RE: [Declude.JunkMail] Blacklist False Positive Tests
Thanks Scott! I completely overlooked your earlier response. Teksolvers, LLC Todd Smith 1077 Glenharbor Circle Winter Garden, FL 34787 Phone 407-877-8450 Fax 407-877-8451 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, June 06, 2003 3:46 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blacklist False Positive Tests >> They all work the same -- Declude JunkMail checks to see if the sender has >> whatever you list in their return address. So "@example.com" which catch >> any E-mail from @example.com, ".example.com" would catch any E-mail from >> @*.example.com, and "example.com" would catch both @example.com and >> @*.example.com as well as @not_an_example.com. >What is the difference within the blacklist.txt file contain entries >that begin with a period (.junkmail.com), @ (@junkmail.com), or just >blank (junkmail.com) ? They all work the same -- Declude JunkMail checks to see if the sender has whatever you list in their return address. So "@example.com" which catch any E-mail from @example.com, ".example.com" would catch any E-mail from @*.example.com, and "example.com" would catch both @example.com and @*.example.com as well as @not_an_example.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist False Positive Tests
>> They all work the same -- Declude JunkMail checks to see if the sender has >> whatever you list in their return address. So "@example.com" which catch >> any E-mail from @example.com, ".example.com" would catch any E-mail from >> @*.example.com, and "example.com" would catch both @example.com and >> @*.example.com as well as @not_an_example.com. What is the difference within the blacklist.txt file contain entries that begin with a period (.junkmail.com), @ (@junkmail.com), or just blank (junkmail.com) ? They all work the same -- Declude JunkMail checks to see if the sender has whatever you list in their return address. So "@example.com" which catch any E-mail from @example.com, ".example.com" would catch any E-mail from @*.example.com, and "example.com" would catch both @example.com and @*.example.com as well as @not_an_example.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist False Positive Tests
Scott, I've set "XSENDER ON" and "XSPOOLNAME ON" What is the difference within the blacklist.txt file contain entries that begin with a period (.junkmail.com), @ (@junkmail.com), or just blank (junkmail.com) ? Teksolvers, LLC Todd Smith 1077 Glenharbor Circle Winter Garden, FL 34787 Phone 407-877-8450 Fax 407-877-8451 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, June 06, 2003 12:27 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blacklist False Positive Tests >SMTP Imail log: > >06:06 11:13 SMTPD(007A0120) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> >06:06 11:13 SMTPD(008B009A) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> >06:06 11:13 SMTPD(0051014C) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> >06:06 11:13 SMTPD(00290138) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> Unfortunately, I can't tell you which of these four E-mails is the one you posted. I would recommend using the "XSENDER ON" and "XSPOOLNAME ON" options in the global.cfg file, which makes it much easier to get the information you need. >Any ideas? You could send me your blacklist.txt file? >Also, What is the difference within the blacklist.txt file contain >entries that begin with a period (.junkmail.com), @ (@junkmail.com), or >just blank (junkmail.com) They all work the same -- Declude JunkMail checks to see if the sender has whatever you list in their return address. So "@example.com" which catch any E-mail from @example.com, ".example.com" would catch any E-mail from @*.example.com, and "example.com" would catch both @example.com and @*.example.com as well as @not_an_example.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist False Positive Tests
Thanks for the fast response! Here is the declude log for the email in question: 06/06/2003 11:13:28 Qaf97002e0138490a Msg failed MX; testing A (mail.networkorlando.com) [1 1 0 ] 06/06/2003 11:13:28 Qaf97002e0138490a BLACKLIST:8 . Total weight = 8 06/06/2003 11:13:28 Qaf97002e0138490a Using [incoming] CFG file d:\IMail\Declude\$default$.junkmail. 06/06/2003 11:13:28 Qaf97002e0138490a Msg failed BLACKLIST (). 06/06/2003 11:13:28 Qaf97002e0138490a Subject: Curry Ford / Alafaya 06/06/2003 11:13:28 Qaf97002e0138490a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] SMTP Imail log: 06:06 11:13 SMTPD(007A0120) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(008B009A) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(00290138) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(0051014C) [209.26.230.188] HELO mail.networkorlando.com 06:06 11:13 SMTPD(007A0120) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(008B009A) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(007A0120) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(0051014C) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(008B009A) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(0051014C) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(007A0120) [209.26.230.188] d:\IMail\spool\Daf7e007a0120e7fe.SMD 1775 06:06 11:13 SMTPD(008B009A) [209.26.230.188] d:\IMail\spool\Daf7f008b009ae80e.SMD 1396 06:06 11:13 SMTPD(0051014C) [209.26.230.188] d:\IMail\spool\Daf7f0051014ce83c.SMD 1186 06:06 11:13 SMTP-(0464) processing d:\IMail\spool\Qaf7f0051014ce83c.SMD 06:06 11:13 SMTP-(0F20) processing d:\IMail\spool\Qaf7f008b009ae80e.SMD 06:06 11:13 SMTP-(0464) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 1299 06:06 11:13 SMTP-(0464) finished d:\IMail\spool\Qaf7f0051014ce83c.SMD status=1 06:06 11:13 SMTP-(0F20) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 1509 06:06 11:13 SMTP-(0F20) finished d:\IMail\spool\Qaf7f008b009ae80e.SMD status=1 06:06 11:13 SMTP-(0FA8) processing d:\IMail\spool\Qaf7e007a0120e7fe.SMD 06:06 11:13 SMTP-(0FA8) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 1888 06:06 11:13 SMTP-(0FA8) finished d:\IMail\spool\Qaf7e007a0120e7fe.SMD status=1 06:06 11:13 SMTPD(00290138) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(00290138) [209.26.230.188] RCPT TO:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(00290138) [209.26.230.188] d:\IMail\spool\Daf8400290138fb96.SMD 9563 06:06 11:13 SMTP-(0ED0) processing d:\IMail\spool\Qaf8400290138fb96.SMD 06:06 11:13 SMTP-(0ED0) ldeliver teksolvers.com blacklist-main (1) [EMAIL PROTECTED] 9676 06:06 11:13 SMTP-(0ED0) finished d:\IMail\spool\Qaf8400290138fb96.SMD status=1 Any ideas? The entire email header was sent over and there was no X-Declude-Sender. Also, What is the difference within the blacklist.txt file contain entries that begin with a period (.junkmail.com), @ (@junkmail.com), or just blank (junkmail.com) Maybe there is something wrong with my file. Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, June 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Blacklist False Positive Tests >Any ideas why would the following email headed be caught by my blacklist file? > >GLOBAL file: > >BLACKLIST fromfile d:\imail\Declude\blacklist.txt >x 8 0 This is a sender blacklist, which checks the return address of the E-mail. However, the headers that you supplied do not include the return address of the E-mail -- you can find it either in an X-Declude-Sender: header, or the IMail SMTP log file (in the MAIL FROM line). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist False Positive Tests
SMTP Imail log: 06:06 11:13 SMTPD(007A0120) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(008B009A) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(0051014C) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> 06:06 11:13 SMTPD(00290138) [209.26.230.188] MAIL FROM:<[EMAIL PROTECTED]> Unfortunately, I can't tell you which of these four E-mails is the one you posted. I would recommend using the "XSENDER ON" and "XSPOOLNAME ON" options in the global.cfg file, which makes it much easier to get the information you need. Any ideas? You could send me your blacklist.txt file? Also, What is the difference within the blacklist.txt file contain entries that begin with a period (.junkmail.com), @ (@junkmail.com), or just blank (junkmail.com) They all work the same -- Declude JunkMail checks to see if the sender has whatever you list in their return address. So "@example.com" which catch any E-mail from @example.com, ".example.com" would catch any E-mail from @*.example.com, and "example.com" would catch both @example.com and @*.example.com as well as @not_an_example.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist False Positive Tests
Any ideas why would the following email headed be caught by my blacklist file? GLOBAL file: BLACKLIST fromfile d:\imail\Declude\blacklist.txt x 8 0 This is a sender blacklist, which checks the return address of the E-mail. However, the headers that you supplied do not include the return address of the E-mail -- you can find it either in an X-Declude-Sender: header, or the IMail SMTP log file (in the MAIL FROM line). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
