06, 2005 3:52 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] CBL:Fw: news
basically it will end the filter if any of the statements are not true.
These stock emails have always met these 4 criteria, so if it doesn't meet
them end the filter.
1. contains a gif attachmen
;Erik" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, December 07, 2005 2:30 PM
Subject: RE: [Declude.JunkMail] CBL:Fw: news
Using CONTAINS will trap a lot of real email if that is the only line in
your filter.
Could try this and set up the $default$.junkmail to HOLD so you can monitor
the
ECT 50 STARTSWITH headline news
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Wednesday, December 07, 2005 1:16 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] CBL:Fw: news
Try CONTAINS instead of BEGINSWITH
Make su
NTAINS Content-Type: image/gif
HEADERS END NOTCONTAINS Received: from unknown (HELO
HEADERS END NOTCONTAINS [192.168.
BODY 20 CONTAINS mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Wednesday, December 07, 2005 1:16 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] CBL:Fw: news
"The declude.cfg goes like this"
Try putting it in the global.cfg. The declude.cfg is for Declude system
settings, not test definitions. (Unless that was a typo, in which case,
you already know this).
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail c
00_0095_01C5FB31.DC30EB90Content-Type:
image/gif; name="lzj.gif"Content-Transfer-Encoding:
base64Content-ID: <[EMAIL PROTECTED]>
- Original Message -
From:
Scott Fisher
To: Declude.JunkMail@declude.com
Sent: Tuesday, December
--
Original Message -
From:
Scott Fisher
To:
Declude.JunkMail@declude.com
Sent:
Tuesday, December 06, 2005 3:51 PM
Subject:
Re: [Declude.JunkMail] CBL:Fw: news
basically it will end the filter
if any of the statements are not true.
These stock ema
.DC30EB90Content-Type:
image/gif; name="lzj.gif"Content-Transfer-Encoding:
base64Content-ID: <[EMAIL PROTECTED]>
- Original Message -
From:
Scott Fisher
To: Declude.JunkMail@declude.com
Sent: Tuesday, December 06, 2005 3:51
END NOTCONTAINS Content-Type:
image/gifHEADERS END NOTCONTAINS Received: from
unknown
(HELOHEADERS END NOTCONTAINS [192.168.TESTSFAILED END NOTCONTAINS CMDSPACE
BODY 15 CONTAINS
- Original Message -
From:
Todd
To: Declude.JunkMail@declude.com
1:54
PM
Subject: RE: [Declude.JunkMail] CBL:Fw:
news
We
use a body filter
BODY
15 BEGINSWITH
This
puts the message at our hold weight. I have not seen one false positive from
this test.
Kevin Bilbee
-Original Message-From: [EMAIL
- Original Message -
From:
Todd
To: Declude.JunkMail@declude.com
Sent: Tuesday, December 06, 2005 3:28
PM
Subject: Re: [Declude.JunkMail] CBL:Fw:
news
Scott,
I am looking through the Declude manual to
determine what you are doing. I don't
> To: Declude.JunkMail@declude.com
> Sent: Tuesday, December 06, 2005 1:50 PM
> Subject: Re: [Declude.JunkMail] CBL:Fw: news
>
>
> I use this filter:
>
> STOPATFIRSTHIT
>
> BODY END NOTCONTAINS Content-Type: image/gif
> HEADERS END NOTCONTAINS Received:
Fisher
To:
Declude.JunkMail@declude.com
Sent:
Tuesday, December 06, 2005 1:50 PM
Subject:
Re: [Declude.JunkMail] CBL:Fw: news
I use this filter:
STOPATFIRSTHIT
BODY END NOTCONTAINS Content-Type:
image/gif
HEADERS END NOTCONTAINS Received: from unknown (HE
, December 06, 2005 1:28 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] CBL:Fw:
news
Scott,
I am looking through the Declude manual to
determine what you are doing. I don't think I understand NOTCONTAINS. I
would think CONTAINS mean it has this string in the
I am probably missing something
painfully obvious here.
Todd
- Original Message -
From:
Scott
Fisher
To: Declude.JunkMail@declude.com
Sent: Tuesday, December 06, 2005 1:50
PM
Subject: Re: [Declude.JunkMail] CBL:Fw:
news
I use this filter:
STOPATFIR
: Tuesday, December 06, 2005 12:35 PM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] CBL:Fw: news
>
>
> May wish to consider CONTAINS instead of BEGINSWITH. This is one I just
>got.
>
> John C
>
>
>
>
>
>
>
>
&
@declude.comSubject: Re: [Declude.JunkMail] CBL:Fw:
news
Newer versions have been adding in some fluff
html...
You may need to change that to a
CONTAINS
- Original Message -
From:
Kevin Bilbee
To: Declude.JunkMail@declude.com
Sent: Tuesday
or ofothers.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin
BilbeeSent: Tuesday, December 06, 2005 1:55 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] CBL:Fw:
news
We
use a body filter
BODY
15 BEGINSWITH
This
ilto:[EMAIL PROTECTED] On Behalf Of Kevin
BilbeeSent: Tuesday, December 06, 2005 1:55 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] CBL:Fw:
news
We use
a body filter
BODY
15 BEGINSWITH
This
puts the message at our hold weight. I have not seen one false positive from
this test
Newer versions have been adding in some fluff
html...
You may need to change that to a
CONTAINS
- Original Message -
From:
Kevin Bilbee
To: Declude.JunkMail@declude.com
Sent: Tuesday, December 06, 2005 1:54
PM
Subject: RE: [Declude.JunkMail] CBL:Fw:
news
We use
a body filter
BODY
15 BEGINSWITH
This
puts the message at our hold weight. I have not seen one false positive from
this test.
Kevin
Bilbee
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On Behalf Of Richard
FarrisSent: Tuesday, Decembe
We have it blocked with the following
tests
X-Note: Total spam
weight of this E-mail is 25.X-Note: Spam Tests Failed: SORBS-DUHL [4],
NJABL-DYNABLOCK [9], FIVETEN-SPAM [5], CMDSPACE [7], WEIGHT10 [10], WEIGHT11
[11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19]
Harry Vanderzand inTown Int
I use this filter:
STOPATFIRSTHIT
BODY END NOTCONTAINS Content-Type:
image/gifHEADERS END NOTCONTAINS Received: from unknown
(HELOHEADERS END NOTCONTAINS [192.168.TESTSFAILED END NOTCONTAINS CMDSPACE
TESTSFAILED 100 CONTAINS HELO-IS-REVDNSTESTSFAILED 100 CONTAINS HELOISIPTESTSFAILED 5
23 matches
Mail list logo
