RE: [Declude.JunkMail] Unable to get filter to work
You might try adding a value to the myfilter.txt MYFILTER filter c:\imail\declude\myfilter.txt x 5 0 It might think that the value of zero is telling it to bypass myfilter.txt Jim Rooth KLOTRON,INC. Office: 817.654.3018.103 Home: 972.606.6341 Mobile: 214.244.0979 [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Lewis-Waller Sent: Thursday, November 28, 2002 07:42 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Unable to get filter to work Any help appreciated... I have in my global.cfg file the line MYFILTER filter c:\imail\declude\myfilter.txt x 0 0 myfilter.txt has the following lines MAILFROM -10 CONTAINS @talk21.com MAILFROM -10 CONTAINS @passport.com MAILFROM -10 CONTAINS @economist.com MAILFROM -10 CONTAINS .ft.com MAILFROM -10 CONTAINS .bbc.co.uk I hold email on a weight of 30. I have a test account with talk21.com which normally fails a number of tests resulting in a total weight of 33. I would have expected the weight to drop to 23 because of myfilter.txt but it doesn't. I tried silly numbers as well e.g. -60 but still end up with a total weight o 33. I'm obviously missing something fundamental. Sent email headers: Received: from wmpmta04-app.mail-store.com [194.73.242.6] by mail.nthost.co.uk with ESMTP (SMTPD32-7.13) id ACAC128E00CC; Thu, 28 Nov 2002 13:39:56 + Received: from wmpmtavirtual ([10.216.84.18]) by wmpmta04-app.mail-store.com with SMTP id 20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual for [EMAIL PROTECTED]; Thu, 28 Nov 2002 13:39:55 + Received: from 62.189.235.109 by t21web08-lrs ([10.216.84.18]); Thu, 28 Nov 02 13:30:20 GMT+00:00 X-Mailer: talk21 v1.26 - http://talk21.btopenworld.com From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Talk21Ref: none Date: Thu, 28 Nov 2002 13:30:20 GMT+00:00 Subject: SPAM: (No Subject) Message-Id: 20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [804f]. X-RBL-Warning: REVDNS: This E-mail was sent from a mail server 194.73.242.6 with no reverse DNS entry. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 4. X-RBL-Warning: WEIGHT10: Weight of 33 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [194.73.242.6] X-Note: This E-mail was scanned by Declude JunkMail for evidence of spam. X-Note: This E-mail was sent from [No Reverse DNS] ([194.73.242.6]). Thanks in advance. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Patnode Sent: 28 November 2002 08:57 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] BASE64 usage I have John. While Base64 is a great test, a number of newsletters and normal emails have come across using it. I have weakened my system to let these types of messages through and pull my hair out every time a spam gets through because of it. Dan On Wednesday, November 27, 2002 8:02, John Tolmachoff [EMAIL PROTECTED] wrote: Even thought it has been determined that there is no legit REASON to use BASE64 encoding in the body, I am finding and increasing use of it. Most of these are junk, but it has caught a number of legit messages. Therefore, I have downgraded BASE64 from 15 to 12. Any one experiencing similar? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Unable to get filter to work
David, You'll also have to put a line in your $default$.junkmail (and GLOBAL.CFG for outgoing) if you want to see the test result in the headers. George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Lewis-Waller Sent: Thursday, November 28, 2002 8:42 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Unable to get filter to work Any help appreciated... I have in my global.cfg file the line MYFILTER filter c:\imail\declude\myfilter.txt x 0 0 myfilter.txt has the following lines MAILFROM -10 CONTAINS @talk21.com MAILFROM -10 CONTAINS @passport.com MAILFROM -10 CONTAINS @economist.com MAILFROM -10 CONTAINS .ft.com MAILFROM -10 CONTAINS .bbc.co.uk I hold email on a weight of 30. I have a test account with talk21.com which normally fails a number of tests resulting in a total weight of 33. I would have expected the weight to drop to 23 because of myfilter.txt but it doesn't. I tried silly numbers as well e.g. -60 but still end up with a total weight o 33. I'm obviously missing something fundamental. Sent email headers: Received: from wmpmta04-app.mail-store.com [194.73.242.6] by mail.nthost.co.uk with ESMTP (SMTPD32-7.13) id ACAC128E00CC; Thu, 28 Nov 2002 13:39:56 + Received: from wmpmtavirtual ([10.216.84.18]) by wmpmta04-app.mail-store.com with SMTP id 20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual for [EMAIL PROTECTED]; Thu, 28 Nov 2002 13:39:55 + Received: from 62.189.235.109 by t21web08-lrs ([10.216.84.18]); Thu, 28 Nov 02 13:30:20 GMT+00:00 X-Mailer: talk21 v1.26 - http://talk21.btopenworld.com From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Talk21Ref: none Date: Thu, 28 Nov 2002 13:30:20 GMT+00:00 Subject: SPAM: (No Subject) Message-Id: 20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [804f]. X-RBL-Warning: REVDNS: This E-mail was sent from a mail server 194.73.242.6 with no reverse DNS entry. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 4. X-RBL-Warning: WEIGHT10: Weight of 33 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [194.73.242.6] X-Note: This E-mail was scanned by Declude JunkMail for evidence of spam. X-Note: This E-mail was sent from [No Reverse DNS] ([194.73.242.6]). Thanks in advance. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Patnode Sent: 28 November 2002 08:57 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] BASE64 usage I have John. While Base64 is a great test, a number of newsletters and normal emails have come across using it. I have weakened my system to let these types of messages through and pull my hair out every time a spam gets through because of it. Dan On Wednesday, November 27, 2002 8:02, John Tolmachoff [EMAIL PROTECTED] wrote: Even thought it has been determined that there is no legit REASON to use BASE64 encoding in the body, I am finding and increasing use of it. Most of these are junk, but it has caught a number of legit messages. Therefore, I have downgraded BASE64 from 15 to 12. Any one experiencing similar? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Unable to get filter to work
David, It would have been nice if I mentioned that the line to be added is: MYFILTERWARN George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Lewis-Waller Sent: Thursday, November 28, 2002 8:42 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Unable to get filter to work Any help appreciated... I have in my global.cfg file the line MYFILTER filter c:\imail\declude\myfilter.txt x 0 0 myfilter.txt has the following lines MAILFROM -10 CONTAINS @talk21.com MAILFROM -10 CONTAINS @passport.com MAILFROM -10 CONTAINS @economist.com MAILFROM -10 CONTAINS .ft.com MAILFROM -10 CONTAINS .bbc.co.uk I hold email on a weight of 30. I have a test account with talk21.com which normally fails a number of tests resulting in a total weight of 33. I would have expected the weight to drop to 23 because of myfilter.txt but it doesn't. I tried silly numbers as well e.g. -60 but still end up with a total weight o 33. I'm obviously missing something fundamental. Sent email headers: Received: from wmpmta04-app.mail-store.com [194.73.242.6] by mail.nthost.co.uk with ESMTP (SMTPD32-7.13) id ACAC128E00CC; Thu, 28 Nov 2002 13:39:56 + Received: from wmpmtavirtual ([10.216.84.18]) by wmpmta04-app.mail-store.com with SMTP id 20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual for [EMAIL PROTECTED]; Thu, 28 Nov 2002 13:39:55 + Received: from 62.189.235.109 by t21web08-lrs ([10.216.84.18]); Thu, 28 Nov 02 13:30:20 GMT+00:00 X-Mailer: talk21 v1.26 - http://talk21.btopenworld.com From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Talk21Ref: none Date: Thu, 28 Nov 2002 13:30:20 GMT+00:00 Subject: SPAM: (No Subject) Message-Id: 20021128133955.RBKO6682.wmpmta04-app.mail-store.com@wmpmtavirtual X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [804f]. X-RBL-Warning: REVDNS: This E-mail was sent from a mail server 194.73.242.6 with no reverse DNS entry. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 4. X-RBL-Warning: WEIGHT10: Weight of 33 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [194.73.242.6] X-Note: This E-mail was scanned by Declude JunkMail for evidence of spam. X-Note: This E-mail was sent from [No Reverse DNS] ([194.73.242.6]). Thanks in advance. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Patnode Sent: 28 November 2002 08:57 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] BASE64 usage I have John. While Base64 is a great test, a number of newsletters and normal emails have come across using it. I have weakened my system to let these types of messages through and pull my hair out every time a spam gets through because of it. Dan On Wednesday, November 27, 2002 8:02, John Tolmachoff [EMAIL PROTECTED] wrote: Even thought it has been determined that there is no legit REASON to use BASE64 encoding in the body, I am finding and increasing use of it. Most of these are junk, but it has caught a number of legit messages. Therefore, I have downgraded BASE64 from 15 to 12. Any one experiencing similar? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Unable to get filter to work
I have added MYFILTER WARN to $default$.junkmail.txt and removed the double quotes around the text file leaving MYFILTERfilter c:\imail\declude\myfilter.txt x 0 0 In global.cfg I'm sent a few more test emails and the MYFILTER test isn't appearing in the headers I am quite puzzled. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: 28 November 2002 13:52 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Unable to get filter to work I have in my global.cfg file the line MYFILTER filter c:\imail\declude\myfilter.txt x 0 0 You'll need to remove the quotes. If you do that, the filter should work. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unable to get filter to work
David, Thursday, November 28, 2002 you wrote: I have added MYFILTER WARN to $default$.junkmail.txt and removed the double quotes around the text file leaving MYFILTERfilter c:\imail\declude\myfilter.txt x 0 0 The format appears to be correct. I'm sent a few more test emails and the MYFILTER test isn't appearing in the headers I am quite puzzled. 1) filters are available for PRO version of DECLUDE only - so that might be the problem 2) check to see if the filter is being loaded - look in the declude log files - if it is not being loaded you'll see something like Could not load filter file c:\imail\declude\notthere.txt 3) It the filter is being loaded then there could be something wrong with the filter rules - you may have to turn on DEBUG logging to see that - common errors include misspelling and spaces 4) Or the filter rule may not be working on your test message as you expect - so you'd need to check that - Hth - Terry Fritts Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
