All IMail tests are run before Declude and can therefore be tracked by
JunkMail, with the single exception of the IMail Statistical Filtering test,
which is run by IMail after the message is received back from Declude and
just before the final delivery of the message to the recipient.
Bill
-
Ditto for me, not a single message ever caught by this test.
Bill
- Original Message -
From: Kami Razvan [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, November 27, 2003 1:14 PM
Subject: RE: [Declude.JunkMail] Subject and body is B
Hi;
I suggested body blank but frankly it
if we comment out a test in global.cfg and leave its action in
default.junkmail
will there be any problems ? errors, performance issues, ...
No, there will be no problems in doing that, as far as Declude is
concerned. However, it may cause confusion later, if you see the test
listed and are
All this conversation about betas/releases, etc.
Scott, you have the patience of a saint at times.
Do what you think is best. You can never keep everyone happy all the time.
Andy
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, November
Hi Scott
Second the manual we can have up to 20 IPBYPASS entries.
At the moment I'm already over this limit:
IPBYPASS194.242.192.2 # local providers
IPBYPASS194.242.192.3
IPBYPASS194.242.196.14
IPBYPASS213.21.176.244
IPBYPASS213.21.176.246
IPBYPASS
I'm running IMail v8.02 on Windows 2000 Server SP4 etc, and am now running
declude.exe 1.76i28; today I saw an HTML style spam come through with no
declude headers. The log did have one line for this message:
11/27/2003 15:23:41 Q875e044a00daa57c Could not lock
Actually, you mean that you are at the limit, and several of
your entries aren't being used.
Can't understand...?
You said At the moment I'm already over this limit -- because you have 21
IPBYPASS entries. My comment was that because you have more than 20
entries, some of them will not be
Hi,
Yesterday's results of my EasyNet replacement candidates:
TEST # FAILED Percentage
AHBLDOMAINS710.95%
AHBLPROXIES...7359.82%
AHBLSOURCES...3514.69% (reliable, so far)
NJABLDUL..2743.66% (many duplicates
Hi,
I have one customer that has a virtual domain. Even though this
[EMAIL PROTECTED] is receiving email that exceeds my DELETE threshold,
the messagages are only being HELD.
Any idea why this is happening? I don't have any special rules setup for
this customer under Declude that I can find.
AHBLDOMAINS710.95%
AHBLPROXIES...7359.82%
AHBLSOURCES...3514.69% (reliable, so far)
NJABLDUL..2743.66% (many duplicates with SORBS-DUL)
NJABLPROXIES1,085...14.49%
NJABLRELAYS...1181.58%
Logs and headers.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Friday, November 28, 2003 8:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] holding
NJABLRELAYS ip4rdnsbl.njabl.org 127.0.0.2 4
0
NJABLDULip4rdnsbl.njabl.org 127.0.0.3 4
0
NJABLSOURCES ip4r dnsbl.njabl.org 127.0.0.4 7
0
NJABLMULTI ip4rdnsbl.njabl.org 127.0.0.5
I think this might be on http://www.ahbl.org/using.php in the rhsbl section.
I have been trying
AHBL-DOMAINSrhsbl rhsbl.ahbl.org * 5 0
for a couple of days, but I don't have any stats to share today.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Andy,
What weight to you hold and delete on?
Sheldon
Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com
Ten Forward Communications 360-457-9023
Nationwide access, neighborhood support!
Whenever you find yourself on the side of the majority, it's time
to pause and
Hi,
I am new to this news group but have been using Declude Junkmail for
some time. I am running Server 2003 with Imail v8.x and declude v1.75.
I am having trouble with an externalplus test that I wrote. It works
fine except when someone uses the Imail Web based mail server. With the
web based
I have one customer that has a virtual domain. Even though this
[EMAIL PROTECTED] is receiving email that exceeds my DELETE threshold,
the messagages are only being HELD.
Any idea why this is happening? I don't have any special rules setup for
this customer under Declude that I can find.
The
Everyone pats John on his back and assure him they have all gone through
similar experiences :)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 28, 2003 7:34 PM
To: [EMAIL PROTECTED]
Subject: RE:
I have a program that reads and archives iMail log files to a SQL
server. I'd like to add the capability to archive Declude log files in
a meaningful manner. I'm studying the log files (LOGLEVEL set to MID),
and I've noticed something I don't understand. For example (lines
edited for
This entry appears to be processing file Q7e4a069f00606ad1. However, it
looks like the file was process twice, and that it passed on the first
run. I'm especially curious about why the first time out, WEIGHT20's
action is IGNORE, but on the second it's action is (correctly) set to
DELETE.
I am new to this news group but have been using Declude Junkmail for
some time. I am running Server 2003 with Imail v8.x and declude v1.75.
I am having trouble with an externalplus test that I wrote. It works
fine except when someone uses the Imail Web based mail server. With the
web based
Hi,
I'm holding on 7, deleting on 14 (I didn't change the labels on the tests,
they still say WEIGHT10 for HOLD and WEIGHT20 for DELETE). Here, the
weight is 18 and should delete, but does not. I see in Spam review that it
has exceeded the DELETE threshold also, but it is not being deleted.
I'm holding on 7, deleting on 14 (I didn't change the labels on the tests,
they still say WEIGHT10 for HOLD and WEIGHT20 for DELETE).
Are you sure?
X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10.
This line in the headers means that Declude JunkMail used the WARN action
Hi,
I report subject at 8.
I bounce at 10.
I delete at 20.
I also delete MAILFROM, PERCENT and all -proxies
Best Regards
Andy Schmidt
HM Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846
Phone: +1 201 934-3414 x20 (Business)
Fax:+1 201
Everyone pats John on his back and assure him they have all gone through
similar experiences :)
Oh, I feel so much better now, thanks.
Actually, I found another one this morning. Turns out though it is a badly
broken header to where the body (html) ends up seen in the header.
John Tolmachoff
R. Scott Perry wrote:
This entry appears to be processing file Q7e4a069f00606ad1. However,
it looks like the file was process twice, and that it passed on the
first run. I'm especially curious about why the first time out,
WEIGHT20's action is IGNORE, but on the second it's action is
Now I know I must have something set up wrong. We're using Declude
JunkMail lite, and to my knowledge there is only one set of configuration
files (global.cfg and $default$.junkmail). The message is question (as
far as I can tell) was addressed to only one recipient, though I was doing
some
What you see below is the only entry in the log file. Here is a log
entry for a message that normally fails the external plus:
11/28/2003 01:01:05 Qf2af9e4c010ec80f NOABUSE:2 nIPNOTINMX:-3
SNIFFER2:10 WAMCHECK:10 . Total weight = 19
11/28/2003 01:01:05 Qf2af9e4c010ec80f Msg failed NOABUSE (Not
Yes, they correspond. I checked the name, Q8b540ec.SMD, etc. Same in both
spam review and the log file. That's how I found the specific log file
entry.
This is only happening for this one email address: [EMAIL PROTECTED]
Thanks, Andy
- Original Message -
From: R. Scott Perry [EMAIL
In $junkmail$.junkmail
I have
WEIGHT10HOLD
WEIGHT20DELETE
All of the other tests are WARN.
In Global.cfg
all tests are WARN.
Is that correct? Still, the issue seems to be confined to this one
[EMAIL PROTECTED]
Thanks, Andy
- Original Message -
From: R. Scott Perry [EMAIL
Here is what spam review reports:
X-RBL-Warning: SPAMCOP: Blocked - see
http://www.spamcop.net/bl.shtml?69.6.42.52
X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL -
http://blackholes.easynet.nl/errors.html
X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL6636
Yes, they correspond. I checked the name, Q8b540ec.SMD, etc. Same in both
spam review and the log file. That's how I found the specific log file
entry.
What version of Declude are you running (\IMail\Declude -diag from a
command prompt will show you)?
I've never heard of any cases where
X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10.
11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or
exceeds the limit of 7.). Action=HOLD.
Something really weird is going on here. The E-mail header shows the
WEIGHT10 test as catch mail with a
I'm looking at Weight of 18 reaches or exceeds the limit of 10.
It it is 18, it also exceeds 14, the limit I delete at
Thanks, andy
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 28, 2003 2:29 PM
Subject: RE:
Anyone testing the Message Sniffer add-in to Declude should consider
testing with the new wide-beta version V2-2b. You can download this
version from our news/updates page at:
http://www.sortmonster.com/MessageSniffer/NewsUpdates.html
The top news item describes the program in more detail. What
1.76i6
I'm only running one email server.
Do you want me to send me my config files ( I do have a support contract).
Thank, Andy
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 28, 2003 2:37 PM
Subject: Re: [Declude.JunkMail]
Andy, what is your global.cfg line that produces the total in the header?
It doesn't look line mine, and SpamReview has a very specific requirement to
report the correct value, e.g.
XOUTHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%.
(my implementation of IMail is as a gateway,
I have the weight10 set to HOLD at 7
weight20 test set to DELETE at 14
weight10 and weight20 are just labels, that's all
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 28, 2003 2:39 PM
Subject: Re: [Declude.JunkMail] holding not
I have the weight10 set to HOLD at 7
weight20 test set to DELETE at 14
weight10 and weight20 are just labels, that's all
I would urge you to rename them to WEIGHT7 and WEIGHT14, as they will
likely cause confusion down the line. But it still doesn't explain:
X-RBL-Warning: WEIGHT10: Weight
Hi,
I sent the config files ot [EMAIL PROTECTED]
Thanks, andy
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 28, 2003 3:03 PM
Subject: Re: [Declude.JunkMail] holding not deleting
1.76i6
I'm only running one email
Here is the config file section:
XINHEADER X-RBL-Warning: Total weight: %WEIGHT%
XOUTHEADER X-RBL-Warning: Total weight: %WEIGHT%
XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%.
XINHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
I sent the config files ot [EMAIL PROTECTED]
The only thing that makes sense here is that the E-mail is going through
another server running Declude JunkMail. Otherwise:
X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10.
X-RBL-Warning: Total weight: 11
The WEIGHT10 test
Can you post the full header for that message?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Friday, November 28, 2003 12:25 PM
To: [EMAIL PROTECTED]
You said At the moment I'm already over this limit --
because you have 21 IPBYPASS entries. My comment was that
because you have more than 20 entries, some of them will not
be used by Declude JunkMail. It will only use 20 of them.
And if I discover other MTAs in this two IP blocks I would
http://www.unsubscribenow.org/
Are they a serius company `?
Benny
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
It seems to me like spammers setup a service where we have to pay them in
order not get spammed ?!
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of ISPHuset Nordic
Sent: Saturday, November 29, 2003 2:48 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail]
Ok,
But there is only one email server...I think the weird thing is that of the
20 virtual domains and 500 or so email boxes, this is only happening for
this *one* email address
Did you see anything else wrong in my config files?
Thanks, andy
- Original Message -
From: R. Scott
Would anyone care to post an example so I can see the math? I still don't
get how to use IPNOTINMX properly.
Thanks, andy
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 28, 2003 1:24 AM
Subject: RE: [Declude.JunkMail]
Why didn't this message fail spamdomains?
Received: from bzq-218-101-218.red.bezeqint.net [81.218.101.218] by
mail.localdomain.moc
(SMTPD32-8.04) id A88A13960090; Fri, 28 Nov 2003 14:56:58 -0500
Received: from [51.180.2.49] by bzq-218-101-218.red.bezeqint.net id
5JCQ8r8Lw22M; Fri, 28 Nov 2003
From the JunkMail Manual:
This test should NOT be used to detect spam! It will be triggered when an
E-mail is sent from an IP address that is not in its MX record. Although
this test will catch a lot of spam (perhaps 80%), it will also catch a lot
of legitimate mail (as quite a few larger mailers
The only thing that makes sense here is that the E-mail is going through
another server running Declude JunkMail. Otherwise:
But there is only one email server...
But if I send you an E-mail, you may see references to a WEIGHT10 test
here, as well as your WEIGHT10 test. Remember that
What this options does ??
WHITELIST AUTH
Can't find it on the manual..
Thanks
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type
What would be the option to whitelist this domain ??
It comes from the IP of the conection..
Nothing to do with the real sender..
The header is..
X-Note: This E-mail was sent from dup-148-233-101-61.prodigy.net.mx
I tried WHITELIST REVDNS .prodigy.net.mx
Didn't work..
Thanks..
---
[This
Hi,
Very sorry if this has been covered before - I searched
and did not find a solution -
I am having no luck filtering on
HEADERS 0 CONTAINS X-IMAIL-SPAM-PHRASE
and on
HEADERS 0 CONTAIN X-IMAIL-SPAM-URL-DBL
I cut and paste into an email from Imails phrase-list.txt
send it to myself, the
It will whitelist email from authenticated users. YOu must be using Imail 8
for this option to work.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Alejandro
Valenzuela
Sent: Friday, November 28, 2003 6:14 PM
To: [EMAIL PROTECTED]
Is this a user of yours that authenticates? If it is and you are on Imail
8.x user Whitelist Auth.
I would not reccomend whitleising dial up ip addresses.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Alejandro
Valenzuela
Sent: Friday,
Does any one have more information on these SKIPIFWEIGHT and MAXWEIGHT
Thanks.
Fred
- Original Message -
From: Nick Hayer [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, November 26, 2003 10:37 AM
Subject: Re: [Declude.JunkMail] improved performance using ramdrive?
John
I understand how the ipnotinmx works
i just want an easy way (%variable%) to put in the header that will show all
tests that contributed to the total weight, and their individual
contribution
that mean if a mail passes ipnotinmx, then ipnotinmx (-3) should show in
the above %variable%
This
Looks like it did fail the spamdomains test:
X-RBL-Warning: TESTS FAILED: SORBS-DUL, NOABUSE, NOPOSTMASTER, BADHEADERS,
WHITEFILTER1, SPAMCHECK, SPAMDOMAINS
Why do you ask, don't the log entries for this message support this?
Bill
- Original Message -
From: John Tolmachoff (Lists)
Check the placement of the IMail headers from one of these messages. If the
IMail headers show up under all of the Declude messages, then that would
indicate that they are run after Declude, if above all of the Declude
headers, then they were run before passed onto Declude. However, I think
that
59 matches
Mail list logo
