Re: [Declude.JunkMail] SpamRouting Broken?

[R. Scott Perry]

Then, does %countrychain% get its info from a different, more correct
source?  It showed Chile in the flow.
That is correct.

The ROUTING test works regardless of whether you have the all_list.dat file 
that is required for the IP->country translation, and as a result, doesn't 
use data that is as accurate.  On the other hand, if the ROUTING test were 
to use the IP->country data, it would have more false positives (for 
example, a company in France that has an office in Germany might get caught 
by the test, whereas it would not given the current setup).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test for message size and return codes

[R. Scott Perry]

Scott, is there a reason why Declude isn't accepting the result code from 
WScript.Quit?  Here's a sample piece of code that I was using to test:

- Global.cfg -
EXTERNALTESTexternal30"C:\IMail\Declude\test.vbs" 
  00

- test.vbs -
WScript.Quit(30)
In theory, that should work fine.

However, I have heard of issues getting VB/VBscript programs to properly 
return an exit code.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Why is this getting thru????

[R. Scott Perry]

I run my own dns server...
Is it listed in the IMail SMTP settings?

I would trying running some tests, such as "ping 2.0.0.127.bl.spamcop.net" 
to see if it is functioning properly (you should see "[127.0.0.2]" in 
response to the ping).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamRouting Broken?

[R. Scott Perry]

RSP> It went from 216.65.3.237 to 164.77.48.71 to your mailserver.  Both those
RSP> IPs are from North America, so the ROUTING test does not get triggered.
However, when I just did a ARIN lookup on 164.77.48.71, it says that
IP belongs to LACNIC. A LACNIC lookup says the IP is located in Chile.
So, the spamrouting test should have failed, right?
Actually, what is happening here is that the IP was originally registered 
through ARIN, and only recently switched to use LACNIC.  In general, the 
ROUTING test tries to determine whether the IP was registered to ARIN, 
APNIC, or RIPE, and works on those three large areas.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamRouting Broken?

[R. Scott Perry]

It looks to me like this e-mail should have failed SpamRouting, but it
passed.  Declude headers show it was routed US--->Chile-->Destination (US).
Using  Pro ver 1.78i31, but upgrading to 1.79 beta momentarily.
Received: from dutch-courage.com [164.77.48.71] by inetconcepts.net
  (SMTPD32-8.05) id AB8A21703BC; Tue, 06 Apr 2004 11:32:10 -0500
Received: from chicky-babe.com (mail4.surgeweb.com [216.65.3.237])
by dutch-courage.com (Postfix) with ESMTP id 6246E890F3
for <[EMAIL PROTECTED]>; Tue, 06 Apr 2004 08:31:24 -0700
It went from 216.65.3.237 to 164.77.48.71 to your mailserver.  Both those 
IPs are from North America, so the ROUTING test does not get triggered.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Why is this getting thru????

[R. Scott Perry]

I received the following email... it only got a weight of 6.
That's why it got through.

When I ran the dnsstuff spam lookup it faild more things than what is 
listed.  I have
my config file at the bottom  I also have the log entries
Something isn't right with your DNS:


Received: from peoplepc.com [163.29.216.1] by mail.pepperlink.net
  (SMTPD32-8.05) id A68C59801EE; Tue, 06 Apr 2004 01:56:28 -0400
X-Declude-Sender: [EMAIL PROTECTED] [163.29.216.1]
Declude JunkMail is seeing the correct IP, but:

X-Spam-Tests-Failed: NOPOSTMASTER, REVDNS [6]
These two tests are failing, which both use DNS, but none of the IP-based 
DNS tests failed (BLITZEDALL, CBL, DSBL, ORDB, or SPAMCOP).

Are you by any chance using your Internet provider's DNS server?  It may be 
that they are blocking these lookups.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] problem with spaces

[R. Scott Perry]

i know it's been discussed before, but isn't there a possibility to add 
something to declude, that deals with preceeding spaces in filters?
Yes, it has been discussed before, and the answer is that it is much more 
difficult to implement than most people realize (it would involve both code 
to be able to detect a method used to identify a space, as well as a lot of 
extra support dealing with it).  It's something that may happen, but isn't 
a high priority yet.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Is it possible to turn logging off?

[R. Scott Perry]

I see many ways to adjust levels of logging, is there any way to 
temporarily turn it off to save processing power?
The best option in this case, if you are sure that you do not want logging, 
is to use "LOGLEVEL WARN".  This will only report warnings and errors to 
the log file, which you really need.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Hijak questions

[R. Scott Perry]

1- A message with 20 recipients, does it count as 1 message or 20 message 
toward the threshold?
It will count as 20 E-mails (since spammers typically operate that way).

2- If a user exeeds therhold 1, and not 2, is there a way to release his 
hold messages at a certain hour, instead than after x Minutes ?
No.

3- Can we set thresholds on size/MB instead of number of messages ?
No.

And answering another question that came up, Declude Hijack will treat 
authenticated users the same as non-authenticated users.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Question about using an equal sign in the wordfilter in Declude

[R. Scott Perry]

I seem to be having issues trying to filter subject or body lines for the 
"=" symbol.

In my wordfilter file, there is a line such as:

BODY 8 CONTAINS style="font-size:1p
I'm not aware of any problems using the "=" sign in filters.  I believe the 
only restricted characters are the % sign (which are used for variables, 
such as %MAILFROM%) and CR/LF characters (used to end the line).

Are any E-mails failing that test?  Are you using Declude JunkMail 
Pro?  Are there any lines after the "BODY 8 CONTAINS style="font-size:1p" 
line?  If so, can the cursor be moved to the line below it (if not, Windows 
can't properly process the last line)?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter not working on Body..

[R. Scott Perry]

This is my filter file(reduced..)

## Filter file Generated from: Adult_words.txt
## To File: ADULT_FILTER.TXT
## On: 1/14/2004
SKIPIFWEIGHT 40
MAXWEIGHT40
SUBJECT   12   CONTAINS   viagra
BODY  12   CONTAINS   viagra
Any ideas why ??
Are any E-mails failing that test?

Are you using Declude JunkMail Pro?  v1.75 or higher?

Are there any lines after the "BODY  12   CONTAINS   viagra" line?  If 
so, can the cursor be moved to the line below it (if not, Windows can't 
properly process the last line)?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude JunkMail v1.79 (beta) released

[R. Scott Perry]

Did you mean "WEIGHT10 COPYFILE C:\Imail\spool\weight10\"?
That is correct.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Microsoft Caller ID in Declude?

[R. Scott Perry]

http://biz.yahoo.com/prnews/040405/sfm030_1.html

Haven't read this thoroughly, but wondering if Declude can claim
to have this or already has a version of this method of qualifying
emails?
It doesn't currently, because SPF is much more popular, but will be 
investigating the Yahoo and Microsoft versions, and seeing if it would be 
worth supporting them as well.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Issue with MAILFROM test

[R. Scott Perry]

I took note that the MAILFROM test was changed in version 1.68 to fail on 
the FQDN, and maybe something else recently happened also, I'm not 
sure.  I've been noticing one to two new false positive senders recently 
though from mostly larger companies, sending E-mail from addresses on 
sub-domains that have been failing.  At least one of these it turns out, 
while it doesn't have an A record for the sub-domain, does have an MX 
record for the sub-domain:

   [EMAIL PROTECTED]
The problem here is that the domain has extremely serious DNS 
problems.  Specifically, if you go to 
http://www.dnsstuff.com/tools/lookup.ch?name=news.stephenking.com&type=MX 
and 
http://www.dnsstuff.com/tools/lookup.ch?name=news.stephenking.com&type=A 
and hit refresh a couple times, you'll see that they have 2 DNS servers 
(ns1.mediatemple.net and ns2.mediatemple.net).  One reports an MX record, 
the other reports that there are none.  One reports that there are no A 
records, the other reports one.

So if your DNS server hits the wrong ones at the wrong times, the E-mail 
will fail the MAILFROM test.

I did note while verifying this a second time just a moment ago, the first 
try resulted in a time out on my local client when checking the MX 
record.  Timeouts are of course a standard occurrence, and it would be 
best if a match was not returned when checking a sub-domain for an MX if 
that is in fact what is happening.  It would be nice not to mix a very 
reliable test, domain.tld exists, with a less reliable test, A or MX 
record exists, because then it's only practical to score according to the 
least reliable set of results.
The test will only fail if the domain has no MX or A records, and will not 
fail if a timeout occurs.

In this case, it is appropriate that the E-mail fail, since 
news.stephenking.com has no MX or A records, per some of their DNS servers.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Declude JunkMail v1.79 (beta) released

[R. Scott Perry]

We have just released Declude JunkMail v1.79 (beta).  See 
http://www.declude.com/junkmail/manual.htm .  Notable changes since the 
last beta include:

o ALL FIX Added code to bypass IMail v8.1's duplicate scanning of 
forwarded E-mails.
o JM FIX Subject filters will now work on both decoded and 
undecoded versions of subject.
o JM FIX Fixes an issue that could force IGNORE action to be used 
if more than 100 tests were defined.
o JM FIX Fixes an issue with an infinite loop that could occur in 
SPF processing with invalid SPF strings.
o JM FIX Fixes an issue that could cause UNKNOWN VAR to appear
o JM ADD COPYFILE action to copy the IMail D*.SMD and Q*.SMD files 
to a specific directory (for example, "WEIGHT10 COPYTO 
C:\IMail\spool\weight10\").

Other additions and fixes can be found in the release notes, at 
http://www.declude.com/relnotes.htm . Anyone with an up-to-date Service 
Agreement is entitled to free upgrades (see 
http://www.declude.com/agree.htm for information on the Declude Service 
Agreement).

---

Quick Resource Reference:

Tech Support:  [EMAIL PROTECTED]
Mailing List: Send E-mail to [EMAIL PROTECTED] with "subscribe 
declude.junkmail your name" in the body
New Releases List: Send E-mail to [EMAIL PROTECTED] with "subscribe 
declude.releases your name" in the body
Troubleshooting: See manual URL above; look at "Troubleshooting" section
Emergency Uninstall:  See manual URL above; look at "Emergency Uninstall" 
section
Urgent Support: urgent @declude.com (for urgent/time-sensitive issues only)
Declude Addons/Tools URL: http://www.declude.com/tools
Manual: http://www.declude.com/junkmail/manual.htm

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Imail 8.1 Trouble

[R. Scott Perry]

if you upgrade to Imail  8.1 it seems Declude will be called and run each
time an email is forwarded. i.e
(".,[EMAIL PROTECTED]")
so if you forward a lot of email from one account to anther you might not
want to upgrade just yet
This was taken care of in the interim release 1.78i31 at 
http://www.declude.com/interim .

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Phishing? (Possible test?)

[R. Scott Perry]

Not knowing enough about the way WHOIS works, could a test be set up that 
would heavily weight any e-mails that come from a "New" domain?  This 
would really help the pill/porn pushers
It's something that we would like to do, but automated WHOIS lookups are a 
Bad Thing.  Domain registrars would freak out if people started using WHOIS 
queries for every E-mail that arrived.  Ironically, the reason for that is 
that spammers love it when they find ways to harvest E-mail addresses out 
of WHOIS queries.  They must figure that people who get their E-mail 
addresses into WHOIS records are prime targets for spam.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Last Action = log line

[R. Scott Perry]

Scott, I'd like to make the case for moving the:

Last action =

log line from the LOGLEVEL HIGH setting down to the LOGLEVEL MED setting.

My rationale being that at the MED level, log items are of a granularity 
appropriate to the entire message, whereas the verbose HIGH setting has a 
granularity at the test level.

That, and it would benefit me personally as I've moved my logging from 
HIGH to MED so as to avoid the "corrupted overlapping log lines"; I find 
that the corruption happens very little at the MED setting.  I've been 
using the "Last action = " line to get quick counts of held spam.
If nobody objects, we'll change it.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Country Chain

[R. Scott Perry]

Yet - the following country chain was reported:

'EU' [corrupt RIPE data]->destination
That's actually a bug at RIPE.  They are claiming that the IP is registered 
to a country with the 2-character abbreviation of "EU".  Apparently, they 
are using that to refer to the European Union, but last I checked, that was 
neither a country nor registered with a 2-character abbreviation.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Gateway and log file questions

[R. Scott Perry]

I am using declude junkmail on two mail gateways for 5 domains, shouldnt
Declude always see mail as outgoing mail? I am seeing this in my logs.
Using [incoming] CFG file D:\IMail\Declude\nat.com\$default$.junkmail.
If you have a file D:\IMail\Declude\nat.com\$default$.junkmail, Declude 
JunkMail will use it for E-mail to the nat.com domain, regardless of 
whether the E-mail is really incoming or outgoing.

I am having trouble with some tests being skipped, how does declude know
what is incoming and what is outgoing in the config and junkmail file?
For outgoing E-mail, the \IMail\Declude\global.cfg file will be used 
*unless* there are per-user/per-domain settings for the recipient.  For 
incoming E-mail the \IMail\Declude\$default$.JunkMail file will be used 
*unless* there are per-user/per-domain settings for the recipient.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] per user settings question

[R. Scott Perry]

Hmmm..., that doesn't quite do what they want.  They have an mailbox
"julie", and nobody is an alias that resolves to julie.  They want different
JM settings for mail specifically addressed to julie versus mail addressed
to no legitimate mailbox (which would get handled through the nobody alias).
For example, if "stephanie" used to work for the company but has been gone
for two years (and her mailbox closed for two years), they want different
settings for stephanie than for julie.
I suppose I could suggest that we create a true mailbox called "nowhere",
make nobody an alias for it, create per-user JM settings for the nowhere
mailbox, and then have the nowhere mailbox forward all mail to julie.
That is exactly what I would recommend.

Will that work?  Would the mail get processed by JM twice?  Once on its way to
nowhere and once on its way to julie?
It should work fine.  If you're using IMail v8.1, you'll probably be stuck 
having the mail scanned twice, though.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Google Gmail.com

[R. Scott Perry]

Anyone think this is a hoax?

They are offering 1 gig of free email space. That is a lot!
It's true (see http://www.google.com/gmail/help/about.html ).  While it is 
huge, they can easily handle it -- they have most of the web pages on the 
Internet cached.

1GB, though, isn't all it's cracked up to be -- I've got close to 200MB of 
posts from the IMail Forum sitting in my mail client.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] per user settings question

[R. Scott Perry]

We have JM Pro, and have a few per-user settings.  Now we have a client with
a "nobody" alias setup to catch all emails that aren't specifically
addressed to one of their mailboxes.  They want custom JM settings for this
nobody alias.  Can we just setup a nobody.jumkmail file like we would for
any regular account?
With aliases, Declude JunkMail looks at the address that the alias resolves 
to.  So if you have the "nobody" alias resolve to 
"[EMAIL PROTECTED]", then you could set up per-user settings for 
[EMAIL PROTECTED] (\IMail\Declude\example.com\nosuchaccount.junkmail).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP

[R. Scott Perry]

I noticed that several RBL's have not been triggered off one of our backup
mail servers over the last 24 hours.  For example SPAMCOP hasn't.  I turned
on "DEBUG" mode and noticed that it was reporting this
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #18 [ORDB] is same as Test
#18 [ORDB=*]. Answer=root.loopback.?
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #19 [SPAMCOP] is same as Test
#19 [SPAMCOP=127.0.0.2]. Answer=root.loopback.?
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #20 [DSBL] is same as Test
#20 [DSBL=*]. Answer=root.loopback.?
Is this a normal answer?
No, that is not a normal answer -- the "Answer=root.loopback.?" indicates 
that the DNS server is responding, but reporting an answer of 
"root.loopback" which isn't correct.  It sounds like your DNS server is 
having problems.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelisting & SPF

[R. Scott Perry]

I'm running 1.78i28.

PREWHITELIST is only entered once in the global.cfg, so no overriding. I
have 7 whitelist lines in the global.cfg, three are IP ranges, three are
domains, and the 7th is an ANYWHERE whitelist. In the Global.cfg,
PREWHITELIST ON is above my WHITELISTs (if that makes any difference?)
No, the order does not make a difference.

In this case, I would recommend using the debug mode.  To use the debug 
mode, you can change the "LOGLEVEL LOW" line in \IMail\Declude\global.cfg 
to "LOGLEVEL DEBUG".  Then, send an E-mail through that should be 
pre-whitelisted, and then you can switch back to "LOGLEVEL LOW" (the debug 
mode adds huge amounts of information to the log file).  You can then send 
me the \IMail\spool\dec.log file (as an attachment off-list, NOT sent 
from web messaging), and I can take a look at it to see what is happening.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelisting & SPF

[R. Scott Perry]

Having added PREWHITELIST ON in my GLOBAL.CFG file, my server still
seems to be running the SPFFAIL test on 'local'/whitelisted IP
addresses. Any ideas?
Are you running v1.70 or later?  Do you also have a line "PREWHITELIST OFF" 
(which could override the ON setting)?  Where exactly is the whitelist (is 
it a WHITELIST IP line in the \IMail\Declude\global.cfg file, which should 
work with PREWHITELIST ON)?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Error #183

[R. Scott Perry]

What I would recommend in this case is searching the IMail SMTP log file 
for references to the spool file name, minus the first character and 
extension.  So with this line:

03/30/2004 22:04:49 Q435810aa00d01c07 WARNING: Could not unlock 
Z:\IMail\spool\_435810aa00d01c07.~MD due to error #183.

you would search the IMail SMTP log file for "435810aa00d01c07".  If you 
find that two incoming E-mails both use the same spool file name, it's an 
IMail bug causing the problem.
  -Scott

At 05:30 PM 3/31/2004, Kornitz, David wrote:
>Below is a log for a single email, the last line indicates that ther was
>an error # 183.
How often is this happening (just this once, occasionally, or for all
E-mails)?
the problem occurs in groups or batches

Did it just start happening?

Over the past month or so.

If so, are you aware of any changes made recently?

Updates are being made to "External Plus Test"

What version of IMail are you running?

7.15 HF3

What version of Declude are you running (you can type "\IMail\Declude 
-diag" from a command prompt to find
out)?

Declude 1.78 (C) Copyright 2000-2004 Computerized Horizons.

Diagnostics ON (Declude v1.78).

The Error #183 means that the file already exists, which means that when
Declude JunkMail went to unlock the file (renaming it from _*.~MD to
Q*.SMD), there was already a Q*.SMD file there).  Most likely, this is a
bug in IMail causing a duplicate file to be used.  This would happen
occasionally on IMail v7.04 and earlier, but I haven't seen it happen since
(and I know you're on a version after 7.04, from the length of the spool
file names).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Help with filter to delete mail

[R. Scott Perry]

Sorry, don't mean to be dense here - I'm learning :)

So I need both:

Imail\declude\mail.mydomainname.com
Imail\declude\mydomainname.com

Or will Imail\declude\mydomainname.com cover both?
That all depends on how your E-mail is set up.  If you just use 
"mydomainname.com" or "mail.mydomainname.com", you can use just the 
one.  But if there are inconsistencies, you would need to use both.

Seems like when I originally set this up I tried just mydomainname.com
and it didn't work - I had to use the mail.mydomainname.com
That's because in your case, you need both -- you've told IMail that the 
real name of the domain is mail.mydomain.com -- but yet you have the 
aliases pointing to mydomain.com.  If you want to use just 
mail.mydomain.com, you would need to change the aliases to point to 
mail.mydomain.com; if you want to use just mydomain.com, you would need to 
change the real name of the domain to mydomain.com.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Help with filter to delete mail

[R. Scott Perry]

The email is going to:

[EMAIL PROTECTED] which is an alias for [EMAIL PROTECTED]
In that case, you need to use \IMail\Declude\mydomainname.com (for aliases, 
IMail gives Declude the domain that the alias points to, rather than the 
official name of the domain).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Help with filter to delete mail

[R. Scott Perry]

It is indeed mail.mydomainname.com, which is also how Imail is setup.
The next question, then, is "Was the E-mail sent to an alias?".  If so, the 
domain used in the alias would be used for the per-domain configuration 
settings.

Do I need to wrap the path in global.cfg with quotes??

BIGELOWSPAM filter E:\IMail\declude\bigelowspam.txt x 5 0
This is the correct entry (with no quotes).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Help with filter to delete mail

[R. Scott Perry]

The full path is:

E:\imail\declude\mail.mydomainname.com\$default$.junkmail
Well, the question then becomes: is "mail.mydomainname.com" the actual name 
of the domain, or a domain alias?  If the actual name is 
"mydomainname.com", then directory should be 
E:\imail\declude\mydomainname.com\$default$.junkmail.  What matters it the 
actual domain name (in the IMail settings).

03/31/2004 14:22:44 Q1a810b6d006cf796 Using [incoming] CFG file 
e:\IMail\Declude\\$default$.junkmail.
What version of Declude are you running ("\IMail\Declude -diag" from a 
command prompt will show you)?  The "\\" in there shows that something 
isn't right (either an old logging bug, or perhaps Declude thinks the 
domain is just "").

Do you have the IMail log file entries for this E-mail?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Help with filter to delete mail

[R. Scott Perry]

That is indeed the case - I think it's reading the base
$default$.junkmail and it's never making it to my
\domainname\$default$.junkmail  where I have it set to delete.
Is "domainname" the actual name of the domain name (if domainname is an 
alias for mail.domainname, then the directory needs to be 
\IMail\Declude\mail.domainname\)?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Help with filter to delete mail

[R. Scott Perry]

But I'm still getting messages through - and if I look at the headers I
can see they've failed the test:
 X-Spam-Tests-Failed: BADHEADERS, HELOBOGUS, IPNOTINMX, REVDNS, ROUTING,
BIGELOWSPAM, WEIGHT10, WEIGHT20 [27]
That means that the test is set up properly, but a different action is 
being used than the one you expected.  From the manual:

---
The wrong action is taken on E-mail
If you find that the wrong action is being taken on an E-mail (for example, 
if you see an X-RBL-Warning: header for a specific test, but you thought 
that E-mail failing that test should be held instead), the most likely 
problem is that Declude JunkMail is not using the configuration file that 
you thought it would use. You can use "LOGLEVEL HIGH" (in the 
\IMail\Declude\global.cfg file) to help here, as Declude JunkMail will 
report to the log file which configuration file it is using.
---

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] cmdspace question

[R. Scott Perry]

Now when I look inthe logs I see this:

03/31/2004 11:32:03 Qf2702a4 Tests failed [weight=5]: CMDSPACE=WARN
03/31/2004 11:32:09 Qf27f25e Tests failed [weight=5]: CMDSPACE=IGNORE
Why do some lines show Ignore, and others Warn??
That's because Declude JunkMail chooses the actions based on each 
recipient, depending whether they are local or remote, and whether they 
have the default, per-domain, or per-user settings.  Since you have 
"CMDSPACE WARN" in the \IMail\Declude\$default$.JunkMail file, the first 
entry above was most likely for an incoming E-mail, whereas the second was 
most likely for an outgoing E-mail (note that the IGNORE action is the 
default action).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Subject filter failure?

[R. Scott Perry]

I was just wondering if there is anyway to catch this, maybe declude is
decoding something?  Should I leave out the "%"? I was just surprised not to
see this fail the filter test.
You should leave out the "%" -- otherwise, Declude JunkMail will assume 
that you are using a variable.

Also, what are the numbers in brackets after the tests now? [2-15-7800]
They are just part of one of the interim releases, and I believe have been 
removed in the latest interim.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Whitelisting & SPF

[R. Scott Perry]

Is PREWHITELIST explained somewhere in more detail?
There isn't much detail to it -- having a line "PREWHITELIST ON" in your 
\IMail\Declude\global.cfg file will force certain whitelists to be run 
before spam tests are run, so that if the E-mail is whitelisted, the test 
do not need to be run.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Whitelisting & SPF

[R. Scott Perry]

I'm getting a lot of fails in the SPF log from my own clients sending
via my server, because I haven't added their dialup ranges into their
SPF records - the SPF records only contain my server range of addresses.
My dialup IPs are all white listed in declude, so with this being the
case, should declude not skip the SPF testing? If not would it be
possible to do so?
To do that, you can add a line "PREWHITELIST ON" to the 
\IMail\Declude\global.cfg file.  With that line, Declude JunkMail will 
prevent tests from being run for many of the various types of whitelists 
(including the WHITELIST IP lines in the global.cfg file).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Error #183

[R. Scott Perry]

Below is a log for a single email, the last line indicates that ther was 
an error # 183.
How often is this happening (just this once, occasionally, or for all 
E-mails)?  Did it just start happening?  If so, are you aware of any 
changes made recently?

What version of IMail are you running?  What version of Declude are you 
running (you can type "\IMail\Declude -diag" from a command prompt to find 
out)?

The Error #183 means that the file already exists, which means that when 
Declude JunkMail went to unlock the file (renaming it from _*.~MD to 
Q*.SMD), there was already a Q*.SMD file there).  Most likely, this is a 
bug in IMail causing a duplicate file to be used.  This would happen 
occasionally on IMail v7.04 and earlier, but I haven't seen it happen since 
(and I know you're on a version after 7.04, from the length of the spool 
file names).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude Logs / Whitelisting

[R. Scott Perry]

1. I've been reviewing the log files and what is the meaning of the 
following log entries:

03/30/2004 00:08:28 Q0ecf080d00fe32c8 L2 Message OK
03/30/2004 18:30:27 Q111b18cd00a62426 L1 Message OK
The "L" means a local recipient (incoming E-mail); an "R" means a remote 
recipient (outgoing).  The number refers to the number of recipients (so 
"L2" refers to the 2nd recipient, which is a local user).

2. How can you disable  or adjust the score for disabling "Bypassing 
whitelisting"?

Bypassing whitelisting of E-mail with weight >=35 (42) and at least 2 
recipients (2).
In your case, I would recommend removing it -- just remove any lines in the 
\IMail\Declude\global.cfg file that mention "bypasswhitelist" in them.  It 
is not normally a recommended option to use.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Crazy Characters

[R. Scott Perry]

Between the words are space like characters that aren't spaces.  I can only
view them using symbol or dingbat fonts and my email client can't even
search for them in a folder of messages.  I'm inclined to make a filter for
them, but I don't know how Declude will react.
Those are high bit (8-bit) characters.  Versions of Declude JunkMail v1.70 
and later will properly process those characters in filters (previous 
versions would not be able to handle them properly in filters).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Store and Forward - Outgoing Actions

[R. Scott Perry]

Wesetup Store and Forward (Imail 8.05, Declude JunkMail Pro) and everything
seems to work correctly.
But, The manual and archives talk about "Outgoing Actions".

We have a declude/domainname.com directory with a $default$.junkmail file.
Do those tests get performed on the outbound email or is there something
special to make them "outgoing" tests?
When an E-mail arrives, Declude JunkMail will use the configuration file(s) 
for the recipients, not the senders.  For E-mail where a recipient is not 
local, Declude JunkMail will use the outgoing actions, which are the ones 
in the \IMail\Declude\global.cfg file.

The \IMail\Declude\example.com\$default$.JunkMail file will be used for 
E-mail *to* an @example.com user, but not for an E-mail *from* 
an  @example.com user.

The outgoing E-mail settings are global, and cannot be changed per domain.

Is Declude JunkMail testing ALL of my outgoing email? I don't think I want
it to, just store and forward email.
In this case, you can have per-domain settings for those domains.  Then, 
the \IMail\Declude\global.cfg file can be set up to use the IGNORE 
action.  That way, regular outgoing E-mail will not be scanned -- but 
E-mail to the store-and-forward domains will be scanned (even though they 
would otherwise be treated as outgoing E-mail, the per-domain config file 
takes priority).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Test not failed.

[R. Scott Perry]

Below is a message that did not fail a filter test, GreyFilter3. What am I
missing that it did not get caught?
Line in GreyFilter3:

HELO5   IS  srv1.eservicesforyou.net

Full Headers:

Received: from srv1.eservicesforyou.net [68.164.114.3] by
mail.eservicesforyou.net
  (SMTPD32-8.05) id A0A32AD30026; Sat, 27 Mar 2004 08:49:39 -0800
It looks like this should have been caught.  Are there any spaces/tabs at 
the end of the line in the filter file?  Is that the last line on the file 
(if so, the cursor needs to be able to go to the line below it, by hitting 
ENTER at the end of the line if necessary)?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] HOLD plus COPYTO

[R. Scott Perry]

> >TEST1 SUBJECT   [Possible SPAM]
> >TEST2 COPYTOC:\Imail\Spool\Spam\CopyHeldForReview
>
> Yes, that would work fine.  The COPYTO action should work
> with all other actions.
COPYTO or COPYFILE ?
Both COPYTO and COPYFILE should work fine with other actions.

I've seen that COPYFILE messages doesn't contain declude headers. Is this
right, or would it be bether to copy the files after declude has added the
headers?
That is correct.  That is because the COPYFILE action copies the file as 
soon as the action is processed, whereas the headers are added after all 
actions are processed (which allows Declude JunkMail to prevent duplicate 
headers and such).

Would it be also possible to have a MOVEFILE action? This would be very
usefull to move messages with very high final weights (eg > 200% of hold
weight) directly in the spam/hold folder instead of moving them manualy (in
spamreview) our automaticaly with an external tool.
That sounds like what we are looking to do with the HOLD action, making the 
hold directory configurable.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Redirecting junkmail files

[R. Scott Perry]

If you are redirecting for a gatewayed domain, would you put the redirect 
command in the Global.cfg file, or is this not possible to redirect? example:
Unfortunately, that isn't possible for gateway domains yet.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] HOLD plus COPYTO

[R. Scott Perry]

Would the SUBJECT and COPYTO actions be compatible, meaning if you had the
following it would work:
TEST1 weightrange   x   x   25  35
TEST2 weightrange   x   x   25  35
TEST1 SUBJECT   [Possible SPAM]
TEST2 COPYTOC:\Imail\Spool\Spam\CopyHeldForReview
Yes, that would work fine.  The COPYTO action should work with all other 
actions.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Declude website

[R. Scott Perry]

From reading these messages, I just learned of 
http://www.declude.com/tools/spamsend.html. 
I never knew it existed and don't see anyway to find it other than going 
directly to it.
That's accessible from http://www.declude.com/tools .

Also, It seems that 
http://www.declude.com/junkMail/manual.htm 
is the same way.
That one doesn't have a direct link yet, but that will hopefully be 
changing soon.

Am I missing something?  Are there other useful areas on the web site that 
aren't linked from the main site?
I believe the manual is the only interesting part that doesn't have a 
direct link.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Enchancment suggestion

[R. Scott Perry]

That reminds medoes the activation need to be at the top?  I've been
considering re-arranging the cfg to have all of my changes at the
bottom.
No, the activation code does not need to be on the top.  It can go anywhere 
in the file.

> Does this mean the idea might get included ?

It is something that we are considering, so it might get included.  I can't 
make any guarantees, though.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] HOLD plus COPYTO

[R. Scott Perry]

You might want to clarify for others if this method is limited to certain 
versions like the COPYTO action is.
Good point -- the new COPYFILE action will be available in all versions of 
Declude JunkMail.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] HOLD plus COPYTO

[R. Scott Perry]

Add my vote for the FILECOPY method.  This would allow me to only copy 
over a certain weight range following all filters and only according to 
the unique capture settings of a domain, and doing it within Declude would 
be more efficient that having an external app do it.

If this is in the works short-term please let me know so that I can save 
myself some time, otherwise I figured that I would code this up this 
weekend for my system and I would switch over when/if the Declude 
functionality becomes available.
You can relax this weekend.  :)

The latest interim 1.78i30 at http://www.declude.com/interim adds a 
COPYFILE action (in the format "TESTNAME COPYFILE C:\IMail\spool\copy\") 
that will copy the file to another directory.  So you can use:

TEST1   COPYFILEC:\IMail\spool\copy\
TEST2   ROUTETO [EMAIL PROTECTED]
This will re-route the E-mail to [EMAIL PROTECTED], and copy the D*.SMD and 
Q*.SMD files to C:\IMail\spool\copy.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] a different RevDNS test

[R. Scott Perry]

It sems to me that it we had a way to do a different dsn test  like,

ReverseDNS 10 Contains client.comcast.net
You can use:

REVDNS  10  CONTAINSclient.comcast.net

However:

As these client machines should not be connecting to our server anyways.
Be very, very careful in making such assumptions.  One person last year 
decided that any connections with reverse DNS entries that appeared as 
though they might be from dynamic IPs should not be allowed.  While that 
sounds reasonable, many static IPs have reverse DNS entries that look like 
dynamic IPs (we found that the guy who tried that would have blocked at 
least 10% to 15% of legitimate mail).

So if all reverse DNS entries with client.comcast.net are 
dynamic/residential IPs, you're safe doing that (but could use one of the 
DYNA/DUL tests instead, which should catch them).  But if there are static 
IPs with reverse DNS that contains client.comcast.net, you could block 
legitimate E-mail.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] v1.78i28 Hijack / Deccon

[R. Scott Perry]

I'm running Declude v1.78i28 and have just noticed the HiJack info is
not appearing in the console. I've had a look through the archive and
noticed a previous interim has this problem, the post indicated
upgrading to a later interim...
Is the console appearing?  If so, what is missing from it?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] HOLD plus COPYTO

[R. Scott Perry]

Am I correct that there is no internal way to HOLD a message and also use 
the COPYTO action?
Correct.  That's because HOLD prevents the E-mail from being delivered, so 
the COPYTO action would just end up adding an extra recipient that won't 
receive the E-mail.

If this is the case, would it either be possible to have this ability, or 
would I need to approach this differently?
In order for the E-mail to be delivered, you're going to need to use 
something other than the HOLD action.  We are looking into the possibility 
of a "FILECOPY" action or something like that (in which case you would be 
able to use that action to keep a copy of the E-mail on the hard drive, and 
ROUTETO to re-route the E-mail to another recipient).  But that isn't 
possible yet.

My thought was to create an external test that didn't really test, it 
would just simply copy the two files over to a new location when 
called.  Is there anything that would prevent that from happening?
That would work.

Another related issue, are all external tests run at the same time, or 
could an external test be called after all of the custom filters are run 
by placing it at the very bottom of the list, that way I could make use of 
the final weight to determine what needed to be copied?
The external tests are run in serial, so the last one defined in the 
global.cfg file will be run after all the other external tests.

Regardless of the above, what I'm trying to do is create an easy way to 
reprocess the messages when I find a FP in one of the capture accounts.
I recall a discussion of how things are processed and maybe skipped if 
called in a different context, and I'm wondering what the best way to 
recall a held message is.  Do I call declude.exe with the spool file name, 
or do I just move the message over to the spool to be picked up?
Obviously I would want to avoid having the message rescanned, but 
immediate processing would be nice.
Copying the D*.SMD and Q*.SMD file to the \IMail\spool directory is the 
recommended method.  It prevents the E-mail from being scanned a second 
time, but the E-mail won't go out immediately.  To do that, you could start 
SMTP32.exe with the Q file name, and it should deliver it immediately.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] WARN

[R. Scott Perry]

I've had another email where I could do with identifying why an email
failed the BADHEADER test, but when I go to view the header info in the
spamattach email, as with the attached email that internet headers are
blank. I think this is because Exchange strips them?
That would probably be the mail client (Outlook?) that is stripping 
them.  If Exchange stripped them, then Outlook wouldn't be able to know who 
sent the E-mail, who it was sent to, the subject, or the date that it was sent.

Because of this is there another simple way I can find out specifically
triggered the BADHEADER test to fail? Or prevent exchange from stripping
these headers?
You could perhaps try "BADHEADERS HEADER [This E-mail failed the BADHEADERS 
test (%WARNING%)]".

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re[3]: [Declude.JunkMail] Possible bug with reserved IP's???

[R. Scott Perry]

> Actually,  that's  what  Declude  JunkMail currently does. This lets
> Declude JunkMail know whether the envelope sender is a local address
> or not.
We  can  automatically  dump  messages from nonexistent local users? I
guess  I  feel  kind  of dumb after my rant, then, since I didn't know
there was a test for that. How to?
No, that can't be done.

> What  I'm  talking  about  above  is  determining  if  the  user has
> permission  to  relay  mail  (and  therefore the DUL/DYNA/etc. tests
> should not apply to the user).
Ah,  I  think  I  see...this is different from the information used by
WHITELIST  AUTH, as it must also account for relay-for-IP permissions.
Exactly.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re[2]: [Declude.JunkMail] Possible bug with reserved IP's???

[R. Scott Perry]

> This  of  course  brings  up  another  question:  Is there a way for
> Declude  JunkMail  to  find out accurately if the sender is really a
> local  user  or  not?
If  by  sender you mean the envelope sender, and not the username used
for  SMTP  AUTH, I don't see why not.
Actually, that's what Declude JunkMail currently does.  This lets Declude 
JunkMail know whether the envelope sender is a local address or not.

What I'm talking about above is determining if the user has permission to 
relay mail (and therefore the DUL/DYNA/etc. tests should not apply to the 
user).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Enchancment suggestion

[R. Scott Perry]

I was reading another thread that digressed into the topic about the 
difficulty of keeping up with the latest .cfg file while maintaining the 
mail administrator s customized .cfg

I would like to suggest that perhaps a different approach to managing the 
.cfg files could be implemented.  It would be really nifty to have a base 
.cfg file and a separate .cfg file that holds an admin s changes.   This 
method works well in BSD style configuration files.

That way the good folks at declude could keep the base .cfg files updated 
and the admin s could conviently replace their base cfg file.  The diff 
file for lack of a better word would store the admin s tweeks, which would 
include addtions and subtractions from the base.
That actually sounds like a good idea.  That would also work well for 
people who have Declude running on multiple servers, and want to have one 
source for the config file, but have different activation codes on each 
server (the activation code could go into the config file that is manually 
updated).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Possible bug with reserved IP's???

[R. Scott Perry]

The message came from a last hop that should have tripped all 4 of these 
tests, but for some reason it missed both (DYNA) tests.  The only thing 
that I can come up with is some bug related to the second hop which has a 
reserved IP forged in the headers (along with my domain forged).  This 
technique of separating (DYNA) and (ALL) otherwise has been working 
reliably to the best of my knowledge for several months.  I did also check 
to see if the private IP tripped those tests as the results suggest, and 
it wasn't listed.  Could this be related to some internal intelligence for 
skipping lookups on private IP's throwing off the DYNA skipping?
Actually, the issue here is:

> X-MailPure: SMTP Sender: [EMAIL PROTECTED]

Declude JunkMail is assuming that this is a local sender, and therefore 
skipping the test (since DYNA/DUL tests should not be applied to local users).

This of course brings up another question: Is there a way for Declude 
JunkMail to find out accurately if the sender is really a local user or 
not?  That, however, can get very tricky (nearly impossible on IMail 
versions before v8, difficult on v8).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Options for Junkmail/Virus

[R. Scott Perry]

Doesn't he need JunkMail Pro for gatewaying though?  (treated as outbound)
That is correct.  Declude JunkMail Pro is required for scanning E-mail on 
domains that IMail acts as a gateway for.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Options for Junkmail/Virus

[R. Scott Perry]

Is it possible to do the following:

With IMail host some domains and have some domains simply forwarded
(This I know works)
Can I Junkmail but not AV one domain
Another domain AV but not Junkmail
Another domain do both
Another Domain do neither
Yes.  With the Standard version of both products, you can use the 
per-domain settings to accomplish that.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] something is up help

[R. Scott Perry]

Attached is the filter file.
The problem is that it is *not* "room" -- it is "SUBJECT 30 IS rõõm".  The 
Windows API has problems with 8-bit characters -- the latest beta of 
Declude JunkMail addresses this.  With previous versions, Windows will 
return a match on any subject with "r" in it.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] something is up help

[R. Scott Perry]

On that note Scott, any chance that in a future version the actual line of
text caught could be listed in the failure?  Like:
Message failed SUBJECTFILTER (332 room)
That's something that we are thinking about adding.  The only problem is 
that some people may not want the information to appear in the headers (for 
adult oriented E-mail, for example) -- although if the phrases are in the 
body and the E-mail isn't blocked, the recipient is going to see the 
phrases in the body anyway.

Or if not in the headers, how about in the log, maybe at only HIGH
level?
I believe that it will appear in the log file at LOGLEVEL HIGH.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Filter File processing

[R. Scott Perry]

A) A small number of larger filer files vs a lot of smaller files

B) Doesn't make any significant difference if you use the SKIPIFWEIGHT
option at
   the beginning even though it would still have to open the file to 
check the
   SKIPIFWEIGHT setting.

C) A small number of larger files ordered in the config file ordered from
   lightest processing most likely to hit to heaviest processing less 
likely to
   hit

D) Alot of smaller files ordered in the config file from ordered from
   lightest processing most likely to hit to heaviest processing less 
likely to
   hit

I would think C or D would be the best option.
I would agree.

Specifically, you would want BODY (or ANYWHERE) filters to only be used 
after everything else was handled.  Those are the most CPU intensive filters.

The last question is what, in number of lines, would be a large filter file.
500, 1000, 2000, 5000, 10,000
That depends on what your concerns are about the large files.  As far as 
Declude is concerned, a single large file of 10,000 lines would be (very 
slightly) more efficient than say 10 files with 1,000 lines each.  But the 
difference should be almost negligible.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] something is up help

[R. Scott Perry]

>Subject: Re: Brochure
>X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (332)
If you look at line 332 in the subjectfilter.txt file, it should have the
text that caused the SUBJECTFILTER test to be triggered.
This is whats on line 332
SUBJECT 30 CONTAINS room
I would try checking the lines just before and after that one, in case of a 
line numbering discrepancy.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] something is up help

[R. Scott Perry]

>Have you recently updated your \IMail\Declude\global.cfg file (are there
lines beginning with AHBL, CBL, SBL, and SORBS- in there)?
No I have not - where do I get it?
http://www.declude.com/junkmail/manual.htm

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] something is up help

[R. Scott Perry]

Last week I was so tired of have to look at spam and up date filters. Im 
pretty feed up with all this.  ( :-) Im venting.
Have you recently updated your \IMail\Declude\global.cfg file (are there 
lines beginning with AHBL, CBL, SBL, and SORBS- in there)?

Im sending all failed mail to a junk email and I found the attached header 
and want to know why it would fail the subject test when the word "Re: 
Brochure"
is not even in the txt file?

Global file
# SUBJECTFILTER  filter   E:\Imail\Declude\Filters\Subjectfilter.txt x   2   0
The "#" at the beginning of the line means that it is a comment, so that 
test is disabled.  I assume that was done after the E-mail was received?

Subject: Re: Brochure
X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (332)
If you look at line 332 in the subjectfilter.txt file, it should have the 
text that caused the SUBJECTFILTER test to be triggered.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Log Question

[R. Scott Perry]

Below is a line from my declude log file.  I was able to get the message
ID from my syslog and then went to my declude log file and found this.
Could someone explain to me why this was caught?
It was not caught:

03/25/2004 08:44:52 Qe2520a28017a22f2 Tests failed [weight=0]:
IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE CATCHALLMAILS=IGNORE
This shows that only the IGNORE action was used.

Unless there were other "Tests failed" log file entries, the 
De2520a28017a22f2.SMD and Qe2520a28017a22f2.SMD files should not be in your 
\IMail\spool\spam directory.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] BODY FILTER Question

[R. Scott Perry]

On this same subject

I want a filter for body text

Such as BODYFILTER filter E:\Imail\Declude\Filters\bodyfilter.txt x 0

And I want it to find exact words
Hmmm... you asked this question yesterday, and got several responses -- did 
you not get them?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] DNS

[R. Scott Perry]

Whenever I have to bring my primary dns server down a lot of spam gets
through.
Correct.  Declude JunkMail relies on your DNS servers to detect spam.

It appears that declude is only using one DNS server.
That, too, is correct.  Given the architecture of IMail, using the backup 
can be problematic.  Note that it has recently been recommended to only 
have one DNS server listed in the IMail SMTP settings.

Is there a way for it to use my secondary DNS when the primary is down?
If you have planned downtime, you can add a DNS line in the 
\IMail\Declude\global.cfg file.  For example, if your backup DNS server is 
at 192.0.2.53, you can add a line "DNS 192.0.2.53" to the 
\IMail\Declude\global.cfg file, and Declude JunkMail will use that DNS 
server instead.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Subject Line FIlter

[R. Scott Perry]

I want a filter for body
Such as  BODYFILTER  filter   E:\Imail\Declude\Filters\bodyfilter.txt   x  0
And I want it to find exact words
Can I use this filter
BODYFILTER  filter   E:\Imail\Declude\Filters\bodyfilter.txt
with
BODYFILTER 0 IS sex
No.  The problem is that the body of the E-mail is never "sex" (well, it 
might be, but that would be extremely rare).  That's one of the problems 
with filters -- they don't have an easy way to block individual words.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Subject Line FIlter

[R. Scott Perry]

And this only works in the Pro version, correct?
Yes, filters are only available in Declude JunkMail Pro.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Subject Line FIlter

[R. Scott Perry]

Scott... Am I correct that case is also a factor??
No.

Such as
CONTAINSHello World
will not catch
hello world
CONTAINSHello World

*will* catch "hello world".

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Subject Line FIlter

[R. Scott Perry]

I have a filter in the default file called
 SUBJECTFILTER  filter   E:\Imail\Declude\Filters\Subjectfilter.txt x 
   21   0

Does this filter only match the entire phrase, or part of the phrase or both?
That depends on the lines within the subjectfilter.txt file.  If they use 
CONTAINS, then the entire phrase must appear (for example, "SUBJECT 0 
CONTAINS Hello World" would only match if the subject contained "Hello 
World", including "Hello World People).  If they use IS, then the entire 
phrase must match exactly (for example, "SUBJECT 0 IS Hello World" would 
only match if the subject was "Hello World", and would not match a subject 
of "Hello World People).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Log File Changes

[R. Scott Perry]

Where I should put the "LogLevel" configuration

On Global.cfg or in the $default$.JUnkMail File ??
It is a global configuration option, which belongs in the 
\IMail\Declude\global.cfg file.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] link

[R. Scott Perry]

Can someone send me the link for the updates?
http://www.declude.com/junkmail/manual.htm has links to the latest released 
version and latest beta.

http://www.declude.com/interim is used for interim releases, which should 
normally only be used if there is a specific need for them.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Countries List

[R. Scott Perry]

I don't currently have that file in my IMail\Declude directory.  If we are
only running DJM Pro v1.75 will having this file do anything for us?
Only if you are using the experimental IP->Country functionality.  If you 
are not, there is no need to have that file.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Countries List

[R. Scott Perry]

I too have some IP's that come up with no country. Is there somewhere we 
can go to verify where they belong?
You can go to http://www.DNSstuff.com and enter the IP in the IPWHOIS box 
or Reverse DNS Lookup box, and it should show you the country.

82.47.137.183  s/b ?
This one should be in the latest all_list.dat file.  Did you download it 
from http://www.declude.com/release/178/all_list.dat?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Countries List

[R. Scott Perry]

When we download this file where do we put it?
It replaces the one in the \IMail\Declude directory.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Automatic Whitelisting

[R. Scott Perry]

I want to white list an email address for the users of a specific virtual
domain, but not for all virtual domains on the server.
For this, you would want to use the WHITELISTFILE option, that lets you 
have whitelists that work for certain domains/users but not others.

- Each individual user has their own address book, and
- I can do a domain wide address book by putting it in the /domain/web
directory.
Regarding JunkMail PRO:

- I can white list an email address for a single user by adding it to a
users address book, BUT
- can I white list an email address for a single virtual domain by adding it
to the domain wide address book?
No.  In this case, you will want to use the WHITELISTFILE option.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Countries List

[R. Scott Perry]

I see a fair amount of junkmail which doesn't fail the Countries Test but
the country is shown as ARIN Unlisted or Unknown. Is there a way to show
these results as failing the test and subsequently add points for the
junkmail filter??
The problem thing to do here is download the latest all_list.dat file from 
http://www.declude.com/release/178/all_list.dat .  The "ARIN Unlisted" and 
"Unknown" shouldn't show up for IPs connecting to your server.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Disable outgoing scanning

[R. Scott Perry]

>> Yes.  With the latest beta of Declude JunkMail and the latest version of
>> IMail, you can add a line "WHITELIST AUTH" to the
>> \IMail\Declude\global.cfg
>> file to automatically whitelist E-mail sent from authenticated users.

Sorry for asking for specifics, could you clarify the minimum versions
of both software products for this function to work.
The latest version of IMail is IMail v8.05 HF2 (although any IMail v8 will 
work fine for WHITELIST AUTH).  The latest beta of Declude Virus is 1.78.

Also, this command isn't in the manual, likely because it's still beta,
but considering I read it thoroughly before I emailed the list, you
might want to add a beta section to it.
Beta features get added to the manual after they are in a released version 
(otherwise, there is too much confusion over "Why does this feature not 
work?").

One other note along these lines, I like to update my config files from
time to time, but new commands found only in newer versions of the
software often show up in them. Is there a chart of Declude version vs.
command? I don't update the version of Declude as often as the config
files, or as the case is at the moment, I need to get an agreement but
won't be able to afford it for a little while.
That's not a problem -- the config files are designed to be both forwards 
and backwards compatible, so if new features are added, it won't affect any 
older version.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Disable outgoing scanning

[R. Scott Perry]

Is it not possible (in anyway) for Declude to identify that an email
came from an authenticated user?
Yes.  With the latest beta of Declude JunkMail and the latest version of 
IMail, you can add a line "WHITELIST AUTH" to the \IMail\Declude\global.cfg 
file to automatically whitelist E-mail sent from authenticated users.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Disable outgoing scanning

[R. Scott Perry]

For clients that find it critical to not have *any* inbound / outbound
scanning is there a way to ensure this never happens in a shared hosting
environment based on how SMTP works?
What you need to do in this case is whitelist the E-mail, which ensures 
that it does not get caught.

For example, you can add a line "WHITELIST FROM [EMAIL PROTECTED]" or 
"WHITELIST IP 192.0.2.25" to the \IMail\Declude\global.cfg file, to 
whitelist based on the return address or IP address that the E-mail came from.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Strange MONKEYFORMMAIL problems

[R. Scott Perry]

I know that the MONKEYFORMMAIL and MONKEYPROXIES list are dead and 
apparently has been for a while but we had a problem last Monday in that 
hundreds of legitimate emails started getting caught with these lists. I 
ve since disabled the tests in Junkmail. I saw that someone else had a 
problem with these tests and someone mentioned that these lists had been 
dead for a while. Can someone please explain why all of a sudden my 
Junkmail started failing emails with these when these lists had been dead? 
Also, how do I avoid something like this form happening again?
The problem is that the person who run those two tests got fed up with 
people still querying them 6 months after the tests died.  He finally 
decided he would "blacklist the world" (as Joe Jarad of Osirusoft did when 
spammers killed off his spam database last August, which made front page news).

Right now, the only way to deal with this is to occasionally update the 
global.cfg file to remove dead spam databases (and add new ones, which 
makes updating the file more worthwhile).  However, there are people in the 
anti-spam community that are working on a standard way for a spam database 
to say "I'm gone! Please stop using me!" to prevent this problem in the future.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Disable outgoing scanning

[R. Scott Perry]

If I send a message that contains recipient addresses for both local
accounts (ex: someone CC's their boss) and external addresses (say a Hotmail
address) the external messages are processed through Declude and actions are
taken despite global.cfg actions being set to "Log" for outgoing messages.
That is correct.

If I simply send the message to the same hotmail address w/o any additional
recipient addresses that reside locally on the IMail server no Declude
scanning occurs.  What am I missing?
That is correct too.

The problem is with SMTP.  When you send an E-mail to an internal and 
external address, you aren't sending an internal E-mail and an external 
E-mail.  You are sending 1 E-mail that is both internal *and* 
external.  When these conflicts occur, Declude JunkMail combines all 
actions that it can, and in the case of conflicts, chooses the "harsher" 
action.  If you have outgoing settings for a spam test to LOG and incoming 
settings to DELETE, and an E-mail failing that test will be deleted if any 
of the recipients are local (and therefore the incoming actions are used).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Subject Missing

[R. Scott Perry]

Here is a Header to From a Yahoo Account  and from my own email

Received: from 66.153.205.2 [66.153.205.9] by scooby.linkbrokers.com with 
ESMTP
  (SMTPD32-8.05) id A358A600F8; Mon, 22 Mar 2004 10:16:40 -0500
Message-Id: <[EMAIL PROTECTED]>
This portion is very, very strange.  It indicates that IMail only saw the 
first Received: header, and *nothing* below it (specifically, IMail adds 
the Message-ID: header if it doesn't see one).  So this E-mail was likely 
flawed to being with.


X-Declude-Sender: [EMAIL PROTECTED] [66.153.205.9]
X-Declude-Spoolname: D035800a600f8cd1b.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
Then Declude added its headers after the IMail headers.

From: [EMAIL PROTECTED]
Date: Mon, 22 Mar 2004 10:18:05
X-RCPT-TO: <[EMAIL PROTECTED]
Status: U
X-UIDL: 378438634
And IMail added some extra headers.  Finally:


Content-type: text/html
Date: Mon, 22 Mar 2004 10:30:37 -0500
From: [EMAIL PROTECTED]
Message-id: <[EMAIL PROTECTED]>
Reply-to: [EMAIL PROTECTED]
Subject: test kevin monday 2
To: [EMAIL PROTECTED]
the rest of the E-mail headers appear.

Whatever the problem was, all of IMail's SMTPD process, Declude, and 
IMail's SMTP32.exe process did not see the headers.  I'm guessing that 
there is a problem with the mail client that sent out the E-mail.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] dns stuff

[R. Scott Perry]

Is the dns stuff page down?  Just wondering
Not now.  :)

Note that if you ever cannot get to http://www.dnsstuff.com you can use 
http://backup.dnsstuff.com .

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPFPASS (Junk)

[R. Scott Perry]

What do we do when we find Junkmail passing the SPF Test.

Is there a place to report it.
It should be treated the same way as regular spam that you would report, 
but there is a big exception here:  you can almost certainly find someone 
responsible that allowed the spam through.

If you have the headers, feel free to post them here.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Befuddled: Test not logged!

[R. Scott Perry]

I know you are busy with viruses - but I can't figure THIS one out.  I 
have thousands of emails in the log file, where SORBS-DUHL is discovered, 
logged and treated properly. But at least this ONE got through and I have 
no explanation.
The issue here isn't that the test wasn't logged -- Declude JunkMail 
doesn't think that the E-mail failed the test at all.

SORBS  ip4r dnsbl.sorbs.net   *
SORBS-DUHL ip4r dnsbl.sorbs.net   127.0.0.10 0 0
c) Yet - Declude never logs SORBS-DUHL!?

03/19/2004 08:26:38 Qf50b5b900020628c SPAMCOP:7 nNOLEGITCONTENT:-3 
.  Total weight = 4.
03/19/2004 08:26:38 Qf50b5b900020628c Subject: Lower your  m ortgage today!
03/19/2004 08:26:38 Qf50b5b900020628c From: 
[EMAIL PROTECTED] To: 
[EMAIL PROTECTED]  IP: 69.47.96.104 ID:
03/19/2004 08:26:38 Qf50b5b900020628c Tests failed [weight=4]: 
SPAMCOP=WARN SORBS=WARN IPNOTINMX=IGNORE
In this case, the E-mail failed the SORBS test, but not the SORBS-DUHL 
test.  It does indeed appear that it should have failed the SORBS-DUHL 
test, given the current information, but it is possible that it wasn't 
listed correctly yesterday (which would explain what 
happened).  dnsbl.sorbs.net definitely did return *something* -- but what 
it returned is a mystery.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] More problems with: Whitelist setup problem

[R. Scott Perry]

My client says they are still have getting email spam filtered by JM when it
should be white listed.  Here is what I have:
I can't see any problems here.  I would recommend using the debug mode to 
track this down.  To use the debug mode, you can change the "LOGLEVEL LOW" 
line in \IMail\Declude\global.cfg to "LOGLEVEL DEBUG".  Then, send an 
E-mail through that just be whitelisted, and then switch back to "LOGLEVEL 
LOW" (the debug mode adds huge amounts of information to the log 
file).  You can then send me (off-list) the \IMail\spool\dec.log file 
(as an attachment, NOT sent from web messaging), and I can see what the 
problem is.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] HOP and HOPHIGH

[R. Scott Perry]

The DNS server appears to be working OK. There are times when our mail
server's CPU utilization is over 90%. It doesn't remain at that level for
extended periods, but it does reach this level which concerns me. Is it
possible that when I introduce the HOP scan within Declude, that the mail
server can't keep up with the load place on it??
Yes, it is almost definite that the mail server can't keep up with the 
load.  The question, though, it why (too much CPU usage, slow processing of 
E-mail, etc.).

I would recommend using the debug mode in this case.  To use the debug 
mode, you can change the "LOGLEVEL LOW" line in \IMail\Declude\global.cfg 
to "LOGLEVEL DEBUG".  Then, after about a minute, you can then switch back 
to "LOGLEVEL LOW" (the debug mode adds huge amounts of information to the 
log file).  You can then send me (off-list) the \IMail\spool\dec.log 
file (as an attachment, NOT sent from web messaging), and I can take a look 
at it to see what is happening.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] HOP and HOPHIGH

[R. Scott Perry]

Presently, the HOP and HOPHIGH parameters in my global.cfg are remarked 
out. When I try to set HOP to 0, the overflow directory begins to fill up. 
Any thoughts?
That's not good.  If the "HOP" line isn't there, the source IP of E-mails 
will not be scanned.

The overflow directory will fill up if E-mail can't be scanned and 
delivered as fast as it comes it.  This is normally due to a DNS issue.  Is 
your DNS server (the one listed in the IMail SMTP settings) working properly?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] WARN

[R. Scott Perry]

In the spamattach.eml file, we are displaying the %HEADERS% but these do
not include the WARNing with the code, and when I open the email
attached and view the internet headers they're blank.
Anyway of being able to find out the BADHEADER codes etc?
Those should appear in the headers of the actual E-mail that is received 
(the one containing the spam in the attachment).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Subject Missing

[R. Scott Perry]

I looked at my $default$  and I did not have a line for
GIBBERISH   WARN  or ANTI-GIBBERISH WARN
Whould that have caused the problem and Do I need both of them there?
What matters is the action that appears in whatever config file that 
Declude JunkMail is using.  That could be the \IMail\Declude\global.cfg 
file (if the E-mail is outgoing), the \IMail\Declude\$default$.JunKMail 
file (if the E-mail is incoming), or a per-user/per-domain config file.

Do you have the full headers for one of the E-mails that this happened 
to?  That could help in determining what happened.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Hour Test

[R. Scott Perry]

I saw your reply to Kris suggesting two tests. Mine is set up with one
test...to subtract 1 for messages between 7 a.m. and 10:59 p.m., and add
6 for messages outside that time range.
HOURhour7   22  -1  6
Is this not also correct? It seems to be working.
That will work fine.

Couldn't Kris use:  HOURhour6   22  0   5
That would work, too.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] JunkMail and Aliases

[R. Scott Perry]

Does JunkMail have difficulties performaing actions against messages
destined for aliases?
No.

We seem to be experiencing a large amount of Junk
getting through to users via Alias/list membership.
Note that if you are using per-domain or per-user settings, the address 
that the alias points to will be used to determine which config files to 
use.  Also, you should make sure that the aliases do not just point to 
"username", but instead have the actual address ("[EMAIL PROTECTED]").

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Subject Missing

[R. Scott Perry]

I have been testing allot of scenarios try to get a handle on a problem 
where the subject line message just disapears from incoming mail when the 
message is created from a Cold Fusion online newsletter editor.

Here is what I found out and how I fixed it.

#GIBBERISHfilter   E:\IMail\Declude\Filters\Gibberish.txtx 
  6   0
#ANTI-GIBBERISH   filter   E:\IMail\Declude\Filters\Anti-Gibberish.txt   x 
 -6   0

With both of these filter in place there is a intermittent problem with 
subject summary missing and showing up in the body of the email.
What action are you using on those two tests?  I'm guessing that you are 
using the WARN action with a custom header with no ":" in it.  For example, 
"GIBBERISH WARNWarning- This E-mail failed the GIBBERISH test" could 
cause what you describe (since there is no ":" in the header that would be 
added).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Hour Test

[R. Scott Perry]

I am trying to test out the new HOUR test, I can't get it to work.  Is this
the correct format in my global.cfg:
HOURhour23  6   5   0

Will this tag everything between 11 PM and 6 AM with a weight of 5 correct?
I am using Declude Junkmail Pro 1.78.
I believe the problem is the overlap -- what you'll want to do is use two 
separate tests:

HOURhour23  23   5  0
HOURhour0   5   5   0
Those would catch anything between 11:00PM and 11:59PM, and anything from 
12:00AM to 5:59AM.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Force resend and rescan of a message that was held?

[R. Scott Perry]

Any ideas about why the process takes so long (~20-30 seconds per
message)?
Is your DNS server (the first one listed in the IMail SMTP settings) 
working properly?  That would be the normal cause of delays (assuming the 
CPU isn't maxed out).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Fprot

[R. Scott Perry]

>> If you switch to fpcmd.exe (changing "F-Prot.exe" to "fpcmd.exe" in the
>> SCANFILE line in your \IMail\Declude\virus.cfg file, and removing
>> "/NOFLOPPY" from that line), it will take care of the problem.  F-Prot.exe
>> is a 16-bit process, which needs to use NTVDM, whereas fpcmd.exe is a
>> 32-bit process that doesn't require NTVDM.  Plus, some servers have a hard
>> time dealing with 16-bit processes, so the switch to fpcmd.exe may also
>> show a noticeable performance improvement.
I have been having this problem as well ... if I make the change do I have
to reboot or stop and start anything ???
No -- just making the changes in the virus.cfg file is all you need to do.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Force resend and rescan of a message that was held?

[R. Scott Perry]

>From testing so far, it appears Declude won't rescan a message.  I've
tried deleting the headers from the D* file before putting it back in
the queue to no avail.  If I set the declude log level to "HIGH" I see
"Passing to SMTP1" for that message ID, so it at least appears that
declude sees the message again.
How can I have messages rescanned?
Declude JunkMail will automatically skip over E-mails that are in the 
spool, since they have already been scanned.

If you want to have Declude scan them again, it would get a bit 
tricky.  You would need to call Declude for each E-mail, but do so before 
IMail delivered it.  So you might try copying batches of perhaps 10-20 
E-mails back to the spool, call Declude for each one ("C:\IMail\Declude.exe 
C:\IMail\spool\Q1234567.SMD"), wait until they are processed, and 
repeat.  I'm not sure of an easy automated way to do this.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.