Re: [Declude.JunkMail] OT Snow
instead of BANEXT snow... edit that to route to missouri. that will be great. no snow yet, just a few spits... I love snow... lots of it... makes hunting so much more fun... plus snow camo is cool to wear :) Travis - Original Message - From: Orin Wells [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, December 03, 2005 12:51 PM Subject: Re: [Declude.JunkMail] OT Snow We had a blanket of snow here in the Seattle area Thursday night too - still hanging around. We had almost zero snow last year. All the ski areas are in operation. Some opened a month ago - the earliest in decades. Maybe we are going into the next ice age? At 09:08 AM 12/3/2005, you wrote: let me know if you get the BANEXT .snow working, we got 24 inches yesterday and last night, good ol Lake Erie lake effect snow... sigh Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, December 03, 2005 3:49 AM Subject: RE: [Declude.JunkMail] Paranoia What's even funnier is by the time I am ready to get in bed, Europe is going to work. yawning mmmh, what? ... ... Ah, hi guys, good morning from Europe! We've around 12 inches of snow here over night. Where's the snowshovel? Maybe I will add BANEXT .snow to my config file ;-) /yawning Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Paranoia
the list traffic comes in spurts :) I felt the same way a few weeks back. Travis - Original Message - From: Orin Wells [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 02, 2005 7:59 PM Subject: RE: [Declude.JunkMail] Paranoia OK, is it me or are you guys just unusually quiet today? I am a bit paranoid after the changes I made yesterday and not seeing any posts to this list makes me wonder if I have done something to get the declude.junkmail list messages tossed out on me. I have seen nothing since my last post yesterday evening on the forwarded email question. What happened is I had changed the iMail DNS server id to point to a different server that is off-site from the ISP and, coincidentally, off-shore although under their control. I had only changed it in iMail thinking that declude would pick it up, but apparently something did not work well with that approach as all of a sudden we had a flood of spam. It looked to me like declude was not able to find any of the blacklists. I then added the declude entry in the global.cfg file to point to our primary DNS server since it was not Declude that was having the problem with the unreachable domain. That seems to have worked, but I am not seeing any email from this list. My hunch is that one of my settings is causing it to get deleted. Which? is the question. So I will have to play with them to find out I guess. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Paranoia
and when Darrell gets tired, I am still here making sure the list works :) 9+ years of imail experience 4 years of declude still find myself trying to make it better even though my mailbox [EMAIL PROTECTED] on millions of spam databases only gets one spam every other day if I shut down my access list, rules, and declude... I get 150 in just a few hoursfound that out last month when our server crashed and was rebuilt it took me a bit to get declude running due to the fluke deal with declude forgetting it was installed until you installed it that 12th magical time lol Travis - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 02, 2005 10:56 PM Subject: Re: [Declude.JunkMail] Paranoia :) Barry head to bed we can take it over from here for you. Once I head off to bed (after the nascar banquet - yes I like to watch cars going in circles for hours at a time) I am sure John can pick up right up (nice thing about the west coast its still early there). Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Barry Simpson [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 02, 2005 11:00 PM Subject: RE: [Declude.JunkMail] Paranoia Thanks guys, now I can go to bed. Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Orin Wells Sent: Friday, December 02, 2005 10:06 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Paranoia Thanks Darin. I feel better. Nothing wrong and Declude seems to be working perfectly. At 06:12 PM 12/2/2005, Darin Cox wrote: Hi Orin, It's just blissfully quiet. IMail list, too. I think everyone realized there are only three weekends left until Christmas! Darin. - Original Message - From: Orin Wells [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, December 02, 2005 8:59 PM Subject: RE: [Declude.JunkMail] Paranoia OK, is it me or are you guys just unusually quiet today? I am a bit paranoid after the changes I made yesterday and not seeing any posts to this list makes me wonder if I have done something to get the declude.junkmail list messages tossed out on me. I have seen nothing since my last post yesterday evening on the forwarded email question. What happened is I had changed the iMail DNS server id to point to a different server that is off-site from the ISP and, coincidentally, off-shore although under their control. I had only changed it in iMail thinking that declude would pick it up, but apparently something did not work well with that approach as all of a sudden we had a flood of spam. It looked to me like declude was not able to find any of the blacklists. I then added the declude entry in the global.cfg file to point to our primary DNS server since it was not Declude that was having the problem with the unreachable domain. That seems to have worked, but I am not seeing any email from this list. My hunch is that one of my settings is causing it to get deleted. Which? is the question. So I will have to play with them to find out I guess. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.13.10/190 - Release Date: 12/1/2005 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.13.10/190 - Release Date: 12/1/2005 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---
Re: [Declude.JunkMail] weighting domains
If you are doing basic filtering, with dns based blacklists, and content filter, body and subject, then you could simply add points to this IP address, enough to reach the hold weight: #ipbl.txt is our list of ips that we penalize, not fully block ipbl.txt #contents of ipbl.txt 65.249.245.0/24 #default.junkmail contents - add this line: ipbl warn #global.cfg contents - add this line near the bottom of your cfg file IPBL ipfile E:\IMail\Declude\ipbl.txt x 12 0 of course change the paths to your liking. the idea here is to score the matches in the ipbl file with a weight that nearly equals your hold weight. Thus, another hit from a dns blacklist or keywords found in a subject/body scan will provide the extra hit needed to hold the email. This will nearly eliminate false positives, just in case there is a good guy on that ip range. Hope this helps! Travis - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, December 01, 2005 10:27 AM Subject: Re: [Declude.JunkMail] weighting domains Hi Kevin Lots you could do - to wack this guy you could have a filter that that said REMOTEIP END NOTCONTAINS 65.249.245. REVDNS 0 CONTAINS csh. I am not sure if REMOTEIP or REVDNS or MAILFROM is appropriate but you get the idea.. In addition you could have an ipfile that you could list these particular ip's... -Nick Kevin Rogers wrote: Some of our users are getting a lot of spam from various domains that all have this in the beginning: csh Like: csh.dbfm.org [65.249.245.172] csh.mdcg.net [65.249.245.159] csh.jtdz.org [65.249.245.150] csh.xmdc.org [65.249.245.168] csh.kvyh.com [65.249.245.204] I have the Pro versions of every Declude product. How would I go about adding some weight to emails from this domain? - Should I somehow use the csh. property or the first three parts of the IP address 65.249.245.? Thanks --- [This E-mail was scanned for viruses.] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamcop
With this being said, no spam test is perfect. Therefore, I don't recomend a single test, regardless how effective it is, being equal to your hold/delete weight. I love the spamcop test, however, it is set to 60% of my hold weight, requiring another test or two to fail before the email is held. Removing spamcop from your testing would be a mistake IMHO. Travis - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, November 22, 2005 9:20 AM Subject: Re: [Declude.JunkMail] spamcop Richard, Last I checked, SpamCop was tagging about 50% of all of my spam, and while it certainly isn't perfect, it doesn't tag IP's that are perfectly clean. It is somewhat doubtful that one could remove SpamCop and not see more spam leakage. As a Declude user, I think that you might want to consider changing the weight that you apply to SpamCop instead, and make sure that you aren't automatically taking action on just that single hit. Personally I have few problems with SpamCop, and when they occur, they are almost always with bulk E-mail. Since I weight it low enough and it takes multiple false positives to result in blocking a legitimate personal E-mail on my system, hits from SpamCop on places like Gmail, AOL, etc. go almost completely unnoticed. The bulk E-mail is a different story though because many places have false positive issues with such traffic and varying definitions of spam, but people rarely complain about missing something like an Overstock.com ad if they do get blocked. Matt Richard Farris wrote: I have already deactivated Spamcop...should I just leave it that way..I have seen where spamcop caught some pretty nasty email..but the declude may have caught it anyway... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, November 21, 2005 4:19 PM Subject: Re: [Declude.JunkMail] spamcop gmail has many outbound servers - chances are one of the messages went via a server listed in spamcop. Spamcop these days has been proving to be less and less reliable - I can't tell you how often AOL, Earthlink, Gmail, Attbi, and other big ISP's get listed... Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Richard Farris writes: I just sent myself 4 messages all the same from my gmail to my ethixs.com account and 3 came thru and one got caught in the filter because of spamcop? 3 of the messages had a weight of 0 and the one that was caught had a weight of 33does this make any sense...all the messages were the same except I put test 1, test 2, test 3 and test 4 in the subject.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 2006 standalone
I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 2006 standalone
I have that and am scanning incoming mail just fine. I am missing something that causes declude not to scan outgoing mail. I tried adding several lines of some of my filters to the body of a message and it is not reporting any tests failed... Travis - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:14 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone Travis - I am not clear on what you are asking - the global.cfg is where '$default.junkmail' lives for outgoing mail - is that it? -Nick Travis Sullivan wrote: I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude outgoing mail
I don't use declude virus, just junkmail pro. INCOMING ON OUTGOING ON does this apply to declude junkmail 1.82? And can we setup different hold/delete/routeto actions for outgoing mail? I want to identify our users that might be infected with viruses or spamming. Travis - Original Message - From: John Carter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:20 AM Subject: RE: [Declude.JunkMail] Imail 2006 standalone Travis Anti-virus: In the virus.cfg you turn off/on outgoing scanning. Look for # # The following options allow you to limit scanning to only incoming or outgoing # E-mail. # INCOMING ON OUTGOING ON For spam checking, look at the bottom of the global.cfg for # OUTBOUND ONLY # (PRO VERSION ONLY) The actions listed below only apply to outgoing E-mail, Note that the DUL test should NOT # be used to block outgoing mail! Where you determine for outbound mail whether to WARN, HOLD, DELETE, etc. Of course you could set up tests that are IGNORE'd in default.junkmail and take a different action in outbound section of global.cfg. Beyond that, you are good to go. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Friday, November 18, 2005 11:04 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 2006 standalone
Okay, it was simple I didn't have any XOUTHEADER specified in the global.cfg so declude is scanning outgoing mail. but, i noticed the score was 17, one point above my hold weight... is there different actions for outgoing mail as in hold/delete? Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] outgoing mail scanned by declude
The message test I sent to another server made it, even though the score was a point above my hold weight... but the CC copy I sent to my declude server was deleted So, it appears that outgoing mail is only noted, no actions are taken. Travis - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:54 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone Okay, it was simple I didn't have any XOUTHEADER specified in the global.cfg so declude is scanning outgoing mail. but, i noticed the score was 17, one point above my hold weight... is there different actions for outgoing mail as in hold/delete? Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] outgoing mail declude junkmail
WEIGHT10 weight x x 16 0 WEIGHT20 weight x x 20 0 That is what I have at the bottom of mine... 16 is my hold weight, 20 is delete. What do I use for outgoing mail actions? Travis - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:01 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone Yes, and those actions are defined in your global.cfg at the bottom. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Travis Sullivan writes: Okay, it was simple I didn't have any XOUTHEADER specified in the global.cfg so declude is scanning outgoing mail. but, i noticed the score was 17, one point above my hold weight... is there different actions for outgoing mail as in hold/delete? Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] outgoing mail declude junkmail
I do have them specified as hold/delete in the default.junkmail file, this is working for incoming mail, just doesn't appear to work for outgoing mail. I have it scored at 16, it makes it easier to change the levels as I improve the ham/spam ratio... easier than renaming tests... Travis - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:21 PM Subject: RE: [Declude.JunkMail] outgoing mail declude junkmail Travis what you have there is the rule defined Now you need to have an action IE Weight10 hold Weight20 delete By the way you make it confusing by saying weight10 is a hold at 16. Why not call it weight16? That is still the difficulty with Declude. A whole language needs to be learned. It will be nice if this ever joins the GUI world Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Friday, November 18, 2005 1:05 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] outgoing mail declude junkmail WEIGHT10 weight x x 16 0 WEIGHT20 weight x x 20 0 That is what I have at the bottom of mine... 16 is my hold weight, 20 is delete. What do I use for outgoing mail actions? Travis - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:01 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone Yes, and those actions are defined in your global.cfg at the bottom. Darrell -- -- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Travis Sullivan writes: Okay, it was simple I didn't have any XOUTHEADER specified in the global.cfg so declude is scanning outgoing mail. but, i noticed the score was 17, one point above my hold weight... is there different actions for outgoing mail as in hold/delete? Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] outgoing mail declude junkmail
Yes, I have that too. Again, incoming mail is scanning just fine and have been for years... I am just now looking into outgoing mail scanning. The messages are held or deleted properly for messages coming to our server, but I sent a test message to another server not running declude and it went through, although the headers said the score was 17 Travis - Original Message - From: Dan Horne [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:28 PM Subject: RE: [Declude.JunkMail] outgoing mail declude junkmail Travis Sullivan wrote on Friday, November 18, 2005 1:05 PM: WEIGHT10 weight x x 16 0 WEIGHT20 weight x x 20 0 That is what I have at the bottom of mine... 16 is my hold weight, 20 is delete. What do I use for outgoing mail actions? That is a test definition. After that, you also need to put something like: WEIGHT10 WARN WEIGHT10 HOLD --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] outgoing mail declude junkmail
Sorry Matt.. I am trying to listen... So, the actions listed in default.junkmail are for incoming mail... and if I just add those options to the global.cfg then they will be applied to the outgoing email, correct? Right now I have none of them listed... so... adding them like: SUBJECTSCAN WARN WEIGHT10 DELETE , then only those tests listed will count towards the weight10 test? Travis - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:47 PM Subject: Re: [Declude.JunkMail] outgoing mail declude junkmail Travis, Everyone is telling you what is wrong, but you aren't listening carefully enough to understand. I would suggest that you go back and read things carefully, because everyone said correctly what you need to do. Simply put, the actions that you define for outgoing E-mail need to appear in your Global.cfg and not in $Default$.junkmail. Incoming and gatewayed E-mail is handled by the JunkMail files while outgoing E-mail sent by local users is handled by actions contained in your Global.cfg. You could for instance just copy the contents of your $Default$.junkmail into the bottom of your Global.cfg and you should be fine. Matt Travis Sullivan wrote: Yes, I have that too. Again, incoming mail is scanning just fine and have been for years... I am just now looking into outgoing mail scanning. The messages are held or deleted properly for messages coming to our server, but I sent a test message to another server not running declude and it went through, although the headers said the score was 17 Travis - Original Message - From: Dan Horne [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:28 PM Subject: RE: [Declude.JunkMail] outgoing mail declude junkmail Travis Sullivan wrote on Friday, November 18, 2005 1:05 PM: WEIGHT10 weight x x 16 0 WEIGHT20 weight x x 20 0 That is what I have at the bottom of mine... 16 is my hold weight, 20 is delete. What do I use for outgoing mail actions? That is a test definition. After that, you also need to put something like: WEIGHT10 WARN WEIGHT10 HOLD --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude junkmail outgoing mail
Thanks Darin! I was thinking you meant to define the tests in my global.cfg, which I had done already. Now I know you meant to use the same entries... makes more sence now. Sorry guys! Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 2006 standalone
WEIGHT20 HOLD If this line is placed into my global.cfg file, not default.junkmail, only outgoing messages will be stored in the spam directory, not affecting incoming email, correct? Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 11:19 AM Subject: Re: [Declude.JunkMail] Imail 2006 standalone It's pretty simple. take all of the actions you have defined in your $default$.config and copy them to your global.cfg. Actions placed in the Global.cfg apply to outgoing scanning. Actions in the $default$.config apply to incoming scanning. Darin. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:03 PM Subject: Re: [Declude.JunkMail] Imail 2006 standalone I searched, not a lot to be honest, the archive, and manual, but couldn't find info on setting up outgoing mail scanning with declude pro 1.82. Does anyone have a primer or at least some notes to share with me? TIA Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] outgoing mail declude junkmail
thanks John, but I think I have it working now. My test mail is getting held in the spam directory. I was missing the hold statement in the global.cfg file, I didn't know the hold statement in the default.junkmail was only for incoming mail that having one in the global.cfg file was for outgoing mail... I knew it was something simple, I just didn't know what. Thanks everyone, Travis - Original Message - From: John Carter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 1:38 PM Subject: RE: [Declude.JunkMail] outgoing mail declude junkmail Travis I don't know if I've overlooked this suggestion from someone else, but post your global.cfg (without code) to the list. We could take a look at it. John C -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, November 18, 2005 1:22 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] outgoing mail declude junkmail Travis, All tests are always run on both incoming and outgoing E-mail the same way (unless you are whitelisting it), and the weights are the same regardless of what you might list. The only unique thing would be the actions. An action would be something like WARN, DELETE, ROUTETO, HOLD, etc. Actions don't control weight, but you could for instance use a higher weight to trigger the DELETE action for outgoing E-mail by creating a different WEIGHT level and listing only that in the Global.cfg. Although the manual might be somewhat unspecific on topics like this one (it does fall short in this case), I believe it is best to also consult that first for such questions. I used to consult this frequently as I was refining my system, and it is best to learn how to use it, plus it might expose you to things that you didn't know about. Matt Travis Sullivan wrote: Sorry Matt.. I am trying to listen... So, the actions listed in default.junkmail are for incoming mail... and if I just add those options to the global.cfg then they will be applied to the outgoing email, correct? Right now I have none of them listed... so... adding them like: SUBJECTSCAN WARN WEIGHT10 DELETE , then only those tests listed will count towards the weight10 test? Travis - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:47 PM Subject: Re: [Declude.JunkMail] outgoing mail declude junkmail Travis, Everyone is telling you what is wrong, but you aren't listening carefully enough to understand. I would suggest that you go back and read things carefully, because everyone said correctly what you need to do. Simply put, the actions that you define for outgoing E-mail need to appear in your Global.cfg and not in $Default$.junkmail. Incoming and gatewayed E-mail is handled by the JunkMail files while outgoing E-mail sent by local users is handled by actions contained in your Global.cfg. You could for instance just copy the contents of your $Default$.junkmail into the bottom of your Global.cfg and you should be fine. Matt Travis Sullivan wrote: Yes, I have that too. Again, incoming mail is scanning just fine and have been for years... I am just now looking into outgoing mail scanning. The messages are held or deleted properly for messages coming to our server, but I sent a test message to another server not running declude and it went through, although the headers said the score was 17 Travis - Original Message - From: Dan Horne [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, November 18, 2005 12:28 PM Subject: RE: [Declude.JunkMail] outgoing mail declude junkmail Travis Sullivan wrote on Friday, November 18, 2005 1:05 PM: WEIGHT10 weight x x 16 0 WEIGHT20 weight x x 20 0 That is what I have at the bottom of mine... 16 is my hold weight, 20 is delete. What do I use for outgoing mail actions? That is a test definition. After that, you also need to put something like: WEIGHT10 WARN WEIGHT10 HOLD --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail
Re: [Declude.JunkMail] WHITELIST AUTH
I have 7.11 :-( And don't plan on upgrading...so the Whitelist AUTH is useless to me? Richard Farris Yes, that is correct. That is a new feature in imail 8+ I don't see it as that big of a benefit really. With combo filters, good use of declude pro's content scanning (headers, body, subject) built in tests, dns tests, ip4 tests... carefully planned counter balances, use of the many tests from matt's web site I don't feel the need to whitelist authenticated users. I have several test email accounts throughout the net, and many spam-trap as well. Declude's fabulous weighting system really reduces false positives. An email failing two tests will not get held on my system, it generally takes at least 3 of the most accurate tests and up to six of the others... My only wish is that we could setup the global.cfg file to fire the tests in the order we choose. To ensure counter weights, (ie - microsoft.com -3), are considered before any other tests are ran. I don't use any whitelists at all... major cause of increased spam through the filters. If you have one user that can't receive email from a source, whitelisting that user will allow any spam that comes in to be delivered... yikes!!! Nasty!!! Instead, via the logs, find out the source RVDNS and counter-blanace that email with a negative weight, start off with even -100 if you have to, then work down from there. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST AUTH
Travis, My only wish is that we could setup the global.cfg file to fire the tests in the order we choose. This is on our development wishlist. David B www.declude.com That is exactly why you guys are among the best company we have ever worked with in our nearing 10 year history oh.. and I can download the new feature tomorrow, correct? jk ;-) Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking on resolved domain name
Sorry to chime in so late... this is what I do: I add that full class C to a weight of 80% of my hold weight... that weight, my content filters, body/subject, and combo filters take care of the rest. So, in the event a real person is sitting on that class C, their email still comes though, unless they are selling Viagra :) Travis - Original Message - From: John Carter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, November 15, 2005 12:51 PM Subject: [Declude.JunkMail] Blocking on resolved domain name I am getting a lot of spam for 64.192.25.* (which come in with constantly changing domains, but actually resolve back to outgoing.liverandcherrys.com). I am reluctant to block the whole class C, but will likely end up doing so. Is there a better way to handle this? Kind of a best practices? John --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking on resolved domain name
No, especially if you are using skipifweight directive for the filters. I use them for all my filters except the safe-mail filters. I use safe-mail filters to counter balance certain hosts. Travis - Original Message - From: John Carter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, November 15, 2005 1:11 PM Subject: RE: [Declude.JunkMail] Blocking on resolved domain name Ok. Haven't used REVDNS before, so didn't think of that one. Is there much CPU or network overhead in using REVDNS? Thanks, John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, November 15, 2005 1:06 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Blocking on resolved domain name You could create a filter file to block REVDNS matching outgoing.liverandcherrys.com if you have Junkmail Pro, or create a simple external filter if you don't. Darin. - Original Message - From: John Carter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, November 15, 2005 1:51 PM Subject: [Declude.JunkMail] Blocking on resolved domain name I am getting a lot of spam for 64.192.25.* (which come in with constantly changing domains, but actually resolve back to outgoing.liverandcherrys.com). I am reluctant to block the whole class C, but will likely end up doing so. Is there a better way to handle this? Kind of a best practices? John --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DECLUDE 1.82
What is the correct directive? MINWEIGHTTOFAIL 3 MINWEIGHT 3 I currently use MAXWEIGHT and that works, I just want to make sure I have the MIN correct before I use a new combo-filter. thanks, Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] yahoo and subjectchars test
yahoo email and subject chars Subject: bowling To: Travis Sullivan [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=0-853569865-1131749189=:26372 Content-Transfer-Encoding: 8bit X-RBL-Warning: SUBJECTCHARS: Subject with at least 50 characters found. As you can see... the subject doesn't have 50 chars a bug is causing this to fail this test. Anyone else have this? declude v 1.82 Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help-Reinstall Urgent
Did you check that declude.exe is the mail transport for imail? Just replace smtp32.exe with declude.exe. You will need to stop/start imail. I had that problem too with declude's error message. I just ran it a few times and it just went away on it's own. Then, check the headers of a test email to see if you see declude inserts. Travis - Original Message - From: Orillia ProNet Administration [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, November 07, 2005 7:17 AM Subject: [Declude.JunkMail] Help-Reinstall Urgent hello all. had a meltdown yesterday. Need help. have imail back and working, 815hf2. I restored data from backup, all is well. when i reinstalled and restored declude, it seemed to be ok. But whenever i run declude.exe in the imail directory from the Command prompt it just says first time running installing. the diag show it sees all cfg files ok. ver 1.81. email flowing but tones of junk coming in. help Cheers Mark p.s. been up since 7:30am yesterday straight, sorry for the choppy email, thank god for spell check --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Address Not Whitelisted?
Exactly, counterweight works so much better. Whitelist at the last possible option. I counterweight everything and don't have a single whitelist entry. Travis - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, November 03, 2005 7:24 PM Subject: Re: [Declude.JunkMail] Address Not Whitelisted? We've found that to be too general... You might try a regex or phrase-based whitelist that looks for unique text in the newsletter to whitelist it (or rather counterweight it). Darin. - Original Message - From: Tyler Jensen [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, November 03, 2005 7:01 PM Subject: RE: [Declude.JunkMail] Address Not Whitelisted? Try Whitelist from @returns.bulk.yahoo.com Or Whitelist from @yahoo-inc.com I have one of these to allow fantasy football and baseball emails through to my franchisees. I have not seen any spam whitelisted because of this setup and I have been using it for at least a year. It may not be the best way but it has worked for me. Tyler -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of mail-lists Sent: Thursday, November 03, 2005 6:36 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Address Not Whitelisted? I'm at my wits end.. These Yahoo news alerts are legitimate messages, but I can't seem to whitelist them. So far in my global.cf I've added WHITELIST FROM settings to the following addresses, but they still don't get to the recipient! [EMAIL PROTECTED], [EMAIL PROTECTED], and [EMAIL PROTECTED] Anybody know what else I can do to allow these e-mails in? Thanks! Cavell Received: from n10.bulk.scd.yahoo.com [66.218.66.189] by cottonwoodfinancial.com (SMTPD-8.21) id A1190444; Thu, 03 Nov 2005 13:12:25 -0600 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; b=p2OiCTjMDGenNXSS96zFPWPUJWbDSYtXDGfx+d+759EZNpjxhxAkRF35XS37W00BJ3v6G0WpK8 rYURzt55Dtrw8e6wXInDswJk67+7vNJnZRNIECCZO7cXBoKKaw2i4B8/wcWwL6WNeIq2lOUW rYURzt55Dtrw8e6wXInDswJk67+f8JH rYogvNoV28SaQReeLJUYw=; Received: from [66.218.69.2] by n10.bulk.scd.yahoo.com with NNFMP; 03 Nov 2005 19:12:53 - Received: from [66.94.229.26] by mailer2.bulk.scd.yahoo.com with NNFMP; 03 Nov 2005 19:12:53 - Received: from [127.0.0.1] by dlv8.alerts.scd.yahoo.com with NNFMP; 03 Nov 2005 19:12:53 - X-yahoo-newman-property: alerts X-yahoo-newman-id: [EMAIL PROTECTED] From: Yahoo! Alerts [EMAIL PROTECTED] Subject: **SPAM**=?UTF-8?B?S2V5d29yZCBOZXdzOiBbIkFkdmFuY2UgQW1lcmljYSJd?= To: [EMAIL PROTECTED] Reply-To: Yahoo! Alerts [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit X-Yahoo-AlertId:5cYJ5LIxGXHDwPmeko3O878bwgWlTAmS X-Yahoo-Alerts-Beta: YES Date: Thu, 3 Nov 2005 11:12:53 -0800 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: MXRATE-ALLOW: GOOD SENDER X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: MAILFROM: Domain returns.bulk.y has no MX or A records [0301]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420e]. X-RBL-Warning: SUBJECTCHARS: Subject with at least 50 characters found. X-RBL-Warning: WEIGHT10: Weight of 24 reaches or exceeds the limit of 10. X-Declude-Sender: alerts.kmydqmbqgu2wknrtmy3taljygvxdau3ikndxovs7he3gwx3hhbeha2thovsvmvjxmiyuw [EMAIL PROTECTED] [66.218.66.189] X-Declude-Spoolname: D611901607008.smd X-Declude-Note: Scanned by Declude 3.0.5.5 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [24] at 13:12:37 on 03 Nov 2005 X-Declude-Tests: MXRATE-ALLOW, CMDSPACE, MAILFROM, SPAMHEADERS, SUBJECTCHARS, WEIGHT10, WEIGHT14, WEIGHT18 X-Country-Chain: UNITED STATES-destination X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 424737504 X-IMail-ThreadID: 611901607008 Confidentiality Notice: The information contained in this transmission is intended only for the personal and confidential use of the designated recipient named above. If the receiver of this transmission is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error, and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you are not the intended recipient, please immediately notify the sender and delete this e-mail message from your system. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED],
Re: [Declude.JunkMail] Spamcop catching Gmail
I noticed that Spamcop is catching email from GMAIL.COM Is there another real-time black list to use that is as good Spamcop was. Gmail is slow on their TOS reports. I have sent in 30 so far and it normally takes 5 working days for them to kill the account and reply. However, I have spamcop set to 40% hold weight. I also use spamhause. There are many good ones, when used together with declude's weight system, they are very affective. I found most of mine at declude's web site under the free tools listing I think. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting
You can double check by scanning the whitelist section in your global.cfg file and address books for the text string. Travis - Original Message - From: Serge [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, October 31, 2005 10:39 AM Subject: Re: [Declude.JunkMail] Whitelisting Messagethanks scott, that confirms my thoughts - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Monday, October 31, 2005 2:38 PM Subject: Re: [Declude.JunkMail] Whitelisting I'm pretty confident that the Skipping4 E-mail from means an address book whitelist. - Original Message - From: Serge To: Declude.JunkMail@declude.com Sent: Monday, October 31, 2005 3:35 AM Subject: [Declude.JunkMail] Whitelisting Hi all I am tryi,g to find why an email was whitelisted I suspect autowhitelist, but how can i confirm ? the logs shows this: 10/31/2005 07:23:52 QC64AD3B100E67716 Skipping4 E-mail from [EMAIL PROTECTED] ; whitelisted [EMAIL PROTECTED] ]. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNS timeouts
http://www.declude.com/Version/Manuals/JunkMail/JM_2.0.6.asp Can you specify more than one DNS server to queary? I am getting quite a few dns timeouts. We are going to setup a dedicated caching server for declude/imail to use. I would like to use two for performance reasons. It would be nice if one timesout to use the 2nd before giving up. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail v8
I haven't seen anything from the list since mid day friday. I want to make sure I was still on it and it was working :) I actually like this list, lol - weird huh? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail v8
Has ipswitch stopped selling their mail server as a standalone unit? All I can find on their site is the Suit. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 30511 problem
This is precisely why I asked a few folks with high cpu problems to create performance monitor logs, or at least screen shots of taskmanager. I bet the high spikes are making people jump. We don't want our high dollar CPUs with TBs of RAM to spike, it just isn't supposed to be so :) However, it's the low valleys that makes the system shine. Get the email in, get it out quickly. The system loadaverage actually drops a bit. But, without some sort of STATS on this DATA we can only make assumptions. Assumptions is what accidentally FUBAR'ed the disk drive. Travis - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, October 26, 2005 11:19 AM Subject: Re: [Declude.JunkMail] 30511 problem Darin Cox wrote: In picture form, we're looking at something like 80 | /\ /\ 40 | / \/ \ 0 |__/\_/\___ vs 80 | 40 | --- 0 |___/ \___ Interesting...mine looks like this though :) .:: . :::`:: .::..::. .: . `:::``::: `:: ::'zc$$$b`:',cc,`:::' :''``,c=`:::' '::: $c,,u,zd$c,',zc,`' ::'z$ccd$P . .. `?. :::dP?$$$ d$$$b.$$L,`::: :.::$$ z$$$c,::.. `'::'`.F$3$$?$$?$$P:..:'' `:`$$$? .. ?$$r` 3$c`: :.?:`$$Fd$$.P4$c $/ :J$ .,,P ,$$$F `:::'```'',d$$c`?PJ.$P db`'' f,r4b4$c ,`.-$$c c$$$ b F ,$dc$bd$$$ b$bJ$L$$$P P ?$$$P??$$$P ' `???$PFFF 4$$cdc$$$bccbc d$$$bc $$$??$$$FF?P 3$$c. dP':::`?' ?$$c. 4$P $ ::: ?$c $P `$.:: `.$c .$$' `$-`::' c$$$ z$$' . .d$$' `::: .$$$F' d$$$' `:: ,$$P .$$$F::: 3c, . 4P' z$$$ :: ==$c % ? z$$ ...:3P L `?$$$.?::: . $ .ccc$L ? :::.c% :$$ ?=?P$$$% :???$%== d :. `::: :: : :zcc`` :::'zc,cd$$ `??? `',d$$$ = `` $$ $c$F `$ $$F `$$$F$$ `$$'$$F 4F$P zF $P c$ J$F .$$z$$ $P c$$$ $ 4$$$F d ' .$$$P4$$$ J$$ $$F $P?$ dF F $$$P $$$P J$$P$$$' .$$P .$$$ `$$$L z$$$F/ $$$ %/ ( ;. ?. ;?`` `. \ \.- ` `--' Matt --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
Re: [Declude.JunkMail] 30511 problem
I recomend getting some stats/data on the topic. Use performance monitor/log the data with v9 for a few hours, then with v11. This would give them spikes and clear data as to what is going on. I advise that you monitor cpu usage, along with declude proc, declude queue process, imail pop3d/webmessaging. Perhaps that will help them see your problem clearer. Travis - Original Message - From: Harry Vanderzand [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, October 25, 2005 3:29 PM Subject: RE: [Declude.JunkMail] 30511 problem I have repeatedly switch back and forth between the two version (V9 and V11) I assure that I have changed nothing else and that cpu usage is higher on the V11 I watch V9 cpu usage I go from V9 to V11 and cpu usage increases Back to V9: it goes down Back to V11 it goes up. How else does one state this problem? It would make a lot of sense if Declude were to say that they have made a change in the code that would cause this, but that is not the case. Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 4:14 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Andy, don't be scared I can hold you hand :) How do I explain the apparent inconsistency where users report that the CPU consumption is considerable higher than in the prior version? First we need to confirm that it is decludeproc that has increased in CPU usage. So far I have not seen any real statistics for this other than what has been posted on the boards. But I am certainly trying to validate this information. How can the various process settings make any difference - at worst it should spike quickly and then be idle? Why do you think it should spike and then become idle ? What is spending all this other CPU time on? Looping, looking for directory content? Perhaps an incorrect assumption, Declude actually uses less CPU, between 3% and 20% on average. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, October 25, 2005 2:33 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Okay, I'm watching these discussions - as I'm still truly scared of upgrading Declude. I just can't figure out the logic behind all the CPU consumption and why certain process parameters are suspected to have detrimental effects. Please verify my thinking: A machine that needs to process a given amount of mail will require a certain number of instructions, which are reflected in the total CPU usage. If several messages come in almost simultaneously, then I can either process them right away using parallel processes, causing a short spike in CPU use - or I can process them one by one, using up the same CPU time over time and causing a few seconds delay in mail delivery. Either way, the overall CPU consumption should be the same - just distributed differently. So - if the above is true, how do I explain the apparent inconsistency where users report that the CPU consumption is considerable higher than in the prior version? How can the various process settings make any difference - at worst it should spike quickly and then be idle? If the old Declude handled the amount of mail with moderate CPU use and without causing noticeable delays in mail delivery to the users - then I can't see how the same outcome suddenly should require x times the CPU resources, no matter how inefficient the process settings are? What is spending all this other CPU time on? Looping, looking for directory content? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster Sent: Tuesday, October 25, 2005 10:13 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem I changed the THREADS to 75 and CPU wnet down to about avg 50%. I'll try WAITFORMAIL in just a bit. I also noticed in my spool folder I have a new folder called s that appeared with the time stamp of the new proc install. There is nothing in it; just a blank folder. I deleted it. Sincerely, Randy Armbrecht Global Web Solutions, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 9:39 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 30511 problem Randy try changing WAITFORMAIL 1500 To WAITFORMAIL 500 See if that changes the delay. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster
Re: [Declude.JunkMail] SPAMC32 -e option in JunkMail
My hold weight is 15, I don't worry about the negetive weights right now. Once my cpu optimization is completed and URI scanning is done, I am going to change my focus on improving spamassassin. I can tell you this, from stats, that the use of spammassassin with my other tests has reduced my spam by 33%. spamc32 normally adds 1 to 6 points to spam messages, thereby, allowing me to reduce the scores on my other tests, reducing false positives, and further punishing spam. Since I have done this, I have received emails from mailing lists that I used to have signed up for years ago :) Contact me off list if you want further details of my config file. I love this declude system, and spamc32, it has become quite the hobby to me :) Travis - Original Message - From: Geoff Varney [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, October 24, 2005 1:21 PM Subject: RE: [Declude.JunkMail] SPAMC32 -e option in JunkMail Thanks Travis. I have now begun to see some results in my declude log file that shows what I did is passing the score on to declude. However, the problem there is that I have set the SPAMASSASSIN action to add a footer that the message is likely SPAM, and it adds that when the test is failed, even negative scores from SA. What is your hold weight? I have my routeto (a SPAM folder I review) weight at 10 which doesn't give to many false positives. I wonder what your hold weight is so that I can tailor your command line to suit my hold weight if different than yours. Is there a way to ensure that the SPAMC32 weight passed to JM doesn't go negative? Geoff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Monday, October 24, 2005 11:01 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SPAMC32 -e option in JunkMail Hi Geoff, this is what I use: SPAMASSASSIN external weight e:\imail\declude\spamd\spamc32.exe -d #serverIP# -cw %WEIGHT% -sw 15 -e -et 11 -f I don't want to check spamassassin if my hold weight is already reached, and I don't want the message to weigh more than 11 from spamassassin, prevents one test from failing a message, thereby reducing false positives. This allows the score to come from spamassassin, not assigning 10 points to all failed spamassassin tests. Most of spam assassin tests only return 1 to 5 points. It is working for me quite well. Travis - Original Message - From: Geoff Varney [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, October 24, 2005 12:53 PM Subject: [Declude.JunkMail] SPAMC32 -e option in JunkMail Hi, I am finally getting SpamAssassin working for my JunkMail with SPAMC32 (0.5.57) calling SPAMD from a Linux box. With training of the Bayesian databases well underway I am seeing significantly more SPAM being caught. However, I'd like to verify the way the SPAMASSASSIN entry in the Declude global.cfg works. Here is what I had originally: SPAMASSASSINexternalnonzero c:\imail\declude\filters\spamc32\spamc32.exe -u spamd -d IP of SPAMD server -cw %WEIGHT% -sw 10 -y -f 10 0 This works fine, but the weight of 10 then assumes all SpamAssassin identified messages are SPAM since Declude considers 10 the score for SPAM. So I thought I'd use the -e option for SPAMC32 to pass the actual SA score to Declude to possibly minimize false positives. Here is the line I have now: SPAMASSASSINexternalnonzero c:\imail\declude\filters\spamc32\spamc32.exe -u spamd -d IP of SPAMD server -e -cw %WEIGHT% -sw 10 -y -f Is this correct usage? By using -e and dropping the weights at the end of the command line does this then pass the SA weight for Declude to apply to the total weight? I think this is what's happening now, but wanted to check with someone who has used this for a while and knows it better than I do. Thanks, Geoff --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] test order
Is it a fact that declude processes in the order the results apear in the logs, from left to right? Thanks, Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] test order
Is it a fact that declude processes in the order the results apear in the logs, from left to right? external tests, ip4, dns, declude app tests, then custom filters Then, this means the external test of spamc32/spamassassin with the skipifweight option is used is meaningless since it is the first test fired. Only then our custom filters being last make the difference. Thus, if you have a safe-mail filter like I do, crediting points to mail servers considered safe, will have little affect if the global.cfg file contains stoponfirstdelete. Thereby forcing wider use of whitelists. It would be nice if WE had the option of setting the global.cfg in order of which WE wanted the tests to fire. I am sure since I am relatively new at this, someone has said this before. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] test order
I wish one of the guys from declude would chime in. Well my logs report the tests failed in order they were listed in the global.cfg file. Everytime. I moved a few around just to see and they did follow. But, from what you all said here, that doesn't matter. Declude folks? Since external tests create the most load on the system, it would be nice to run them last and only if skipifweight hasn't been met. Travis - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, October 24, 2005 10:28 PM Subject: Re: [Declude.JunkMail] test order I think the order is: ip4r rhsbl declude internal spamdomains external ipfile/fromfile filters - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, October 24, 2005 9:57 PM Subject: Re: [Declude.JunkMail] test order Is it a fact that declude processes in the order the results apear in the logs, from left to right? Thanks, Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] test order
Keep in mind, I don't use the high scoring system like most of you seem to. Most of my tests are worth 3 points, with the highest being 7, unless spamassassin reaches it's max of 10. Here is one example: 10/24/2005 21:58:40 Q9f5a23100098a3fc Tests failed [weight=75]: SPAMCOP=WARN MXRATE-BLOCK=WARN FIVETENSRC=WARN DSBL=WARN SORBS-DUHL=WARN NJABLDUL=WARN SERVICESNET=WARN WHOIS-INVALID-DYNA=WARN HELOBOGUS=WARN REVDNS=WARN ROUTING=WARN CMDSPACE=WARN SUBJECTCHARS=WARN NONENGLISH=WARN DYNHELO=WARN WEIGHT20=DELETE WEIGHT30=DELETE If this scan stopped at 20, on the 1st delete, look at all the cpu that would have been saved :) Since I use skipifweight on spamc32 and all custom filters, spamc32 nor custom filters ran on this example. So, they definately don't fire in the order of the tests in the log file, otherwise spamc32 would have scored a hit. Travis - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Travis Sullivan Declude.JunkMail@declude.com Sent: Monday, October 24, 2005 10:43 PM Subject: Re[2]: [Declude.JunkMail] test order Then, this means the external test of spamc32/spamassassin with the skipifweight option is used is meaningless since it is the first test fired. Not exactly meaningless -- I place it after Sniffer and a couple of other external tests, for example, and if you weight DNSBL/IP4R tests high enough, you can make use of it. For custom filters, rather than indicating preemption in the definition of the test, you have to build the preemption into the text of the custom filter with 'END,' 'SKIPIFWEIGHT,' and 'STOPALLTESTS' lines. I am sure since I am relatively new at this, someone has said this before. Yes. And I'm definitely with you; full control over test order would be an obvious improvement. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] found something new to me
I want to use combo filtering with testsfailed to further punish emails that fail two or more of the reliable tests. If I could get started with the correct format, I can build it from there. In scotts example: TESTSFAILED 32 CONTAINS REVDNS-DUL-KEYWORDS what is the purpse of the hyphens seperating the test names? Travis - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, October 23, 2005 9:00 AM Subject: Re: [Declude.JunkMail] found something new to me Travis, The one thing to keep in mind is that TESTSFAILED is a variable that lists the tests that failed. The order of the TESTSFAILED line as you know is dependent on which tests failed. Essentially for a one line in the filter to try and list two tests names would be difficult to hit on. The example that Scott sent is the best approach since it uses CONTAINS and one test per line in the filter. The point that Matt was trying to get across was that if you tried to list them on the same line it is very difficult cause you have to take specific ordering into account whereas Scott's example with one test per-line is the easiest way to do it. I think the best thing until you get the hang of this would be to post what you want to do and what you have up to this point and we can guide you home on if it will work and if it does not how to tweak it to work. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Travis Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, October 23, 2005 12:12 AM Subject: Re: [Declude.JunkMail] found something new to me Thanks for the reply Nick. No, not at all. I thought I did. global.cfg contents: COMBO filter C:\IMail\Declude\lists\combo.txt x 0 0 combo.txt file contents: TESTSFAILED 10 CONTAINS testname1-testname2 So, any test I want to combo script simply take the testname and seperate them by a hyphen? like: SPAMCOP-SBL I thought that is how it was setup, then scott emailed this example: MAXWEIGHT 100 TESTSFAILED 60 CONTAINS NJABL-DUL TESTSFAILED 75 CONTAINS NJABL-DYNABLOCK TESTSFAILED 60 CONTAINS SORBS-DUHL Now Matt says this: TESTSFAILED 0 CONTAINS SPAMCOP SBL XBL (no hypens) And he said they have to be in the correct order for a matching string. I guess I have to look in the logs for the correct order. Anyone have a whitepaper on this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] cmdspace command
declude 1.82 ms-outlook express win xp cmdspace scores a hit... here are my headers: - Original Message - From: Serge [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, October 23, 2005 1:50 PM Subject: Re: [Declude.JunkMail] found something new to me Matt said: On the other hand, if you want to tag just two tests in combination, this is very easy to do using a different approach. For instance, if you wanted to filter for something that failed both SPAMCOP and XBL (and anything else), you could do so as follows: TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED 0 CONTAINS XBL why can't this approach be used for any number of tests ? TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED END NOTCONTAINS SBL TESTSFAILED 0 CONTAINS XBL will tag a message that failed all 3 tests. No ? - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, October 22, 2005 9:06 PM Subject: Re: [Declude.JunkMail] found something new to me Travis, Not exactly. The TESTSFAILED string is a space separated string of tests that failed, so if SPAMCOP, SBL and XBL hit, the string would look like the following: SPAMCOP SBL XBL If you are looking for more than two tests, it requires you to have the order the same as Declude records them, so for instance the above string would need to be matched exactly like so: TESTSFAILED 0 CONTAINS SPAMCOP SBL XBL The following wouldn't hit however because the string wouldn't match: TESTSFAILED 0 CONTAINS SBL XBL SPAMCOP That means that you have to be careful about how you order your tests if you are looking to match more than two, and you also have to be aware of the order in which Declude runs certain types of tests, for instance all blacklists are run before built-in Declude tests, and those are run before External tests, and External tests are run before custom filters. Sometimes you can just make non-scoring filters to tag a certain test in order to guarantee their order just in case there are other tests that can appear in between them. On the other hand, if you want to tag just two tests in combination, this is very easy to do using a different approach. For instance, if you wanted to filter for something that failed both SPAMCOP and XBL (and anything else), you could do so as follows: TESTSFAILED END NOTCONTAINS SPAMCOP TESTSFAILED 0 CONTAINS XBL Why is this so difficult? Because it wasn't designed for combo-ing tests...but you can make it do just that with a little elbow grease. Combo-ing tests is a kludge that came about after the TESTFAILED variable was introduced for a separate reason. Matt Travis Sullivan wrote: I think I got it... I am slow, I know :) global.cfg contents: COMBO filter C:\IMail\Declude\lists\combo.txt x 0 0 combo.txt file contents: TESTSFAILED 10 CONTAINS testname1-testname2 So, any test I want to combo script simply take the testname and seperate them by a hyphen? like: SPAMCOP-SBL ? Thanks, I can definately see how this can further punish emails... allowing us to lower the scores of the individual tests. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT and other cpu saving tricks
SKIPIFWEIGHT Can I use this to prevent spamd from running if the current weight of the email already excedes a delete action? I am using 1.82 so I don't have the global option to stoponfirstdelete. I have my delete option set at 20, but I see in the logs that declude is still scanning after that with many scores in the 35s and beyond. Woops! I forgot to add something very important. I know we can stop processing text files with filters... but I need to know if I can use skipifweight to prevent spamd(spamassassin) from launching if the score is already high enough? If so, how? I am trying desperately to reduce the cpu consumption on our server. Thanks!!! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] NT firewall
Anyone still running NT4 on some older mail servers? If so, are you using any software application as a firewall? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] found something new to me
Thanks for the reply Nick. No, not at all. I thought I did. global.cfg contents: COMBO filter C:\IMail\Declude\lists\combo.txt x 0 0 combo.txt file contents: TESTSFAILED 10 CONTAINS testname1-testname2 So, any test I want to combo script simply take the testname and seperate them by a hyphen? like: SPAMCOP-SBL I thought that is how it was setup, then scott emailed this example: MAXWEIGHT 100 TESTSFAILED 60 CONTAINS NJABL-DUL TESTSFAILED 75 CONTAINS NJABL-DYNABLOCK TESTSFAILED 60 CONTAINS SORBS-DUHL Now Matt says this: TESTSFAILED 0 CONTAINS SPAMCOP SBL XBL (no hypens) And he said they have to be in the correct order for a matching string. I guess I have to look in the logs for the correct order. Anyone have a whitepaper on this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] found something new to me
http://www.mail-archive.com/declude.junkmail@declude.com/msg24116.html anyone doing any of these combo tests? sounds very cool! I have not used them and would highly welcome any tips any of you might have. Also, is declude 2.9 the single process mode or the new application thread model? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: AOL message size restrictions?
To be sure that attachments are delivered to AOL customers, Zip them, or do whatever you have to do to be sure they do not exceed 700K. In my experience, attachments under 700K almost always get through. AOL mail servers are throttling inbound message sizes dynamically, I have a friend that works in one of the many IT sections. It is best to zip the file, upload it to a web server, and mail that link to your recip. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] spamheaders
Anyone using norton av 2005 with outlook express with outgoing mail scanning enabled will trip the spamheaders test. I just thought everyone should know. I guess that just about obsoletes this test now? I am using declude 1.81 Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamheaders
I understand that, but we don't have control over norton antivirus's method of scanning outgoing email. Also note the emails also fail the test cmdspace (space in receipt to command). Users/clients sending e-mail out should be authenticating and authentication should be whitelisted hence the test does not matter. As for receiving, find out what the common string is that is used in the headers and add that to your whitelisting file giving credit for the same amount as the spamheaders test. John T eServices For You Anyone using norton av 2005 with outlook express with outgoing mail scanning enabled will trip the spamheaders test. I just thought everyone should know. I guess that just about obsoletes this test now? I am using declude 1.81 Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamheaders
I care if my users aren't getting emails from anyone on the plant when their emails are scored high due to the spamheaders test. I can't whitelist everyone. I am not sure if you understand my question John? Travis - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, October 11, 2005 7:56 PM Subject: RE: [Declude.JunkMail] spamheaders Who cares if the client is authenticating and you are whitelisting authentication? John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Tuesday, October 11, 2005 5:45 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] spamheaders I understand that, but we don't have control over norton antivirus's method of scanning outgoing email. Also note the emails also fail the test cmdspace (space in receipt to command). Users/clients sending e-mail out should be authenticating and authentication should be whitelisted hence the test does not matter. As for receiving, find out what the common string is that is used in the headers and add that to your whitelisting file giving credit for the same amount as the spamheaders test. John T eServices For You Anyone using norton av 2005 with outlook express with outgoing mail scanning enabled will trip the spamheaders test. I just thought everyone should know. I guess that just about obsoletes this test now? I am using declude 1.81 Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] emergency! declude.exe won't install
long story short, we had to reinstall the OS on our primary server last night. I had installed .net framework for another project of mine, and I missed the security patch, we were hit via this exploit. Now, the system is fully restored but when I type declude.exe at a cmd prompt, I get: It just keeps repeating this over and over... ideas? E:\IMAILdeclude.exe Declude 1.81 (C) Copyright 2000-2004 argc2 First time running... installing... thanks, Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] emergency! declude.exe won't install
E:\IMAILdeclude.exe Declude 1.81 (C) Copyright 2000-2004 argc2 First time running... installing... Well, even the -diag states it's running for the first time. Nevertheless, after about the 10th time of installing it... it took and now is working well again. whew! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] emergency! declude.exe won't install
the dotNET framework I installed for dmrtg to work I missed the service pack/hot fix, 48 hours or so laterBAM! Those exploit bots are fast! Travis - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, September 29, 2005 1:47 PM Subject: Re: [Declude.JunkMail] emergency! declude.exe won't install Travis, What exploit did you get pop'ed with? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Travis Sullivan writes: E:\IMAILdeclude.exe Declude 1.81 (C) Copyright 2000-2004 argc2 First time running... installing... Well, even the -diag states it's running for the first time. Nevertheless, after about the 10th time of installing it... it took and now is working well again. whew! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] declude - cnn.com email alerts
anyone know of the REVDNS server that send out CNN's email alerts? I wanted to score it -40 until I figure out why they are not getting through. thanks, Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains.txt
I am having a problem where the spamdomains list is blocking cc.com, but also is blocking another legitimate domain, emmcc.com. Is there a way to continue blocking cc.com, but not block emmcc.com? Maybe something in the spamdomains.txt file I can change? I will take a stab at this one. in your filter, set your domain to: .cc.com That will prent blocking anythingelsecc.com Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] critique my global.cfg file with regards to blacklist use
Thank you so much Scott for taking the time with my global.cfg file. Your help/advise was very appreciated. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[8]: [Declude.JunkMail] declude / spamassassin
'returnvalue' would be better written returnvalue, i.e. it's a variable -- the the return value you're watching for. But you don't want an 'external retunvalue' type. You want an 'external weight' type. I couldn't get 'external weight' to work, am I missing something? SPAMASSASSIN external weight e:\imail\declude\spamd\spamc32.exe -d 209.215.97.193 -e -et 6 -f 4 0 Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] dnsbl locations explained???
SBL+XBL sbl-xbl.spamhaus.org 127.0.0.2-6 Combined zone to reduce queries Includes both SBL and XBL zones I have: sbl-xbl.spamhaus.org* But I am wondering on the downside of such a wildcard. Will the system check ANY/ALL IPs belonging to that domain, or just the first response? Anyone know? I am thinking perhaps we should list all IPs to cut down on system hunting? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] declude / spamassassin
I can't find documentation with regards to how to use a remove spamassassin server as an external test in declude v 1.81. Any help will be much appreciated. Thanks! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude / spamassassin
Sorry, that was a typo, remove = remote :) I am looking into your plugin now, is this plug in the only way? I simply can't just use the IP of my spamassasin server somehow? - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, September 20, 2005 12:29 PM Subject: RE: [Declude.JunkMail] declude / spamassassin Travis not sure what you are asking with how to use a remove :) 1. To remove the external test just # comment out the test in your global.cfg 2. To use spamassassin I would suggest using this plugin SPAMC32 http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Tuesday, September 20, 2005 1:21 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] declude / spamassassin I can't find documentation with regards to how to use a remove spamassassin server as an external test in declude v 1.81. Any help will be much appreciated. Thanks! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude / spamassassin
These are the columns in my global.cfg file, can you help me plug this in? SECURITYSAGE rhsbl blackhole.securitysage.com 127.0.0.5 3 0 (minus the word wrap, is this exactly as it needs to be entered?) what are these flags? spamc32.exe -D -d 12.152.254.3 -a 16000 -lt 4 ht 100 -f EXTERNAL.SPAMASSASSIN_v3.04externalNONZERO e:\imail\declude\spamd\spamc32.exe -D -d 12.152.254.3 -a 16000 -lt 4 ht 100 -f 60 - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, September 20, 2005 12:45 PM Subject: Re: [Declude.JunkMail] declude / spamassassin Hi Travis - Sandy's plugin does the 'somehow' part. Simply have it point to your spamd. Here is the line from my global.cfg that may help - EXTERNAL.SPAMASSASSIN_v3.04externalNONZERO e:\imail\declude\spamd\spamc32.exe -D -d 12.152.254.3 -a 16000 -lt 4 ht 100 -f 60 -Nick Travis Sullivan wrote: Sorry, that was a typo, remove = remote :) I am looking into your plugin now, is this plug in the only way? I simply can't just use the IP of my spamassasin server somehow? - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, September 20, 2005 12:29 PM Subject: RE: [Declude.JunkMail] declude / spamassassin Travis not sure what you are asking with how to use a remove :) 1. To remove the external test just # comment out the test in your global.cfg 2. To use spamassassin I would suggest using this plugin SPAMC32 http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Travis Sullivan Sent: Tuesday, September 20, 2005 1:21 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] declude / spamassassin I can't find documentation with regards to how to use a remove spamassassin server as an external test in declude v 1.81. Any help will be much appreciated. Thanks! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude / spamassassin
SPAMASSASSINexternalnonzero c:\imail\declude\spamc32.exe -cw %WEIGHT% -sw 10 -f choose a weight 0 -f is supposed to be the filename... but the example doesn't give one. So, how does spamc send a file name to spamd? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude / spamassassin
Thanks guys, I have it working now! BTW... any way to retrieve any info from SA with regards to test failed or weight? This is what I have in my logs: Msg failed SPAMASSASSIN (Message failed SPAMASSASSIN: 1.). Action=WARN All I have is a 1, that is the score I have set as the test weight, for now until I figure it all out, with your help of course :) Thanks Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] declude / spamassassin
Anyway, the next version of SPAMC32 is coming out very soon with the ability to consult a local SPAMC32 log file (rather than the main SPAMD log file) to check which individual SA rules failed for each message; this is a definite need. Thanks Sandy, I just wanted to make sure I wasn't missing anything. So, the only thing I will see in the headers is the total score SA results: X-RBL-Warning: SPAMASSASSIN: Message failed SPAMASSASSIN: 3. And declude scores only for the test group, like other tests in the global.cfg file? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude / spamassassin
Nick, If you don't mind, is SA heavy on the CPU? What kinda load are you running with SA? I have 3k plus users getting 300k emails per day... my SA is running on a linux server, P4 2ghz... no increase in load when I started using SA with declude today. The best config I have set is: SPAMASSASSIN externalnonzero e:\imail\declude\spamd\spamc32.exe -d 209.215.97.193 -r -lt 4 -et 6 -f 3 0 I 'think' so far that spamassassin only reports if SA's score is 4 or more, if so, I score it a 3 on the email test. I am still playing with the values to tune the system. thanks for everyone's help today. I hope to have MRTG running reports on declude soon to show some statistics. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] critique my global.cfg file with regards to blacklist use
DSBL ip4r list.dsbl.org * 3 0 ORDB ip4r relays.ordb.org * 3 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 3 0 SERVICESNET ip4r korea.services.net* 3 0 ORID ip4r dnsbl.antispam.or.id127.0.0.2 3 0 FABELSOURCES ip4r spamsources.fabel.dk127.0.0.2 3 0 AHBL ip4r dnsbl.ahbl.org * 3 0 BLITZEDALL ip4r opm.blitzed.org * 3 0 CBL ip4r cbl.abuseat.org 127.0.0.2 3 0 SBL ip4r sbl-xbl.spamhaus.org* 3 0 NJABL ip4r dnsbl.njabl.org 127.0.0.2 3 0 NJABLDUL ip4r combined.njabl.org127.0.0.3 3 0 NJABLFORMS ip4r dnsbl.njabl.org 127.0.0.8 2 0 NJABLPROXYS ip4r dnsbl.njabl.org 127.0.0.9 2 0 NJABLSOURCES ip4r dnsbl.njabl.org 127.0.0.4 2 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 2 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 2 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 2 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 2 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 2 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 2 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 2 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 2 0 SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 2 0 FIVETENDUL ip4r blackholes.five-ten-sg.com 127.0.0.3 2 0 FIVETENFREE ip4r blackholes.five-ten-sg.com 127.0.0.12 2 0 FIVETENIGNORE ip4r blackholes.five-ten-sg.com 127.0.0.7 2 0 FIVETENKLEZ ip4r blackholes.five-ten-sg.com 127.0.0.10 2 0 FIVETENMULTI ip4r blackholes.five-ten-sg.com 127.0.0.5 2 0 FIVETENOPTIN ip4r blackholes.five-ten-sg.com 127.0.0.4 2 0 FIVETENOTHER ip4r blackholes.five-ten-sg.com 127.0.0.9 2 0 FIVETENSINGLE ip4r blackholes.five-ten-sg.com 127.0.0.6 2 0 FIVETENSRC ip4r blackholes.five-ten-sg.com 127.0.0.2 2 0 FIVETENTCPA ip4r blackholes.five-ten-sg.com 127.0.0.11 2 0 FIVETENWEBFORM ip4r blackholes.five-ten-sg.com 127.0.0.8 2 0 CSMA-SBL ip4r sbl.csma.biz 127.0.0.2 2 0 JAMMDNSBL ip4r dnsbl.jammconsulting.com127.0.0.2 2 0 INTERSIL ip4r blackholes.intersil.net 127.0.0.2 2 0 MXRATE-BLOCK ip4r pub.mxrate.net 127.0.0.2 3 0 MXRATE-SUSPICIOUS ip4r pub.mxrate.net 127.0.0.4 3 0 SPAMBAG ip4r blacklist.spambag.org 127.0.0.2 2 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org127.0.0.4 1 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 1 0 BOGUSMX rhsbl bogusmx.rfc-ignorant.org 127.0.0.8 3 0 DNSILLEGAL rhsbl in.dnsbl.org 127.0.0.5 3 0 DNSFRAUD rhsbl in.dnsbl.org 127.0.0.3 3 0 DNSMAILLIST rhsbl in.dnsbl.org 127.0.0.6 3 0 DNSPROMO rhsbl in.dnsbl.org 127.0.0.4 3 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] declude / spamassassin
The best config I have set is: SPAMASSASSIN externalnonzero e:\imail\declude\spamd\spamc32.exe -d 209.215.97.193 -r -lt 4 -et 6 -f 3 0 I 'think' so far that spamassassin only reports if SA's score is 4 or more, if so, I score it a 3 on the email test. I am still playing with the values to tune the system. I think your external test's behavior won't be what you expect. The -et switch won't be used without the -e switch, the -lt switch won't be used without the -ht switch, and the -r switch report isn't parsed by Declude, so what you're saying is the same as if you had no special switches at all: Just gimme a 0 if SPAMD says it's ham, and a 1 if SPAMD says it's spam. What did you want it to do? --Sandy A few more tests later, I have found the SA results of 1 to be spam, and my global.cfg line scores a hit at 3, this 3 gets added to the result of SA's 1 and therefore I get 4 points. Hummm... I was hoping to get the real score of SA, max of 10, and score that value against the email message for the weighting system. So, for now, it's ham or spam :) Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[4]: [Declude.JunkMail] declude / spamassassin
Sandy;
There should be no _addition_ of Declude-defined weights to external
test result codes! I don't even know how your test definition could be
doing that. Certainly, that's not the intended use of SPAMC32.
Yes, another mistake on my part. Sorry :(
What's confusing you seems to be the way of pairing Declude's external
test types ('external nonzero' or 'external weight') with the related
SPAMC32 options (default or '-e').
A Declude 'external nonzero' test is designed for tests whose return
codes you want Declude to convert to binary pass/fail-- it's either
'pass' (return code 0) or 'fail' (return code 1+). [A test that only
returns a 0 or 1 (never 1+) can alternately be defined as an 'external
1' test, but I think most people just use the catchall 'nonzero'
type.] After you define a a test as nonzero, from the manual:
Can you point me to the manual please? :)
I would like to see what else can be done besides the nonzero (ham or spam).
I would like to rate how smelly the spam is :)
On the other hand, a Declude 'external weight' test is designed for
tests whose return code you want to reuse _as_ the Declude weight for
the test. This is designed for tests that return a range of values
that represent increasing spamminess, such as SPAMC32 with the -e (and
optionally the -et) option. In these cases, you're passing the SPAMD
weight, up to the -et threshold, directly back to Declude, which is
what you seem to want to do.
Hummm... I was hoping to get the real score of SA, max of 10, and
score that value against the email message for the weighting system.
So, for now, it's ham or spam :)
Only because you haven't defined the test correctly in Declude. :)
Yes, exactly, this is what I want to do :)
Travis
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: Re[6]: [Declude.JunkMail] declude / spamassassin
Take a look: http://www.declude.com/Version/Manuals/2.0.6.asp Ah! I was thinking of your manual. Well, anyhow, I couldn't get the 'returnvalue' to work. only nonzero seams to work. any ideas? I used the following without success: SPAMASSASSIN externalreturnvalue e:\imail\declude\spamd\spamc32.exe -d 209.215.97.193 -e -et 6 -f 4 0 ideas? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude v1.30 released (beta)
Also, the size of the Declude.exe has been shrunk to about 1/2 of its original size, so don't be alarmed if it appears small. The beta can be downloaded from http://www.declude.com/junkmail/support/ip4r.htm . Scott, Will our old version of Delcude and the basic config file work with the new one? All we were using it for was basic RBL tests. Also, does anyone offer their config file for sale? This program as become quite complex and we are very interested in purchasing help from someone to get a good setup working. Travis Sullivan [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Declude crashing and taking up 99% CPU
I have tried my best to help with this issue, research, testing, etc. During a normal business day, declude is awesome - working very nicely as advertised and very reliable. Perhaps, on an email server with less traffic, some declude customers wouldn't even know of any reliability issues. I think I have narrowed down the issue with our declude operation. During a normal time period, we do pass a ton of emails, but during the moments when the flood gates open and spam flows in, this causes many declude.exe's to run. Some use 99% of the CPU, while others simply use up memory. In my opinion, an opinion from a non-programmer, I would think that there should only be one declude.exe running (as a service perhaps). In the event that declude can't handle a High Surge of Spam, then declude should pass the junk mail on to imail for normal processing. With Imail limiting smtp32.exe to just 30 instances (configurable by the registry), this would not cause a problem with the desktop heap. You could even trim down the smtp32.exe count to 10. Then, when the flood gates open, the mail will just be a little slow, but reliable. I think this would make a more reliable server. Again, I am only TRYING to help and give ideas. My intent is not to step on anyones toes. I will keep looking at the list to see when they have this problem fixed, but we can't continue to provide poor uptime on our mail server. I do want to add one final note, my hats off to Scott for a great product design and truely remarkable tech support. I honestly don't know when he sleeps. Outstanding work ethics Scott!!! Travis Sullivan --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Declude crashing and taking up 99% CPU
What are the major differences between 1.23 and 1.24+ If 1.23 fixes our problem, then I want to downgrade. Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] imail / declude access violations since the install of declude
In my fight to end these access violations with declude and smtp32.exe, I have found another fix that may help reduce or eliminate this issue: 100s of declude.exe's running, eventually causing the need for a reboot due to problems with the user32.dll This document introduces three more possible fix actions for reducing access violations: ipswitch document# IM-19990608-dm01 I was wondering what versions of IMAIL people are using with declude? We are using 5.9 Has anyone noticed if imail 6 or 7 was more reliable than 5? Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
