail.  We aren't going to let a virus into our system
just so someone can receive an e-mail message.  If a legitimate e-mail is
being tracked as a virus we would have no choice but to get the sender to
change something on their end.

 There are a number of recently discovered
 vulnerabilities that some legitimate mailers are using (unintentionally,
of
 course), that *must* be blocked (without blocking them, future viruses
will
 be allowed to bypass virus scanners on the mailserver).

I see what your saying there.

 It's also very important to remember that lots of this legitimate broken
 E-mail gets lost, anyways.  Many mailservers will block such E-mail.  And
 in many cases, the mail gets lost in inboxes.

I understand that when possible broken e-mail needs to be fixed.

 It's a choice of dealing with it now or dealing with it later.  Waiting
 means that you'll receive more spam now, and you'll probably have to get
 hit with a virus outbreak before dealing with the problem, which can be
 very costly.

Well, obviously I'm dealing with it now.

 Of course, the choice is completely up to you, and only you can know your
 unique situation well enough to determine whether or not to allow such
 E-mail through.

Specifically what type of e-mail are you talking about?

   The only legitimate mail that the BADHEADERS test catches is mail that
has
   broken headers (which may never reach you anyways).  Whenever
legitimate
   E-mail fails the BADHEADERS test, I strongly recommend fixing the
   problem.  In most cases, blocking based on the BADHEADERS test alone
is
   very useful.
 
 So how would you recommend fixing the problem?

 We are always willing to deal with legitimate companies who have products
 that are sending out broken E-mail (either failing the BADHEADERS test in
 Declude JunkMail, or getting caught as vulnerabilities with Declude
 Virus).  In the majority of cases, though, upgrading to the latest version
 of the software used to send the mail is all that is required (and if
 someone is sending broken mail and isn't willing to upgrade, they have to
 accept the consequences).

Is there any way to tell what about a particular message raises the
BADHEADERS flag?

Thanks for all of your help!

Dan Geiser [EMAIL PROTECTED]


This E-mail is scanned and free from viruses. www.nexustechgroup.com

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http

[Declude.JunkMail] FW: returned email

[Jim Rooth]

I am a little confused.  This email was sent from a client on our mail
server to another client on a different mail server.  If I am reading this
correctly, email.genesis (my server) says it cannot find this person so it
is refusing delivery.  This person is not on my server so why is my server
trying to validate this account?  I am more than a little confused...

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

From: Postmaster [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, February 14, 2003 2:12 PM
Subject: Undeliverable Mail


 undeliverable to [EMAIL PROTECTED]


 Original message follows.

 Received: from MIS02065 [65.120.133.99] by email.genesis
   (SMTPD32-7.14) id AD99112C017C; Fri, 14 Feb 2003 14:12:09 -0600
 Message-ID: 013601c2d465$5d35fd80$[EMAIL PROTECTED]
 Reply-To: John Castro [EMAIL PROTECTED]
 From: John Castro [EMAIL PROTECTED]
 To: Light, Cindy [EMAIL PROTECTED]
 References:
 [EMAIL PROTECTED]
 Subject: Re: P.ups for 2/14 at Eastman in Pleasant Prairie WI
 Date: Fri, 14 Feb 2003 14:12:13 -0600
 MIME-Version: 1.0
 Content-Type: text/plain;
 charset=iso-8859-1
 Content-Transfer-Encoding: 7bit
 X-Priority: 3
 X-MSMail-Priority: Normal
 X-Mailer: Microsoft Outlook Express 6.00.2800.1106
 Disposition-Notification-To: John Castro
[EMAIL PROTECTED]
 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
 X-Declude-Sender: [EMAIL PROTECTED] [65.120.133.99]
 X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for
spam.
 Organization: Klotron, INC.

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] FW: returned email

[Jim Rooth]

I see where the log files say error 554 Transaction error. I do
not know where to go to find an explanation of error 554. The log file
is:



20030214 141209 127.0.0.1 SMTPD
(112C017C) [168.75.225.202]

connect65.120.133.99 port 52573

20030214 141209 127.0.0.1 SMTPD
(112C017C) [65.120.133.99] HELO MIS02065

20030214 141209 127.0.0.1 SMTPD
(112C017C) [65.120.133.99] MAIL FROM: [EMAIL PROTECTED]

20030214 141209 127.0.0.1 SMTPD
(112C017C) [65.120.133.99] RCPT TO: [EMAIL PROTECTED]

20030214 141209 127.0.0.1 SMTPD
(112C017C) [65.120.133.99] d:\IMail\spool\D4d99112c017c52e0.SMD 1954

20030214 141210 127.0.0.1 SMTP
(1996) processing d:\IMail\spool\Q4d99112c017c52e0.SMD

20030214 141210 127.0.0.1 SMTP
(1996) Trying cendian.com (0)

20030214 141210 127.0.0.1 SMTP
(1996) Connect cendian.com [12.129.91.60:25] (1)

20030214 141210 127.0.0.1 SMTP
(1996) 220 clean1.cendian.com WebShielde500/SMTP Ready.

20030214 141210 127.0.0.1 SMTP
(1996) EHLO email.genesis

20030214 141210 127.0.0.1 SMTP
(1996) 250 Requested mail action okay, completed.

20030214 141210 127.0.0.1 SMTP
(1996) MAIL FROM:[EMAIL PROTECTED]

20030214 141210 127.0.0.1 SMTP
(1996) 250 [EMAIL PROTECTED] Sender OK

20030214 141210 127.0.0.1 SMTP
(1996) RCPT To:[EMAIL PROTECTED]

20030214 141210 127.0.0.1 SMTP
(1996) 250 Requested mail action okay, completed.

20030214 141210 127.0.0.1 SMTP
(1996) DATA

20030214 141210 127.0.0.1 SMTP
(1996) 354 Enter mail, end with . on a line by itself

20030214 141210 127.0.0.1 SMTP
(1996) .

20030214 141210
127.0.0.1 SMTP (1996) 554 Transaction
failed: message format error

20030214 141210
127.0.0.1 SMTP (1996) ERR undeliverable 554
Transaction failed: message format error

20030214 141210
127.0.0.1 SMTP (1996) SMTP_DELIV_FAILED

20030214 141210 127.0.0.1 SMTP
(1996) QUIT

20030214 141210 127.0.0.1 SMTP
(1996) 221 Closing connection

20030214 141210 127.0.0.1 SMTP
(1996) Creating message from Postmaster

20030214 141210 127.0.0.1 SMTP
(1996) finished d:\IMail\spool\Q4d99112c017c52e0.SMD status=2





Original message with a simple reply with ‘thanks’ added.



Here is the original message:



Received: from MIS02065
[65.120.133.99] by email.genesis


(SMTPD32-7.14) id AD99112C017C; Fri,
 14 Feb 2003 14:12:09
-0600

 Message-ID:
013601c2d465$5d35fd80$[EMAIL PROTECTED]

 Reply-To: John
Castro [EMAIL PROTECTED]

 From: John
Castro [EMAIL PROTECTED]

 To: Light,
Cindy [EMAIL PROTECTED]

 References:

 [EMAIL PROTECTED]

 Subject: Re: P.ups for
2/14 at Eastman in Pleasant Prairie
 WI

 Date: Fri,
 14 Feb 2003 14:12:13
-0600

 MIME-Version: 1.0

 Content-Type:
text/plain;

 charset=iso-8859-1


Content-Transfer-Encoding: 7bit

 X-Priority: 3

 X-MSMail-Priority: Normal

 X-Mailer: Microsoft
Outlook Express 6.00.2800.1106


Disposition-Notification-To: John Castro

[EMAIL PROTECTED]

 X-MimeOLE: Produced By
Microsoft MimeOLE V6.00.2800.1106

 X-Declude-Sender:
[EMAIL PROTECTED] [65.120.133.99]

 X-Note: This E-mail was
scanned by Declude JunkMail (www.declude.com)

for

spam.

 Organization: Klotron,
INC.



 Thanks

 John Castro

 Corporate Customer
Service

 800-233-9226 Ext 4480

 Fax 254-741-5248


[EMAIL PROTECTED]

 www.centralfreight.com

 - Original Message
-

 From: Light,
Cindy [EMAIL PROTECTED]

 To: John Castro
(E-mail) [EMAIL PROTECTED]

 Sent: Friday,
 February 14, 2003 1:43
 PM

 Subject: P.ups for 2/14
at Eastman in Pleasant Prairie
 WI





 Please reply with
confirmation and have a nice Valentine's Day.





Jim Rooth

Klotron, Inc.

214.244.0979

[EMAIL PROTECTED]














---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

RE: [Declude.JunkMail] FW: returned email

[Jim Rooth]

Thanks.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Sunday, February 16, 2003 2:00 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] FW: returned email


I see where the log files say error 554 Transaction error.  I do not know 
where to go to find an explanation of error 554.  The log file is:

There is no need to look up the 554 error message:

20030214 141210 127.0.0.1   SMTP (1996) DATA
20030214 141210 127.0.0.1   SMTP (1996) 354 Enter mail, end with . 
on a line by itself
20030214 141210 127.0.0.1   SMTP (1996) .
20030214 141210 127.0.0.1   SMTP (1996) 554 Transaction failed: 
message format error

The remote mailserver returned an error 554 Transaction failed: message 
format error.  The meaning of that message is only known to the remote 
mailserver, so you would need to either contact them for an explanation, or 
ignore it.  There isn't enough information to determine what the problem 
is, aside from the remote mailserver not wanting the E-mail.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.455 / Virus Database: 255 - Release Date: 2/13/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] whitelist todomain

[Jim Rooth]

I have set this up as a way to prevent lost emails.  I have a problem with
three different companies saying they are losing their emails.  Will this
allow their emails to go through...regardless of what it is?

WHITELIST TODOMAIN pyramidhealthcare.com
WHITELIST TODOMAIN standardhardware.com

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Wednesday, February 05, 2003 9:34 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Comments

 I mean't to search for normal but uneccessary repeated html-tags like
 font ...
 This can trigger a lot of false positives not only in Frontpage composed
 html.
 The target is to remove them completely before search for keywords.

OK, I guess I am still not sure then how this test works.

Of course, since I have a major project facing me right now, changing ISP
this Friday/Saturday, I am a little distracted.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] whitelist todomain

[Jim Rooth]

Thanks , will set it up that way.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Grant Griffith
Sent: Wednesday, February 05, 2003 10:18 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] whitelist todomain

I have them entered differently and it works.

WHITELIST TO @pyramidhealthcare.com

Not sure if the other way works, but this does...

Sincerely,
Grant Griffith, Vice President
EI8HT LEGS Web Management Co., Inc.
http://www.getafreewebsite.com
877-483-3393 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Jim Rooth
Sent: Wednesday, February 05, 2003 11:05 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] whitelist todomain


I have set this up as a way to prevent lost emails.  I have a problem with
three different companies saying they are losing their emails.  Will this
allow their emails to go through...regardless of what it is?

WHITELIST TODOMAIN pyramidhealthcare.com
WHITELIST TODOMAIN standardhardware.com

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.449 / Virus Database: 251 - Release Date: 1/27/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Trouble adding latest beta version

[Jim Rooth]

I copied the filed from the web, but when I try to copy it to the Imail
folder I get a sharing violation.  I stopped all services in Imail and still
get the sharing violation.  The only thing open on the server is Explorer so
I can see the files.  Any ideas?  I even tried to delete the existing file
but it says it is in use...

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.445 / Virus Database: 250 - Release Date: 1/21/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Trouble adding latest beta version

[Jim Rooth]

Thanks...that fixed it.  I was afraid to rename it because it said it was in
use.  Oh well...Declude -diag says the new one is up and running..1.66 so I
reckon everything is fine in cyber land.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson
Sent: Friday, January 24, 2003 9:20 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Trouble adding latest beta version

Renaming it fixes that condition for me

Have a great day!
Rick Davidson
Buckeye Internet Inc.
www.buckeyeweb.com
440-953-1900
-
- Original Message -
From: Jim Rooth [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, January 24, 2003 10:07 AM
Subject: [Declude.JunkMail] Trouble adding latest beta version


I copied the filed from the web, but when I try to copy it to the Imail
folder I get a sharing violation.  I stopped all services in Imail and still
get the sharing violation.  The only thing open on the server is Explorer so
I can see the files.  Any ideas?  I even tried to delete the existing file
but it says it is in use...

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]



---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.445 / Virus Database: 250 - Release Date: 1/21/2003


---

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.445 / Virus Database: 250 - Release Date: 1/21/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.445 / Virus Database: 250 - Release Date: 1/21/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] No reverse dns

[Jim Rooth]

How odes one correct the reverse DNS on Imail if using virtual domains?  For
instance I have 57 domains all using the same IP...doing a reverse lookup
will not show the correct server name.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith
Sent: Thursday, January 09, 2003 11:44 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...

That's the problem... Hotmail is on and off of Spamcop every other day.
We bounce at 12 and delete at 20.
Spamcop is at 8 so I'll put in -8 for hotmail which will adjust for the
nopostmaster and noabuse.

 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED]] On Behalf Of John 
 Tolmachoff
 Sent: Thursday, January 09, 2003 11:59 AM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Hotmail, Yahoo, MSN, etc...
 
 
 The way I have it configured, they will end up with a weight 
 of 8 and we hold at 20, so they would have to fail a test 
 like SPAMCOP or NOXMAIL or one of our major filters to be held.
 
 John Tolmachoff MCSE, CSSA
 IT Manager, Network Engineer
 RelianceSoft, Inc.
 Fullerton, CA  92835
 www.reliancesoft.com
 
 
 
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the 
 Declude.JunkMail mailing list.  To unsubscribe, just send an 
 E-mail to [EMAIL PROTECTED], and type unsubscribe 
 Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.
 ---
 [This E-mail scanned for 
 viruses by F-Proto Virus Scanner]
 
 

---
[This E-mail scanned for viruses by F-Proto Virus Scanner]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] No reverse dns

[Jim Rooth]

Problem is there are 57 domains using one ip address.   Reverse lookup shows
the domain the server is and not the other domains.  But if you do a reverse
lookup for mail.standardhardware.com it will give you 168.75.225.197
mail.klotron.com.  Thus it fails the reverse dns test.  The IP is correct
but the domain name is that of the main mail record.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Thursday, January 09, 2003 12:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] No reverse dns

Jim, only one PTR record per IP address needed. 

Should only be for the mail record domain.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com




---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] No reverse dns

[Jim Rooth]

Possibly...the error my client received just said no reverse dns but it does
have one even if it doesn't match the wording.  Thanks.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith
Sent: Thursday, January 09, 2003 12:27 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] No reverse dns

This shouldn't fail REVDNS as there is a REVDNS entry. Maybe HELOBOGUS.



 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED]] On Behalf Of Jim Rooth
 Sent: Thursday, January 09, 2003 1:24 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] No reverse dns
 
 
 Problem is there are 57 domains using one ip address.   
 Reverse lookup shows
 the domain the server is and not the other domains.  But if 
 you do a reverse lookup for mail.standardhardware.com it will 
 give you 168.75.225.197 mail.klotron.com.  Thus it fails the 
 reverse dns test.  The IP is correct but the domain name is 
 that of the main mail record.
 
 Jim Rooth
 Klotron, Inc.
 214.244.0979
 [EMAIL PROTECTED]
 
 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED]] On Behalf Of John 
 Tolmachoff
 Sent: Thursday, January 09, 2003 12:17 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] No reverse dns
 
 Jim, only one PTR record per IP address needed. 
 
 Should only be for the mail record domain.
 
 John Tolmachoff MCSE, CSSA
 IT Manager, Network Engineer
 RelianceSoft, Inc.
 Fullerton, CA  92835
 www.reliancesoft.com
 
 
 
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the 
 Declude.JunkMail mailing list.  To unsubscribe, just send an 
 E-mail to [EMAIL PROTECTED], and type unsubscribe 
 Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.
 ---
 
 
 ---
 Incoming mail is 
 certified Virus Free.
 Checked by AVG anti-virus system (http://www.grisoft.com).
 Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
  
 
 ---
 Outgoing mail is certified Virus Free.
 Checked by AVG anti-virus system (http://www.grisoft.com).
 Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
  
 
 ---
 
 ---
 [This E-mail was scanned for viruses by Declude Virus 
 (http://www.declude.com)]
 
 ---
 This E-mail came from the 
 Declude.JunkMail mailing list.  To unsubscribe, just send an 
 E-mail to [EMAIL PROTECTED], and type unsubscribe 
 Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.
 ---
 [This E-mail scanned for 
 viruses by F-Proto Virus Scanner]
 
 

---
[This E-mail scanned for viruses by F-Proto Virus Scanner]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] No reverse dns

[Jim Rooth]

Thanks to all.  I have sent a request to the ISP to set up PTR record and
hopefully that will solve this issue.  Appreciate the help from everyone.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of David Lewis-Waller
Sent: Thursday, January 09, 2003 12:37 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] No reverse dns

John,

dnstsuff shows that 168.75.225.197 (ip for mail.standardhardware.com)
doesn't have a PTR record. Set one up and you shouldn't fail REVDNS.

http://www.dnsstuff.com/tools/ptr.ch?ip=168.75.225.197

David


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Jim Rooth
Sent: 09 January 2003 18:24
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] No reverse dns


Problem is there are 57 domains using one ip address.   Reverse lookup
shows
the domain the server is and not the other domains.  But if you do a
reverse lookup for mail.standardhardware.com it will give you
168.75.225.197 mail.klotron.com.  Thus it fails the reverse dns test.
The IP is correct but the domain name is that of the main mail record.

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Thursday, January 09, 2003 12:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] No reverse dns

Jim, only one PTR record per IP address needed. 

Should only be for the mail record domain.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com




---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] No reverse dns

[Jim Rooth]

This sucker would be flying down the boulevard!

Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Thursday, January 09, 2003 2:13 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] No reverse dns

 Thanks to all.  I have sent a request to the ISP to set up PTR record and
 hopefully that will solve this issue.  Appreciate the help from everyone.

Now, if we were still driving...

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.438 / Virus Database: 246 - Release Date: 1/7/2003
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Server change over

[Jim Rooth]

To my understanding the code is actually lnked to the mail server name.
Without having the exact same name, declude will not work with the old code.
There was a problem earlier with Imail...one of their versions renamed the
mail server and it caused the virus protection to come to a screeching halt.


Jim Rooth
Klotron, Inc.
214.244.0979
[EMAIL PROTECTED]

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Avolve Support
Sent: Tuesday, December 31, 2002 7:45 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Server change over

I don't think it is tied to the server, as I had mine blow up over
Thanksgiving and just recovered the .cfg file from the old server and put it
on the new server.

Do you have the mail server names the same as the last one ?

-- Original Message --
From: Malcolm Kynoch [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Date:  Mon, 30 Dec 2002 16:29:26 -0500


Hi,

Over the holiday our mail server blew up big time, I loaded up a new
server but with a different machine name.  Now junkmail/virus pro
doesn't like my CODE #

I've forgotten the procedure and info required to get a new one

Regards,
   Malcolm

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.435 / Virus Database: 244 - Release Date: 12/30/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.435 / Virus Database: 244 - Release Date: 12/30/2002
 

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Lost emails

[Jim Rooth]

I am having a small problem.  One company sends an email to my mail server.
They get a return that says it is an unknown user..  They answer an email we
send them.  They get it back with unknown user.  I gave them a completely
different address.  Mine.  One time it goes through and never again.  I had
them send me an email to my personal address and it came through with no
problems.  What am I missing here?  I thought maybe they had an internal and
external mail program and the guy was sending it through the wrong program.
He assures me that isn't the case...they send all email through the internet
and he can send to many other clients across the country with no problem.
Any help would be greatly appreciated.  Oh yes, the logs show no record of
ever receiving any emails that were sent other than the two that came
through.  I checked the syslog, virlog, declog, hilog and log.txt.  No
where does it mention any of the emails that are not getting through.  Makes
me think his mail server is bad but he can send to other companies with no
problem...

Here are the headers from the GOOD email:

Return-Path: @alironmarketing.com
Received: from mail.allironmarketing.com ([209.151.255.101])
  by rwcrgwc52.attbi.com
  (InterMail vM.4.01.03.37 201-229-121-137-20020806) with ESMTP
  id
[EMAIL PROTECTED]
  for [EMAIL PROTECTED]; Wed, 18 Dec 2002 22:34:54 +
Received: from ALIRON05 [209.167.97.68] by mail.allironmarketing.com with
ESMTP
  (SMTPD32-7.11) id A74A1CBD0096; Wed, 18 Dec 2002 14:31:38 -0800
Reply-To: @alironmarketing.com
From: ***  @alironmarketing.com
To: [EMAIL PROTECTED]
Subject: Test
Date: Wed, 18 Dec 2002 17:36:17 -0500
Message-ID: LDEAKKKMIAIBEMKDJJPDMEHCCAAA.@alironmarketing.com
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700

Here is the header where it did come through my server the  one time:

Received: from mail.allironmarketing.com [209.151.255.101] by email.genesis
with ESMTP
  (SMTPD32-7.12) id A806469017E; Wed, 18 Dec 2002 15:26:30 -0600
Received: from ALIRON05 [209.167.97.68] by mail.allironmarketing.com with
ESMTP
  (SMTPD32-7.11) id A74376AF0052; Wed, 18 Dec 2002 13:23:15 -0800
Reply-To: @alironmarketing.com
From:   @alironmarketing.com
To: [EMAIL PROTECTED]
Subject: RE: Undeliverable Mail
Date: Wed, 18 Dec 2002 16:27:54 -0500
Message-ID: LDEAKKKMIAIBEMKDJJPDOEHACAAA.@alironmarketing.com
MIME-Version: 1.0
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700
In-Reply-To: [EMAIL PROTECTED]
X-RBL-Warning: MYFILTER: Message failed MYFILTER test (1536)
X-Declude-Sender: @alironmarketing.com [209.151.255.101]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: MYFILTER
X-RCPT-TO: [EMAIL PROTECTED]
Status: U
X-UIDL: 326489075

Here is the message he received about it being a bad user name:

From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
Sent: Monday, December 16, 2002 3:57 PM
To: @alironmarketing.com
Subject: Undeliverable Mail


Unknown user: @centralfreight.com


Original message follows.

Received: from ALIRON05 [209.167.97.68] by mail.allironmarketing.com with
ESMTP
  (SMTPD32-7.11) id AE1E4AB60042; Mon, 16 Dec 2002 12:57:02 -0800
Reply-To: [EMAIL PROTECTED]
From:   [EMAIL PROTECTED]
To: @centralfreight.com
Subject: RE: E MAIL
Date: Mon, 16 Dec 2002 16:01:38 -0500
Message-ID: LDEAKKKMIAIBEMKDJJPDMEFOCAAA.[EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700
In-Reply-To: [EMAIL PROTECTED]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Note: This E-mail was sent from [No Reverse DNS] ([209.167.97.68]).
Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.431 / Virus Database: 242 - Release Date: 12/17/2002

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail

RE: [Declude.JunkMail] Lost emails

[Jim Rooth]

Thanks...that explains why...DNS has been bouncing and the great ISP has
killed the backup servers...oh well, back to the drawing board!

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]

 -Original Message-
From:   [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]  On Behalf Of R. Scott Perry
Sent:   Wednesday, December 18, 2002 17:36
To: [EMAIL PROTECTED]
Subject:Re: [Declude.JunkMail] Lost emails


I am having a small problem.  One company sends an email to my mail server.
They get a return that says it is an unknown user..  They answer an email
we
send them.  They get it back with unknown user.  I gave them a completely
different address.  Mine.  One time it goes through and never again.  I had
them send me an email to my personal address and it came through with no
problems.  What am I missing here?

The Unknown User message comes from IMail (or another mailserver), and
indicates that the server receiving the E-mail doesn't recognize the
account that the E-mail is being sent to.

Oh yes, the logs show no record of
ever receiving any emails that were sent other than the two that came
through.  I checked the syslog, virlog, declog, hilog and log.txt.  No
where does it mention any of the emails that are not getting through.

In this case (BTW, it's the syslog or log.txt that it would appear in),
if the E-mail doesn't appear, then it isn't reaching your server.

I think the problem can be seen at
http://www.dnsreport.com/tools/mail.ch?[EMAIL PROTECTED] .  It
seems that one of your backup mailservers doesn't accept mail addressed to
you, and the other backup mailserver is down.  Therefore, if they can't
reach your mailserver for some reason (even due to a temporary problem on
their end), the mail will go to your backup that will bounce it.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.431 / Virus Database: 242 - Release Date: 12/17/2002

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.431 / Virus Database: 242 - Release Date: 12/17/2002

---

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] attachments ending in .text

[Jim Rooth]

I have a client complaining about some emails being blocked.  What is
weird is the particular mainframe that sends the emails in question is
whitelisted.  Now he tells me all emails go through with a .txt
extension but any with a .text does not.  Have I forgot DOS again?
Doesn't dos require a 3 character extension?

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] attachments ending in .text

[Jim Rooth]

Yes, the only thing I can see in the log file is where an incorrect
address is entered, then it doesn't get delivered.  Other than that it
just says server whitelisted.

They are using a very antiquated main frame to send this mail.  Could it
be it does not support a long extension?  I knew the newer DOS would
accept a long file name but I wasn't aware it would accept an extension
longer than 3 characters...

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, December 10, 2002 18:57
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] attachments ending in .text


I have a client complaining about some emails being blocked.  What is
weird is the particular mainframe that sends the emails in question is
whitelisted.

Have you checked the Declude log file(s) to see what happens to his
E-mail?

Now he tells me all emails go through with a .txt
extension but any with a .text does not.

That is really odd...

Have I forgot DOS again? Doesn't dos require a 3 character extension?

DOS used to require a 3 character extension, but the latest versions of
DOS
(the ones that come with Windows) do have some support for long
filenames.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] attachments ending in .text

[Jim Rooth]

Thanks, I'll look into it and come up with an answer of some
kind...hopefully the correct one...LOL

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, December 10, 2002 19:24
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] attachments ending in .text


Yes, the only thing I can see in the log file is where an incorrect
address is entered, then it doesn't get delivered.  Other than that it
just says server whitelisted.

If the Declude JunkMail log file entry says that it is whitelisted, then

the E-mail shouldn't be caught by Declude JunkMail (meaning that it is
getting caught for some other reason, such as an IMail rule, or through
Declude Virus).

Have you checked the IMail log file?  If the E-mail is delivered, you
should see both SMTPD lines showing the E-mail being received, and
SMTP
or SMTP- lines showing the E-mail being delivered.  If it is
delivered,
the fault doesn't lie on your end; if it is not delivered, then you will

know to investigate further.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] attachments ending in .text

[Jim Rooth]

Go to your room!  This is weird.  The virus detector is catching it as it
says there is no file extension so it assumes the extension to be .exe.  

12/10/2002 11:03:03 Q1e400d65014a69ab Found file with mismatched extensions
[AR.B.S.ARB-AR.B.S.ARB]; assuming .exe
12/10/2002 11:03:03 Q1e400d65014a69ab Got disp
name=AR.B.S.ARBCA2.FILE01.TEXT [MimeName=mismatched.exe].
12/10/2002 11:03:03 Q1e400d65014a69ab Scanned: Banned file extension. [MIME:
2 475831]

However when I look at the file name I see where it is extremely long but
does in fact have an ext of .text

--MIME-Boundary-1039539809
Content-Type: text/plain; name=AR.B.S.ARBCA2.FILE06.txt
Content-Disposition: attachment; filename=AR.B.S.ARBCA2.FILE06.TEXT
Content-Transfer-Encoding: Base64
Content-Description: AR.B.S.ARBCA2.FILE06

I guess I need to go back to driving as I sure do not understand this.

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Tuesday, December 10, 2002 19:34
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] attachments ending in .text

...hopefully the correct one...LOL

All answers are assumed correct until proven otherwise.

Kind of like, if you can't find it, grind it. :))

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


attachment: winmail.dat

RE: [Declude.JunkMail] Unable to get filter to work

[Jim Rooth]

You might try adding a value to the myfilter.txt
MYFILTER filter c:\imail\declude\myfilter.txt x 5 0
It might think that the value of zero is telling it to bypass
myfilter.txt


Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of David
Lewis-Waller
Sent: Thursday, November 28, 2002 07:42
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Unable to get filter to work

Any help appreciated...

I have in my global.cfg file the line

MYFILTER filter c:\imail\declude\myfilter.txt x 0 0

myfilter.txt has the following lines

MAILFROM -10 CONTAINS @talk21.com
MAILFROM -10 CONTAINS @passport.com
MAILFROM -10 CONTAINS @economist.com
MAILFROM -10 CONTAINS .ft.com
MAILFROM -10 CONTAINS .bbc.co.uk

I hold email on a weight of 30.

I have a test account with talk21.com which normally fails a number of
tests resulting in a total weight of 33. I would have expected the
weight to drop to 23 because of myfilter.txt but it doesn't. I tried
silly numbers as well e.g. -60 but still end up with a total weight o
33. I'm obviously missing something fundamental.

Sent email headers:

Received: from wmpmta04-app.mail-store.com [194.73.242.6] by
mail.nthost.co.uk with ESMTP
  (SMTPD32-7.13) id ACAC128E00CC; Thu, 28 Nov 2002 13:39:56 +
Received: from wmpmtavirtual ([10.216.84.18])
  by wmpmta04-app.mail-store.com with SMTP
  id
20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual
  for [EMAIL PROTECTED]; Thu, 28 Nov 2002 13:39:55 +
Received: from 62.189.235.109 by t21web08-lrs ([10.216.84.18]); Thu, 28
Nov 02 13:30:20 GMT+00:00
X-Mailer: talk21 v1.26 - http://talk21.btopenworld.com
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
X-Talk21Ref: none
Date: Thu, 28 Nov 2002 13:30:20 GMT+00:00
Subject: SPAM: (No Subject)
Message-Id:
20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual
X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain
X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail
client [804f].
X-RBL-Warning: REVDNS: This E-mail was sent from a mail server
194.73.242.6 with no reverse DNS entry.
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 4.
X-RBL-Warning: WEIGHT10: Weight of 33 reaches or exceeds the limit of
10.
X-Declude-Sender: [EMAIL PROTECTED] [194.73.242.6]
X-Note: This E-mail was scanned by Declude JunkMail for evidence of
spam.
X-Note: This E-mail was sent from [No Reverse DNS] ([194.73.242.6]).

Thanks in advance.

David




-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Dan Patnode
Sent: 28 November 2002 08:57
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] BASE64 usage


I have John.  While Base64 is a great test, a number of newsletters and
normal emails have come across using it.  I have weakened my system to
let these types of messages through and pull my hair out every time a
spam gets through because of it.

Dan


On Wednesday, November 27, 2002 8:02, John Tolmachoff
[EMAIL PROTECTED] wrote:
Even thought it has been determined that there is no legit REASON to
use BASE64 encoding in the body, I am finding and increasing use of it.

Most of these are junk, but it has caught a number of legit messages.

Therefore, I have downgraded BASE64 from 15 to 12.

Any one experiencing similar?

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Log entry

[Jim Rooth]

Sounds like an Imail issue. Sometimes
they change the server name when they upgrade. Dont know why but it
happens. From your IMAIL directory (in DOS) run declude diag This will
tellyou the name it sees of the server and if it is different than what you
registered Declude with, it will not work.





Jim Rooth

KLOTRON,INC.

Office: 817.654.3018.103

Home: 972.606.6341

Mobile: 214.244.0979

[EMAIL PROTECTED]

[EMAIL PROTECTED]

[EMAIL PROTECTED]





-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of steve
Sent: Monday, November 25, 2002
09:04
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Log
entry





Scott,











Just ran the Declude Junkmail
installation this morning. Can you tell me what this log entry means:











11/25/2002 09:04:08
Q2dd81489010e9f06 Declude JunkMail NOT Registered for mail; not scanning
E-mail.











Thanks,











Steve

RE: [Declude.JunkMail] Log entry

[Jim Rooth]

Oops.  Should have known, Scott beat me to the answer...LOL

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, November 25, 2002 09:28
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Log entry


Just ran the Declude Junkmail installation this morning. Can you tell
me
what this log entry means:

11/25/2002 09:04:08 Q2dd81489010e9f06 Declude JunkMail NOT Registered
for
mail; not scanning E-mail.

Did you just upgrade IMail?  A few of the IMail upgrades have a bug that

can change the Official Host Name of the server -- it looks like that is

what happened here.  Instead of being mail.example.com, IMail changed
the
name to mail (which isn't a valid hostname on the Internet).  If you
switch it back, it should fix the problem.
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] How does a reverse lookup work from a mail server?

[Jim Rooth]

Scott, Could you put that in layman's terms. ;))

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, October 16, 2002 11:42
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] How does a reverse lookup work from a
mail server?


When a message arrives at my mail server, how does the server perform
the
reverse lookup?

It just does.  :)

You can go to http://www.DNSstuff.com/info/revdns.htm for an overview of

how reverse DNS lookups work.  Or, you can use the Reverse DNS Lookup
at
http://wwwDNSstuff.com to check to see if the reverse DNS entry exists
for
a given IP.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Best Rule Tweaks

[Jim Rooth]

I'd sure buy some stock if you did decide to go public!

Jim Rooth
KLOTRON,INC.
Office: 817.654.3018.103
Home: 972.606.6341
Mobile: 214.244.0979
[EMAIL PROTECTED]


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, October 09, 2002 17:42
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Best Rule Tweaks


Thanks for the suggestion -- that page has been updated to include
links to
the archives.
Wow, THAT was fast!  Thank you, Scott!

We aim to please.  :)

Could you define your version of a discussion forum?  My definition is
similar enough to a mailing list that I'm not sure what you are
looking for.
I define a discussion forum as a web-based, threaded discussion site,

whereas newsgroups, mailing lists, listservs, etc. are e-mail-based.
I'm
not sure that mine is the publicly recognized standard parlance or
not.  It could just be me.

My favorite example of a slick and useful web discussion forum would
have
to be the Macromedia Support Forums, at
http://forums.macromedia.comhttp://webforums.macromedia.com/coldfusio
n/
, for example.

Ah, gotcha.  That's something that we may look into, although if we do
so,
we would likely have it act as a mirror to the mailing list (so that
people
could choose whether or not to use the web interface).

Thanks again.  I am increasingly impressed by Declude.  Goin' public
anytime soon?

Nope, sorry.  :)
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] DSN:WEIGHTING

[Jim Rooth]

Works on the same principlemore
weight more costly







Jim Rooth
Klotron, Inc. 



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On
Behalf Of Kevin (Linkbrokers Support)
Sent: Tuesday, October 01, 2002
13:41
To: Declude Junk Mail
Subject: [Declude.JunkMail]
DSN:WEIGHTING





I hear allot about the weighting
system! Is there somewhere to go to see examples and explanations - I am
totally clueless on this subject - newbe here 











- Don't laugh - I was a tobacco
farmer and weight to us was how much did I get for atruck load or
kilo's











kevin











^^^^---^^---^^











Link Brokers Group, LLC
Email:mailto:[EMAIL PROTECTED]
ONLINE SUPPORT FORM 24 Hours
http://www.linkbrokers.com/support_ticket.cfm
TOLL FREE Support
1-888-546-5631 - Ext 15 Mon - Friday 9-5 EST.











^^^^---^^---^^

RE: [Declude.JunkMail] DSN:WEIGHTING

[Jim Rooth]

Hey!! I resemble that remark!


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Kevin
(Linkbrokers Support)
Sent: Tuesday, October 01, 2002 16:10
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] DSN:WEIGHTING

I'm glade you'all have a since of humor.  :-)


- Original Message -
From: John Tolmachoff [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, October 01, 2002 3:11 PM
Subject: RE: [Declude.JunkMail] DSN:WEIGHTING


I think this post is going to the trucks.

Honk Honk.

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Jim Rooth
Sent: Tuesday, October 01, 2002 11:50 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] DSN:WEIGHTING

Works on the same principle.more weight more costly


Jim Rooth
Klotron, Inc.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Kevin
(Linkbrokers Support)
Sent: Tuesday, October 01, 2002 13:41
To: Declude Junk Mail
Subject: [Declude.JunkMail] DSN:WEIGHTING

I hear allot about the weighting system! Is there somewhere to go to
see examples and explanations - I am totally clueless on this subject -
newbe here

- Don't laugh - I was a tobacco farmer and weight to us was how much did
I get for a truck load or kilo's

kevin

^^^^---^^---^^

Link Brokers Group, LLC
Email:mailto:[EMAIL PROTECTED]
ONLINE SUPPORT FORM 24 Hours
http://www.linkbrokers.com/support_ticket.cfm
TOLL FREE Support
1-888-546-5631 - Ext 15 Mon - Friday 9-5 EST.

^^^^---^^---^^

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



[Reliable Web Hosting by -  http://www.linkbrokers.com/hosting.cfm]
[This E-mail scanned for viruses by LinkBrokers EMail Service]
[This E-mail scanned for spam mail against orbs and spamcop]








[Reliable Web Hosting by -  http://www.linkbrokers.com/hosting.cfm]
[This E-mail scanned for viruses by LinkBrokers EMail Service]
[This E-mail scanned for spam mail against orbs and spamcop]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] BADHEADERS Test question

[Jim Rooth]

Getting to me...look here, you say you been thinking again!  Sounds like
a retread coming off to me...


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Friday, September 27, 2002 01:00
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] BADHEADERS Test question


Thanks Scott, I meant to say SPAMHEADERS in lieu of BADHEADERS...to
ya'll I was RFC ignorant...you had to figure the rest of the ignorance
out on your own...LOL

Me thinks you have been spending too much time around a truck stop again
Jim. The diesel fumes are getting to you again.

:-)

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] BADHEADERS Test question

[Jim Rooth]

I do it by a weight system.  Thee are a few of the tests that really
have less value in catching legitimate spam.  For instance if you give
a heavy weight to noabuse, you will not receive any mail from Microsoft
as they do not want the emails telling them they are screwing up so
therefore they do not have an 'abuse' account.  BADHEADERS, in my
opinion, should have a lower value.  Many servers out there are
legitimate but have RFC ignorant people running them.  I know, cause I
am one ignorant son of a gun when it comes to RFC!


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Troy Hilton
Sent: Thursday, September 26, 2002 15:53
To: Declude Junkmail Forum (E-mail)
Subject: [Declude.JunkMail] BADHEADERS Test question


Hello All,

So far I've been very happy with JunkMail. I'm only running a few tests
and
it's catching a lot of spam and porn. However, I'm noticing the
occasional
legitimate email from badly formatted clients. For example, JunkMail
caught
a confirmation email from an online service that one of my co-workers
signed
up for. This was a good email but it had badly formatted headers.
Fortunately, I'm not rejecting or deleting emails as of yet but
eventually I
will. How do you all deal with emails that fail the BADHEADERS test
because
of poor mail clients/senders but are legit emails that need to be
delivered?
I'm looking for my next step in configuring JunkMail. Any advice is
appreciated.

Troy D. Hilton
SofWerks LLC.
[EMAIL PROTECTED]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP:[SNIFFER Sniffer test failed]Declude.JunkMail and Message Sniffer

[Jim Rooth]

Instead of whitelisting, try giving those names a negative value.  That
way if you do get some real spam from that domain, you will still have
other values or weights to use to catch it.  If you whitelist, nothing
is even checked and it goes through regardless.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Lenny Bauman
Sent: Thursday, September 26, 2002 19:42
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] SPAMCOP:[SNIFFER Sniffer test
failed]Declude.JunkMail and Message Sniffer


Hello all

 I have Junkmail running and it has cut down on the spam somewhat   I am
still getting a lot of spam so I though I would give Message Sniffer a
try I
installed it about 24 hours ago and it has catauh a large amount of the
message that I was getting as spam.  The problem that I am seeing is
that I
am getting a lot of newsletter marked as failing the sniffer test.
Newsletter from places like  Columbia House, The WWE, ISP World.  Am I
missing something or do I have to whitelist these site so that my
customer
can continue to receive there newsletter that they subcribed to.
Below is
a small list of the site that have been reported to me as failing the
sniffer test that the customer has requested to receive mail from.   Any
help you can give me will be greatly appreacted.I like the fact that
sniffer is catuching what gets through Junkmail I just am not sure how
to
handle the False Positive messages.Thanks in advance for any help
you
can give me.



Lenny Bauman


From: [EMAIL PROTECTED]
From: Strive.To Word [EMAIL PROTECTED]
From: eWEEK News [EMAIL PROTECTED]
From: ArcaMax [EMAIL PROTECTED]
From: Just Say Wow [EMAIL PROTECTED]
From:  [EMAIL PROTECTED]
From:  [EMAIL PROTECTED]
From: Webmonkey Frontdoor [EMAIL PROTECTED]
From: ISPworld [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
From: Wired News [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
From: WWE Newsletter [EMAIL PROTECTED]
From: Columbia House DVD Club [EMAIL PROTECTED]
From: bizjournals.com Solutions
[EMAIL PROTECTED]
From: ISPworld [EMAIL PROTECTED]
From: TESSCO...Your Total Source [EMAIL PROTECTED]
From: McAfee.com Services [EMAIL PROTECTED]
From: [EMAIL PROTECTED]


---
[This E-mail scanned for viruses by LRBCG.COM, Inc.]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spam rec'd using internal return address

[Jim Rooth]

One way is to use myfilter.txt.  Include some of the obvious wordings in
it such as :

SUBJECTCONTAINS 10 disgusting words
BODYCONTAINS 10 disgusting verbage
MAILFROM 10 sorry individual


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Sharyn Schmidt
Sent: Tuesday, September 24, 2002 07:27
To: Declude Junkmail List
Subject: [Declude.JunkMail] spam rec'd using internal return address


Good morning :)

One of my users is receiving some really disgusting porn email.

The logs show that the sender is actually using HER address as the
return address. Here is a snip from the IMAIL log:

09:23 23:13 SMTPD(29B2013E) [200.231.59.131] HELO aleph.inbrac.com.br

09:23 23:13 SMTPD(29B2013E) [200.231.59.131] MAIL
FROM:[EMAIL PROTECTED]
(this is NOT the IP address of my mail server)

09:23 23:13 SMTPD(29B2013E) [200.231.59.131] RCPT
TO:[EMAIL PROTECTED]

09:23 23:13 SMTPD(29B2013E) [200.231.59.131] D:\IMAIL\spool\Dd85c13e.SMD
1329

09:23 23:13 SMTP-(0A84) processing D:\IMAIL\spool\Qd85c13e.SMD

09:23 23:13 SMTP-(0A84) ldeliver todhunter.com scarbo-main (1)
[EMAIL PROTECTED] 1598

09:23 23:13 SMTP-(0A84) finished D:\IMAIL\spool\Qd85c13e.SMD
status=1

According to the Dec0923.log, the only test this message failed was the
reverse DNS and obviously I don't rely solely on that test to block or
attach spam.

What is the best way to block this? Does Declude blacklist IP addresses
or do I have to do this in IMAIL? Should this post go to the IMAIL users
list? If so, my apologies!

TIA,
Sharyn


We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged Best in the World at the annual
San Francisco Wine and Spirits Championships. For
more information, please click (go to) htmla
href=http://www.cruzanrums.com;www.cruzanrums.com/a/html
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Winmail.dat

[Jim Rooth]

Perhaps a little off the subject but since it was mentioned...

I have a client who cannot send attachments with .xls.  They come
through as winmail.dat and are unreadable.  Based on what I read here,
so I check and see if he is sending it as RTF and have him try to send
as Plain or HTML?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, September 05, 2002 18:06
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] More encoded spam



How is RTF (Outlook) email sent?
Also, Exchange RTF is not the same as plain Outlook RTF composed
messages.

Outlook/Exchange's proprietary RTF is done through a winmail.dat file
that
is sent as an attachment -- instead of a text/plain content type, it's

sent as application/ms-tnef.  So that won't be a problem.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.385 / Virus Database: 217 - Release Date: 09/04/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.385 / Virus Database: 217 - Release Date: 09/04/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

DORKZTL:RE: [Declude.JunkMail] dictionary attacks

[Jim Rooth]

Perhaps a disgruntled employee or 'friend' trying for a Denial of
Service attack.  2 people in a domain...I thought I had some small
accounts...LOL


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: Friday, August 16, 2002 5:15 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] dictionary attacks

Yesterday we recorded dictionary attack(s) from 42 different IP's.
For the most part these were in different network ranges.

Most attempts tried 24 addresses but several were fewer and 3 were
more.  Sometimes 10 or 15 minutes between attack and later in the day
maybe an hour.

Can't say if it was one attack or several but is continuing today as
well although at a reduced pace.  I've counted 3 so far in similar
pattern - apparently random IP's and trying 24 addresses.

Kind of funny in a way to think of the spammer expending all those
resources to harvest addresses from a domain used by 2 people.



Terry Fritts

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

DORKZTL:RE: [Declude.JunkMail] Who are these guys?

[Jim Rooth]

The first is a Spanish site...almost like Excite.  It list place for
friends and lovers, news, chat room, etc.

The second looks like an email program of some sort...


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Saturday, August 03, 2002 5:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Who are these guys?


Since I do not understand other languages I could not figure
out what these sites were.  I was hopping someone could help
otherwise I can not place them on the kill list.


I'm not sure what this one is, it looks like it's in Spanish:
http://www.24horas.com

Just need an opinion on this one, it's in English:
http://www.zoanmail.com/login.php (this one looks like a mail

Thanks,
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

DORKZTL:RE: [Declude.JunkMail] What Action Do you take?

[Jim Rooth]

One of the neat things about Declude is it doesn't let the idiot on the
other end know you deleted his spam.  If he did, there are those who sit
up until the wee hours trying to get around a program just cuz he can.


I personally have a huge myfilter.txt file (over 1800 entries) and I
have anything set to 35 or higher is lost in the cyber world.  Anything
over 25 but less than 34 is set to WARN and anything less is sent
without recourse.

Because of the file I have, I get some Weight values over 100!  And I
have yet to see one of them over forty that doesn't look like spam.  I
am sure I am losing a few but I know I am stopping a bunch.  The numbers
a few minutes ago were 33010 emails and 24783 spam.  This is not a large
amount of emails seeing as how I have not reset for 8 days.

If anyone wants a copy of the myfilter.txt that I use, I would be glad
to share.  I would warn all first though...there are things I look for
that may not be prudent for your clients.  The myfilter.txt file has to
be set for each individual server.  I have found that it is a lot easier
removing things that are not germane that gong through tons of spam and
trying to find things that are.  My file has been compiled from several
other's list.

Oh yes, it also makes my dec.log bigger.  I run around a 2.5 to 3
meg file a day.

After reading every post for a month I have tried to incorporate other's
ideas into my global.cfg and myfilter.txt.

Hope this helps and doe not confuse.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L.
Sent: Friday, August 02, 2002 2:51 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] What Action Do you take?

I am sure most people use the weighting system.  For the most part you
have certain weights were you know that 99% of the mail triggering that
weight is spam.

Do you BOUNCE, HOLD, Or DELETE?  Right now I am using HOLD, but was
considering switching that to BOUNCE.  There are defiantly some pro's
and con's to both.

Any thoughts.

Darrell

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] another newbie question

[Jim Rooth]

Based on the ROUTETO theory, what steps would be needed to send the
email on to the original destination if it was found to be legitimate?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, July 29, 2002 12:02 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] another newbie question


Is there a way to have an email sent to me by the Junkmail software
that
tells me, personally, as the administrator, that a spam email has been
sent to the spam folder? (same idea as the Declude virus sends me a
virus notification when someone's email has been quarantined.)

The closest thing is with the latest beta, you can use the COPYTO
action.  For example, WEIGHT10 ROUTETO [EMAIL PROTECTED].  That would
route the E-mail to [EMAIL PROTECTED], rather than quarantine it.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?

[Jim Rooth]

Oh well, so much for my two cents worth...I'll have to keep an eye on it
a little closer I reckon...maybe have to have my eyes open???  LOL


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: Monday, July 29, 2002 3:08 PM
To: Tom
Subject: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD
or BAD?

Tom,

Monday, July 29, 2002 you wrote:
T That is, should we block them or not?

   You'd have to be careful.

T would or could it capture legitimate mail?

   Yes.  Lots of valid mailing lists have bounce in them too.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

DORKZTL:RE: [Declude.JunkMail] another newbie question

[Jim Rooth]

Thanks, I was more than a little confused.  I am sure Scott had told me
that but for some reason it just didn't stick.  Hopefully it will this
time.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry
Sent: Monday, July 29, 2002 1:40 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] another newbie question

Jim, with Declude, inbound messages are passed directly to Declude by
IMail
for processing and if clean, then dropped directly into the spool
directory
for delivery.  If a legitimate message is held, you can simply move the
Q 
D files of the legit message into the spool directory and IMail will
deliver
them.  Declude does not check the spool directory after the messages
have
been placed there.

HTH,

Bill

-Original Message-
From: Jim Rooth [mailto:[EMAIL PROTECTED]]
Sent: Monday, July 29, 2002 11:33 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] another newbie question


Ok, let me rephrase...would I be able to go to that email and hit
forward and add the original address or would JunkMail catch it again?
I guess my question is what stops JunkMail from catching it the second
time?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, July 29, 2002 12:58 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] another newbie question


Based on the ROUTETO theory, what steps would be needed to send the
email on to the original destination if it was found to be legitimate?

It would need to be forwarded somehow.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This e-mail was scanned for viruses by Pointshare's Virus Scanning
Service]
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?

[Jim Rooth]

I personally have MAILFROM 10 CONTAINS bounce in myfilter.txt.  I have
yet to see it where it wasn't associated with some type of spam.
However, bounce alone is not enough for me to kick - it creates a weight
of 15 as Myfilter adds a weight of 5.  I have my kick weight set at 20
so it means something else has to be a catalyst.  I can honestly say I
have never had one message with bounce in it come in at less that 30
though.  My 2 cents.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Monday, July 29, 2002 3:01 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or
BAD?


Post your thoughts on the following addresses...

@BOUNCE
.BOUNCE
BOUNCE.

In my research I found these addresses to be typical with
spam messages, I'd be curious to hear what your findings are.
That is, should we block them or not?  would or could it capture
legitimate mail?

Regards,
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

DORKZTL:RE: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?

[Jim Rooth]

Oh well, open mouth a little wider and put the other foot in it...you
gotta love the list...enough diversity that every subject can be covered
and recovered.  I do believe I will leave my bounce set up for the time
being though...already have both feet in my mouth so can't go too far
wrong!


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: Monday, July 29, 2002 3:58 PM
To: Tom
Subject: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD
or BAD?

Tom,

Monday, July 29, 2002 you wrote:
T Have you ever seen BOUNCE used in legitimate mail?

I haven't kept a running database of them but never expected to have
to prove anything.

But just from today I can list a few:

   @bounces.spamcop.net   - note that bounce is inside bounces
these are sent for incident reports

   @bounce.forbesdigital.com  - used by Forbes for subscribers -
the first part is the user id

   @bounce.quris.net  - I forget what list this is but
one of our clients is subscribed

   sparklist - also uses bounce but at the front of the address
   I forget how it works exactly - maybe
   bounce-listname-subscriberid

There are others as well.

Keep in mind we are really low volume so I wouldn't think we'd see as
many as some of the high volume providers.

Of course these things change too.  I've been amazed at how often
lists change mailing software.


Terry Fritts

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?

[Jim Rooth]

Yes sir, I answered before I read all the replies...my bad.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: Monday, July 29, 2002 4:39 PM
To: Jim Rooth
Subject: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD
or BAD?

Jim,

Monday, July 29, 2002 you wrote:
JR I only look for it in the MAILFROM and not in the body or

The examples I gave were from MAILFROM not body.
They may be in the body but I don't have the messages to check
them.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

DORKZTL:RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? Conclusion

[Jim Rooth]

Basically that is what I have done.  I have weight set to 20 before it
stops anything so bounce alone cannot do it.  Trouble is RVSDNS (5) and
spamheaders(5) can.  I figure if all three are hit, chances are it is
real and not just a poorly run server.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Monday, July 29, 2002 4:44 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Adding BOUNCE to your Kill list?
Conclusion

 Here again, I only look for it in the MAILFROM and not in the body or
 subject.  Maybe that is why I haven't had any problems...yet.
Knocking
 on every piece of wood I can find...


Ok, after doing some more research I came up with the following
conclusion:
I created another FROMFILE called WFILE.TXT and placed the following
addresses
inside of it:
-
@BOUNCE BOUNCE1
.BOUNCE BOUNCE2
BOUNCE. BOUNCE3
BOUNCE@ BOUNCE4
-

Then I set up a test inside the Declude CFG file with a weight of 10:
-
BFROM   fromfiled:\imail\declude\wfile.txt  x
10  0
-

And finally I set up the test inside the $default$.junkmail file to
warn:
-
BFROM   WARN
-

This way BOUNCE by itself would not fail completely unless it fails more
than one test.  Hopefully this helps catch more spam using the BOUNCE
from
address and doesn't disturb legitimate mail.

Regards,
Tom
Image`fx

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD?

[Jim Rooth]

I'm not.  Been around fighting with these stupid square headed girl
friends since '73 when they were huge boxes with 32 and 64 Kb of ram.  I
learned a long time ago no matter what you say, someone can justifiably
prove you wrong.  So I try to beat them to the punch...LOL


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom
Sent: Monday, July 29, 2002 4:48 PM
To: [EMAIL PROTECTED]
Subject: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD?
Importance: Low


 Oh well, open mouth a little wider and put the other foot in it...you
 gotta love the list...enough diversity that every subject can be
covered
 and recovered.  I do believe I will leave my bounce set up for the
time
 being though...already have both feet in my mouth so can't go too far
 wrong!

I wouldn't worry about it, this list is here for all of us and this is
how we learn to use DECLUDE.  Hopefully share information and/or create
new tools to help us battle this VIRUS they call spam!

Best Regards,
Tom
Image`fx


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD?

[Jim Rooth]

This is the kind of mail I am seeing:

Subject: Motorola Cell Phone+ $50 Cash Back
X-List-Unsubscribe: [EMAIL PROTECTED]
From: Melissa H. [EMAIL PROTECTED]
Reply-To: Melissa H. [EMAIL PROTECTED]
Return-Path: [EMAIL PROTECTED]

So I have bounce listed as well as dealseveryday.  Also $ and cash.
This particular item had a weight of 35 after spamcop finished with it.
I tell most of my subscribers not to try to unsub as it usually ends up
putting their names on another list for the spammers to sell.  I may be
wrong...no cherry there either...LOL


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Monday, July 29, 2002 5:21 PM
To: [EMAIL PROTECTED]
Subject: RE: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list?
BAD?

I'm not.  Been around fighting with these stupid square headed girl
friends since '73 when they were huge boxes with 32 and 64 Kb of ram.
I
learned a long time ago no matter what you say, someone can justifiably
prove you wrong.  So I try to beat them to the punch...LOL

LOL

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer

[Jim Rooth]

I would be interested in seeing what some of you have as  myfilter.txt
list.  I have been adding to mine and find it is a time consuming
experience to say the least.  One that has been paying for itself
though.  Being inexperienced in this endeavor, though, I realize I may
be going into overkill.  What say you?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Todd Ryan
Sent: Sunday, July 28, 2002 2:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Declude and Sniffer

Jeff,

I just purchased Message Sniffer this past week.  Before that, I ran
the trial version for 30 days and then produced some statistics to
prove to myself and my boss that it was worth buying.  What it boiled
down to was that I was catching 12.5% more definite spam with Message
Sniffer than without it.

A couple things that are worth mentioning...

By definite spam, I'm being very conservative.  I don't consider
anything that has a legitimate unsubscribe method to be spam.  Many
would disagree.  We're a higher education institution so free speech
is a very important factor.  So you may find it even more effective
than I do because it will also block some of the newsletters that we
as mail administrators find to be at the top of the spam scale.

I was using the demo for 30 days so that means no updates.  Using it
with frequent updates will probably produce even better results.

Also, I have some very tweaked JunkMail weights and rules.  I only use
Message Sniffer only in the weighting system.  It blocks some things
that I don't consider junkmail like newsletters from emazing.com and
beliefnet.com.  So if a message ONLY fails sniffer, I don't bounce it.
It has to fail one or two other tests.

Hope this helps.  For me, I expect a 12%-15% increase in accuracy and
that is worth it.  I now have what I think is a VERY accurate
weighting system.  I've only had two instances in about 6 months where
a remote postmaster said their mail was bouncing.  In both cases they
were legitimate companies sending work-related things, but they both
were listed in one of the open relay databases so the filters worked
correctly.

--Todd.



- Original Message -
From: Jeff Kratka [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, July 26, 2002 4:08 PM
Subject: [Declude.JunkMail] Declude and Sniffer


 Just curious. How many people are using both Declude Junk Mail and
the
 sniffer add-on and has it made a difference if yes. I have been
completely
 pummeled with Spam and am looking for more options.

 Thanks.

 Jeff

 *
 TymeWyse Internet
 P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417
 tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]
 *


 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---

 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer

[Jim Rooth]

I would appreciate it...trying to make sure that I am going in the right
direction


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry
Sent: Sunday, July 28, 2002 3:07 PM
To: '[EMAIL PROTECTED]'
Subject: RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer

Jim, my filter file is rather large (almost 1600 entries and growing).
I
don't know if it is appropriate to post to the list, but I will send you
a
copy off-line, if you like.

Bill

-Original Message-
From: Jim Rooth [mailto:[EMAIL PROTECTED]]
Sent: Sunday, July 28, 2002 12:59 PM
To: [EMAIL PROTECTED]
Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer


I would be interested in seeing what some of you have as  myfilter.txt
list.  I have been adding to mine and find it is a time consuming
experience to say the least.  One that has been paying for itself
though.  Being inexperienced in this endeavor, though, I realize I may
be going into overkill.  What say you?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Todd Ryan
Sent: Sunday, July 28, 2002 2:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Declude and Sniffer

Jeff,

I just purchased Message Sniffer this past week.  Before that, I ran
the trial version for 30 days and then produced some statistics to
prove to myself and my boss that it was worth buying.  What it boiled
down to was that I was catching 12.5% more definite spam with Message
Sniffer than without it.

A couple things that are worth mentioning...

By definite spam, I'm being very conservative.  I don't consider
anything that has a legitimate unsubscribe method to be spam.  Many
would disagree.  We're a higher education institution so free speech
is a very important factor.  So you may find it even more effective
than I do because it will also block some of the newsletters that we
as mail administrators find to be at the top of the spam scale.

I was using the demo for 30 days so that means no updates.  Using it
with frequent updates will probably produce even better results.

Also, I have some very tweaked JunkMail weights and rules.  I only use
Message Sniffer only in the weighting system.  It blocks some things
that I don't consider junkmail like newsletters from emazing.com and
beliefnet.com.  So if a message ONLY fails sniffer, I don't bounce it.
It has to fail one or two other tests.

Hope this helps.  For me, I expect a 12%-15% increase in accuracy and
that is worth it.  I now have what I think is a VERY accurate
weighting system.  I've only had two instances in about 6 months where
a remote postmaster said their mail was bouncing.  In both cases they
were legitimate companies sending work-related things, but they both
were listed in one of the open relay databases so the filters worked
correctly.

--Todd.



- Original Message -
From: Jeff Kratka [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, July 26, 2002 4:08 PM
Subject: [Declude.JunkMail] Declude and Sniffer


 Just curious. How many people are using both Declude Junk Mail and
the
 sniffer add-on and has it made a difference if yes. I have been
completely
 pummeled with Spam and am looking for more options.

 Thanks.

 Jeff

 *
 TymeWyse Internet
 P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417
 tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]
 *


 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---

 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This e-mail was scanned for viruses

RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer

[Jim Rooth]

Most of my failures come from my myfile.txt file.  I wrote down key
phrases or words for a week or two and it seems to kill most of them.
Got my first one today since we setup JunkMail four weeks ago!  It came
through clean as a whistle...I will look forward to setting up phrases
in the body of the email.  That will kill those that are smart enough to
circumvent the system.  I have my bounce set at 20 but all my key words
and phrases set at ten.  That way no one word or phrase will kill the
email.  Seems to be working...now if I could just get ATT to get off
the blacklist so Kithrup and dorkface and those others would go away.  I
do 90% of my work from home and use ATT cable to access with.



Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker |
Netsmith Inc
Sent: Friday, July 26, 2002 3:27 PM
To: '[EMAIL PROTECTED]'
Subject: RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer

That is about average, over 50% of our inbound mail fails at least one
test
(more like 70%)...
This is where the weighing system comes into play.
Tests like no postmaster and no abuse fail every message from
systems
like aol.com, msn.com, earhtlink.net, etc,etc... So they will appear as
SPAM
in your logfiles.

You need to use the weighing system / edit your $default$.junkmail and
your
global.cfg to meet your needs.

There is no cut/dry solution to spam, I have definitely learned
monitoring
this list that everybody has a different solution that fits their setup.

The great thing about declude/sniffer is their flexibility, great
mailing
lists and frequent updates.

(ex: we completely disabled the no postmaster/no abuse tests in our
system,
they are just too inefficient for our setup, but in other setups they
are
very useful )


-Original Message-
From: Jim Rooth [mailto:[EMAIL PROTECTED]]
Sent: Friday, July 26, 2002 3:18 PM
To: [EMAIL PROTECTED]
Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer


I must be doing something wrong!  I looked at the confirm log and I have
caught almost half of the 20,000 emails as spam.  I have poured through
the
logs though and have only found four obviously legitimate emails that
should
not have been caught.  I fixed that with the myfilter file. Either I am
doing it wrong or the program is great.  I suspect the latter...


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Kratka
Sent: Friday, July 26, 2002 3:08 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Declude and Sniffer

Just curious. How many people are using both Declude Junk Mail and the
sniffer add-on and has it made a difference if yes. I have been
completely
pummeled with Spam and am looking for more options.

Thanks.

Jeff

*
TymeWyse Internet
P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417
tel/fax: (541) 839-6027  -  [EMAIL PROTECTED]
*


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  You can E-mail [EMAIL PROTECTED] for assistance.
You
can visit our web site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  You can E-mail [EMAIL PROTECTED] for assistance.
You
can visit our web site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type

KITHRUP:RE: [Declude.JunkMail] mailfrom failing

[Jim Rooth]

You might make a myfilter.txt entry that gives a negative weight to that
particular domain.  I have a similar problem where  a client uses a
mainframe to send out txt messages.  It fails badheaders and REVDNS
constantly.  I gave it a -15 weight and now the messages go through from
that server.

HTH


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Josh Piche
Sent: Tuesday, July 23, 2002 9:18 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] mailfrom failing

MessageHoping someone can explain this. We're having messages sent to us
from Air Canada, specifically electronic tickets from
[EMAIL PROTECTED],
fail the mailfrom test.  However, an nslookup (using the same dns iMail
uses) for aircanada.ca shows both MX and A records.

Here's the log entries:

07/22/2002 14:44:05 Q527302d7013e817a Msg failed MAILFROM (Domain
AIRCANADA.CA has no MX/A records.).
07/22/2002 14:44:05 Q527302d7013e817a Msg failed REVDNS (This E-mail was
sent from a mail server 206.47.209.234 with no reverse DNS entry.).
07/22/2002 14:44:05 Q527302d7013e817a Msg failed WEIGHT9 (Weight of 17
reaches or exceeds the limit of 9.).
07/22/2002 14:44:05 Q527302d7013e817a Msg failed WEIGHT14 (Weight of 17
reaches or exceeds the limit of 16.).
07/22/2002 14:44:05 Q527302d7013e817a Subject: AIR CANADA - ELECTRONIC
TICKET ITINERARY/RECEIPT
07/22/2002 14:44:05 Q527302d7013e817a From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]

The dns lookup looks like this:

aircanada.canameserver = ns.RezoNet.NET
aircanada.canameserver = ns.InterLink.NET
aircanada.ca
primary name server = ns.InterLink.NET
responsible mail addr = root.ns.InterLink.NET
serial  = 2002072203
refresh = 3600 (1 hour)
retry   = 900 (15 mins)
expire  = 2419200 (28 days)
default TTL = 3600 (1 hour)
aircanada.caMX preference = 30, mail exchanger = mail.q
aircanada.caMX preference = 10, mail exchanger = mail.a
aircanada.cainternet address = 206.45.20.197
aircanada.canameserver = ns.RezoNet.NET
aircanada.canameserver = ns.InterLink.NET
ns.RezoNet.NET  internet address = 198.168.54.8
ns.InterLink.NETinternet address = 198.168.73.8
mail.qc.uunet.cainternet address = 198.168.54.17
mail.qc.uunet.cainternet address = 198.168.54.16
mail.aircanada.ca   internet address = 206.47.209.234

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

DORKZTL:RE: [Declude.JunkMail] declude queue / imail spool problems?

[Jim Rooth]

Do I need to setup the ADULT test in anything save the global config
file?  I haven't seen that one and have had quite a few porn email come
through with a weight of 4 and 6 combined.  I figure if I set 'ADULT' to
15 then nothing porn related should get through with a bounce weight of
20.  Is this correct thinking?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, July 18, 2002 1:54 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?


We do get lots of dictionary attacks, but they don't actually get in as
files do they?

That depends.  If you have a nobody alias, they do come in as files,
and 
are processed by Declude.  If you do not have a nobody alias, then
they 
will not be processed (by IMail or Declude).

don't the emails to bogus users get rejected before they are
written to a file?

Yes -- if there is no nobody alias.

The part about dead tests sounds interesting.  Below is a list of the
tests
that I am running...

All of those tests are still around, so that shouldn't account for the
problem.

Have you tried looking at the logs to see why there is so much mail?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

KITHRUP:RE: Re: DORKZTL:RE: [Declude.JunkMail] declude queue / imail spool problems?

[Jim Rooth]

Oh well, I was looking for the golden fleece...thanks for your reply.
Back to the drawing board.
  

Darn ATT and their DORKZTL!!

Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
[EMAIL PROTECTED]
Sent: Thursday, July 18, 2002 4:25 PM
To: [EMAIL PROTECTED]
Subject: DSN:Re: DORKZTL:RE: [Declude.JunkMail] declude queue / imail
spool problems?

Jim,

The Adult test is officially undocumented and unsupported.

Scott is the only one that can speak to its original intent, status and
reasoning or any future development if any. But I believe it was a test
idea that Declude, for their own internal reasons, has not continued
or
slowed development on.

The results or detections by that test may not be up to the same level
you
see from the other tests. My testing has shown minimal results though
others
on this list may have seen better results.

my $.02

Stu


At 02:04 PM 07/18/2002 -0500, you wrote:
Do I need to setup the ADULT test in anything save the global config
file?  I haven't seen that one and have had quite a few porn email come
through with a weight of 4 and 6 combined.  I figure if I set 'ADULT'
to
15 then nothing porn related should get through with a bounce weight of
20.  Is this correct thinking?


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Thursday, July 18, 2002 1:54 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] declude queue / imail spool problems?


We do get lots of dictionary attacks, but they don't actually get in
as
files do they?

That depends.  If you have a nobody alias, they do come in as files,
and 
are processed by Declude.  If you do not have a nobody alias, then
they 
will not be processed (by IMail or Declude).

don't the emails to bogus users get rejected before they are
written to a file?

Yes -- if there is no nobody alias.

The part about dead tests sounds interesting.  Below is a list of the
tests
that I am running...

All of those tests are still around, so that shouldn't account for the
problem.

Have you tried looking at the logs to see why there is so much mail?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .



-
CSOnline Technical Support hours - Monday thru Saturday 7am - 1am 
CSOnline Technical Support Numbers Seneca814-677-2447 
   Clarion   814-227-3638  
   Meadville 814-425-1696
   Parker724-399-1158   
http://www.csonline.net  http://www.cshowcase.com
http://www.learncenter.com  

-

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] KITHRUP:One User Account

[Jim Rooth]

Jim Rooth
Klotron, Inc.

 How do I set up just one user account to be able to send multiple
emails?  

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] DORKZTL:DORKZTL

[Jim Rooth]

The DORKZTL is coming from my attbi.com line I use.  My servers are not
listed (at this time!)


Jim Rooth
Klotron, Inc.


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] DORKZTL:DORKZTL

[Jim Rooth]

Yes sir it sure does and a reverse lookup will tell you that it is not a
server used by Klotron but one of ATT.  I sent them a nasty note as I
cannot send purchase orders to a couple of vendors because of them being
listed on four or five lists.  They said they really were not concerned
at this point in time.

I'll go you one better...I get a 'page not found now when I go to
DNSstuff.com!  I swear it is a communist plot...


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, July 15, 2002 1:00 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] DORKZTL:DORKZTL


The DORKZTL is coming from my attbi.com line I use.  My servers are not
listed (at this time!)

http://www.dnsstuff.com/tools/ip4r.ch?ip=204.127.202.62 shows that it is

listed.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] DORKZTL:Strange

[Jim Rooth]

Normal size is around 1 Mb.  Just a small server with around 5K emails a
day.  All of the emails seem to be coming from the same sender.  The
weird thing is it is not on my email server...it is on a web server that
is not published but used strictly for in house use by a client.  I have
killed the SMTP service on it in hopes of stopping it for the time
being.  All the Bad emails and queued emails were on the web server and
not the email server.  There is no reference of an email on the web
server other than a form that sends it through my email server (one
form.)  I guess that is how it is getting to the email server.

Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, July 15, 2002 1:08 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] DORKZTL:Strange


I have another issue that may or may not be germane here.  I have a
small server running W2K as the OS with Apache and PHP running a
webpage.  The webpage has an entry to an email user on my Imail server.
This morning I noticed my log file hit over 14 Mb in size.

How high is it normally?  If it is normally 10-12 MB, there may be no 
problem.  If is is normally 1-2 MB, you may have a compromised server
that 
a spammer is using to send out spam.

I cleared out over 14,000 bad emails and email in the queue at about
10:00 am today.  Ten minutes ago I cleaned out another 15,000 emails
from the queue.  I also stopped the SMTP service on the server.  Does
anyone have any idea how or what I need to do to stop this monster?

The first step is to identify the monster.

To do that, I would open some of those 10,000's of E-mails, and see who 
they are from/to.  If they are all from/to the same user, there may be a

mail loop.  More likely, a spammer has found a way to send spam through 
your mailserver.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] DORKZTL:Strange

[Jim Rooth]

I can't tell you as I apparently don't have it configured properly yet.
The DECCON log told me at 0930 that I had 1536 emails, with 873 Spam.  I
clicked it close when doing something and it didn't come back on.  I
started it again an hour ago and I just now checked it and it said
0,0,0,0  so I have another issue as well.  Oh, I forgot the one about
the boss yelling about how he spent $700 to get an email this morning
about an adult porn site!  I told him he should invest some time in it
and leave me alone so I could figure out how to help his spam situation.


Jim Rooth
Klotron, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Monday, July 15, 2002 1:12 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] DORKZTL:Strange

If you have Declude Hijack loaded and configured, what does the Deccon
log say?

John Tolmachoff
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com

I have another issue that may or may not be germane here.  I have a
small server running W2K as the OS with Apache and PHP running a
webpage.  The webpage has an entry to an email user on my Imail server.
This morning I noticed my log file hit over 14 Mb in size.  I just
loaded Declude Hijack and Declude Junk Mail on the server Saturday.  I
have been running Declude Virus for quite some time.



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---


---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.375 / Virus Database: 210 - Release Date: 7/10/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Analyze IMail log program?

[Jim Rooth]

There is a beta program on Ipswitch that will do that I believe.  It
hasn't been released as a full blown program but it does work to count
the amount of emails each domain has.  I do not know if it will narrow
down incoming or outgoing.  It can be located at
ftp2.ipswitch.com/pub/beta  It is called Imailbetalog1.exe  Hope this
helps. 


Jim Rooth

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Helpdesk
Sent: Wednesday, May 15, 2002 11:06 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Analyze IMail log program?

Does anyone know of or use a program that would analyze the IMail log
file
to determine which domains were sending the most mail to the IMail
server
(after Declude JunkMail filters out most of the spam messages)?

I was checking the JunkMail logs and noticed a lot of messages from 2
domains that were only failing one test (spamheaders). Since that was
all
they were failing the messages were going through. Investigating the
domains
in older logs I noticed all the messages were spam, so I blacklisted the
domains. If I had a program that went through the IMail log and and gave
me
a report or screen that reported ...

850 messages from currentmail.com
510 messages from emailfactory.com
312 messages from spamemail.com
200 messages from hotmail.com

I'd know those messages made it through JunkMail and it's tests. I could
then investigate the messages from currentmail.com more easily than
manually
scanning/remembering the thousands of domains in a 40k JunkMail log
file.

Thanks,
Greg

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.361 / Virus Database: 199 - Release Date: 5/7/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.361 / Virus Database: 199 - Release Date: 5/7/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Hijack question

[Jim Rooth]

The new beta file from IMAIL will do that on your IMAIL server...thus
not using the firewall  I can see all mail numbers by IP or domain.  Not
as sophisticated as Declude but works until Declude comes along with
something better(which I have no doubt will happen!)


Jim Rooth

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Monday, April 22, 2002 9:50 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Hijack question

Good morning all.

Declude Hijack tracks the number of outgoing e-mail by IP address.

But what about an office, such as ours, that uses a firewall with a DMZ,
where the Imail is in the DMZ and the internal network uses NAT.

Therefore, Declude Hijack sees all the users from the internal network
as one IP address, that of the IP address of the firewall.

Here is the exact setup:

MS ISA server three homed in a DMZ setup.

IP of DMZ NIC on ISA is x.x.x.5.
IP of Internal NIC on ISA is 192.168.10.5
IP of Imail Nic is x.x.x.17.

Imail receives the e-mail as if it came from the DMZ NIC and lists the
from address as x.x.x.5.

The problem can arise with many users on the internal network sending
e-mail, whereas Declude Hijack sees all those messages as one user.

I do not want to allow that IP, as I do want the protection that Hijack
brings. For example, we had a developer use a program that was
designed to send out bulk e-mail. Of course Hijack caught it. But it
also caught every other e-mail going out from all other uses in the
office.

Is there a way for Hijack or Imail to get the IP address one step back?

John Tolmachoff 
IT Manager, Network Engineer
211 E. Imperial Hwy., Suite 106
Fullerton, CA  92835
714-578-7999, ext. 104
[EMAIL PROTECTED]
www.reliancesoft.com
 
 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.351 / Virus Database: 197 - Release Date: 4/19/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.351 / Virus Database: 197 - Release Date: 4/19/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Relaying configuration WAS HELP: I just got listed on ORDB

[Jim Rooth]

I got a 10K zip file that contained a
readme.txt and a fpipe.exe





Family, God, and Corps...all else are mere details

Jim Rooth
http://www.usmcfew.com/3516 



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Shacklett
Sent: Monday, April 01, 2002 7:42
AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Relaying
configuration WAS HELP: I just got listed on ORDB





I tried to download this
a few moments ago, and got an empty zip file. Would someone else try this and
let me know what you get, please?















-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Scott MacLean
Sent: Sunday, March 31, 2002 8:44
PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
Relaying configuration WAS HELP: I just got listed on ORDB

I used FPipe - it's free:

http://www.foundstone.com/knowledge/assessment.html

As far as I know, it should be able to do it for port 80 as well. I've had it
running for several months with no problems at all, with a fair amount of
traffic across it.

At 07:56 PM 03/31/2002, Timm Jasper wrote:




Scott MacLean Writes:

 I got around the SMTP filtering issue by setting up a small daemon
on my server that accepted connections on port 125 (could be any port, I 
 just picked 125) and redirects the connection to port 25. It's
multi-threaded and lets people connect directly to your server to send mail
even 
 if their port 25 is blocked by their ISP.

What was the program, and will it do the same for port 80? ie: web messaging

-- Timm Jasper
-- Systems Administrator
-- TQCi Internet
-- 301-863-6121 



___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com








---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.343 / Virus Database: 190 - Release Date: 3/22/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.343 / Virus Database: 190 - Release Date: 3/22/2002
 

RE: [Declude.JunkMail] HELP: I just got listed on ORDB

[Jim Rooth]

I have a question then.  I have a small setup (only two IP's with maybe
1000 users).  If I set up relay for addresses, what happens if someone
tries to send an email from their home?  We have web access available as
well.

I understand it works great as long as all mail is sent through the SMTP
with the address listed in the 'relay for addresses' but will it block
email if they are using another computer at a different location or does
it pick up only from the SMTP server?

Family, God, and Corps...all else are mere details

Jim Rooth
http://www.usmcfew.com/3516 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry
Sent: Saturday, March 30, 2002 3:17 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] HELP: I just got listed on ORDB

What he said is that relay for addresses and no relay are the only
two
options that protect your mail server from being an open relay--the
other
options do not.  You can use the no relay option if you are using SMTP
Auth, otherwise, relay for addresses is the way to go.

Bill

-Original Message-
From: Bennie [mailto:[EMAIL PROTECTED]]
Sent: Saturday, March 30, 2002 10:20 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] HELP: I just got listed on ORDB


Scott,

Are you saying that relay for address is not a good idea.. We have
customer that has a static IP address with a different provider but we
provide their mail and webspace.
I have their Static IP listed in my allowed addresses

Bennie


- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, March 28, 2002 10:23 AM
Subject: Re: [Declude.JunkMail] HELP: I just got listed on ORDB



 I have my IMail set to Relay for local hosts only

 To make sure that you are not an open relay, you can either use
IMail's
 Relay for addresses (in which case you would enter a list of safe
IP
 addresses that your users may come from; anyone not coming from those
safe
 IPs would need to use SMTP AUTH), or No mail relay (which really
means
 that everyone must use SMTP AUTH).  Note that relay setting apply only
to
 outgoing E-mail, so no matter what your settings are, your users will
still
 be able to get mail.

 Any other relay options will allow spammers to send mail through your
 server.  In the case of Relay for local hosts, IMail will allow
spammers
 to send unlimited spam if they pretend to be using a return address on
one
 of your domains.

 Are you running Declude Hijack (which would limit the amount of mail
that
a
 spammer could send)?
  -Scott

 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---

 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  You can E-mail
 [EMAIL PROTECTED] for assistance.  You can visit our web
 site at http://www.declude.com .
 ---
 [This E-mail scanned for viruses by Declude Virus]





---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.343 / Virus Database: 190 - Release Date: 3/22/2002
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.343 / Virus Database: 190 - Release Date: 3/22/2002
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .