Re: [Declude.JunkMail] Declude vulnerabilty: Tolerates forged local domains

2005-03-09 Thread Matt
Agreed.  This was absolutely necessary before IMail 8.x and Declude's WHITELIST AUTH came out, but it is a problem now that these things exist.  The workaround should be in the form of a switch in the global.cfg, something like DULSKIPPING OFF. Another note to Declude in regard to the announce

RE: [Declude.JunkMail] Declude vulnerabilty: Tolerates forged local domains

2005-03-09 Thread Andy Schmidt
Hi "Declude" staff: >> While adding DUL, DYNA or DUHL to the test name would skip scanning all but the last hop, Declude also will not apply any tests named this way to any E-mail that has a local domain in the Mail From. The effect of this was that forging spammers that used local domains would

Re: [Declude.JunkMail] Purpose of %IP4R%

2005-03-09 Thread Matt
I just wanted to add that I started using things this way because of intentional behavior in Declude. While adding DUL, DYNA or DUHL to the test name would skip scanning all but the last hop, Declude also will not apply any tests named this way to any E-mail that has a local domain in the Mail

Re: [Declude.JunkMail] Purpose of %IP4R%

2005-03-09 Thread Scott Fisher
In addition to Darrell's answer, here is my best understandings of the DNSBL vs IP4R tests: IP4R test: Will search the up to the number of hops up to (HOPHIGH variable +1) with the following exceptions: If DYNA, DUL, or DUHL are in the test name, they will be skipped after the first hop. (From t

Re: [Declude.JunkMail] Purpose of %IP4R%

2005-03-09 Thread Darrell \([EMAIL PROTECTED])
Thomas, The %IP4R% is a variable in declude that contains the IP address of the last mail server that connected to your mail server. It does not appear that this variable is listed in the manual though. When you see some tests defined as XBL(LAST) dnsbl %IP4R%.sbl-xbl.spamhaus.org

RE: [Declude.JunkMail] Purpose of %IP4R%

2005-03-09 Thread Fox, Thomas
I've been following the beginner config thread, trying to improve my setup, and am curious about the %IP4R% tag on some of the tests. What does this do/mean? > > It depends on how you want to score. > > You are currently referencing the sbl-xbl with only a return code of > > 127.0.0.4 and ru

Re: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Scott Fisher
I'd get in trouble with the ALLRECIPS (when I used them) in the following scenario: Mail Comes to multiple recips: [EMAIL PROTECTED] and [EMAIL PROTECTED] [EMAIL PROTECTED] is bad address, I'd weigh heavily and bye-bye mail (for A and B) Now if ALLRECIPS is [EMAIL PROTECTED] and [EMAIL PROTECTED

RE: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Markus Gufler
> ALLRECIPS 480 IS "ANNE" <[EMAIL PROTECTED]> To be honest I haven't understand completely when this format must be used but as in my case all handled messages are relayed and so not local mailboxes Imail/Declude can't know about "ANNE". So as I can see here listing two times the recipients addr

RE: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Markus Gufler
> By looking at the %BODY% results this was the only way that I > could really see the content. So you could add the > %ALLRECIPS% and fire it off to you which would show you > exactly what the variable contains. That's the problem: %ALLRECIPS% says "[EMAIL PROTECTED]" while in the filter fil

RE: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Goran Jovanovic
Markus, Based on what Scott mentioned ALLRECIPS 480 IS "ANNE" <[EMAIL PROTECTED]> you might want to check this case I have in my address book someone as Fred Smith [EMAIL PROTECTED] And someone else has Freddie[EMAIL PROTECTED] Then you may have both ALLRECIPS 480 IS "Fred" <[EMAI

RE: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Goran Jovanovic
Markus, Since it is figured out you may not need this right now but I had a devil of a time this weekend trying to figure out some text in the body of some spam. I looked at it in View Source in Outlook and was sure that I had the right text yet my filter would not fire. I sent a test mail and the

RE: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Markus Gufler
BTW: I plan to use this in our users web interface. The user can choose between 5 (or more) different spam protection levels. The default is maximum (level 1) or what we consider the best setting in our weighting system. Now if a users chooses level 2 this will add a line ALLRECIPS -20 IS <[

RE: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Markus Gufler
> It needs to be "<[EMAIL PROTECTED]>, < [EMAIL PROTECTED]> (where > the first "[EMAIL PROTECTED]" is the name entered by the user, > and the second one is the one that IMail uses). > > http://www.mail-archive.com/declude.junkmail@declude.com/msg18392.html Wow!? It works, it works! :-) Maybe

Re: [Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Scott Fisher
Here's my notes on ALLRECIPS: ALLRECIPS with IS test: It needs to be "<[EMAIL PROTECTED]>, < [EMAIL PROTECTED]> (where the first "[EMAIL PROTECTED]" is the name entered by the user, and the second one is the one that IMail uses). http://www.mail-archive.com/declude.junkmail@declude.com/msg18392.

[Declude.JunkMail] ALLRECIPS in filter files not working?

2005-03-09 Thread Markus Gufler
I've lost now several hours trying the following filter ALLRECIPS -50 IS [EMAIL PROTECTED] I've tried also CONTAINS, STARTSWITH. I've checked the filter line does not end with a space after the recipient adress. The filter file is linked correctly because the following line MAIL