Title: Message
Hi;
Recently we are
noticing a higher incidents of mail coming to us from the backup mail
server. This is hosted elsewhere but somehow the SPAM'ers are sending
e-Mail to that server to come to us. I think they probably think that we
have that server in a WhiteList, therefore
Recently we are noticing a higher incidents of mail coming to us from the
backup mail server. This is hosted elsewhere but somehow the SPAM'ers are
sending e-Mail to that server to come to us. I think they probably think
that we have that server in a WhiteList, therefore it will come
Hi Scott:
Sorry to have sent the entire header but I think I did not relay the
issue clearly. Look at the header and see who it is sent to. We have
no business receiving an email that is addressed to:
[EMAIL PROTECTED] since this is our backup mail server.
When they send it to that address
Hi Again:
Just to complement the previous posting: Look at the following SPAM
=
Received: from njohhd ([65.138.136.163])
by mail.americana.com.do (Lotus Domino Release 5.0.9a)
with SMTP id 2002073008494562:2754 ;
Tue, 30
Sorry to have sent the entire header but I think I did not relay the
issue clearly. Look at the header and see who it is sent to. We have
no business receiving an email that is addressed to:
[EMAIL PROTECTED] since this is our backup mail server.
So you're talking about filtering on the
Right now, the only way to do that would be to set up a filter on the
headers, using the latest beta version.
--- You mean 1.56? Or is 1.7 out? On the site there is 1.56.
You can always go to http://www.declude.com/junkmail/manual.htm to find out
what the latest version is. Right now, the
Now the question: Can we add a weigh to the address used in the To List?
SP I don't think that is currently possible. Why would you want to do
that,
though?
Scott,
actually, I had wished for this myself for a while. We DO have a few
legacy domain names where 99% of the incoming messages
We have just released Declude JunkMail v1.57 (beta). Changes include:
o HELOBOGUS will now only be tested on non-local senders.
o HELO detection wasn't using correct hop; fixed.
o An issue STARTSWITH in filter was fixed.
o ROUTETO/COPYTO can now use variables (IE
Reply to: R. Scott Perry
Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 9:44:55
AM
Scott, I am seeing 'whitelisted automatically' ??? How does his
work?
--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com
- Copy of Original Message(s): -
R We have
Would this be proper syntax of the new features?
REMOTEIP8 IS 218.17.92.184
REVDNS 8 ENDSWITH.are.net
...
Yes, that is the correct syntax. IS looks for an exact match (so
REMOTEIP 8 IS 218.17.92. would never catch anything, since an IP
Scott, I am seeing 'whitelisted automatically' ??? How does his work?
Do you mean that you are seeing a log file entry This E-mail was
whitelisted - automatically passing all spam tests?
We added that log file entry because SO many people have complained about
E-mail not getting caught,
Hey, that's great, no more searching for why a message did not get caught by
any spam tests!
Bill
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 8:18 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta)
I made a pointing of defining LOG_OK = none - so I never expected to see
those whitelist entries in my log either.
The problem is that the failed log messages and the whitelisted
logically go together, since the whitelist entry cancels out the failed
entries. If there was a way that we could
Declude would examine the TLD of the sender and then looks for an REVDNS.DE
alert message. If none is found, it uses for the default REVDNS bounce
message.
That's an interesting idea -- it has been added to the suggestion database.
-Scott
---
[This E-mail was scanned
Hi Scott:
REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\lenient.cfg
hhh that would be a cool feature.
Instead of whitelisting Postmaster@ I could now decide to simply test
those differently.
But - since this is essentially per user configuration - will that feature
demand Pro level
Hey, thanks Scott, as always, you're awesome!
Bill
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 10:15 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released
Wishlist items:
1. send out rhsbl
Here is an update for the kill list for
07/30/02 - Even though each address is
checked, we strongly suggest you use it
at your own risk. The entire list can
be downloaded from the following URL:
http://www.imagefxonline.net/apps/delog/fromfile.txt
Regards,
Tom
Image`fx
Title: Message
Hi;
Has anyone seen a
valid or a legitimate e-Mail that is addressed as follows:
To: #recipient#@Domain.com
a number of SPAMS
received have that as the address in the TO field. With the new HEADER
option in 1.57 beta we can filter this from the HEADER section so I am
Does the HEADER filter look at the header before DECLUDE adds all its
headers? or we can't say which is first?
It looks at the header before the Declude headers are added.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
Tom,
How do you determine when to use an entry like
.ac-mail.net
versus an entry like
@123jumo.com
Thanks!
Rob
Hopkins Mailing Services, Inc.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Tom
Sent: Tuesday, July 30, 2002 3:05 PM
To: [EMAIL
How do you determine when to use an entry like
.ac-mail.net
versus an entry like
@123jumo.com
In general, the .ac-mail.net entry would match @hostname.ac-mail.net
but not @ac-mail.net. @123juno.com would match @123juno.com, but not
@hostname.123juno.com.
-Scott
How do you determine when to use an entry like
.ac-mail.net
versus an entry like
@123jumo.com
This depends on the address the spammer used, I always try to use
.abc.com if and when possible, however, some spammers send mail
using the root address.
If the spammer uses [EMAIL PROTECTED] I
I have a weight setup for WEIGHT20, but it was commented out in my
default.junkmail file but the logs showed an actual message that failed
this test even though it was commented out.
Using Version 1.57 beta, did not see this happen with 1.55b.
$default$.junkmail
WEIGHT15HOLD
#WEIGHT20
I have a weight setup for WEIGHT20, but it was commented out in my
default.junkmail file but the logs showed an actual message that failed
this test even though it was commented out.
That is the correct behavior. If you do not want to see the WEIGHT20 test
entries in the log, you would have
Scott,
I got a telephone call from a customer about a particular e-mail which
wasn't making the trip.
I found it in the Declude log file. Please note the IP address
reported by Declude:
07/29/2002 08:06:44 Q3dda126 Msg failed RBL (This E-mail came from 0.0.0.0, a
potential spam source listed
I found it in the Declude log file. Please note the IP address
reported by Declude:
07/29/2002 08:06:44 Q3dda126 Msg failed RBL (This E-mail came from
0.0.0.0, a potential spam source listed in RBL.).
That is very odd. Which version of Declude are you running? Do you by
chance have a copy
Scott, I haven't tried this feature yet, but I was wondering if the REMOTEIP
feature will follow the IPBYPASS and HOP settings and ignore our mail
gateway ip addresses? These new features are really cool and add nice
functionality to the overall filter capabilities.
Thanks,
Bill
---
[This
Hmmm, let me reply to my own question with another question. When using the
REMOTEIP feature, with the IS flag, does it just look for an exact match
anywhere in the headers?
Bill
-Original Message-
From: Bill Landry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 5:42 PM
To:
Perfect!
Thanks,
Bill
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 6:00 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] REMOTEIP feature question
Scott, I haven't tried this feature yet, but I was wondering if the
REMOTEIP
I have been looking back through my email trying to catch up and have
noticed a few messages related to spamreview. As the developer I have no
problem with this software being discussed here but would prefer all problem
related issues be directed to [EMAIL PROTECTED] Not that it bothers me
for
30 matches
Mail list logo
