RE: [Declude.JunkMail] error message in declude log
Sometimes a cigar is just a cigar.
Look at the order of your lines. You have a duplicate pair of weight4
lines between your 7 and 8 pair.
Andrew 8)
-Original Message-
From: IMail Admin [mailto:imailad...@bcwebhost.net]
Sent: Wednesday, August 17, 2011 4:56 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] error message in declude log
Hi,
I'm getting the following lines in my log file:
08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration
in following line in configuration file ('weight' is not an ACTION). May
be a duplicate test definition?
08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4 weight x x 4 0
08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration
in following line in configuration file ('weightrange' is not an
ACTION). Maybe a duplicate test definition?
08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4r weightrange x x 4
8
They seem to only cover tests 4 and 4r, but I actually have a whole
series
of these:
#WEIGHT10 weight x x 10 0
#WEIGHT14 weight x x 14 0
#WEIGHT20 weight x x 20 0
#WEIGHT30 weight x x 30 0
WEIGHT5 weight x x 5 0
WEIGHT5r weightrange x x 5 9
WEIGHT10 weight x x 10 0
WEIGHT10r weightrange x x 10 14
WEIGHT15 weight x x 15 0
WEIGHT15r weightrange x x 15 19
WEIGHT20 weight x x 20 0
WEIGHT20r weight x x 20 29
WEIGHT30 weight x x 30 0
WEIGHT30r weight x x 30 39
WEIGHT2 weight x x 2 0
WEIGHT2r weightrange x x 2 4
WEIGHT3 weight x x 3 0
WEIGHT3r weightrange x x 3 6
WEIGHT4 weight x x 4 0
WEIGHT4r weightrange x x 4 8
WEIGHT6 weight x x 6 0
WEIGHT6r weightrange x x 6 9
WEIGHT7 weight x x 7 0
WEIGHT7r weightrange x x 7 14
WEIGHT4 weight x x 4 0
WEIGHT4r weightrange x x 4 8
WEIGHT8 weight x x 8 0
WEIGHT8r weightrange x x 8 12
WEIGHT9 weight x x 9 0
WEIGHT9r weightrange x x 9 12
WEIGHT12 weight x x 12 0
WEIGHT12r weightrange x x 12 15
I didn't have this problem before. Any idea what I screwed up?
Thanks,
Ben
(global.cfg attached)
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
This message (and any associated files) may contain confidential, proprietary
and/or privileged material and access to these materials by anyone other than
the intended recipient is unauthorized. Unauthorized recipients are required to
maintain confidentiality. Any review, retransmission, dissemination or other
use of these materials by persons or entities other than the intended recipient
is prohibited and may be unlawful. If you have received this message in error,
please notify us immediately and destroy the original.
Ce message et tout document qui y est eventuellement joint peuvent contenir de
l'information confidentielle ou exclusive. L'acces a cette information par
quiconque autre que le destinataire designe en est donc interdit. Les personnes
ou les entites non autorisees doivent respecter la confidentialite de cette
information. La lecture, la retransmission, la communication ou toute autre
utilisation de cette information par une personne ou une entite non autorisee
est strictement interdite. Si vous avez recu ce message par erreur, veuillez
nous en aviser immediatement et le detruire.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] error message in declude log
I stared at those lines for 15 minutes without seeing the obvious. Is it
weekend yet?
Thanks,
Ben
- Original Message -
From: Colbeck, Andrew
To: Declude.JunkMail@declude.com
Sent: Wednesday, August 17, 2011 5:10 PM
Subject: RE: [Declude.JunkMail] error message in declude log
Sometimes a cigar is just a cigar.
Look at the order of your lines. You have a duplicate pair of weight4
lines between your 7 and 8 pair.
Andrew 8)
-Original Message-
From: IMail Admin [mailto:imailad...@bcwebhost.net]
Sent: Wednesday, August 17, 2011 4:56 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] error message in declude log
Hi,
I'm getting the following lines in my log file:
08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration
in following line in configuration file ('weight' is not an ACTION). May
be a duplicate test definition?
08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4 weight x x 4 0
08/17/2011 16:33:31.218 q4fc823f5c012.smd Warning: misconfiguration
in following line in configuration file ('weightrange' is not an
ACTION). Maybe a duplicate test definition?
08/17/2011 16:33:31.218 q4fc823f5c012.smd WEIGHT4r weightrange x x 4
8
They seem to only cover tests 4 and 4r, but I actually have a whole
series
of these:
#WEIGHT10 weight x x 10 0
#WEIGHT14 weight x x 14 0
#WEIGHT20 weight x x 20 0
#WEIGHT30 weight x x 30 0
WEIGHT5 weight x x 5 0
WEIGHT5r weightrange x x 5 9
WEIGHT10 weight x x 10 0
WEIGHT10r weightrange x x 10 14
WEIGHT15 weight x x 15 0
WEIGHT15r weightrange x x 15 19
WEIGHT20 weight x x 20 0
WEIGHT20r weight x x 20 29
WEIGHT30 weight x x 30 0
WEIGHT30r weight x x 30 39
WEIGHT2 weight x x 2 0
WEIGHT2r weightrange x x 2 4
WEIGHT3 weight x x 3 0
WEIGHT3r weightrange x x 3 6
WEIGHT4 weight x x 4 0
WEIGHT4r weightrange x x 4 8
WEIGHT6 weight x x 6 0
WEIGHT6r weightrange x x 6 9
WEIGHT7 weight x x 7 0
WEIGHT7r weightrange x x 7 14
WEIGHT4 weight x x 4 0
WEIGHT4r weightrange x x 4 8
WEIGHT8 weight x x 8 0
WEIGHT8r weightrange x x 8 12
WEIGHT9 weight x x 9 0
WEIGHT9r weightrange x x 9 12
WEIGHT12 weight x x 12 0
WEIGHT12r weightrange x x 12 15
I didn't have this problem before. Any idea what I screwed up?
Thanks,
Ben
(global.cfg attached)
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
This message (and any associated files) may contain confidential, proprietary
and/or privileged material and access to these materials by anyone other than
the intended recipient is unauthorized. Unauthorized recipients are required to
maintain confidentiality. Any review, retransmission, dissemination or other
use of these materials by persons or entities other than the intended recipient
is prohibited and may be unlawful. If you have received this message in error,
please notify us immediately and destroy the original.
Ce message et tout document qui y est eventuellement joint peuvent contenir
de l'information confidentielle ou exclusive. L'acces a cette information par
quiconque autre que le destinataire designe en est donc interdit. Les personnes
ou les entites non autorisees doivent respecter la confidentialite de cette
information. La lecture, la retransmission, la communication ou toute autre
utilisation de cette information par une personne ou une entite non autorisee
est strictement interdite. Si vous avez recu ce message par erreur, veuillez
nous en aviser immediatement et le detruire.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Declude 4.10.78 Interceptor 3.4.10.508 Available
Please contact supp...@declude.com if you need assistance with your upgrade. Version Part Type Change 4.10.78 AVG FIX Update AVG Key license key Exp=2012-04-10 4.10.77 AV ADD Fixed virus emails being deleted instead of being held in the virus directory, problem was introduced with 4.10.72. (IMail Only) 4.10.76 JM FIX Fixed crash due to buffer overflow (to many recipients) when the last action is DELETE 4.10.75 DEC FIX Fixed ALLOWVULNERABILITIESFROM which was not working with certain vulnerabilities, such as OBJECT DATA, Partial vulnerability and Outlook 'Blank Folding' vulnerability. 4.10.74 JM FIX Fixed emails being tagged by Declude as Outbound when should be Inbound. Declude will exit from loading the domains name (host) to memory, when the Aliases entry in the registry is missing from one of the domain. (IMail only) 4.10.73 DEC ADD Added the Declude Key in the diags.txt file David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com Description: Description: Description: -declude Description: Description: Description: -dnsstuff --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. image001.pngimage002.png
RE: [Declude.JunkMail] regular expressions and IS
Rich, PCRE searches against BODY can be very expensive, particularly when you
do a .* expression, which will try to match very long strings.
You can give your CPU a break by changing .* to a judicious text size
restriction e.g. .{5,100}
body 0 PCRE (?i:^http\:\/\/.{5,100}\.(html|htm|php)$)
Andrew 8)
-Original Message-
From: Rick Davidson [mailto:rdavid...@nat.com]
Sent: Tuesday, August 09, 2011 7:51 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] regular expressions and IS
just looking for text emails with nothing more than a url in the body
David answered my question, I was over thinking it, by leading with the ^ and
ending with the $ that makes the RegEx an IS statement
body 0 PCRE (?i:^http\:\/\/.*\.(html|htm|php)$)
its working
--
Rick
-Original Message-
From: Nick Hayer [mailto:n...@madriveraccess.com]
Sent: Tuesday, August 09, 2011 6:12 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] regular expressions and IS
BODY. CONTAINS. Bla bla
Is that what you are looking for?
-Nick
On Aug 9, 2011, at 3:26 PM, David Barker dbar...@declude.com wrote:
The expression is the IS
Can you post a few examples of what you trying to catch ?
-Original Message-
From: Rick Davidson [mailto:rdavid...@nat.com]
Sent: Tuesday, August 09, 2011 2:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] regular expressions and IS
I am working on a combo filter to catch the aol/hotmail/yahoo url spam
is there a way to use a regular expression with IS
body 0 IS/PCRE (?i:^http\:\/\/.*\.(html|htm|php)$)
any suggestions welcome
--
Rick
CONFIDENTIALITY NOTICE
This e-mail message and any attachments contain confidential and/or
privileged information for the sole use of the intended recipient. If you
are not the intended recipient, you may not read, disseminate, distribute or
copy this e-mail message or any attachments. Please notify the sender
immediately by reply e-mail if you received this e-mail message by mistake
and delete this e-mail message and any attachments from your system. E-mail
transmission cannot be guaranteed to be secure or error-free as information
could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or
contain viruses. The sender, therefore, does not accept liability for any
errors or omissions in the contents of this e-mail message or any
attachments, which arise as a result of e-mail transmission. If verification
is required, please request a hard-copy version.
-. .- -
You have received this e-mail due to a past or current transaction or as a
result of our efforts to keep you in touch with current developments
affecting your industry. If you wish to unsubscribe from any future general
information mailings, please click the 'Reply' button and add the word
'UNSUBSCRIBE' to the subject of your response.
---
This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to imail...@declude.com, and type unsubscribe
Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
You have received this e-mail due to a past or current transaction or as a
result of our efforts to keep you in touch with current developments affecting
your industry. If you wish to unsubscribe from any future general information
mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the
subject of your response.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
This message (and any associated files) may contain confidential, proprietary
and/or privileged material and access to these materials by anyone other than
the intended recipient is unauthorized. Unauthorized recipients are required to
maintain confidentiality. Any review, retransmission, dissemination or other
use of these materials by persons or entities other than the intended recipient
is prohibited and may be unlawful. If you have received this message in error,
please notify us immediately and destroy the original.
Ce message et tout document qui y est éventuellement joint peuvent contenir de
l’information confidentielle ou exclusive. L’accès à cette information par
quiconque autre que le destinataire désigné en est donc interdit. Les personnes
ou les entités non autorisées doivent respecter
[Declude.JunkMail] regular expressions and IS
I am working on a combo filter to catch the aol/hotmail/yahoo url spam is there a way to use a regular expression with IS body 0 IS/PCRE (?i:^http\:\/\/.*\.(html|htm|php)$) any suggestions welcome -- Rick CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] regular expressions and IS
The expression is the IS Can you post a few examples of what you trying to catch ? -Original Message- From: Rick Davidson [mailto:rdavid...@nat.com] Sent: Tuesday, August 09, 2011 2:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] regular expressions and IS I am working on a combo filter to catch the aol/hotmail/yahoo url spam is there a way to use a regular expression with IS body 0 IS/PCRE (?i:^http\:\/\/.*\.(html|htm|php)$) any suggestions welcome -- Rick CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] regular expressions and IS
BODY. CONTAINS. Bla bla Is that what you are looking for? -Nick On Aug 9, 2011, at 3:26 PM, David Barker dbar...@declude.com wrote: The expression is the IS Can you post a few examples of what you trying to catch ? -Original Message- From: Rick Davidson [mailto:rdavid...@nat.com] Sent: Tuesday, August 09, 2011 2:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] regular expressions and IS I am working on a combo filter to catch the aol/hotmail/yahoo url spam is there a way to use a regular expression with IS body 0 IS/PCRE (?i:^http\:\/\/.*\.(html|htm|php)$) any suggestions welcome -- Rick CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] regular expressions and IS
just looking for text emails with nothing more than a url in the body David answered my question, I was over thinking it, by leading with the ^ and ending with the $ that makes the RegEx an IS statement body 0 PCRE (?i:^http\:\/\/.*\.(html|htm|php)$) its working -- Rick -Original Message- From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Tuesday, August 09, 2011 6:12 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] regular expressions and IS BODY. CONTAINS. Bla bla Is that what you are looking for? -Nick On Aug 9, 2011, at 3:26 PM, David Barker dbar...@declude.com wrote: The expression is the IS Can you post a few examples of what you trying to catch ? -Original Message- From: Rick Davidson [mailto:rdavid...@nat.com] Sent: Tuesday, August 09, 2011 2:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] regular expressions and IS I am working on a combo filter to catch the aol/hotmail/yahoo url spam is there a way to use a regular expression with IS body 0 IS/PCRE (?i:^http\:\/\/.*\.(html|htm|php)$) any suggestions welcome -- Rick CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Stop processing before virus check
When the system detects a virus, it quarantines them and puts them in my virus folder for review. When I review them I notice that they completely failed the junk mail settings and should have been deleted. However, they are still getting scanned for viruses, held for review, which triggers an alert to me so I can go and see what is there. Is there something that I should have in my config files to tell it to stop processing everything once it reaches my delete threshold - currently set at 30 - and really delete it? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Stop processing before virus check
Change the order in which JunkMail and Declude EVA scan. Use the following line in your virus.cfg AVAFTERJM ON -Original Message- From: Todd Richards [mailto:to...@nnepa.com] Sent: Sunday, August 07, 2011 3:15 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Stop processing before virus check When the system detects a virus, it quarantines them and puts them in my virus folder for review. When I review them I notice that they completely failed the junk mail settings and should have been deleted. However, they are still getting scanned for viruses, held for review, which triggers an alert to me so I can go and see what is there. Is there something that I should have in my config files to tell it to stop processing everything once it reaches my delete threshold - currently set at 30 - and really delete it? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Stop processing before virus check
Hi David - Actually, I already had that line, which is what got me wondering if I was missing something else. Todd -Original Message- From: David Barker [mailto:dbar...@declude.com] Sent: Sunday, August 07, 2011 5:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Stop processing before virus check Change the order in which JunkMail and Declude EVA scan. Use the following line in your virus.cfg AVAFTERJM ON -Original Message- From: Todd Richards [mailto:to...@nnepa.com] Sent: Sunday, August 07, 2011 3:15 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Stop processing before virus check When the system detects a virus, it quarantines them and puts them in my virus folder for review. When I review them I notice that they completely failed the junk mail settings and should have been deleted. However, they are still getting scanned for viruses, held for review, which triggers an alert to me so I can go and see what is there. Is there something that I should have in my config files to tell it to stop processing everything once it reaches my delete threshold - currently set at 30 - and really delete it? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Stop processing before virus check
Send a ticket to supp...@declude.com with your diags.txt, virus.cfg, global.cfg and $default$.junkmail lets see if we can figure out what the problem is. -Original Message- From: Todd Richards [mailto:to...@nnepa.com] Sent: Sunday, August 07, 2011 7:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Stop processing before virus check Hi David - Actually, I already had that line, which is what got me wondering if I was missing something else. Todd -Original Message- From: David Barker [mailto:dbar...@declude.com] Sent: Sunday, August 07, 2011 5:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Stop processing before virus check Change the order in which JunkMail and Declude EVA scan. Use the following line in your virus.cfg AVAFTERJM ON -Original Message- From: Todd Richards [mailto:to...@nnepa.com] Sent: Sunday, August 07, 2011 3:15 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Stop processing before virus check When the system detects a virus, it quarantines them and puts them in my virus folder for review. When I review them I notice that they completely failed the junk mail settings and should have been deleted. However, they are still getting scanned for viruses, held for review, which triggers an alert to me so I can go and see what is there. Is there something that I should have in my config files to tell it to stop processing everything once it reaches my delete threshold - currently set at 30 - and really delete it? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Question on SNF within Declude
Hi David I just upgraded from 4.10.72 to 4.10.78 and noticed a build-up of files in the /IMail/Declude/SNF directory with names p59us2lf.20110801.log.xml Before after the upgrade, my diag.txt file shows that SNF is OFF (see below). Have I done something wrong to cause these files to be built? Is there an automated delete procedure for these files? Thanks very much Ferrell Ard Network Admin Badpuppy Enterprises, Inc. 321-6331-9500 === Declude 4.10.78 Diagnostics Compilation Platform: IMail Copyright (c) 2000-2011 Declude, Inc. Host Name mail.beicorporate.net Declude Key I8DA6838F-E6E2-4E5C-A9AA-575E25F81F5B Daisy Chain smtp32.exe DNS Server 173.227.130.100 Product Details JunkMail ON EVAON Hijack OFF SNFOFF AVGON CommTouch ON --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
Thank you for your message. I am currently out of the office, with limited access to e-mail. I will be returning on Thursday, August 11th. If you have an urgent issue, please contact Bill Slentz at ad...@oasisol.com or 1-800-784-4091. Daniel Slentz Network Engineer Oasis Online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Question on SNF within Declude
On 8/5/2011 11:13 AM, Ferrell Ard wrote: Hi David  I just upgraded from 4.10.72 to 4.10.78 and noticed a build-up of files in the /IMail/Declude/SNF directory with names p59us2lf.20110801.log.xml  Before after the upgrade, my diag.txt file shows that SNF is OFF (see below).  Have I done something wrong to cause these files to be built? Is there an automated delete procedure for these files? Hi Ferrel, I'm pretty sure these are not created by the OEM SNF in declude. They appear to be created by your external SNF installation since the log file name includes your SNF license ID. You can disable logging if you wish. You can also redirect it to a different directory. http://www.armresearch.com/support/articles/software/snfServer/logFiles/ http://www.armresearch.com/support/articles/software/snfServer/config/node/logs/scan/xml.jsp Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] white list or positive weight for a specific To address?
Thanks Sandy, interesting response, it got me thinking a bit wouldnt the spammer/attacker need to have delegated authority over the source ip address space and control of DNS infrastructure to forge a PTR record? I have been doing this a while and I dont recall ever seeing a message whitelisted due to forged revdns, I use revdns for whitelisting heavily. Also to the point of Ben's query, your solution is a good one, didnt pick up on that one... I guess I didnt consider the possibility of a targeted attack on an email admin list from the hosting anti-spam/virus vendor's domain when I suggested using the revdns, although it would be kinda funny. lol -- Rick -Original Message- From: Sanford Whiteman [mailto:sa...@cypressintegrated.com] Sent: Sunday, June 19, 2011 2:14 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Why not use the HELO or REVDNS? REVDNS is going to be the safest because of the difficulty in forging it Not always... if the domain has a hard-fail SPF record that isn't *itself* dependent on forgeable records (only uses IPs and forward DNS entries), then the MAILFROM can't successfully impersonate the protected domain (the envelope sender can still be trivially crafted, of course, but the mail will be rejected). However, in the case under discussion, declude.com's SPF record depends on the forgeable PTR, so in this case the SPF isn't any stronger protection than REVDNS itself. I would hesitate to say that there's any difficulty forging the PTR as part of a targeted attack. @ Ben, the MAILFROM for list messages uses the format declude.junkmail-your_verp...@declude.com, so there is a consistent SMTP (RFC 821) emvelope sender to filter on. -- Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response.--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail]
http://danjacoby.de/modules/Search/life.html --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
wouldnt the spammer/attacker need to have delegated authority over the source ip address space and control of DNS infrastructure to forge a PTR record? Well, either delegated authority *or* a subscriber agreement with the ISP that allows PTRs to be requested/modified. For example, I can write to my DSL provider and have the PTRs for my small IP block changed to whatever I want. I don't have a management UI nor delegation to my own NSs, but I can easily get it done. Again, we're talking about a targeted attack. Given sufficient motivation/payoff for such an attack, a forged PTR is going to be a lot easier to make happen than an altered SPF record, let alone a spoofed IP. I have been doing this a while and I dont recall ever seeing a message whitelisted due to forged revdns, I use revdns for whitelisting heavily. Me too, I'm not saying it's commonly abused, but in terms of feasibility I just had to point out that MAILFROM w/forward-only SPF mechanisms is less vulnerable to forgery than MAILFROM w/PTR SPF mechanism or REVDNS alone. -- S. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
“It is just our way.” That has such a Zen sound to it, like you must find your own path to enlightenment. I am still confused by both your suggestion and Randy’s. They both seem to be based on the From line, which would not be declude.com. Here are the first few header lines from one of Randy’s emails in this discussion: Received: from smtp.declude.com [216.144.195.81] by mail2.bcwebhost.net with ESMTP (SMTPD-9.23) id A94001FC; Sat, 18 Jun 2011 11:06:56 -0700 Received: from smail.globalweb.net (smail.globalweb.net [208.74.80.105]) by smtp.declude.com with SMTP; Sat, 18 Jun 2011 13:05:28 -0500 Received: from HRADellDTPC (173-163-199-121-richmond.hfc.comcastbusiness.net [173.163.199.121]) by smail.globalweb.net with SMTP; Sat, 18 Jun 2011 14:05:05 -0400 From: Randy A ra...@globalweb.us To: Declude.JunkMail@declude.com References: -291971859_45532...@smtp.declude.com -170080375_45540...@smtp.declude.com 242286454_45562...@smtp.declude.com 251212219_45563...@smtp.declude.com 258933297_45563...@smtp.declude.com 317249079_45567...@smtp.declude.com 51015843_49160...@smtp.declude.com 82729453_49162...@smtp.declude.com 119798468_49164...@smtp.declude.com In-Reply-To: 119798468_49164...@smtp.declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? Date: Sat, 18 Jun 2011 14:06:08 -0400 I would expect both your whitelist technique and Randy’s counter-weighting to apply to the From line, which shows ra...@globalweb.us, not Declude.com. So am I misunderstanding how these tests work? Do they use the In-Reply-To line instead? Or search the whole header? Thanks, Ben From: Nick Hayer Sent: Saturday, June 18, 2011 12:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? yup there is some sort of cap in global.cfg the around that is with a whitelist file that would contain entries like: MAILFROMWHITELISTCONTAINS@declude.com and clearly implementation technique is a personal thing :) We use compensatory filters to add/subtract weights as needed, and whitelist filters for whitelisting - which I am not suggesting is a better way. Its just our way.. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Randy A ra...@globalweb.us Sent: Saturday, June 18, 2011 2:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? Yes but if I remember correctly there is a limit on the number of whitelist entries you can have in the cfg file (200 I think – please correct me if I am wrong) so depending on the number of domains you are hosting email for, this could fill up at some point. We use the whitelist technique for our company needs, and the text file format for customer needs so everything is in one location for easier management. Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Saturday, June 18, 2011 2:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? An easy way to whitelist these in your global.cfg WHITELISTFROM@declude.com -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Saturday, June 18, 2011 1:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Can you give me the line you used in the config file? From: Randy A Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office
RE: [Declude.JunkMail] white list or positive weight for a specific To address?
Why not use the HELO or REVDNS? REVDNS is going to be the safest because of the difficulty in forging it HELO -10 CONTAINS smtp.declude.com or HELO WHITELIST CONTAINS smtp.declude.com REVDNS -10 CONTAINS smtp.declude.com or REVDNS WHITELIST CONTAINS smtp.declude.com or even blanket the headers with HEADERS -10 CONTAINS smtp.declude.com or HEADERS WHITELIST CONTAINS smtp.declude.com MAILFROM would be my 4th choice if the helo or revdns was broken -- Rick From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Sunday, June 19, 2011 1:02 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? “It is just our way.” That has such a Zen sound to it, like you must find your own path to enlightenment. I am still confused by both your suggestion and Randy’s. They both seem to be based on the From line, which would not be declude.com. Here are the first few header lines from one of Randy’s emails in this discussion: Received: from smtp.declude.com [216.144.195.81] by mail2.bcwebhost.net with ESMTP (SMTPD-9.23) id A94001FC; Sat, 18 Jun 2011 11:06:56 -0700 Received: from smail.globalweb.net (smail.globalweb.net [208.74.80.105]) by smtp.declude.com with SMTP; Sat, 18 Jun 2011 13:05:28 -0500 Received: from HRADellDTPC (173-163-199-121-richmond.hfc.comcastbusiness.net [173.163.199.121]) by smail.globalweb.net with SMTP; Sat, 18 Jun 2011 14:05:05 -0400 From: Randy A ra...@globalweb.us To: Declude.JunkMail@declude.com References: -291971859_45532...@smtp.declude.com -170080375_45540...@smtp.declude.com 242286454_45562...@smtp.declude.com 251212219_45563...@smtp.declude.com 258933297_45563...@smtp.declude.com 317249079_45567...@smtp.declude.com 51015843_49160...@smtp.declude.com 82729453_49162...@smtp.declude.com 119798468_49164...@smtp.declude.com In-Reply-To: 119798468_49164...@smtp.declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? Date: Sat, 18 Jun 2011 14:06:08 -0400 I would expect both your whitelist technique and Randy’s counter-weighting to apply to the From line, which shows ra...@globalweb.usmailto:ra...@globalweb.us, not Declude.com. So am I misunderstanding how these tests work? Do they use the In-Reply-To line instead? Or search the whole header? Thanks, Ben From: Nick Hayermailto:n...@madriveraccess.com Sent: Saturday, June 18, 2011 12:12 PM To: Declude.JunkMail@declude.commailto:Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? yup there is some sort of cap in global.cfg the around that is with a whitelist file that would contain entries like: MAILFROMWHITELISTCONTAINS@declude.com and clearly implementation technique is a personal thing :) We use compensatory filters to add/subtract weights as needed, and whitelist filters for whitelisting - which I am not suggesting is a better way. Its just our way.. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Randy A ra...@globalweb.us Sent: Saturday, June 18, 2011 2:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? Yes but if I remember correctly there is a limit on the number of whitelist entries you can have in the cfg file (200 I think – please correct me if I am wrong) so depending on the number of domains you are hosting email for, this could fill up at some point. We use the whitelist technique for our company needs, and the text file format for customer needs so everything is in one location for easier management. Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Saturday, June 18, 2011 2:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? An easy way to whitelist these in your global.cfg WHITELISTFROM@declude.com -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.netmailto:supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
Why not use the HELO or REVDNS? REVDNS is going to be the safest because of the difficulty in forging it Not always... if the domain has a hard-fail SPF record that isn't *itself* dependent on forgeable records (only uses IPs and forward DNS entries), then the MAILFROM can't successfully impersonate the protected domain (the envelope sender can still be trivially crafted, of course, but the mail will be rejected). However, in the case under discussion, declude.com's SPF record depends on the forgeable PTR, so in this case the SPF isn't any stronger protection than REVDNS itself. I would hesitate to say that there's any difficulty forging the PTR as part of a targeted attack. @ Ben, the MAILFROM for list messages uses the format declude.junkmail-your_verp...@declude.com, so there is a consistent SMTP (RFC 821) emvelope sender to filter on. -- Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] white list or positive weight for a specific To address?
On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
Can you give me the line you used in the config file? From: Randy A Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] white list or positive weight for a specific To address?
We scale on a base of mark as Spam at 15; quarantine at 20; delete at 30 In my global.config file I have: FILTER-GOODMAILINGLISTS fromfileC:\...path to file…\filter-GoodMailingLists.txt x -20 0 In the default.junkmail file: FILTER-GOODMAILINGLISTS WARN The actual filter-GoodMailingLists.txt file includes lines like: ema...@domain1.com #actual full email address Domain2.com#deduct points for anything incl. this domain, i.e. em...@domain2.com or em...@sub.domain2.com or em...@otherdomain2.com @alerts.wachovia.com #deduct points for emails from this specific subdomain @Domain3.com#deduct points for anything from this specific domain Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Saturday, June 18, 2011 1:32 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Can you give me the line you used in the config file? From: Randy A mailto:ra...@globalweb.us Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
An easy way to whitelist these in your global.cfg WHITELISTFROM@declude.com -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Saturday, June 18, 2011 1:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Can you give me the line you used in the config file? From: Randy A Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address?On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer's email lists that were getting flagged by decludeSincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] white list or positive weight for a specific To address?
Yes but if I remember correctly there is a limit on the number of whitelist entries you can have in the cfg file (200 I think – please correct me if I am wrong) so depending on the number of domains you are hosting email for, this could fill up at some point. We use the whitelist technique for our company needs, and the text file format for customer needs so everything is in one location for easier management. Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Saturday, June 18, 2011 2:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? An easy way to whitelist these in your global.cfg WHITELISTFROM@declude.com -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: IMail Admin imailad...@bcwebhost.net Sent: Saturday, June 18, 2011 1:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Can you give me the line you used in the config file? From: Randy A mailto:ra...@globalweb.us Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
I like the idea of reverse weights over whitelisting. The problem with whitelisting is that the mail is guaranteed to get through. I just want to counter-weight mail from a list. For example, I have one list that typically shows up with a weight of 4-6. I can counter that with –4 and then if something really bad shows up, it is likely to have a much larger weight (20+) and my counter-weight won’t matter. I like this for individual addresses as well. Ben From: Nick Hayer Sent: Saturday, June 18, 2011 11:09 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? An easy way to whitelist these in your global.cfg WHITELISTFROM@declude.com -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Saturday, June 18, 2011 1:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Can you give me the line you used in the config file? From: Randy A Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] white list or positive weight for a specific To address?
I’m confused on what part of the envelope this is filtering on. List messages show up in the mailbox as From Contributor (such as From: Randy A) and To Listname (such as To: Declude.JunkMail). I want the positive weight to only apply to list messages, which means the weight has to be filtered on the To line. It would seem your list below gives weight based on the From line? Or perhaps from both From and To lines? Ben From: Randy A Sent: Saturday, June 18, 2011 11:06 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? We scale on a base of mark as Spam at 15; quarantine at 20; delete at 30 In my global.config file I have: FILTER-GOODMAILINGLISTS fromfileC:\...path to file…\filter-GoodMailingLists.txt x -20 0 In the default.junkmail file: FILTER-GOODMAILINGLISTS WARN The actual filter-GoodMailingLists.txt file includes lines like: ema...@domain1.com #actual full email address Domain2.com#deduct points for anything incl. this domain, i.e. em...@domain2.com or em...@sub.domain2.com or em...@otherdomain2.com @alerts.wachovia.com #deduct points for emails from this specific subdomain @Domain3.com#deduct points for anything from this specific domain Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Saturday, June 18, 2011 1:32 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? Can you give me the line you used in the config file? From: Randy A Sent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer’s email lists that were getting flagged by declude Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] white list or positive weight for a specific To address?
yup there is some sort of cap in global.cfg the around that is with a whitelist file that would contain entries like: MAILFROMWHITELISTCONTAINS@declude.com and clearly implementation technique is a personal thing :) We use compensatory filters to add/subtract weights as needed, and whitelist filters for whitelisting - which I am not suggesting is a better way. Its just our way.. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Randy A ra...@globalweb.us Sent: Saturday, June 18, 2011 2:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? Yes but if I remember correctly there is a limit on the number of whitelist entries you can have in the cfg file (200 I think - please correct me if I am wrong) so depending on the number of domains you are hosting email for, this could fill up at some point. We use the whitelist technique for our company needs, and the text file format for customer needs so everything is in one location for easier management. Sincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Saturday, June 18, 2011 2:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address? An easy way to whitelist these in your global.cfg WHITELISTFROM@declude.com -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Saturday, June 18, 2011 1:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] white list or positive weight for a specific To address?Can you give me the line you used in the config file? From: Randy ASent: Saturday, June 18, 2011 12:18 AM To: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] white list or positive weight for a specific To address? On my declude config, I set up a GoodMailList test text file, added a negative point value to this test, and then I add any of my customer's email lists that were getting flagged by decludeSincerely, Randy Armbrecht Global Web Solutions, Inc. Office: 804.442.5300 option 1 Toll Free: 877.800.4562 24 /7 Tech Support! Your Internet Source.Since 1996! NEW GlobalSync Remote-BackUp Solutions! Web Hosting - E-Mail - Spam/Virus Gateway Services Hi-Speed DSL and Wireless Internet - T-1/T-3's PC Support - Networking - Virus/MalWare Removal 25% discount on most services for Non-Profits! Call us today! From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, June 17, 2011 6:31 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] white list or positive weight for a specific To address? Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben -- This message has been scanned for viruses and dangerous content by the ipengines.net MailScanner and is believed to be clean. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com
[Declude.JunkMail] white list or positive weight for a specific To address?
Hi, The emails I receive from this list have various From lines but always have one To line: Declude.JunkMail@declude.com. I would like to white list or, better yet, add a positive weight for emails I receive addressed to Declude.JunkMail@declude.com. How do I do this? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Time to upgrade and to what?
Thanks, that helped. From: Todd Richards Sent: Monday, June 06, 2011 6:18 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Time to upgrade and to what? Hey Ben – If you haven’t already, you can download a trial of SmarterMail to give you a hands on feel for how the interface works, from the system administrator to a domain administrator to an end user. I can’t speak to the latest version of SmarterMail as we are still running 6.9xx (we have a current subscription but never felt the need yet to upgrade – probably will soon), nor can I offer a good comparison, since we were still on IMail 8.2x when we made the change. There were three main reasons we made the switch: cost, a much improved web interface from our IMail 8.2x version, and the massive number of positive recommendations about switching to SM. Like the others, we have never looked back. We too were on the unlimited version of IMail, but are on a 1000 user version of SmarterMail. That has proved plenty for us at this point. The nice thing is, if we need more then we add them on. We are heavy users of the Mailing Lists in SmarterMail. I like the fact that we can manage subscribers separate from lists. Our main domain (the one that I am on) currently has almost 70 mailing lists. It’s great that, via the web interface, we can add a single subscriber to multiple lists. We can also go into the individual lists and manage subscribers as well. You can add your own custom fields to the subscriber screens if you want to track Name, City, Company Name, etc. It also has the ability to remove a user from the lists if they have a certain number of bounces. While that feature was nice, we actually increased it (maybe even turned it off – can’t remember for sure without going and looking) because it would remove someone and nobody ever knew about it. There were requests about maybe alerting the administrator of such a change, or disabling a user versus removing them, etc. I’m just not sure whether that part has been upgraded. Again, we are on SmarterMail 6.9 but I don’t think the rest of it has changed that much. The one thing that I didn’t like about the mailing lists is that we had an ASP page with all of the options that people could subscribe to. At the end, when they hit submit, it would fire off an email to IMail and subscribe (or unsubscribe) them from all of their choices in one swoop. SmarterMail didn’t handle things that way, and would simply make the change for the first option but ignore the rest of them. We weren’t aware of that at first and had people think they were making changes but they really weren’t. SmarterMail does offer the ability to tie web pages to the mail server using SOAP, etc. But I don’t know it and haven’t had the time to make the changeover. Todd From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Monday, June 06, 2011 6:12 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Time to upgrade and to what? I guess my three areas on concern would be how IM and SM compare in their web mail interface, how they compare in administration, and how they compare in list server. We make pretty modest use of the IM list server (which is pretty primitive), but I would hate to give it up altogether. Thanks for any comments, Ben - Original Message - From: Heimir Eidskrem To: Declude.JunkMail@declude.com Sent: Monday, June 06, 2011 1:41 PM Subject: Re: [Declude.JunkMail] Time to upgrade and to what? We dumped Imail after being with them since version 4 I think. Moved to Smartermail and never looked back. Our customers really like SM and we have nothing but positive feedback. the transition was easy with the migration tools from SM. I would do it again with no hesitation. On 6/1/2011 9:09 PM, Imail Admin wrote: I've been musing over whether it's time to upgrade or replace my mail system. I've got IMail (unlimited users) v 2006.23 on an old server runing Win2k Advanced Server with Declude v.?? (not current, whatever it is). On the one hand, I only have a small number of domains and mail boxes any more and on the other hand, my old server is looking pretty long in the tooth.  I started out looking at boxes to build a new server, but they're not that expensive any more. Then I got caughter up in the software. Ipswitch wants $2300 or some such for a software upgrade (unlimited users). That's way more than I can justify spending. I don't really need unlimited users any more, but I hate to give it up. On the other hand, I recall a few years ago when people were switching en masse to SmaterMail so I looked at them and their prices are a lot nice. Anyone care to say how the current versions of either software compared with my old IMail?  I assume that I'll have to upgrade to the current version of Declude, but otherwise that will work
Re: [Declude.JunkMail] Time to upgrade and to what?
I guess my three areas on concern would be how IM and SM compare in their web mail interface, how they compare in administration, and how they compare in list server. We make pretty modest use of the IM list server (which is pretty primitive), but I would hate to give it up altogether. Thanks for any comments, Ben - Original Message - From: Heimir Eidskrem To: Declude.JunkMail@declude.com Sent: Monday, June 06, 2011 1:41 PM Subject: Re: [Declude.JunkMail] Time to upgrade and to what? We dumped Imail after being with them since version 4 I think. Moved to Smartermail and never looked back. Our customers really like SM and we have nothing but positive feedback. the transition was easy with the migration tools from SM. I would do it again with no hesitation. On 6/1/2011 9:09 PM, Imail Admin wrote: I've been musing over whether it's time to upgrade or replace my mail system. I've got IMail (unlimited users) v 2006.23 on an old server runing Win2k Advanced Server with Declude v.?? (not current, whatever it is). On the one hand, I only have a small number of domains and mail boxes any more and on the other hand, my old server is looking pretty long in the tooth.  I started out looking at boxes to build a new server, but they're not that expensive any more. Then I got caughter up in the software. Ipswitch wants $2300 or some such for a software upgrade (unlimited users). That's way more than I can justify spending. I don't really need unlimited users any more, but I hate to give it up. On the other hand, I recall a few years ago when people were switching en masse to SmaterMail so I looked at them and their prices are a lot nice. Anyone care to say how the current versions of either software compared with my old IMail?  I assume that I'll have to upgrade to the current version of Declude, but otherwise that will work the same as before?  Any suggestions or pointers would be appreciated.  Thanks,  Ben  --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Time to upgrade and to what?
I have the latest versions of both; I bought SM to dump Imail but found that some customers are simply resistant to change. So rather than risk losing them I am keeping Imail up to date. Privately Imail maybe receptive to price matching SM [give them a call?] - so that is a 3rd option. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Imail Admin imailad...@bcwebhost.net Sent: Wednesday, June 01, 2011 10:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Time to upgrade and to what? ? I've been musing over whether it's time to upgrade or replace my mail system. I've got IMail (unlimited users) v 2006.23 on an old server runing Win2k Advanced Server with Declude v.?? (not current, whatever it is). On the one hand, I only have a small number of domains and mail boxes any more and on the other hand, my old server is looking pretty long in the tooth. I started out looking at boxes to build a new server, but they're not that expensive any more. Then I got caughter up in the software. Ipswitch wants $2300 or some such for a software upgrade (unlimited users). That's way more than I can justify spending. I don't really need unlimited users any more, but I hate to give it up. On the other hand, I recall a few years ago when people were switching en masse to SmaterMail so I looked at them and their prices are a lot nice. Anyone care to say how the current versions of either software compared with my old IMail? I assume that I'll have to upgrade to the current version of Declude, but otherwise that will work the same as before? Any suggestions or pointers would be appreciated. Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Time to upgrade and to what?
I've been musing over whether it's time to upgrade or replace my mail system. I've got IMail (unlimited users) v 2006.23 on an old server runing Win2k Advanced Server with Declude v.?? (not current, whatever it is). On the one hand, I only have a small number of domains and mail boxes any more and on the other hand, my old server is looking pretty long in the tooth. I started out looking at boxes to build a new server, but they're not that expensive any more. Then I got caughter up in the software. Ipswitch wants $2300 or some such for a software upgrade (unlimited users). That's way more than I can justify spending. I don't really need unlimited users any more, but I hate to give it up. On the other hand, I recall a few years ago when people were switching en masse to SmaterMail so I looked at them and their prices are a lot nice. Anyone care to say how the current versions of either software compared with my old IMail? I assume that I'll have to upgrade to the current version of Declude, but otherwise that will work the same as before? Any suggestions or pointers would be appreciated. Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 4.10.72 Interceptor 3.4.10.500
Please contact supp...@declude.com if you need assistance with your upgrade. Version Part Type Change 4.10.72 DEC ADD Declude no longer use imail1.exe to send notifications as IMail no longer supports imail1.exe. 4.10.71 DEC ADD Create the diags.txt file when the decludeproc service is started, which includes Declude Version, Platform Type, Copyright and Host name 4.10.70 SNF FIX Declude crashed due to SNF header exceeding the buffer size. Improved altering of headers and footers. 4.10.69 VIR FIX File attachments stripped when the following vulnerabilities were allowed OLMIMESEGMIMEPRE, MIMESEGMIMEPOST, OLBOUNDARYSPACEGAP 4.10.68 HI FIX When Hijack is turned off no Hijack log is created. 4.10.67 VIR FIX When the Outlook Boundary Space Gap Vulnerability occurs (triggered) the attachment files are striped. This was due miss match boundary string. 4.10.66 DEC FIX Declude accepts SM default alias as incoming. (Makes Declude compatible with SM default alias mail.* ) For example, domain.com its default alias is mail.domain.com 4.10.65 JM FIX Filter triggered information now displays in medium log level instead of debug. 4.10.64 DEC ADD blklst.txt which is located in the \spool directory is being created every day like the other logs if BLKLST ON in the declude.cfg 4.10.63 JM ADD Split Commtouch test results so each have their own score. Spam, Bulk, Suspect. Also included the match value of nonzero for single line configuration, which will be triggered for spam or bulk. Example of configuration: CT-SPAMCOMMTOUCH 0 4 20 0 CT-BULKCOMMTOUCH 0 3 8 0 CT-SUSPECT COMMTOUCH 0 2 4 0 Example of nonzero configuration: CT-SPAMCOMMTOUCH 0 nonzero 15 0 4.10.61 JM FIX Fix ROUTTO issue with SM Routing when incoming gateway is configured. Accommodate their change by deleting the smarthost: line from hdr file as the SM suggested 4.10.61 DEC FIX Copyright update from 2010 to 2011 4.10.60 JM FIX Compliance with SM 6+ to accommodate changes to their Trusted Sender list. 4.10.59 AV FIX When virus scanning is turned off (OUTGOING OFF, INCOMING OFF, or virus.cfg.off) any plain/text email Declude failed to copy the body of the email from eml to em$. Which resulted in an empty email. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com Description: -declude Description: -dnsstuff --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. image001.pngimage002.png
RE: [Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?)
That was a bounce or auto notify, from webjogger.net who is also subscribed to the list. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, May 20, 2011 1:28 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?) Hi, I’ve just always left these templates in place (the .eml files) that cause various notifications to be sent out. However, in recent years I’ve received complaints that these notifications are unnecessary or a nuisance. I was curious if anyone else bothered with these, or if you deleted them all, or if you kept just some? Any recommendations? I originally posted this to the declude.virus list a few minutes ago. Then I got a response saying “ This address is not being used. Please contact mailto:supp...@webjogger.net supp...@webjogger.net ”. Looking back, I realize I haven’t seen any posts for declude.virus since October, but, on the other hand, I didn’t see any announcements the list was going away. Did I miss something? Has it moved? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?)
Whew! Thanks. I saw that it was an automated response, but the wording was just ambiguous enough to imply something more. Now I’ll just wait to see if anyone responds to my original question. Ben From: David Barker Sent: Friday, May 20, 2011 10:34 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?) That was a bounce or auto notify, from webjogger.net who is also subscribed to the list. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Friday, May 20, 2011 1:28 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Do you use the Declude email notification templates? (and what happened to the declude.virus mailing list?) Hi, I’ve just always left these templates in place (the .eml files) that cause various notifications to be sent out. However, in recent years I’ve received complaints that these notifications are unnecessary or a nuisance. I was curious if anyone else bothered with these, or if you deleted them all, or if you kept just some? Any recommendations? I originally posted this to the declude.virus list a few minutes ago. Then I got a response saying “ This address is not being used. Please contact supp...@webjogger.net ”. Looking back, I realize I haven’t seen any posts for declude.virus since October, but, on the other hand, I didn’t see any announcements the list was going away. Did I miss something? Has it moved? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FROMNOMATCH returning high scores
Was it invURIBL by any chance? If so did you find a cause? From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Wednesday, May 18, 2011 3:06 PM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] FROMNOMATCH returning high scores I haven't seen it on FROMNOMATCH but have seen it elsewhere; specifically when an external app throws an exception. Bottom line somewhere declude or some other app threw an exception - the wacko score is the result. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: Jim Comerford jcomerf...@sbsnet.com Sent: Wednesday, May 18, 2011 1:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] FROMNOMATCH returning high scores Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROMNOMATCH returning high scores
I’ve seen invUribl do it on random occasions, but I don’t know a cause or solution. Ben From: Jim Comerford Sent: Thursday, May 19, 2011 12:00 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] FROMNOMATCH returning high scores Was it invURIBL by any chance? If so did you find a cause? From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Wednesday, May 18, 2011 3:06 PM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] FROMNOMATCH returning high scores I haven't seen it on FROMNOMATCH but have seen it elsewhere; specifically when an external app throws an exception. Bottom line somewhere declude or some other app threw an exception - the wacko score is the result. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Jim Comerford jcomerf...@sbsnet.com Sent: Wednesday, May 18, 2011 1:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] FROMNOMATCH returning high scores Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FROMNOMATCH returning high scores
I forced invuribl to return specific weights to offset this problem: INV-URIBL-WEIGHT25 external 25 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 25 0 INV-URIBL-WEIGHT50 external 50 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 50 0 INV-URIBL-WEIGHT75 external 75 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 75 0 INV-URIBL-WEIGHT100 external 100 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 100 0 INV-URIBL-WEIGHT125 external 125 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 125 0 INV-URIBL-WEIGHT150 external 150 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 150 0 INV-URIBL-WEIGHT175 external 175 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 175 0 INV-URIBL-WEIGHT200 external 200 D:\IMAIL\DECLUDE\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 200 0 -Original Message- From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 19, 2011 2:47 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] FROMNOMATCH returning high scores I've seen invUribl do it on random occasions, but I don't know a cause or solution. Ben From: Jim Comerford mailto:jcomerf...@sbsnet.com Sent: Thursday, May 19, 2011 12:00 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] FROMNOMATCH returning high scores Was it invURIBL by any chance? If so did you find a cause? From: Nick Hayer [mailto:n...@madriveraccess.com] Sent: Wednesday, May 18, 2011 3:06 PM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] FROMNOMATCH returning high scores I haven't seen it on FROMNOMATCH but have seen it elsewhere; specifically when an external app throws an exception. Bottom line somewhere declude or some other app threw an exception - the wacko score is the result. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: Jim Comerford jcomerf...@sbsnet.com Sent: Wednesday, May 18, 2011 1:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] FROMNOMATCH returning high scores Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FROMNOMATCH returning high scores
Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROMNOMATCH returning high scores
I have not seen that. Herb On 5/18/2011 12:12 PM, Jim Comerford wrote: Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)789-0966x200 (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FROMNOMATCH returning high scores
Well I just solved 1/2 the problem. The range I had defined did not go past so that’s why they were not acted on. Still unsolved is the very high score from FROMNOMATCH test - I'm working with DECLUDE on it, but curious if anyone but me has sees that happen. -Original Message- From: Herb Guenther [mailto:h...@lanex.com] Sent: Wednesday, May 18, 2011 1:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] FROMNOMATCH returning high scores I have not seen that. Herb On 5/18/2011 12:12 PM, Jim Comerford wrote: Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)789-0966x200 (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] FROMNOMATCH returning high scores
I haven't seen it on FROMNOMATCH but have seen it elsewhere; specifically when an external app throws an exception. Bottom line somewhere declude or some other app threw an exception - the wacko score is the result. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Jim Comerford jcomerf...@sbsnet.com Sent: Wednesday, May 18, 2011 1:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] FROMNOMATCH returning high scores Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit
Sandy, I found this link - http://www.starwindsoftware.com/high-performance-ram-disk-emulator Apparently you can now download it separately. I'll give it a try. I'm also going to test the Dataram product. http://memory.dataram.com/products-and-services/software/ramdisk If anyone else has a comment on these products or other options, please chime in. Regards, Gary Original Message From: Sanford Whiteman sa...@cypressintegrated.com Sent: Friday, May 13, 2011 6:14 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit Gary, I think I might have spaced on a similar question you asked a while back. I recommend Starwind Software's RAM disk -- the one that comes with their iSCSI initiator (you don't actually need any iSCSI SAN in place). We use it on 2003 + 2008. -- Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit
Is anyone out there using a ramdisk with Windows Server 2008 64bit? If so, which one are you using? Someone recommended to me Dataram RAMDisk, can anyone comment on that? Any other recommendations on using a ramdisk with SmarterMail? Thanks, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit
Gary, I think I might have spaced on a similar question you asked a while back. I recommend Starwind Software's RAM disk -- the one that comes with their iSCSI initiator (you don't actually need any iSCSI SAN in place). We use it on 2003 + 2008. -- Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
With declude.cfg you can allocate the # of threads - but what do your logs show? Are sending out a lot of email? Maybe there are other issues like the box needs more physical ram/processing power - does task mgr say all ik kool? Dunno the answer here - just giving you some ideas for things to check.. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Thursday, May 05, 2011 2:24 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what's happening. What Declude originally called the mystery heap is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn't explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it's the smtp32.exe process causing the crash, then that would imply to me that I've got a lot of outbound messages all at once. I just don't see how this could happen. I'm guessing that we've got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
On 5/5/2011 2:21 PM, IMail Admin wrote: My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? The trick is, it's not controlled by outbound messages, but inbound messages. The way IMail works is to accept all incoming connections (essentially) and store the messages in the spool. Then it calls it's delivery agent (SMTP32) to get those messages where they need to go. When a message processing system like a mail filter wants to hook into IMail it (or one of it's components) takes the place of SMTP32, processes the message for itself, and then calls SMTP32 itself to continue the chain of processing. (There are exceptions, of course and the above is oversimplified). What all of that means is that the number of times SMTP32 is called is partially controlled by the number of messages you are receiving -- and any publicly accessible MTA is subject to spam storms that can include large numbers of messages. If your software is configured to allow too many instances of SMTP32 then a sizable spam storm will trigger the mystery heap problem. The solution generally is to reduce the number of processing threads you allow. Since your system is small (as you say) this shouldn't be a problem and should resolve the problem. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] error 0xC0000142 smtp.exe
I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil mailto:madscient...@microneil.com Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M --Pete McNeil, PresidentMicroNeil Research Corporationwww.microneil.com703.779.4909x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] error 0xC0000142 smtp.exe
In MY case it was not the number of threads, but eliminating one of the third party command line applications. Although – I had never TRIED reducing the number of threads to see if that would help the situation. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 4:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt mailto:andy_schm...@hm-software.com Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil mailto:madscient...@microneil.com Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found
RE: [Declude.JunkMail] error 0xC0000142 smtp.exe
PS: I also upgraded Declude to use the integrated Sniffer and the integrated Anti-Virus engine so that I could eliminate the number of command line invocations. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 4:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt mailto:andy_schm...@hm-software.com Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil mailto:madscient...@microneil.com Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came
RE: [Declude.JunkMail] error 0xC0000142 smtp.exe
Hi, Even though I am running an Imail server for a bachelor level education with about 2500 active mailboxes and about 15.000 mails per day, I still have Declude set to max 150 THREADS. That is plenty to get the mail delivered in time. Declude itself can handle a lot more and using the build in Sniffer helps keeping the max heap problem down, but I have never found a good reason the increase the THREAD count. As a matter of fact I have had it even lower in the past and still mail was delivered quickly enough for users never to notice it. Yours sincerely, Bonno Bloksma senior systeembeheerder tio university of applied sciences for hospitality and tourism julianalaan 9 / 7553 ab hengelo netherlands t +31-74-255 06 10 / f +31-74-255 06 11 mailto:b.blok...@tio.nl b.blok...@tio.nl / http://www.tio.nl www.tio.nl Follow us at http://twitter.com/#!/hogeschooltio Twitter / http://www.facebook.com/pages/TIO-Hogeschool-Hospitality-en-Toerisme/103881882987989#!/pages/Hogeschool-Tio/417375345610 Facebook / http://cognatio.hyves.nl/ Hyves / http://www.youtube.com/user/hogeschooltio YouTube Van: IMail Admin [mailto:imailad...@bcwebhost.net] Verzonden: donderdag 5 mei 2011 22:10 Aan: Declude.JunkMail@declude.com Onderwerp: Re: [Declude.JunkMail] error 0xC142 smtp.exe That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt mailto:andy_schm...@hm-software.com Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil mailto:madscient...@microneil.com Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
On 5/5/2011 4:28 PM, Bonno Bloksma wrote: Hi, Â Even though I am running an Imail server for a bachelor level education with about 2500 active mailboxes and about 15.000 mails per day, I still have Declude set to max 150 THREADS. That is plenty to get the mail delivered in time. Over the years I have determined that you can have a very high inbound throughput on a very small number of threads and in fact that this strategy significantly improves overall performance by reducing overhead. All of the local deliveries you have will be constrained mostly by the underlying file system, so if most of your deliveries are local (inbound traffic) you can set the number of threads very small indeed (2x Cores works as a starting point). You only need a larger number of threads when sending mail out because each thread may need to wait a significant amount of time for the outbound process to start and finish. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
Hi, I just looked in my declude.cfg and found these as the only non-commented lines: THREADS 15 WAITFORMAIL 5000 INVITEFIXON So it appears I've got 15 threads going. Unless there is some sort of multiplier going? What happens if my thread count is too small? Thanks, Ben - Original Message - From: Bonno Bloksma To: Declude.JunkMail@declude.com Sent: Thursday, May 05, 2011 1:28 PM Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe Hi, Even though I am running an Imail server for a bachelor level education with about 2500 active mailboxes and about 15.000 mails per day, I still have Declude set to max 150 THREADS. That is plenty to get the mail delivered in time. Declude itself can handle a lot more and using the build in Sniffer helps keeping the max heap problem down, but I have never found a good reason the increase the THREAD count. As a matter of fact I have had it even lower in the past and still mail was delivered quickly enough for users never to notice it. Yours sincerely, Bonno Bloksma senior systeembeheerder tio university of applied sciences for hospitality and tourism julianalaan 9 / 7553 ab hengelo netherlands t +31-74-255 06 10 / f +31-74-255 06 11 b.blok...@tio.nl / www.tio.nl Follow us at Twitter / Facebook / Hyves / YouTube Van: IMail Admin [mailto:imailad...@bcwebhost.net] Verzonden: donderdag 5 mei 2011 22:10 Aan: Declude.JunkMail@declude.com Onderwerp: Re: [Declude.JunkMail] error 0xC142 smtp.exe That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
I should add that in looking through my spool folder, I found a *lot* of tmp*.tmp files, all generated by Armresearch for Sniffer and going way back. Does this mean I have something misconfigured that these files are being left over? - Original Message - From: Imail Admin To: Declude.JunkMail@declude.com Sent: Thursday, May 05, 2011 4:41 PM Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe Hi, I just looked in my declude.cfg and found these as the only non-commented lines: THREADS 15 WAITFORMAIL 5000 INVITEFIXON So it appears I've got 15 threads going. Unless there is some sort of multiplier going? What happens if my thread count is too small? Thanks, Ben - Original Message - From: Bonno Bloksma To: Declude.JunkMail@declude.com Sent: Thursday, May 05, 2011 1:28 PM Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe Hi, Even though I am running an Imail server for a bachelor level education with about 2500 active mailboxes and about 15.000 mails per day, I still have Declude set to max 150 THREADS. That is plenty to get the mail delivered in time. Declude itself can handle a lot more and using the build in Sniffer helps keeping the max heap problem down, but I have never found a good reason the increase the THREAD count. As a matter of fact I have had it even lower in the past and still mail was delivered quickly enough for users never to notice it. Yours sincerely, Bonno Bloksma senior systeembeheerder tio university of applied sciences for hospitality and tourism julianalaan 9 / 7553 ab hengelo netherlands t +31-74-255 06 10 / f +31-74-255 06 11 b.blok...@tio.nl / www.tio.nl Follow us at Twitter / Facebook / Hyves / YouTube Van: IMail Admin [mailto:imailad...@bcwebhost.net] Verzonden: donderdag 5 mei 2011 22:10 Aan: Declude.JunkMail@declude.com Onderwerp: Re: [Declude.JunkMail] error 0xC142 smtp.exe That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking out loud. From: Pete McNeil Sent: Wednesday, May 04, 2011 8:34 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the mystery heap problem and solving it will mostly have to do with the setting
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
No, that's typical. We have a script scheduled to delete them every day. It seems the sniffer script doesn't always delete them... probably Declude still has a lock on the file, so it can be read, but not changed or deleted. We monitor our spool and overflow directories, and when thresholds (by file count) are met we're alerted. Monitoring like this tell you if there is a problem so you can resolve it before your customers notice a problem. Darin. - Original Message - From: Imail Admin To: Declude.JunkMail@declude.com Sent: Thursday, May 05, 2011 8:49 PM Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe I should add that in looking through my spool folder, I found a *lot* of tmp*.tmp files, all generated by Armresearch for Sniffer and going way back. Does this mean I have something misconfigured that these files are being left over? - Original Message - From: Imail Admin To: Declude.JunkMail@declude.com Sent: Thursday, May 05, 2011 4:41 PM Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe Hi, I just looked in my declude.cfg and found these as the only non-commented lines: THREADS 15 WAITFORMAIL 5000 INVITEFIXON So it appears I've got 15 threads going. Unless there is some sort of multiplier going? What happens if my thread count is too small? Thanks, Ben - Original Message - From: Bonno Bloksma To: Declude.JunkMail@declude.com Sent: Thursday, May 05, 2011 1:28 PM Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe Hi, Even though I am running an Imail server for a bachelor level education with about 2500 active mailboxes and about 15.000 mails per day, I still have Declude set to max 150 THREADS. That is plenty to get the mail delivered in time. Declude itself can handle a lot more and using the build in Sniffer helps keeping the max heap problem down, but I have never found a good reason the increase the THREAD count. As a matter of fact I have had it even lower in the past and still mail was delivered quickly enough for users never to notice it. Yours sincerely, Bonno Bloksma senior systeembeheerder tio university of applied sciences for hospitality and tourism julianalaan 9 / 7553 ab hengelo netherlands t +31-74-255 06 10 / f +31-74-255 06 11 b.blok...@tio.nl / www.tio.nl Follow us at Twitter / Facebook / Hyves / YouTube Van: IMail Admin [mailto:imailad...@bcwebhost.net] Verzonden: donderdag 5 mei 2011 22:10 Aan: Declude.JunkMail@declude.com Onderwerp: Re: [Declude.JunkMail] error 0xC142 smtp.exe That sounds like me. What’s the cure? Drop the number of threads in declude.cfg? I haven’t looked at it yet to see what I have. From: Andy Schmidt Sent: Thursday, May 05, 2011 1:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] error 0xC142 smtp.exe I had encountered the problem when I introduced another Declude add-on to the mix (e.g., another command line program that Declude was launching). Eventually there were too many command line processes using up too much heap… Some of us were using the old command-line sniffer and 2 or 3 anti-virus command line tools, and invURIBL and various other – each one chipping away at the heap. From: IMail Admin [mailto:imailad...@bcwebhost.net] Sent: Thursday, May 05, 2011 2:21 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] error 0xC142 smtp.exe HI Pete, Thanks for the links. After reading all of those, and everything they link to, I have a better idea of what’s happening. What Declude originally called the “mystery heap” is apparently the desktop heap, which had a system wide limit of 48 mb (Win2k and Win2k3), allocated between interactive and non-interactive desktops. Presumably, too many processes are launched, exhausting this heap. Setting a smaller value for the per-process allocation (512 kb by default) should allow more processes to run. So all of this makes sense but doesn’t explain why my server should have this problem. My business is so small any more than I could imagine using my smart phone to run the mail server. If it’s the smtp32.exe process causing the crash, then that would imply to me that I’ve got a lot of outbound messages all at once. I just don’t see how this could happen. I’m guessing that we’ve got no more than a couple hundred mailboxes spread over 30 domains, and no lists larger than 200. So how do I find out where all this outbound stuff is coming from? And is there a setting I could use to limit the number of outbound messages sent (or processed) at one time? Any suggestions are appreciated. Thanks, Ben P.S. I wonder what would happen if I moved my software (Imail 2006.23) to a Win 7 PC or a Windows 2010 server? Just thinking
[Declude.JunkMail] error 0xC0000142 smtp.exe
Hi, I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
On 5/4/2011 11:08 PM, Imail Admin wrote: Hi,  I recall a while back about errors where you get Error #0xC142 (The application failed to initialize) for smtp32.exe, somehow related to Declude. We started getting these recently for no particular reason that I can think of. Is there a setting in Declude that helps with this? IIRC, this is the "mystery heap" problem and solving it will mostly have to do with the setting you're using. http://kb.imailserver.com/cgi-bin/imail.cfg/php/enduser/std_adp.php?p_faqid=686 There is a particular chunk of memory that runs out if too many applications/processes are started at once as children of other processes. In your case, for example, too many concurrent instances of SMTP32.exe along with a number of other factors. If I'm guessing correctly, you could suddenly experience this problem due to allowing enough SMTP32 processes (usually controlled by the number of processing threads you allow) and also having enough mail running through your system to exhaust the mystery heap. This search might help you find what you're looking for in previous discussions. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] error 0xC0000142 smtp.exe
On 5/4/2011 11:08 PM, Imail Admin wrote: Hi, Â I recall a while back about errors where you get Error #0xC142 Oops... when I said "this search" I forgot to include the link: http://www.mail-archive.com/search?q=0xC142l=declude.junkmail%40declude.com There is also a link buried in the KB article that leads here: http://www.declude.com/Articles.asp?ID=130 _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Web analytics
I know this is way off topic, but I’d love to hear if anybody wants to throw out an opinion. We’ve been using HitList Commerce 4.0 since, I don’t know, maybe 2000? to generate web statics reports for our clients’ domains. It was a simple system that produced decent reports emails in a single .RTF file. Recently, however, it broke and I can’t seem to repair it. The makers of HitList, Marketwave, have undergone many changes of ownership over the years and focus now only on very expensive products and services (it was a few hundred dollars when we bought it). So I’m looking at getting something modern. The truth is that I only have a handful of domains who care about this, so I’m looking for something free or very cheap. I’d prefer it to read our IIS logs and then send out emails, but I guess we could adapt to something that just displays a web page. The question is: what’s cheap or free, suitable for hosters (as opposed to end-users) and simple? I’m looking right now at something called JawStats (open source) and also Google Analytics, but I don’t know what’s involved. Any old-timers here with suggestions? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] OT: Web analytics
This will do what you want, does not require any code on the pages, and its free: http://www.mrunix.net/webalizer/ You just set up a config file and run the app with Windows scheduler. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Monday, April 11, 2011 3:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Web analytics I know this is way off topic, but I'd love to hear if anybody wants to throw out an opinion. We've been using HitList Commerce 4.0 since, I don't know, maybe 2000? to generate web statics reports for our clients' domains. It was a simple system that produced decent reports emails in a single .RTF file. Recently, however, it broke and I can't seem to repair it. The makers of HitList, Marketwave, have undergone many changes of ownership over the years and focus now only on very expensive products and services (it was a few hundred dollars when we bought it). So I'm looking at getting something modern. The truth is that I only have a handful of domains who care about this, so I'm looking for something free or very cheap. I'd prefer it to read our IIS logs and then send out emails, but I guess we could adapt to something that just displays a web page. The question is: what's cheap or free, suitable for hosters (as opposed to end-users) and simple? I'm looking right now at something called JawStats (open source) and also Google Analytics, but I don't know what's involved. Any old-timers here with suggestions? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
I added in a weight for the grey listings, but it hasn’t had much impact. A review of the log files shows only a few messages failing due to grey and since I give it a small weight, I’m not worried about false positives. In the meanwhile, something Very Strange happened this morning. An extreme spam (high score under Declude) showed up in my inbox today. It got there thanks to inv-uribl. Here are the relevant lines from the header: X-RBL-Warning: INV-URIBL: Message failed INV-URIBL: -1066598274. X-Declude-Sender: neomaanastaci...@keci.com [201.50.140.132] X-Declude-Spoolname: D1c67025c4807.smd X-Declude-Note: Scanned by Declude 4.2.20 for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [-1066598201] at 07:33:30 on 08 Apr 2011 X-Declude-Fail-WithWeight: NOLEGITCONTENT [0], IPNOTINMX [0], CBL [6], FIVETEN-SRC [7], ZEN [7], SORBS-DUHL [6], SPAMCOP [8], UCEPROTECT-1 [6], UCEPROTECT-2 [5], UCEPROTECT-3 [2], BARRACUDA [4], CMDSPACE [8], SPFUNKNOWN [1], SUBSPACE-12 [1], SUBSPACE-15 [1], SUBCHARS-50 [1], SUBCHARS-55 [1], SUBCHARS-60 [1], SNIFFER [8], INV-URIBL [-1066598274], ZEROHOUR [0] This result was also confirmed by the line in the Declude log file: 04/08/2011 07:33:30.046 q1c67025c4807.smd Tests failed [weight=-1066598201]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=WARN[0] IPNOTINMX=WARN[0] CBL=WARN[6] FIVETEN-SRC=WARN[7] ZEN=IGNORE[7] SORBS-DUHL=WARN[6] SPAMCOP=WARN[8] UCEPROTECT-1=WARN[6] UCEPROTECT-2=WARN[5] UCEPROTECT-3=WARN[2] BARRACUDA=IGNORE[4] CMDSPACE=WARN[8] SPFUNKNOWN=WARN[1] SUBSPACE-12=WARN[1] SUBSPACE-15=WARN[1] SUBCHARS-50=WARN[1] SUBCHARS-55=WARN[1] SUBCHARS-60=WARN[1] SNIFFER=WARN[8] INV-URIBL=WARN[-1066598274] Now how the heck did inv-urible generate a scored of –1 billion??? I checked and there’s nothing like that in the config file. So then I checked the inv-uribl log file and this message does not show up in the log file. Inv-uribl apparently didn’t process this message but did manage to give it an outrageous score. Has anyone seen something like this and is it cause for concern? Thanks, Ben From: IMail Admin Sent: Wednesday, April 06, 2011 10:23 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? HI Scott, It looks to me like you only score the black and not the grey or red listings. The config I have, which would have come from someone else or the default because I’ve never tried tweaking inv-uribl, scores black and red but not grey. I’m thinking of scoring grey with a small score but I was waiting to see response on the list such as yours. Thanks, Ben From: Scott Fisher Sent: Wednesday, April 06, 2011 6:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file? The 127.0.0.4 is a gray listing for the uribl. I personally don’t score the gray result because of too many false positives. !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=75 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / -Original Message- From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Tuesday, April 05, 2011 7:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system with relatively marginal score so I'm looking at the Inv-Uribl log. Here are the lines for a message that I would consider to be obviously spam, yet came through Inv-Uribl as Clean: 2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI from message body found in multi.uribl.com [4] [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 207.65.119.238 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 216.139.251.42 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 173.164.65.196 [Total Weight=0] Did I miss something here that should have
Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
It crashed - through an exception and either Declude was unsure of what to do with it or that was the score it returned.I have seen this happen when I was developing my own app. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 1:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? I added in a weight for the grey listings, but it hasn't had much impact. A review of the log files shows only a few messages failing due to grey and since I give it a small weight, I'm not worried about false positives. In the meanwhile, something Very Strange happened this morning. An extreme spam (high score under Declude) showed up in my inbox today. It got there thanks to inv-uribl. Here are the relevant lines from the header: X-RBL-Warning: INV-URIBL: Message failed INV-URIBL: -1066598274. X-Declude-Sender: neomaanastaci...@keci.com [201.50.140.132] X-Declude-Spoolname: D1c67025c4807.smd X-Declude-Note: Scanned by Declude 4.2.20 for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [-1066598201] at 07:33:30 on 08 Apr 2011 X-Declude-Fail-WithWeight: NOLEGITCONTENT [0], IPNOTINMX [0], CBL [6], FIVETEN-SRC [7], ZEN [7], SORBS-DUHL [6], SPAMCOP [8], UCEPROTECT-1 [6], UCEPROTECT-2 [5], UCEPROTECT-3 [2], BARRACUDA [4], CMDSPACE [8], SPFUNKNOWN [1], SUBSPACE-12 [1], SUBSPACE-15 [1], SUBCHARS-50 [1], SUBCHARS-55 [1], SUBCHARS-60 [1], SNIFFER [8], INV-URIBL [-1066598274], ZEROHOUR [0] This result was also confirmed by the line in the Declude log file: 04/08/2011 07:33:30.046 q1c67025c4807.smd Tests failed [weight=-1066598201]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=WARN[0] IPNOTINMX=WARN[0] CBL=WARN[6] FIVETEN-SRC=WARN[7] ZEN=IGNORE[7] SORBS-DUHL=WARN[6] SPAMCOP=WARN[8] UCEPROTECT-1=WARN[6] UCEPROTECT-2=WARN[5] UCEPROTECT-3=WARN[2] BARRACUDA=IGNORE[4] CMDSPACE=WARN[8] SPFUNKNOWN=WARN[1] SUBSPACE-12=WARN[1] SUBSPACE-15=WARN[1] SUBCHARS-50=WARN[1] SUBCHARS-55=WARN[1] SUBCHARS-60=WARN[1] SNIFFER=WARN[8] INV-URIBL=WARN[-1066598274] Now how the heck did inv-urible generate a scored of -1 billion??? I checked and there's nothing like that in the config file. So then I checked the inv-uribl log file and this message does not show up in the log file. Inv-uribl apparently didn't process this message but did manage to give it an outrageous score. Has anyone seen something like this and is it cause for concern? Thanks, Ben From: IMail Admin Sent: Wednesday, April 06, 2011 10:23 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? HI Scott, It looks to me like you only score the black and not the grey or red listings. The config I have, which would have come from someone else or the default because I've never tried tweaking inv-uribl, scores black and red but not grey. I'm thinking of scoring grey with a small score but I was waiting to see response on the list such as yours. Thanks, Ben From: Scott Fisher Sent: Wednesday, April 06, 2011 6:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file? The 127.0.0.4 is a gray listing for the uribl. I personally don't score the gray result because of too many false positives. !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=75 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / -Original Message- From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Tuesday, April 05, 2011 7:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system with relatively marginal score so I'm looking at the Inv-Uribl log. Here are the lines for a message that I would consider to be obviously spam, yet came through Inv-Uribl as Clean: 2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 D:\IMail\spool\proc\work\D5d0b028c100f.smd
Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
Makes sense. Thanks. From: Nick Hayer Sent: Friday, April 08, 2011 10:29 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? It crashed - through an exception and either Declude was unsure of what to do with it or that was the score it returned.I have seen this happen when I was developing my own app. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 1:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? I added in a weight for the grey listings, but it hasn’t had much impact. A review of the log files shows only a few messages failing due to grey and since I give it a small weight, I’m not worried about false positives. In the meanwhile, something Very Strange happened this morning. An extreme spam (high score under Declude) showed up in my inbox today. It got there thanks to inv-uribl. Here are the relevant lines from the header: X-RBL-Warning: INV-URIBL: Message failed INV-URIBL: -1066598274. X-Declude-Sender: neomaanastaci...@keci.com [201.50.140.132] X-Declude-Spoolname: D1c67025c4807.smd X-Declude-Note: Scanned by Declude 4.2.20 for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [-1066598201] at 07:33:30 on 08 Apr 2011 X-Declude-Fail-WithWeight: NOLEGITCONTENT [0], IPNOTINMX [0], CBL [6], FIVETEN-SRC [7], ZEN [7], SORBS-DUHL [6], SPAMCOP [8], UCEPROTECT-1 [6], UCEPROTECT-2 [5], UCEPROTECT-3 [2], BARRACUDA [4], CMDSPACE [8], SPFUNKNOWN [1], SUBSPACE-12 [1], SUBSPACE-15 [1], SUBCHARS-50 [1], SUBCHARS-55 [1], SUBCHARS-60 [1], SNIFFER [8], INV-URIBL [-1066598274], ZEROHOUR [0] This result was also confirmed by the line in the Declude log file: 04/08/2011 07:33:30.046 q1c67025c4807.smd Tests failed [weight=-1066598201]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=WARN[0] IPNOTINMX=WARN[0] CBL=WARN[6] FIVETEN-SRC=WARN[7] ZEN=IGNORE[7] SORBS-DUHL=WARN[6] SPAMCOP=WARN[8] UCEPROTECT-1=WARN[6] UCEPROTECT-2=WARN[5] UCEPROTECT-3=WARN[2] BARRACUDA=IGNORE[4] CMDSPACE=WARN[8] SPFUNKNOWN=WARN[1] SUBSPACE-12=WARN[1] SUBSPACE-15=WARN[1] SUBCHARS-50=WARN[1] SUBCHARS-55=WARN[1] SUBCHARS-60=WARN[1] SNIFFER=WARN[8] INV-URIBL=WARN[-1066598274] Now how the heck did inv-urible generate a scored of –1 billion??? I checked and there’s nothing like that in the config file. So then I checked the inv-uribl log file and this message does not show up in the log file. Inv-uribl apparently didn’t process this message but did manage to give it an outrageous score. Has anyone seen something like this and is it cause for concern? Thanks, Ben From: IMail Admin Sent: Wednesday, April 06, 2011 10:23 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? HI Scott, It looks to me like you only score the black and not the grey or red listings. The config I have, which would have come from someone else or the default because I’ve never tried tweaking inv-uribl, scores black and red but not grey. I’m thinking of scoring grey with a small score but I was waiting to see response on the list such as yours. Thanks, Ben From: Scott Fisher Sent: Wednesday, April 06, 2011 6:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file? The 127.0.0.4 is a gray listing for the uribl. I personally don’t score the gray result because of too many false positives. !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=75 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / -Original Message- From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Tuesday, April 05, 2011 7:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system
[Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
In all this work on inv-uribl, I realized that my system scores 0 for NOLEGITCONTENT and IPNOTINMX. I would just be following the default, so that leads to the question: what is the purpose of these tests and do other people assign them scores? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
the defs are in the junkmail manual https://www.declude.com/searchresults.asp?Cat=109 IPNOTINMX - The IPNOTINMX test is good for helping reduce false positives. By default, Declude JunkMail will subtract several points from the weighting system when an email does not fail this test (which is very different from the way a spam test normally works). WARNING: The IPNOTINMX should NOT be used to detect spam! It will be triggered when an email is sent from an IP address that is not in its MX record. Although this test will catch a lot of spam (perhaps 80%), it will also catch a lot of legitimate mail (as quite a few larger mailers will send their mail through a different mail server than they use to receive mail). NOLEGITCONTENT - Like the IPNOTINMX test, the NOLEGITCONTENT test is good for helping reduce false positives. By default, Declude JunkMail will subtract several points from the weighting system when an email does not fail this test (which is very different from the way a spam test normally works). WARNING: The NOLEGITCONTENT test should NOT be used to detect spam! It will be triggered Declude JunkMail does not detect any legitimate content in an email. NOTE: Some legitimate email will fail this test, but almost all spam will fail it. The best 'test' is a 'combo' test where it takes several unrelated tests to fail before you wack the email w/a penalty. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 1:38 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX In all this work on inv-uribl, I realized that my system scores 0 for NOLEGITCONTENT and IPNOTINMX. I would just be following the default, so that leads to the question: what is the purpose of these tests and do other people assign them scores? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
We've seen this a lot with Inv-URIBL. You can patch it somewhat by putting in a counterweight for Inv-URIBL when it crashes. There is a small set of scores to adjust for. Darin. - Original Message - From: IMail Admin To: Declude.JunkMail@declude.com Sent: Friday, April 08, 2011 1:35 PM Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? Makes sense. Thanks. From: Nick Hayer Sent: Friday, April 08, 2011 10:29 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? It crashed - through an exception and either Declude was unsure of what to do with it or that was the score it returned.I have seen this happen when I was developing my own app. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 1:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? I added in a weight for the grey listings, but it hasn’t had much impact. A review of the log files shows only a few messages failing due to grey and since I give it a small weight, I’m not worried about false positives. In the meanwhile, something Very Strange happened this morning. An extreme spam (high score under Declude) showed up in my inbox today. It got there thanks to inv-uribl. Here are the relevant lines from the header: X-RBL-Warning: INV-URIBL: Message failed INV-URIBL: -1066598274. X-Declude-Sender: neomaanastaci...@keci.com [201.50.140.132] X-Declude-Spoolname: D1c67025c4807.smd X-Declude-Note: Scanned by Declude 4.2.20 for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [-1066598201] at 07:33:30 on 08 Apr 2011 X-Declude-Fail-WithWeight: NOLEGITCONTENT [0], IPNOTINMX [0], CBL [6], FIVETEN-SRC [7], ZEN [7], SORBS-DUHL [6], SPAMCOP [8], UCEPROTECT-1 [6], UCEPROTECT-2 [5], UCEPROTECT-3 [2], BARRACUDA [4], CMDSPACE [8], SPFUNKNOWN [1], SUBSPACE-12 [1], SUBSPACE-15 [1], SUBCHARS-50 [1], SUBCHARS-55 [1], SUBCHARS-60 [1], SNIFFER [8], INV-URIBL [-1066598274], ZEROHOUR [0] This result was also confirmed by the line in the Declude log file: 04/08/2011 07:33:30.046 q1c67025c4807.smd Tests failed [weight=-1066598201]: CATCHALLMAILS=IGNORE[0] NOLEGITCONTENT=WARN[0] IPNOTINMX=WARN[0] CBL=WARN[6] FIVETEN-SRC=WARN[7] ZEN=IGNORE[7] SORBS-DUHL=WARN[6] SPAMCOP=WARN[8] UCEPROTECT-1=WARN[6] UCEPROTECT-2=WARN[5] UCEPROTECT-3=WARN[2] BARRACUDA=IGNORE[4] CMDSPACE=WARN[8] SPFUNKNOWN=WARN[1] SUBSPACE-12=WARN[1] SUBSPACE-15=WARN[1] SUBCHARS-50=WARN[1] SUBCHARS-55=WARN[1] SUBCHARS-60=WARN[1] SNIFFER=WARN[8] INV-URIBL=WARN[-1066598274] Now how the heck did inv-urible generate a scored of –1 billion??? I checked and there’s nothing like that in the config file. So then I checked the inv-uribl log file and this message does not show up in the log file. Inv-uribl apparently didn’t process this message but did manage to give it an outrageous score. Has anyone seen something like this and is it cause for concern? Thanks, Ben From: IMail Admin Sent: Wednesday, April 06, 2011 10:23 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you read the Inv-Uribl log file? HI Scott, It looks to me like you only score the black and not the grey or red listings. The config I have, which would have come from someone else or the default because I’ve never tried tweaking inv-uribl, scores black and red but not grey. I’m thinking of scoring grey with a small score but I was waiting to see response on the list such as yours. Thanks, Ben From: Scott Fisher Sent: Wednesday, April 06, 2011 6:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file? The 127.0.0.4 is a gray listing for the uribl. I personally don’t score the gray result because of too many false positives. !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=75 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key
Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
Thanks. Now that you’ve posted this I have to apologize because I recall reading this years ago. The problem I’m struggling with is that I get a lot of spam that fail many tests and ends up being deleted, but I also get a lot of true spam that fails only one test, usually Sniffer, and I’d like to find test(s) that would incrementally confirm the spam and push it to the next threshold. For example, I weight Sniffer at 8, so I get a lot of spam that score 8. They’re true spam, but the other tests don’t confirm it and my delete threshold is 12 (although I would be happy to get just to 10 on these spams). Any suggestions welcome. Thanks, Ben From: Nick Hayer Sent: Friday, April 08, 2011 12:23 PM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX the defs are in the junkmail manual https://www.declude.com/searchresults.asp?Cat=109 IPNOTINMX - The IPNOTINMX test is good for helping reduce false positives. By default, Declude JunkMail will subtract several points from the weighting system when an email does not fail this test (which is very different from the way a spam test normally works). WARNING: The IPNOTINMX should NOT be used to detect spam! It will be triggered when an email is sent from an IP address that is not in its MX record. Although this test will catch a lot of spam (perhaps 80%), it will also catch a lot of legitimate mail (as quite a few larger mailers will send their mail through a different mail server than they use to receive mail). NOLEGITCONTENT - Like the IPNOTINMX test, the NOLEGITCONTENT test is good for helping reduce false positives. By default, Declude JunkMail will subtract several points from the weighting system when an email does not fail this test (which is very different from the way a spam test normally works). WARNING: The NOLEGITCONTENT test should NOT be used to detect spam! It will be triggered Declude JunkMail does not detect any legitimate content in an email. NOTE: Some legitimate email will fail this test, but almost all spam will fail it. The best 'test' is a 'combo' test where it takes several unrelated tests to fail before you wack the email w/a penalty. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 1:38 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX In all this work on inv-uribl, I realized that my system scores 0 for NOLEGITCONTENT and IPNOTINMX. I would just be following the default, so that leads to the question: what is the purpose of these tests and do other people assign them scores? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
I would suggest combo-ing sniffer with other tests - and make the penalty very small at first until you gain confidence in the results. -Nick Here is a old sample combo-sniffer.txt file - use it as a guide - not in production.. SKIPIFWEIGHT26 TESTSFAILEDENDNOTCONTAINSEXTERNAL.SNIFFER TESTSFAILED2CONTAINSF5SPAMMONKEY TESTSFAILED2CONTAINS10SPAMMONKEY HEADERS5CONTAINSX-Alligate-AddrSpace: Failed TESTSFAILED2CONTAINSFILTER.ALLIGATE TESTSFAILED4CONTAINSFILTER.STATICSPAMMER_MAILFROM COUNTRIES6CONTAINSCN COUNTRIES6CONTAINSKR COUNTRIES6CONTAINSCH TESTSFAILED6CONTAINSFILTER.BADCOUNTRYNORVDNS TESTSFAILED2CONTAINSFILTER.COMBO.SUSPECIOUS TESTSFAILED5CONTAINSFILTER.DYNA TESTSFAILED8CONTAINSFILTER.INVESTMENT TESTSFAILED5CONTAINSFILTER.LOTTERY TESTSFAILED3CONTAINSFILTER.MORTGAGE TESTSFAILED5CONTAINSFILTER.HEALTH_INS TESTSFAILED5CONTAINSFILTER.NIGERIAN.SCAM TESTSFAILED2CONTAINSFILTER.REV_DNS TESTSFAILED3CONTAINSIP4R.SBL TESTSFAILED2CONTAINSIP4R.SPAMCOP TESTSFAILED2CONTAINSIP4R.XBL TESTSFAILED3CONTAINSIPFILE.HOSTS TESTSFAILED9CONTAINSIPFILE.KILL TESTSFAILED3CONTAINSIPFILE.NETWORKS TESTSFAILED6CONTAINSIPFILE.SUSPICIOUS.HOST TESTSFAILED2CONTAINSIPFILE.SUSPICIOUS.NETWRK TESTSFAILED3CONTAINSXBL( TESTSFAILED3CONTAINSTEST.DYNHELO TESTSFAILED3CONTAINSTEST.ROUTING TESTSFAILED1CONTAINSTEST.SPAMHEADERS TESTSFAILED3CONTAINSTEST.BADHEADERS TESTSFAILED3CONTAINSTEST.REVDNS TESTSFAILED3CONTAINSIP4R.ZENSPAMHAUS MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 3:51 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX Thanks. Now that you've posted this I have to apologize because I recall reading this years ago. The problem I'm struggling with is that I get a lot of spam that fail many tests and ends up being deleted, but I also get a lot of true spam that fails only one test, usually Sniffer, and I'd like to find test(s) that would incrementally confirm the spam and push it to the next threshold. For example, I weight Sniffer at 8, so I get a lot of spam that score 8. They're true spam, but the other tests don't confirm it and my delete threshold is 12 (although I would be happy to get just to 10 on these spams). Any suggestions welcome. Thanks, Ben From: Nick Hayer Sent: Friday, April 08, 2011 12:23 PM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX the defs are in the junkmail manual https://www.declude.com/searchresults.asp?Cat=109 IPNOTINMX - The IPNOTINMX test is good for helping reduce false positives. By default, Declude JunkMail will subtract several points from the weighting system when an email does not fail this test (which is very different from the way a spam test normally works). WARNING: The IPNOTINMX should NOT be used to detect spam! It will be triggered when an email is sent from an IP address that is not in its MX record. Although this test will catch a lot of spam (perhaps 80%), it will also catch a lot of legitimate mail (as quite a few larger mailers will send their mail through a different mail server than they use to receive mail). NOLEGITCONTENT - Like the IPNOTINMX test, the NOLEGITCONTENT test is good for helping reduce false positives. By default, Declude JunkMail will subtract several points from the weighting system when an email does not fail this test (which is very different from the way a spam test normally works). WARNING: The NOLEGITCONTENT test should NOT be used to detect spam! It will be triggered Declude JunkMail does not detect any legitimate content in an email. NOTE: Some legitimate email will fail this test, but almost all spam will fail it. The best 'test' is a 'combo' test where it takes several unrelated tests to fail before you wack the email w/a penalty. -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, April 08, 2011 1:38 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
On 4/8/2011 3:49 PM, IMail Admin wrote: They’re true spam, but the other tests don’t confirm it and my delete threshold is 12 (although I would be happy to get just to 10 on these spams). If you're not already using truncate.gbudb.net DNSBL then that might also allow you to add some weight. http://www.gbudb.com/truncate/index.jsp _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX
try jackie99 MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Pete McNeil madscient...@microneil.com Sent: Friday, April 08, 2011 5:26 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX On 4/8/2011 3:49 PM, IMail Admin wrote: Theyâ?Tre true spam, but the other tests donâ?Tt confirm it and my delete threshold is 12 (although I would be happy to get just to 10 on these spams). If you're not already using truncate.gbudb.net DNSBL then that might also allow you to add some weight. http://www.gbudb.com/truncate/index.jsp _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
That’s a good idea, so I looked at what I have in the config file: !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- !-- BitValue_8 = comes from red.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=7 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=2 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / I’m not an expert, but this seems to say that showing up in the black, grey, or red lists gets you scores of 7, 0 2 corresponding to bitmasks results of 127.0.0.2, 127.0.0.4, and 127.0.0.8. So then I went to the uribl.com web site to look up the definitions of these lists: ■black.uribl.com - This lists contains domain names belonging to and used by spammers, including but not restricted to those that appear in URIs found in Unsolicited Bulk and/or Commercial Email (UBE/UCE). This list has a goal of zero False Positives. This zone rebuilds frequently as new data is added. ■grey.uribl.com - This lists contains domains found in UBE/UCE, and possibly honour opt-out requests. It may include ESPs which allow customers to import their recipient lists and may have no control over the subscription methods. This list can and probably will cause False Positives depending on your definition of UBE/UCE. This zone rebuilds several times a day as necessary. ■red.uribl.com - This list contains domains that actively show up in mail flow, are not listed on URIBL black, and are either: being monitored, very young (domain age via whois), or use whois privacy features to protect their identity. This list is automated in nature, so please use at your own risk. From this, I don’t understand why red would rate a score of 2 and grey a score of 0. It seems to me that grey is in between black and red, and should probably have a score of 3 or 4. In my system, that kind of score wouldn’t be enough to cause the message to be treated as spam (my Declude threshold for “ordinary email” is 5), but it would if combined with other failed tests. Any thoughts on this? Thanks, Ben From: Nick Hayer Sent: Tuesday, April 05, 2011 5:52 PM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] How do you read the Inv-Uribl log file? maybe it scores bitmask results and 127.0.0.4 response is not tagged? -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Imail Admin imailad...@bcwebhost.net Sent: Tuesday, April 05, 2011 8:36 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system with relatively marginal score so I'm looking at the Inv-Uribl log. Here are the lines for a message that I would consider to be obviously spam, yet came through Inv-Uribl as Clean: 2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI from message body found in multi.uribl.com [4] [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 207.65.119.238 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 216.139.251.42 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 173.164.65.196 [Total Weight=0] Did I miss something here that should have triggered a score (additional spam weight in Declude)? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail
RE: [Declude.JunkMail] email being delivered with blank body. What happened to body?
Hi, Time to call Declude on the line or (Linda) via Skype and ask them. I am using “regular” Declude on an Imail system, not the interceptor version. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 mailto:b.blok...@tio.nl b.blok...@tio.nl / http://www.tio.nl www.tio.nl Volg ons op http://twitter.com/#!/hogeschooltio Twitter / http://www.facebook.com/pages/TIO-Hogeschool-Hospitality-en-Toerisme/103881882987989#!/pages/Hogeschool-Tio/417375345610 Facebook / http://cognatio.hyves.nl/ Hyves / http://www.youtube.com/user/hogeschooltio YouTube Van: Rick Davidson [mailto:rdavid...@nat.com] Verzonden: dinsdag 5 april 2011 20:52 Aan: Declude.JunkMail@declude.com Onderwerp: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? So running the 3.4.10.59 (or .49 what ever it is supposed to be) resulted in a bit of chaos for me So there were no more blank email bodies but instead it randomly started mixing up the Q and D files and delivering message bodies to unintended recipients (yea no kidding) The headers look normal, exactly like they are supposed to be, however the message is delivered to the wrong recipient Received: from nateet1.nat.com (64.143.180.230) by mail.nat.com (10.101.226.10) with Microsoft SMTP Server (TLS) id 8.3.137.0; Tue, 5 Apr 2011 11:53:48 -0500 Received: from mx1.nat.com (64.143.180.231) by nateet1.nat.com (64.143.180.231) with Microsoft SMTP Server id 8.3.137.0; Tue, 5 Apr 2011 11:53:42 -0500 Received: from fnbtc.net [209.149.254.11] by mx1.nat.com (Alligate(TM) SMTP Gateway v3.11.1.27) with ESMPT id b5ebbfc2087eab34.8d3a4a8f6d574...@mx1.nat.com for some...@nat.com; Tue, 05 Apr 2011 11:53:23 -0500 Received: from ([192.168.3.1]) by mail.fnbtc.net with ESMTP id J3NF5H1.30523111;Tue, 05 Apr 2011 12:16:50 -0400 Received: by fnb_tc_02.fnb_tc with Internet Mail Service (5.5.2657.72) id 2KAZYZJ7; Tue, 5 Apr 2011 12:37:54 -0400 Message-ID: 4C6283FBCA6604418688004ED2B8EC6C24ED23EB@fnb_tc_02.fnb_tc From: Mrs Someone some...@seacoastnational.com To: 'Mr Someone' some...@nat.com Subject: chairs Date: Tue, 5 Apr 2011 12:37:53 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: multipart/alternative; boundary=_=_NextPart_001_01CBF3AF.CF9AC848 X-MXRate-Prob: 0 X-MXRate-Country: US X-MXRate-Action: NONE X-Alligate-ReceivingIP: [64.143.180.230] X-Alligate-Country-Chain: United States-Destination X-Alligate-Tarpit: NOSUBD;GREY (20secs) X-Alligate-Grey: Passed X-Alligate-REVDNS: mail.fnbtc.net X-Alligate-HELO: fnbtc.net X-Alligate-Spam: NOSUBD;TARPIT; X-Alligate-MsgScan: (10) NOTGOODSNDR[10]; X-Alligate-ID: 245564 X-Originating-IP: 209.149.254.11 X-Alligate-RcptTo: some...@nat.com Return-Path: some...@seacoastnational.com X-RBL-Warning: WEIGHTER: Message failed WEIGHTER test (line 29, weight 1) X-Declude-Sender: some...@seacoastnational.com [209.149.254.11] X-Declude-Spoolname: D005433486.smd X-Declude-RefID: str=0001.0A020202.4D9B4913.0045:SCFSTAT2058654,ss=1,fgs=0 X-SendingHost: seacoastnational.com X-Country-Chain: UNITED STATES-destination X-Recipients: some...@nat.com X-Declude-Fail: BACKSCATTER [4], COMMENTS [7], WEIGHTER [1] X-Declude-Score: 12 Alligate 11:53:07.578 - (245564) Cmd recd: MAIL FROM:some...@seacoastnational.com size=5349 11:53:07.734 - (245564) Cmd recd: RCPT TO:some...@nat.com Declude Junkmail 04/05/2011 11:53:39.156 Q005433486.smd From: some...@seacoastnational.com To: some...@nat.com IP: 209.xxx.xxx.xx ID: J3NF5H1.30523111 Here is where it goes bad, the handoff from Declude to Exchange, there are two new recipients and an additional sender address 2011-04-05T16:53:42.453Z,64.143.180.231,,64.143.180.231,mx1,08CDBFF5751E827C;2011-04-05T16:53:42.296Z;0,mx1\Inbound From Internet,SMTP,RECEIVE,31471,4C6283FBCA6604418688004ED2B8EC6C24ED23EB@fnb_tc_02.fnb_tc,someo...@nat.com;someo...@nat.com,,9626,2,,,chairs,some...@seacoastnational.com,some...@msn.com,10I: the message above was delivered to someo...@nat.com and someo...@nat.com from some...@msn.com instead of what was contained in the headers Rolled back to previous version… -- Rick From: Rick Davidson Sent: Tuesday, April 05, 2011 8:37 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Login to the interim area Go to interceptor There is a dir called 3.4.10.59 Swap out the decludeproc.exe files I am running it this morning and indeed that issue does not exist, however the diags.txt says it is 3.4.10.49 -- rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Tuesday, April 05, 2011 8:05 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered
RE: [Declude.JunkMail] How do you read the Inv-Uribl log file?
The 127.0.0.4 is a gray listing for the uribl. I personally don't score the gray result because of too many false positives. !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=75 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / -Original Message- From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Tuesday, April 05, 2011 7:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system with relatively marginal score so I'm looking at the Inv-Uribl log. Here are the lines for a message that I would consider to be obviously spam, yet came through Inv-Uribl as Clean: 2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI from message body found in multi.uribl.com [4] [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 207.65.119.238 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 216.139.251.42 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 173.164.65.196 [Total Weight=0] Did I miss something here that should have triggered a score (additional spam weight in Declude)? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
HI Scott, It looks to me like you only score the black and not the grey or red listings. The config I have, which would have come from someone else or the default because I’ve never tried tweaking inv-uribl, scores black and red but not grey. I’m thinking of scoring grey with a small score but I was waiting to see response on the list such as yours. Thanks, Ben From: Scott Fisher Sent: Wednesday, April 06, 2011 6:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file? The 127.0.0.4 is a gray listing for the uribl. I personally don’t score the gray result because of too many false positives. !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=75 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / -Original Message- From: Imail Admin [mailto:imailad...@bcwebhost.net] Sent: Tuesday, April 05, 2011 7:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system with relatively marginal score so I'm looking at the Inv-Uribl log. Here are the lines for a message that I would consider to be obviously spam, yet came through Inv-Uribl as Clean: 2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI from message body found in multi.uribl.com [4] [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 207.65.119.238 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 216.139.251.42 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 173.164.65.196 [Total Weight=0] Did I miss something here that should have triggered a score (additional spam weight in Declude)? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] email being delivered with blank body. What happened to body?
I am running 4.10.58 Will upgrade and see what happens Still trying to figure why just the one domain. Will let you know results Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 From: Bonno Bloksma [b.blok...@tio.nl] Sent: April-05-11 1:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Hi, Which version of Declude are you running? I remember chasing a wierd bug that was sometimes truncating a message to 1k, which mostly affected html mail. After declude found the cause for that issue they released interim version Declude 4.10.59 which is what I am running now. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 b.blok...@tio.nlmailto:b.blok...@tio.nl / www.tio.nlhttp://www.tio.nl/ Volg ons op Twitterhttp://twitter.com/#!/hogeschooltio / Facebookhttp://www.facebook.com/pages/TIO-Hogeschool-Hospitality-en-Toerisme/103881882987989#!/pages/Hogeschool-Tio/417375345610 / Hyveshttp://cognatio.hyves.nl/ / YouTubehttp://www.youtube.com/user/hogeschooltio Van: Harry Vanderzand [mailto:ha...@intown.net] Verzonden: dinsdag 5 april 2011 0:54 Aan: Declude.JunkMail@declude.com Onderwerp: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] email being delivered with blank body. What happened to body?
Where did you get 4.10.59? I do not see it available for download. I have even turned of spam scanning for the domain yet it still occurs. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 From: Bonno Bloksma [b.blok...@tio.nl] Sent: April-05-11 1:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Hi, Which version of Declude are you running? I remember chasing a wierd bug that was sometimes truncating a message to 1k, which mostly affected html mail. After declude found the cause for that issue they released interim version Declude 4.10.59 which is what I am running now. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 b.blok...@tio.nlmailto:b.blok...@tio.nl / www.tio.nlhttp://www.tio.nl/ Volg ons op Twitterhttp://twitter.com/#!/hogeschooltio / Facebookhttp://www.facebook.com/pages/TIO-Hogeschool-Hospitality-en-Toerisme/103881882987989#!/pages/Hogeschool-Tio/417375345610 / Hyveshttp://cognatio.hyves.nl/ / YouTubehttp://www.youtube.com/user/hogeschooltio Van: Harry Vanderzand [mailto:ha...@intown.net] Verzonden: dinsdag 5 april 2011 0:54 Aan: Declude.JunkMail@declude.com Onderwerp: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] email being delivered with blank body. What happened to body?
Login to the interim area Go to interceptor There is a dir called 3.4.10.59 Swap out the decludeproc.exe files I am running it this morning and indeed that issue does not exist, however the diags.txt says it is 3.4.10.49 -- rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Tuesday, April 05, 2011 8:05 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Where did you get 4.10.59? I do not see it available for download. I have even turned of spam scanning for the domain yet it still occurs. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 From: Bonno Bloksma [b.blok...@tio.nl] Sent: April-05-11 1:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Hi, Which version of Declude are you running? I remember chasing a wierd bug that was sometimes truncating a message to 1k, which mostly affected html mail. After declude found the cause for that issue they released interim version Declude 4.10.59 which is what I am running now. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 b.blok...@tio.nlmailto:b.blok...@tio.nl / www.tio.nlhttp://www.tio.nl/ Volg ons op Twitterhttp://twitter.com/#!/hogeschooltio / Facebookhttp://www.facebook.com/pages/TIO-Hogeschool-Hospitality-en-Toerisme/103881882987989#!/pages/Hogeschool-Tio/417375345610 / Hyveshttp://cognatio.hyves.nl/ / YouTubehttp://www.youtube.com/user/hogeschooltio Van: Harry Vanderzand [mailto:ha...@intown.net] Verzonden: dinsdag 5 april 2011 0:54 Aan: Declude.JunkMail@declude.com Onderwerp: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click heremailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com. CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] email being delivered with blank body. What happened to body?
So running the 3.4.10.59 (or .49 what ever it is supposed to be) resulted in a bit of chaos for me So there were no more blank email bodies but instead it randomly started mixing up the Q and D files and delivering message bodies to unintended recipients (yea no kidding) The headers look normal, exactly like they are supposed to be, however the message is delivered to the wrong recipient Received: from nateet1.nat.com (64.143.180.230) by mail.nat.com (10.101.226.10) with Microsoft SMTP Server (TLS) id 8.3.137.0; Tue, 5 Apr 2011 11:53:48 -0500 Received: from mx1.nat.com (64.143.180.231) by nateet1.nat.com (64.143.180.231) with Microsoft SMTP Server id 8.3.137.0; Tue, 5 Apr 2011 11:53:42 -0500 Received: from fnbtc.net [209.149.254.11] by mx1.nat.com (Alligate(TM) SMTP Gateway v3.11.1.27) with ESMPT id b5ebbfc2087eab34.8d3a4a8f6d574...@mx1.nat.com for some...@nat.com; Tue, 05 Apr 2011 11:53:23 -0500 Received: from ([192.168.3.1]) by mail.fnbtc.net with ESMTP id J3NF5H1.30523111;Tue, 05 Apr 2011 12:16:50 -0400 Received: by fnb_tc_02.fnb_tc with Internet Mail Service (5.5.2657.72) id 2KAZYZJ7; Tue, 5 Apr 2011 12:37:54 -0400 Message-ID: 4C6283FBCA6604418688004ED2B8EC6C24ED23EB@fnb_tc_02.fnb_tc From: Mrs Someone some...@seacoastnational.com To: 'Mr Someone' some...@nat.com Subject: chairs Date: Tue, 5 Apr 2011 12:37:53 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: multipart/alternative; boundary=_=_NextPart_001_01CBF3AF.CF9AC848 X-MXRate-Prob: 0 X-MXRate-Country: US X-MXRate-Action: NONE X-Alligate-ReceivingIP: [64.143.180.230] X-Alligate-Country-Chain: United States-Destination X-Alligate-Tarpit: NOSUBD;GREY (20secs) X-Alligate-Grey: Passed X-Alligate-REVDNS: mail.fnbtc.net X-Alligate-HELO: fnbtc.net X-Alligate-Spam: NOSUBD;TARPIT; X-Alligate-MsgScan: (10) NOTGOODSNDR[10]; X-Alligate-ID: 245564 X-Originating-IP: 209.149.254.11 X-Alligate-RcptTo: some...@nat.com Return-Path: some...@seacoastnational.com X-RBL-Warning: WEIGHTER: Message failed WEIGHTER test (line 29, weight 1) X-Declude-Sender: some...@seacoastnational.com [209.149.254.11] X-Declude-Spoolname: D005433486.smd X-Declude-RefID: str=0001.0A020202.4D9B4913.0045:SCFSTAT2058654,ss=1,fgs=0 X-SendingHost: seacoastnational.com X-Country-Chain: UNITED STATES-destination X-Recipients: some...@nat.com X-Declude-Fail: BACKSCATTER [4], COMMENTS [7], WEIGHTER [1] X-Declude-Score: 12 Alligate 11:53:07.578 - (245564) Cmd recd: MAIL FROM:some...@seacoastnational.com size=5349 11:53:07.734 - (245564) Cmd recd: RCPT TO:some...@nat.com Declude Junkmail 04/05/2011 11:53:39.156 Q005433486.smd From: some...@seacoastnational.com To: some...@nat.com IP: 209.xxx.xxx.xx ID: J3NF5H1.30523111 Here is where it goes bad, the handoff from Declude to Exchange, there are two new recipients and an additional sender address 2011-04-05T16:53:42.453Z,64.143.180.231,,64.143.180.231,mx1,08CDBFF5751E827C;2011-04-05T16:53:42.296Z;0,mx1\Inbound From Internet,SMTP,RECEIVE,31471,4C6283FBCA6604418688004ED2B8EC6C24ED23EB@fnb_tc_02.fnb_tc,someo...@nat.com;someo...@nat.com,,9626,2,,,chairs,some...@seacoastnational.com,some...@msn.com,10I: the message above was delivered to someo...@nat.commailto:someo...@nat.com and someo...@nat.commailto:someo...@nat.com from some...@msn.commailto:some...@msn.com instead of what was contained in the headers Rolled back to previous version… -- Rick From: Rick Davidson Sent: Tuesday, April 05, 2011 8:37 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Login to the interim area Go to interceptor There is a dir called 3.4.10.59 Swap out the decludeproc.exe files I am running it this morning and indeed that issue does not exist, however the diags.txt says it is 3.4.10.49 -- rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Tuesday, April 05, 2011 8:05 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Where did you get 4.10.59? I do not see it available for download. I have even turned of spam scanning for the domain yet it still occurs. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 From: Bonno Bloksma [b.blok...@tio.nl] Sent: April-05-11 1:48 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] email being delivered with blank body. What happened to body? Hi, Which version of Declude are you running? I remember chasing a wierd bug that was sometimes truncating a message to 1k, which mostly affected html mail. After declude found the cause for that issue they released interim version Declude 4.10.59 which is what I am running now. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el
re: [Declude.JunkMail] How do you read the Inv-Uribl log file?
maybe it scores bitmask results and 127.0.0.4 response is not tagged? -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: Imail Admin imailad...@bcwebhost.net Sent: Tuesday, April 05, 2011 8:36 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file? So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a lot of spam that gets through my system with relatively marginal score so I'm looking at the Inv-Uribl log. Here are the lines for a message that I would consider to be obviously spam, yet came through Inv-Uribl as Clean: 2011-03-31 02:53:09.343 2011-03-31 02:53:12.484 D:\IMail\spool\proc\work\D5d0b028c100f.smd netcontentinc.com 127.0.0.4 URI from message body found in multi.uribl.com [4] [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved netcontentinc.com to 207.65.119.238 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved avantresources.com to 216.139.251.42 [Total Weight=0] 2011-03-31 02:53:09.343 2011-03-31 02:53:12.953 D:\IMail\spool\proc\work\D5d0b028c100f.smd Resolved bcwebhost.net to 173.164.65.196 [Total Weight=0] Did I miss something here that should have triggered a score (additional spam weight in Declude)? Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] email being delivered with blank body. What happened to body?
This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
I will be checking my mail once a day and hopefully all will be well. Should you have an issue that can wait till I get back, I would appreciate that. If it needs to be taken care of right away then I will do it when I check my mail. If the matter is more urgent, I.E. hardware/server issues, then contact Doug Palubiski at Justfixit.com, 1-866-349-8447 . Let them know that you are calling as a client of Intown and they will take care of it on my behalf. I will be back fully rested Thursday April 7th. Thank you, Harry --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] RE: email being delivered with blank body. What happened to body?
Look for these messages in your log files WARNING: EOF in multipart processing I had that problem when I upgraded to Interceptor 3.4.10.48 back in Feb, I had to roll back to the previous version I was running which is 3.4.42 I have yet to hear back on that one, if anyone has a fix I’d like to hear it -- Rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Monday, April 04, 2011 5:54 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click heremailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com. CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body?
I've seen it with lotus notes delivering to an Outlook client. The emails show fine in imails web mail. I've never found a fix. Its related to Lotus Notes replies - not the original email. -Original Message- From: Rick Davidson rdavid...@nat.com Sent 4/4/2011 8:33:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body? Look for these messages in your log files WARNING: EOF in multipart processing I had that problem when I upgraded to Interceptor 3.4.10.48 back in Feb, I had to roll back to the previous version I was running which is 3.4.42 I have yet to hear back on that one, if anyone has a fix I’d like to hear it -- Rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Monday, April 04, 2011 5:54 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click here. CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body?
I get the same behavior with smartermail. I also run into (frequently) situations where it strips off attachments and people complain they don't receive their files. I have also seen where spam will skate right on past filters that should have triggered. I suspect there is some very specific series of events that causes the above weird things to happen. _ From: Richard Lyon [mailto:rl...@piolaxusa.com] Sent: Monday, April 04, 2011 7:53 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body? I've seen it with lotus notes delivering to an Outlook client. The emails show fine in imails web mail. I've never found a fix. Its related to Lotus Notes replies - not the original email. -Original Message- From: Rick Davidson rdavid...@nat.com Sent 4/4/2011 8:33:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body? Look for these messages in your log files WARNING: EOF in multipart processing I had that problem when I upgraded to Interceptor 3.4.10.48 back in Feb, I had to roll back to the previous version I was running which is 3.4.42 I have yet to hear back on that one, if anyone has a fix I'd like to hear it -- Rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Monday, April 04, 2011 5:54 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click here mailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com . _ CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body?
I was seeing the blank emails in the spam hold queue (which I review with fpReview), the bodies in the D files were indeed blank so they wouldn’t have shown ok in any client. I didn’t realize it was a problem until the helpdesk started opening tickets for blank emails (outlook Exchange 07) It appeared to be an issue with html email only, didn’t take any time to do detective work, I quickly rolled back since it was only day two into an upgrade -- Rick From: Richard Lyon [mailto:rl...@piolaxusa.com] Sent: Monday, April 04, 2011 7:53 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body? I've seen it with lotus notes delivering to an Outlook client. The emails show fine in imails web mail. I've never found a fix. Its related to Lotus Notes replies - not the original email. -Original Message- From: Rick Davidson rdavid...@nat.com Sent 4/4/2011 8:33:10 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body? Look for these messages in your log files WARNING: EOF in multipart processing I had that problem when I upgraded to Interceptor 3.4.10.48 back in Feb, I had to roll back to the previous version I was running which is 3.4.42 I have yet to hear back on that one, if anyone has a fix I’d like to hear it -- Rick From: Harry Vanderzand [mailto:ha...@intown.net] Sent: Monday, April 04, 2011 5:54 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click heremailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com. CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click heremailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] email being delivered with blank body. What happened to body?
Hi, Which version of Declude are you running? I remember chasing a wierd bug that was sometimes truncating a message to 1k, which mostly affected html mail. After declude found the cause for that issue they released interim version Declude 4.10.59 which is what I am running now. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 mailto:b.blok...@tio.nl b.blok...@tio.nl / http://www.tio.nl www.tio.nl Volg ons op http://twitter.com/#!/hogeschooltio Twitter / http://www.facebook.com/pages/TIO-Hogeschool-Hospitality-en-Toerisme/103881882987989#!/pages/Hogeschool-Tio/417375345610 Facebook / http://cognatio.hyves.nl/ Hyves / http://www.youtube.com/user/hogeschooltio YouTube Van: Harry Vanderzand [mailto:ha...@intown.net] Verzonden: dinsdag 5 april 2011 0:54 Aan: Declude.JunkMail@declude.com Onderwerp: [Declude.JunkMail] email being delivered with blank body. What happened to body? This is occurring to one of my domains. No others that I can figure. I see no pattern as to why the mail gets delivered but the body is missing. Any help is sure appreciated. I run imail with an Alligate front end. And of course Declude. Thank you in advance for your assistance. Thank you Harry Vanderzand Intown internet Erbsville Internet 740 Erbsville Road Waterloo, ON, N2J3Z4 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] JunkMail Bounce and Virus Notices
Hi, It’s not just limited to HiJack, it seems that Declude Virus and Declude Junkmail are both hardcoded to use IMail1 for virus notifications, Bounce Messages. I can’t find any configuration option where you can either use BLAT or some other command line mailer and/or mailer script. Here snippets from the VIR* and DEC* logs: 03/27/2011 09:08:21.095 q57ef0032830be332.smd Error starting imail1: 2 [D:\IMAIL\IMail1.exe -h Postmaster.Argos.net -t PostMaster@[123.26.186.94],PostMaster@localhost -u postmas...@postmaster.argos.net -s Our Virus Firewall has Rejected an Apparent Email of Your User! -f D:\IMail\spool\proc\work\D57ef0032830be332.sm0] 03/27/2011 00:03:01.096 q216f00324ee89e2d.smd Error starting imail1: 2 [D:\IMAIL\IMail1.exe -h Postmaster.Argos.net -t r...@images.solarcycle29.info -u postmas...@postmaster.argos.net -s Undelivered Mail -f D:\IMail\spool\proc\work\D216f00324ee89e2d.sm0] Best Regards, Andy _ From: John T johnl...@eservicesforyou.com Sender: John T johnl...@eservicesforyou.com Date: Sat, 26 Mar 2011 16:09:11 GMT To: Declude.JunkMail@declude.com ReplyTo: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to send notices about email held by HiJack With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts? John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How to send notices about email held by HiJack
PS: appears they removed it in v10 – not just v11 (or v11.03). I went back to version 11.02 installer, and after going through the entire activation sequence for a new/second trial install – I ended up with 11.02 – but no Imail1.exe. I don’t have a pre-version 10 installer laying around! _ From: John T johnl...@eservicesforyou.com Sender: John T johnl...@eservicesforyou.com Date: Sat, 26 Mar 2011 16:09:11 GMT To: Declude.JunkMail@declude.com ReplyTo: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to send notices about email held by HiJack With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts? John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How to send notices about email held by HiJack
With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts?John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How to send notices about email held by HiJack
We are aware of this and are looking at an alternative. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com Description: -declude Description: -dnsstuff From: John T [mailto:johnl...@eservicesforyou.com] Sent: Saturday, March 26, 2011 12:09 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to send notices about email held by HiJack With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts? John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. image001.pngimage002.png
Re: [Declude.JunkMail] How to send notices about email held by HiJack
Thanks David. John T eServices For You -Original Message- From: "David Barker" dbar...@declude.com Sent 3/26/2011 9:11:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] How to send notices about email held by HiJack We are aware of this and are looking at an alternative. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: John T [mailto:johnl...@eservicesforyou.com] Sent: Saturday, March 26, 2011 12:09 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to send notices about email held by HiJack With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts? John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to send notices about email held by HiJack
Restore imail1.exe from a backup Sent via BlackBerry by ATT -Original Message- From: John T johnl...@eservicesforyou.com Sender: John T johnl...@eservicesforyou.com Date: Sat, 26 Mar 2011 16:09:11 To: Declude.JunkMail@declude.com Reply-to: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to send notices about email held by HiJack With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts?John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How to send notices about email held by HiJack
John T I took an old copy from a backup, renamed it, and stuck it in an obscure folder. If I get hacked, and they get to my Declude scripts, I'm screwed, but most likely it'll be the least of my worries. My recollection is that the worry is that that program can be fired off via an Ipswitch issue. My thought is whatever that vulnerability is, it won't be able to find my copy and execute. John D From: John T [mailto:johnl...@eservicesforyou.com] Sent: Saturday, March 26, 2011 9:09 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to send notices about email held by HiJack With Ipswitches decision to remove imail1.exe from Imail 11.03 the scripts we have been using to check the HiJack hold folders and send emails when email is found hold no longer work. What options are avilable now to be able to send automated email through scripts? John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How effective should Inv-Uribl be?
I'm still having trouble with more spam seepage, so I've been looking at my various tests. I noticed that in the past, the Inv-uribl test caught 63-70% of messages, but recently it's only catching 56%. When I look at a lot of the low value spam (messages that barely get classified as spam), they always have an Inv-uribl result of score 0 range clean. Is it just that this test is less effective now? Or have I somehow messed up my configuration? As an aside: I use DL Analyzer to check these results. One this it always does is give the average weight/message and average weight/failed message. Typically, these are scores such as 45 and 46. Just lately I started get results like -131,000 and -136,000. I don't know if this is another sign of something broken in my configuration or if the analyzer program has somehow broken. Thanks. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] How effective should Inv-Uribl be?
What uribl tests are you using and are you getting hits on them - check your logs.. I'm suggesting you may need different tests - the one you are using may have blacklisted you or are dead even... -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, March 18, 2011 2:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How effective should Inv-Uribl be? I'm still having trouble with more spam seepage, so I've been looking at my various tests. I noticed that in the past, the Inv-uribl test caught 63-70% of messages, but recently it's only catching 56%. When I look at a lot of the low value spam (messages that barely get classified as spam), they always have an Inv-uribl result of score 0 range clean. Is it just that this test is less effective now? Or have I somehow messed up my configuration? As an aside: I use DL Analyzer to check these results. One this it always does is give the average weight/message and average weight/failed message. Typically, these are scores such as 45 and 46. Just lately I started get results like -131,000 and -136,000. I don't know if this is another sign of something broken in my configuration or if the analyzer program has somehow broken. Thanks. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How effective should Inv-Uribl be?
I’m not quite sure what you mean. In the Declude global.cfg file the only reference to inv-uribl is INV-URIBL external weight D:\imail\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP% 0 0 In the invUribl.exe.config file there is (in part): *** !-- This is the URI Blacklist That The URI Will Be Checked Against -- add key=URIBL_List1 value=multi.surbl.org / !-- Weight added to the result code or custom bitmask total. -- add key=URIBL_Weight_List1 value=0 / !--Allows you to override the normal values for bitmasks for a custom return weight-- add key=Enable_Custom_Bitmask_Values_URIBL_List1 value=true / !--If using multi.surbl.org see http://www.surbl.org/lists.html#multi for which lists correspond -- !--to which bitmask values -- !-- BitValue_2 = comes from sc.surbl.org -- !-- BitValue_4 = comes from ws.surbl.org -- !-- BitValue_8 = comes from phishing data source (labelled as [ph] in multi) -- !-- BitValue_16 = comes from ob.surbl.org -- !-- BitValue_32 = comes from ab.surbl.org -- !-- BitValue_64 = comes from jp data source (labelled as [jp] in multi) -- add key=URI_Bitmask_BitValue_1_Weight_URIBL_List1 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List1 value=7 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List1 value=2 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List1 value=5 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List1 value=3 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List1 value=7 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List1 value=10 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List1 value=0 / !--URI LIST 2-- add key=URIBL_List2 value=multi.uribl.com / add key=URIBL_Weight_List2 value=0 / !-- BitValue_2 = comes from black.uribl.org -- !-- BitValue_4 = comes from grey.uribl.org -- !-- BitValue_8 = comes from red.uribl.org -- add key=Enable_Custom_Bitmask_Values_URIBL_List2 value=true / add key=URI_Bitmask_BitValue_1_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_2_Weight_URIBL_List2 value=7 / add key=URI_Bitmask_BitValue_4_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_8_Weight_URIBL_List2 value=2 / add key=URI_Bitmask_BitValue_16_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_32_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_64_Weight_URIBL_List2 value=0 / add key=URI_Bitmask_BitValue_128_Weight_URIBL_List2 value=0 / !--Enables the checking of the URI's name servers against an RBL. -- !--If the name servers are listed in the RBL the defined weight will be added-- !--Max_Name_servers_To_Check - Sets the number of name servers to check. -- !--If set to zero all name servers returned from the DNS query will be checked-- !--Bitmask_Skip_Options_Name_Server_RBLx - Bitmask value that allows you to skip -- !--the associated Namerserver check if the URI is listed in the URI list. -- !--Values: 0 - no skipping will occur. 1 - Skip Nameserver check if URI was listed-- !--in a URI list. 2 - Skip if the URI's name server was already found in he given -- !--blacklist. This prevents double scoring. These are bitmask values and would -- !--be added together based on the options you want.-- add key=Enable_URI_Name_Server_Check value=true / add key=Max_Name_Servers_To_Check value=3 / add key=Name_Server_RBL1 value=sbl.spamhaus.org / add key=Bitmask_Skip_Options_Name_Server_RBL1 value=2 / add key=Name_Server_Return_Code_RBL1 value=* / add key=Name_Server_Weight_RBL1 value=5 / *** In the inv-uribl log file I find references to multi.surbl.org, sbl.spamhaus.org, multi.uribl.com, and xx.countries.nerd.dk (where xx is a country code such as ru). All the lines that end in Total Weight = 0 don’t list any tests at all – they just resolve the IP. Thanks. From: Nick Hayer Sent: Friday, March 18, 2011 11:21 AM To: Declude.JunkMail@declude.com Subject: re: [Declude.JunkMail] How effective should Inv-Uribl be? What uribl tests are you using and are you getting hits on them - check your logs.. I'm suggesting you may need different tests - the one you are using may have blacklisted you or are dead even... -Nick MadRiverAccess.com|Skywaves.com Tech Support US/Canada 877-873-6482 or International +1-802-229-6574 Emergency Support 24/7: supp...@skywaves.net General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm From: IMail Admin imailad...@bcwebhost.net Sent: Friday, March 18, 2011 2:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How effective should Inv-Uribl be? I'm still having trouble with more spam seepage, so I've been looking at my various tests. I noticed that in the past, the Inv-uribl test caught 63-70% of messages, but recently it's only catching 56
