Hello All,
I've got a problem with Declude catching mail from my web server. The web
server is sending mail from web forms that customers fill out to users
hosted on my email server. I'm getting HELOBOGUS and MAILFROM warnings,
stating that the domain "server_name" does not have any MX/A records.
Hi Scott,
Can I manually move spooled D and Q-files in the overflow folder?
When they will be respooled?
Markus
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail t
I've had issues with Outblaze's clients, mail.com, e-mail.com, when I was
blocking them Outblaze contacted me about it. I have to say in their
defense, when I had an issue with a user of theirs they took care of it
right away and terminated the account. In a way it's no big deal, the
spammer has 10
Add the appropriate records in your DNS.
John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA 92835
www.reliancesoft.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED]] On Behalf Of Troy Hilton
> Sent: Tues
Hi,
I'm trying to see if a certain IP address is listed in any of the
Orbz-like spam databases.
What, in everyone's opinion, is the most common one used?
TIA
Sharyn
We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged "Best in the World" at the annu
Can I manually move spooled D and Q-files in the overflow folder?
When they will be respooled?
You can, but it is not recommended.
If there are any files in the overflow directory (there should only be Q*.*
files in there), it means that your mailserver is overloaded (not that it
*was* overl
I've got a problem with Declude catching mail from my web server. The web
server is sending mail from web forms that customers fill out to users
hosted on my email server. I'm getting HELOBOGUS and MAILFROM warnings,
stating that the domain "server_name" does not have any MX/A records. How
can I
No there is no file in the overflow directory.
The problem is not that there are to much msgs for the server. The
problem is that there are 600 clients returning from holidays and
everone begins to donwload his email. In addition they begin to send
relative large mails ("here the picture where I'm
>From InternetWeek at
http://www.internetwk.com/breakingNews/INW20030106S0006:
ExactTarget, which provides e-mail marketing services, introduced technology
on Monday designed to help legitimate bulk mailers evade spam filters. The
service added two new features: Content Detective identifies words,
So we have a very large spool folder with many timed out delivery
attempts and I will try to move some large msgs in a temporary folder
until tonight.
Ah, I see.
The overflow directory won't help here -- if you move the
\IMail\spool\Q*.SMD files to the \IMail\spool\overflow directory, Declude
Scott/All,
I can't retrieve the extended info for code a400010b. Does anyone have
it on hand?
-Sandy
Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]
I can't retrieve the extended info for code a400010b. Does anyone have
it on hand?
That one is caused by a missing To: header.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
Hi Sharyn,
I don't know about popularity, but I'd use the SPAM database lookup tool at
http://www.dnsstuff.com/
There's also an interesting article posted at
http://www.sdsc.edu/~jeff/spam/Blacklists_Compared.html
Burzin
Hi,
I'm trying to see if a certain IP address is listed in any of th
> So there are a lot of msgs where the remote mailserver after some
> mb's of transfered data terminates the trasmission.
Any mail server that terminates the session instead of sending a 5xx
is broken, as it's just inviting more waste on both sides. If the
server terminates
>>I can't retrieve the extended info for code a400010b. Does anyone
>>have it on hand?
> That one is caused by a missing To: header.
Thanks--I would've caught it if I'd had the original e-mail, but I
just had the alert. Is it indeed not at /tools/badheaders?
-Sandy
---
[This E-mail was s
I don't know about popularity, but I'd use the SPAM database lookup tool
at
http://www.dnsstuff.com/
That's perfect..that's exactly what I was looking for!
Thanks!
Sharyn
We are the worldwide producer and marketer of the award winning Cruzan
Single Barrel Rum, judged "Best in the World" at t
I'm rather fond of this web tool for doing multiple simultaneous lookups:
http://openrbl.org/
Specifically, it returns hyperlinks and text messages if returned by the bl.
It also puts up spam related news and info.
Andrew 8)
-Original Message-
From: Sharyn Schmidt [mailto:[EMAIL PROTECT
> Any mail server that terminates the session instead of
> sending a 5xx is broken, as it's just inviting more
> waste on both sides.
Why they don't answer with an 5xx code?
There was one single "531 - Mailbox has exceeded disk quota" today but a
lot of
01:07 10:00 SMTP-(07BC) >.
0
Scott/All,
- I've found HELOBOGUS is often counterproductive, even with a low
weight, since legit sites, even (especially?) "big guns" (Fortune 500,
whatever) often give their servers fully-qualified, RFC-legal--yet
publicly nonexistent--hostnames. What would help a lot, I think, is
the
> Why they don't answer with an 5xx code? There was one single "531 -
> Mailbox has exceeded disk quota" today...
Because they're stupid. They don't want to wait, so they just keep it
comin' 1/2 hour later.
>> If the server terminates the session and blacklists you temporarily
>> or permanently
I have a persitant old lady that is very upset by the fact we do not allow
EXE files. She is making greeting cards with MS Home Publisher. I showed her
this link on Microsofts site
http://office.microsoft.com/assistance/2000/Out2ksecFAQ.aspx , but she is
still adamant that it does not pertain to Ho
- I've found HELOBOGUS is often counterproductive, even with a low
weight, since legit sites, even (especially?) "big guns" (Fortune 500,
whatever) often give their servers fully-qualified, RFC-legal--yet
publicly nonexistent--hostnames. What would help a lot, I think, is
the ability t
Any one have a fairly up to date list?
John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA 92835
www.reliancesoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing
Is anyone having problems using relays.osirusoft.com and relays.ordb.org?
Should I comment these out in the global.cfg file to avoid excessive
timeouts?
It's a temporary problem due to the "Santa Monica Winds" in California,
which are apparently blowing cars from one lane on highways to anothe
We've setup the following domains:
@yahoo.com
@yahoo.co.uk
hotmail.com
msn.com
email.com
aol.com
@mail.com
lycos.com
lycos.co.uk
@usa.net
earthling.net
xx.com
I think Len Conrad should have a lot more of them:
He wrote today on the Imail-list:
"One of the ways IMGate stops spam is, for 3500 domai
> earthling.net
I am sure that is earthlink.net, correct? Of course, some people claim they
are aliens. :))
John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA 92835
www.reliancesoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www
That's Santa _Ana_ winds Scott ;-)
It has been in the 80's here in So Cal. and the winds have knocked out our
electricity twice for a total of about 8 hours, and our backup copper T1 once.
Our big fiber line and batteries have kept us up and running. This morning I
woke up and when I turned on t
> It's also important to realize the purpose of the HELOBOGUS test. It
> isn't designed primarily to catch spammers. It's designed to help
> detect poorly administered mailservers -- ones that are likely to be
> abused by spammers.
True, but if you're using HELOBOGUS for anything oth
Is anyone having problems using relays.osirusoft.com and relays.ordb.org?
Should I comment these out in the global.cfg file to avoid excessive
timeouts?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.
> That's Santa _Ana_ winds Scott ;-)
Brian, you got it easy up there in Santa Barbra. Try being in the San
Gabriel Valley where I live. Remember the 2 big fires we had a number of
months ago? All that ash is in the air and in eyes and lungs and everywhere.
The area around them looks like a big bla
My list would be the same as previously cited, and yes, earthling.net is not
a typo.
All of these would make it to my list as the "top faked from: domains". But
of the ones that I've seen make it through to the spamtraps, none. Which is
why I haven't implemented a small negative weight for these
Don't say "fires". It makes me nervous. Been through 2 here already, lost 1
house, and just bought a big house above a canyon that hasn't burned in 40
years.
On 01/07/03 3:24pm you wrote...
>> That's Santa _Ana_ winds Scott ;-)
>
>Brian, you got it easy up there in Santa Barbra. Try being in the
Is there a gotcha in filter text files when the message is in HTML format?
The following line works if I send myself a message from HotMail, but didn't
on an actual piece of spam I just received, whose relevant bit of text I'll
reproduce here with an underscore inserted to get around my own filter
Is there a gotcha in filter text files when the message is in HTML format?
No (unless the spammer uses comments to break up text that would otherwise
be filtered).
Unsubscribe
at: [EMAIL PROTECTED]
**
If you add a line "BODY 0 CONTAINS bta_mail.net.cn", it should work.
(sigh) Keyboard virus... I should have had an underscore in *both* of the
entries. To recap I'll reproduce here with an underscore inserted to get
around my own filter:
#Dec-02-2002 AC Very common in Chinese hosted spamvertisement
# "unsubscribe" footers
BODY 0 CONTAINS bta_mail.net.cn
And the "
BODY 0 CONTAINS bta_mail.net.cn
Unsubscribe
at: [EMAIL PROTECTED]
**
That should get caught. Does the "BODY 0 CONTAINS bta_mail.net.cn" line
contain any spaces/tabs at the end of it? Could the E-mail that was caught
have been sent using base64 encoding perhaps?
Except for the underscore I inserted, both snippets are verbatim. No
trailing spaces or hidden control characters. The message was not in
Base-64. I just checked my Declude log for today and it did fire off on 7
other messages today.
I'll include the whole spam message in an attachment here.
A
> Any one have a fairly up to date list?
I have a list of servers that are considered ISPs, Mail Services
and services that may be significant. Let me know off the list
if this is what you are looking for.
Regards,
Tom
Image`fx
---
[This E-mail was scanned for viruses by Declude Virus (http:/
I use the Spam Database Lookup tool on Scott's www.dnsstuff.com.
John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA 92835
www.reliancesoft.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED]] On Behalf O
> What would be nice, though,
> is if IMail had a way of listing all the SMTP processes in
> memory and what
> they were working on, and allowed you to stop them.
Can we place another wish list, even if christmas just passed?
;-)
> In this case, you could move some of the Q*.SMD files to a te
Thanks--I would've caught it if I'd had the original e-mail, but I
just had the alert. Is it indeed not at /tools/badheaders?
No, it isn't -- the problem is that there were some other flags in there
that were causing the lookup tool to fail.
-Scott
---
Horrifying doublespeak: they agree that spamtraps are foolproof
evidence of harvesting, and yet they may somehow be found in an
otherwise verifiable opt-in list? I'm sure their verification process
is really in-depth.
Anyone thought about how much they could have made by getting $5
42 matches
Mail list logo
