Re: [Declude.JunkMail] Global.cfg lines for SPF
I don't give any weight to a SPF pass since many spammers have set up their own SPF records and will pass. - Original Message - From: "Kim Premuda" <[EMAIL PROTECTED]> To: Sent: Wednesday, November 23, 2005 12:12 AM Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF This is what we have in our 'global.cfg' file: SPFFAIL spffail x x 3 0 Is this old syntax? A remnant of version 1.86? We are currently running JunkMail 3.0.5.20. Also, why are the weights all zero? Shouldn't a fail add weight, and a pass subtract weight? Or, am I misunderstanding the 'spf' test? Thanks! Kim -- Original Message -- From: "David Barker" <[EMAIL PROTECTED]> Reply-To: Declude.JunkMail@declude.com Date: Mon, 21 Nov 2005 16:26:13 -0500 This is the correct syntax. SPFFAIL spf fail x 0 0 SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan Sent: Monday, November 21, 2005 4:00 PM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF I use: SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 SPFFAIL spf fail x 50 0 > Set 1: > SPFFAIL spf fail x 9 0 > SPFPASS spf pass x 0 0 > Thanks for the quick responses. I did have the correct pair of lines in my global.cfg file but I have received messages over the weekend which Imail's SPF check marked as SPFFAIL but Declude did not. The messages were what F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own domain. Since I have an SPF record, they should have failed the Declude check but they did not. As a result the first few that arrived before F-Prot updated their databases and were delivered to my users. I'm aware of at least one user who attempted to open the zip file. Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20? Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Global.cfg lines for SPF
This is what we have in our 'global.cfg' file: SPFFAIL spffail x x 3 0 Is this old syntax? A remnant of version 1.86? We are currently running JunkMail 3.0.5.20. Also, why are the weights all zero? Shouldn't a fail add weight, and a pass subtract weight? Or, am I misunderstanding the 'spf' test? Thanks! Kim -- Original Message -- From: "David Barker" <[EMAIL PROTECTED]> Reply-To: Declude.JunkMail@declude.com Date: Mon, 21 Nov 2005 16:26:13 -0500 >This is the correct syntax. > >SPFFAILspf failx 0 0 >SPFPASSspf passx 0 0 >SPFUNKNOWN spf unknown x 0 0 > >David B >www.declude.com > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan >Sent: Monday, November 21, 2005 4:00 PM >To: Declude.JunkMail@declude.com >Cc: [EMAIL PROTECTED] >Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF > >> >> I use: >> SPFPASS spf pass x 0 0 >> SPFUNKNOWN spf unknown x 0 0 >> SPFFAIL spf fail x 50 0 >> >> > Set 1: >> > SPFFAIL spf fail x 9 0 >> > SPFPASS spf pass x 0 0 >> > > >Thanks for the quick responses. I did have the correct pair of lines in my >global.cfg file but I have received messages over the weekend which Imail's >SPF check marked as SPFFAIL but Declude did not. The messages were what >F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own >domain. >Since I have an SPF record, they should have failed the Declude check but >they did not. As a result the first few that arrived before F-Prot updated >their databases and were delivered to my users. I'm aware of at least one >user who attempted to open the zip file. > >Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20? > >Brad Morgan >IT Manager >Horizon Interactive Inc. > > >--- >This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, >just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe >Declude.JunkMail". The archives can be found at >http://www.mail-archive.com. > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. >--- >[This E-mail scanned for viruses by Declude Virus] > > -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Global.cfg lines for SPF
Thanks, I must have forgotten that. I can not figure out what unknown
would be used for except to support more of the SPf
standard.
Kevin
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On Behalf Of Dean
LawrenceSent: Monday, November 21, 2005 4:15 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail]
Global.cfg lines for SPF
Kevin,
The SPFFAIL test states in the manual.
"This test will be triggered if an E-mail fails SPFNote that it will
not be triggered for E-mail that has other problems (no SPF record, unknown
results from the SPF record, etc.). So any E-mail failing the SPFFAIL
test is E-mail that is not authorized per the administrator of the domain the
E-mail is being sent from."
So if you do neither SPFFAIL or SPFPASS are triggered, you have
essentially received an SPFUNKNOWN response.
Dean
On 11/21/05, Kevin
Bilbee <[EMAIL PROTECTED]>
wrote:
As
far as I know declude only supports SPFFAIL and SPFPASS.Please
direct me to the release notes/documentation if I am wrong.
Kevin Bilbee> -Original Message->
From: [EMAIL PROTECTED]>
[mailto:
[EMAIL PROTECTED]]On Behalf Of David Barker>
Sent: Monday, November 21, 2005 1:26 PM> To: Declude.JunkMail@declude.com>
Subject: RE: [ Declude.JunkMail] Global.cfg lines for
SPF>>> This is the correct syntax.>>
SPFFAIL
spf
failx
0 0>
SPFPASS
spf
passx
0 0 >
SPFUNKNOWNspf
unknown x
0 0>> David B> www.declude.com>>
-Original Message-> From: [EMAIL PROTECTED]>
[mailto:[EMAIL PROTECTED]]
On Behalf Of Brad Morgan> Sent: Monday, November 21, 2005 4:00
PM> To: Declude.JunkMail@declude.com>
Cc: [EMAIL PROTECTED]>
Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF >>
>> > I use:> > SPFPASS
spf pass x 0 0> >
SPFUNKNOWN spf unknown x 0
0> > SPFFAIL
spf fail x 50 0> >> >
> Set 1:> > > SPFFAIL spf fail x 9 0 > > >
SPFPASS spf pass x 0 0> > >>> Thanks for the
quick responses. I did have the correct pair of lines in my>
global.cfg file but I have received messages over the weekend> which
Imail's> SPF check marked as SPFFAIL but Declude did not. The
messages were what> F-Prot is now calling W32/[EMAIL PROTECTED] and appear
to be from my own domain.> Since I have an SPF record, they should
have failed the Declude check but > they did not. As a result the
first few that arrived before F-Prot updated> their databases and
were delivered to my users. I'm aware of at least one> user who
attempted to open the zip file.> > Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20?>> Brad Morgan> IT
Manager> Horizon Interactive Inc.>>> ---
> This E-mail came from the Declude.JunkMail mailing
list. To unsubscribe,> just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe> Declude.JunkMail ". The archives can be
found at> http://www.mail-archive.com.>>
---> This E-mail came from the Declude.JunkMail mailing
list. To> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and>
type "unsubscribe Declude.JunkMail". The archives can be
found> at http://www.mail-archive.com .>
---> [This E-mail scanned for viruses by Declude
Virus]>>>---[This E-mail scanned for
viruses by Declude Virus]---This E-mail came from the
Declude.JunkMail mailing list. Tounsubscribe, just send an
E-mail to [EMAIL PROTECTED],
andtype "unsubscribe Declude.JunkMail". The archives can be
foundat http://www.mail-archive.com.-- __Dean
Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 *
fax: 888.438.4381 http://www.idatatech.com/Corporate
Internet Development and Marketing Specialists
Re: [Declude.JunkMail] Global.cfg lines for SPF
Unknown will work as well as I recall.. -Nick Kevin Bilbee wrote: As far as I know declude only supports SPFFAIL and SPFPASS. Please direct me to the release notes/documentation if I am wrong. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of David Barker Sent: Monday, November 21, 2005 1:26 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF This is the correct syntax. SPFFAIL spf fail x 0 0 SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Brad Morgan Sent: Monday, November 21, 2005 4:00 PM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF I use: SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 SPFFAIL spf fail x 50 0 Set 1: SPFFAIL spf fail x 9 0 SPFPASS spf pass x 0 0 Thanks for the quick responses. I did have the correct pair of lines in my global.cfg file but I have received messages over the weekend which Imail's SPF check marked as SPFFAIL but Declude did not. The messages were what F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own domain. Since I have an SPF record, they should have failed the Declude check but they did not. As a result the first few that arrived before F-Prot updated their databases and were delivered to my users. I'm aware of at least one user who attempted to open the zip file. Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20? Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Global.cfg lines for SPF
Kevin, The SPFFAIL test states in the manual. "This test will be triggered if an E-mail fails SPFNote that it will not be triggered for E-mail that has other problems (no SPF record, unknown results from the SPF record, etc.). So any E-mail failing the SPFFAIL test is E-mail that is not authorized per the administrator of the domain the E-mail is being sent from." So if you do neither SPFFAIL or SPFPASS are triggered, you have essentially received an SPFUNKNOWN response. Dean On 11/21/05, Kevin Bilbee <[EMAIL PROTECTED]> wrote: As far as I know declude only supports SPFFAIL and SPFPASS.Please direct me to the release notes/documentation if I am wrong. Kevin Bilbee> -Original Message-> From: [EMAIL PROTECTED]> [mailto: [EMAIL PROTECTED]]On Behalf Of David Barker> Sent: Monday, November 21, 2005 1:26 PM> To: Declude.JunkMail@declude.com> Subject: RE: [ Declude.JunkMail] Global.cfg lines for SPF>>> This is the correct syntax.>> SPFFAIL spf failx 0 0> SPFPASS spf passx 0 0 > SPFUNKNOWNspf unknown x 0 0>> David B> www.declude.com>> -Original Message-> From: [EMAIL PROTECTED]> [mailto:[EMAIL PROTECTED]] On Behalf Of Brad Morgan> Sent: Monday, November 21, 2005 4:00 PM > To: Declude.JunkMail@declude.com> Cc: [EMAIL PROTECTED]> Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF >> >> > I use:> > SPFPASS spf pass x 0 0> > SPFUNKNOWN spf unknown x 0 0> > SPFFAIL spf fail x 50 0> >> > > Set 1:> > > SPFFAIL spf fail x 9 0 > > > SPFPASS spf pass x 0 0> > >>> Thanks for the quick responses. I did have the correct pair of lines in my> global.cfg file but I have received messages over the weekend > which Imail's> SPF check marked as SPFFAIL but Declude did not. The messages were what> F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own domain.> Since I have an SPF record, they should have failed the Declude check but > they did not. As a result the first few that arrived before F-Prot updated> their databases and were delivered to my users. I'm aware of at least one> user who attempted to open the zip file.> > Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20?>> Brad Morgan> IT Manager> Horizon Interactive Inc.>>> --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe> Declude.JunkMail ". The archives can be found at> http://www.mail-archive.com.>> ---> This E-mail came from the Declude.JunkMail mailing list. To> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and> type "unsubscribe Declude.JunkMail". The archives can be found> at http://www.mail-archive.com .> ---> [This E-mail scanned for viruses by Declude Virus]>>>---[This E-mail scanned for viruses by Declude Virus]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/Corporate Internet Development and Marketing Specialists
RE: [Declude.JunkMail] Global.cfg lines for SPF
As far as I know declude only supports SPFFAIL and SPFPASS. Please direct me to the release notes/documentation if I am wrong. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of David Barker > Sent: Monday, November 21, 2005 1:26 PM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF > > > This is the correct syntax. > > SPFFAIL spf failx 0 0 > SPFPASS spf passx 0 0 > SPFUNKNOWNspf unknown x 0 0 > > David B > www.declude.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan > Sent: Monday, November 21, 2005 4:00 PM > To: Declude.JunkMail@declude.com > Cc: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF > > > > > I use: > > SPFPASS spf pass x 0 0 > > SPFUNKNOWN spf unknown x 0 0 > > SPFFAIL spf fail x 50 0 > > > > > Set 1: > > > SPFFAIL spf fail x 9 0 > > > SPFPASS spf pass x 0 0 > > > > > Thanks for the quick responses. I did have the correct pair of lines in my > global.cfg file but I have received messages over the weekend > which Imail's > SPF check marked as SPFFAIL but Declude did not. The messages were what > F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own > domain. > Since I have an SPF record, they should have failed the Declude check but > they did not. As a result the first few that arrived before F-Prot updated > their databases and were delivered to my users. I'm aware of at least one > user who attempted to open the zip file. > > Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20? > > Brad Morgan > IT Manager > Horizon Interactive Inc. > > > --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Global.cfg lines for SPF
This is the correct syntax. SPFFAIL spf failx 0 0 SPFPASS spf passx 0 0 SPFUNKNOWN spf unknown x 0 0 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan Sent: Monday, November 21, 2005 4:00 PM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Global.cfg lines for SPF > > I use: > SPFPASS spf pass x 0 0 > SPFUNKNOWN spf unknown x 0 0 > SPFFAIL spf fail x 50 0 > > > Set 1: > > SPFFAIL spf fail x 9 0 > > SPFPASS spf pass x 0 0 > > Thanks for the quick responses. I did have the correct pair of lines in my global.cfg file but I have received messages over the weekend which Imail's SPF check marked as SPFFAIL but Declude did not. The messages were what F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own domain. Since I have an SPF record, they should have failed the Declude check but they did not. As a result the first few that arrived before F-Prot updated their databases and were delivered to my users. I'm aware of at least one user who attempted to open the zip file. Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20? Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Global.cfg lines for SPF
> > I use: > SPFPASS spf pass x 0 0 > SPFUNKNOWN spf unknown x 0 0 > SPFFAIL spf fail x 50 0 > > > Set 1: > > SPFFAIL spf fail x 9 0 > > SPFPASS spf pass x 0 0 > > Thanks for the quick responses. I did have the correct pair of lines in my global.cfg file but I have received messages over the weekend which Imail's SPF check marked as SPFFAIL but Declude did not. The messages were what F-Prot is now calling W32/[EMAIL PROTECTED] and appear to be from my own domain. Since I have an SPF record, they should have failed the Declude check but they did not. As a result the first few that arrived before F-Prot updated their databases and were delivered to my users. I'm aware of at least one user who attempted to open the zip file. Is this a bug in 2.0.6.16? Is it fixed in 3.0.5.20? Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Global.cfg lines for SPF
Hi Brad, Brad Morgan wrote: I am currently running Declude v2.0.6.16. Which of the following pairs of lines should be in global.cfg? Set 1: SPFFAIL spf failx 9 0 SPFPASS spf passx 0 0 The one above. Set 2: SPFFAIL spffail x x 9 0 SPFPASS spfpass x x 0 0 What would the answer be for 3.0.5.20? dunno! -Nick Regards, Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Global.cfg lines for SPF
I use: SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 SPFFAIL spf fail x 50 0 - Original Message - From: "Brad Morgan" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: Sent: Monday, November 21, 2005 2:05 PM Subject: [Declude.JunkMail] Global.cfg lines for SPF I am currently running Declude v2.0.6.16. Which of the following pairs of lines should be in global.cfg? Set 1: SPFFAIL spf fail x 9 0 SPFPASS spf pass x 0 0 Set 2: SPFFAIL spffail x x 9 0 SPFPASS spfpass x x 0 0 What would the answer be for 3.0.5.20? Regards, Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
