RE: [Declude.JunkMail] COUNTRY/COUNTRIES

2004-05-28 Thread R. Scott Perry
Slightly off this topic but if I have the all_list.dat file in my declude directory but I do not any COUNTRY/COUNTRIES filters then X-Country-Chain: Somewhere-Otherwhere-destination Will show up in the headers but no points will be added to the score of the e-mail. Right? That is correct.

Re: [Declude.JunkMail] Feature Request

2004-05-28 Thread R. Scott Perry
The possibility to filter on SUBJECT where the mailbox/account appears. We use accounts that are first initial/last name, and any mail that has that combination in the subject is virtually always SPAM. So, since I'm jcochran, subjects like these would get filtered on: This is something that we

Re: [Declude.JunkMail] New Tests

2004-05-28 Thread R. Scott Perry
This question has probably already been posted before. Is there a list anywhere that lists all the new tests in the beta versions that aren't listed in the manual of the release? For example DOW and SPF. Is there any easier way to find the documentation for these test other than looking through

Re: [Declude.JunkMail] Junkmail manual

2004-05-27 Thread R. Scott Perry
Has the link to the manual changed? http://www.declude.com/junkmail/manual.htm no longer works. I just checked, and it worked for me (with a redirect to the articles URL, but I still use the URL you listed). -Scott --- Declude JunkMail: The

Re: [Declude.JunkMail] Spamdomains test

2004-05-27 Thread R. Scott Perry
But I'm sure I've seen discussion someplace with reference to lines containing more than just a domain name in the spamdomains.txt file ... or is that all that's needed besides enabling the test? That's a new feature, that allows you to have an alias (for lack of a better word) that can be

Re: [Declude.JunkMail] Question about quoted-printable encoding and filtering

2004-05-27 Thread R. Scott Perry
I'm finding this difficult to test and thought that I would ask it instead. I've found some heavy obfuscation in some Nigerian stuff that has be scratching my head about how to filter it. One such messages contains the following: THE OWNER OF THIS ACCOUNT LATE MR.DENNIS BR= OWN ,HE DIED

Re: [Declude.JunkMail] Hijack OT Windows IP question

2004-05-26 Thread R. Scott Perry
Is there *any* way to allow a different HIJACK setting based on IP and or MAILFROM? No. It's either unlimited E-mail, or the standard settings. Any thoughts on how I can make this work without whitelisting? I also have DJMPro. The only other option I can think of would be to increase the

Re: [Declude.JunkMail] Per-Domain Whitelist

2004-05-26 Thread R. Scott Perry
I'm running a per-domain whitelist of e-mail addresses, etc. I can't seem to get a couple domains configured correctly for one particular client. They receive e-mails from lehman.com, but it's a weird sender address - [EMAIL PROTECTED] I added lehman.com to the whitelist file

Re: [Declude.JunkMail] Next JM Release

2004-05-25 Thread R. Scott Perry
Can you give any idea when the next full release will be out and the doccumentation updated? Unfortunately, I do not have an answer for that yet. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.

Re: [Declude.JunkMail] Take 2

2004-05-25 Thread R. Scott Perry
Can we make imail/junkmail reject any ougoing message where From or ReturnTo are not valid local addresses ? Not easily. You could probably do it with filters, if you listed all local E-mail addresses, but it could not be done manually. -Scott

Re: [Declude.JunkMail] Using the RCPT To domain instead of what's resolved to.

2004-05-25 Thread R. Scott Perry
I recall someone indicating that this was possible. By default, Declude seems to use the per-domain config that is the final destination on the server instead of the RCPT To address (if forwarded to a different domain). I believe there is a switch to turn this resolution off, but it's

Re: [Declude.JunkMail] Massive CPU usage

2004-05-25 Thread R. Scott Perry
Over the last week or so we have been getting terrible performance, mostly noticed through SMTP (either not accepting connections on port 25 or really slow response). I have not been able to find any errors reported in Imail or Declude. Watching Task Manager shows the CPU maxed at 100%

Re: [Declude.JunkMail] Massive CPU usage

2004-05-25 Thread R. Scott Perry
I am using F-Prot for virus scanning. Everytime I've tried using the fpcmd.exe scanner it fails to detect anything. I'll try this again. My current scanfile line is as follows: SCANFILED:\Progra~1\FSI\F-Prot\F-Prot.exe /TYPE /SILENT /NOMEM /ARCHIVE /NOFLOPPY /NOBOOT /DUMB

Re: [Declude.JunkMail] [Declude.Virus] Welcome Back Scott

2004-05-24 Thread R. Scott Perry
Glad to see you back. Got a question on domainblack list. What is the type for it? IP4r? IPBLACK? DomBLACK? what? There is no domain blacklist -- what Declude JunkMail has is a sender blacklist, which can blacklist the sender based on their E-mail address or domain. You can use a line such as:

Re: [Declude.JunkMail] trip

2004-05-24 Thread R. Scott Perry
Welcome back Scott - how was your trip? Any details? It was a nice trip. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in

Re: [Declude.JunkMail] NONENGLISH; characters or encoding?

2004-05-24 Thread R. Scott Perry
I was wondering what exactly the NONENGLISH tests hits on. Is it actual high bit characters (or what ever classification is most appropriate), or does it look for character encoding headers such as 'characterset=', or both? It looks at the subject for several signs of non-English characters

Re: [Declude.JunkMail] Filter Keyword Order

2004-05-24 Thread R. Scott Perry
Is order in a filter important for these commands? Specifically can I have the END in front of the SKIPIFWEIGHT and MAXWEIGHT? Declude JunkMail processes each line one at a time, so: ALLRECIPS END NOTCONTAINS @domain.com SKIPIFWEIGHT 60 MAXWEIGHT60 ANYWHERE 14

Re: [Declude.JunkMail] Redundant Log Lines - Proposing Clean-Up

2004-05-23 Thread R. Scott Perry
a) I think the LASTACTION' log entry is rendering the Deleting Spam from/to log entry obsolete. It contains the action, the from and to to - all information that is redundant with other log lines (see red sample below) This will be changed in the next release. b) Once an email is bypassing

RE: [Declude.JunkMail] DNSstuff Website

2004-05-23 Thread R. Scott Perry
But is it gone and they just forgot to whack the backup? dnsreport.com was (is?) the best dns report on the planet. The DNSstuff.com/DNSreport.com sites are certainly not gone, nor can I foresee them going away any time in the near future. My best guess is - Chuck Berry - whoever now own

Re: [Declude.JunkMail] ALLRECIPs filter trouble

2004-05-14 Thread R. Scott Perry
I'm not getting any matches on ALLRECIPS filters with the IS. Anyone have any tips? ALLRECIPS 20 IS [EMAIL PROTECTED] If you change it to: ALLRECIPS 20 IS [EMAIL PROTECTED] then it should work. -Scott ---

Re: [Declude.JunkMail] badheader variable?

2004-05-14 Thread R. Scott Perry
I see a fair amount of spam e-mails that fail badheaders of c8000246 or c8000247 which means no From address. As a result all of the headers and body are put in the body. I'm wondering if the badheaders return code could be made into a variable? I'd be thinking along the lines of: BADHEADERS

Re: [Declude.JunkMail] ISBLANK is blank

2004-05-14 Thread R. Scott Perry
I have a filter for the following that isn't getting hit: BODY 4ISBLANK SUBJECT2ISBLANK That's because of the way that Declude JunkMail now handles encoded subjects/bodies -- we will try to change that behavior. Also note that I have no idea why SPAMCOP(ALL) failed

Re: [Declude.JunkMail] ISBLANK is blank

2004-05-14 Thread R. Scott Perry
You could save me a bit of time though by answering this one question. With custom filters, will they also be skipped if there is a DUL/DUHL/DYNA in the name and the Mail From is local, i.e. DYNAMIC or DUL-COMBO? If so, I'll just change those names as well though I would prefer not to. No --

Re: [Declude.JunkMail] OT SPF PTR Problem

2004-05-14 Thread R. Scott Perry
I have therefore added a ptr:directpceu.com record to the domain, and tested it here: http://www.dnsstuff.com/tools/spf.ch?server=bedstone.orgip=62.128.191.2 6 This page and the SPF test page both say the email should fail. Even though 62.128.191.26 has a reverse ending in directpceu.com The

Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank

2004-05-14 Thread R. Scott Perry
I seem to have broken things worse :) Is there any reason why the following wouldn't work? XBL(LAST)dnsbl%REMOTEIP%.sbl-xbl.spamhaus.org127.0.0.4 60 I tested the DUL lists using this format and it seemed to be working. Here's the headers from a single hop test

Re: [Declude.JunkMail] DUL skipping was ISBLANK is blank

2004-05-14 Thread R. Scott Perry
XBL(LAST)dnsbl%IP4R%.sbl-xbl.spamhaus.org127.0.0.4 60 XBL(ALL)ip4rsbl-xbl.spamhaus.org 127.0.0.420 Scott/Matt, would a configuration like above require multiple DNS queries since the hostnames defined in the tests are no longer identical? Or is

Re: [Declude.JunkMail] ALLRECIPs filter trouble

2004-05-14 Thread R. Scott Perry
No matches with the [EMAIL PROTECTED] format either. Actually, it needs to be [EMAIL PROTECTED], [EMAIL PROTECTED] (where the first [EMAIL PROTECTED] is the name entered by the user, and the second one is the one that IMail uses). -Scott ---

Re: [Declude.JunkMail] Whitelistfile

2004-05-14 Thread R. Scott Perry
Can I point to two whitelistfile's in the per user config file for junkmail (i.e. to WHITELISTFILE entries on separate lines). For example, one to main corporate then a personal one. Thanks, Yes, that will work fine. -Scott --- Declude

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

2004-05-13 Thread R. Scott Perry
You are correct -- I'll see if I can get a new interim release online which will take care of this. There is a new interim release 1.79i7 at http://www.declude.com/version/interim . It takes care of the issue of the ALLRECIPS filter not working properly.

Re: [Declude.JunkMail] DNSSTUFF

2004-05-13 Thread R. Scott Perry
What happened to this valuable site? I get a server not found? It crashed last night -- it's back up now, though. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable

Re: [Declude.JunkMail] Not receiving messages - sometimes..

2004-05-13 Thread R. Scott Perry
I am unable to receive from @fiberlinkinc.com if the message is sent from them and is new. However, if I send a message to @fiberlinkinc.com and they Reply to the message I sent, then I am able to receive from them. Therefore only on Replied messages am I able to receive mail from this company.

Re: [Declude.JunkMail] Using RHSBL's for reverse DNS entries

2004-05-13 Thread R. Scott Perry
Is there any shot of you enabling a different type of test built to do RHS lookups from the reverse DNS value? Actually, you can use something like: BULK-REVDNS dnsbl %REVDNS%.bulk.rhs.mailpolice.com* x 0 -Scott ---

Re: [Declude.JunkMail] Using RHSBL's for reverse DNS entries

2004-05-13 Thread R. Scott Perry
For the test type below you have dnsbl ; I have only been using rhsbl and ip4r - are these just names to flag the type of test in global.cfg or are different actions taken on each? [Hope I am somewhat clear on this..] That is correct. ip4r will take the IP address that the E-mail came from,

Re: [Declude.JunkMail] Using RHSBL's for reverse DNS entries

2004-05-13 Thread R. Scott Perry
That would be awesome if it really does work. I'll give it a try this evening! Am I also to assume that this will work with the %HELO% as well? That would rock :) Yes, it will also work with %HELO%. :) You can also use %MAILFROMBL%, which turns [EMAIL PROTECTED] into user.example.com, for

Re: [Declude.JunkMail] Invalid XINHEADER: error

2004-05-13 Thread R. Scott Perry
My declude logs has the following error on most messages coming in Invalid XINHEADER: X-Note - Total spam weight of this E-mail is %WEIGHT%. XINHEADER X-Note - Total spam weight of this E-mail is %WEIGHT%. If you change that line to: XINHEADER X-Note: Total spam weight of this

Re: [Declude.JunkMail] Using RHSBL's for reverse DNS entries

2004-05-13 Thread R. Scott Perry
You can also use %MAILFROMBL%, which turns [EMAIL PROTECTED] into user.example.com, for spam databases that work on the full E-mail address rather than just the domain. Scott, are there any such lists that use the full e-mail address that you know of? These are some nice additional features.

Re: [Declude.JunkMail] bypasswhitelisting?

2004-05-12 Thread R. Scott Perry
I am trying to understand how this works.. We have the following in the Global: EMERGENCYBYPASS bypasswhitelisting 40 2 0 0 This should be bypasswhitelist not bypasswhitelisting. in the following action in the default file. EMERGENCYBYPASS DELETE With bypasswhitelist, an E-mail with a

Re: [Declude.JunkMail] Why does this fail routing?

2004-05-12 Thread R. Scott Perry
Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com (SMTPD32-8.05) id AA05D10128; Tue, 11 May 2004 23:53:57 -0700 Received: from [80.199.82.218] ([80.199.82.218]) by ns1.ssc-isp.net (SAVSMTP 3.1.6.45) with SMTP id M2004051123492224557 for [EMAIL PROTECTED]; Tue, 11 May

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

2004-05-12 Thread R. Scott Perry
I have a filter called FOREIGN that I have been defeating with END statements for certain domains with international traffic like so - Foreign.txt - ALLRECIPSENDCONTAINS@clientdomain.com I just noticed an E-mail that was held which failed this filter for this client. Note

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

2004-05-12 Thread R. Scott Perry
Are you using an interim version of Declude? I just recently had this problem, and contact [EMAIL PROTECTED] They told me there was a bug with the ALLRECIPS in the current interim, and that it would be resolved in a future interim. For now, I've had to return back to the latest beta. If

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

2004-05-12 Thread R. Scott Perry
Not to start a huge long thread about interims and such, but if you can get this interim released, do you know if that little problem with the zip files (zipped but didn't abide by the zipped rules) getting caught by banext ezip will be fixed as well... Yes (whenever we say that something has

Re: [Declude.JunkMail] Whitelisting a test?

2004-05-12 Thread R. Scott Perry
Is there anyway we can whitelist a test? With Declude we can have combination tests and tests that give weight based on a combination of test names.. now I wonder if we can whitelist a test name: Whitelist Testsfailedspamcop :) If we can do this it can help us with whitelisting based on

Re: [Declude.JunkMail] Spamdomains question

2004-05-11 Thread R. Scott Perry
I just had an email fail spamdomains for [EMAIL PROTECTED] X-RBL-Warning: SPAMDOMAINS: Spamdomain 'swbell.net' found: Address of [EMAIL PROTECTED] sent from invalid mta7.pltn13.pbi.net. pbi.net is registered to SBC and is valid (pacific bell internet) In my spam domains file I have this:

Re: Re: [Declude.JunkMail] messages from declude list marked as spam

2004-05-11 Thread R. Scott Perry
Now Scott needs to notify us for future IP change of his mail server No, it is your responsibility to check to see if it changes. Declude JunkMail is designed to prevent legitimate E-mail from getting caught. If you are blocking the E-mail, there is probably a problem with your configuration.

Re: [Declude.JunkMail] messages from declude list marked as spam

2004-05-11 Thread R. Scott Perry
No need for a response from NJABL -- they are refusing to accept our mail to their removal address (a temporary failure for 10 hours from their primary mailserver; their backup would have outright refused the E-mail if our mailserver hit it). So it is safe to say that NJABL is willing to

RE: [Declude.JunkMail] Country Code for Palestine?

2004-05-11 Thread R. Scott Perry
I was wondering if there was a way to decode the Mime encoding of a message so that I could build filters to catch the Vi*agra portion of the subject line. I'm included both what the subject line looks like in an e-mail client and what the internet headers of the message looks like. The

Re: [Declude.JunkMail] Latest interim

2004-05-11 Thread R. Scott Perry
It would be a great help if you can indicate what is the latest interim number- for one big reason... It will reduce the load on your server since we really have no way to know other than downloading it and seeing if a new version shows up. If we know the latest interim is the one we have then

Re: [Declude.JunkMail] Latest interim

2004-05-11 Thread R. Scott Perry
The file date does display on the webpage. But I agree the version number displayed in some manner would be very useful. We can do that, but then it is back to just releases/betas. I think the final answer really should be If you don't like the way that interim releases work, pretend that

RE: [Declude.JunkMail] Latest interim

2004-05-11 Thread R. Scott Perry
The management of interim releases comes up in regular intervals. I agree, it is a waste of resources of time that email messages refer to a mysterious latest interim - instead of simply qualifying, interim 1.76i6. I just can't see how that can possible take more time to the author - but it will

Re: [Declude.JunkMail] Latest interim

2004-05-11 Thread R. Scott Perry
Please understand that I hold you in the highest regard..grin Surely you know which interim you have available when you post to the list that something is added or fixed in the latest interim? I can say that the latest interim is 1.79i7. But that won't help someone who is running 1.79i3 in

Re: [Declude.JunkMail] Latest interim

2004-05-11 Thread R. Scott Perry
BTW, what is the new link for interims ? The URL for interim releases is http://www.declude.com/version/interim . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus

RE: [Declude.JunkMail] Latest interim

2004-05-11 Thread R. Scott Perry
That one is 1.79i6. Scott just said that the latest interim was v1.79i7? The latest interim available at the web site is 1.79i6. Just out of curiosity, how did you come by this valuable piece of information. As I said, I found no mention of it in the archives. http://www.mail-archive.com is

Re: [Declude.JunkMail] Odd error - bogus Message-ID header???

2004-05-10 Thread R. Scott Perry
Is this something new(er)? I don't believe so. I'm now also seeing errors related to a bad Subject: header??? In this case it is seemingly related to multiple spaces that appear at the end or near the end of the subject. This is essentially causing a double hit for this as I am already

Re: [Declude.JunkMail] Country Code for Palestine?

2004-05-10 Thread R. Scott Perry
Does anyone know what the Country Code for Palestine is? I just received an e-mail which Declude's X-COUNTRY-CHAIN identified as Palestine yet the official country code list, http://www.iana.org/cctld/cctld-whois.htmhttp://www.iana.org/cctld/cctld-whois.htm, makes no mention of Palestine.

Re: [Declude.JunkMail] messages from declude list marked as spam

2004-05-10 Thread R. Scott Perry
My messages from Declude are being caught as spam. Failing NJABL-DYNA, and DUL Robert: MAPS says that our new IP is not listed in DUL. Are you paying for their service? If not, you should remove the test (otherwise, they might list all IPs or randomly list IPs or whatever).

Re: [Declude.JunkMail] messages from declude list marked as spam

2004-05-10 Thread R. Scott Perry
MAPS says that our new IP is not listed in DUL. Are you paying for their service? If not, you should remove the test (otherwise, they might list all IPs or randomly list IPs or whatever). This is the old EASYNET-DYNA zone that they picked up after EASYNET was no more. Actually, DUL is the

Re: [Declude.JunkMail] messages from declude list marked as spam

2004-05-10 Thread R. Scott Perry
This sounds like NJABL-DYNA. According to their information, they will not remove us, and I'm guessing they will not. Interestingly, though, Easynet was willing to remove our IP, back when they ran it. We'll see what they say, though. No need for a response from NJABL -- they are refusing

Re: [Declude.JunkMail] messages from declude list marked as spam

2004-05-10 Thread R. Scott Perry
My messages from Declude are being caught as spam. Failing NJABL-DYNA, and DUL Anybody else having this problem? Started a couple of days ago. That's because we were assigned a new IP. Note that NJABL-DYNA lists static IPs (such as ours), and does not allow legitimate mailservers to be

Re: [Declude.JunkMail] Odd error - bogus Message-ID header???

2004-05-10 Thread R. Scott Perry
Something odd is happening here. I've now seen two recent false positives where the BADHEADER error code, 8004000e, relates to a Bogus Message-ID header when looked up with your tool. From what I can see, the Message-ID headers were both fine (one example is included below). Also note that

Re: [Declude.JunkMail] Messages for list showing up in spam account

2004-05-07 Thread R. Scott Perry
Was just wondering why these messages, that should be delivered to our maillist account, is being delivered to our spam account. It's hard to say without more information, but what I can say is that: X-Spam-Tests-Failed: ROUTING [-6] The E-mail only failed the ROUTING test, and scored less than

Re: [Declude.JunkMail] Domain forwarding

2004-05-07 Thread R. Scott Perry
Setting up iMail to store-and-forward the mail for the new server is easy enough. I just want to make sure I have my ducks in a row on the Declude side. The on-line manual sez that Declude will treat the mail for the forwarded domain as outgoing, and claims that the standard and pro

Re: [Declude.JunkMail] SPF logs

2004-05-07 Thread R. Scott Perry
Maybe this was discussed before, but i have spf.log and spf.none growing in c:\ what to do about these ? why aren't they included in the regular declude logs ? Because they are not appropriate for the regular Declude logs. The SPF logging was added when the SPF support was first added, and

Re: [Declude.JunkMail] Feature Request

2004-05-07 Thread R. Scott Perry
I know this has been requested before, but if more people request it, won't it get higher on the list... The TESTSFAILED filter type just begs for the NOTCONTAINS parameter. The next release will include NOTCONTAINS. :) -Scott --- Declude

RE: [Declude.JunkMail] Declude headers missing from several e-mails

2004-05-06 Thread R. Scott Perry
No backup software, no on access scanning. I am having some other problems with the machine - I'm about to nuke it regardless - I just wanted to make sure that declude was still being called to scan for viruses until I get this box formatted... ugh Unfortunately, if the files can't be locked by

Re: [Declude.JunkMail] Attach Command

2004-05-06 Thread R. Scott Perry
I am using the ATTACH command with the default spamattach.eml file. Is there a method to specify a different .eml file? I would like to have one per domain or for testing etc. No, only the \IMail\Declude\spamattach.eml file can be used with the ATTACH action.

RE: Re[2]: [Declude.JunkMail] Declude and SPF

2004-05-06 Thread R. Scott Perry
Not on version 7. decluse does not know if it is a local or remote user until Imail 8 and SMTP auth. Imail 8 indicates in the Q file it the user authed or not not if the user is local or remote. And why we can specify separate XINHEADER and XOUTHEADER lines? That's different.

Re: [Declude.JunkMail] %WEIGHT% variable as -100

2004-05-06 Thread R. Scott Perry
This may be very minor and possibly just cosmetic, I have found that some messages will have a %WEIGHT% variable returned for a WARN action that is -100 when such a score is impossible on our system. The example below is from a message that scored 0 in the logs (seemingly correct), but shows

Re: [Declude.JunkMail] %WEIGHT% variable as -100

2004-05-06 Thread R. Scott Perry
1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights

Re: [Declude.JunkMail] HTML COMMENTS found in PDF attachment?

2004-05-05 Thread R. Scott Perry
This email failed some tests that it shouldn't--at least the COMMENTS test--from what I can tell. Help please. Unfortunately, there isn't much that can be done about this -- it seems that some .PDF files are sent in a strange way that causes them to appear to have anti-filter HTML comments in

Re: [Declude.JunkMail] Declude headers missing from several e-mails

2004-05-05 Thread R. Scott Perry
Logentry for that time period - there is a gap? 05/05/2004 05:15:07 Qae350111006606b6 Could not lock D:\IMail\spool\Qae350111006606b6.SMD; timed out (j=2). 05/05/2004 05:33:09 Qae85002a00623cd4 Tests failed [weight=44]: SBL=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE MOREIPS=WARN

Re: [Declude.JunkMail] DNS Report mail server failure

2004-05-05 Thread R. Scott Perry
I just came across an issue where DNS Report was giving me a failure for the following: FAIL Connect to mail servers ERROR: I could not connect to one or more of your mailservers: mx2.mailpure.com: Connection closed before I received all my data (state 8). Your mailserver disconnected before

RE: [Declude.JunkMail] Declude headers missing from several e-mails

2004-05-05 Thread R. Scott Perry
There were e-mails delivered between 5:15 and 5:33 - This could not lock message should've just effected just that one e-mail. It shouldn't have stopped Declude from being called for 15 minutes. Correct? After a closer look at the logs, this was what I found - what could cause so many errors?

RE: [Declude.JunkMail] Declude and SPF

2004-05-04 Thread R. Scott Perry
I am not running my own DNS Servers. My ISP will have to add an A record for me, correct? Whoever handles your DNS would need to add the TXT record. Depending on that situation, that could be you, your Internet provider, or a company that the DNS has been outsourced to.

Re: [Declude.JunkMail] NJABL:NJABL Open Relay / Dynamic IP Conflict

2004-05-04 Thread R. Scott Perry
Scott, what's the limit on weight? 2-byte signed int? 4-byte signed int? 4-byte signed int, so it can go from about -2147483647 to 2147483647 (giving you 31 flags to play with). -Scott --- Declude JunkMail: The advanced anti-spam solution for

Re: [Declude.JunkMail] Anything special for Imail 8.1?

2004-05-04 Thread R. Scott Perry
I know when Imail 8.1 was initially release there were some issues with Imail and Declude? I just noticed 8.11 is out and figured I'd upgrade but want to make sure my Junkmail doesn't break! :) There was a very minor issue with IMail v8.1 (where E-mail forwarded E-mail would get scanned multiple

RE: [Declude.JunkMail] Anything special for Imail 8.1?

2004-05-04 Thread R. Scott Perry
There are no known issues with IMail v8.11 and Declude. So can I continue to use the latest non-beta or do I need to beta? How stable is the beta? It would probably be better to run the Declude beta. It is very stable, and will help ensure that nothing weird happens when using IMail v8.11

Re: [Declude.JunkMail] Anything special for Imail 8.1?

2004-05-04 Thread R. Scott Perry
To confirm, you're talking about Declude 1.79? Correct. I don't recall off-hand which version added the support for ignoring forwarded E-mails to work around the problem with IMail v8.1, but it was after the latest released version, so running 1.79 will work fine. If anyone is running a beta

Re: [Declude.JunkMail] Printable manual

2004-05-03 Thread R. Scott Perry
Is there a manual suitable for printing (not the html page) available on the website? The manual at http://www.declude.com/junkmail/manual.htm is the only version of the manual. It is designed to be printable. -Scott --- Declude JunkMail: The

Re: [Declude.JunkMail] Declude HiJack: root account in hold1 folder

2004-05-03 Thread R. Scott Perry
Does anybody know why my root account gets cought up in the hold1 folder when using Declude HiJack? Log entry: --- 05/03/2004 15:39:56 Q4bac085007e9 root is not local. That's probably because root isn't a valid E-mail address, and therefore is assumed to be highly suspicious. The E-mail

RE: [Declude.JunkMail] Declude HiJack: root account in hold1 folder

2004-05-03 Thread R. Scott Perry
This started happening just a few days ago. I have been running HiJack for 6 months now, without this being an issue. It seems to happen when Declude is sending Virus Alerts to me as the Admin. admin = root account. Where can I add the domain name to the root account? That would be in the To:

RE: [Declude.JunkMail] Declude HiJack: root account in hold1 folder

2004-05-03 Thread R. Scott Perry
This is my postmasert.eml: To: [EMAIL PROTECTED] That is strange -- that should show up as [EMAIL PROTECTED]. IMail v8 and IMail v8.10 made a number of small changes in the way that it handles E-mail sent from Declude, so it may be related to that (it sounds like it may be processing

Re: [Declude.JunkMail] Declude and SPF

2004-05-03 Thread R. Scott Perry
Is there a tutorial available to set up SPF with Declude? Do I also have to set up records at spf.pobox.com for this to work? I have look at the wizard, but I am not quite certain as of how to set up my domain correctly. There are two separate pieces: [1] Setting up your domain with an SPF

Re: [Declude.JunkMail] IPBYPASS and HELO

2004-05-03 Thread R. Scott Perry
If in the Global.cfg, If I have IPBYPASS and the IP of my backup MX, does that affect HELO in a filter test? Yes. Declude JunkMail will then see the HELO of the server that connected to your backup MX record. Example, I have IPBYPASS and my backup MX. In a filter file for headers and such, I

Re: [Declude.JunkMail] Declude Products Training

2004-05-03 Thread R. Scott Perry
Does Declude offer some kind of training for their products? With things in the virus/spam world getting out of control, it would be great to get into some kind of training to be sure I am doing all that I can. No, we do not currently offer any training courses.

Re: [Declude.JunkMail] Blocking Sender

2004-05-03 Thread R. Scott Perry
I want to block anything sent from onlinelifetime.com. I could use BLACKLIST fromfile C:\iMail\Declude\blacklist.txt x 50 0 Or BLOCKSENDER filter C:\IMail\Declude\BlockSender.txt x 0 0 ( BlockSender.txt: HEADERS 50 CONTAINS @onlinelifetime.com HEADERS 50 CONTAINS

Re: [Declude.JunkMail] MailFrom vs From

2004-05-02 Thread R. Scott Perry
The header contains: From: [EMAIL PROTECTED] [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [62.4.71.170] is think %MAILFROM% will be [EMAIL PROTECTED] Is there a %Variable% that will give [EMAIL PROTECTED] ? No -- Declude JunkMail only uses the return address, as it is the one that

Re: [Declude.JunkMail] Hello Bogus

2004-05-02 Thread R. Scott Perry
Shouldnt this fail the helobogus test ? (No mx and no A records) Received: from finance [217.64.97.78] by mail.cefib.com No, because the sender was one in your domain. Since most mail clients unfortunately are not RFC-compliant with the HELO/EHLO, Declude JunkMail automatically skips this test

Re: [Declude.JunkMail] Log feature request

2004-04-30 Thread R. Scott Perry
For log level high, I'd like to see the failure line for fromfile test logged. Current log line: 04/28/2004 00:14:52 Q3dca01de026a2147 Msg failed BLACKLIST-DOMAIN (). Action=WARN. Desired log line; 04/28/2004 00:14:52 Q3dca01de026a2147 Msg failed BLACKLIST-DOMAIN (@bestdeals.com). Action=WARN.

Re: [Declude.JunkMail] Another test idea

2004-04-30 Thread R. Scott Perry
Wouldn't a difference in the number of recipients in the ALLRECIPS and REALRECIPS variables be a rather good spam indicator, as this means that the recipient list is a mixture of both valid and invalid addresses? I guess that such a test could be implemented directly in Declude, but it has to

Re: [Declude.JunkMail] Whitelisting IP Addresses

2004-04-30 Thread R. Scott Perry
What I really want to do is WHITELIST these IP addresses for my domain only. That isn't currently possible. Per-user/per-domain whitelisting is available for the return address, but there isn't yet a way to have IP whitelisting on a per-user/per-domain basis.

RE: [Declude.JunkMail] Whitelisting IP Addresses

2004-04-30 Thread R. Scott Perry
Can you whitelist IP addresses via a file in global.cfg or only inline? You can currently only whitelist IPs in the global.cfg file (WHITELIST IP 192.0.2.25). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers

Re: [Declude.JunkMail] Whitlisted 0.0.0.0 ??

2004-04-29 Thread R. Scott Perry
M Received: from À [66.63.168.171] by rleeheath.com M (SMTPD32-8.10) id AE395E1A020E; Wed, 28 Apr 2004 18:28:57 -0500 M X-RBL-Warning: RDNS-ROUTE: 0.0.0.0 - (Private IP) - Reverse DNS 0.0.0.0 ??? automatic whitelisted? Wondering how this spam was autowhitelisted and went right through? Using

Re: [Declude.JunkMail] Per-Domain Virus.CFG?

2004-04-29 Thread R. Scott Perry
Was wondering if there was a way to have a per-domain virus.cfg. No -- the virus.cfg (like the global.cfg file for Declude JunkMail) only contains global settings. Is it possible to have only his domain allow this extension so he can distribute the file or the only way to change

Re: [Declude.JunkMail] Wildcards in sender blacklist

2004-04-29 Thread R. Scott Perry
Are wildcards supported in the sender blacklists? For example: @mail*.rapiddealsbyemail.com @mail*.emailcourrier.com @relay*.reunion.com @*xxx* No, that is not possible. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail

Re: [Declude.JunkMail] High CPU usage

2004-04-28 Thread R. Scott Perry
We turned on the ipblacklist and domainblacklist and populated them from a couple of pretty good sources last Thursday and all of a sudden we were not getting anywhere close to the amount of spam, however some customers who use ColdFusion started not getting much of their email. Also our dual

Re: [Declude.JunkMail] Whitelist.txt file

2004-04-28 Thread R. Scott Perry
Can IP addresses in conjunction with e-mail addresses (or domain names) be added to a Whitelists.txt file within a per-domain configuration? No, currently the whitelistfiles can only use domains or E-mail addresses. -Scott --- Declude

RE: [Declude.JunkMail] Whitelist.txt file

2004-04-28 Thread R. Scott Perry
And to just re-verify something, if the whitelist.txt file is in the domain folder (per-domain config), the GLOBAL.CFG is skipped and the whitelist.txt file is used instead for whitelisting e-mail addresses. Or are they used in conjunction with each other? That's handled the same regardless of

Re: [Declude.JunkMail] ALLRECIPS variable

2004-04-28 Thread R. Scott Perry
Something just struck me. Wouldn't it be a good idea to have the individual addresses in the ALLRECIPS variable surrounded by angled brackets, if it is possible to do that? It only makes sense to use this variable with the CONTAINS filtertype, and by having such brackets we could easily

RE: [Declude.JunkMail] Whitelist.txt file

2004-04-28 Thread R. Scott Perry
Just trying to get a domain configured correct in a per-domain config with the whitelist.txt file (having problems and hearing about it from the client). Just so long as you have the WHITELISTFILE option in the correct config file, and the file exists and has the appropriate domain(s) and/or

Re: [Declude.JunkMail] When does Declude re-read .junkmail files?

2004-04-28 Thread R. Scott Perry
I have this weird problem. I've been trying to get WHITELISTFILE to work for days with no avail. I was pretty sure I had followed all the instructions, and still no results. So I left the settings in there, and gave up. Well, sparked by the Perl Script Spamheaders email and my finding of the

<    1   2   3   4   5   6   7   8   9   10   >