Re: [Declude.JunkMail] Filter Rule Mistake
>Perhaps blocking on "odc.ca." would be the best option here (including the >"." at the end)? Hey! Good idea. Dropping that in right now. Thanks ;) Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
>Perhaps blocking on "odc.ca." would be the best option here (including the >"." at the end)? Hey! Good idea. Dropping that in right now. Thanks ;) Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
>Just as a matter of interest where did you get the idea that "$" >was a wildcard character? The way its written in the manual it just looked like it would be a wildcard. You can't have a $ sign in a valid domain name or an email address so I just assumed thats what it was. Thanks for pointing this out -- the manual has been changed to clearer examples. >For the odc.ca rule, what are you looking to block? We've been getting messages like this: X-Declude-Sender: [EMAIL PROTECTED] [207.158.45.51] With the sending username containing odc.ca we could block these no problem. But if I don't cut it off before the @ it'll drop all our internal email too. Perhaps blocking on "odc.ca." would be the best option here (including the "." at the end)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
>Just as a matter of interest where did you get the idea that "$" >was a wildcard character? The way its written in the manual it just looked like it would be a wildcard. You can't have a $ sign in a valid domain name or an email address so I just assumed thats what it was. On closer examination of the explanitory text, seeing the "$domain" and "$success$@" within quotes should have clued me in. [quote] HELO 8 CONTAINS $domain SUBJECT 3 CONTAINS enlarge MAILFROM 3 STARTSWITH $success$@ BODY 3 CONTAINS To unsubscribe, click here The first one would look for HELO/EHLO text that contains "$domain" in it (and if it does, a weight of 8 will be added to the weight of the E-mail), the second one would look for an E-mail that contains "enlarge" in it and add 3 to the weight of the E-mail, and the last one would look for a return address beginning with "$success$@" (and add 3 to the weight of the E-mail if there is a match). [/quote] >For the odc.ca rule, what are you looking to block? We've been getting messages like this: From: Pay Advance <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Need Extra Dough? Get it now! MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" X-Declude-Sender: [EMAIL PROTECTED] [207.158.45.51] With the sending username containing odc.ca we could block these no problem. But if I don't cut it off before the @ it'll drop all our internal email too. Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
I understood the $'s to behave as wildcards. Removing them will work for the stderr, and bounce rules but if I leave odc.ca in there without a wildcard and an @ it will drop all internal mail. Is there another way I can fix this? Declude JunkMail doesn't include wildcards. For the odc.ca rule, what are you looking to block? Also, what can I do to ensure the proper config files are used? Nothing -- Declude JunkMail takes care of that automatically. :) I thought global.cfg and $default$.junkmail where the only ones used. That is correct (unless you have set up per-user or per-domain configuration files). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
Rob, Wednesday, July 9, 2003 you wrote: RS> I understood the $'s to behave as wildcards. Just as a matter of interest where did you get the idea that "$" was a wildcard character? Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
I understood the $'s to behave as wildcards. Removing them will work for the stderr, and bounce rules but if I leave odc.ca in there without a wildcard and an @ it will drop all internal mail. Is there another way I can fix this? Also, what can I do to ensure the proper config files are used? I thought global.cfg and $default$.junkmail where the only ones used. Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
I've got a custom filter that isn't generating any error messages, but fails to catch the spam I want it to. Perhaps someone could point out the problem? >From spamfilter.txt: MAILFROM 0 CONTAINS $stderr$ MAILFROM 0 CONTAINS $bounce$ MAILFROM 0 CONTAINS $odc.ca$@ The problem is the "$" in there -- it should look like: MAILFROM 0 CONTAINS stderr MAILFROM 0 CONTAINS bounce MAILFROM 0 CONTAINS odc.ca@ If that doesn't work, the next step would be to search the log file for "SPAMFILTER", to see if E-mails are actually failing the test (you can't rely on the E-mail being re-routed by the ROUTETO command, as it is possible that a different configuration file may be used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter Rule Mistake
I've got a custom filter that isn't generating any error messages, but fails to catch the spam I want it to. Perhaps someone could point out the problem? >From my Global.CFG: SPAMFILTER filter D:\IMail\Declude\spamfilter.txt x 0 0 >From spamfilter.txt: MAILFROM 0 CONTAINS $stderr$ MAILFROM 0 CONTAINS $bounce$ MAILFROM 0 CONTAINS $odc.ca$@ >From $default$.junkmail: SPAMFILTER ROUTETO [EMAIL PROTECTED] However I'm still seeing messages like this pass through. From: Pay Advance <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Need Extra Dough? Get it now! MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" X-Declude-Sender: [EMAIL PROTECTED] [207.158.45.51] and... To: [EMAIL PROTECTED] Subject: Have What it Takes? I Cracked the Code! Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=_Part_1093706_14516957.1057719304125" ew-bounceaddress: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [216.128.76.59] Have I done this wrong somehow? Thanks, Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
