RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Lyndon Eaton
Hello guys, I may be wrong but I think I read somewhere on the list that an email failed the CMDSPACE test when it shouldn't have? Would somebody mind checking these headers to see if this email should have failed the CMDSPACE test also? If you need anything else please let me know, Thanks!

RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Markus Gufler
I may be wrong but I think I read somewhere on the list that an email failed the CMDSPACE test when it shouldn't have? As I know all - or at least most - Microsoft Outlook clients that connect directly to your Imail-Server will fail the CMDSPACE test. The solution: Use Imail v8 with

RE: [Declude.JunkMail] Disable outgoing scanning

2004-03-23 Thread R. Scott Perry
Yes. With the latest beta of Declude JunkMail and the latest version of IMail, you can add a line WHITELIST AUTH to the \IMail\Declude\global.cfg file to automatically whitelist E-mail sent from authenticated users. Sorry for asking for specifics, could you clarify the minimum versions of

RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Lyndon Eaton
They also fail the helobogus. These would not normally be a problem because the vast majority of clients are within our dialup/xDSL or lease line range that is already white listed. This client unfortunately has broadband through another provider! I had a (mini) brain storm and added WHITELIST

RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Markus Gufler
The solution: Use Imail v8 with SMTP-Authentication and Declude Junkmail Pro with the parameter AUTOWHITELIST ON in the global.cfg file. Sorry I meant WHITELIST AUTH instead of AUTOWHITELIST ON Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Markus Gufler
I had a (mini) brain storm and added WHITELIST AUTH to declude, but it didn't work. When I checked the declude release notes it stated you needed Imail 8. We have Imail 8, but it isn't installed yet. ? WHITELIST AUTH can work only if you use SMTP-Authentication to allow relaying trough

RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Lyndon Eaton
WHITELIST AUTH can work only if you use SMTP-Authentication to allow relaying trough your server. Yep I know. But as we're only using Imail 6 ATM the WHITELIST AUTH does not work (although the clients are authing). If your clients connects from a defined IP range(s) you can use the same

RE: [Declude.JunkMail] Strange MONKEYFORMMAIL problems

2004-03-23 Thread Troy D. Hilton
Dude, I didn't know it was dead until my Junkmail started catching all these legit emails, and I'm not complaining about it as much as trying to avoid this problem in the future. Basically, I just need to do a regular update to my global.cfg file. I'm sure the information about the list dying was

Re: [Declude.JunkMail] Strange MONKEYFORMMAIL problems

2004-03-23 Thread Joe Wolf
I try to look at the config files on a regular basis, but I have to print both of them out and compare them side by side to see if Declude has made any changes. It would be of great help to me if they would just put a comment at the top of the file giving the revision date. I think many others

Re: [Declude.JunkMail] Strange MONKEYFORMMAIL problems

2004-03-23 Thread Don Brown
See below -- Tuesday, March 23, 2004, 8:31:36 AM, Troy D. Hilton [EMAIL PROTECTED] wrote: TDH Dude, You meant Don. TDH Basically, I just need to do a regular update to my global.cfg TDH file. Yes. You can't prevent the problem you encountered without routinely maintaining the system. Scott is

RE: [Declude.JunkMail] CMDSPACE

2004-03-23 Thread Kevin Bilbee
The reason WHITELIST AUTH only works with Imail 8 and above is because Imail adds a line in the Q file in version 8 and above indicating the sender authenticated to Imail. It does not add a line it changes the S to an A at the beginning ot the envelope sender line. Kevin Bilbee ---

[Declude.JunkMail] Countries List

2004-03-23 Thread J Porter
I see a fair amount of junkmail which doesn't fail the Countries Test but the country is shown as ARIN Unlisted or Unknown. Is there a way to show these results as failing the test and subsequently add points for the junkmail filter?? Thanks.. ~Joe www.EastARK.com --- [This E-mail scanned for

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread R. Scott Perry
I see a fair amount of junkmail which doesn't fail the Countries Test but the country is shown as ARIN Unlisted or Unknown. Is there a way to show these results as failing the test and subsequently add points for the junkmail filter?? The problem thing to do here is download the latest

Re: [Declude.JunkMail] Automatic Whitelisting

2004-03-23 Thread R. Scott Perry
I want to white list an email address for the users of a specific virtual domain, but not for all virtual domains on the server. For this, you would want to use the WHITELISTFILE option, that lets you have whitelists that work for certain domains/users but not others. - Each individual user has

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread R. Scott Perry
When we download this file where do we put it? It replaces the one in the \IMail\Declude directory. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread Scott Fisher
I too have some IP's that come up with no country. Is there somewhere we can go to verify where they belong? 82.47.137.183 s/b ? 82.40.12.96 s/b us 82.36.129.149 s/b us 82.35.91.122 s/b us 81.134.52.32 s/b nl 195.245.230.115 s/b NL 217.44.36.184 s/b NL I downloaded my all_list.dat on

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread R. Scott Perry
I too have some IP's that come up with no country. Is there somewhere we can go to verify where they belong? You can go to http://www.DNSstuff.com and enter the IP in the IPWHOIS box or Reverse DNS Lookup box, and it should show you the country. 82.47.137.183 s/b ? This one should be in the

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread Dan Geiser
Scott, I don't currently have that file in my IMail\Declude directory. If we are only running DJM Pro v1.75 will having this file do anything for us? Thanks, Dan - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 23, 2004 5:35 PM

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread Scott Fisher
I downloaded Sunday 3/21. I will downloaded again now to see what happens. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 03/23/04 04:44PM I too have some IP's that come up with no country. Is there somewhere we can go to verify where they belong? You can go to

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread R. Scott Perry
I don't currently have that file in my IMail\Declude directory. If we are only running DJM Pro v1.75 will having this file do anything for us? Only if you are using the experimental IP-Country functionality. If you are not, there is no need to have that file.

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread IMail Admin
So how do we use this functionality? Per your instructions, I'm trying to study the newsgroup postings to see how to use the extra functionalities included in the Interim releases, but those postings seem to leave me with more questions than answers. Thanks, Ben - Original Message -

RE: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Kornitz, David
Matt, I've seen the same problem and the suggestion we have made to our customers is to reconfigure their firewall (or proxy server/smtp server), such that they only accept SMTP traffic from our mail servers. This does not stop spam initially, but over a period of time, the

Re: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Matt
Whenever a client has no need for SMTP AUTH for their own clients, we do advise them to set up port blocking, but of the two places that this is happening two, one didn't have a firewall in front of their SMTP gateway (now does and problem solved), and the other one can't close off access to

Re[2]: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Sanford Whiteman
Whenever a client has no need for SMTP AUTH for their own clients, we do advise them to set up port blocking... We've always seen relay attempts to _any_ machines that listen on port 25 and assume that such machines will see illegitimate traffic. There should never be any reason to

RE: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Colbeck, Andrew
For what it's worth, I haven't seen anything in the security literature about spammers operating that way. Any chance that the affected organizations had, at some time, addresses of the form: [EMAIL PROTECTED] which isn't uncommon? I've seen at least one private company that advertised

Re: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Matt
Andrew, This is definitely stuff going to harvested (real) addresses with full spam content. I've seen the full headers as well. I've seen the relay testing from spammers before, in fact the same turd brought down two different clients of mine in the space of one week, both running GroupWise

RE: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Adam Lukasiewicz
Matt, Have you turned this turd in??? Adam -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Sent: Tuesday, March 23, 2004 11:18 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spammers bypassing gateways? Andrew, This is definitely stuff

Re: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Matt
The guy primarily spams asian sites from what I can tell, but also targets AOL. One of the servers he knocked off line is an 80 seat law firm, and trust me they were quite willing to hunt the guy down, but in this case it wasn't realistic, or at least I so advised. I have though seen similar

Re: [Declude.JunkMail] Countries List

2004-03-23 Thread J Porter
Ben... 1. To get the Countries Test to work, add a line to your global.cfg something like: CTRY2filter c:\imail\declude\ctry2.txt x 5 0 this creates a filter test named CTRY2 with a link to a text file. 2. Create a text file (my example being ctry2.txt) which looks something

Re[2]: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Sanford Whiteman
...but sooner or later I will find a customer that makes use of SMTP AUTH and can't be firewalled or resolved with a filter following the connection... If the server is solely used for SMTP AUTH, there's no reason to use port 25. SMTP running on other ports is (so far) unlikely to be