RE: [NoXMail] SpamManager Final now available

[Brian Milburn]

I know, there aren't any for NoxMail for today either. Guess it is time to
look at the IMail logs.
 
On 2/12/2003 4:35pm you wrote...
>Brian, I notice there are no replies in the archive either.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Wednesday, February 12, 2003 4:32 PM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] SpamManager Final now available
>> 
>> 
>> No everything is set up correctly. I just checked again. Let me know if
>you
>> get this one.
>> 
>> On 2/12/2003 4:28pm you wrote...
>> >Brian, I concur with Bill.
>> >
>> >I have only seen one reply the list.
>> >
>> >Have you checked reply to list or reply to sender on the list setup?
>> >
>> >In fact, the only reply that I see is the one you sent direct to me
>> >yesterday.
>> >
>> >Check the list settings and check reply to list.
>> >
>> >John Tolmachoff MCSE, CSSA
>> >IT Manager, Network Engineer
>> >RelianceSoft, Inc.
>> >Fullerton, CA  92835
>> >www.reliancesoft.com
>> >
>> >
>> >> -Original Message-
>> >> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> >> [EMAIL PROTECTED]] On Behalf Of Bill Landry
>> >> Sent: Wednesday, February 12, 2003 4:17 PM
>> >> To: [EMAIL PROTECTED]
>> >> Subject: Re: [NoXMail] SpamManager Final now available
>> >>
>> >> Awesome!  BTW, I subscribed to the new SpamManager list, and have
>received
>> >a
>> >> few test messages, but when I replied to one of yours yesterday, it
>never
>> >> showed up on the list (at least I never got it).
>> >>
>> >> Bill
>> >> - Original Message -
>> >> From: "Brian Milburn" <[EMAIL PROTECTED]>
>> >> To: <[EMAIL PROTECTED]>
>> >> Sent: Wednesday, February 12, 2003 2:59 PM
>> >> Subject: Re: [NoXMail] SpamManager Final now available
>> >>
>> >>
>> >> >
>> >> > Hi Bill,
>> >> >
>> >> > I have worked out an arrangement with Scott to resell a "Declude test
>> >> only"
>> >> > version through his web site. We won't be offering it directly. It
>will
>> >be
>> >> and
>> >> > unlimited use subscription for $395 annually. The fancy message
>handling
>> >> stuff
>> >> > is disabled and it will simply return result codes to Declude. It
>will
>> >be
>> >> the
>> >> > exact same version as the full one, but the license code will turn
>off
>> >> > features not applicable in a Declude test environment.
>> >> >
>> >> > Scott may possibly make an announcement on his web site or list
>> >regarding
>> >> > this. I would check with him if you haven't heard anything by early
>next
>> >> week.
>> >> >
>> >> > Brian
>> >> >
>> >> > On 02/11/03 12:44pm you wrote...
>> >> > >Brian,
>> >> > >
>> >> > >I have been following this list since day one, but did not
>participate
>> >> the
>> >> > >actual beta testing...mainly out of concern for costs being too high
>to
>> >> > >continue using the product after it was out of its beta stage.  I
>have
>> >> > >enjoyed listening to all the discussing, and it sounds like this is
>> >going
>> >> to
>> >> > >be a great product.  But as it is, the pricing is indeed too high
>for
>> >us
>> >> to
>> >> > >justify making the purchase to add this as another test within
>Declude.
>> >> > >
>> >> > >We average ~40K-50K emails per day, with a large portion of those
>being
>> >> > >spam.  Most Spam is caught with our Declude/Sniffer combo, but still
>> >some
>> >> do
>> >> > >get through...especially adult emails.  I would love to implement
>Spam
>> >> > >Manager as another test within Declude if you do establish
>> >> Declude-specific
>> >> > >pricing.  So I do hope you consider doing that.  I'll be keeping an

RE: [NoXMail] SpamManager Final now available

[Brian Milburn]

No everything is set up correctly. I just checked again. Let me know if you
get this one.
 
On 2/12/2003 4:28pm you wrote...
>Brian, I concur with Bill.
>
>I have only seen one reply the list.
>
>Have you checked reply to list or reply to sender on the list setup?
>
>In fact, the only reply that I see is the one you sent direct to me
>yesterday.
>
>Check the list settings and check reply to list.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Bill Landry
>> Sent: Wednesday, February 12, 2003 4:17 PM
>> To: [EMAIL PROTECTED]
>> Subject: Re: [NoXMail] SpamManager Final now available
>> 
>> Awesome!  BTW, I subscribed to the new SpamManager list, and have received
>a
>> few test messages, but when I replied to one of yours yesterday, it never
>> showed up on the list (at least I never got it).
>> 
>> Bill
>> - Original Message -
>> From: "Brian Milburn" <[EMAIL PROTECTED]>
>> To: <[EMAIL PROTECTED]>
>> Sent: Wednesday, February 12, 2003 2:59 PM
>> Subject: Re: [NoXMail] SpamManager Final now available
>> 
>> 
>> >
>> > Hi Bill,
>> >
>> > I have worked out an arrangement with Scott to resell a "Declude test
>> only"
>> > version through his web site. We won't be offering it directly. It will
>be
>> and
>> > unlimited use subscription for $395 annually. The fancy message handling
>> stuff
>> > is disabled and it will simply return result codes to Declude. It will
>be
>> the
>> > exact same version as the full one, but the license code will turn off
>> > features not applicable in a Declude test environment.
>> >
>> > Scott may possibly make an announcement on his web site or list
>regarding
>> > this. I would check with him if you haven't heard anything by early next
>> week.
>> >
>> > Brian
>> >
>> > On 02/11/03 12:44pm you wrote...
>> > >Brian,
>> > >
>> > >I have been following this list since day one, but did not participate
>> the
>> > >actual beta testing...mainly out of concern for costs being too high to
>> > >continue using the product after it was out of its beta stage.  I have
>> > >enjoyed listening to all the discussing, and it sounds like this is
>going
>> to
>> > >be a great product.  But as it is, the pricing is indeed too high for
>us
>> to
>> > >justify making the purchase to add this as another test within Declude.
>> > >
>> > >We average ~40K-50K emails per day, with a large portion of those being
>> > >spam.  Most Spam is caught with our Declude/Sniffer combo, but still
>some
>> do
>> > >get through...especially adult emails.  I would love to implement Spam
>> > >Manager as another test within Declude if you do establish
>> Declude-specific
>> > >pricing.  So I do hope you consider doing that.  I'll be keeping an ear
>> out.
>> >
>> > ---
>> > [This E-mail scanned for viruses by Solid Oak Software]
>> >
>> >
>> > Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> > Removal address: [EMAIL PROTECTED]
>> >
>> > ---
>> > [This e-mail was scanned for viruses by Pointshare's Virus Scanning
>> Service]
>> >
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>ware]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] SpamManager Final now available

[Brian Milburn]

I don't know, something's up there somewhere. I had a lot of problems getting
this to work. Our other lists all work fine.  When I set it up at first, IMail
did not automatically create the owner aliases that it normally does. Maybe
I'll just delete it and do it again.
 
On 2/12/2003 4:17pm you wrote...
>Awesome!  BTW, I subscribed to the new SpamManager list, and have received a
>few test messages, but when I replied to one of yours yesterday, it never
>showed up on the list (at least I never got it).
>
>Bill
>- Original Message -
>From: "Brian Milburn" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Wednesday, February 12, 2003 2:59 PM
>Subject: Re: [NoXMail] SpamManager Final now available
>
>
>>
>> Hi Bill,
>>
>> I have worked out an arrangement with Scott to resell a "Declude test
>only"
>> version through his web site. We won't be offering it directly. It will be
>and
>> unlimited use subscription for $395 annually. The fancy message handling
>stuff
>> is disabled and it will simply return result codes to Declude. It will be
>the
>> exact same version as the full one, but the license code will turn off
>> features not applicable in a Declude test environment.
>>
>> Scott may possibly make an announcement on his web site or list regarding
>> this. I would check with him if you haven't heard anything by early next
>week.
>>
>> Brian
>>
>> On 02/11/03 12:44pm you wrote...
>> >Brian,
>> >
>> >I have been following this list since day one, but did not participate
>the
>> >actual beta testing...mainly out of concern for costs being too high to
>> >continue using the product after it was out of its beta stage.  I have
>> >enjoyed listening to all the discussing, and it sounds like this is going
>to
>> >be a great product.  But as it is, the pricing is indeed too high for us
>to
>> >justify making the purchase to add this as another test within Declude.
>> >
>> >We average ~40K-50K emails per day, with a large portion of those being
>> >spam.  Most Spam is caught with our Declude/Sniffer combo, but still some
>do
>> >get through...especially adult emails.  I would love to implement Spam
>> >Manager as another test within Declude if you do establish
>Declude-specific
>> >pricing.  So I do hope you consider doing that.  I'll be keeping an ear
>out.
>>
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>>
>> ---
>> [This e-mail was scanned for viruses by Pointshare's Virus Scanning
>Service]
>>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] SpamManager Final now available

[Brian Milburn]

Hi Bill, 

I have worked out an arrangement with Scott to resell a "Declude test only"
version through his web site. We won't be offering it directly. It will be and
unlimited use subscription for $395 annually. The fancy message handling stuff
is disabled and it will simply return result codes to Declude. It will be the
exact same version as the full one, but the license code will turn off
features not applicable in a Declude test environment.

Scott may possibly make an announcement on his web site or list regarding
this. I would check with him if you haven't heard anything by early next week.

Brian
 
On 02/11/03 12:44pm you wrote...
>Brian,
>
>I have been following this list since day one, but did not participate the
>actual beta testing...mainly out of concern for costs being too high to
>continue using the product after it was out of its beta stage.  I have
>enjoyed listening to all the discussing, and it sounds like this is going to
>be a great product.  But as it is, the pricing is indeed too high for us to
>justify making the purchase to add this as another test within Declude.
>
>We average ~40K-50K emails per day, with a large portion of those being
>spam.  Most Spam is caught with our Declude/Sniffer combo, but still some do
>get through...especially adult emails.  I would love to implement Spam
>Manager as another test within Declude if you do establish Declude-specific
>pricing.  So I do hope you consider doing that.  I'll be keeping an ear out.

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] SpamManager Final now available

[Brian Milburn]

Thanks John, you especially have been a great help. I will now go correct my
errors you so kindly pointed out ;-)
 
On 02/11/03 7:32am you wrote...
>Brian, it has been a pleasure helping to Beta test this product and I wish
>you and your company the best of fortune in marketing it.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Monday, February 10, 2003 3:50 PM
>> To: [EMAIL PROTECTED]
>> Subject: [NoXMail] SpamManager Final now available
>> 
>> 
>> Hi everyone!
>> 
>> First, my sincere thanks to everyone who helped with the beta testing.
>Your
>> input really helped to bring things together.
>> 
>> We posted the final version (for now) today at
>> http://www.spammanager.com/imail/
>> 
>> Complete documentation is also now available.
>> 
>> Press releases go out at 8am eastern time tomorrow.
>> 
>> This list will be shut down shortly but a new one is up. To join the new
>list,
>> please send an email to: [EMAIL PROTECTED]
>> 
>> Also, the new address for off list support is [EMAIL PROTECTED]
>ions!
>Three
>> of our techs spent the weekend reading the docs and I will be training
>them
>> this week. I will be monitoring all messages coming in and for now I will
>> probably be answering most of the questions as well until the others get
>up to
>> speed.
>> 
>> It looks like the next thing to go into beta will be the SMTP
>relay/gateway
>> for both Windows and Linux. The gateway portion is complete and it is just
>a
>> matter of plugging in the SpamManager functions. So if anyone is
>interested in
>> that, be sure to let me know.
>> 
>> Thanks again and we'll see you on the new list!
>> 
>> -Brian
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>ware]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] SpamManager Final now available

[Brian Milburn]

Hi Bill,
 
On 02/10/03 6:27pm you wrote...
>Thanks, Brian, for the excellent product support you have provided
>throughout this beta cycle, I think you have done a great job!

Thanks, actually I have enjoyed this more than most beta tests! Usually we are
working with real computer novices.

>Pricing question before you drop this list.  I was looking at the pricing on
>the SpamManager site and was wondering if you would be providing a lite
>version for people who use SM as just another test within Declude?  Or is
>this what you are referring to when you talk about beta testing the "SMTP
>relay/gateway"?

Declude versions have been a real difficult thing to figure out. I have the
capability of producing a version with a lot of management capabilities
disabled. The problem for us is how to sell it. If we offer it on our web
site, we will create a lot of confusion. We already have 2 other versions for
small shareware mail servers and we can't sell those either. We used these to
work out the procedures for porting to other server platforms, and shareware
guys are usually more than happy to work with us.

I'll need to ask Scott about this, but what we might be able to do is see if
we can work a deal with Scott to be the exclusive reseller of the Declude
version. That way we can offer something with unlimited use, at a reasonable
price and not have to justify this to other customers who may use IMail alone
or some other mail server.

>I would be interested in beta testing both the Windows and Linux versions of
>the "SMTP relay/gateway" when they are available.

Sure, actually the gateway version is full MTA. It can be used as a store and
forward or a relay server. I am going to make it work with Declude Virus (at
least the Windows version) so we can offer a gateway filter for incoming email
for all kinds of platforms. I'll let you know when we start testing. Probably
in a month or less. I am going to take a few days off here in March, so maybe
right after that. We go to Yosemite every year in early March. 

-Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] SpamManager Final now available

[Brian Milburn]

 
Hi everyone!

First, my sincere thanks to everyone who helped with the beta testing. Your
input really helped to bring things together.

We posted the final version (for now) today at
http://www.spammanager.com/imail/

Complete documentation is also now available.

Press releases go out at 8am eastern time tomorrow.

This list will be shut down shortly but a new one is up. To join the new list,
please send an email to: [EMAIL PROTECTED] 

Also, the new address for off list support is [EMAIL PROTECTED] .
Finally :-) there will be more people than just me answering questions! Three
of our techs spent the weekend reading the docs and I will be training them
this week. I will be monitoring all messages coming in and for now I will
probably be answering most of the questions as well until the others get up to
speed.

It looks like the next thing to go into beta will be the SMTP relay/gateway
for both Windows and Linux. The gateway portion is complete and it is just a
matter of plugging in the SpamManager functions. So if anyone is interested in
that, be sure to let me know.

Thanks again and we'll see you on the new list!

-Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] License policy

[Brian Milburn]

Hi John,

I had already made allowances for non-metered messages so what I did is to add
common bounce message indicators to the main pattern file. Most, if not all
bounce messages will now be ignored as far as licensing goes. I can update
this from the pattern file updates now so that anything I forgot can be added
at any time.

This is enabled in the final version which is now posted along with full
documentation at http://www.spammanager.com/imail/

Brian
 
On 2/10/2003 8:26am you wrote...
>Morning.
>
>In seeing users with issues where SpamManager stops scanning because of over
>limit, I have been thinking about it.
>
>I am a little concerned with that policy because it could cause problems
>when an unusually high message day occurs.
>
>Example:
>
>Last week, one of our client tried out there new list they have with us
>which has about 4000 addresses on it.
>
>Do to an error in the way Imail handles lists and broken remote mail
>servers, the one message was resent 6 times before I figured out what was
>happening and stopped it. During that time, several thousand
>bounce/remove/unknown messages were received. We normally see SpamManager
>process about 2600 messages per day, but on that day, it processes about
>3700, and that does not include the hundreds that I intercepted in the spool
>file and in the overflow file.
>
>My concern is that in an unusual situation, not all messages will be
>processed. This would occur at the end of the day, when the normal IT person
>in charge of the mail server would not be around.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>ware]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Invalid pointer operation

[Brian Milburn]

Ok, keep an eye out. We may have already fixed it anyway. I have done a little
more optimizing this week.

Brian
 
On 02/07/03 10:52am you wrote...
>Brian, I have not seen any more of the "Invalid pointer operation" entries
>in my logs since doing the update.  I'll keep an eye on the logs and if I
>see anymore I'll turn on debug logging, and also try to send you a copy of a
>message that triggers the log entry.
>
>Thanks!
>
>Bill
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Milburn
>Sent: Friday, February 07, 2003 8:46 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] Invalid pointer operation
>
>
>
>Hi Bill,
>
>Lets try this:
>
>Go to http://www.spammanager.com/imail/downloads.htm and download the latest
>version.
>
>Set your LOGDETAIL to DEVDEBUG
>
>This will give us information about where in the program this error may be
>occurring. I am not sure if it will enable me to fix this without a sample
>message to try, but I will know where to look. That, with the helpful log
>info
>you sent may be enough clues.
>
>Thanks
>
>Brian
> 
>On 02/07/03 12:24am you wrote...
>>Brian, the messages were delivered successfully, so I don't have a copy of
>>an actual message, but here is a sample of the log output from IMail,
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>---
>[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Invalid pointer operation

[Brian Milburn]

Ok, keep an eye out. We may have already fixed it anyway. I have done a little
more optimizing this week.

Brian
 
On 02/07/03 10:52am you wrote...
>Brian, I have not seen any more of the "Invalid pointer operation" entries
>in my logs since doing the update.  I'll keep an eye on the logs and if I
>see anymore I'll turn on debug logging, and also try to send you a copy of a
>message that triggers the log entry.
>
>Thanks!
>
>Bill
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Milburn
>Sent: Friday, February 07, 2003 8:46 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] Invalid pointer operation
>
>
>
>Hi Bill,
>
>Lets try this:
>
>Go to http://www.spammanager.com/imail/downloads.htm and download the latest
>version.
>
>Set your LOGDETAIL to DEVDEBUG
>
>This will give us information about where in the program this error may be
>occurring. I am not sure if it will enable me to fix this without a sample
>message to try, but I will know where to look. That, with the helpful log
>info
>you sent may be enough clues.
>
>Thanks
>
>Brian
> 
>On 02/07/03 12:24am you wrote...
>>Brian, the messages were delivered successfully, so I don't have a copy of
>>an actual message, but here is a sample of the log output from IMail,
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>---
>[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Invalid pointer operation

[Brian Milburn]

Hi Bill,

Lets try this:

Go to http://www.spammanager.com/imail/downloads.htm and download the latest
version.

Set your LOGDETAIL to DEVDEBUG

This will give us information about where in the program this error may be
occurring. I am not sure if it will enable me to fix this without a sample
message to try, but I will know where to look. That, with the helpful log info
you sent may be enough clues.

Thanks

Brian
 
On 02/07/03 12:24am you wrote...
>Brian, the messages were delivered successfully, so I don't have a copy of
>an actual message, but here is a sample of the log output from IMail,

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Fwd: SpamManager WARNING

[Brian Milburn]

Hi Mark,

Yes, when I issued new keys I guessed at the number of messages users were
processing because no one sent me any statistics.

If you could run the NoxAdmin app then cut and paste the statistics page and
send it to me off list, I'll make sure you get the proper license code.

Thanks

Brian
 
On 02/07/03 8:11am you wrote...
>Brian,
>
>Does the message below indicate my mail server is processing more mail than 
>the SpamManger is licensed for?
>
>Mark
>
>
>>From:  <[EMAIL PROTECTED]>
>>To:<[EMAIL PROTECTED]>
>>Date: Fri, 07 Feb 2003 00:00:29 -0500
>>X-CYBERsitter-SpamManager-Out: License Violation
>>Subject: SpamManager WARNING
>>X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1]
>>X-Declude-Spoolname: D3d6d08a100b644c7.SMD
>>X-Note: This E-mail was scanned for spam.
>>X-Spam-Tests-Failed: IPNOTINMX
>>X-Note: This E-mail was sent from localhost ([127.0.0.1]).
>>X-RCPT-TO: <[EMAIL PROTECTED]>
>>
>>
>>WARNING: Your daily message license level is being exceeded.
>>Incoming message scanning will cease when the number of incoming
>>messages exceeds your license level by 20%.
>>
>
>
>Mark Seagroves  voice: (865) 471-3506
>Dir, Campus Computing   fax: (865) 471-3555
>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>ware]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Invalid pointer operation

[Brian Milburn]

Hi Bill,
 
On 02/06/03 5:56pm you wrote...
>Brian, I have been finding many entries like these in my log files and was
>wondering what might be causing them:

>2/6/2003 11:06:48 AM - Db228158000bacbfa.SMDInvalid pointer operation

I have no idea. I searched through 3 months of log files here and could find
no errors of this type at all. I would probably need to have the exact message
to see if I could duplicate the error. 

The fact that you see this is not necessarily a problem. It means that the
error was trapped correctly and that the worst that could happen is that the
message would simply be delivered normally.

We have exception traps all through the program for just this purpose. In a
perfect world we would know exactly what data is coming in, and in what format
it was. I have seen hundreds if not thousands of emails since we started this
that are not even loosely close to a properly formatted email message.

I am sure that whatever causes these is technically fixable, but I would need
to be able to reproduce it somehow.

>Also, can you please explain these entries and what they are looking for in
>the e-mail messages and how a weight value is determined for them:
>Invalid routing
>Excessive Routing

Invalid routing means that in the "Received:" header you may on occasion see
an entry where a local domain is used, but does not match the IP address it
says it is from.

For example the message you sent me has this:

Received: from PSMAIL.pointshare.com [204.189.39.252] by mail.solidoak.com
with ESMTP
  (SMTPD32-7.04) id A1C61B20284; Thu, 06 Feb 2003 17:54:14 -0800

Now if it had this:

Received: from solidoak.com [204.189.39.252] by mail.solidoak.com with ESMTP
  (SMTPD32-7.04) id A1C61B20284; Thu, 06 Feb 2003 17:54:14 -0800

You will see that the domain name says solidoak.com and the IP address is
yours. I can reproduce this here any time I feel like it by creating a message
and using SMTP to send directly to the recipients host server by resolving the
MX record. In this case, the message never goes through any other mail server.
I have yet to see a case where there is a good reason for doing this except to
send spam from locations you want to keep a secret.

Excessive routing is when there are excessive "hops" meaning the message was
probably intentionally routed through several servers. I think Declude uses a
more general term like "headers consistent with spam".

>Are either of the "routing" log entries above controlled by the "BADROUTING"
>configuration setting in the noxmail.nox file?

Yes, the BADROUTING value controls the penalty for "Invalid Routing". It
defaults to 2.

Hope this helps,

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Adult?

[Brian Milburn]

It didn't fail. It passed. Almost any message will generate a score of some
kind. It is the TOTAL score that matters.
 
On 02/04/03 12:47pm you wrote...
>Ok. Semantics. It failed with a 2. How is that? Now, why did it fail?
>
>Craig.
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
>Sent: Tuesday, February 04, 2003 11:53 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] Adult?
>
>
>Where does it show it failed? This line shows it passed:
>
>X-CYBERsitter-NoXMail: Passed - Adult: 2 (Req: 18) Spam: 14 (Req: 18) Tot:
>16 (Req: 20)
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>ware]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New documentation

[Brian Milburn]

Hi Guys,

There is new draft documentation available at:

http://www.spammanager.com/imail/documentation.htm

If anyone cares to look it over the weekend, well it's there. There is just a
few more pages on the utilities to do and we're about done.

Have a good weekend

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Problem with messages being held in the new version

[Brian Milburn]

I believe it will work either way, although I am not sure. We are having a
meeting on Tuesday morning to review the status and I will get more details
exactly how this will work. We are also working on a full MTA gateway that
will work on both Windows and Linux. It will run presumably on a separate box.
We are contracting the basic MTA code from a company that already has done
development in this area, and they are adding the hooks we need for
SpamManager, then we will finish the final implementation in house. All this
is being done in Delphi/Kylix so all the code except the OS specific stuff is
sharable between platforms, including the considerable amount of inline
assembly that is so crucial to performance. This will allow us to easily
maintain versions for both platforms with the same code. The BSD version has
to be translated into ANSI C which is why it will be down the road a bit. I
don't like ANSI C, you can't use any of the slick classes that C++, Delphi, or
Kylix has built in. Everything takes a lot longer.

-Brian
 
On 01/30/03 6:28pm you wrote...
>Brian
>Is your LINUX solution going to be a stand alone solution or is it going to
>depend on a local mail server (on the same box)? I was envisioning a scan
>server that forwards to another server for final delivery or distribution.
>Your comment about BSD made me wonder what you had in mind? I too am anxious
>for the LINUX version.
>
>I'm sure someone could teach the JUNO folks about LINUX. ;)
>
>
>David
>
>> -Original Message-
>> From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>> Sent: Thursday, January 30, 2003 6:24 PM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] Problem with messages being held in the new
>> version
>>
>>
>>
>> What's that my grandmother used to say... from your lips to Gods ear?
>>
>> Actually though, we have a better than excellent shot with Juno. They have
>> been a good customer of ours for several years and refer all
>> their users to us
>> for filtering software. They have asked us several times for an
>> anti-porn/spam
>> email solution. They run BSD though, and that is not going ready
>> for awhile.
>>
>> -Brian
>>
>>
>>
>> On 01/30/03 12:32pm you wrote...
>> >Now, if we could just convince AOL...
>> >
>> >John Tolmachoff MCSE, CSSA
>> >IT Manager, Network Engineer
>> >RelianceSoft, Inc.
>> >Fullerton, CA  92835
>> >www.reliancesoft.com
>> >
>> >
>> >> -Original Message-
>> >> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> >> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> >> Sent: Thursday, January 30, 2003 12:04 PM
>> >> To: [EMAIL PROTECTED]
>> >> Subject: RE: [NoXMail] Problem with messages being held in the
>> new version
>> >>
>> >>
>> >> Hi Bill,
>> >>
>> >> On 01/30/03 2:31pm you wrote...
>> >> >Thanks - that did the trick.
>> >>
>> >> Excellent!
>> >>
>> >> >How did your presentation(s) go?
>> >>
>> >> So far so good. We have a couple of ISPs that are going to dump Postini
>> >when
>> >> we finish the Postfix version. Actually it works now, but we
>> have a lot of
>> >> details to look at. Linux is not my thing, so I have to go through
>> >everything
>> >> with other programmers who have done pretty much a literal translation.
>> >>
>> >> What we are going to try to push is an
>> >> IMail/Declude(Junkmail/Virus)/CYBERsitter platform. We have a new
>> >rackmount
>> >> dual processor raid5 system coming today that we are going to
>> set up for
>> >> demonstrations. I am totally convinced that small to mid sized
>> ISPs could
>> >run
>> >> this platform with exceptional results. It is so much easier to manage,
>> >and
>> >> train people to manage, plus with the mailing lists, support is almost
>> >> instantaneous. Even on Christmas! The hardest part will be to convince
>> >> died-in-the-wool linux admins that this will make their jobs infinitely
>> >> easier. Of course, with things so competitive these days in the ISP
>> >market,
>> >> this wouldn't be a hard sell at all to the corporate officers.
>> >>
>> >> Next week we will demo to Cox-Internet, not the whole company, but the
>> >> business division based here in Santa Barbara. They may sell our
>> >recommended
>>

Re: [NoXMail] Problem with messages being held in the new version

[Brian Milburn]

Thanks Bill,

Actually all we have to do is finish up the file storage stuff. It is a lot
different than Windows because we are operating on the StdInput instead of a
file, and are outputting as StdOutput to Postfix, (I think that is what it's
called anyway). 

All the filtering works, and it would probably work right now as a simple
test, but we want to enable all the message hold/trash retrieval features.
Some of the utilities are not needed because they can be set up as cron
(chron?) jobs. (I'm not a Linux guy).

I will keep you informed.

-Brian 

On 01/30/03 2:02pm you wrote...
>Good luck Brian!  And don't forget to let me know when that Linux/Postfix
>version is ready for testing.  I run three Linux/Postfix gateways, and would
>love to implement something like SpamManager on them.
>
>Bill
>- Original Message -
>From: "Brian Milburn" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Thursday, January 30, 2003 12:04 PM
>Subject: RE: [NoXMail] Problem with messages being held in the new version
>
>
>>
>> Hi Bill,
>>
>> On 01/30/03 2:31pm you wrote...
>> >Thanks - that did the trick.
>>
>> Excellent!
>>
>> >How did your presentation(s) go?
>>
>> So far so good. We have a couple of ISPs that are going to dump Postini
>when
>> we finish the Postfix version. Actually it works now, but we have a lot of
>> details to look at. Linux is not my thing, so I have to go through
>everything
>> with other programmers who have done pretty much a literal translation.
>>
>> What we are going to try to push is an
>> IMail/Declude(Junkmail/Virus)/CYBERsitter platform. We have a new
>rackmount
>> dual processor raid5 system coming today that we are going to set up for
>> demonstrations. I am totally convinced that small to mid sized ISPs could
>run
>> this platform with exceptional results. It is so much easier to manage,
>and
>> train people to manage, plus with the mailing lists, support is almost
>> instantaneous. Even on Christmas! The hardest part will be to convince
>> died-in-the-wool linux admins that this will make their jobs infinitely
>> easier. Of course, with things so competitive these days in the ISP
>market,
>> this wouldn't be a hard sell at all to the corporate officers.
>>
>> Next week we will demo to Cox-Internet, not the whole company, but the
>> business division based here in Santa Barbara. They may sell our
>recommended
>> platform into their fiber customer base. From there, maybe we can get the
>> whole thing!!
>>
>> Brian
>>
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>>
>> ---
>> [This e-mail was scanned for viruses by Pointshare's Virus Scanning
>Service]
>>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Problem with messages being held in the new version

[Brian Milburn]

What's that my grandmother used to say... from your lips to Gods ear?

Actually though, we have a better than excellent shot with Juno. They have
been a good customer of ours for several years and refer all their users to us
for filtering software. They have asked us several times for an anti-porn/spam
email solution. They run BSD though, and that is not going ready for awhile. 

-Brian


 
On 01/30/03 12:32pm you wrote...
>Now, if we could just convince AOL...
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Thursday, January 30, 2003 12:04 PM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] Problem with messages being held in the new version
>> 
>> 
>> Hi Bill,
>> 
>> On 01/30/03 2:31pm you wrote...
>> >Thanks - that did the trick.
>> 
>> Excellent!
>> 
>> >How did your presentation(s) go?
>> 
>> So far so good. We have a couple of ISPs that are going to dump Postini
>when
>> we finish the Postfix version. Actually it works now, but we have a lot of
>> details to look at. Linux is not my thing, so I have to go through
>everything
>> with other programmers who have done pretty much a literal translation.
>> 
>> What we are going to try to push is an
>> IMail/Declude(Junkmail/Virus)/CYBERsitter platform. We have a new
>rackmount
>> dual processor raid5 system coming today that we are going to set up for
>> demonstrations. I am totally convinced that small to mid sized ISPs could
>run
>> this platform with exceptional results. It is so much easier to manage,
>and
>> train people to manage, plus with the mailing lists, support is almost
>> instantaneous. Even on Christmas! The hardest part will be to convince
>> died-in-the-wool linux admins that this will make their jobs infinitely
>> easier. Of course, with things so competitive these days in the ISP
>market,
>> this wouldn't be a hard sell at all to the corporate officers.
>> 
>> Next week we will demo to Cox-Internet, not the whole company, but the
>> business division based here in Santa Barbara. They may sell our
>recommended
>> platform into their fiber customer base. From there, maybe we can get the
>> whole thing!!
>> 
>> Brian
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Problem with messages being held in the new version

[Brian Milburn]

Hi Bill,
 
On 01/30/03 2:31pm you wrote...
>Thanks - that did the trick.

Excellent!

>How did your presentation(s) go?

So far so good. We have a couple of ISPs that are going to dump Postini when
we finish the Postfix version. Actually it works now, but we have a lot of
details to look at. Linux is not my thing, so I have to go through everything
with other programmers who have done pretty much a literal translation.

What we are going to try to push is an
IMail/Declude(Junkmail/Virus)/CYBERsitter platform. We have a new rackmount
dual processor raid5 system coming today that we are going to set up for
demonstrations. I am totally convinced that small to mid sized ISPs could run
this platform with exceptional results. It is so much easier to manage, and
train people to manage, plus with the mailing lists, support is almost
instantaneous. Even on Christmas! The hardest part will be to convince
died-in-the-wool linux admins that this will make their jobs infinitely
easier. Of course, with things so competitive these days in the ISP market,
this wouldn't be a hard sell at all to the corporate officers.

Next week we will demo to Cox-Internet, not the whole company, but the
business division based here in Santa Barbara. They may sell our recommended
platform into their fiber customer base. From there, maybe we can get the
whole thing!!

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Problem with messages being held in the new version

[Brian Milburn]

 
Un-comment these 2 entries and then no message will be sent and no messages
will be held.

#SPAMMESSAGENONE
#ADULTMESSAGE   NONE

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New License Keys

[Brian Milburn]

Hi Bill,

Sorry, I didn't post the address yesterday, we had a little bug with the
license keys to work out.

The address for the latest version is

http://www.spammanager.com/imail/cssmbeta.zip

Anyone who has their new LICENSE and KEY codes can download and use this
version.

Please check the NOXMAIL.NOX file. It is now commented with references for
normal and Declude specific (Declude test only) installations.

-Brian

 
On 01/29/03 7:38am you wrote...
>Where is the new post?
>
>I downloaded from the traditional http://www.noxmail.com/imail/noxbeta.zip
>and it seems to be the same old, same old (1/13/03).
>
>Thanks in advance for your help and good luck with the sales.
>
>-Bill Naber
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>Sent: Wednesday, January 29, 2003 12:12 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] New License Keys
>
>
>
>Sorry, I gave you the wrong information. I am not using it as just a test
>and
>I forget all the Declude specific tweaks that have to be done.
>
>What is needed is to have no value for SPAMMESSAGE and ADULTMESSAGE, but not
>commented out. Just delete the MOVEDIR line entirely.
>
>I just posted a new version and it will now make more sense.
>
>Add
>
>SPAMMESSAGE NONE
>ADULTMESSAGE NONE
>
>and that will cause the hold functions to be ignored because no message is
>then defined to send to the end user.
>
>In the final clean up I have put defaults in for almost all of the values
>for
>the configuration file. There are really only about 4 that the user actually
>needs. I typically do not do this until the final cleanup because you don't
>always know what the best defaults are.
>
>Previously, if the SPAMMESSAGE and/or ADULTMESSAGE were commented out, it
>defaulted to nothing. Now it defaults to DEFAULT which is how the majority
>of
>people will use this. A space would have worked, but I added NONE (or NO
>also
>works) to make it more clear.
>
>Sorry for the confusion.
>
>Brian
>
>
>On 01/28/03 8:09pm you wrote...
>>It also appears that the messages are still being held, or deleted, since
>>they are not delivered and I don't see them anywhere in the NoXMail
>>directory--ouch!  For now I have reverted back to the previous version.
>>
>>Bill
>>
>>-Original Message-
>>From: [EMAIL PROTECTED]
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry
>>Sent: Tuesday, January 28, 2003 8:00 PM
>>To: [EMAIL PROTECTED]
>>Subject: RE: [NoXMail] New License Keys
>>
>>
>>Well, that stopped the messages from being held, however, it's still
>sending
>>out the notification messages, even though there is now nothing for the
>user
>>to retrieve, which should cause lots of confusion and frustration to our
>>customers.  Why the undocumented changes in this update?
>>
>>Bill
>>
>>-Original Message-
>>From: [EMAIL PROTECTED]
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Milburn
>>Sent: Tuesday, January 28, 2003 5:28 PM
>>To: [EMAIL PROTECTED]
>>Subject: Re: [NoXMail] New License Keys
>>
>>
>>
>>
>>Bill, when you define MOVEDIR put a couple of spaces after it just to be
>>safe.
>>I haven't tested this in awhile.
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>>
>>---
>>[This e-mail was scanned for viruses by Pointshare's Virus Scanning
>Service]
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>>
>>---
>>[This e-mail was scanned for viruses by Pointshare's Virus Scanning
>Service]
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] NoXMUpd.exe no longer works...

[Brian Milburn]

No, actually, it just needed to be recompiled because it used the same
validation code as noxmail.exe. When one broke, both did. Oh, well, the day
ends with no open issues!

Thanks for your help.

Brian
 
On 01/29/03 7:48pm you wrote...
>That did it:
>
>==
>1/29/2003 7:39:08 PM - M:\IMail\Declude\TPA\NoXMail\noxmail.pat (58030
>bytes) updated successfully.
>1/29/2003 7:39:08 PM - M:\IMail\Declude\TPA\NoXMail\noxspam.pat (346741
>bytes) updated successfully.
>==
>
>I did update all of the files included in the download yesterday, including
>the noxmupd.exe file.  Oh well, we seem to be good to go for now...
>
>Thanks again!
>
>Bill
>----- Original Message -
>From: "Brian Milburn" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Wednesday, January 29, 2003 7:28 PM
>Subject: Re: [NoXMail] NoXMUpd.exe no longer works...
>
>
>>
>> Try this one, maybe you didn't get the one with the new licensing code
>checks.
>>
>> Brian
>>
>> On 01/29/03 7:19pm you wrote...
>> >Hmmm, yep, ran noxmupd twice and got two errors in the log file:
>> >
>> >=
>> >1/29/2003 7:13:50 PM - [ERROR] LICENSE EXPIRED
>> >1/29/2003 7:16:59 PM - [ERROR] LICENSE EXPIRED
>> >=
>> >
>> >However, NoXMail is processing e-mail messages fine.  Strange, eh?
>> >
>> >Bill
>> >- Original Message -
>> >From: "Brian Milburn" <[EMAIL PROTECTED]>
>> >To: <[EMAIL PROTECTED]>
>> >Sent: Wednesday, January 29, 2003 6:48 PM
>> >Subject: Re: [NoXMail] NoXMUpd.exe no longer works...
>> >
>> >
>> >>
>> >> Hi Bill,
>> >>
>> >> Does your log file have any entries regarding the updates? If there is
>an
>> >> error, it should be recorded and likewise will also record a successful
>> >> transfer.
>> >>
>> >> On 01/29/03 6:39pm you wrote...
>> >> >Hi Brian,
>> >> >
>> >> >Me again, sorry to be such a pain-in-the-@$$.  However, since running
>the
>> >> >newest versions of NoXMail (from yesterday and today), I have not been
>> >able
>> >> >to get noxmupd to do an update of the .pat files.  When I execute
>noxmupd
>> >> >the cursor returns almost immediately and the file sizes and dates
>never
>> >> >change.  Suggestions?
>> >> >
>> >> >Thanks,
>> >> >
>> >> >Bill
>> >> >
>> >> >---
>> >> >[This E-mail scanned for viruses by Solid Oak Software]
>> >> >
>> >> >
>> >> >Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> >> >Removal address: [EMAIL PROTECTED]
>> >>
>> >> ---
>> >> [This E-mail scanned for viruses by Solid Oak Software]
>> >>
>> >>
>> >> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> >> Removal address: [EMAIL PROTECTED]
>> >>
>> >> ---
>> >> [This e-mail was scanned for viruses by Pointshare's Virus Scanning
>> >Service]
>> >>
>> >
>> >---
>> >[This E-mail scanned for viruses by Solid Oak Software]
>> >
>> >
>> >Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> >Removal address: [EMAIL PROTECTED]
>>
>>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] NoXMUpd.exe no longer works...

[Brian Milburn]

Try this one, maybe you didn't get the one with the new licensing code checks.

Brian
 
On 01/29/03 7:19pm you wrote...
>Hmmm, yep, ran noxmupd twice and got two errors in the log file:
>
>=
>1/29/2003 7:13:50 PM - [ERROR] LICENSE EXPIRED
>1/29/2003 7:16:59 PM - [ERROR] LICENSE EXPIRED
>=
>
>However, NoXMail is processing e-mail messages fine.  Strange, eh?
>
>Bill
>- Original Message -
>From: "Brian Milburn" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Wednesday, January 29, 2003 6:48 PM
>Subject: Re: [NoXMail] NoXMUpd.exe no longer works...
>
>
>>
>> Hi Bill,
>>
>> Does your log file have any entries regarding the updates? If there is an
>> error, it should be recorded and likewise will also record a successful
>> transfer.
>>
>> On 01/29/03 6:39pm you wrote...
>> >Hi Brian,
>> >
>> >Me again, sorry to be such a pain-in-the-@$$.  However, since running the
>> >newest versions of NoXMail (from yesterday and today), I have not been
>able
>> >to get noxmupd to do an update of the .pat files.  When I execute noxmupd
>> >the cursor returns almost immediately and the file sizes and dates never
>> >change.  Suggestions?
>> >
>> >Thanks,
>> >
>> >Bill
>> >
>> >---
>> >[This E-mail scanned for viruses by Solid Oak Software]
>> >
>> >
>> >Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> >Removal address: [EMAIL PROTECTED]
>>
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>>
>> ---
>> [This e-mail was scanned for viruses by Pointshare's Virus Scanning
>Service]
>>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]



NoXMUpd.zip
Description: Zip compressed data

Re: [NoXMail] NoXMUpd.exe no longer works...

[Brian Milburn]

Hi Bill,

Does your log file have any entries regarding the updates? If there is an
error, it should be recorded and likewise will also record a successful
transfer.
 
On 01/29/03 6:39pm you wrote...
>Hi Brian,
>
>Me again, sorry to be such a pain-in-the-@$$.  However, since running the
>newest versions of NoXMail (from yesterday and today), I have not been able
>to get noxmupd to do an update of the .pat files.  When I execute noxmupd
>the cursor returns almost immediately and the file sizes and dates never
>change.  Suggestions?
>
>Thanks,
>
>Bill
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] License ?

[Brian Milburn]

No, it shouldn't be missing any any more. If there are errors, they will be
put in the \errors folder. You can then redeliver them if you want using
noxadmin.exe. This number refers to non-spam, incoming message only. Not to
total emails. You should be able to see how many actual incoming non-spam
emails you get using the noxstats.exe program.
 
On 01/29/03 3:43pm you wrote...
>Brian,
>
>I'm getting the message below in the log file.  I'm averaging 7000 e-mails 
>per day and hit 10,000 on a good/bad day.  Could this be the reason noxmail 
>(sorry... SpamManager) is missing some e-mails?
>
>Thanks.
>
>mark
>
>
>1/29/2003 8:01:50 AM - Licensed to process 5000 legitimate messages daily.
>1/29/2003 8:01:50 AM - License expires in 92 days.
>
>
>
>
>
>Mark Seagroves  voice: (865) 471-3506
>Dir, Campus Computing   fax: (865) 471-3555
>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
>e
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] SpamManager LICENSE EXCEEDED

[Brian Milburn]

Bill,

Approximately how many legitimate messages are you processing daily? 

I can generate a new key for you.
 
On 01/29/03 7:24am you wrote...
>And now this one:
>
>==
>WARNING: Your daily message license level has been exceeded.
>Incoming message scanning has been terminated for today.
>Your incoming messages exceeded your license by the allowable
>20%. Please visit http://www.spammanager.com/upgrades/ to upgrade
>your license to prevent future violations.
>==
>
>Bill
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New License Keys

[Brian Milburn]

Bill,

I forgot to mention that I included comments in the NOXMAIL.NOX file included
in the archive file that indicate what to use when using as a Declude test
only.

Hopefully I won't forget to do this again. Things are getting busy now with
schools back in for the 2nd semester and there is always a lot of work to do
in January.

Plus, we are starting to do in house demos of NoXMail (now CYBERsitter
SpamManager) for some larger ISPs (got a really big one coming on Tuesday) and
my mind is not always tuned in to every nuance it should be.

Brian


---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New License Keys

[Brian Milburn]

Sorry, I gave you the wrong information. I am not using it as just a test and
I forget all the Declude specific tweaks that have to be done.

What is needed is to have no value for SPAMMESSAGE and ADULTMESSAGE, but not
commented out. Just delete the MOVEDIR line entirely.

I just posted a new version and it will now make more sense.

Add

SPAMMESSAGE NONE
ADULTMESSAGE NONE

and that will cause the hold functions to be ignored because no message is
then defined to send to the end user.

In the final clean up I have put defaults in for almost all of the values for
the configuration file. There are really only about 4 that the user actually
needs. I typically do not do this until the final cleanup because you don't
always know what the best defaults are.

Previously, if the SPAMMESSAGE and/or ADULTMESSAGE were commented out, it
defaulted to nothing. Now it defaults to DEFAULT which is how the majority of
people will use this. A space would have worked, but I added NONE (or NO also
works) to make it more clear. 

Sorry for the confusion. 

Brian

 
On 01/28/03 8:09pm you wrote...
>It also appears that the messages are still being held, or deleted, since
>they are not delivered and I don't see them anywhere in the NoXMail
>directory--ouch!  For now I have reverted back to the previous version.
>
>Bill
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry
>Sent: Tuesday, January 28, 2003 8:00 PM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] New License Keys
>
>
>Well, that stopped the messages from being held, however, it's still sending
>out the notification messages, even though there is now nothing for the user
>to retrieve, which should cause lots of confusion and frustration to our
>customers.  Why the undocumented changes in this update?
>
>Bill
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Milburn
>Sent: Tuesday, January 28, 2003 5:28 PM
>To: [EMAIL PROTECTED]
>Subject: Re: [NoXMail] New License Keys
>
>
> 
>
>Bill, when you define MOVEDIR put a couple of spaces after it just to be
>safe.
>I haven't tested this in awhile.
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>---
>[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>---
>[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] New License Keys

[Brian Milburn]

 

Bill, when you define MOVEDIR put a couple of spaces after it just to be safe.
I haven't tested this in awhile.

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] New License Keys

[Brian Milburn]

Hi Bill,

Define a value in your NOXMAIL.NOX file like this:


MOVEDIR

nothing else. It should be blank.

Badrouting detects instances where the received headers show it coming from
your domain but not your IP address. It is pretty effective. You can change
the value to any point value you want. 

DECLUDETESTONLY causes it to return a negative result for adult and a positive
result for spam.


 
On 01/28/03 4:34pm you wrote...
>Brian, I have upgraded to the latest version and am now seeing messages with
>subjects like the following being sent out to users:
>
>Rejected email notification:: NXBDE42E97
>
>There was not PDF file in the latest download, but I don't want to hold
>messages or send out these messages to customers.  I am using this with
>Declude JunkMail and only as a JunkMail test.  Here is how I have my
>NoxMail.Nox file configured:
>
>==
>DECLUDETESTONLY  TRUE
>#BADROUTING   12
>SCANOUTGOING   FALSE
>#SENDREJECTION   TRUE
>ALLOWRELAYTRUE
>REPORTSTO   [EMAIL PROTECTED]
>REPORTTITLE   SpamManager Report
>NONENGLISH   6
>THRESHOLD4
>PATMATCHES   2
>SATURATION   5
>LOGALLFAILURES   TRUE
>ADULTSCORE   20
>SPAMSCORE20
>EXITCODESCORE25
>#KILLSCORE100
>#ROUTESPAM   [EMAIL PROTECTED]
>#ROUTEADULT   [EMAIL PROTECTED]
>#ROUTEADULTSCORE  50
>#ADULTKILLSCORE   45
>#SPAMKILLSCORE65
>#SPAMMESSAGE  DEFAULT
>#ADULTMESSAGE DEFAULT
>POSTMASTER   [EMAIL PROTECTED]
>#ADULTSUBJECT [ADULT]
>#SPAMSUBJECT  [SPAM]
>ADDHEADER  TRUE
>LOGDETAILHIGH
>==
>
>What do I need to change or add in order to stop holding messages and
>sending spam notifications?  Also, can you please explain what the
>DECLUDETESTONLY and BADROUTING config entries do.
>
>Thanks,
>
>Bill
>
>- Original Message -
>From: "Brian Milburn" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Tuesday, January 28, 2003 1:29 PM
>Subject: [NoXMail] New License Keys
>
>
>>
>> Just a reminder, if you haven't already done so, please send me your
>primary
>> IMail server IP address so that I can send out new license keys.
>>
>> I want to post a new version, however, I have only received a few
>responses
>> from you guys with your IP addresses. I would prefer to have the keys out
>to
>> you in advance.
>>
>> Thanks
>>
>> -Brian
>>
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>>
>> ---
>> [This e-mail was scanned for viruses by Pointshare's Virus Scanning
>Service]
>>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] missing ROUTESPAMSCORE in latest version?

[Brian Milburn]

It is still supported, just copy it over from your old file. I probably left
them out. Not many people use it because it is easier to hold them and check
them with the noxadmin program. It allows you to view and deliver them if you
like without the overhead of all those messages coming to your own computer.
 
On 01/28/03 7:11pm you wrote...
>Brian,
>
>I don't see ROUTESPAMSCORE in the latest version.  ROUTEADULTSCORE is there 
>though.  Was it just left out of the .nox file?
>
>Mark
>
>
>Mark Seagroves  voice: (865) 471-3506
>Dir, Campus Computing   fax: (865) 471-3555
>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
>e
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] filtering working intermittently?

[Brian Milburn]

Actually this one was from John.
 
On 01/28/03 6:50pm you wrote...
>Thanks Brian.
>
>Mark
>
>
>At 02:27 PM 1/28/2003, you wrote:
>
>>Mark, I will put together an information sheet together, as I have even 
>>changed it a bit since I wrote the one up before that Brian is using.
>>
>>
>>
>>Give me a day or so.
>>
>>
>>
>>John Tolmachoff  MCSE, CSSA
>>
>>IT Manager, Network Engineer
>>
>>211 E. Imperial Hwy, Suite 106
>>
>>Fullerton, CA  92835
>>
>>562-694-4800, ext. 104
>>
>>[EMAIL PROTECTED]
>>
>>www.reliancesoft.com
>>
>>
>>
>>
>>
>>-Original Message-
>>From: [EMAIL PROTECTED] 
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Seagroves
>>Sent: Tuesday, January 28, 2003 1:35 PM
>>To: [EMAIL PROTECTED]
>>Subject: RE: [NoXMail] filtering working intermittently?
>>
>>
>>
>>John,
>>
>>Are you referring to the Declude global.cfg settings?  If so, I've never 
>>been clear on how these work.  Any light you could shed on this would be 
>>appreciated (specifically the interaction between declude and noxmail).
>>
>>Thanks.
>>
>>Mark
>>
>>
>>At 12:26 PM 1/28/2003, you wrote:
>>
>>
>>Mark, I would recommend changing from using 2 weight tests to using a 
>>combination of weightrange and weight.
>>
>>
>>
>>WEIGHTRANGE10-19  WEIGHTRANGE X X 10 19
>>
>>WEIGHTRANGE20-29  WEIGHTRANGE X X 20 29
>>
>>WEIGHT30   WEIGHT X X 30 0
>>
>>
>>
>>Having Weight10 and Weight20 and so forth could cause action problems.
>>
>>
>>
>>Not sure if this would cause this, just something I noticed.
>>
>>
>>
>>John Tolmachoff MCSE, CSSA
>>
>>IT Manager, Network Engineer
>>
>>RelianceSoft, Inc.
>>
>>Fullerton, CA  92835
>>
>>www.reliancesoft.com
>>
>>
>>
>>-Original Message-
>>From: [EMAIL PROTECTED] 
>>[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Seagroves
>>Sent: Tuesday, January 28, 2003 12:09 PM
>>To: [EMAIL PROTECTED]
>>Subject: [NoXMail] filtering working intermittently?
>>
>>
>>
>>Brian,
>>
>>Since last Thurs or so, noxmail seems to be allowing some adult & spam 
>>e-mails to go through.  I received a couple of calls from users on Friday 
>>that they had received some porn e-mails.  I double-checked all settings 
>>on Sat and finally stopped/restarted the IMail SMTP service.  This seemed 
>>to fix the problem for the moment.  However, yesterday I saw some more 
>>adult/spam messages slip through and I rebooted our e-mail server, again 
>>after checking everything first.  That seemed to cause the filtering to 
>>work properly again.  This morning, I thought I saw some more e-mails slip 
>>through but I sent myself a couple (one "adult" and one "spam") from an 
>>off-campus address and they were filtered correctly.  I currently have all 
>>adult & spam e-mail sent to a spam account.  This account is getting 
>>messages but some are apparently still slipping through.  I just received 
>>a spam e-mail from e-bay.  Below are the spam e-mail header and log 
>>snippet from noxmail.  I can send you the .nox config file or other files 
>>if needed.  I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 
>>to the e-bay message should have been routed.  The spam mailbox did catch 
>>this same e-mail to 7 other recipients (however, the total weight was 40 
>>instead of 45).
>>
>>Any suggestions?
>>
>>Thanks.
>>
>>Mark
>>
>>
>>NOXMAIL log snippet:
>>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores - 
>>Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM: 
>><[EMAIL PROTECTED]>
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a 
>>fortune, mseagroves!
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 
>>penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent 
>>with SPAM: 1 penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 
>>5 penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image 
>>links: 14 penalty points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty 
>>points added.
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - 
>>Matched:  (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms - 
>>Msg Size: 19300 bytes
>>
>>
>>
>>
>>Mail Header:
>>
>>To: [EMAIL PROTECTED]
>>Subject: [S] Don't spend a fortune, mseagroves!
>>From: "eBay" <[EMAIL PROTECTED]>
>>Date: Tue, 28 Jan 2003 11:29:04 -0800
>>Reply-To: "eBay" <[EMAIL PROTECTED]>
>>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 
>>18) Tot: 45 (Req: 20)
>>X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
>>X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
>>X-RBL-Warning: HELOBOGUS: Domain CNCFWblu

[NoXMail] New License Keys

[Brian Milburn]

Just a reminder, if you haven't already done so, please send me your primary
IMail server IP address so that I can send out new license keys.

I want to post a new version, however, I have only received a few responses
from you guys with your IP addresses. I would prefer to have the keys out to
you in advance.

Thanks

-Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] filtering working intermittently?

[Brian Milburn]

I noticed a couple of other things here:

The message was probably sent to you with BCC's to the other people.

1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a 
fortune, mseagroves!

Here is  ^^ is your login name


1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 
5 penalty points added.

Here ^^ is why the 5 points was added to yours and not the others. Your login
name was used in the message subject to make it look 'personal'.

Maybe you should send me your NOXMAIL.NOX file so I can have a look-see. 

-Brian


On 01/28/03 3:09pm you wrote...
>Brian,
>
>Since last Thurs or so, noxmail seems to be allowing some adult & spam 
>e-mails to go through.  I received a couple of calls from users on Friday 
>that they had received some porn e-mails.  I double-checked all settings on 
>Sat and finally stopped/restarted the IMail SMTP service.  This seemed to 
>fix the problem for the moment.  However, yesterday I saw some more 
>adult/spam messages slip through and I rebooted our e-mail server, again 
>after checking everything first.  That seemed to cause the filtering to 
>work properly again.  This morning, I thought I saw some more e-mails slip 
>through but I sent myself a couple (one "adult" and one "spam") from an 
>off-campus address and they were filtered correctly.  I currently have all 
>adult & spam e-mail sent to a spam account.  This account is getting 
>messages but some are apparently still slipping through.  I just received a 
>spam e-mail from e-bay.  Below are the spam e-mail header and log snippet 
>from noxmail.  I can send you the .nox config file or other files if 
>needed.  I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 to 
>the e-bay message should have been routed.  The spam mailbox did catch this 
>same e-mail to 7 other recipients (however, the total weight was 40 instead 
>of 45).
>
>Any suggestions?
>
>Thanks.
>
>Mark
>
>
>NOXMAIL log snippet:
>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores - 
>Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM: 
><[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a 
>fortune, mseagroves!
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 penalty 
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent 
>with SPAM: 1 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 
>5 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image 
>links: 14 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty 
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - 
>Matched:  (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms - 
>Msg Size: 19300 bytes
>
>
>
>
>Mail Header:
>
>To: [EMAIL PROTECTED]
>Subject: [S] Don't spend a fortune, mseagroves!
>From: "eBay" <[EMAIL PROTECTED]>
>Date: Tue, 28 Jan 2003 11:29:04 -0800
>Reply-To: "eBay" <[EMAIL PROTECTED]>
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 18) 
>Tot: 45 (Req: 20)
>X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
>X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
>X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam 
>[420e].
>X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
>X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
>X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-Declude-Spoolname: Dda50019700ce4425.SMD
>X-Note: This E-mail was scanned for spam.
>X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT10, WEIGHT20, 
>CYBERSITTER
>X-Note: This E-mail was sent from (Private IP) ([10.1.1.10]).
>X-RCPT-TO: <[EMAIL PROTECTED]>
>
>
>
>Mark Seagroves  voice: (865) 471-3506
>Dir, Campus Computing   fax: (865) 471-3555
>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] filtering working intermittently?

[Brian Milburn]

Hi Mark,

The only thing I can figure is that for some reason NoXMail cannot send the
message via SMTP. Whenever it "sends" something, whether a hold message,
re-routing a message, etc., it uses SMTP and does not use the IMail queue. 

What could happen it that for some reason, IMail did not accept the message.
The fact that you had one where 7 of them were re-routed and 1 got through,
and the fact that the headers were modified, leads me to believe that this may
be the case. In the event of any failure, such as an SMTP failure, the message
is not deleted, it is simply left in the spool folder. That could be why the
message was apparently processed but delivered anyway.

When sending anything via SMTP it only tries once. So if for some reason the
server does not respond, the sending process is aborted. This is to avoid
endless loops in the event of a misconfiguration or if the SMTP service is
stopped and processor time being gobbled up.

The next version I will post has some additional error reporting. Technically,
it is called "exception trapping" and I have added numerous error messages to
the exception traps where there were no messages before. Ideally you should
never see an error message, so my style is to typically leave many of the
error messages out until one of the last steps.

About the only thing I can suggest is that you inspect your IMail log at about
the same time and see if there are any unusual entries. Unless there is
something there that indicates a specific error condition, I am willing to bet
that the SMTP service simply did not respond.

-Brian

 
On 01/28/03 3:09pm you wrote...
>Brian,
>
>Since last Thurs or so, noxmail seems to be allowing some adult & spam 
>e-mails to go through.  I received a couple of calls from users on Friday 
>that they had received some porn e-mails.  I double-checked all settings on 
>Sat and finally stopped/restarted the IMail SMTP service.  This seemed to 
>fix the problem for the moment.  However, yesterday I saw some more 
>adult/spam messages slip through and I rebooted our e-mail server, again 
>after checking everything first.  That seemed to cause the filtering to 
>work properly again.  This morning, I thought I saw some more e-mails slip 
>through but I sent myself a couple (one "adult" and one "spam") from an 
>off-campus address and they were filtered correctly.  I currently have all 
>adult & spam e-mail sent to a spam account.  This account is getting 
>messages but some are apparently still slipping through.  I just received a 
>spam e-mail from e-bay.  Below are the spam e-mail header and log snippet 
>from noxmail.  I can send you the .nox config file or other files if 
>needed.  I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 to 
>the e-bay message should have been routed.  The spam mailbox did catch this 
>same e-mail to 7 other recipients (however, the total weight was 40 instead 
>of 45).
>
>Any suggestions?
>
>Thanks.
>
>Mark
>
>
>NOXMAIL log snippet:
>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores - 
>Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM: 
><[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a 
>fortune, mseagroves!
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 penalty 
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent 
>with SPAM: 1 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables: 
>5 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image 
>links: 14 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty 
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - 
>Matched:  (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms - 
>Msg Size: 19300 bytes
>
>
>
>
>Mail Header:
>
>To: [EMAIL PROTECTED]
>Subject: [S] Don't spend a fortune, mseagroves!
>From: "eBay" <[EMAIL PROTECTED]>
>Date: Tue, 28 Jan 2003 11:29:04 -0800
>Reply-To: "eBay" <[EMAIL PROTECTED]>
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 18) 
>Tot: 45 (Req: 20)
>X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
>X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
>X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam 
>[420e].
>X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
>X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
>X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-Declude-Spoolname: Dda50019700ce4425.SMD
>X-Note: Thi

RE: [NoXMail] Opinions Please

[Brian Milburn]

SpamAway, hmmm. No, I had a neighbor who was selling that stuff, er... I think
maybe that was Amway! Maybe we could market a new MLM AntiSpam product like
Spamway?
 
On 01/27/03 2:40pm you wrote...
>SpamAway has a nice retro feel to it.
>
>-Bill Naber
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>Sent: Monday, January 27, 2003 2:32 PM
>To: [EMAIL PROTECTED]
>Subject: Re: [NoXMail] Opinions Please
>
>
>
>How about SpamChomper? That has teeth in it!
>
>On 01/27/03 2:09pm you wrote...
>>SpamManager sounds good.  The "Manager" part implies options as to what
>>actions can be taken with spam.  "SpamShredder" has a little more teeth to
>>it.
>>
>>Mark
>>
>>At 03:10 PM 1/24/2003, you wrote:
>>
>>>Hi everyone,
>>>
>>>Actually I have 2 things...
>>>
>>>Item 1. It looks like the name "No-X-Mail" is out which is no surprise to
>>me.
>>>I write software ok, but marketing is not my best thing. We received some
>>>research materials back and that name has a definite problem in that
>>>"CYBERsitter" already has recognition for adult oriented material, and the
>>>"No-X-Mail" makes it appear that the product is strictly for adult
>>messages,
>>>not necessarily spam in general.
>>>
>>>So it's down to "CYBERsitter AntiSpam" or "CYBERsitter NicerMail". We
>>already
>>>own the nicermail.* domains. That's a plus. If you do a google search on
>>>CYBERsitter AntiSpam you still get hits from a product we published in
>>1998.
>>>That's a negative. The research indicated that the NicerMail name imparts
>a
>>>more "friendly" implication. We have used "For a Family Friendly Internet"
>>as
>>>a service mark for many years. It's on all our t-shirts and everything ;-)
>>>Also, the nicermail.com will also be used for filtered subscription email
>>>services we will be offering to our regular CYBERsitter customers. My
>>opinion
>>>is that NicerMail maybe does not imply something as "industrial strength"
>>as
>>>mail admins may want.
>>>
>>>So... opinions anyone?
>>>
>>>Item 2. I will be posting a release candidate version next week. The
>>>NoxAnalyxe.exe program is now NoxAdmin.exe (of course the names may now
>>>change). It is really cool now. There are no more popup menus, everything
>>is
>>>all hyperlinked, color coded, and you can use the whole thing with just a
>>>mouse unless you want to edit a file. You can view or edit any file,
>>deliver
>>>held messages, and do pretty much anything from any computer anywhere. If
>>>anyone wants to use it before next week, let me know.
>>>
>>>The licensing mechanisms have changed and now require a license code and a
>>>separate key code. So before you can install the upcoming version I will
>>need
>>>to issue you new codes. The key code is keyed on your server IP address.
>So
>>if
>>>you will send me (off-list if you like) your server IP address I will send
>>you
>>>each your own codes. If your server has more than one IP address, just
>send
>>me
>>>one of them, it doesn't matter which one, as long as it is valid for
>IMail.
>>>
>>>Thanks and have a good weekend.
>>>
>>>-Brian
>>>
>>>
>>>---
>>>[This E-mail scanned for viruses by Solid Oak Software]
>>>
>>>
>>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>>Removal address: [EMAIL PROTECTED]
>>
>>
>>Mark Seagroves  voice: (865) 471-3506
>>Dir, Campus Computing   fax: (865) 471-3555
>>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>>Carson-Newman College
>>
>>
>>
>>e
>>
>>
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Opinions Please

[Brian Milburn]

How about SpamChomper? That has teeth in it! 
 
On 01/27/03 2:09pm you wrote...
>SpamManager sounds good.  The "Manager" part implies options as to what 
>actions can be taken with spam.  "SpamShredder" has a little more teeth to
>it.
>
>Mark
>
>At 03:10 PM 1/24/2003, you wrote:
>
>>Hi everyone,
>>
>>Actually I have 2 things...
>>
>>Item 1. It looks like the name "No-X-Mail" is out which is no surprise to
>me.
>>I write software ok, but marketing is not my best thing. We received some
>>research materials back and that name has a definite problem in that
>>"CYBERsitter" already has recognition for adult oriented material, and the
>>"No-X-Mail" makes it appear that the product is strictly for adult
>messages,
>>not necessarily spam in general.
>>
>>So it's down to "CYBERsitter AntiSpam" or "CYBERsitter NicerMail". We
>already
>>own the nicermail.* domains. That's a plus. If you do a google search on
>>CYBERsitter AntiSpam you still get hits from a product we published in
>1998.
>>That's a negative. The research indicated that the NicerMail name imparts a
>>more "friendly" implication. We have used "For a Family Friendly Internet"
>as
>>a service mark for many years. It's on all our t-shirts and everything ;-)
>>Also, the nicermail.com will also be used for filtered subscription email
>>services we will be offering to our regular CYBERsitter customers. My
>opinion
>>is that NicerMail maybe does not imply something as "industrial strength"
>as
>>mail admins may want.
>>
>>So... opinions anyone?
>>
>>Item 2. I will be posting a release candidate version next week. The
>>NoxAnalyxe.exe program is now NoxAdmin.exe (of course the names may now
>>change). It is really cool now. There are no more popup menus, everything
>is
>>all hyperlinked, color coded, and you can use the whole thing with just a
>>mouse unless you want to edit a file. You can view or edit any file,
>deliver
>>held messages, and do pretty much anything from any computer anywhere. If
>>anyone wants to use it before next week, let me know.
>>
>>The licensing mechanisms have changed and now require a license code and a
>>separate key code. So before you can install the upcoming version I will
>need
>>to issue you new codes. The key code is keyed on your server IP address. So
>if
>>you will send me (off-list if you like) your server IP address I will send
>you
>>each your own codes. If your server has more than one IP address, just send
>me
>>one of them, it doesn't matter which one, as long as it is valid for IMail.
>>
>>Thanks and have a good weekend.
>>
>>-Brian
>>
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>
>
>Mark Seagroves  voice: (865) 471-3506
>Dir, Campus Computing   fax: (865) 471-3555
>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
>e
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Opinions Please

[Brian Milburn]

How about SpamScud? Or maybe Spamazappa? Actually, Hormel has a published
position on the use of the term SPAM. They do not discourage it and from what
I have heard, they actually are pleased because it keeps their brand in the
current vernacular. I imagine a Lexus/Nexus search on SPAM would show
thousands of references and very few of them would refer to a meat? product.
 
On 01/27/03 1:24pm you wrote...
>SpamManager sounds more corporate, but I want something *tough*, like
>SpamFryer ;-)
>
>Seriously, I think SpamManager is about as good as AntiSpam.
>
>One random thought I've had is wondering if/when Hormel gets touchy about
>the "Spam" being used in a variety derisive product names (spamkiller,
>antispam, etc.).  I know trademark only covers you in the same industry
>(e.g., Jameson Hotels & Jameson Whiskey can both legally exist), but it
>seems like at some point there's going to be a backlash against the slang
>use of spam.
>
>-Bill
>
>-Original Message-----
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>Sent: Monday, January 27, 2003 1:09 PM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] Opinions Please
>
>
>
>What do you think of simply CYBERsitter SpamManager? We also own
>spammanager.com.
>
>-Brian
>
>On 01/27/03 10:46am you wrote...
>>1) I'd go with "CYBERSitter AntiSpam", the NicerMail just sounds like it
>>belongs on a desktop, not a server.  The CYBERSitter AntiSpam captures both
>>the spam and adult blocking features.
>>
>>2) (Sending off list).
>>
>>Thanks,
>>-Bill Naber
>>
>>-Original Message-
>>From: [EMAIL PROTECTED]
>>[mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>>Sent: Friday, January 24, 2003 6:11 PM
>>To: [EMAIL PROTECTED]
>>Subject: [NoXMail] Opinions Please
>>
>>
>>
>>Hi everyone,
>>
>>Actually I have 2 things...
>>
>>Item 1. It looks like the name "No-X-Mail" is out which is no surprise to
>>me.
>>I write software ok, but marketing is not my best thing. We received some
>>research materials back and that name has a definite problem in that
>>"CYBERsitter" already has recognition for adult oriented material, and the
>>"No-X-Mail" makes it appear that the product is strictly for adult
>messages,
>>not necessarily spam in general.
>>
>>So it's down to "CYBERsitter AntiSpam" or "CYBERsitter NicerMail". We
>>already
>>own the nicermail.* domains. That's a plus. If you do a google search on
>>CYBERsitter AntiSpam you still get hits from a product we published in
>1998.
>>That's a negative. The research indicated that the NicerMail name imparts a
>>more "friendly" implication. We have used "For a Family Friendly Internet"
>>as
>>a service mark for many years. It's on all our t-shirts and everything ;-)
>>Also, the nicermail.com will also be used for filtered subscription email
>>services we will be offering to our regular CYBERsitter customers. My
>>opinion
>>is that NicerMail maybe does not imply something as "industrial strength"
>as
>>mail admins may want.
>>
>>So... opinions anyone?
>>
>>Item 2. I will be posting a release candidate version next week. The
>>NoxAnalyxe.exe program is now NoxAdmin.exe (of course the names may now
>>change). It is really cool now. There are no more popup menus, everything
>is
>>all hyperlinked, color coded, and you can use the whole thing with just a
>>mouse unless you want to edit a file. You can view or edit any file,
>deliver
>>held messages, and do pretty much anything from any computer anywhere. If
>>anyone wants to use it before next week, let me know.
>>
>>The licensing mechanisms have changed and now require a license code and a
>>separate key code. So before you can install the upcoming version I will
>>need
>>to issue you new codes. The key code is keyed on your server IP address. So
>>if
>>you will send me (off-list if you like) your server IP address I will send
>>you
>>each your own codes. If your server has more than one IP address, just send
>>me
>>one of them, it doesn't matter which one, as long as it is valid for IMail.
>>
>>Thanks and have a good weekend.
>>
>>-Brian
>>
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>>
>>l.com
>>
>>---
>>[This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>>Removal address: [EMAIL PROTECTED]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Opinions Please

[Brian Milburn]

What do you think of simply CYBERsitter SpamManager? We also own
spammanager.com. 

-Brian
 
On 01/27/03 10:46am you wrote...
>1) I'd go with "CYBERSitter AntiSpam", the NicerMail just sounds like it
>belongs on a desktop, not a server.  The CYBERSitter AntiSpam captures both
>the spam and adult blocking features.
>
>2) (Sending off list).
>
>Thanks,
>-Bill Naber
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>Sent: Friday, January 24, 2003 6:11 PM
>To: [EMAIL PROTECTED]
>Subject: [NoXMail] Opinions Please
>
>
>
>Hi everyone,
>
>Actually I have 2 things...
>
>Item 1. It looks like the name "No-X-Mail" is out which is no surprise to
>me.
>I write software ok, but marketing is not my best thing. We received some
>research materials back and that name has a definite problem in that
>"CYBERsitter" already has recognition for adult oriented material, and the
>"No-X-Mail" makes it appear that the product is strictly for adult messages,
>not necessarily spam in general.
>
>So it's down to "CYBERsitter AntiSpam" or "CYBERsitter NicerMail". We
>already
>own the nicermail.* domains. That's a plus. If you do a google search on
>CYBERsitter AntiSpam you still get hits from a product we published in 1998.
>That's a negative. The research indicated that the NicerMail name imparts a
>more "friendly" implication. We have used "For a Family Friendly Internet"
>as
>a service mark for many years. It's on all our t-shirts and everything ;-)
>Also, the nicermail.com will also be used for filtered subscription email
>services we will be offering to our regular CYBERsitter customers. My
>opinion
>is that NicerMail maybe does not imply something as "industrial strength" as
>mail admins may want.
>
>So... opinions anyone?
>
>Item 2. I will be posting a release candidate version next week. The
>NoxAnalyxe.exe program is now NoxAdmin.exe (of course the names may now
>change). It is really cool now. There are no more popup menus, everything is
>all hyperlinked, color coded, and you can use the whole thing with just a
>mouse unless you want to edit a file. You can view or edit any file, deliver
>held messages, and do pretty much anything from any computer anywhere. If
>anyone wants to use it before next week, let me know.
>
>The licensing mechanisms have changed and now require a license code and a
>separate key code. So before you can install the upcoming version I will
>need
>to issue you new codes. The key code is keyed on your server IP address. So
>if
>you will send me (off-list if you like) your server IP address I will send
>you
>each your own codes. If your server has more than one IP address, just send
>me
>one of them, it doesn't matter which one, as long as it is valid for IMail.
>
>Thanks and have a good weekend.
>
>-Brian
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Reporting backup mail server.

[Brian Milburn]

Hi John,

I suppose we could put something in there to check for a backup server
setting, but we don't do RBL lookups so I don't see what the point would be.
The limited IP checking we do is using one of the pattern files and ALL IPs in
the routing are checked, so the only thing that would change would be what is
inserted into the headers. In addition, the only time IP checking is invoked
is when a message does not fail anything else. It would not affect the program
operation in the slightest.

Brian
 
On 01/27/03 7:06am you wrote...
>This is a junkmail, but what is interesting is NoXMail is reporting the IP
>source as my backup mail server. In Declude, you can set to skip a backup
>server. Is there a way to do that in NoXMail so that it will report the true
>received from source?
>
> 
>
>Received: from srv5.reliance.net [64.171.65.20] by mail.reliance.net
>
>  (SMTPD32-7.13) id A74714900A6; Sun, 26 Jan 2003 22:52:55 -0800
>
>Received: from 65-85-179-212.client.dsl.net ([65.85.179.212]) by
>srv5.reliance.net with Microsoft SMTPSVC(6.0.3718.0);
>
>   Sun, 26 Jan 2003 22:52:55 -0800
>
>Received: from [204.27.230.223] by 65-85-179-212.client.dsl.net with ESMTP
>id QCCEPV; Sun, 26 Jan 03 22:44:36 +0400
>
>Received: from [87.146.168.85] by 204.27.230.223 with ESMTP id LDKCUC; Sun,
>26 Jan 03 22:39:36 +0400
>
>From: "Jenny Carey" <[EMAIL PROTECTED]>
>
>Message-ID: <03v8p-k-$ynwl$g$w51-$[EMAIL PROTECTED]>
>
>To: [EMAIL PROTECTED]
>
>Date: Sun, 26 Jan 03 22:39:36 GMT
>
>X-Priority: 1
>
>X-MSMail-Priority: High
>
>Subject: ## COPY ANY DVD TO CD ##
>
>X-Mailer: Microsoft Outlook Express 6.00.2462.
>
>MIME-Version: 1.0
>
>Content-Type: multipart/alternative;
>
>  boundary="15CAE7CAD3114B9278B81"
>
>Return-Path: [EMAIL PROTECTED]
>
>X-OriginalArrivalTime: 27 Jan 2003 06:52:55.0670 (UTC)
>FILETIME=[B85BF960:01C2C5D0]
>
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 32 (Req: 18)
>Tot: 32 (Req: 22)
>
>X-CYBERsitter-SpoolFile: Dd747014900a6140f.SMD
>
>X-CYBERsitter-Sender: [EMAIL PROTECTED] [64.171.65.20]
>
>X-RBL-Warning: ORDB: This mail was handled by an open relay - please visit
>
>
>X-RBL-Warning: OSPROXY: (2003/01/23) Open Proxy: http(8080)
>
>X-RBL-Warning: SPAMCOP: Blocked - see
>http://spamcop.net/bl.shtml?65.85.179.212
>
>X-RBL-Warning: NOABUSE: Not supporting abuse@domain
>
>X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client
>[801e].
>
>X-RBL-Warning: WHITEFILTER1: Message failed WHITEFILTER1 test (11)
>
>X-RBL-Warning: GRAYFILTER1: Message failed GRAYFILTER1 test (34)
>
>X-RBL-Warning: SPAMCHECK: Message failed SPAMCHECK: 13.
>
>X-RBL-Warning: NOXSPAM1: Message failed NOXSPAM1: 32.
>
>X-Declude-Sender: [EMAIL PROTECTED] [65.85.179.212]
>
>X-Declude-Spoolname: Dd747014900a6140f.SMD
>
>X-Tests-Failed: ORDB, OSPROXY, SPAMCOP, NOABUSE, BADHEADERS, IPNOTINMX,
>WHITEFILTER1, GRAYFILTER1, SPAMCHECK, NOXSPAM1, WEIGHTRANGE30-34
>
>X-Note: This E-mail was sent from 65-85-179-212.client.dsl.net
>([65.85.179.212]).
>
>X-RBL-Warning: Total weight: 32
>
>X-Note: This e-mail was scanned by RelianceSoft, Inc for Viruses and SPAM.
>
>X-Note: To report any issues, please goto
>http://support.reliance.net/help.html
>
> 
>
>John Tolmachoff MCSE, CSSA
>
>IT Manager, Network Engineer
>
>RelianceSoft, Inc.
>
>Fullerton, CA  92835
>
>www.reliancesoft.com
>
> 
>
>

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Opinions Please

[Brian Milburn]

Hi everyone,

Actually I have 2 things...

Item 1. It looks like the name "No-X-Mail" is out which is no surprise to me.
I write software ok, but marketing is not my best thing. We received some
research materials back and that name has a definite problem in that
"CYBERsitter" already has recognition for adult oriented material, and the
"No-X-Mail" makes it appear that the product is strictly for adult messages,
not necessarily spam in general. 

So it's down to "CYBERsitter AntiSpam" or "CYBERsitter NicerMail". We already
own the nicermail.* domains. That's a plus. If you do a google search on
CYBERsitter AntiSpam you still get hits from a product we published in 1998.
That's a negative. The research indicated that the NicerMail name imparts a
more "friendly" implication. We have used "For a Family Friendly Internet" as
a service mark for many years. It's on all our t-shirts and everything ;-)
Also, the nicermail.com will also be used for filtered subscription email
services we will be offering to our regular CYBERsitter customers. My opinion
is that NicerMail maybe does not imply something as "industrial strength" as
mail admins may want.

So... opinions anyone?

Item 2. I will be posting a release candidate version next week. The
NoxAnalyxe.exe program is now NoxAdmin.exe (of course the names may now
change). It is really cool now. There are no more popup menus, everything is
all hyperlinked, color coded, and you can use the whole thing with just a
mouse unless you want to edit a file. You can view or edit any file, deliver
held messages, and do pretty much anything from any computer anywhere. If
anyone wants to use it before next week, let me know.

The licensing mechanisms have changed and now require a license code and a
separate key code. So before you can install the upcoming version I will need
to issue you new codes. The key code is keyed on your server IP address. So if
you will send me (off-list if you like) your server IP address I will send you
each your own codes. If your server has more than one IP address, just send me
one of them, it doesn't matter which one, as long as it is valid for IMail.

Thanks and have a good weekend.

-Brian


---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Dr. Watson message with 1/13 version of NoXMail

[Brian Milburn]

Hi Bill,

You should check your NT event logs for clues and see if the event was
recorded. Also, I am not sure if Dr. Watson keeps logs (I haven't used an NT
machine for 2 years) but you could look there as well.

When you find the error get the exact time, and check your Declude and IMail
logs for that time. If you send me any information you can find about what was
going on at that moment, maybe it will give us a clue as to what is going on.

Just as an aside, I would do anything possible to upgrade to 2000. We ran all
the 2000 betas on a server here, and it solved so many of our error handling
problems we upgraded 12 of them to RC2 as soon as we got it, then we installed
the final when we got that. I haven't seen any BSODs, stops, memory dumps,
nothing in 2 years. Of course your mileage may vary ;-)

Brian
 
On 01/22/03 3:10pm you wrote...
>Yesterday I updated to the 1/13 @ 10:59am version of NoXMail.  I'm running
>Declude 1.65 and IMail 7.13 on NT.  My NoXMail LogDetail is set to "High".
>
>This morning I received at Dr. Watson message of Exception 0xc025 at
>Address 0x77f892e5.  There was no entry in the application event log.
>
>I did a cursory review of the NoXMail log and didn't see anything, but
>without any specific to search for I could have easily missed something.
>
>What should I do/check to better narrow this down?
>
>Thanks,
>-Bill Naber
> Kitchin Hospitality, LLC
>
>, LLC
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Dr. Watson messages from NoXMail

[Brian Milburn]

Hi Bill,

What would be helpful is if you could try to find the sections in your log
files for that day that correspond to the times of the errors and send them to
me. If you want to keep them off the list, just send them to my regular email
address. 

I have seen a few times where the program encountered terribly mal-formed
emails and thay caused the program to generate an error. However we do not use
Dr. Watson. When these kinds of errors are encountered the program should just
exit. In your case, there may have been something come in with improper codes
in the email causing an error that was unhandled. 

Are you running NT or 2000?

Also, the latest version of No-X-Mail is dated 1/13/03. We made several
internal changes that did not affect usage, but may have already corrected the
problem you are describing.

If you like, you can get the latest version, and see if you get any more
errors. If you do, then maybe that would be the time to check the log files
and see if there is anything there that could indicate a problem and send it
to me. 

One note, if it is a unhandled exception, there may not be anything in the log
for the message that caused it. You may need to look in your Declude or IMail
logs and see if there is any references there that correspond to the date and
time of the error.

-Brian

 
On 01/21/03 9:44am you wrote...
>I'm running the NoXMail.exe dated 1/4/03 @ 2:58pm and received several Dr.
>Watson messages over the last week.  They specifically said:
>
>NoXMail.exe Exception: access violation (0xc005), Address: 0x00401b3e.
>Over the course of the week I received four of the Dr. Watson messages and
>processed approximately 10,000 Email messages.
>
>Around Christmas I was seeing some Dr. Watson messages from NoXMail, but
>they seemed to clear up with the 1/4 release (until last week).
>
>Let me know how I should best proceed.
>
>Thanks,
>-Bill Naber
>
>Naber
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Different senders

[Brian Milburn]

I don't see how the Q file sender would be as useful. What the end user sees
is the header sender, since they have the ability to manage their own
whitelists, they would have no way of of easily knowing what the address of Q
file sender was.

As long as the method used is consistent, and the user understands it, I
wouldn't think there would be a problem.
 
On 01/16/03 9:07am you wrote...
>An interesting scenario.
>
> 
>
>Apparently, NoXMail is retrieving the sender from the header, whereas
>Declude uses the sender in the Q file, which is the one as received by
>Imail. It seems this could affect whitelisting. Any thoughts or comments?
>
> 
>
>Received: from domainics.com [456.456.456.456] by mail.reliance.net
>
>  (SMTPD32-7.13) id A6F540E00E6; Wed, 15 Jan 2003 16:04:05 -0800
>
>Received: (qmail 3780 invoked by uid 0); 16 Jan 2003 00:01:33 -
>
>Date: 16 Jan 2003 00:01:33 -
>
>Message-ID: <20030116000133.3777.qmail@domain1>
>
>To: <[EMAIL PROTECTED]>
>
>Subject: Requirements - Domain Sales
>
>From: Purchasing <[EMAIL PROTECTED]>
>
>Reply-To: Purchasing <[EMAIL PROTECTED]>
>
>MIME-Version: 1.0
>
>Content-Type: multipart/alternative;
>
> boundary="be5f3414c4e4129162860aa8776dfcf02456"
>
>X-Priority: 3
>
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 18 (Req: 18)
>Tot: 18 (Req: 22)
>
>X-CYBERsitter-SpoolFile: Df6f5040e00e66f80.SMD
>
>X-CYBERsitter-Sender: [EMAIL PROTECTED] [456.456.456.456]
>
>X-RBL-Warning: BASE64: A binary encoded text or HTML section was found in
>this E-mail.
>
>X-RBL-Warning: GRAYFILTER1: Message failed GRAYFILTER1 test (11)
>
>X-RBL-Warning: GRAYFILTER2: Message failed GRAYFILTER2 test (17)
>
>X-RBL-Warning: NOXSPAM1: Message failed NOXSPAM1: 18.
>
>X-Declude-Sender: [EMAIL PROTECTED] [456.456.456.456]
>
>X-Declude-Spoolname: Df6f5040e00e66f80.SMD
>
>X-Tests-Failed: BASE64, GRAYFILTER1, GRAYFILTER2, NOXSPAM1, WEIGHTRANGE35-39
>
>X-Note: This E-mail was sent from domainics.com ([456.456.456.456]).
>
>X-RBL-Warning: Total weight: 36
>
>X-Note: This e-mail was scanned by RelianceSoft, Inc for Viruses and SPAM.
>
>X-Note: To report any issues, please goto
>http://support.reliance.net/help.html
>
> 
>
>QD:\IMail\spool\Df6f5040e00e66f80.SMD
>
>Hmail.reliance.net
>
>WD:\IMail\mail_reliance_net
>
>E0,
>
>R<[EMAIL PROTECTED]>
>
>S<[EMAIL PROTECTED]>
>
>NRCPT TO:<[EMAIL PROTECTED]>
>
>R<[EMAIL PROTECTED]>
>
> 
>
>John Tolmachoff  MCSE, CSSA
>
>IT Manager, Network Engineer
>
>211 E. Imperial Hwy, Suite 106
>
>Fullerton, CA  92835
>
>562-694-4800, ext. 104
>
>[EMAIL PROTECTED]
>
>www.reliancesoft.com  
>
> 
>
> 
>
>

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New beta posted

[Brian Milburn]

Hi John,

Actually, those settings will be pulled out of the next release of the docs.
They will be officially unsupported, but supported as undocumented features.
That's what the 'heads up' was about. 

-Brian
 
On 01/13/03 1:02pm you wrote...
>Brian, in the Configuration.pdf, you have in three locations the following
>sentence: "The use of setting is no longer recommended."
>
>I take that to mean in reference last week's heads up on the directory
>change.
>
>I recommend that sentence be the following: "The use of this setting is no
>longer recommended and is being phased out. Please update your configuration
>to reflect the recommended directories."
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New beta posted

[Brian Milburn]

Correct. It they do not exist, they will be created.
 
On 01/13/03 12:54pm you wrote...
>So now the installation needs to have these folders, correct?
>
>..\noxmail
> \logs
> \hold
> \trash
> \users
>  \whitelists
>  \blacklists
>  \common
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New beta posted

[Brian Milburn]

Hi Guys,

I posted a new beta release a little while ago at:

http://www.noxmail.com/imail/noxbeta.zip

Some of the documentation has been changed to reflect new features or how
existing features work. The new stuff is now in red text.

Be sure to check out the new stuff before installing.

There is a new NoxAnalyze.exe. I am working on the docs for it now and will
post them as soon as I finish.

It should be pretty self-explanatory. You can now connect in 3 ways. Locally,
from a network share, or remotely from any computer via FTP. If you want to
use FTP, you will have to set up an FTP server or virtual server for your
NOXMAIL folder. If you have IIS, it takes 2-3 minutes tops. It is pretty cool,
I use it from home and can do pretty much anything.

You will need to click on Servers then Add New... to specify the connection
details. You can add as many as you like. Also, it is designed so that if you
set up FTP, we can provide remote support for you if necessary.

If you highlight (select) any HELD file name (no extension needed), or any
SPOOL file name (no extension needed), you can right click for special options
and search options. Pretty much anything can now be done from a workstation or
from off-site. It sure saves me a lot of time now.

There is one new setting that didn't make it into the docs.

SENDTOTRASH TRUE

This will cause any message that would be normally deleted to be sent to the
\noxmail\trash folder instead.

There is a new utility called NoxEmpty.exe. You can use this exactly like
NoXpire.exe to empty your trash of files older than x days.

I created a .bat file called NoxClean.bat

NOEXPIRE.EXE 7
NOXEMPTY.EXE 7

I then call this from a scheduled task at 11:59pm every day and it cleans out
all hold and trash after 7 days.

Both hold files and trash files can be viewed and can be "administrator
delivered" if ever necessary using the NoxAnalyze program. 

-Brian


---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] URGENT, Can not load pattern file.

[Brian Milburn]

That isn't the problem. No-X-Mail downloads the pattern file to a stream. The
file is saved from the stream into a temporary file, then copied to the normal
pattern file and then the temporary file is deleted. There is no overwriting
until the final copy and that can not be avoided, even if you have a backup.
There should be no possibility of a deadlock as the file copy is being
performed, therefor processing is suspended while the copy is being performed.
This should only take a few milliseconds.

The problem in this case was that something was causing the task to not
complete, and that could be any number of things. I have had tasks not
complete here dozens of times that are totally unrelated to No-X-Mail and not
even on Internet servers. There may be some problem in Windows itself.

So what we do is to try to make sure that no matter what problem occurs, we
try to handle it. In this case the solution is going to be the addition of a
secondary application timer, in addition to the procedure timer that forces
the app to terminate and clean up after itself if something goes south.
 
On 01/13/03 9:09am you wrote...
>Brian, the failed download of a new pattern file should not be able to cause
>the NoXMail app to stop working.  Maybe if the file did not overwrite during
>the download but rather downloaded with a different name and waited until
>the pattern file was completely downloaded before renaming and overwriting
>the old pattern file.  Maybe even do what the sniffer app does and rename
>the old pattern file with a .old extension.  That way you always have at
>least the most recent previous pattern file available in case something is
>wrong with the latest one.
>
>Just a suggestion...
>
>Bill
>
>-Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Milburn
>Sent: Monday, January 13, 2003 8:22 AM
>To: [EMAIL PROTECTED]
>Subject: RE: [NoXMail] URGENT, Can not load pattern file.
>
>Hi John, No-X-Mail waits for 5 seconds if a pattern file update is in
>progress. The *.pa_ are temporary files that, if they exist, indicate a
>pattern file transfer is in progress. If the 5 seconds go by and the update
>was NOT completed, then the program aborts. This was what I had to do to fix
>the 100% CPU problem.
>
>The pattern file update program uses the HTTP protocol to retrieve the files
>from our server. On occasion, I have seen situations where for one reason or
>another, the file transfer goes at an extremely slow rate. Fast enough so it
>doesn't trigger a timeout, but a small file can take many minutes to
>download.
>This may have nothing at all to do with any of the No-X-Mail programs. It
>may
>have been a bottleneck somewhere at a single point in time, it may have been
>our server, it could have been any number of things. 
>
>One thing I would suggest is to set the scheduled task to terminate if it
>runs
>longer than 2 minutes.
>
>Brian
> 
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Whitelist problem

[Brian Milburn]

Hi Marco,

The version you downloaded is for IMail and IMail/Declude users. 

The beta and this discussion list is also only for IMail and IMail/Declude
users.

A special version will be available after January 15th that will work with
your server. I would contact [EMAIL PROTECTED] after that date to find out
where it can be obtained.
 
On 01/13/03 5:34pm you wrote...
>Hi.
>I have a problem with whitelist.txt file: if I receive an e-mail from a
>domain listed in the whitelist, it is still filtered.
>Just to make an example:
>
>11/01/2003 19.42.45 - cs1626.tmp [IGNORED] - @discuss.develop.com
>whitelisted.
>11/01/2003 19.42.45 - cs1626.tmp [FAILED SPAM] - Adult: 0 (Req: 5) Spam:
>19 (Req: 18) ExitCode: 19 (Req: 20)
>11/01/2003 19.42.45 - cs1626.tmp - (Adult) Hits/Wgt: 0/0 - Matches: 0 -
>Saturation: 0
>11/01/2003 19.42.45 - cs1626.tmp - MSG TO:
><[EMAIL PROTECTED]> 
>11/01/2003 19.42.45 - cs1626.tmp - MSG FROM: <[EMAIL PROTECTED]>
>11/01/2003 19.42.45 - cs1626.tmp - MSG SUBJECT: Re: [DOTNET-CX] Add Ins
>- how far can I go in respect to a custom editor for classes?
>11/01/2003 19.42.45 - cs1626.tmp - RETURN ADDRESS consistent with SPAM:
>2 penalty points added.
>11/01/2003 19.42.45 - cs1626.tmp - SUBJECT consistent with SPAM: 12
>penalty points added.
>11/01/2003 19.42.45 - cs1626.tmp - SUBJECT contains variables: 5 penalty
>points added.
>11/01/2003 19.42.45 - cs1626.tmp - Msg processed in: 0ms - Msg Size:
>3021 bytes
>
>How can avoid that?
>
>Please note that: 
>- I downloaded documentation, but I'm not able to implement domain
>whitelist file (it seems doesn't work as documentation described)
>- I have the Beta downloaded for ArgoSoft users (NOXMail.Exe filedate is
>21/11/2002)
>- I download new pattern each day with NoXMUpd
>
>Thank you
>
>Marco
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] URGENT, Can not load pattern file.

[Brian Milburn]

Ok, I am adding a couple of lines of code to the updater that will do some
double checking to make sure there are no temp files left if the scheduled
task had to be aborted.

This will be posted today.
 
On 01/13/03 8:12am you wrote...
>Yes, deleting that file and rerunning the updater fixed it.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of John Tolmachoff
>> Sent: Monday, January 13, 2003 7:57 AM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] URGENT, Can not load pattern file.
>> 
>> I found a noxmail.pa_ file folder.
>> 
>> I just sent you a screen shot of the old folder that still had the updater
>> running and scheduled every hour.
>> 
>> Interesting that both scheduled tasks still showed running.
>> 
>> John Tolmachoff MCSE, CSSA
>> IT Manager, Network Engineer
>> RelianceSoft, Inc.
>> Fullerton, CA  92835
>> www.reliancesoft.com
>> 
>> 
>> 
>> soft.com
>> 
>> 
>> 
>> m
>> 
>> 
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>@noxmail.com
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] URGENT, Can not load pattern file.

[Brian Milburn]

Hi John, No-X-Mail waits for 5 seconds if a pattern file update is in
progress. The *.pa_ are temporary files that, if they exist, indicate a
pattern file transfer is in progress. If the 5 seconds go by and the update
was NOT completed, then the program aborts. This was what I had to do to fix
the 100% CPU problem.

The pattern file update program uses the HTTP protocol to retrieve the files
from our server. On occasion, I have seen situations where for one reason or
another, the file transfer goes at an extremely slow rate. Fast enough so it
doesn't trigger a timeout, but a small file can take many minutes to download.
This may have nothing at all to do with any of the No-X-Mail programs. It may
have been a bottleneck somewhere at a single point in time, it may have been
our server, it could have been any number of things. 

One thing I would suggest is to set the scheduled task to terminate if it runs
longer than 2 minutes.

Brian
 
On 01/13/03 7:56am you wrote...
>I found a noxmail.pa_ file folder.
>
>I just sent you a screen shot of the old folder that still had the updater
>running and scheduled every hour.
>
>Interesting that both scheduled tasks still showed running.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] URGENT, Can not load pattern file.

[Brian Milburn]

John, do you have either of these files in your NOXMAIL directory?

NOXMAIL.PA_

NOXSPAM.PA_

If you do, delete them and let me know if that corrects the problem.

Thanks

Brian

 
On 01/13/03 7:37am you wrote...
>Brian, nothing is getting scanned.
>
>1/12/2003 2:02:44 AM - D3d42188501c27e8c.SMD - Msg processed in: 148ms - Msg
>Size: 7540 bytes
>1/12/2003 2:04:09 AM - D3d8f188b01c2ad71.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:04:40 AM - D3db1188d01c23114.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:07:49 AM - D3e2d039a018a16f9.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:10:08 AM - D3ef8189801c22d9a.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:11:28 AM - D3f48189b01c2674b.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:11:42 AM - D3f57189d01c2a00e.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:18:03 AM - D40d218a901c26b5c.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:19:04 AM - D:\IMail\declude\NoXMail2\noxmail.pat (55206 bytes)
>updated successfully.
>1/12/2003 2:19:04 AM - D:\IMail\declude\NoXMail2\noxspam.pat (394993 bytes)
>updated successfully.
>1/12/2003 2:27:15 AM - D42fc18c201c2deb4.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:28:42 AM - D435218c701c22eee.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:33:25 AM - D445a18d201c235ac.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:34:40 AM - D44b903bc018aa816.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:37:51 AM - D457818dc01c29070.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:41:08 AM - D463d03c7018a9183.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:42:47 AM - D46a003cd018a159c.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:44:04 AM - D46ed18e701c243c3.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:45:55 AM - D475a18ee01c2ec33.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:48:31 AM - D47f303d4018a41bd.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:55:20 AM - D499103e1018a918a.SMD  Could not load noxmail.pat
>file
>1/12/2003 2:56:20 AM - D49ca03e6018a7110.SMD  Could not load noxmail.pat
>file
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>com
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Next Update

[Brian Milburn]

Hi Guys,

I was planning on posting a new update this morning but I ran into an odd
thing that nobody had ever reported. The problem was with whitelisting and
alias accounts.

Here is the basic scenario...

The regular mail account I use is [EMAIL PROTECTED] The Official Host Name
is "mail.solidoak.com" and the hist aliases are "solidoak.com" and
"cybersitter.com".

Ok, so I also have several mail box aliases defined as well, like
[EMAIL PROTECTED], [EMAIL PROTECTED], etc. that are all delivered to my
official mailbox "[EMAIL PROTECTED]".

Now, if I get a mail addressed to [EMAIL PROTECTED], and it is
identified as spam then a rejection notice is sent to [EMAIL PROTECTED] 

Oh-oh, that mail came from some ISP in Hong Kong and they want to buy 5000
copies of CYBERsitter (it's happened!).

So I send back the rejection letter and I put an [x] so this person
whitelisted. 

The problem is that the whitelist entry is created in the [EMAIL PROTECTED]
whitelist file. The next time I get a message from this guy to
[EMAIL PROTECTED], it is rejected again.

The upshot of all this is that we are going to have to maintain whitelists by
official mailbox name. That way domain aliases and account aliases do not
require separate whitelist files.

I have made the necessary changes and am testing it today and will test it
over the weekend. I have also made the necessary accommodations so that your
current user whitelists will still be valid. Any new entries will be added to
the whitelist for the official mailbox name.

Also, the remote administration program is basically finished. It allows full
administration locally, via a network share, or remotely via FTP.

You can view and analyze logs for any date, edit whitelists and blacklists,
edit the noxmail.nox file, etc. A bunch of "right click" context sensitive
helpers have been built in. For instance, right click on a users email address
and you can open and edit their whitelists or blacklists. Right click on a
"held" file name and you can open up and edit the file. You can also remotely
"deliver" any held message to the user with just a couple of mouse clicks if
you feel it was held incorrectly.

One other change available in the next version is a TRASH directory. If you
want to delete messages, but not REALLY delete them, you can optionally have
them sent to the "trash". The user is never notified. A new command line
utility called NoXEmpty.exe will empty your trash for you after xx days. This
will help when you are uncomfortable about just deleting messages and maybe
want to keep them for 4 or 5 days just to be safe.

Ok, time for me to go back to work!

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Spam and adult tests with Declude

[Brian Milburn]

Hi John,

The negative value is not recorded in the log files. The REAL value is. We are
still working with the actual scores when that log line is buffered, and it
would be too cumbersome to keep testing for the setting throughout the
process. If you have DECLUDETESTONLY TRUE defined, the exitcode is sign is
simply changed when the program terminates.

Here is a line from my Declude log file:

01/10/2003 06:58:20 Qdf8b27c Msg failed CYBERsitter (Message failed
CYBERsitter: -52.). Action=WARN.

This shows the the test returned a -52 code for this message.

Brian

 
On 01/10/03 6:53am you wrote...
>Actually Brian, it appears NoXMail is not returning an negative exit code to
>Declude for Adult.
>
>01/10/2003 00:11:45 Q804004cb01026e82 Msg failed NOXSPAM1 (Message failed
>NOXSPAM1: 244.). Action=IGNORE.
>01/10/2003 00:11:45 Q804004cb01026e82 Msg failed NOXSPAM2 (Message failed
>NOXSPAM2: 244.). Action=IGNORE
>
>1/10/2003 12:11:45 AM - D804004cb01026e82.SMD (IN) [FAILED ADULT] Scores -
>Adult: 197 (Req: 18) Spam: 47 (Req: 18) ExitCode: 244 (Req: 22)
>1/10/2003 12:11:45 AM - D804004cb01026e82.SMD - (Adult test) Hits/Wgt:
>37/167 (Req: 4) Matches: 19 (Req: 2) Saturation: 11 (Req: 5)
>
>I am out of the office today, so I may not be able to test further until
>Monday.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Spam and adult tests with Declude

[Brian Milburn]

Hi John and Scott,

Thanks for the hard work on this. You guys save me a lot of trial and error.
John it you don't mind, I think I'll copy your examples below almost verbatim
into the docs for suggested Declude configurations. Because declude is so
flexible, I can feel free to put in different examples how users can utilize
this.

Thanks

Brian
 
On 01/09/03 12:50pm you wrote...
>Brian and others who are interested having Declude take action based on
>score steps from NoXMail, Scott and I have been working on it the last day
>and a half and it is working now.
>
>Purpose: Allow NoXMail to scan and return the message score back to Declude
>to take action or add higher weight based on the score.
>
>Requirements: Latest version of NoXMail.exe and Declude.exe v. 1.65i17.
>As the Declude version is an interim version, if you do not need this
>function now and you configuration is working, you may want to wait until
>the next beta or release.
>
>Example test definitions:
>NOXSPAM1 external >17 "D:\imail\noxmail\noxmail.exe" 20 0
>NOXSPAM2 external >40 "D:\imail\noxmail\noxmail.exe" 15 0
>NOXADULT1 external <-17 "D:\imail\noxmail\noxmail.exe" 20 0
>NOXADULT2 external <-40 "D:\imail\noxmail\noxmail.exe" 15 0
>NOXADULT3 external <-75 "D:\imail\noxmail\noxmail.exe" 15 0
>
>Explanation: 
>1. A message scanned by NoXMail is determined to have a score of 30 and is
>spam. It will fail NOXSPAM1 and have a weight of 20. 
>2. A message scanned by NoXMail is determined to have a score of 45 and is
>spam. It will fail NOXSPAM1 and NOXSPAM2 and have a weight of 35.
>3. A message scanned by NoXMail is determined to have a score of 30 and is
>adult spam. Noxmail will return a negative score to Declude. It will fail
>NOXADULT1 and have a score of 20.
>4. A message scanned by NoXMail is determined to have a score of 45 and is
>adult spam. Noxmail will return a negative score to Declude. It will fail
>NOXADULT1 and NOXADULT2 have a score of 35.
>5. A message scanned by NoXMail is determined to have a score of 80 and is
>adult spam. Noxmail will return a negative score to Declude. It will fail
>NOXADULT1 and NOXADULT2 and NOXADULT3 and have a score of 50.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] A Heads Up

[Brian Milburn]

Hi David,

The problem gets a little more complex with an entire whitelist. With the hold
message, each one has a specific ID. 

Say your whitelist was sent to you as:

[ ][EMAIL PROTECTED]
[ ][EMAIL PROTECTED]
[ ][EMAIL PROTECTED]
[ ][EMAIL PROTECTED]
[ ][EMAIL PROTECTED]

The instructions might be to x all the valid ones and reply.

If you leave this message in your sent mail folder, any one who may have
access to your computer can resend it at any time.

With the HOLD notification, the worst that could happen is that that single
messages sender could be whitelisted.

This is what presents the problem. To make it secure then some sort of
database has to be defined to track open reference numbers, with a allowable
time limit for the user to respond. In other words, it can get rather
complicated. 

Brian

 
On 01/09/03 10:50am you wrote...
>Brian
>As it is the HOLD feature uses a reference ID. If I request a change and it
>requires a confirmation, would the reference IDs would need to match??
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>> Sent: Wednesday, January 08, 2003 9:54 PM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] A Heads Up
>>
>>
>>
>> Hi David,
>>
>> I had thought about doing this at a later date, but I
>> experimented a little
>> today to explore any issues that might arise.
>>
>> The only problem I see is security. I will need to come up with
>> some sort of
>> security measures so that someone could not spoof your account
>> and add a bunch
>> of porno spammers to your whitelist.
>>
>> I'll look into it some more and we'll see what I come up with.
>>
>> Thanks for the suggestion,
>>
>> Brian
>>
>> On 01/07/03 6:52pm you wrote...
>> >Brian
>> >The "Add this to my whitelist" feature in the HOLD function
>> works so well,
>> >why not consider this as email interface tool. That could open
>> it up so that
>> >the end user could configure themselves. Send an email to the NOXMAIL
>> >account and it could email back a copy of the current user
>> settings. X a box
>> >to set a particular feature and reply. If a feature required
>> further choice
>> >the appropriate email could be returned for additional changes. X the box
>> >beside the "get my current whitelist" to retrieve athe list to remove a
>> >mistake.
>> >
>> >The postmaster or domain or group administrator could have a
>> different set
>> >of email responders.
>> >
>> >A couple of years ago I experimented with something like the
>> HOLD feature. I
>> >tried consolidating email addresses that failed and sent out an
>> email. The
>> >customer removed the addresses that were not legitimate and replied. That
>> >created their whitelist although it only worked after the fact.
>> I loved it
>> >then because it gave the customer all the control and it cut down on my
>> >work. False positives are by far my biggest problems. They take more time
>> >than all the work I do towards junkmail. Hunt it down, try to
>> figure out why
>> >it failed, adjust, guess, sweat etc. When I adjust, did it throw
>> something
>> >else out of whack. Did I loosen things up so that I get flooded. How many
>> >other things will I need to change to make the system run smooth again.
>> >Letting the customer make the choice means far fewer false
>> positives because
>> >they get to make the fine adjustments.
>> >
>> >Just some thoughts.
>> >
>> >Thanks
>> >
>> >David
>> >
>> >
>> >>
>> >> Hi John,
>> >>
>> >> I may leave the LOGFILEPATH setting in there but it will be
>> >> undocumented and
>> >> not supported by the remote administration program.
>> >>
>> >> Unfortunately, you can't always provide all the features
>> everyone wants in
>> >> every way they want them. In your case, you probably wouldn't
>> >> have much of a
>> >> need for the remote administration features as you manage
>> >> everything manually.
>> >>
>> >> To make remote administration work using FTP you really have to
>> >> have a base
>> >> directory. It isn't really practical as a matter of support to
>> >> have hundreds
>> >> of different drive/path configurations to figure out.
>> >>
>> >> You could always run No-X-Mail from that partition. It doesn't
>> >> care where it
>> >> is.
>> >
>> >---
>> >[This E-mail scanned for viruses by Solid Oak Software]
>> >
>> >
>> >Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> >Removal address: [EMAIL PROTECTED]
>>
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>>
>>
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] A Heads Up

[Brian Milburn]

Hi David,

I had thought about doing this at a later date, but I experimented a little
today to explore any issues that might arise.

The only problem I see is security. I will need to come up with some sort of
security measures so that someone could not spoof your account and add a bunch
of porno spammers to your whitelist.

I'll look into it some more and we'll see what I come up with.

Thanks for the suggestion,

Brian
 
On 01/07/03 6:52pm you wrote...
>Brian
>The "Add this to my whitelist" feature in the HOLD function works so well,
>why not consider this as email interface tool. That could open it up so that
>the end user could configure themselves. Send an email to the NOXMAIL
>account and it could email back a copy of the current user settings. X a box
>to set a particular feature and reply. If a feature required further choice
>the appropriate email could be returned for additional changes. X the box
>beside the "get my current whitelist" to retrieve athe list to remove a
>mistake.
>
>The postmaster or domain or group administrator could have a different set
>of email responders.
>
>A couple of years ago I experimented with something like the HOLD feature. I
>tried consolidating email addresses that failed and sent out an email. The
>customer removed the addresses that were not legitimate and replied. That
>created their whitelist although it only worked after the fact. I loved it
>then because it gave the customer all the control and it cut down on my
>work. False positives are by far my biggest problems. They take more time
>than all the work I do towards junkmail. Hunt it down, try to figure out why
>it failed, adjust, guess, sweat etc. When I adjust, did it throw something
>else out of whack. Did I loosen things up so that I get flooded. How many
>other things will I need to change to make the system run smooth again.
>Letting the customer make the choice means far fewer false positives because
>they get to make the fine adjustments.
>
>Just some thoughts.
>
>Thanks
>
>David
>
>
>>
>> Hi John,
>>
>> I may leave the LOGFILEPATH setting in there but it will be
>> undocumented and
>> not supported by the remote administration program.
>>
>> Unfortunately, you can't always provide all the features everyone wants in
>> every way they want them. In your case, you probably wouldn't
>> have much of a
>> need for the remote administration features as you manage
>> everything manually.
>>
>> To make remote administration work using FTP you really have to
>> have a base
>> directory. It isn't really practical as a matter of support to
>> have hundreds
>> of different drive/path configurations to figure out.
>>
>> You could always run No-X-Mail from that partition. It doesn't
>> care where it
>> is.
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Test please disregard

[Brian Milburn]

This is a test, please disregard and sorry for cluttering up your in-box!


Brian

 

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Return code

[Brian Milburn]

It returns a 0 unless it fails.
 
On 01/08/03 12:54pm you wrote...
>Brian, just to clarify, if a message passes NoXMail, does it return a code
>of 0 to Declude, or if not what?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] A Heads Up

[Brian Milburn]

Hi John,

I may leave the LOGFILEPATH setting in there but it will be undocumented and
not supported by the remote administration program.

Unfortunately, you can't always provide all the features everyone wants in
every way they want them. In your case, you probably wouldn't have much of a
need for the remote administration features as you manage everything manually.

To make remote administration work using FTP you really have to have a base
directory. It isn't really practical as a matter of support to have hundreds
of different drive/path configurations to figure out.

You could always run No-X-Mail from that partition. It doesn't care where it
is.

-Brian
 
On 01/07/03 2:00pm you wrote...
>Brian, what about if some one wants the log files to be on a different
>partition?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>soft.com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] A Heads Up

[Brian Milburn]

Actually, it doesn't even need to be under \imail. It can be anywhere, it is
only what is under the \noxmail directory that is important. It can be on any
drive you like on the server.
 
On 01/07/03 8:13am you wrote...
>> So, if your installation is currently different than I have outlined
>above, I
>> would recommend changing it as soon as you get time. I will not post any
>new
>> versions of anything for a couple of days to allow you to make the
>changes.
>
>If I read this correctly, the noxmail directory must be a direct
>subdirectory of the \imail directory, but does not necessarily have to be
>C:\imail\noxmail but could be d:\imail\noxmail or L:\mail\imail\noxmail and
>so forth.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>
>ft.com
>
>
>
>
>
>
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] A Heads Up

[Brian Milburn]

Hi Guys,

I thought I would give you some advanced warning about a design change I have
determined will be necessary and let you make any changes now rather that have
an updated version not support your installation.

I have turned the application, NoXAnalyze.exe that I posted on Friday into a
full featured remote administration program. It allows configuration from the
local computer, from the LAN, or from FTP. If you are running IIS on your
server, it would be a simple matter to add an FTP site with the root directory
as your root NOXMAIL directory. It now also supports any number of servers at
any number of locations, including peered servers.

Here is what it can do:

Analyze any log file.
Creates a synopsis of deleted and held messages.
Search log files, and search from the synopsis reports using a highlighted key
word.
Administrator can deliver held messages and whitelist email addresses or
domains for the user.
Edit the NOXMAIL.NOX configuration file.
Edit the global whitelist file.
Edit the global blacklist file.
Edit any domain whitelist or blacklist files.
Edit any user whitelist or blacklist files.

To accomplish this, especially when using the application from a remote or
network computer, I must define a root directory, and have the necessary files
stored in consistent locations.

The default installation should look like this:

.\noxmail
 \logs
 \hold
 \users
  \whitelists
  \blacklists
  \common

The following configuration values will still be supported for the time being,
but may be removed in the final version and will be removed from the
documentation.

  MOVEDIR, LOGFILEPATH, and USERDIR

Assuming you have No-X-Mail installed as C:\imail\noxmail then these
configuration values should look like this:

MOVEDIR C:\imail\noxmail\Hold
LOGFILEPATH C:\imail\noxmail\Logs
USERDIR C:\imail\noxmail\Users

Currently, you can define the servers you want to connect to, including
passwords, etc. and they are displayed in a dropdown list. The server
connection information is now being stored in the registry. I am thinking
about possibly storing the server connection data in INI files so that it
would be possible to copy the application and INI files to a floppy disk and
run this from any computer anywhere in the world. My only concern in doing
this is that a floppy could get loose and some disgruntled employee somewhere
could possibly cause problems. Of course, you could always change passwords
frequently. I have to give this some more thought.

So, if your installation is currently different than I have outlined above, I
would recommend changing it as soon as you get time. I will not post any new
versions of anything for a couple of days to allow you to make the changes.

Thanks, and as always, I am interested in opinions and comments!

Brian









 

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Update for Declude +- test

[Brian Milburn]

Hi John,

I am going to have to defer to Scott on this one. I tried what I indicated
below and could not make it work. So it is probable that I misunderstood the
syntax.

Brian
 
On 01/06/03 7:58am you wrote...
>> Here is the text from the message I posted regarding this:
>
>
>
>What I meant was in defining the test, what is the correct way to set up the
>exit code that Declude looks for?
>
>Something like this?
>
>NOXSPAM external positive "D:\imail\declude\noxmail.exe" 20 0
>NOXSPAM external negative "D:\imail\declude\noxmail.exe" 40 0
>
>Or what about
>
>NOXSPAM1 external >+20 "D:\imail\declude\noxmail.exe" 20 0
>NOXSPAM2 external >+35 "D:\imail\declude\noxmail.exe" 35 0
>NOXADULT1 external >-20 "D:\imail\declude\noxmail.exe" 30 0
>NOXADULT2 external >-50 "D:\imail\declude\noxmail.exe" 50 0
>
>(On the negative, would it actually be <-20 and <-50 because it is
>reversed?)
>
>And that is using DECLUDETESTONLY TRUE in the NoXMail.nox file also with
>Declude.exe V 1.65i11 or better.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>
>ft.com
>
>
>
>
>
>
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Update for Declude +- test

[Brian Milburn]

Hi John,

Here is the text from the message I posted regarding this:

**

I enabled the positive/negative testing for Declude.

http://www.noxmail.com/imail/noxbeta.zip

This must use http://www.declude.com/release/165i/declude.exe (interim
release) or newer.

To use the No-X-Mail test this way you will need to add

DECLUDETESTONLY TRUE

to the NOXMAIL.NOX configuration file. It will then return a positive exitcode
for SPAM and a negative exitcode for ADULT.

WARNING: I was NOT able to get this to work with Declude as intended. I
checked the Declude logs and the result codes are being sent properly as
positive or negative values, however Declude would fail the test no matter
what. 

I set them up as:
NOXSPAM external >30 "C:\IMail\noxmail\NoXMail.exe" 15  0
NOXADULT external <30 "C:\IMail\noxmail\NoXMail.exe" 15 0

Declude was failing BOTH tests no matter what the score was. I didn't have
time to test this further today, but I am sure that Noxmail is sending the
correct codes. If you run the test as:

NOXMAIL external nonzero "C:\IMail\noxmail\NoXMail.exe" 10 0

then the correct positive or negative result code is always recorded in the
log file. So anyway, you may not want to try changing these tests on a Friday
afternoon.

*

 
On 01/06/03 7:17am you wrote...
>Brain or Scott, what is the syntax for the return code for this?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Friday, January 03, 2003 3:17 PM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] Update for Declude +- test
>> 
>> 
>> Ah yes, the old "Microsoft didn't tell us the correct stuff" ploy. I know
>it
>> well ;-)
>> 
>> Thanks Scott.
>> 
>> On 01/03/03 6:13pm you wrote...
>> >
>> >>Brian, I am not sure that Scott said he had the positive/negative ready
>> >yet.
>> >
>> >This is the first I've heard of an issue with negative return values.
>> >
>> >However, it appears there was a glitch in the code (thanks to Microsoft
>> >reporting that the exit code should be an unsigned long, rather than a
>> >signed long).  There is a new interim release (same URL) that takes care
>of
>> >this issue.
>> >
>> >The new feature is that "greater than" and "less than", which will be in
>> >the next beta (and is in the interim release, as usual).
>> > -Scott
>> >
>> >---
>> >[This E-mail was scanned for viruses by Declude Virus
>> >(http://www.declude.com)]
>> >
>> >com)]
>> >
>> >---
>> >[This E-mail scanned for viruses by Solid Oak Software]
>> >
>> >
>> >Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> >Removal address: [EMAIL PROTECTED]
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>@noxmail.com
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] +/- test question

[Brian Milburn]

The score return is always the greater failure. If spam has a higher score
then it will be called spam. The same for adult.
 
On 01/06/03 7:24am you wrote...
>If a message fails BOTH spam and adult, which score is returned?
>
>My short-term suggestion is to have adult override spam (i.e., return the
>negative exit code whenever the adult test fails).
>
>My longer term suggestion is to allow a command line parameter that would
>tell NoXMail to only check for spam or only check for adult.
>
>Thanks,
>-Bill Naber
> Kitchin Hospitality, LLC
>
>itality, LLC
>
>, LLC
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Updated Utility

[Brian Milburn]

 
I posted a newer version of NoxAnalyze at:

http://www.noxmail.com/imail/noxanalyze.zip

This adds full search (ctrl-f) and search again (F3) by right clicking.

Also, if on the Deleted Messages or Held Messages page, you can highlight a
word and right click and it will search the whole log file.

I included the spool file identifier at the end of the delete and held message
reports. You can highlight that, right click and select "Find in Log" and it
will take you directly to the corresponding log entry for that particular
entry.

I may add remote capabilities via FTP so this program would work off-site. It
would require that you be running an FTP server of some kind on your mail
server.

Also other possibilities:

Administrator delivery of held mail.
Examination and editing of global, domain, and user whitelists and blacklists.
Configuration file editor.

Remote administration would require that there be a consistent file tree for
No-X-Mail.

Example:

   c:
  \imail
  \noxmail
 \logs
 \users
 \hold  

Any problem with this or other ideas?

-Brian


---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] error #2 & Access violation at address 75740054

[Brian Milburn]

Actually, a couple of interim versions back, and I think in the last official
update, he suppressed the message if the "D" file was deleted. Maybe he also
did that for the real "Q" file, but we delete the "_" temporary file which is
what the "Q" file is renamed to when the message is in process.
 
On 01/04/03 3:28pm you wrote...
>> The Declude file errors are due to No-X-Mail deleting the in-process,
>> temporary "Q" file when the message is held. I probably need to clue Scott
>> into the fact we are doing this so he can suppress the error if necessary.
>It
>> should not do any harm other than add a line to the Declude log file. It
>> happens here as well.
>
>If I remember correctly, Scott has said this can be ignored if it is your
>intended action. I do know he was going to make a change at some point so
>that if that error is incurred, Declude stops all processing of that
>message. I am not sure if that has been implemented.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>
>ft.com
>
>
>
>
>
>
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] error #2 & Access violation at address 75740054

[Brian Milburn]

Hi Greg,

Ok, I think I see where the problem may be. You are holding and notifying
users and using a custom rejection message. I changed the message rejection
delivery method last week and this may have introduced the problem. It should
not have caused any unusual behaviour if it is what I think it is.

Actually the error you are seeing can be generated from any 1 of 3 things that
occur during the hold/notify process.

Here is what I did:

1. Separated the 3 items in the block into single items each with its own
unique error so we can see EXACTLY where it it coming from.

2. Fixed what I ~think~ the problem may be.

If #2 corrects the problem, then we do not need to worry about #1 but it is
there anyway. 

The Declude file errors are due to No-X-Mail deleting the in-process,
temporary "Q" file when the message is held. I probably need to clue Scott
into the fact we are doing this so he can suppress the error if necessary. It
should not do any harm other than add a line to the Declude log file. It
happens here as well.

An updated version No-X-Mail with the fixes applied is available at:

http://www.noxmail.com/imail/noxbeta.zip

Please let me know ASAP what the results are.

Thanks

Brian


 
On 01/04/03 5:27pm you wrote...
>zip and send to Brian for me please.
>I do appriciate this.
>I have already deleted the content of the files so I no longer have a local
>copy.  : (
>
>Greg
>
>- Original Message -
>From: "John Tolmachoff" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Saturday, January 04, 2003 4:43 PM
>Subject: RE: [NoXMail] error #2 & Access violation at address 75740054
>
>
>I would take those down right now.
>
>You can zip and send to Brian or if you want I will do it for you, as I have
>saved those locally.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED]
>> Sent: Saturday, January 04, 2003 1:35 PM
>> To: [EMAIL PROTECTED]
>> Subject: Re: [NoXMail] error #2 & Access violation at address 75740054
>>
>> A very large number of my log lines have this error.
>> I have coppied large excerpts from both nox and declude logs to view.
>> refer to ;
>> http://www.cfhosting.net/declude.txt
>> http://www.cfhosting.net/noxmail.txt
>>
>> These are VERY large chuncks of my logs
>> So a fast connection would be a good idea.
>> Let me know what you can find out.
>>
>> I need to delete these after you have seen them
>> to avoid spambots from finding them, please let me know.
>>
>> Greg Hedgepath
>> [EMAIL PROTECTED]
>> http://www.CFHosting.net/
>>
>> ICQ#: 290276 | AIM: colFu
>> Yahoo: cfhosting
>> msn:   [EMAIL PROTECTED]
>>
>> - Original Message -
>> From: "Brian Milburn" <[EMAIL PROTECTED]>
>> To: <[EMAIL PROTECTED]>
>> Sent: Saturday, January 04, 2003 3:05 PM
>> Subject: Re: [NoXMail] error #2 & Access violation at address 75740054
>>
>>
>> >
>> > Hi Greg,
>> >
>> > Does this happen very often? It is a "handled" error condition and not
>> > critical, but I am curious how often you see it and under what
>> circumstances
>> > it may occur. I have never actually seen this error before, although I
>> have
>> > designed the program to recognize and report that it may occur.
>> >
>> > Brian
>> >
>> >
>> >
>> > On 01/04/03 2:32pm you wrote...
>> > >Please explain;
>> > >What is "Could not unlock .. Error #2" ??
>> > >What is "Access violation at address 75740054" ??
>> > >Are these due to the fact the email is being deleted?
>> > >Just want some clarification on these log entries.
>> > >Thanx.
>> > >
>> > >Excerpt from Declude log below.
>> > >01/04/2003 14:24:47 Q34fe07c7011ad907 WARNING: Could not unlock
>> > >C:\IMail\spool\_34fe07c7011ad907.~MD due to error #2.
>> > >
>> > >Excerpt from NoXMail log below
>> > >1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD (IN) [FAILED SPAM] Scores -
>> > >Adult: 0 (Req: 18) Spam: 37 (Req: 22) ExitCode: 37 (Req: 26)
>> > >1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - MSG TO: <[EMAIL PROTECTED]>
>> > >1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - ENV TO: <[EMAIL PROTECTED]>
>> > >1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - MBX TO:

RE: [NoXMail] error #2 & Access violation at address 75740054

[Brian Milburn]

Thanks John, you are correct of course. While the distribution of this list is
very limited, the archives are there for anyone to see.
 
On 01/04/03 2:39pm you wrote...
>Done. 
>
>1. Never put stuff like that out to the public.
>2. Remember, this is a weekend, and people are only on if and when they can
>be.
>
>The only reason I am on right now is because I am babysitting a merger in
>which data has to be transferred and I have to be available to trouble
>shoot.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>
>ft.com
>
>
>
>
>
>
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] error #2 & Access violation at address 75740054

[Brian Milburn]

Hi Greg,

Does this happen very often? It is a "handled" error condition and not
critical, but I am curious how often you see it and under what circumstances
it may occur. I have never actually seen this error before, although I have
designed the program to recognize and report that it may occur.

Brian


 
On 01/04/03 2:32pm you wrote...
>Please explain;
>What is "Could not unlock .. Error #2" ??
>What is "Access violation at address 75740054" ??
>Are these due to the fact the email is being deleted?
>Just want some clarification on these log entries.
>Thanx.
>
>Excerpt from Declude log below.
>01/04/2003 14:24:47 Q34fe07c7011ad907 WARNING: Could not unlock
>C:\IMail\spool\_34fe07c7011ad907.~MD due to error #2.
>
>Excerpt from NoXMail log below
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD (IN) [FAILED SPAM] Scores -
>Adult: 0 (Req: 18) Spam: 37 (Req: 22) ExitCode: 37 (Req: 26)
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - MSG TO: <[EMAIL PROTECTED]>
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - ENV TO: <[EMAIL PROTECTED]>
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - MBX TO: <[EMAIL PROTECTED]>
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - MSG FROM:
><[EMAIL PROTECTED]>
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - MSG SUBJECT: After Christmas
>Sale - Save 75% off Everything in Stock
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - Subject consistent with SPAM:
>3 penalty points added.
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - Found 11 embedded image links:
>6 penalty points added.
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - Matched:  (#Spam)STOCK(1*2)
>(Spam)BEREMOVED(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>(Spam)MAILMARKETING(2*8)
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - Msg processed in: 52ms - Msg
>Size: 7234 bytes
>1/4/2003 2:24:47 PM - D34fe07c7011ad907.SMD - Access violation at address
>75740054. Read of address 75740054 message deleted.
>
>Running latest NoX beta and version 165i declude.
>
>Greg Hedgepath
>[EMAIL PROTECTED]
>http://www.CFHosting.net/
>
>ICQ#: 290276 | AIM: colFu
>Yahoo: cfhosting
>msn:   [EMAIL PROTECTED]
>
>
>-
>[This E-mail scanned for viruses by declude AntiVirus Software]
>
>ware]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Wrong link

[Brian Milburn]

The link for the utility should be:

http://www.noxmail.com/imail/noxanalyze.zip 


Sorry, fat fingers.

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New utility posted

[Brian Milburn]

Hi Guys,

I posted a Windows GUI log file analyzer utility this morning at:

http://www.noxmail/com/imail/noxanalyze.zip

It can be run on the server or on a workstation with network share access to
the No-X-Mail log directory.

It should be pretty clear how it works. Just browse for the log directory
path, select the date  you want to analyze with the date picker (calendar) and
click on the "Analyze" button.

It is a tabbed style interface and has 4 tabs. One shows the same info as
NoxStats, one gives you a list of deleted messages, one gives you a list of
held messages (both show recipient, sender and subject and can be sorted by
recipient) and the last one shows the entire log file.

Let me know if this is useful and if you have any suggestions.

Thanks,

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Moving back to the queue

[Brian Milburn]

Hi Tito,
 
On 01/03/03 3:29pm you wrote...
>Hi Brian,
>I've just installed the software and it looks like it is working pretty good
>and I starting to understand how it works.  Several questions though:
>
>1.  how do I bring back to the queue a quarantined (held) message?

You can't. Only the user can do that by replying to a rejection notice. We
don't rely on the IMail queue functions at all. Everything is done using an
internal SMTP client. The goal is to isolate the administrator from these
kinds of tasks as much as possible.

Other people use No-X-Mail simply as an external test and let Declude take
care of the holding, warning, etc. If this is more what you are looking to do,
I can get some recommended settings for doing this. Actually, there is another
user here (hey John!) that probably can give you better advice on this than
even I can. He is using it this way.

>2. how do I know whether a notification email has been sent to the
>recipient.

You might want to set LOGDETAIL  DEBUG in the NOXMAIL.NOX file for awhile
until you get a handle on how everything is processed. In the log file, a line
will be recorded showing that the message was placed in the hold directory
specified in MOVEDIR. It will also say what address the rejection message was
sent to. I would also recommend setting SPAMMESSAGE DEFAULT and ADULTMESSAGE
DEFAULT unless you see a need to do something differently.

Hope this helps,

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Update for Declude +- test

[Brian Milburn]

Ah yes, the old "Microsoft didn't tell us the correct stuff" ploy. I know it
well ;-)

Thanks Scott.
 
On 01/03/03 6:13pm you wrote...
>
>>Brian, I am not sure that Scott said he had the positive/negative ready
>yet.
>
>This is the first I've heard of an issue with negative return values.
>
>However, it appears there was a glitch in the code (thanks to Microsoft 
>reporting that the exit code should be an unsigned long, rather than a 
>signed long).  There is a new interim release (same URL) that takes care of 
>this issue.
>
>The new feature is that "greater than" and "less than", which will be in 
>the next beta (and is in the interim release, as usual).
> -Scott
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>com)]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] Update for Declude +- test

[Brian Milburn]

I checked with him yesterday and he said this interim release should handle
it. However, I was not able to get it to work properly. Maybe I am doing
something wrong and hopefully Scott will enlighten me :-)

Brian
 
On 01/03/03 2:54pm you wrote...
>Brian, I am not sure that Scott said he had the positive/negative ready yet.
>
>Scott?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Friday, January 03, 2003 2:44 PM
>> To: [EMAIL PROTECTED]
>> Subject: [NoXMail] Update for Declude +- test
>> 
>> 
>> Hi Guys, especially John,
>> 
>> I enabled the positive/negative testing for Declude.
>> 
>> http://www.noxmail.com/imail/noxbeta.zip
>> 
>> This must use http://www.declude.com/release/165i/declude.exe (interim
>> release) or newer.
>> 
>> To use the No-X-Mail test this way you will need to add
>> 
>> DECLUDETESTONLY  TRUE
>> 
>> to the NOXMAIL.NOX configuration file. It will then return a positive
>exitcode
>> for SPAM and a negative exitcode for ADULT.
>> 
>> WARNING: I was NOT able to get this to work with Declude as intended. I
>> checked the Declude logs and the result codes are being sent properly as
>> positive or negative values, however Declude would fail the test no matter
>> what.
>> 
>> I set them up as:
>> NOXSPAM  external >30 "C:\IMail\noxmail\NoXMail.exe" 15  0
>> NOXADULT external <30 "C:\IMail\noxmail\NoXMail.exe" 15  0
>> 
>> Declude was failing BOTH tests no matter what the score was. I didn't have
>> time to test this further today, but I am sure that Noxmail is sending the
>> correct codes. If you run the test as:
>> 
>> NOXMAIL external nonzero "C:\IMail\noxmail\NoXMail.exe" 10 0
>> 
>> then the correct positive or negative result code is always recorded in
>the
>> log file. So anyway, you may not want to try changing these tests on a
>Friday
>> afternoon.
>> 
>> Also, in my profiling tests today I found a potential memory leak if you
>are
>> NOT checking outgoing email messages by default. The memory allocated for
>the
>> process for the "overout.txt" file was not being released properly. It was
>> fixed, so you may want to grab this if you are not scanning outgoing mail.
>> 
>> We are really hammering this now. We are running memory leak checks, speed
>> checks, file access checks, deadlock checks etc. at the rate of tens of
>> thousands an hour. On other words, we are trying to find any possible way
>to
>> create a problem or break it. So far this is the only one we have found
>and it
>> is not potentially severe. We will be running these stress tests the rest
>of
>> the weekend on non critical servers. Things are looking pretty stable so I
>am
>> optimistic that we can wrap up the documentation by Tuesday or Wednesday.
>I am
>> still working on spam-in-progress detection, but this is going to take a
>lot
>> more thought and will be an update later on sometime.
>> 
>> -Brian
>> 
>> 
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>@noxmail.com
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Update for Declude +- test

[Brian Milburn]

Hi Guys, especially John,

I enabled the positive/negative testing for Declude.

http://www.noxmail.com/imail/noxbeta.zip

This must use http://www.declude.com/release/165i/declude.exe (interim
release) or newer.

To use the No-X-Mail test this way you will need to add

DECLUDETESTONLY TRUE

to the NOXMAIL.NOX configuration file. It will then return a positive exitcode
for SPAM and a negative exitcode for ADULT.

WARNING: I was NOT able to get this to work with Declude as intended. I
checked the Declude logs and the result codes are being sent properly as
positive or negative values, however Declude would fail the test no matter
what. 

I set them up as:
NOXSPAM external >30 "C:\IMail\noxmail\NoXMail.exe" 15  0
NOXADULT external <30 "C:\IMail\noxmail\NoXMail.exe" 15 0

Declude was failing BOTH tests no matter what the score was. I didn't have
time to test this further today, but I am sure that Noxmail is sending the
correct codes. If you run the test as:

NOXMAIL external nonzero "C:\IMail\noxmail\NoXMail.exe" 10 0

then the correct positive or negative result code is always recorded in the
log file. So anyway, you may not want to try changing these tests on a Friday
afternoon.

Also, in my profiling tests today I found a potential memory leak if you are
NOT checking outgoing email messages by default. The memory allocated for the
process for the "overout.txt" file was not being released properly. It was
fixed, so you may want to grab this if you are not scanning outgoing mail. 

We are really hammering this now. We are running memory leak checks, speed
checks, file access checks, deadlock checks etc. at the rate of tens of
thousands an hour. On other words, we are trying to find any possible way to
create a problem or break it. So far this is the only one we have found and it
is not potentially severe. We will be running these stress tests the rest of
the weekend on non critical servers. Things are looking pretty stable so I am
optimistic that we can wrap up the documentation by Tuesday or Wednesday. I am
still working on spam-in-progress detection, but this is going to take a lot
more thought and will be an update later on sometime.

-Brian



---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] valid Lic key

[Brian Milburn]

Here is the current beta lic key.

4D7A63324E54493D
 
On 01/03/03 10:51am you wrote...
>Looking for purchase info OR for a valid BETA Version LICENSE  SERIAL
>Number.
>
>Greg Hedgepath
>[EMAIL PROTECTED]
>http://www.CFHosting.net/
>
>ICQ#: 290276 | AIM: colFu
>Yahoo: cfhosting
>msn:   [EMAIL PROTECTED]
>
>
>
>
>
>-
>[This E-mail scanned for viruses by declude AntiVirus Software]
>
>ware]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] FW: No-X-Mail Report

[Brian Milburn]

%Inc = Percent of Incoming messages

%Fld = Percent of Failed messages

I am going to play with the formatting and see if we can fit the full
description in without getting wordwrapped and messing up the format.

 
On 01/03/03 7:17am you wrote...
>Brian, what is the %Inc and %Fld columns?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: No-X-Mail [mailto:[EMAIL PROTECTED]]
>> Sent: Friday, January 03, 2003 12:05 AM
>> To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
>> Subject: No-X-Mail Report
>> 
>> 
>> Reliancesoft, Inc Noxmail Report
>> 
>>  CYBERsitter No-X-Mail Statistics for: Thu, 02 Jan 2003
>>  Report date: Fri, 03 Jan 2003 12:05am
>> 
>>   Incoming Msgs:2462
>>   Outgoing Msgs:  78
>>  Total Msgs:2540
>> 
>>  %Inc%Fld
>>  --- 
>>  Adult Msgs:  50   2%  6%
>>   Spam Msgs: 760  31% 94%
>>Total Failed: 810  33%
>>  Known Spammers:  34   1%  4%
>> Msgs Passed:1606  65%
>>Msgs Ignored:  93   4%
>> 
>> Holding:   1  Messages.
>> 
>>  Avg Spam Score:  60
>> Avg Adult Score:  73
>>  Avg Exit Score:  63
>> 
>>   Avg Proc Time: 154 milliseconds per failed message.
>> 
>> Pattern Updates:  24
>>Failures:   0
>> 
>
>
>
>> 
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Minor update posted

[Brian Milburn]

Hi everyone,

I discovered late yesterday as we were adding some complex patterns to the
pattern files that under certain conditions, conditional definitions were not
being checked if they contained more than 2 optional sections. In other words,
some of the more complicated complex patterns might return a false positive. 

It was a simple fix, it was just a function that had a counter loop exiting
too soon.

http://www.noxmail.com/imail/noxbeta.zip

I also changed the way complex patterns are recorded to the log file. They
were previously recording the actual pattern. This made it hard to debug and
see what the matches actually were. If a complex pattern is matched now, the
actual matching portions of the complex pattern will be logged and enclosed in
curly braces {}. An ampersand, &, separates the individual matches. This makes
it a lot easier to determine exactly what caused the message to fail.

This post is not a critical fix, and whatever false positives that might occur
probably would fail anyway so I seriously doubt that any legit email would be
caught. I would however, recommend replacing your NOXMAIL.EXE with this one,
as we will be converting more of the "marginal" literal word and phrase
patterns into complex patterns to improve their accuracy and lessen the
possibility of false positives.

I will also be working on the blacklisting docs today and over the weekend.
You will be able to create your own complex patterns and the documentation
will provide more detailed information on exactly how they work. They are
really quite useful especially in situations where you know that messages
containing a certain number of normally innocuous words are spam.

-Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New update posted

[Brian Milburn]

Hi everyone!

I posted a new IMPORTANT UPDATED VERSION this morning at:

http://www.noxmail.com/imail/noxbeta.zip 

There are no documentation changes this time.

What is new is that I added a new way of evaluating complex filter patterns.

This allows us to add a single line like (this is psuedo code):

if message contains ("nigeria" OR "zambia" OR "congo" ) AND contains "bank"
and contains "your account" and contains "million" then IT'S A SPAM!

All of this is done in a single pass, and speeds up processing. It also allows
us to assign higher scores to certain patterns when we can be certain that
message is spam when certain complex patterns is matched.

This also has the side benefit of lowering scores (and false positives) of
messages that innocently have words in them that are sometimes characteristic
of spams. 

I tested this over the holiday and I was able to determine that with a few
test complex patterns in our own pattern files, we were able to correctly
identify and stop a significant number of spams tha would have probably gotten
through with high but not failing scores. Also, I tried moving a couple of
words that are most often caught in a false positive into complex patterns and
that eliminated that problem as well.

We are going to start updating the pattern files today to reflect the new
capabilities. It will not break anything on your end, but I would STRONGLY
recommend installing the new NOXMAIL.EXE as soon as possible as some of the
patterns will not be recognized by your version, and some may be gone.

Also new in this version; if you have killscores set to delete messages, and
the killscore you have defined is reached during scanning, the scanning
terminates. No sense kicking a dead horse. On our server, this amounted to an
average ~20% savings in processing time for failed messages.

Also new is a new NoxStats.EXE. Some additional stats are now provided.

-Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] FW: December 2002 Spam Statistics

[Brian Milburn]

Thanks John,

I hope we will be at least 95-96% in January. A lot of progress was made
during December.

Brian
 
On 01/02/03 8:58am you wrote...
>> The three best tests by far are CYBERSITTER (in beta;
>> http://www.noxmail.com/ ) at 92.14%, SNIFFER ( http://www.sortmonster.com
>)
>> at 91.37% and SPAMCOP ( http://www.spamcop.net ) at 83.87%.  However,
>there
>> are quite a few reports of SPAMCOP reporting false positives (which they
>> will hopefully fix by adding the 'spam to legitimate mail ratio' to their
>> TXT record).
>
>Grangrats Brian and your team.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>
>m
>
>
>
>
>
>
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] best way to handle "shoemaker"

[Brian Milburn]

Hi Mark,

Actually, it is in the pattern file as "make$". When I enabled wildcard
matching for the header portions of the message a couple of weeks ago, the $
is now treated as a wildcard character. In the pattern files, some patterns
are flagged to be only used in header and header field scans. 

Anyway, thanks for pointing this out. I fixed it and as soon as your pattern
files update, they will no longer have any problems.

If you or anyone sees any problems like this again, please let me know asap.
The main pattern files were adapted from our web filtering files, and we are
working to refine them to make them better for mail-only scanning. Proper
names are always a problem because they typically do not show up in our
reference dictionaries. Email obviously email uses proper names a great deal
more than web pages do. 

Thanks, and Happy New Year!

Brian
 
On 01/01/03 3:46pm you wrote...
>Brian,
>
>I have two staff members here at the college with the last name of 
>shoemaker.  The word "make" seems to have a pretty high spam rating.  I 
>currently have their names whitelisted but I really don't want spam & adult 
>mail making it to their e-mail accounts (as it would with 
>whitelisting).  Is there a better way to handle this problem?
>
>Thanks.
>
>Mark
>
>
>
>
>
>Mark Seagroves  voice: (865) 471-3506
>Dir, Campus Computing   fax: (865) 471-3555
>Asst Prof, Computer Science e-mail:  [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
>
>
>
>
>
>
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] SPAM/Adult

[Brian Milburn]

No, not yet. I didn't think that Declude supported negative exit code results
yet unless I missed something somewhere, which wouldn't surprise me.
 
On 12/31/02 3:42pm you wrote...
>Is noxmail.exe now returning negative for adult and positive for SPAM and
>the score to declude now?
>
> 
>
>John Tolmachoff MCSE, CSSA
>
>IT Manager, Network Engineer
>
>RelianceSoft, Inc.
>
>Fullerton, CA  92835
>
>www.reliancesoft.com
>
> 
>
>
>Attachment converted: C:\95reply\Attachments\image001(8).gif

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Logging

[Brian Milburn]

Hi John,

It has never logged updates to any file other than the main log file. I don't
know if that would really be useful and I am going to add a report item to
show how many successful filter updates were done over the day.
 
On 12/31/02 3:12pm you wrote...
>Brian, a while ago I noticed that the logging of updates is now reported to
>the same log as defined in NoXMail.nox. I did kind of like it better when it
>logged updates to a separate file.
>
>Can that still be possible?
>
>Say to noxsys.txt in the same directory as the report log?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>
>com
>
>
>
>m
>
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] Correction to file posted earlier

[Brian Milburn]

Sorry, I just posted a replacement for the version I posted this AM.

http://www.noxmail.com/imail/noxbeta.zip

I had added function so that we could use multiple word patterns in the
pattern files. I typically do not post versions with new functions until they
are fully tested, and left this commented out in this mornings update. It has
already been fully tested so I posted an updated version about 5 minutes ago.
I would recommend downloading again and simply extracting NOXMAIL.EXE. 

This allows us to specify that multiple words be found in an email before a
hit is counted. For instance, we can specify that if NIGERIA and BANK and
ASSISTANCE and MILLION are in the message body then, and only then, will a hit
be counted and the score incremented. This will greatly help in reducing false
positives for terms that are frequently used in normal correspondence as well
as in spam.

Thanks and sorry for any inconvenience.

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New Beta posted

[Brian Milburn]

Hi guys, and Happy New Year!

I posted a new version of No-X-Mail this morning that adds a couple of new
items.

  http://www.noxmail.com/imail/noxbeta.zip

The most important addition is the ability to specify fields in whitelists.
These are

TO=
FROM=
SUBJECT=

I was seeing to many whitelist problems where a whitelisted account appeared
in a CC list in the headers causing a message to be whitelisted incorrectly.

If these are not part of the whitelist line, then the headers will be checked
as before.

There was another feature in the whitelist stuff that was never documented but
has been there for awhile.  You can prepend a [##] to a whitelist entry and
only the headers will be checked.

For example: TO=[##][EMAIL PROTECTED] will cause all messaged TO me to have
only the headers checked. That way people can swear at me and call me names
all they want to in the message body and it won't get tagged! 

This is all now documented in the WHITELISTS.PDF file.

There was also an omission in the CONFIGURATION.PDF file I posted yesterday.
Look for HOLDDAYS in the file and you will see what it does.

I also added a new version of NoxStats.exe. Guess what, Declude reported the
old version as having BADHEADERS and from a BROKEN EMAIL CLIENT! Duh...  you
think I would know better. Anyway, this is fixed.


Again, Happy New Year!!

Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New beta version posted

[Brian Milburn]

No, now since these docs will ultimately be the finished docs, changes are
being integrated where they belong with reference to topic. I will call your
attention to the pertinent topics or settings that were changed.
 
On 12/30/02 12:07pm you wrote...
>Brian, are new items in the documents always added at the bottom?
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Monday, December 30, 2002 8:27 AM
>> To: [EMAIL PROTECTED]
>> Subject: [NoXMail] New beta version posted
>> 
>> 
>> I posted a new beta version of No-X-Mail this morning at the following
>> address:
>> 
>> http://www.noxmail.com/imail/noxbeta.zip
>> 
>> I found a memory leak that was not terribly serious and did not occur on
>every
>> message received, but it could lead to system resource/memory reduction
>after
>> many thousands of messages. I would therefor recommend that you install
>this
>> update as soon as possible. Please check the docs referenced below FIRST
>> though.
>> 
>> There have been a couple of other changes...
>> 
>> The held message rejection notice features were changed. The SPAMMESSAGE
>> and
>> ADULTMESSAGE values have changed. There is now a re-done DEFAULT
>> (internally
>> generated) rejection message setting, a one line text setting and an
>external
>> file setting.
>> 
>> Please see CONFIGURATION.PDF for details on the SPAMMESSAGE and
>> ADULTMESSAGE
>> values. You will probably need to change your SPAMMESSAGE and
>> ADULTMESSAGE
>> settings BEFORE installing the NOXMAIL.EXE file because they will act
>> differently. If you are using these values to send messages to users when
>> messages are held, then change these values to:
>> 
>>ADULTMESSAGE  DEFAULT
>> 
>>SPAMMESSAGE  DEFAULT
>> 
>> Then see if the default messages are suitable and if they are not, you can
>> define your own. The default messages were re-done to make them more user
>> friendly.
>> 
>> I also added the capability to have rejection messages for specified users
>to
>> sent to a defined administrator or supervisor (responsible person) instead
>of
>> the user. The defined 'responsible person' can decide if they should be
>> retrieved and delivered to the user.
>> 
>> Please the section on "Special Whitelist Processing Commands" in the
>> WHITELISTS.PDF file for details on how this is done.
>> 
>> There were a couple of other minor changes to the scoring methods, and an
>> experimental test was added (not yet documented) to check for some
>non-english
>> character set spams.
>> 
>> You can add a penalty value by adding to your NOXMAIL.NOX file...
>> 
>> NONENGLISH  2 (or whatever value you want)
>> 
>> The message is then checked to see if characters are used that are
>typically
>> used in foreign languages and if there are enough of them, the NONENGLISH
>> penalty score you define will be added to the SPAMSCORE.
>> 
>> I am also experimenting with some different mechanisms for detecting
>'spams in
>> progress'. I have noticed that most of the spams that get through here
>come to
>> several accounts within a few minutes. Then 10 or 15 minutes later they
>may
>> come to a few more accounts in a different domain. A lot of them appear to
>be
>> done using legitimate mail accounts and have very few indicators of spam
>and
>> the Declude tests seldom indicate any problems either. A good example of
>these
>> are the Nigerian scams. While these do not account for a significant
>> percentage of all spam received, it is now sort of a challenge to me. So
>few
>> spams are getting through now that when even one comes in, it makes me mad
>> and
>> I want to figure out how to detect it! Of course, I could just work on a
>> 'mind-reader' program ;-)
>> 
>> 
>> -Brian
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>@noxmail.com
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New beta version posted

[Brian Milburn]

That is the correct date. That was the date I put it into the ZIP file.
 
On 12/30/02 12:14pm you wrote...
>Also, just to double check, the noxmail.exe has yesterday's date on it.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:NoX-List-
>> [EMAIL PROTECTED]] On Behalf Of Brian Milburn
>> Sent: Monday, December 30, 2002 8:27 AM
>> To: [EMAIL PROTECTED]
>> Subject: [NoXMail] New beta version posted
>> 
>> 
>> I posted a new beta version of No-X-Mail this morning at the following
>> address:
>> 
>> http://www.noxmail.com/imail/noxbeta.zip
>> 
>> I found a memory leak that was not terribly serious and did not occur on
>every
>> message received, but it could lead to system resource/memory reduction
>after
>> many thousands of messages. I would therefor recommend that you install
>this
>> update as soon as possible. Please check the docs referenced below FIRST
>> though.
>> 
>> There have been a couple of other changes...
>> 
>> The held message rejection notice features were changed. The SPAMMESSAGE
>> and
>> ADULTMESSAGE values have changed. There is now a re-done DEFAULT
>> (internally
>> generated) rejection message setting, a one line text setting and an
>external
>> file setting.
>> 
>> Please see CONFIGURATION.PDF for details on the SPAMMESSAGE and
>> ADULTMESSAGE
>> values. You will probably need to change your SPAMMESSAGE and
>> ADULTMESSAGE
>> settings BEFORE installing the NOXMAIL.EXE file because they will act
>> differently. If you are using these values to send messages to users when
>> messages are held, then change these values to:
>> 
>>ADULTMESSAGE  DEFAULT
>> 
>>SPAMMESSAGE  DEFAULT
>> 
>> Then see if the default messages are suitable and if they are not, you can
>> define your own. The default messages were re-done to make them more user
>> friendly.
>> 
>> I also added the capability to have rejection messages for specified users
>to
>> sent to a defined administrator or supervisor (responsible person) instead
>of
>> the user. The defined 'responsible person' can decide if they should be
>> retrieved and delivered to the user.
>> 
>> Please the section on "Special Whitelist Processing Commands" in the
>> WHITELISTS.PDF file for details on how this is done.
>> 
>> There were a couple of other minor changes to the scoring methods, and an
>> experimental test was added (not yet documented) to check for some
>non-english
>> character set spams.
>> 
>> You can add a penalty value by adding to your NOXMAIL.NOX file...
>> 
>> NONENGLISH  2 (or whatever value you want)
>> 
>> The message is then checked to see if characters are used that are
>typically
>> used in foreign languages and if there are enough of them, the NONENGLISH
>> penalty score you define will be added to the SPAMSCORE.
>> 
>> I am also experimenting with some different mechanisms for detecting
>'spams in
>> progress'. I have noticed that most of the spams that get through here
>come to
>> several accounts within a few minutes. Then 10 or 15 minutes later they
>may
>> come to a few more accounts in a different domain. A lot of them appear to
>be
>> done using legitimate mail accounts and have very few indicators of spam
>and
>> the Declude tests seldom indicate any problems either. A good example of
>these
>> are the Nigerian scams. While these do not account for a significant
>> percentage of all spam received, it is now sort of a challenge to me. So
>few
>> spams are getting through now that when even one comes in, it makes me mad
>> and
>> I want to figure out how to detect it! Of course, I could just work on a
>> 'mind-reader' program ;-)
>> 
>> 
>> -Brian
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>> 
>> 
>> Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>> Removal address: [EMAIL PROTECTED]
>
>@noxmail.com
>
>l.com
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New beta version posted

[Brian Milburn]

I posted a new beta version of No-X-Mail this morning at the following
address:

http://www.noxmail.com/imail/noxbeta.zip

I found a memory leak that was not terribly serious and did not occur on every
message received, but it could lead to system resource/memory reduction after
many thousands of messages. I would therefor recommend that you install this
update as soon as possible. Please check the docs referenced below FIRST
though.

There have been a couple of other changes...

The held message rejection notice features were changed. The SPAMMESSAGE and
ADULTMESSAGE values have changed. There is now a re-done DEFAULT (internally
generated) rejection message setting, a one line text setting and an external
file setting.

Please see CONFIGURATION.PDF for details on the SPAMMESSAGE and ADULTMESSAGE
values. You will probably need to change your SPAMMESSAGE and ADULTMESSAGE
settings BEFORE installing the NOXMAIL.EXE file because they will act
differently. If you are using these values to send messages to users when
messages are held, then change these values to: 

   ADULTMESSAGE  DEFAULT

   SPAMMESSAGE  DEFAULT

Then see if the default messages are suitable and if they are not, you can
define your own. The default messages were re-done to make them more user
friendly.

I also added the capability to have rejection messages for specified users to
sent to a defined administrator or supervisor (responsible person) instead of
the user. The defined 'responsible person' can decide if they should be
retrieved and delivered to the user.

Please the section on "Special Whitelist Processing Commands" in the
WHITELISTS.PDF file for details on how this is done.

There were a couple of other minor changes to the scoring methods, and an
experimental test was added (not yet documented) to check for some non-english
character set spams.

You can add a penalty value by adding to your NOXMAIL.NOX file...

NONENGLISH  2 (or whatever value you want)

The message is then checked to see if characters are used that are typically
used in foreign languages and if there are enough of them, the NONENGLISH
penalty score you define will be added to the SPAMSCORE.

I am also experimenting with some different mechanisms for detecting 'spams in
progress'. I have noticed that most of the spams that get through here come to
several accounts within a few minutes. Then 10 or 15 minutes later they may
come to a few more accounts in a different domain. A lot of them appear to be
done using legitimate mail accounts and have very few indicators of spam and
the Declude tests seldom indicate any problems either. A good example of these
are the Nigerian scams. While these do not account for a significant
percentage of all spam received, it is now sort of a challenge to me. So few
spams are getting through now that when even one comes in, it makes me mad and
I want to figure out how to detect it! Of course, I could just work on a
'mind-reader' program ;-)


-Brian

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] False positive (Moved to list)

[Brian Milburn]

There are several 'undocumented' things like this to cover situations as they
arise, *if* they arise. 

I think we are doing something similar to SpamCop, but we don't rely on users
to report spammers. We do however, try to validate our own results with other
services we subscribe to. This round robin type validation can lead to false
positives on occasion as several services may list an IP address at the same
time.

I am experimenting here with what I hope will be a better solution, and I am
going to ask for opinions here soon. One of the things we are trying harder to
identify to get is 'spams in progress'. Currently, we see something come in
that is not caught but has some aspects of spam, and we check the IP against
other known databases. What I am working on is a way that NoxMail can report
"almost failed" messages, say with a score over 10, to a central server. We
can collect the data from other NoXMail users in real time and see if similar
messages from the same IP are coming into other mail servers as well. This
will enable us to catch more of those one shot spams that frequently come from
amateur spammers. The IP addresses would expire after no spams have been
received for 4 hours or so.

This would require that the administrator allow NoxMail to report both the
host IP and the suspect IP addresses to our server, and this may not be
acceptable to everyone. It would also not be truly effective until we have
enough subscribers to get a really valid sampling.
 
We are doing this here now and at one beta site with a fairly high volume. So
far the results are promising, so we'll see how it goes. A high priority is
performance. I don't like database lookups, they are too slow. So this will
probably be a technical challenge as well.

On 12/27/02 12:29pm you wrote...
>> Change the GOODSPAMMER value to 6 or something to make sure it fails more
>> tests before it is flagged as spam.
>
>Good idea and feature. Thank you.
>
>> I see SpamCop has this IP as well. Someone must be doing some significant
>> spamming from there.
>
>Unfortunately, as has been somewhat discussed on the Declude JunkMail forum,
>SpamCop seems to be a little to quick on the trigger lately, and we have
>actually down graded the weight value from hold to major.
>
>John Tolmachoff MCSE, CSSA
>IT Manager, Network Engineer
>RelianceSoft, Inc.
>Fullerton, CA  92835
>www.reliancesoft.com
>
>
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
>> Sent: Friday, December 27, 2002 12:19 PM
>> To: Mail
>> Subject: Re: False positive
>> 
>> 
>> It is too cumbersome to try to evaluate all IP addresses from where spam
>> originates as to whether or not they are a major ISP.
>> 
>> You can however change the offset for the known spammer penalty for major
>> ISPs. We already have them in the pattern file.
>> 
>> Add this line to your NOXMAIL.NOX file.
>> 
>> GOODSPAMMER   2 (this is the default if it is not defined)
>> 
>> Normally known spammers are penalized the maximum penalty for SPAM, by
>> default
>> this is 18. The offset value set by GOODSPAMMER will be subtracted from
>the
>> maximum penalty. In this case it would be 16.
>> 
>> Change the GOODSPAMMER value to 6 or something to make sure it fails more
>> tests before is is flagged as spam.
>> 
>> I see SpamCop has this IP as well. Someone must be doing some significant
>> spamming from there.
>> 
>> 
>> 
>> On 12/27/02 12:01pm you wrote...
>> >I would tend to think that a major ISP server such as AOL, even though a
>> >good amount of SPAM comes forth from it, should not be listed as a known
>> >spam source as it will catch legits.
>> >
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD (IN) [FAILED SPAM]
>> Scores -
>> >Adult: 0 (Req: 18) Spam: 18 (Req: 18) ExitCode: 18 (Req: 22)
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - MSG TO:
>> ><[EMAIL PROTECTED]>
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - ENV TO:
>> ><[EMAIL PROTECTED]>
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - MBX TO:
>> ><[EMAIL PROTECTED]>
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - MSG FROM:
>> ><[EMAIL PROTECTED]>
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - MSG SUBJECT: Need
>> help on
>> >reports
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - No sender name:  2
>> penalty
>> >points added.
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - Known SPAM source:
>> >64.12.137.9 - 16 points added.
>> >12/27/2002 11:55:28 AM - Db02d01ed009a3bca.SMD - Msg processed in: 84ms -
>> >Msg Size: 1338 bytes
>> >
>> > Db02d01ed009a3bca.SMD
>> >Attachment converted: C:\95reply\Attachments\Db02d01ed009a3bca.SMD
>> 
>> ---
>> [This E-mail scanned for viruses by Solid Oak Software]
>
>
>ware]
>
>
>re]
>
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-arch

RE: [NoXMail] Expire held messages

[Brian Milburn]

noxpire.exe must be in the same directory as noxmail.exe and noxmail.nox.

It will check the file dates of the files in the hold directory and delete
them if they are older than the number of days specified.

You should be able to cd\imail\noxmail

and type noxpire 10


 
On 12/27/02 11:04am you wrote...
>Brian,
> No luck, I went to my noxmail directory via command line and did
>"E:\Imail\noxmail>noxpire 10" with no change in the HOLD directory size,
>even tried it with a 5.
>
>It jumps back to the command prompt immediately, shouldn't it look like
>it's doing something (like pause for a moment) when I run it ?
>
>Do I need to specify the path i.e. "noxpire 10 e:\imail\noxmail\HOLD".
>
>Fritz
>
>Frederick P. Squib, Jr.
>Network Administrator
>Citizens Internet Services
>http://www.wpa.net
>
>
>-----Original Message-
>From: [EMAIL PROTECTED]
>[mailto:[EMAIL PROTECTED]] On Behalf Of Brian Milburn
>Sent: Friday, December 27, 2002 10:29 AM
>To: [EMAIL PROTECTED]
>Subject: Re: [NoXMail] Expire held messages
>
>
>
>Hi Fritz,
>
>How are you calling NoXpire?
>
>If you run it as "NoXPire 10" (no quotes) it will expire all messages
>older
>than 10 days.
>
>Brian
>
>---
>[This E-mail scanned for viruses by Citizens Internet Services with Declude
>Virus v 1.65i10]
>
>i10]
>
>
>i10]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Expire held messages

[Brian Milburn]

Hi Fritz,

How are you calling NoXpire?

If you run it as "NoXPire 10" (no quotes) it will expire all messages older
than 10 days.

Brian
 
On 12/27/02 10:19am you wrote...
>Brian,
> I discontinued holding messages a while back, my users just couldn't
>get the hang of putting an [X] in the box...my hold directory is still
>over 1GB and not getting any smaller, is there a trick here that I am
>missing that is causing the messages no to go away after the 10 days?
>
>Fritz
>
>Frederick P. Squib, Jr.
>Network Administrator
>Citizens Internet Services
>http://www.wpa.net
>
>---
>[This E-mail scanned for viruses by Citizens Internet Services with Declude
>Virus v 1.65i10]
>
>5i10]
>
>---
>[This E-mail scanned for viruses by Solid Oak Software]
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]

---
[This E-mail scanned for viruses by Solid Oak Software]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] New version of No-X-Mail posted

[Brian Milburn]

Sorry, I did it again...

http://www.noxmail.com/imail/noxbeta.zip


 
On 12/26/02 8:49am you wrote...
>Brian, I tried http://www.cybersitter.com/noxmail/noxbeta.zip and downloaded
>a zip file that has a NoXMail.exe file dated 12-10-02, so I figured that
>this must not be the latest version you posted...
>
>Bill
>
>-Original Message-
>From: Brian Milburn [mailto:[EMAIL PROTECTED]]
>Sent: Thursday, December 26, 2002 8:00 AM
>To: [EMAIL PROTECTED]
>Subject: [NoXMail] New version of No-X-Mail posted
>
>
> 
>Hi Guys,
>
>I hope everyone had a great Christmas. Too much food for me though, and way
>too much sugar and sweets.
>
>I posted a new version this morning. I made these changes on the 24th, but
>wanted to run it a couple of days before posting it.
>
>The major change is in the saturation calculation. Virtually all the false
>positives for adult messages I have seen here were due to erroneous high
>saturation values. I was previously doing a line count and determining the
>saturation based on the number of lines containing a potentially
>objectionable
>term. This produced unreliable results as a message like:
>
>"We are all meeting at Hooters later"
>
>might produce a saturation value of 90 to 100. Obviously this would be a
>false
>positive.
>
>The solution was to base the calculation on a word count rather than a line
>count. This presents it's own set of problems however because of embedded
>HTML
>tags, URLS, etc. Many messages have hard coded spaces ( ;nbsp or %20 )
>separating words, and that was the reason I originally stayed away from a
>word
>count calculation in determining the saturation.
>
>The only solution that could produce an accurate saturation value however
>was
>to write a function that parses the message to product an accurate word
>count.
>So, this is what I did.
>
>The new version produces a much more accurate saturation value that should
>greatly reduce the number of false positives for adult content tests. We ran
>it over the holiday and I didn't see any false positives at all. 
>
>The other change in this version is the data recorded in the log file for
>the
>LOGDETAIL MID setting. It now shows the intended recipient ( Env To: ) and
>the
>delivery mailbox. 
>
>-Brian
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]
>
>mail.com
>
>---
>[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

[NoXMail] New version of No-X-Mail posted

[Brian Milburn]

 
Hi Guys,

I hope everyone had a great Christmas. Too much food for me though, and way
too much sugar and sweets.

I posted a new version this morning. I made these changes on the 24th, but
wanted to run it a couple of days before posting it.

The major change is in the saturation calculation. Virtually all the false
positives for adult messages I have seen here were due to erroneous high
saturation values. I was previously doing a line count and determining the
saturation based on the number of lines containing a potentially objectionable
term. This produced unreliable results as a message like:

"We are all meeting at Hooters later"

might produce a saturation value of 90 to 100. Obviously this would be a false
positive.

The solution was to base the calculation on a word count rather than a line
count. This presents it's own set of problems however because of embedded HTML
tags, URLS, etc. Many messages have hard coded spaces ( ;nbsp or %20 )
separating words, and that was the reason I originally stayed away from a word
count calculation in determining the saturation.

The only solution that could produce an accurate saturation value however was
to write a function that parses the message to product an accurate word count.
So, this is what I did.

The new version produces a much more accurate saturation value that should
greatly reduce the number of false positives for adult content tests. We ran
it over the holiday and I didn't see any false positives at all. 

The other change in this version is the data recorded in the log file for the
LOGDETAIL MID setting. It now shows the intended recipient ( Env To: ) and the
delivery mailbox. 

-Brian


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] ???

[Brian Milburn]

Hi David,

I just can't give you an answer on this one. I have tried to get this to
generate a false positive using CC's and BCC's but no matter what I have
tried, it works correctly every time. Without knowing the exact format of the
real recipients address, I am at a complete loss for an answer.

Brian
 
On 12/24/02 12:53pm you wrote...
>Brian
>This is a forwarded email. The email is forwarded to his account on our
>server. The local account is [EMAIL PROTECTED] The integxxx.com domain is
>whitelisted as @*integxxx.com as you had suggested. The whitelist works most
>of the time but occasionally fails as it did here. There isn't enough
>information in the logs or the message header to really understnad what
>happened. It is unfortunate that I did not have the DEVDEBUG log level
>enabled. My only guess here, given what little evidence exists, is that it
>did not get whitelisted because the real local TO address was in the BCC or
>CC.
>
>My whitelist is just the domains we host on this server listed as
>
>@*integxxx.com
>@*domain.com
>@*domain2.com
>@*domain3.com
>etc.
>
>Thanks
>
>David
>
>> -Original Message-
>> From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED]]On Behalf Of Brian Milburn
>> Sent: Tuesday, December 24, 2002 11:48 AM
>> To: [EMAIL PROTECTED]
>> Subject: RE: [NoXMail] ???
>>
>>
>>
>> Hi David,
>>
>> I am having a really hard time trying to figure this out.
>>
>> The mail appears to be to: [EMAIL PROTECTED]
>>
>> I don't have a copy of your actual whitelist, so I cannot see
>> what you have in
>> there that is supposed to allow messages to this individual (or
>> domain) to be
>> whitelisted.
>>
>> To whitelist things to this person you would add:
>>
>> [EMAIL PROTECTED]
>>
>> or do that domain you would add:
>>
>> @alum.mit.edu
>>
>> We are running this live on our main mail server that is extremely mission
>> critical and we have seen no whitelist problems at all. Because
>> of the nature
>> of a lot of the legitimate email we receive, we rely very heavily on
>> whitelisting to not filter forms submissions, inquiries from potential
>> customers, tech support requests, etc. Because most of our traffic deals
>> primarily with our CYBERsitter web filtering product, we get a tremendous
>> amount of mail that could be categorized as adult oriented. The
>> whitelisting
>> has worked flawlessly here, and we have some very complicated wildcard
>> patterns, nested whitelist files, and adjusted values.
>>
>> If you like, you can sent me a copy of your whitelist to my normal address
>> instead of posting it to this list. That way I can see EXACTLY
>> what you have
>> there.
>>
>> Thanks
>>
>> Brian
>>
>>
>> On 12/23/02 1:33pm you wrote...
>> >Brian
>> >
>> >Sorry wrong chunk of the LOG
>> >
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD (IN) [FAILED SPAM] Scores -
>> >Adult: 0 (Req: 18) Spam: 22 (Req: 18) ExitCode: 22 (Req: 20)
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - MSG TO:
>> ><[EMAIL PROTECTED]>
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - MSG FROM:
>> ><[EMAIL PROTECTED]>
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - MSG SUBJECT: Happy Holidays
>> >from Ski Country!
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - No sender name:  2 penalty
>> >points added.
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Found 5 embedded
>> image links:
>> >4 penalty points added.
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Matched:
>> >(Spam)PROMOTIONS.??(2*8)
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Msg processed in:
>> 94ms - Msg
>> >Size: 4587 bytes
>> >12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Msg held:
>> >D:\NOX\HOLD\NXFF444572.HLD
>> >
>> >The IMAIL entry
>> >
>> >20021220 171839 127.0.0.1   SMTPD (232C0982) [18.7.21.81] MAIL
>> >From:
>> >20021220 171839 127.0.0.1   SMTPD (232C0982) [18.7.21.81] RCPT
>> >To:<[EMAIL PROTECTED]>
>> >20021220 171839 127.0.0.1   SMTPD (232C0982) [18.7.21.81]
>> >D:\IMail\spool\Da54f232c09829778.SMD 4587
>> >
>> >This entry is prior to having the DEVDEBUG turned on so it
>> doesn't show the
>> >local domain. The domain that this mail was destined for was whitelisted.
>> >IMHO the "env to" should be in the logfile by default.
>> >
>> 

RE: [NoXMail] ???

[Brian Milburn]

Hi David,

I am having a really hard time trying to figure this out.

The mail appears to be to: [EMAIL PROTECTED]

I don't have a copy of your actual whitelist, so I cannot see what you have in
there that is supposed to allow messages to this individual (or domain) to be
whitelisted.

To whitelist things to this person you would add:

[EMAIL PROTECTED]

or do that domain you would add:

@alum.mit.edu

We are running this live on our main mail server that is extremely mission
critical and we have seen no whitelist problems at all. Because of the nature
of a lot of the legitimate email we receive, we rely very heavily on
whitelisting to not filter forms submissions, inquiries from potential
customers, tech support requests, etc. Because most of our traffic deals
primarily with our CYBERsitter web filtering product, we get a tremendous
amount of mail that could be categorized as adult oriented. The whitelisting
has worked flawlessly here, and we have some very complicated wildcard
patterns, nested whitelist files, and adjusted values.

If you like, you can sent me a copy of your whitelist to my normal address
instead of posting it to this list. That way I can see EXACTLY what you have
there.

Thanks

Brian

 
On 12/23/02 1:33pm you wrote...
>Brian
>
>Sorry wrong chunk of the LOG
>
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD (IN) [FAILED SPAM] Scores -
>Adult: 0 (Req: 18) Spam: 22 (Req: 18) ExitCode: 22 (Req: 20)
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - MSG TO:
><[EMAIL PROTECTED]>
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - MSG FROM:
><[EMAIL PROTECTED]>
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - MSG SUBJECT: Happy Holidays
>from Ski Country!
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - No sender name:  2 penalty
>points added.
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Found 5 embedded image links:
>4 penalty points added.
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Matched:
>(Spam)PROMOTIONS.??(2*8)
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Msg processed in: 94ms - Msg
>Size: 4587 bytes
>12/20/02 5:18:52 PM - Da54f232c09829778.SMD - Msg held:
>D:\NOX\HOLD\NXFF444572.HLD
>
>The IMAIL entry
>
>20021220 171839 127.0.0.1   SMTPD (232C0982) [18.7.21.81] MAIL
>From:
>20021220 171839 127.0.0.1   SMTPD (232C0982) [18.7.21.81] RCPT
>To:<[EMAIL PROTECTED]>
>20021220 171839 127.0.0.1   SMTPD (232C0982) [18.7.21.81]
>D:\IMail\spool\Da54f232c09829778.SMD 4587
>
>This entry is prior to having the DEVDEBUG turned on so it doesn't show the
>local domain. The domain that this mail was destined for was whitelisted.
>IMHO the "env to" should be in the logfile by default.
>
>My NOXMAIL.NOX file
>
>POSTMASTER [EMAIL PROTECTED]
>THRESHOLD  4
>PATMATCHES 2
>SATURATION 5
>ADULTSCORE 18
>SPAMSCORE  18
>EXITCODESCORE   20
>KILLSCORE  500
>ADULTKILLSCORE 400
>SPAMKILLSCORE  400
>ROUTEADULTSCORE 250
>ROUTEADULT [EMAIL PROTECTED]
>ROUTESPAMSCORE 250
>ROUTESPAM  [EMAIL PROTECTED]
>MOVEDIRd:\nox\hold\
>SPAMMESSAGEd:\nox\spammail.txt
>ADULTMESSAGE   d:\nox\adultmail.txt
>LOGFILEPATHd:\nox\logs\
>USERDIRd:\nox\users\
>#ADULTSUBJECT
>#SPAMSUBJECT
>ADDHEADER  TRUE
>LOGDETAIL  DEVDEBUG
>WHITELIST  d:\nox\global\whitelist.txt
>REPORTSTO  [EMAIL PROTECTED]
>REPORTTITLESpam Report
>
>The attached HELD file is tainted because I responded to the REJECT
>Notification (recieved via [EMAIL PROTECTED] forwarded to my
>account) so it shows may address in the message ID.
>
>I won't be able to do any more testing like this because I have had to turn
>NOXMAIL off completely. I have customers who ABSOLUTELY don't want their
>mail touched and not being able to reliably enable / disable selectively I
>can't let it do it's magic. I may try setting up another IMAIL server but
>???
>
>Thanks
>David
>
>
>Attachment converted: C:\95reply\Attachments\NXFF444572.HLD


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

Re: [NoXMail] Why such a high adult score on this?

[Brian Milburn]

That's good to hear! Trapping spam is relatively easy. You just block
everything and you get 100% ;-) The hard part is keeping a low false positive
ratio.

After Christmas, I am going to put in another couple of days on this. We have
about 60 days worth of data here and at least 30 days of really good data. We
have cataloged each of out false positives and John had reported some to me as
well. I need to do a little more work on the saturation calculations to try
and prevent what happened to you from happening again. But that is why we test
(and test and test)!

Thanks

Brian
 
On 12/23/02 3:28pm you wrote...
>Thanks Brian.  This helps me better understand.  FWIW, the software is 
>working very well for us now... very few false positives.  I'm combing 
>through the caught spam/porn daily to do fine tuning (whitelisting, etc) 
>and am only seeing a couple of false positives out of 1000+ caught messages 
>daily.  A pretty good ratio.
>
>Mark
>
>
>
>
>
>Mark
>
>At 11:42 AM 12/23/2002, you wrote:
>
>>I sincerely doubt that there would be any way to design a product that can
>>reliably handle these kinds of messages. There were 76 recipients, and one
>of
>>the recipients name was "pern" which also matches the pattern P?RN. We use
>>that for a pattern because that particular word is obfuscated in about 20
>>different ways, and I have seen "PERN-O" before. Because the message was so
>>short (about the equal to of 4 60 character lines, the saturation level was
>>too high.
>>
>>The saturation value is extremely difficult make really accurate with short
>>messages. Many adult messages are very short like this, and it needs to be
>>used, but it can also be the number 1 reason for a false positive.
>>
>>If it wasn't for "PERN" it would have had no adult score at all. If this is
>a
>>regular occurrence, you might want to add [-3]PERN so that if this is the
>word
>>caught, it's value will be negated. Also some creative whitelisting may
>help.
>>Add "PERN" or VOTD.
>>
>>
>>On 12/23/02 2:07pm you wrote...
>> >Brian,
>> >
>> >Why such a high adult rating on this one?  Log entry at bottom.
>> >
>> >Thanks.
>> >
>> >Mark
>> >
>> >
>> >
>> >Date: Mon, 23 Dec 2002 10:30:46 -0500
>> >From: John Cristion <[EMAIL PROTECTED]>
>> >Subject: [NOX ADULT] RE: VOTD
>> >To: "Cristion, John A." <[EMAIL PROTECTED]>,
>> >"\"Ashley Cristion\"" <[EMAIL PROTECTED]>,
>> >Al Greuter <[EMAIL PROTECTED]>, Andersons <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], [EMAIL PROTECTED],
>> >Cathy Benson <[EMAIL PROTECTED]>,
>> >Charlie Stockham <[EMAIL PROTECTED]>, Chuck Dean
><[EMAIL PROTECTED]>,
>> >Connie <[EMAIL PROTECTED]>, Dave Ritch <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], Debbie Carlson <[EMAIL PROTECTED]>,
>> >Delores Johnson <[EMAIL PROTECTED]>, Dematatis <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], Drake Warrick <[EMAIL PROTECTED]>,
>> >Drew Prouse <[EMAIL PROTECTED]>, Duane & Freda Clutts <[EMAIL PROTECTED]>,
>> >"Dub Crawford (E-mail)" <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>> >Emelio <[EMAIL PROTECTED]>,
>> >"Gilbert Jefferson (E-mail)" <[EMAIL PROTECTED]>,
>> >Goodier <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>> >Heather Cristion <[EMAIL PROTECTED]>, Inez <[EMAIL PROTECTED]>,
>> >Iris White <[EMAIL PROTECTED]>, "Iris White (home)" <[EMAIL PROTECTED]>,
>> >Jeff Cook <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED],
>> >Jim & Lyric Bogdanor <[EMAIL PROTECTED]>,
>> >Jim Gregory <[EMAIL PROTECTED]>, Jim Kinnison
>> ><[EMAIL PROTECTED]>,
>> >John Vassar <[EMAIL PROTECTED]>, JR <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], Kara Keener <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], Karen Vassar <[EMAIL PROTECTED]>,
>> >Kathy Greuter <[EMAIL PROTECTED]>, Ken Gosnell <[EMAIL PROTECTED]>,
>> >Ken White <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>[EMAIL PROTECTED],
>> >[EMAIL PROTECTED], Linden and Tonya Mercer <[EMAIL PROTECTED]>,
>> >Louis Redd <[EMAIL PROTECTED]>,
>> >Mark Ridenour <[EMAIL PROTECTED]>, McCarty <[EMAIL PROTECTED]>,
>> >Melody Warford <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>> >Mike Stevens <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>> >Nancy Neel <[EMAIL PROTECTED]>, Norris <[EMAIL PROTECTED]>,
>> >Pastor Steve <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>> >Pern <[EMAIL PROTECTED]>, [EMAIL PROTECTED], [EMAIL PROTECTED],
>> >Rhonda Ritch <[EMAIL PROTECTED]>,
>> >Richard_Higdon <[EMAIL PROTECTED]>,
>> >"Roger Phillips @ work" <[EMAIL PROTECTED]>, Ron Wilson <[EMAIL PROTECTED]>,
>> >Scott Burdick <[EMAIL PROTECTED]>,
>> >Steve & Carol Goslen <[EMAIL PROTECTED]>,
>> >Steve Barber <[EMAIL PROTECTED]>, Steve Crafton <[EMAIL PROTECTED]>,
>> >"Steve Goslen (work)" <[EMAIL PROTECTED]>,
>> >Steve Soliday <[EMAIL PROTECTED]>, Taylor <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], Terry Rudd <[EMAIL PROTECTED]>,
>> >[EMAIL PROTECTED], Vernon Stark <[EMAIL PROTECTED]>
>> >Reply-to: [EMAIL PROTECTED]
>> >X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
>> >Importance: Normal
>> >X-CYBERsitter-NoXMail: FAILED - Score Adult: 29 (Req: 18) Spam: 19 (Req:
>> >18) 

Re: [NoXMail] Why such a high adult score on this?

[Brian Milburn]

I sincerely doubt that there would be any way to design a product that can
reliably handle these kinds of messages. There were 76 recipients, and one of
the recipients name was "pern" which also matches the pattern P?RN. We use
that for a pattern because that particular word is obfuscated in about 20
different ways, and I have seen "PERN-O" before. Because the message was so
short (about the equal to of 4 60 character lines, the saturation level was
too high. 

The saturation value is extremely difficult make really accurate with short
messages. Many adult messages are very short like this, and it needs to be
used, but it can also be the number 1 reason for a false positive.

If it wasn't for "PERN" it would have had no adult score at all. If this is a
regular occurrence, you might want to add [-3]PERN so that if this is the word
caught, it's value will be negated. Also some creative whitelisting may help.
Add "PERN" or VOTD.

 
On 12/23/02 2:07pm you wrote...
>Brian,
>
>Why such a high adult rating on this one?  Log entry at bottom.
>
>Thanks.
>
>Mark
>
>
>
>Date: Mon, 23 Dec 2002 10:30:46 -0500
>From: John Cristion <[EMAIL PROTECTED]>
>Subject: [NOX ADULT] RE: VOTD
>To: "Cristion, John A." <[EMAIL PROTECTED]>,
>"\"Ashley Cristion\"" <[EMAIL PROTECTED]>,
>Al Greuter <[EMAIL PROTECTED]>, Andersons <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], [EMAIL PROTECTED],
>Cathy Benson <[EMAIL PROTECTED]>,
>Charlie Stockham <[EMAIL PROTECTED]>, Chuck Dean <[EMAIL PROTECTED]>,
>Connie <[EMAIL PROTECTED]>, Dave Ritch <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], Debbie Carlson <[EMAIL PROTECTED]>,
>Delores Johnson <[EMAIL PROTECTED]>, Dematatis <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], Drake Warrick <[EMAIL PROTECTED]>,
>Drew Prouse <[EMAIL PROTECTED]>, Duane & Freda Clutts <[EMAIL PROTECTED]>,
>"Dub Crawford (E-mail)" <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>Emelio <[EMAIL PROTECTED]>,
>"Gilbert Jefferson (E-mail)" <[EMAIL PROTECTED]>,
>Goodier <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>Heather Cristion <[EMAIL PROTECTED]>, Inez <[EMAIL PROTECTED]>,
>Iris White <[EMAIL PROTECTED]>, "Iris White (home)" <[EMAIL PROTECTED]>,
>Jeff Cook <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED],
>Jim & Lyric Bogdanor <[EMAIL PROTECTED]>,
>Jim Gregory <[EMAIL PROTECTED]>, Jim Kinnison
><[EMAIL PROTECTED]>,
>John Vassar <[EMAIL PROTECTED]>, JR <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], Kara Keener <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], Karen Vassar <[EMAIL PROTECTED]>,
>Kathy Greuter <[EMAIL PROTECTED]>, Ken Gosnell <[EMAIL PROTECTED]>,
>Ken White <[EMAIL PROTECTED]>, [EMAIL PROTECTED], [EMAIL PROTECTED],
>[EMAIL PROTECTED], Linden and Tonya Mercer <[EMAIL PROTECTED]>,
>Louis Redd <[EMAIL PROTECTED]>,
>Mark Ridenour <[EMAIL PROTECTED]>, McCarty <[EMAIL PROTECTED]>,
>Melody Warford <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>Mike Stevens <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>Nancy Neel <[EMAIL PROTECTED]>, Norris <[EMAIL PROTECTED]>,
>Pastor Steve <[EMAIL PROTECTED]>, [EMAIL PROTECTED],
>Pern <[EMAIL PROTECTED]>, [EMAIL PROTECTED], [EMAIL PROTECTED],
>Rhonda Ritch <[EMAIL PROTECTED]>,
>Richard_Higdon <[EMAIL PROTECTED]>,
>"Roger Phillips @ work" <[EMAIL PROTECTED]>, Ron Wilson <[EMAIL PROTECTED]>,
>Scott Burdick <[EMAIL PROTECTED]>,
>Steve & Carol Goslen <[EMAIL PROTECTED]>,
>Steve Barber <[EMAIL PROTECTED]>, Steve Crafton <[EMAIL PROTECTED]>,
>"Steve Goslen (work)" <[EMAIL PROTECTED]>,
>Steve Soliday <[EMAIL PROTECTED]>, Taylor <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], Terry Rudd <[EMAIL PROTECTED]>,
>[EMAIL PROTECTED], Vernon Stark <[EMAIL PROTECTED]>
>Reply-to: [EMAIL PROTECTED]
>X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
>Importance: Normal
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 29 (Req: 18) Spam: 19 (Req: 
>18) Tot: 48 (Req: 20)
>X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
>X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10.
>X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-Declude-Spoolname: D2beb0a0800cec4a6.SMD
>X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, WEIGHT10, CYBERSITTER
>
>[The Angel Gabriel speaking to Mary:]
>"For with God nothing will be impossible." Then
>Mary said, "Behold the maidservant of the Lord!
>Let it be to me according to your word."
>
>Luke 1:37-38
>Have a terrific Monday!
>
>
>
>
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD (IN) [FAILED ADULT] Scores - 
>Adult: 29 (Req: 18) Spam: 19 (Req: 18) ExitCode: 48 (Req: 20)
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD - (Adult test) Hits/Wgt: 1/3 
>(Req: 4) Matches: 1 (Req: 2) Saturation: 25 (Req: 5)
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD - MSG TO: 
><[EMAIL PROTECTED]>
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD - MSG FROM: 
><[EMAIL PROTECTED]>
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD - MSG SUBJECT: RE: VOTD
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD - Excessive Routing: 4 
>penalty points added.
>12/23/2002 10:29:49 AM - D2beb0a0800cec4a6.SMD - TO address contains 
>

RE: [NoXMail] ???

[Brian Milburn]

David, 

What I really need to see is the portion of the log file where the message was
held. Also, it would also be helpful to see the file that was held as it
exists in the MOVEDIR directory. It looks like some header information is
missing here. What I need to see is why the message failed and was held. Just
knowing it was held does not help me figure out why it happened.

Also, you can look at the headers of the rejection message that this user
received. The headers are left in tact, so there may be some clues there too.

I would strongly recommend NOT turning off ADDHEADER if you have. It makes it
a lot more difficult to debug problems. There should be the name of the
original SMD file in the header of the held message, and from there, you can
refer to the log file and look for that entry.
 
On 12/23/02 11:24am you wrote...
>Brian
>
>A chumk of the logfile
>
>12/23/02 8:42:51 AM - D20e7014603586714.SMD (OUT) [REQUEST HOLD] -
>[EMAIL PROTECTED]
>12/23/02 8:42:58 AM - D20ec015503827c70.SMD (IN) [IGNORED] - @*corte.com
>whitelisted.
>12/23/02 8:42:58 AM - D20eb58b4037e77dc.SMD (IN) [IGNORED] - @*prime.com
>whitelisted.
>12/23/02 8:42:59 AM - D20e9014c03586ed4.SMD (OUT) [IGNORED] From:
>[EMAIL PROTECTED] - Outgoing Mail.
>12/23/02 8:43:00 AM - D20eb0084037277cd.SMD (IN) [IGNORED] - @*prime.com
>whitelisted.
>12/23/02 8:43:03 AM - D20f412bc037a9865.SMD (OUT) [IGNORED] From:
>[EMAIL PROTECTED] - Outgoing mail.
>12/23/02 8:43:12 AM - D20ea014d03587397.SMD (IN) [IGNORED] - @*integxxx.com
>whitelisted.
>
>The top line shows a HOLD but the last line is IGNORED because it is
>whitelisted.
>The logs are full of IGNORED for integxxx.com email but every once in a
>while every domain I have whitelisted
>has a message(s) that get REQUEST HELD. I only have one domain that is NOT
>whitelisted "netraprise.com".
>
>The whitelist is
>
>@*domain.com
>@*domain2.com
>@*domain3.com
>
>This is the header for the HELD message as clipped from the held message.
>
>
>Received: from alum.mit.edu [18.7.21.81] by mx2.netraprise.com with ESMTP
>  (SMTPD32-7.13) id A54F232C0982; Fri, 20 Dec 2002 17:18:39 -0600
>Received: from BLIZZARD.SNOW.COM (blizzard.snow.com [206.168.50.136])
>   by alum.mit.edu (8.9.2/8.9.3) with ESMTP id SAA12325
>   for <[EMAIL PROTECTED]>; Fri, 20 Dec 2002 18:18:38 -0500 (EST)
>Message-ID: <[EMAIL PROTECTED]>
>Received: from BLIZZARD (blizzard.vailresorts.com) by BLIZZARD.SNOW.COM
>(LSMTP for Windows NT v1.1b) with SMTP id <[EMAIL PROTECTED]>;
>Fri, 20 Dec 2002 16:14:34 -0700
>Date: Fri, 20 Dec 2002 16:12:29 -0700
>From: [EMAIL PROTECTED]
>To: [EMAIL PROTECTED]
>Subject: Happy Holidays from Ski Country!
>Mime-Version: 1.0
>Content-Type:
>multipart/alternative;boundary="JwzbXm8skkoGssmQg8yYt70JupPmgZfq1gdvEB7R"
>X-CYBERsitter-NoXMail: Delivery request
>
>This is a multi-part message in MIME format.
>If you are reading this text, you may want to consider changing to a mail
>reader
>or gateway that understands how to properly handle MIME multipart messages.
>
>--JwzbXm8skkoGssmQg8yYt70JupPmgZfq1gdvEB7R
>Content-Type: text/plain; charset=us-ascii
>Content-Transfer-Encoding: 7bit
>Content-Disposition: inline
>
>
>ine
>
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]

RE: [NoXMail] ???

[Brian Milburn]

David,

You are going to have to give me more details. This is one of those "doesn't
work what's wrong" messages ;-)

First, you will need to DEVDEBUG to see the "Env To". Sorry, I should have
mentioned that. This is helpful only insosfar as determining who the message
is actually supposed to be going to.

I will need to see the headers from a sample message that bypasses the
whitelist, and also the whitelist itself where the definition is that should
have caused the message to be whitelisted.
 
Brian

On 12/23/02 10:12am you wrote...
>Brian
>I don't see the local Env to address in the log files and I still get
>messages that bypass the whitelist.
>
>Thanks
>David
>
>
>> The "Env to" log line shows the intended (Envelope to) address.
>>
>>
>
>
>>
>>
>
>
>Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
>Removal address: [EMAIL PROTECTED]


Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]