Re: [Declude.JunkMail] multistage filtering [OT]

2010-02-10 Thread Ncl Admin 
Alligate  Alligate Alligate

At 12:28 PM 2/10/2010 +0100, you wrote: 

Hi,


With the amount of spam I have to throw away each day no reaching consistant levels of over 90%... I can of course get an even faster mailserver but I think I would be better of with an extra smtp server in front of my mailserver which filters the most blatant spam mail purly based on session info. What passes that server can go on to my IMail server and have more contect based filtering using Declude, Sniffer, InvURIBL etc.


What would be a good first step server? I have experience with (Debian) Linux so a Linux based solution is no problem.


Met vriendelijke groet,
Bonno Bloksma
senior systeembeheerder

tio 
hogeschool hospitality en toerisme 
begijnenhof 8-12 / 5611 el eindhoven
t 040 296 28 28 / f 040 237 35 20
b.blok...@tio.nl / www.tio.nl 



-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] CBL:IP is Blacklisted

2009-02-13 Thread Ncl Admin 
Well Alligate should most definitely be in your plan.  I run it, cuts
server hits
by over 90%, is cost effective. Cuts Virus by nearly 99% as bots don't get
through
I tried SM as well as microsoft.  Best thing I have ever tried was Alligate.

Works well with Declude and they even have something coming out together.
Guess
SM has nice web interface now tho.  


At 01:34 PM 2/13/2009 -0600, Todd Richards wrote:
>Thanks Craig.  I have on my budget an upgrade for our mail server - not sure
>yet whether I'm sticking with Imail or going to SM.  Just sucks that it is
>suddenly happening and I probably need to do it sooner rather than later.  I
>don't know anything about Alligate and don't know whether that should be in
>my plan regardless of what I upgrade to.  So I don't know if I should waste
>time putting that in as a work around for now.
>
>Todd
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig
>Edmonds
>Sent: Friday, February 13, 2009 11:33 AM
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>
>I had this problem too  and I have imail 8.15 so the stupid fix does not
>apply to me either.
>
>Therefore I had the choice (or rather the ultimatum from CBL) to either
>upgrade Imail or use a smtp gateway.
>
>So I now use Alligate as an smtp server.
>
>It funny...notthat they "used" to whitelist imail users, now they dont,
>they just give you the ultimatum even when you can prove that your server is
>legit and well protected.
>
>The guys at CBL have their heads up theirwell you can imagine it.
>
>
>Kindest Regards
>Craig Edmonds
>123 Marbella Internet Services
>W: www.123marbella.com
>E : cr...@123marbella.com
>
>
>
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd
>Richards
>Sent: 13 February 2009 18:25
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>
>Thanks Andrew.  I just got a note from CBL that says that they are no longer
>automatically removing Imail machines, as there is a fix.  Not sure if my
>older version (8.2x) is part of that fix or what.  Anyway, their message
>said
>
>"The CBL attempts to detect compromised machines in a number of ways based
>upon the email that the CBL's mail servers receive.
>
>During this it tries distinguish whether the connections represent real mail
>servers by ensuring that each connection is claiming a plausible machine
>name for itself (via SMTP HELO), and not listing any IP that corresponds to
>a real mail server (or several mail servers if the IP address is a NAT
>firewall with multiple mail servers behind it).
>
>8.7.193.82 was found to be using several different EHLO/HELO names during
>multiple connections on or about:
>
>2009:02:12 ~21:30 UTC+/- 15 minutes (approximately 19 hours ago).
>
>The names seen included:
>
>   enwcommunity.com, hcaa.com, mail.nnepa.com, p01c11m022.mxlogic.net,
>p01c11m096.mxlogic.net, p01c11m102.mxlogic.net, p01c11m107.mxlogic.net,
>p01c12m013.mxlogic.net, p01c12m062.mxlogic.net
>"
>
>The first two are legitimate virtual domains on our server, the third is our
>server.  But I have no idea where the mxlogic.net names are from?
>
>Todd
>
>
>
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Colbeck,
>Andrew
>Sent: Friday, February 13, 2009 10:56 AM
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>Here's the answer, Todd.
>
>http://www.mail-archive.com/imail_fo...@list.ipswitch.com/msg103112.html
>
>It's an old problem with CBL and IMail. Certainly, CBL is at fault and
>by now they should have at least taken up SPF record checking to weed
>out false positives. I just checked your SPF record and it is valid, so
>this would have helped you.
>
>
>Andrew.
>
>
> 
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd
>Richards
>Sent: Friday, February 13, 2009 8:42 AM
>To: declude.junkmail@declude.com
>Subject: RE: [Declude.JunkMail] CBL:IP is Blacklisted
>
>
>OK, Sorry to cry wolf.  I sent them an email directly (which is what
>they
>said to do if you are running Imail) and it appears that they have us
>removed already.  Not sure why/how we got added, if it has anything to
>do
>with Imail (as they suggest) or what.  I'm running several misc. scans
>on
>our server to be sure we don't have a problem.  Any other suggestions of
>how/why, or what to check are always appreciated!
>
>Todd
>
>
>-Original Message-
>From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd
>Richards
>Sent: Friday, February 13, 2009 10:13 AM
>To: declude.junkmail@declude.com
>Subject: [Declude.JunkMail] CBL:IP is Blacklisted
>
>Hi  Everyone -
>
>Late yesterday I started seeing some bounces that our IP address was
>being
>rejected because of the following:
>
>   RCPT TO generated following response:
>   5

Re: [Declude.JunkMail] Help Me Add Weight

2009-02-10 Thread Ncl Admin 
I would add country weight as well. There used to be examples that work.  I
actually weight yahoo.com.XX as well.


At 01:20 PM 2/10/2009 -0500, Pete McNeil wrote: 

Robert Grosshandler wrote: 
   
 
Sounds like a spam headline, doesnt it?
 
 
 
Anyway, were getting obvious spam, but were not able to weight it enough
to block it.  Any tests you might suggest.  The following came to us BCCd,
I believe.  Nothing about it was appropriate for us.
  


  

X-RBL-Warning: SNIFFER: Message failed SNIFFER: 60.
 
X-Declude-Sender: scp...@yahoo.com.ar
[173.15.150.165]
 
X-Declude-Spoolname: Dccef01a2279a.smd
 
X-Declude-RefID: str=0001.0A010203.498BCCF8.0197,ss=1,fgs=0
 
X-Declude-Scan: Incoming Score [11] at 23:39:07 on 05 Feb 2009
 
X-Declude-Fail: UCEPROTECT-1 [4], SNIFFER [12], WEIGHT9 [9], WEIGHTMID
[10], ZEROHOUR [0]
  
I'm biased, but you might increase the weight you add for SNF -- I note it
did fail the message.

Most systems seem to weight SNF so that SNF + any other test will hold a
message.

Many hold on SNF alone.

Given that general practice, adding weight to SNF might solve this problem
for you.

_M



-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.





-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SMTPd32.exe failing. Faulting application ntdll.dll

2009-01-26 Thread Ncl Admin 
I suggest you google.com smtp and ntdll.dll.  Seems this is fairly common.

At 10:31 AM 1/26/2009 -0700, Dale McDiarmid wrote:
>That's going to be tricky. The outages are random, sometimes not  
>happening for 24 hours or more. We went most the weekend without  
>failure then had two this morning.
>
>Going without spam or virus protection for a few days or more would be  
>a hardship on everyone in the company.
>
>At this point I'd consider paying for Ipswitch's Plus package to  
>replace Declude's.
>
>But that's $1000 on an experiment that might not work.
>
>Thx,
>D.
>
>
>On Jan 26, 2009, at 9:54 AM, David Barker wrote:
>
>> Remove Declude from the process. If the SMTPd32.exe still faults  
>> this would
>> help verify that the problem is associated with Ipswitch. However the
>> ntdll.dll is a windows OS .dll and there could be a specific  
>> variable on
>> your server that is causing this issue in which case it may not be  
>> either of
>> the vendors.
>>
>> David B
>>
>> -Original Message-
>> From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of  
>> Dale
>> McDiarmid
>> Sent: Monday, January 26, 2009 11:47 AM
>> To: declude.junkmail@declude.com
>> Subject: [Declude.JunkMail] SMTPd32.exe failing. Faulting application
>> ntdll.dll
>>
>> Hello...
>>
>> Beginning late last week we're experiencing periodic SMTP failures.
>> Error log shows: Faulting application SMTPd32.exe, version 8.11.6.0,
>> faulting module ntdll.dll version 5.2.3790.1830.
>>
>> Ipswitch tech support updated my system to 10.02 (I was at 9.04 when
>> it all began). Declude tech support also updated my Declude.
>>
>> But the problems persist. Now Ipswitch is blaming Declude, and Declude
>> it blaming Ipswitch. Both saying pretty much the say thing "There's no
>> way our program could cause this. We've seen this before and always
>> been the other guy".
>>
>> While tech support at both Ipswitch and Declude have been very good,
>> as always, I'm stuck with both sides giving up.
>>
>> Any suggestions?
>>
>> Thx,
>> D.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to imail...@declude.com, and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>
>-
>This information is intended only for the use of the individual or
>entity named above. 
>
>If you are not the intended recipient, you are hereby notified that
>any disclosure, copying, distribution, or action taken in reliance
>on the contents of these documents is strictly prohibited. If you
>have received this information in error, please notify the sender
>immediately and arrange for the return or destruction of the 
>document(s).
>
>Warning: All e-mail sent to or from this address will be received or
>otherwise recorded by the Corporate e-mail system and is subject to 
>archival, monitoring or review by, and/or disclosure to, someone other
>than the recipient.
>
>


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SMTPd32.exe failing. Faulting application ntdll.dll

2009-01-26 Thread Ncl Admin 
I suggest you google.com smtp and ntdll.dll.  Seems this is fairly common.

At 10:31 AM 1/26/2009 -0700, Dale McDiarmid wrote:
>That's going to be tricky. The outages are random, sometimes not  
>happening for 24 hours or more. We went most the weekend without  
>failure then had two this morning.
>
>Going without spam or virus protection for a few days or more would be  
>a hardship on everyone in the company.
>
>At this point I'd consider paying for Ipswitch's Plus package to  
>replace Declude's.
>
>But that's $1000 on an experiment that might not work.
>
>Thx,
>D.
>
>
>On Jan 26, 2009, at 9:54 AM, David Barker wrote:
>
>> Remove Declude from the process. If the SMTPd32.exe still faults  
>> this would
>> help verify that the problem is associated with Ipswitch. However the
>> ntdll.dll is a windows OS .dll and there could be a specific  
>> variable on
>> your server that is causing this issue in which case it may not be  
>> either of
>> the vendors.
>>
>> David B
>>
>> -Original Message-
>> From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of  
>> Dale
>> McDiarmid
>> Sent: Monday, January 26, 2009 11:47 AM
>> To: declude.junkmail@declude.com
>> Subject: [Declude.JunkMail] SMTPd32.exe failing. Faulting application
>> ntdll.dll
>>
>> Hello...
>>
>> Beginning late last week we're experiencing periodic SMTP failures.
>> Error log shows: Faulting application SMTPd32.exe, version 8.11.6.0,
>> faulting module ntdll.dll version 5.2.3790.1830.
>>
>> Ipswitch tech support updated my system to 10.02 (I was at 9.04 when
>> it all began). Declude tech support also updated my Declude.
>>
>> But the problems persist. Now Ipswitch is blaming Declude, and Declude
>> it blaming Ipswitch. Both saying pretty much the say thing "There's no
>> way our program could cause this. We've seen this before and always
>> been the other guy".
>>
>> While tech support at both Ipswitch and Declude have been very good,
>> as always, I'm stuck with both sides giving up.
>>
>> Any suggestions?
>>
>> Thx,
>> D.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to imail...@declude.com, and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to imail...@declude.com, and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>
>-
>This information is intended only for the use of the individual or
>entity named above. 
>
>If you are not the intended recipient, you are hereby notified that
>any disclosure, copying, distribution, or action taken in reliance
>on the contents of these documents is strictly prohibited. If you
>have received this information in error, please notify the sender
>immediately and arrange for the return or destruction of the 
>document(s).
>
>Warning: All e-mail sent to or from this address will be received or
>otherwise recorded by the Corporate e-mail system and is subject to 
>archival, monitoring or review by, and/or disclosure to, someone other
>than the recipient.
>
>


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail]

2008-11-12 Thread Ncl Admin 
It wouldn't create a folder if Imail is set in the domain control panel to not allow that I believe.

Message & Mailbox Options 
Default Maximum Mailbox Size:   byte(s) KB MB GB  
Max. Outbound Message Size:   byte(s) KB MB GB  
Single Message Maximum Size:   byte(s) KB MB GB  
Full Mailbox Notify (percentage):  
Default Maximum Messages:   
Full Mailbox Notify Address:  
Maximum User Count:   
Current User Count: 
Sub-mailbox Creation: Create Send to Inbox Bounce  
Minimum POP Frequency (minutes):  



At 04:32 PM 11/12/2008 -0500, David Barker wrote: 


Not sure why it is not creating the folder as it should do. It should not matter if there is a space or tab used. I would suggest opening a ticket with [EMAIL PROTECTED] m so we can troubleshoot the issue with you.




David Barker




From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Declude Junkmail
Sent: Wednesday, November 12, 2008 11:18 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail]




IMail Version 9.2. (We have the latest but just haven't installed it yet)




It works great and helped me catch one false positive just this AM, but I had to create the mailbox (folder) manually from the web interface. Does it make a difference if that's a space or a tab between MAILBOX and spam? I used a tab.

MAILBOX spam

MAILBOXspam




Can Mailbox be used multiple times such a one folder used for an IP blacklist filter and another used for PDFs? Such as:

IPBLACKLIstMAILBOXBADIPs

FILTERPDFMAILBOXPDF




~Joe

- Original Message - 

From: David Barker 

To: declude.junkmail@declude.com 

Sent: Wednesday, November 12, 2008 8:07 AM

Subject: RE: [Declude.JunkMail] Wish List: Related to Anyone know a tool...




This is how the Mailbox action should work. The MAILBOX action will send an E-mail to a specific mailbox (folder) for the recipient. For example, you can have E-mail moved to a "spam" mailbox that the user can check via web messaging or IMAP (or POP3, by setting up a special account in the format "user-mailbox"). To use it, just include the name of the mailbox to use -- for example, "WEIGHT10 MAILBOX spam".




Are you using SM or IM ?




David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]







From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Declude Junkmail
Sent: Wednesday, November 12, 2008 1:21 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Wish List: Related to Anyone know a tool...




It would certainly be nice if the Mailbox command would create a new folder in a user's account.

Such as
weight22  mailbox   junkmail
where the folder named junkmail would automatically be created.

Or maybe I'm missing something? When I attempted to use this directive in a username.junkmail file, it wouldn't work until I manually created the folder for email to go to.

Maybe someone can point me to a good way to do this.

~Joe







---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

Re: Re[6]: [Declude.JunkMail] DNS Changes

2008-10-09 Thread Ncl Admin 
There is also the question of loss of connectivity from point A to OpenDNS
server #1 which is all that you have if you setup Declude to use a Single
Source DNS server.  If anywhere in that path there is an outage you will
have no DNS.

Far better to learn a little about DNS and run your own. Then you can at
least use several other sources even if you care to set it up to use OpenDNS.

As for $0.01 I have changed that as of recent events to $0.005 as your 401K
has probably gone down that much in recent months.

At 09:01 AM 10/9/2008 -0400, Darin Cox wrote:
>1. The customer has no control over its availability. 
>My $0.01. (decreased due to inflation and other financial considerations, 
>plus being mostly a reiteration of points already made)



-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Reasons to renew

2008-04-02 Thread Ncl Admin 
 
Now there is a good question.


At 10:13 AM 4/2/2008 -0700, you wrote: 


After seeing Matt’s post here about not renewing his JunkMail
subscription. I’m asking Declude to respond to the group as to why any of
us with perpetual licensing. Our SA expires soon and I would like to know
the value of renewing.

 

The updates to Declude have been extremely slow and in some cases painful
since Scott sold out.

 

 

Any idea when ZEROHOUR will be available for use in %TESTSFAILED%

 

 

 

 

 

 

Kevin Bilbee
Network Administrator
Standard Abrasives

3M Simi Valley
[EMAIL PROTECTED]



 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Any Known issues Inv-URIBL today?

2008-02-06 Thread Ncl Admin 


I had that happen after a Microsoft .net update, fixed it by going to the
current version.




At 02:27 PM 2/6/2008 -0500, you wrote:
>
>I know about the old version (blame me) - just haven't found the time to do 
>an upgrade to where we can monitor for an hour or so after upgrading to 
>ensure the success.  Will try and move this to the forefront of our to-do 
>list.
>
>Thanks for the response!
>
>
>
>---
>Randy A.
>Technical Support Director
>Global Web Solutions, Inc.
>804-442-5300
>http://globalweb.net
>
>- Original Message - 
>From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
>To: 
>Sent: Wednesday, February 06, 2008 2:04 PM
>Subject: Re: [Declude.JunkMail] Any Known issues Inv-URIBL today?
>
>
>> Randy,
>>
>> None that I am aware of.  It's processing fine on all of my servers. Also, 
>> version 1.x is very old (several years).  We are now on version 3.1.1.
>>
>> Darrell
>> --
>> Check out http://www.invariantsystems.com for utilities for Declude, 
>> Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
>> SURBL/URI integration, MRTG Integration, and Log Parsers.
>>
>> Randy Armbrecht wrote:
>>> We're seeing a backup today on mulitple occasions now in the Declude Proc 
>>> folder.  Proc folder has grown to as many as 6000+ items in it; once we 
>>> turn off our Inv-URIBL filter, messages start processing again.  .
>>>  Any known issues that would cause this?
>>>
>>> We're still running an older version of Inv-URIBL (1.1x I believe)
>>>  ---
>>> Randy A.
>>> Technical Support Director
>>> Global Web Solutions, Inc.
>>> 804-442-5300
>>> http://globalweb.net
>>>
>>> ---
>>> This E-mail came from the Declude.JunkMail mailing list. To
>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>> type "unsubscribe Declude.JunkMail". The archives can be found
>>> at http://www.mail-archive.com.
>>
>> -- 
>>
>>
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>> 
>
>
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>
>-
>This information is intended only for the use of the individual or
>entity named above. 
>
>If you are not the intended recipient, you are hereby notified that
>any disclosure, copying, distribution, or action taken in reliance
>on the contents of these documents is strictly prohibited. If you
>have received this information in error, please notify the sender
>immediately and arrange for the return or destruction of the 
>document(s).
>
>Warning: All e-mail sent to or from this address will be received or
>otherwise recorded by the Corporate e-mail system and is subject to 
>archival, monitoring or review by, and/or disclosure to, someone other
>than the recipient.
>
>


-
This information is intended only for the use of the individual or
entity named above. 

If you are not the intended recipient, you are hereby notified that
any disclosure, copying, distribution, or action taken in reliance
on the contents of these documents is strictly prohibited. If you
have received this information in error, please notify the sender
immediately and arrange for the return or destruction of the 
document(s).

Warning: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to 
archival, monitoring or review by, and/or disclosure to, someone other
than the recipient.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] F-Prot Licensing

2006-07-14 Thread Ncl Admin 
According to something I read on the Alligate Support forumn at least as
far back as March.  Interesting that they have never issued much of a press
release on it to there customer base.  Tho I licensed mine in Februrary of
this year so I'm good for a bit.



At 12:59 PM 7/14/2006 -0700, you wrote: 


When did Frisk change the licensing for F-prot! They now have a mail server
license for windows on number of users pricing?

 
   

F-Prot Antivirus for Windows Mail Servers
   
  


Number of Users
   

 
   

Annual license fee
   
   

1-24
   

 
   

US$ 269
   
   

25-49
   

 
   

US$ 359
   
   

50-99
   

 
   

US$ 449
   
   

100-199
   

 
   

US$ 719
   
   

200-299
   

 
   

US$ 989
   
   

300-399
   

 
   

US$ 1259
   
   

400-499
   

 
   

US$ 1529
   
   

500-749
   

 
   

US$ 1799
   
   

750-999
   

 
   

US$ 2069
   
   

1000-1999
   

 
   

US$ 2519
   
   

2000-2999
   

 
   

US$ 2969
   
   

3000-3999
   

 
   

US$ 3419
   
   

4000-4999
   

 
   

US$ 3869
   
   

5000-5999
   

 
   

US$ 4499
   
   

 

 

Kevin Bilbee
Network Administrator
Standard Abrasives, Inc.
[EMAIL PROTECTED]

Changing the way industry works. 



 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Trying to install Declude 3.1.20 anew

2006-07-12 Thread Ncl Admin 
At 03:31 PM 7/12/2006 -0400, David Barker wrote:

>As far as I know this still works, although majority of customers do not
>send virus notifications.

What gives you this opinion might I inquire?




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] compatibility question

2006-06-19 Thread Ncl Admin 
Excellent idea, Nick as I also am on 2.x because of the same issues. Frankly, I started to upgrade to 4.x but this doesn't seem like a very good idea for this company.

Not exactly pleased with the solution or lack thereof of progress on resolving basic issues. 

Jay

At 01:04 PM 6/19/2006 -0400, you wrote: 

Hi David [Barker],

Is there a list, or would you kindly post one of the known issues with Declude?  I'm still on 2x because of all the problems reported and what I perceive as them not being resolved.

Thanks!

-Nick


John Doyle wrote: 
@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman" } H1 { FONT-WEIGHT: bold; FONT-SIZE: 16pt; MARGIN: 12pt 0in 3pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: center } H2 { FONT-WEIGHT: bold; FONT-SIZE: 14pt; MARGIN: 12pt 0in 3pt; FONT-STYLE: italic; FONT-FAMILY: Arial } A:link { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline } A:visited { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlinkFollowed { COLOR: blue; TEXT-DECORATION: underline } P.MsoPlainText { FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Courier New" } LI.MsoPlainText { FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Courier New" } DIV.MsoPlainText { FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Courier New" } P { FONT-SIZE: 12pt; MARGIN-LEFT: 0in; MARGIN-RIGHT: 0in; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto } SPAN.emailstyle17 { COLOR: navy; FONT-FAMILY: Arial } SPAN.emailstyle19 { COLOR: navy; FONT-FAMILY: Arial } SPAN.emailstyle21 { COLOR: navy; FONT-FAMILY: Arial } SPAN.EmailStyle23 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply } DIV.Section1 { page: Section1 }   
Robert


I"m running 8.22 hf2 and Declude 4.1.
I would not suggest going to 4.2 as I was getting some "leakage" of mail that seemingly had not 
been scanned by declude. I could not find any record in either the declude, or the virus log files.
I found that the headers had no declude entries. That was version 4.2 Build 12.


I reverted back to 4.09 and the problem resolved itself, I later moved back to 4.1 and things still
are working well. 


I'd stay away from 4.2 until there is a fix.  This was reported as not being an Imail problem, only
smartermail, but I had the same thing happen with Ipswitch. (this is my opinion, I could be wrong)


I have a firewall blocking "broken" and non compliant addresses, but still got maybe
4 or 5 per day out of 200 for my address. So I'm not sure of the root cause. I was most worried about
no record of the email in the virus log. I still can't figure out how they got delivered if Declude didn't 
process the mail.




John




-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Robert Shubert
Sent: Monday, June 19, 2006 8:45 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] compatibility question






Sorry if this is waste of time, but I want to be absolutely sure before I do anything to my server.






Is Declude 4.2 fully compatible with iMail 8.22?






Thanks,






Robert


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com. 

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Windows Gui Ping

2006-06-01 Thread Ncl Admin 
One that I used to use was in Men & Mice Tools and the entire thing is very
useful.  Still use it at home a lot when I am doing certain things.

Jay


At 02:22 PM 6/1/2006 -0700, you wrote: 

A little off topic but I remember seeing a post in the past on a great ping
program on the list but forgot the name. It'll ping a range of ips and
report with it either live or not. 
Any feedback greatly apprecicated.  



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Way OT: Find a virus in my network

2006-04-27 Thread Ncl Admin 
At 10:29 AM 4/27/2006 -0400, you wrote:
>Marc Catuogno writes: 
>
> Anyone have any suggestions short of unplugging one Cat5 cable at a time? 
> 
> Marc 

Why not just scan your network from a XP box using something like
Networkactiv.com PIAFCTM.  Just lock down and look for 445 activity on the
inside of your network.

Then you can find the machine most likely. 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Software for searching junkmail

2006-04-07 Thread Ncl Admin 
> Some folks route spam to an email address that the admin reviews, but that
> is a violation of privacy and not a direction we care to go.

So add this and stop spending so much time worrying.

trailer.txt 
---

WARNING: All e-mail sent to or from this address will be received or
otherwise recorded by the Corporate e-mail system and is subject to
archival, monitoring or review by, and/or disclosure to, someone other than
the recipient.


 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: Re[2]: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking

2006-03-07 Thread Ncl Admin 
Using other's mailing lists for support and public documentation, ldap, VBS
scripts. And free vs. free and both IMHO are equal amounts of spam.

Tarpitting, country blocking and native Win service and about five minutes
of my time.  Sorry and it wasn't just address validation.

Unix sendmail is free as well. Wonder why everyone went to Imail. H.



At 05:29 PM 3/7/2006 -0500, you wrote:
>> Might  be  a  sore  spot for some, but others of us have done that a
>> while back. MS SMTP and all of that stuff was painful. . .
>
>Painful?  Using MS SMTP *just for address validation* was painful? Let
>me ask that again. *Painful*?
>
>OS-bundled  app, huge capacity, simple setup, huge user community. . .
>painful.
>
>Spamvertised app, commercial pricing. . . wonderful.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking

2006-03-07 Thread Ncl Admin 
Might be a sore spot for some, but others of us have done that a while
back.  MS SMTP and all of that stuff was painful and the solution you are
going to seems to work flawlessly for us.  Has cut the load that we have on
the Imail/Declude Server a bunch.

And I plan to expand the thing to a couple of more backup Gateways on
different Class "C"'s when I get some free time.



At 02:03 PM 3/7/2006 -0500, you wrote: 

This might be a sore subject with some around here, but I am going to swap
out MS SMTP/ORF for Alligate very soon. 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spammer IP Range

2006-01-04 Thread Ncl Admin 
Perhaps you/others might want to add this url to your toolbox.

http://ws.arin.net/whois/?queryinput=198.145.23.0

Palin Aquisitions Inc. PALIN-198-145 (NET-198-145-0-0-1) 
  198.145.0.0 - 198.145.255.255
MRC Marketing 198-145-23-0 (NET-198-145-23-0-1) 
  198.145.23.0 - 198.145.23.255

# ARIN WHOIS database, last updated 2006-01-03 19:10


At 03:13 PM 1/4/2006 -0600, Dave Beckstrom wrote:
>We're seeing spam from 198.145.23.1 - 198.145.23.254
>
>
>This link will show you some of the other domains they're using.  
>
>http://www.senderbase.org/search?searchBy=organization&searchString=Universi
>ty%20of%20Portland
>
>
>Funny thing is the IPs are supposed to belong to the university of Portland.
>Why mark123inc.com has their own name servers on a Universities IP block is
>a mystery to me.
>
> 
>
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>
>---
>[This E-mail was scanned for viruses by Declude EVA www.declude.com]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Ping

2005-12-16 Thread Ncl Admin 
At 04:59 PM 12/16/2005 -0500, Barry Simpson wrote:
> Pong
>
>Shhh

Which is a relief :-)it's cold.


---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] F-prot

2005-11-29 Thread Ncl Admin 
I just opened a window and sat there it finally downloaded took a  while.



At 05:19 PM 11/28/2005 -0800, Kevin Bilbee wrote: 

Same problem here. I get an "Internal Server Error"
  


Kevin Bilbee
 -Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Richard Farris
Sent: Monday, November 28, 2005 4:48 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] F-prot

Anyone using F-Prot for antivirus...they just came out with a new update and I have been trying all day to get there to update with no luck...anybody else see this?


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet





[This E-mail scanned for viruses by F-Prot]
--- [This E-mail was scanned for viruses by Declude EVA www.declude.com]
--- This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail".  The archives can be found at http://www.mail-archive.com.

RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10

2005-10-25 Thread Ncl Admin 
At 02:47 PM 10/25/2005 -0500, you wrote:
>Something changed at the time the new architecture came out.  Either folks
>started using a lot of new / broken clients, or Declude became more
>sensitive.

In my opinion a lot of broken clients started happening. Whereas I beta
tested the new version on my backup server I have never changed to the new
version on my old server and I am seeing large numbers of the broken
clients with no changes in my old declude setup.

Jay


[This E-mail scanned for viruses by F-Prot]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Authenicated User

2005-10-12 Thread Ncl Admin 
I am having a problem with an authenicated user that has an IP that is
major big-time on the spam lists.  Is there anyway to strip off his
originating ip info and not pass it along?

Guess that T-Mobile has finally started at least cleaning up there address
space but this person needs to get his email flowing and uses that service
for roaming internet.


[This E-mail scanned for viruses by F-Prot]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] 3.0.4

2005-09-16 Thread Ncl Admin 
If files are not moving from proc to work make sure you downloaded the
right version, I grabbed smartermail version this AM and it does exactly
nada under Imail.  Duh. Got the Imail version and of course its running now.


[This E-mail scanned for viruses by F-Prot]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] OT - iMail 7.x and Windows 2003

2005-09-07 Thread Ncl Admin 
I think that the exploit is in imail 7.07 and not in your server do a
google on
imail 7.07 exploit.

So you most likely would need to upgrade to 8.2 series. Tho the exploit
isn't in 8.15 I don't believe. BTW they do seem to have some interesting
pricing going on if you google imail deals depending on your number of
domains and users.


At 12:43 PM 9/7/2005 -0700, you wrote:
>We are about to build a new server using Windows 2003.  The reason is that 
>we were apparently attacked through the iMail IMAPI exploit.  The last of 
>whatever got in seems to be running in a very effective stealth mode 
>because nothing seems to be able to find it and kill it.  As a consequence, 
>our sever reboots anywhere from every 10 minutes to every 45 minutes.
>
>So = new server.
>
>We have been running iMail 7.07 under windows 2000.  We had some input that 
>there may be some problems in this environment.  We are not keen on 
>upgrading to 8.x since IPSwitch is walking away from iMail the product.
>
>Can anyone comment on this possible incompatibility?
>
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>[This E-mail scanned for viruses by F-Prot]
>
>
>
[This E-mail scanned for viruses by F-Prot]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] OT: Trouble with HotMail

2005-08-03 Thread Ncl Admin 
http://www.dnsreport.com/tools/dnsreport.ch?domain=martek.net

Fix all of your problems.

Your Nameservers aren't working.



At 01:24 PM 8/3/2005 -0500, you wrote: 



One of my domains is having trouble sending email to HotMail.  I have a reverse record and spf record setup for the offending domain.  Do you guys know what HotMails requirements are of if they have a test page available like AOLs?




Thanks,

Evans Martin




[This E-mail scanned for viruses by F-Prot]
--- This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail".  The archives can be found at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude Woes

2005-07-29 Thread Ncl Admin 
Or you could just block the IP's in Imail from which the attacks are coming...or in your router.

At 05:18 PM 7/29/2005 -0400, you wrote: 

Easy way to find out if it is dictionary attacks:  count the number of times "ERR * invalid user" appears in a single day's log.  I wouldn't be surprised to see 100,000 of them if it is a dictionary attack.  In the search string, you can replace the "*" with the OHN of your mail server if you want, but I search with the wildcard to make sure in case it uses the hostnames of other IP'ed hosts on my system.  If you find that there aren't a HGE number of these in the logs, then Matt is right and IMGate might not solve your problem.  But if there ARE a HGE number of these, a gateway is the answer.
  
Dan Horne

--
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, July 29, 2005 2:12 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Declude Woes

Michael,

Just to clarify one issue here that is important to understand in this context.  If Will's server has no nobody aliases, and all of the E-mail that it accepts is hosted on that same box, then he shouldn't be seeing any issues from "dictionary attacks".  It's when you meet either one of those conditions that you are at severe risk for being brought down by one of them.

IMO, installing IMgate (Postfix config) or some other pre-scanning gateway does have other advantages as well, but given the information that Will has provided, I don't believe that dictionary attacks aren't an issue here, and he does has issues that a gateway wouldn't fix and they should be looked at first before throwing in another box as that other box might not be necessary or fix the overall problem.

Matt



Michael Jaworski wrote: 
@font-face { font-family: Tahoma; } @font-face { font-family: Verdana; } @page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } A:link { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline } A:visited { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlinkFollowed { COLOR: blue; TEXT-DECORATION: underline } P.MsoAutoSig { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } LI.MsoAutoSig { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } DIV.MsoAutoSig { FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Times New Roman" } PRE { FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; COLOR: black; FONT-FAMILY: "Courier New" } SPAN.emailstyle18 { COLOR: navy; FONT-FAMILY: Verdana } SPAN.emailstyle21 { COLOR: navy; FONT-FAMILY: Arial } SPAN.emailstyle22 { COLOR: navy; FONT-FAMILY: Arial } SPAN.emailstyle23 { COLOR: navy; FONT-FAMILY: Arial } SPAN.EmailStyle24 { COLOR: navy; FONT-FAMILY: Arial } DIV.Section1 { page: Section1 }  
I can second the need for a gateway defense when under attack. We run a Windows shop and were being crushed under multiple dictionary attacks for two domains on a daily basis. I took the daunting task to build our first Linux box running Postfix.  The first box was a tough start though I had a employee who had Linux experience. We are running Postfix on OpenBSD 3.6 with MySql for dynamic update ability. (I am still working on grabbing additions, updates and deletions from SmarterMail admins so we can throw all our domains in Postfix and update in realtime) After a few weeks we added a second box in the event the first box went down. The second box was a breeze since it was basically a duplication. Both mx records now point at the two boxes. The hardware was old 500Mhz and 1ghz cpu with 512mbs of ram each. The 1ghz is primary and takes 75% of the load without much effort with plenty of free memory. The whole setup allows the main server running SmarterMail/Declude Pro/Sniffer/F-Prot to respond quickly to POP, web mail and smtp traffic requests. 


The Linus approach only should cost you some time and old equipment as the software is free. Our experience over the last two years showed it was worth climbing the short Linux learning cliff. And it is true ... they run forever


One important note not related to using a gateway: We never bounce spam e-mail back to the "sender". The backscatter traffic can kill you and skew your reports.


Michael Jaworski
Puget Sound Network, Inc.
(206) 217-0400
(800) 599-9485
--
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Will
Sent: Friday, July 29, 2005 9:38 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Declude Woes




Well, Im back at it today.






Yesterday I disabled Declude early in the day and started working mail ba

RE: [Declude.JunkMail] Declude 2.x

2005-03-04 Thread Ncl Admin 
Right, so they have to make it so that we can account for this which is what 
they didn't do when they made the change in 2.0 as we do know what the account 
name is, however, if you don't have pro version that is even a bigger issue.  
Not a problem for me, but perhaps others.

---
Network Administrator
[EMAIL PROTECTED]


-- Original Message --
From: "Kevin Bilbee" <[EMAIL PROTECTED]>
Reply-To: Declude.JunkMail@declude.com
Date:  Thu, 3 Mar 2005 14:48:31 -0800

The copy all account is added before the message is passed ot declude so
declude should not know the difference.


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Ncl Admin
> Sent: Thursday, March 03, 2005 2:34 PM
> To: Declude.JunkMail@declude.com; Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] Declude 2.x
>
>
> At 04:40 PM 3/3/2005 -0500, Andy Schmidt wrote:
> >I generally agree that the new function is desirable. Now we just need to
> >figure out how to implement it "robustly".
> >
> >E.g., when Declude modifies the "envelope" to the new "route-to"
> address, it
> >may have to "remember" that new recipient so that it can reference it in
> >case it later encounters a DELETE action.
> >
> >Or, to reverse that logic, let the ROUTETO remember the "new" recipient -
> >but don't actually update the envelope until Spam processing for
> that user
> >is complete.
>
> The problem is the COPYALL account as it will always be HELD rather than
> have SPAM deleted as it always fails enough HOLD actions prior to DELETE
> weight.
>
> And as the COPYALL isn't a "real" part of the "envelope" it most likely
> causes more problems since it is added somewhere in IMAIL as a seperate
> addressee.
>
>
> [This E-mail scanned for viruses by F-Prot]
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
[This E-mail scanned for viruses by F-Prot]


 

[This E-mail scanned for viruses by F-Prot]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude 2.x

2005-03-03 Thread Ncl Admin 
At 04:40 PM 3/3/2005 -0500, Andy Schmidt wrote:
>I generally agree that the new function is desirable. Now we just need to
>figure out how to implement it "robustly".
>
>E.g., when Declude modifies the "envelope" to the new "route-to" address, it
>may have to "remember" that new recipient so that it can reference it in
>case it later encounters a DELETE action.
>
>Or, to reverse that logic, let the ROUTETO remember the "new" recipient -
>but don't actually update the envelope until Spam processing for that user
>is complete.

The problem is the COPYALL account as it will always be HELD rather than
have SPAM deleted as it always fails enough HOLD actions prior to DELETE
weight.

And as the COPYALL isn't a "real" part of the "envelope" it most likely
causes more problems since it is added somewhere in IMAIL as a seperate
addressee.


[This E-mail scanned for viruses by F-Prot]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude 2 and DELETE

2005-03-01 Thread Ncl Admin 
At 11:20 AM 3/1/2005 -0500, Goran Jovanovic wrote:
>I put in the 2.0.5 upgrade on the weekend and so far have no seen any
>problems. I did the manual install and copied the declude.exe over, did
>the -diags and then started the SMTP service.
>
>I have looked in the logs but see nothing unusual. What type of problems
>did you spend time fixing?

Instead of deleting bad messages which exceed my weight it captured them.
Then I have to hand process all of them.  It also got a zillion of them
going to my "catchall" account which are normally not there so it was
double the trouble so to speak.

I have to hand process everything between my weight range of hold and
delete to make sure that false positives are not just deleted.  I also then
block spam ip's while I do it which really cuts down on the next batch.

I did send a low priority ticket to declude, as far as I am concerned I did
the auto install and if it needed to fix things from weight to weightrange
it should have done it.  I haven't really currently got the time to re-do
my settings.  But might take a look at it in the near future but I am
moving from Imail to Smartermail so not sure I should allocate the time.

Jay


[This E-mail scanned for viruses by F-Prot]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude 2 and DELETE

2005-03-01 Thread Ncl Admin 
At 02:54 PM 3/1/2005 +0100, Erik wrote:
>After many emails to Declude about this, they confirmed to me this IS a
>problem and one of not a high priority to fix.  We've reverted back to 1.82
>until it's fixed.

We have as well.  I just tried 2.05 yesterday and spent 1 1/2 hours fixing
stuff this morning. Clearly the upgrade is still not working very well.


[This E-mail scanned for viruses by F-Prot using Declude Anti-virus ]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Problems with msn and hotmail

2005-01-24 Thread Ncl Admin 
Anyone seeing odd problems with hotmail and msn.com accounts being rejected.

I have a number of valid email's that are being rejected.

1:24 13:00 SMTPD(61d200c101cc4412) [66.162.138.13] connect 65.54.168.114
port 60403
01:24 13:00 SMTPD(61d200c101cc4412) [65.54.168.114] EHLO hotmail.com
01:24 13:00 SMTPD(61d200c101cc4412) [65.54.168.114] unacceptable mail
address in MAIL FROM:<[EMAIL PROTECTED]>

I am seeing fairly large amounts of these sometimes they mention something
about RFC's. Sometimes not. Almost looks like they are in the kill.lst but
they aren't.

Ideas?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Unknown error code

2005-01-13 Thread Ncl Admin 
I don't buy this agrument. I use Eudora and don't fail those tests. Did
this message fail those tests?

At 10:55 AM 1/13/2005 -0500, Dave Doherty wrote:
>Hi Scott-
>
>Len says it's common to all versions of Eudora. Is there a way to make an 
>adjustment where the mailer contains "Eudora"? Or is that even a good idea? 
>He also says it's an optional header so it shouldn't matter. Maybe you 
>should communicate directly with Len.
>
>-d
>
>
>
>
>- Original Message - 
>From: "R. Scott Perry" <[EMAIL PROTECTED]>
>To: 
>Sent: Thursday, January 13, 2005 7:06 AM
>Subject: Re: [Declude.JunkMail] Unknown error code
>
>
>>
>>>A message today from Len Conrad at IMGate failed the BADHEADERS and 
>>>ROUTING tests.
>>>
>>>The error code returned by both tests was the same: a004010f
>>>
>>>The lookup on declude.com doesn't know what this means.
>>
>> That code is a combination of two things.
>>
>> The first is as John pointed out:  Len will often use a computer in the 
>> U.S., send mail to someone in the U.S., but relay the mail through an 
>> offshore mailserver.  Perfectly legal, but it will trigger the ROUTING 
>> test (since that is how the majority of spam was sent a couple years ago).
>>
>> The second problem is that the Message-ID: header was bogus, and did not 
>> conform to the RFCs, which caused the E-mail to fail the more serious 
>> BADHEADERS test.
>>
>>-Scott
>> ---
>> Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
>> since 2000.
>> Declude Virus: Ultra reliable virus detection and the leader in mailserver 
>> vulnerability detection.
>> Find out what you've been missing: Ask for a free 30-day evaluation.
>>
>>
>> 
>> This outgoing message is guaranteed to be authentic by Message Level 
>> users.
>> Guarantee the authenticity of your email @ http://www.messagelevel.com.
>> ---
>> [This E-mail was scanned for viruses by Declude Virus 
>> (http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>> 
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?

2005-01-03 Thread Ncl Admin 
At 07:59 AM 1/2/2005 +1100, you wrote:
>Great way to increase sales due to the need to update service agreements.

Anyone that runs production software without service agreements gets what
they deserve. 
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.