Re: [Declude.JunkMail] Negative Weight an IP
Todd, Set the PTR for the IP assigned to your IIS SMTP --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 http://globalweb.net - Original Message - From: "Todd Richards" <[EMAIL PROTECTED]> To: Sent: Thursday, October 23, 2008 7:09 PM Subject: RE: [Declude.JunkMail] Negative Weight an IP Actually, it doesn't send just to the mail server. But I'm guessing that would be the best thing to do. I can easily get a REVDNS through my ISP. However, I'm not sure what I would get it as. Obviously my mail server was easy (mail.domain.com). However, with a web server that hosts many sites, do I have to have a REVDNS for each domain name? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman [Mobile] Sent: Thursday, October 23, 2008 5:15 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Negative Weight an IP While any server doing direct delivery to remote MXs must have a PTR, I got the impression that Todd's box sends to the Declude box only, making the PTR somewhat more optional (until, of course, your anti-spam gateway looks for a PTR...). --Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight an IP
Actually, it doesn't send just to the mail server. But I'm guessing that would be the best thing to do. I can easily get a REVDNS through my ISP. However, I'm not sure what I would get it as. Obviously my mail server was easy (mail.domain.com). However, with a web server that hosts many sites, do I have to have a REVDNS for each domain name? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman [Mobile] Sent: Thursday, October 23, 2008 5:15 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Negative Weight an IP While any server doing direct delivery to remote MXs must have a PTR, I got the impression that Todd's box sends to the Declude box only, making the PTR somewhat more optional (until, of course, your anti-spam gateway looks for a PTR...). --Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight an IP
While any server doing direct delivery to remote MXs must have a PTR, I got the impression that Todd's box sends to the Declude box only, making the PTR somewhat more optional (until, of course, your anti-spam gateway looks for a PTR...). --Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight an IP
Any server sending mail should have REVDNS. Darin. - Original Message - From: "Todd Richards" <[EMAIL PROTECTED]> To: Sent: Thursday, October 23, 2008 3:30 PM Subject: RE: [Declude.JunkMail] Negative Weight an IP Sandy, I guess that was a question that was on my mind. We've never had anything set up for the web server before - only the REVDNS for the mail server itself. Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Thursday, October 23, 2008 1:23 PM To: Todd Richards Subject: Re: [Declude.JunkMail] Negative Weight an IP > Thanks for your suggestions! Um, fix the PTR? --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight an IP
Sandy, I guess that was a question that was on my mind. We've never had anything set up for the web server before - only the REVDNS for the mail server itself. Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Thursday, October 23, 2008 1:23 PM To: Todd Richards Subject: Re: [Declude.JunkMail] Negative Weight an IP > Thanks for your suggestions! Um, fix the PTR? --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight an IP
You can either fix your DNS so the web server doesn't fail the REVDNS check, or add WHITELIST IP without the <> to your Declude config, or both. Darin. - Original Message - From: "Todd Richards" <[EMAIL PROTECTED]> To: Sent: Thursday, October 23, 2008 1:49 PM Subject: [Declude.JunkMail] Negative Weight an IP Hello - After our move, email from our web server forms (sent via IIS SMTP) and server alerts is being caught. One of the things that it is failing on is the REVDNS. My thought was to counter the REVDNS with a negative weight on the IP address, but I'm not sure of the syntax to add to my "allow" filter. I would probably prefer not to whitelist the server, as bogus emails that come through tend to get caught. Thanks for your suggestions! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight an IP
> Thanks for your suggestions! Um, fix the PTR? --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative weight isn't working
Andrew - I learn a lot from people on this list, and you are no exception. I looked to see why the email failed the FILTER-SPAM test, and it was because of "ad.doubleclick.net". I think that is common for some of the more well-known "news" newsletters that I've seen failing. What I could do is give less points for that particular penalty (it's at 15 now and this newsletter missed passing altogether by just 3 points), and then re-visit some of the others that are coming in. I'm still getting a handful of messages that are making it through, and you'd think they would be obvious. Like you said, it's a sort of science and I, for one, apprecaite the time that goes into making this work. This particular negative-weight test probably has way too high, so I think I will adjust those too. I think as I gain a better understanding of what I'm looing for, and how everything works, I will undoubtedly have to tweak things. Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Thursday, November 09, 2006 3:32 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working No problem, Todd. To answer your question in the other thread, yes, more specific is more better. On the other hand, you also have to look at what you're really trying to counterweight. In this case, you could certainly counterweight both the REVDNS of their mailserver, and the particular MAILFROM email address too, but after visiting the site, I suspect that you really don't care about the MAILFROM. You can use the REVDNS -30 ENDSWITH .ibsys.com Just fine. If you do use a MAILFROM, don't use much weight, because viruses harvest all email addresses from the infectee and report them back to the virus writer or spammer, and that address becomes a spoofed MAILFROM later down the road. Viruses also spoof the HELO, so a: HELO -30 ENDSWITH comcast.com Or REVDNS -30 ENDSWITH .comcast.com Would be a bad thing to put in your counterweight file, because a virus is quite likely to come from a zombie on that network. What I'd suggest you do for ibsys.com is look at your FILTER-SPAM test and see why it gave 15 points to this email. You will likely get better mileage (i.e. spend less of your time on your counterweight file making exceptions for MTAs) by assigning only incremental points to text values in your filter files, don't look for the "big win" by blocking small text phrases or small bits of text in a URL. To go the extra mile (hey, a driving theme today [pun intended]) why not decide which IP4R tests you trust, and/or which external tests you trust, and cancel the dangerously punitive text files? At the top of your FILTER-SPAM test, you *could* put in: TESTSFAILED END CONTAINS MXRATE-ALLOW And then messages like this sample wouldn't have received any points from the FILTER-SPAM test, you would save CPU time on your server, save your user's time in figuring out that they didn't receive that inbound message, and save your time on finding the false positives and making counterweight entries. The downside of making a "cancel line" in your filter files is that MXRATE-ALLOW will trigger on, say, a well known ISPs' MTA, and you *want* to do content filtering on, say, scam text that is so common from HotMail, Yahoo!, and various international free webmail providers that you wouldn't otherwise hear about. Most Declude users end up with filter files that are focused on kinds of spam and tweak their "cancel lines" accordingly. There is a great deal of art to this science. Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Todd Richards > Sent: Thursday, November 09, 2006 12:42 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > Thanks Andrew. I'm starting to catch on. The good news is that > everyone "else" thinks I'm a miracle worker because of the drastic > decrease in spam. > One of these days I'll break down and tell them the truth. > So if you all happen to start getting "Thank You" cards from people > you don't know, that's probably why... > > Todd > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Colbeck, Andrew > Sent: Thursday, November 09, 2006 2:23 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > Todd, do this from a command line: > > C:\Temp>nslookup 66.187.204.25 > Server: Andrew's.obfuscated.dns.server > Address: 192.168.0.1 > > Name:treets100.ibsys.com > Address: 66.187.204.25 > > C:\Tem
RE: [Declude.JunkMail] Negative weight isn't working
No problem, Todd. To answer your question in the other thread, yes, more specific is more better. On the other hand, you also have to look at what you're really trying to counterweight. In this case, you could certainly counterweight both the REVDNS of their mailserver, and the particular MAILFROM email address too, but after visiting the site, I suspect that you really don't care about the MAILFROM. You can use the REVDNS -30 ENDSWITH .ibsys.com Just fine. If you do use a MAILFROM, don't use much weight, because viruses harvest all email addresses from the infectee and report them back to the virus writer or spammer, and that address becomes a spoofed MAILFROM later down the road. Viruses also spoof the HELO, so a: HELO -30 ENDSWITH comcast.com Or REVDNS -30 ENDSWITH .comcast.com Would be a bad thing to put in your counterweight file, because a virus is quite likely to come from a zombie on that network. What I'd suggest you do for ibsys.com is look at your FILTER-SPAM test and see why it gave 15 points to this email. You will likely get better mileage (i.e. spend less of your time on your counterweight file making exceptions for MTAs) by assigning only incremental points to text values in your filter files, don't look for the "big win" by blocking small text phrases or small bits of text in a URL. To go the extra mile (hey, a driving theme today [pun intended]) why not decide which IP4R tests you trust, and/or which external tests you trust, and cancel the dangerously punitive text files? At the top of your FILTER-SPAM test, you *could* put in: TESTSFAILED END CONTAINS MXRATE-ALLOW And then messages like this sample wouldn't have received any points from the FILTER-SPAM test, you would save CPU time on your server, save your user's time in figuring out that they didn't receive that inbound message, and save your time on finding the false positives and making counterweight entries. The downside of making a "cancel line" in your filter files is that MXRATE-ALLOW will trigger on, say, a well known ISPs' MTA, and you *want* to do content filtering on, say, scam text that is so common from HotMail, Yahoo!, and various international free webmail providers that you wouldn't otherwise hear about. Most Declude users end up with filter files that are focused on kinds of spam and tweak their "cancel lines" accordingly. There is a great deal of art to this science. Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Todd Richards > Sent: Thursday, November 09, 2006 12:42 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > Thanks Andrew. I'm starting to catch on. The good news is > that everyone "else" thinks I'm a miracle worker because of > the drastic decrease in spam. > One of these days I'll break down and tell them the truth. > So if you all happen to start getting "Thank You" cards from > people you don't know, that's probably why... > > Todd > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Colbeck, Andrew > Sent: Thursday, November 09, 2006 2:23 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > Todd, do this from a command line: > > C:\Temp>nslookup 66.187.204.25 > Server: Andrew's.obfuscated.dns.server > Address: 192.168.0.1 > > Name:treets100.ibsys.com > Address: 66.187.204.25 > > C:\Temp> > > That tells me that your REVDNS won't match, because their > reverse DNS is > *not* the same as the HELO value that you used for your REVDNS test. > > The same is also true for your use of the MAILFROM, which > does not have to match the From: address you see in the > header. Look at the > X-Declude-Sender: line in the header that has been marked up. > The MAILFROM was really "[EMAIL PROTECTED]". > > Andrew 8) > > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Todd Richards > > Sent: Thursday, November 09, 2006 11:44 AM > > To: declude.junkmail@declude.com > > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > > > OK, here is an update with the header of the particular message. > > > > Todd > > > > > > Received: from treetso101.mtc.ibsys.com [66.187.204.25] by > > mail.nnepa.com with ESMTP > > (SMTPD-8.22) id ACCC0340; Thu, 09 Nov 2006 12:00:44 -0600 > > Date: Thu, 9 Nov 2006 12:02:02 -0600 (CST) > > From: "KETV.com Newsroom" <[EMAIL PR
RE: [Declude.JunkMail] Negative weight isn't working
Thanks Andrew. I'm starting to catch on. The good news is that everyone "else" thinks I'm a miracle worker because of the drastic decrease in spam. One of these days I'll break down and tell them the truth. So if you all happen to start getting "Thank You" cards from people you don't know, that's probably why... Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Thursday, November 09, 2006 2:23 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, do this from a command line: C:\Temp>nslookup 66.187.204.25 Server: Andrew's.obfuscated.dns.server Address: 192.168.0.1 Name:treets100.ibsys.com Address: 66.187.204.25 C:\Temp> That tells me that your REVDNS won't match, because their reverse DNS is *not* the same as the HELO value that you used for your REVDNS test. The same is also true for your use of the MAILFROM, which does not have to match the From: address you see in the header. Look at the X-Declude-Sender: line in the header that has been marked up. The MAILFROM was really "[EMAIL PROTECTED]". Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Todd Richards > Sent: Thursday, November 09, 2006 11:44 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > OK, here is an update with the header of the particular message. > > Todd > > > Received: from treetso101.mtc.ibsys.com [66.187.204.25] by > mail.nnepa.com with ESMTP > (SMTPD-8.22) id ACCC0340; Thu, 09 Nov 2006 12:00:44 -0600 > Date: Thu, 9 Nov 2006 12:02:02 -0600 (CST) > From: "KETV.com Newsroom" <[EMAIL PROTECTED]> > Reply-to: [EMAIL PROTECTED] > Message-Id: <[EMAIL PROTECTED]> > X-unsub: ?unsub.cfm?u=2656017216813-oma_12pm-oma_12pm_1_12000311092006 > Subject: [21] KETV.com Noon Headlines > To: <[EMAIL PROTECTED]> > Content-type: text/html; charset=us-ascii > X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" > X-RBL-Warning: HELOBOGUS: Domain treetso101.mtc.ibsys.com has no MX or > A records [0301]. > X-RBL-Warning: FILTER-SPAM: Message failed FILTER-SPAM test (line 55, > weight > 15) > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 76, > weight 4) > X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of > 10. > X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] > X-Declude-Spoolname: D6ccc08932bf7.smd > X-Declude-RefID: > X-Declude-Note: Scanned by Declude 4.3.14 for spam. > "http://www.declude.com/x-note.htm"; > X-Declude-Scan: Incoming Score [21] at 12:01:18 on 09 Nov 2006 > X-Declude-Fail: MXRATE-ALLOW [-3], HELOBOGUS [5], FILTER-SPAM [15], > GIBBERISH [4], WEIGHT10 [10], WEIGHT15 [15], WEIGHT19 [19], WEIGHT19a > [19] > X-Country-Chain: UNITED STATES->destination > X-RCPT-TO: <[EMAIL PROTECTED]> > Status: U > X-UIDL: 463090338 > X-IMail-ThreadID: 6ccc08932bf7 > X-Antivirus: AVG for E-mail 7.5.431 [268.14.0/524] > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Todd Richards > Sent: Thursday, November 09, 2006 1:19 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > Hi David - > > OK, it appears that it is running the test. Here is a snip of the > log: > > 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file > D:\imail\Declude\Filters\FILTER-SPAM.txt. > 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file > D:\imail\Declude\Filters\FILTER-GERMAN.txt. > 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file > D:\imail\Declude\Filters\FILTER-SURBL.txt. > 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at > first hit. > 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file > D:\iMail\Declude\Filters\Gibberish.txt. > 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file > D:\iMail\Declude\Filters\Anti-Gibberish.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file > D:\imail\Declude\Filters\FILTER-COUNTRY.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking > countries: US . > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file > D:\IMail\Declude\filters\allowlist_low.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file > D:\IMail\Declude\filters\allowlist_med.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file > D:\IMail\Declude\filters\allowlist_high.txt. > 11/09/2006 13:14:23.968 q7df6083c3523.s
Re: [Declude.JunkMail] Negative weight isn't working
What are you adding to outgoing headers in the config? You won't see the test in the headers unless you add a header that displays all of the tests the message fails. Darin. - Original Message - From: "Todd Richards" <[EMAIL PROTECTED]> To: Sent: Thursday, November 09, 2006 2:18 PM Subject: RE: [Declude.JunkMail] Negative weight isn't working Hi David - OK, it appears that it is running the test. Here is a snip of the log: 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SPAM.txt. 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-GERMAN.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SURBL.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at first hit. 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Gibberish.txt. 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Anti-Gibberish.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking countries: US . 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_low.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_med.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_high.txt. 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . Total weight = -3. However, before I ran the Debug mode I had one of the emails in question caught in the trap, and there was nothing in the headers about an "allowlist_med". Which means that there must be something not right in the filter itself. This particular newsletter is listed in my ALLOWLIST_MED as a MAILFROM with the full email address of [EMAIL PROTECTED] Is there a better way to do that? Should I wait to see what the logs look like on the debug mode when the next one comes through later today? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 12:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 11:54 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Negative weight isn't working Hi Everyone - I've been playing with some negative weighting, but it doesn't seem to be working. I have the following in my global.cfg file (down towards the bottom): ALLOWLIST_MED filter D:\IMail\Declude\filters\allowlist_med.txt x -30 0 In my allowlist_med.txt file, I have the following entries: MAILFROM 0 ENDSWITH [EMAIL PROTECTED] REVDNS 0 ENDSWITH .asaenet.org However, these messages are still getting caught. When I look at the headers, it doesn't even appear that it is running this test. I have the test listed in $default$.junkmail as ALLOWLIST_MED WARN And in diags.txt as ALLOWLIST_MED FILTER I would like to add some others as well but need to get at least one working first. Any help is appreciated (as always)! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative weight isn't working
Oh Geesss (head down, walking towards corner)... Seeing that (now), what's the best practice? MAILFROM [EMAIL PROTECTED] Or MAILFROM @mailer.ibsys.com I would think the more specific, the better. Thanks, David! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 2:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working The actual MAILFROM is: X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] Not From: "KETV.com Newsroom" <[EMAIL PROTECTED]> David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 2:44 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working OK, here is an update with the header of the particular message. Todd Received: from treetso101.mtc.ibsys.com [66.187.204.25] by mail.nnepa.com with ESMTP (SMTPD-8.22) id ACCC0340; Thu, 09 Nov 2006 12:00:44 -0600 Date: Thu, 9 Nov 2006 12:02:02 -0600 (CST) From: "KETV.com Newsroom" <[EMAIL PROTECTED]> Reply-to: [EMAIL PROTECTED] Message-Id: <[EMAIL PROTECTED]> X-unsub: ?unsub.cfm?u=2656017216813-oma_12pm-oma_12pm_1_12000311092006 Subject: [21] KETV.com Noon Headlines To: <[EMAIL PROTECTED]> Content-type: text/html; charset=us-ascii X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" X-RBL-Warning: HELOBOGUS: Domain treetso101.mtc.ibsys.com has no MX or A records [0301]. X-RBL-Warning: FILTER-SPAM: Message failed FILTER-SPAM test (line 55, weight 15) X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 76, weight 4) X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] X-Declude-Spoolname: D6ccc08932bf7.smd X-Declude-RefID: X-Declude-Note: Scanned by Declude 4.3.14 for spam. "http://www.declude.com/x-note.htm"; X-Declude-Scan: Incoming Score [21] at 12:01:18 on 09 Nov 2006 X-Declude-Fail: MXRATE-ALLOW [-3], HELOBOGUS [5], FILTER-SPAM [15], GIBBERISH [4], WEIGHT10 [10], WEIGHT15 [15], WEIGHT19 [19], WEIGHT19a [19] X-Country-Chain: UNITED STATES->destination X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 463090338 X-IMail-ThreadID: 6ccc08932bf7 X-Antivirus: AVG for E-mail 7.5.431 [268.14.0/524] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 1:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Hi David - OK, it appears that it is running the test. Here is a snip of the log: 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SPAM.txt. 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-GERMAN.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SURBL.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at first hit. 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Gibberish.txt. 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Anti-Gibberish.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking countries: US . 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_low.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_med.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_high.txt. 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . Total weight = -3. However, before I ran the Debug mode I had one of the emails in question caught in the trap, and there was nothing in the headers about an "allowlist_med". Which means that there must be something not right in the filter itself. This particular newsletter is listed in my ALLOWLIST_MED as a MAILFROM with the full email address of [EMAIL PROTECTED] Is there a better way to do that? Should I wait to see what the logs look like on the debug mode when the next one comes through later today? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 12:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09,
RE: [Declude.JunkMail] Negative weight isn't working
Todd, do this from a command line: C:\Temp>nslookup 66.187.204.25 Server: Andrew's.obfuscated.dns.server Address: 192.168.0.1 Name:treets100.ibsys.com Address: 66.187.204.25 C:\Temp> That tells me that your REVDNS won't match, because their reverse DNS is *not* the same as the HELO value that you used for your REVDNS test. The same is also true for your use of the MAILFROM, which does not have to match the From: address you see in the header. Look at the X-Declude-Sender: line in the header that has been marked up. The MAILFROM was really "[EMAIL PROTECTED]". Andrew 8) > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Todd Richards > Sent: Thursday, November 09, 2006 11:44 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > OK, here is an update with the header of the particular message. > > Todd > > > Received: from treetso101.mtc.ibsys.com [66.187.204.25] by > mail.nnepa.com with ESMTP > (SMTPD-8.22) id ACCC0340; Thu, 09 Nov 2006 12:00:44 -0600 > Date: Thu, 9 Nov 2006 12:02:02 -0600 (CST) > From: "KETV.com Newsroom" <[EMAIL PROTECTED]> > Reply-to: [EMAIL PROTECTED] > Message-Id: <[EMAIL PROTECTED]> > X-unsub: ?unsub.cfm?u=2656017216813-oma_12pm-oma_12pm_1_12000311092006 > Subject: [21] KETV.com Noon Headlines > To: <[EMAIL PROTECTED]> > Content-type: text/html; charset=us-ascii > X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" > X-RBL-Warning: HELOBOGUS: Domain treetso101.mtc.ibsys.com has > no MX or A records [0301]. > X-RBL-Warning: FILTER-SPAM: Message failed FILTER-SPAM test > (line 55, weight > 15) > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line > 76, weight 4) > X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the > limit of 10. > X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] > X-Declude-Spoolname: D6ccc08932bf7.smd > X-Declude-RefID: > X-Declude-Note: Scanned by Declude 4.3.14 for spam. > "http://www.declude.com/x-note.htm"; > X-Declude-Scan: Incoming Score [21] at 12:01:18 on 09 Nov 2006 > X-Declude-Fail: MXRATE-ALLOW [-3], HELOBOGUS [5], FILTER-SPAM > [15], GIBBERISH [4], WEIGHT10 [10], WEIGHT15 [15], WEIGHT19 > [19], WEIGHT19a [19] > X-Country-Chain: UNITED STATES->destination > X-RCPT-TO: <[EMAIL PROTECTED]> > Status: U > X-UIDL: 463090338 > X-IMail-ThreadID: 6ccc08932bf7 > X-Antivirus: AVG for E-mail 7.5.431 [268.14.0/524] > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Todd Richards > Sent: Thursday, November 09, 2006 1:19 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Negative weight isn't working > > Hi David - > > OK, it appears that it is running the test. Here is a snip > of the log: > > 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter > file D:\imail\Declude\Filters\FILTER-SPAM.txt. > 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter > file D:\imail\Declude\Filters\FILTER-GERMAN.txt. > 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter > file D:\imail\Declude\Filters\FILTER-SURBL.txt. > 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will > stop at first hit. > 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter > file D:\iMail\Declude\Filters\Gibberish.txt. > 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter > file D:\iMail\Declude\Filters\Anti-Gibberish.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter > file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking > countries: US . > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter > file D:\IMail\Declude\filters\allowlist_low.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter > file D:\IMail\Declude\filters\allowlist_med.txt. > 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter > file D:\IMail\Declude\filters\allowlist_high.txt. > 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . > Total weight = -3. > > However, before I ran the Debug mode I had one of the emails > in question caught in the trap, and there was nothing in the > headers about an "allowlist_med". Which means that there > must be something not right in the filter itself. This > particular newsletter is listed in my ALLOWLIST_MED as a > MAILFROM with the full email address of > [EMAIL PROTECTED] Is there a better way to do that? > > Should I wait to see what the logs look like on the debug > mode when the next one comes through lat
RE: [Declude.JunkMail] Negative weight isn't working
The actual MAILFROM is: X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] Not From: "KETV.com Newsroom" <[EMAIL PROTECTED]> David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 2:44 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working OK, here is an update with the header of the particular message. Todd Received: from treetso101.mtc.ibsys.com [66.187.204.25] by mail.nnepa.com with ESMTP (SMTPD-8.22) id ACCC0340; Thu, 09 Nov 2006 12:00:44 -0600 Date: Thu, 9 Nov 2006 12:02:02 -0600 (CST) From: "KETV.com Newsroom" <[EMAIL PROTECTED]> Reply-to: [EMAIL PROTECTED] Message-Id: <[EMAIL PROTECTED]> X-unsub: ?unsub.cfm?u=2656017216813-oma_12pm-oma_12pm_1_12000311092006 Subject: [21] KETV.com Noon Headlines To: <[EMAIL PROTECTED]> Content-type: text/html; charset=us-ascii X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" X-RBL-Warning: HELOBOGUS: Domain treetso101.mtc.ibsys.com has no MX or A records [0301]. X-RBL-Warning: FILTER-SPAM: Message failed FILTER-SPAM test (line 55, weight 15) X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 76, weight 4) X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] X-Declude-Spoolname: D6ccc08932bf7.smd X-Declude-RefID: X-Declude-Note: Scanned by Declude 4.3.14 for spam. "http://www.declude.com/x-note.htm"; X-Declude-Scan: Incoming Score [21] at 12:01:18 on 09 Nov 2006 X-Declude-Fail: MXRATE-ALLOW [-3], HELOBOGUS [5], FILTER-SPAM [15], GIBBERISH [4], WEIGHT10 [10], WEIGHT15 [15], WEIGHT19 [19], WEIGHT19a [19] X-Country-Chain: UNITED STATES->destination X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 463090338 X-IMail-ThreadID: 6ccc08932bf7 X-Antivirus: AVG for E-mail 7.5.431 [268.14.0/524] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 1:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Hi David - OK, it appears that it is running the test. Here is a snip of the log: 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SPAM.txt. 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-GERMAN.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SURBL.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at first hit. 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Gibberish.txt. 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Anti-Gibberish.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking countries: US . 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_low.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_med.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_high.txt. 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . Total weight = -3. However, before I ran the Debug mode I had one of the emails in question caught in the trap, and there was nothing in the headers about an "allowlist_med". Which means that there must be something not right in the filter itself. This particular newsletter is listed in my ALLOWLIST_MED as a MAILFROM with the full email address of [EMAIL PROTECTED] Is there a better way to do that? Should I wait to see what the logs look like on the debug mode when the next one comes through later today? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 12:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 11:54 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Negative weight isn't working Hi Everyone - I've been playing with some negative weighting, but it doesn't seem to be working. I have the following in my global.cfg file (down towards the bottom): ALLOWLIST_MED filter D:\IMail\Declude\filters\allowlist_med.txt x -30 0 In my allowlist_med.txt file, I have the following entries: MAILFROM0 ENDSWITH[EMAIL PROTECTED
RE: [Declude.JunkMail] Negative weight isn't working
OK, here is an update with the header of the particular message. Todd Received: from treetso101.mtc.ibsys.com [66.187.204.25] by mail.nnepa.com with ESMTP (SMTPD-8.22) id ACCC0340; Thu, 09 Nov 2006 12:00:44 -0600 Date: Thu, 9 Nov 2006 12:02:02 -0600 (CST) From: "KETV.com Newsroom" <[EMAIL PROTECTED]> Reply-to: [EMAIL PROTECTED] Message-Id: <[EMAIL PROTECTED]> X-unsub: ?unsub.cfm?u=2656017216813-oma_12pm-oma_12pm_1_12000311092006 Subject: [21] KETV.com Noon Headlines To: <[EMAIL PROTECTED]> Content-type: text/html; charset=us-ascii X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" X-RBL-Warning: HELOBOGUS: Domain treetso101.mtc.ibsys.com has no MX or A records [0301]. X-RBL-Warning: FILTER-SPAM: Message failed FILTER-SPAM test (line 55, weight 15) X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 76, weight 4) X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.187.204.25] X-Declude-Spoolname: D6ccc08932bf7.smd X-Declude-RefID: X-Declude-Note: Scanned by Declude 4.3.14 for spam. "http://www.declude.com/x-note.htm"; X-Declude-Scan: Incoming Score [21] at 12:01:18 on 09 Nov 2006 X-Declude-Fail: MXRATE-ALLOW [-3], HELOBOGUS [5], FILTER-SPAM [15], GIBBERISH [4], WEIGHT10 [10], WEIGHT15 [15], WEIGHT19 [19], WEIGHT19a [19] X-Country-Chain: UNITED STATES->destination X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 463090338 X-IMail-ThreadID: 6ccc08932bf7 X-Antivirus: AVG for E-mail 7.5.431 [268.14.0/524] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 1:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Hi David - OK, it appears that it is running the test. Here is a snip of the log: 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SPAM.txt. 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-GERMAN.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SURBL.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at first hit. 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Gibberish.txt. 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Anti-Gibberish.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking countries: US . 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_low.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_med.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_high.txt. 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . Total weight = -3. However, before I ran the Debug mode I had one of the emails in question caught in the trap, and there was nothing in the headers about an "allowlist_med". Which means that there must be something not right in the filter itself. This particular newsletter is listed in my ALLOWLIST_MED as a MAILFROM with the full email address of [EMAIL PROTECTED] Is there a better way to do that? Should I wait to see what the logs look like on the debug mode when the next one comes through later today? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 12:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 11:54 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Negative weight isn't working Hi Everyone - I've been playing with some negative weighting, but it doesn't seem to be working. I have the following in my global.cfg file (down towards the bottom): ALLOWLIST_MED filter D:\IMail\Declude\filters\allowlist_med.txt x -30 0 In my allowlist_med.txt file, I have the following entries: MAILFROM0 ENDSWITH[EMAIL PROTECTED] REVDNS 0 ENDSWITH.asaenet.org However, these messages are still getting caught. When I look at the headers, it doesn't even appear that it is running this test. I have the test listed in $default$.junkmail as ALLOWLIST_MED WARN And in diags.txt as ALLOWLIST_MED FILTER I would like to add some others as well but need to get at least one working first. Any help is appreciated (as
RE: [Declude.JunkMail] Negative weight isn't working
Where are you getting the MAILFROM address [EMAIL PROTECTED] ? Do you have a header you can post that is addressed to [EMAIL PROTECTED] ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 2:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Hi David - OK, it appears that it is running the test. Here is a snip of the log: 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SPAM.txt. 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-GERMAN.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SURBL.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at first hit. 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Gibberish.txt. 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Anti-Gibberish.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking countries: US . 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_low.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_med.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_high.txt. 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . Total weight = -3. However, before I ran the Debug mode I had one of the emails in question caught in the trap, and there was nothing in the headers about an "allowlist_med". Which means that there must be something not right in the filter itself. This particular newsletter is listed in my ALLOWLIST_MED as a MAILFROM with the full email address of [EMAIL PROTECTED] Is there a better way to do that? Should I wait to see what the logs look like on the debug mode when the next one comes through later today? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 12:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 11:54 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Negative weight isn't working Hi Everyone - I've been playing with some negative weighting, but it doesn't seem to be working. I have the following in my global.cfg file (down towards the bottom): ALLOWLIST_MED filter D:\IMail\Declude\filters\allowlist_med.txt x -30 0 In my allowlist_med.txt file, I have the following entries: MAILFROM0 ENDSWITH[EMAIL PROTECTED] REVDNS 0 ENDSWITH.asaenet.org However, these messages are still getting caught. When I look at the headers, it doesn't even appear that it is running this test. I have the test listed in $default$.junkmail as ALLOWLIST_MED WARN And in diags.txt as ALLOWLIST_MED FILTER I would like to add some others as well but need to get at least one working first. Any help is appreciated (as always)! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative weight isn't working
Hi David - OK, it appears that it is running the test. Here is a snip of the log: 11/09/2006 13:14:20.937 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SPAM.txt. 11/09/2006 13:14:21.312 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-GERMAN.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-SURBL.txt. 11/09/2006 13:14:21.390 q7df6083c3523.smd Filter: Will stop at first hit. 11/09/2006 13:14:21.781 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Gibberish.txt. 11/09/2006 13:14:22.875 q7df6083c3523.smd Doing filter file D:\iMail\Declude\Filters\Anti-Gibberish.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\imail\Declude\Filters\FILTER-COUNTRY.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Checking countries: US . 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_low.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_med.txt. 11/09/2006 13:14:23.953 q7df6083c3523.smd Doing filter file D:\IMail\Declude\filters\allowlist_high.txt. 11/09/2006 13:14:23.968 q7df6083c3523.smd nIPNOTINMX:-3 . Total weight = -3. However, before I ran the Debug mode I had one of the emails in question caught in the trap, and there was nothing in the headers about an "allowlist_med". Which means that there must be something not right in the filter itself. This particular newsletter is listed in my ALLOWLIST_MED as a MAILFROM with the full email address of [EMAIL PROTECTED] Is there a better way to do that? Should I wait to see what the logs look like on the debug mode when the next one comes through later today? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 09, 2006 12:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Negative weight isn't working Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 11:54 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Negative weight isn't working Hi Everyone - I've been playing with some negative weighting, but it doesn't seem to be working. I have the following in my global.cfg file (down towards the bottom): ALLOWLIST_MED filter D:\IMail\Declude\filters\allowlist_med.txt x -30 0 In my allowlist_med.txt file, I have the following entries: MAILFROM0 ENDSWITH[EMAIL PROTECTED] REVDNS 0 ENDSWITH.asaenet.org However, these messages are still getting caught. When I look at the headers, it doesn't even appear that it is running this test. I have the test listed in $default$.junkmail as ALLOWLIST_MED WARN And in diags.txt as ALLOWLIST_MED FILTER I would like to add some others as well but need to get at least one working first. Any help is appreciated (as always)! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative weight isn't working
Todd, Run you global.cfg on DEBUG see if the test is being called correctly. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Thursday, November 09, 2006 11:54 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Negative weight isn't working Hi Everyone - I've been playing with some negative weighting, but it doesn't seem to be working. I have the following in my global.cfg file (down towards the bottom): ALLOWLIST_MED filter D:\IMail\Declude\filters\allowlist_med.txt x -30 0 In my allowlist_med.txt file, I have the following entries: MAILFROM0 ENDSWITH[EMAIL PROTECTED] REVDNS 0 ENDSWITH.asaenet.org However, these messages are still getting caught. When I look at the headers, it doesn't even appear that it is running this test. I have the test listed in $default$.junkmail as ALLOWLIST_MED WARN And in diags.txt as ALLOWLIST_MED FILTER I would like to add some others as well but need to get at least one working first. Any help is appreciated (as always)! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative weight for local hosts?
Also watch out for: WHITELIST AUTH - Original Message - From: "S.J.Stanaitis" <[EMAIL PROTECTED]> To: Sent: Friday, September 22, 2006 1:03 PM Subject: [Declude.JunkMail] Negative weight for local hosts? I'm trying to add confidentiality footers do outgoing emails. All arguments over necessity aside, I need to get 'er done. I'm sure someone else has run into this... I have my local private IP range whitelisted in Declude (192.168.1.) so that they aren't scanned for spam. In order to add a footer to the outgoing emails via Sandford's external test which does just that - I need to remove the whitelist for that range. That of course causes legitimate emails to be blocked. My first guess as a fix would be to assign a large negative weight to outgoing emails - or - find a way to allow Sanford's footer app to run independent of the whitelist. Any ideas? Suggestions? Thanks, Sam Samuel J Stanaitis, Network Administrator Decorative Product Source, Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative weight for local hosts?
Whitelist in a filter instead of by using the Global.cfg. That will allow external tests to run. Example: REMOTEIP WHITELIST CIDR 192.168.1.0/24 REMOTEIP WHITELIST IS 10.12.14.30 The only disadvantage of whitelisting in a filter over whitelisting in the Global.cfg is that it takes more processing power since Global.cfg whitelist hits can be used to immediately stop processing of most spam tests. Matt S.J.Stanaitis wrote: I'm trying to add confidentiality footers do outgoing emails. All arguments over necessity aside, I need to get 'er done. I'm sure someone else has run into this... I have my local private IP range whitelisted in Declude (192.168.1.) so that they aren't scanned for spam. In order to add a footer to the outgoing emails via Sandford's external test which does just that - I need to remove the whitelist for that range. That of course causes legitimate emails to be blocked. My first guess as a fix would be to assign a large negative weight to outgoing emails - or - find a way to allow Sanford's footer app to run independent of the whitelist. Any ideas? Suggestions? Thanks, Sam Samuel J Stanaitis, Network Administrator Decorative Product Source, Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] negative weight filters?
attached is a copy of my white list file that adds negative weight, i have been adding to it for about one year now. Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 - - Original Message - From: "DLAnalyzer Support" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, December 09, 2003 11:45 PM Subject: Re: [Declude.JunkMail] negative weight filters? We have been creating negative weight filters based on reverse DNS. REVDNS-3 ENDSWITH .dell.com Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com Administration writes: > Hello, > I was wondering if any one could show me some examples of what they are using > for negative weight filters? It would seem that i'm catching alot of legit mail > in a last few weeks, mostly just mailing lists and ebay messages. > > thanks in advance for your time! > ken > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. [ scanned for spam to: [EMAIL PROTECTED] incoming http://www.DcMetroNet.com on 12/09/2003 at 23:53:59-0500et. ] [ scanned for viruses to: [EMAIL PROTECTED] incoming http://www.DcMetroNet.com on 12/09/2003 at 23:54:37-0500et. ] White_Text.zip Description: Zip compressed data
Re: [Declude.JunkMail] negative weight filters?
We have been creating negative weight filters based on reverse DNS. REVDNS-3 ENDSWITH .dell.com Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com Administration writes: Hello, I was wondering if any one could show me some examples of what they are using for negative weight filters? It would seem that i'm catching alot of legit mail in a last few weeks, mostly just mailing lists and ebay messages. thanks in advance for your time! ken --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
Scott,
Thank you for the clarification, the end of your message was what the
intended behavior I was looking for.
Darrell
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, January 21, 2003 10:21 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Negative Weight On A Domain Name
>The first weight is the weight applied if the test is failed, and the
>second weight is if the test is passed.
Ah, I see what you're getting at. It gets confusing because there are
two
meanings of "negative weight" ("negative" meaning that the E-mail didn't
fail the spam test, or "negative" as in a negative number added to the
weight).
Assuming "@mail.southwest.com" is in the blacklist:
DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5
The above would cause E-mail from @mail.southwest.com to have 0 points,
and
mail from any other address would have 5 points. Instead, I'm guessing
you
would want:
DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x -5 0
With this, 5 points will be deducted from mail from @mail.southwest.com,
but other mail won't be affected.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
The first weight is the weight applied if the test is failed, and the
second weight is if the test is passed.
Ah, I see what you're getting at. It gets confusing because there are two
meanings of "negative weight" ("negative" meaning that the E-mail didn't
fail the spam test, or "negative" as in a negative number added to the weight).
Assuming "@mail.southwest.com" is in the blacklist:
DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5
The above would cause E-mail from @mail.southwest.com to have 0 points, and
mail from any other address would have 5 points. Instead, I'm guessing you
would want:
DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x -5 0
With this, 5 points will be deducted from mail from @mail.southwest.com,
but other mail won't be affected.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
> >If I was going to setup Negative Weight on certain domains instead of > >white listing them would I use just a standard sender blacklist with > >negative weight > > > >DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 > > > >Then inside the file I would use > >@mail.southwest.com > > > >Since the Declude sender is > >X-Declude-Sender: [EMAIL PROTECTED] > [12.5.136.142] > > In this case, the only change I would make is to use "-5" instead of "5" in > the test definition, so that it will lower the weight: > > DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 Darrell, a little confusion here. Do you want to have any message from @mail.southwest.com get added a negative weight? And you are going to list that in a file called badaddresses.txt? If so, shouldn't that be called goodaddresses.txt? If you want to add a negative weight to a line listed in the file, I believe it should be: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x -5 0 If you want to add a negative weight to an address NOT listed in the file, then it would be: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 Scott? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
Just for clarification, The first weight is the weight applied if the test is failed, and the second weight is if the test is passed. In my case I would have @mail.southwest.com entered in the file and I want to decrease the weight of the mail if the message is from the @mail.southwest.com domain. DecreaseWeight fromfile C:\IMail\Declude\AddressesToDecWeightOn.txt x -5 0 Is this correct? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, January 21, 2003 9:39 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Negative Weight On A Domain Name >If I was going to setup Negative Weight on certain domains instead of >white listing them would I use just a standard sender blacklist with >negative weight > >i.e. > >DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 > >Then inside the file I would use >@mail.southwest.com > >Since the Declude sender is >X-Declude-Sender: [EMAIL PROTECTED] [12.5.136.142] In this case, the only change I would make is to use "-5" instead of "5" in the test definition, so that it will lower the weight: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight On A Domain Name
If I was going to setup Negative Weight on certain domains instead of white listing them would I use just a standard sender blacklist with negative weight i.e. DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 Then inside the file I would use @mail.southwest.com Since the Declude sender is X-Declude-Sender: [EMAIL PROTECTED] [12.5.136.142] In this case, the only change I would make is to use "-5" instead of "5" in the test definition, so that it will lower the weight: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight on Subject
Does negative weight work with Subject? Is this valid? SUBJECT -20 CONTAINS Delivery failure Yes, that is valid. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] negative weight in CFG
> "Negative weight" can (unfortunately) mean two different things.
> You can have:
> Assuming that this is a whitelist, you would want the first type
> ("-1000 0").
Thanks.
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] negative weight in CFG
>How does one go about creating a negative weight
>for the following CFG example:
>
>---
>WLIST fromfiled:\imail\declude\allowed.txtx 0
> 0
>---
"Negative weight" can (unfortunately) mean two different things. You can have:
WLIST fromfiled:\imail\declude\allowed.txtx
-1000 0
this line will give the WLIST test a weight of -1000 (which should normally
result in a total weight of less than 0). Or, you can have:
WLIST fromfiled:\imail\declude\allowed.txtx
0 1000
In this case, any E-mail that is NOT caught by the WLIST test would get a
weight of 1,000.
Assuming that this is a whitelist, you would want the first type ("-1000 0").
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight
>In assigning negative weight should we assign the domain as it appears >in the log? First, I should clarify that there are two meanings of "negative weight". One is the weight that is added to an E-mail when the E-mail does NOT fail a spam test (which is almost always 0). The other is a standard weight, with a negative value (which is what you are talking about). >Almost all newsletters from Microsoft are assigned a warning for REVDNS. >So should we assign a negative 5 weigth to: > >Microsoft.com >Or: >Newsletters.Microsoft.com >Or: >delivery.pens.microsoft.com You would use: >X-Declude-Sender: >[EMAIL PROTECTED] >[207.46.239.124] Newsletters.Microsoft.com -- that's the one used in the return address, which is what Declude (and IMail) use. So in a filter file, you could have "MAILFROM -5 CONTAINS newsletters.microsoft.com". One important note here is that if the filter test itself has a weight assigned to it, you need to take that into effect. For example, if you have "MYFILTER filter myfilterfile x 8 0", the MYFILTER test would cause the Microsoft E-mail to have a weight 3 higher than when it started (+8 for being listed in the filter, and -5 from the line that it matched). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
