RE: [Declude.JunkMail] Fine tuning
Lower the weights of the noabuse/nopostmaster tests for one. I think the default is 5 for each. The noabuse/nopostmaster tests fail for most of the big guys (aol.com,earthlink.net,msn.com,etc,etc...) Or You might play by raising the weight of the other tests and trapping/bouncing on a higher WEIGHT. You might want to read the mail-archive as to why bouncing might not be such a good idea. Bouncing can actually add extra load to mail servers as 90% (whatever it is, it's a lot) of junkmail has a FORGED from address, so a single bounce usually adds to multiple bounces until the loop ends. You can also use the beta feature 'filter' to add negative weight for certain providers rather than a complete whitelist. For documentation on the Beta FILTER feature see http://www.mail-archive.com/declude.junkmail@declude.com/msg02791.html And as of 1.57 BETA a few updates were made to the FILTER type http://www.mail-archive.com/declude.junkmail@declude.com/msg03378.html -Tom -Original Message- From: David Dodell [mailto:[EMAIL PROTECTED]] Sent: Tuesday, September 10, 2002 9:55 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Fine tuning I recently implemented using the bounce feature of Junkmail, and spam has dropped 95% however, there are a few users that are trying to send us legtimate email, but their ISP's are listed and failing multiple tests ... ie DSBLMULTI, DNSRBL-SPAM, NOABUSE, NOPOSTMASTER I hate to start making whitelists for each of these people, since that list could become very large very fast ... and obviously telling them their ISP are junk is not going to work ... For example one of them is Bellsouth.net which seems to fail multiple tests ... just whitelist them, but that would allow spam to come through ... Suggestions on how to deal with this? David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fine tuning
I agree with Tom on Bounce. When I first implemented JunkMail, I would Bounce messages. I then got tired of dealing with all the failed Bounce. Now I hold and every couple of days I go through and delete all held messages over 5 days old. 5 Days is plenty of time for someone to complain they did not get an important e-mail. Also, I have NOABUSE and NOPOSTMASTER set to 2. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist Troubles
Hi; I think Declude looks at this: X-Declude-Sender: [EMAIL PROTECTED] Two possibilities: - @postino.ch is whitelisted - [EMAIL PROTECTED] is whitelisted. At least that is my understanding... Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Koree A. Smith Sent: Wednesday, September 11, 2002 10:41 AM To: declude.junkmail Subject: [Declude.JunkMail] Whitelist Troubles I have a few whitelists, but am wondering why this particular message was whitelisted. I don't have anything in these headers that is whitelisted. However, I noticed that the X-Rcpt-To header has a different address in it than what mine is. I checked my whitelists, and *that* address is not whitelisted either. Any clues? Thanks, Koree Original Message From: - Wed Sep 11 09:24:44 2002 X-UIDL: 293824111 X-Mozilla-Status: 0001 X-Mozilla-Status2: Received: from temqube.teac.com.my [210.19.150.132] by mvn.net with ESMTP (SMTPD32-7.07) id A26515201E8; Tue, 10 Sep 2002 17:29:57 -0500 Received: from mail.mailbox.hu ([10.1.1.3]) by temqube.teac.com.my (8.10.2/8.10.2) with SMTP id g8AMSH607375; Wed, 11 Sep 2002 06:28:18 +0800 Date: Wed, 11 Sep 2002 06:28:18 +0800 Message-Id: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] [EMAIL PROTECTED] To: 9346@[EMAIL PROTECTED] 9346@[EMAIL PROTECTED] Subject: HELP US MARKET OUR NEW, LIFE-CHANGING MEDICAL TECHNOLOGY!!! Content-Type: text/plain; charset=us-ascii;format=flowed Content-Transfer-Encoding: 7bit X-Declude-Sender: [EMAIL PROTECTED] [210.19.150.132] X-Note: This E-mail was scanned for spam. X-Note-Sender: This E-mail was sent from [No Reverse DNS] ([210.19.150.132]). X-Declude-Version: 1.58 X-Declude-Weight: 0 (Whitelisted) X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 293824111 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist Troubles
These are the whitelist entries: #Exceptions for [EMAIL PROTECTED] WHITELIST ANYWHERE[EMAIL PROTECTED] WHITELIST FROM [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TODOMAIN @lotsharp.com Basically, these are people who do not want Spam filtering. Koree R. Scott Perry wrote: I have a few whitelists, but am wondering why this particular message was whitelisted. I don't have anything in these headers that is whitelisted. However, I noticed that the X-Rcpt-To header has a different address in it than what mine is. I checked my whitelists, and *that* address is not whitelisted either. Any clues? What are your whitelist entries? The most likely culprit is a WHITELIST ANYWHERE entry. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fine tuning
I bounce on RBLs only. I created an account called spam-bounce and setup and Imail rule to delete any mail sent to that address. Then I set the bounce email from address to [EMAIL PROTECTED] that way if they come back they are deleted by the system. Make sure you provide adequate info in your bounce message so that legit email senders no why it bounced and what they have to do to correct the situation. A URL to a web page is best in my opinion. Also mention that replying to the bounce is futile. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: John Tolmachoff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, September 11, 2002 10:06 AM Subject: RE: [Declude.JunkMail] Fine tuning I agree with Tom on Bounce. When I first implemented JunkMail, I would Bounce messages. I then got tired of dealing with all the failed Bounce. Now I hold and every couple of days I go through and delete all held messages over 5 days old. 5 Days is plenty of time for someone to complain they did not get an important e-mail. Also, I have NOABUSE and NOPOSTMASTER set to 2. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fine tuning
I bounce on RBLs only. I created an account called spam-bounce and setup and Imail rule to delete any mail sent to that address. Then I set the bounce email from address to [EMAIL PROTECTED] that way if they come back they are deleted by the system. Make sure you provide adequate info in your bounce message so that legit email senders no why it bounced and what they have to do to correct the situation. A URL to a web page is best in my opinion. Also mention that replying to the bounce is futile. One word of warning here -- Since about 99% or so of spammers use forged return addresses, this is going to waste a lot of resources (both on your end, and on the victim's end). You need to weigh the benefit of the bounce message against the drawback of sending bounces to innocent victims. If there are going to be a lot of legitimate E-mails bouncing, it's OK (the HELOBOGUS test, for example). For a test that has very few false positives (WEIGHT20, for example), bouncing the E-mail is usually a very bad thing to do. -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] At least they're honest !
Gave me a chuckle, thought I'd share Received: from mail.reallyfakedomain.com [64.158.31.171] by wpa.net with ESMTP (SMTPD32-7.12) id A28419320042; Wed, 11 Sep 2002 11:34:28 -0400 Received: from heater (localhost [127.0.0.1]) by mail.reallyfakedomain.com (Postfix) with SMTP id 7E2F4342FD for [EMAIL PROTECTED]; Wed, 11 Sep 2002 06:22:04 -0700 (MST) Frederick P. Squib, Jr. Network Administrator Citizens Internet Services http://www.wpa.net --- [This E-mail scanned for viruses by Citizens Internet Services with Declude Virus v 1.58] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Consistant spam
Using the latest beta, you can set up a filter that would reject any E-mail with mx-man.net in the headers. Thanks! I have not had much time this summer to follow the betas and the features you have been adding. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] More encoded spam
on 9/5/02 9:23 PM, Madscientist wrote: All this is good I guess. Until we come up with some good examples of legitimate messages with text/html base64 then we won't completely settle the issue. It does seem that the evidence so far is strongly in favor of a spam/no-spam test for base64 encoded html. Any news on this front? My subscribers and I are receiving more and more of this type of spam. Even if there are some legitimate messages of this type going around, I'd like a Declude test to identify this type of message. I plan on giving messages that fail this future test a weight of 5 in hopes that when combined with my other tests/weights it will cause these messages to exceed my automatic delete weight. If no one finds any legitimate messages of this type, I would obviously increase the weight of the test but until then I could at least stop some of these messages. Later, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] More encoded spam
[X] I agree. -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Im Auftrag von Helpdesk Gesendet: Mittwoch, 11. September 2002 18:54 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] More encoded spam on 9/5/02 9:23 PM, Madscientist wrote: All this is good I guess. Until we come up with some good examples of legitimate messages with text/html base64 then we won't completely settle the issue. It does seem that the evidence so far is strongly in favor of a spam/no-spam test for base64 encoded html. Any news on this front? My subscribers and I are receiving more and more of this type of spam. Even if there are some legitimate messages of this type going around, I'd like a Declude test to identify this type of message. I plan on giving messages that fail this future test a weight of 5 in hopes that when combined with my other tests/weights it will cause these messages to exceed my automatic delete weight. If no one finds any legitimate messages of this type, I would obviously increase the weight of the test but until then I could at least stop some of these messages. Later, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Null Senders (Kind of OT)
Hello, Recently, Texas AM University decided to institute some method for checking to see if the sending mail server accepts mail from a null sender. We set-up our Imail server to not accept null senders. I know, I know, it's a violation of RFC but it seems to me that this RFC is archaic and should no longer be enforced. I know that the spirit of the RFC was to prevent mail loops, but most modern mail servers prevent mail loops by detecting them. (not re-rejecting mail) Has any one else seen this problem? Is there any way to get an RFC repealed? I personally would like to see an RFC instituted that makes sending mail from a null sender a violation of RFC. Corey Travioli Village Online - Network Administrator 440 Benmar Dr. Suite #2075 Houston, Texas 77060 E-Mail: [EMAIL PROTECTED] Ph: 281-820-1234 x204 Fax: 281-539-2390 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Null Senders (Kind of OT)
Recently, Texas AM University decided to institute some method for checking to see if the sending mail server accepts mail from a null sender. Ouch. :) Have you gotten listed in http://www.rfc-ignorant.org yet? We set-up our Imail server to not accept null senders. I know, I know, it's a violation of RFC but it seems to me that this RFC is archaic and should no longer be enforced. Hmmm... I know that the spirit of the RFC was to prevent mail loops, but most modern mail servers prevent mail loops by detecting them. (not re-rejecting mail) Do you know that the RFCs require bounce messages and Delivery Status Notifications to use ? Although the reason was to prevent mail loops, that's how all bounce messages and DSNs are currently sent. So either you need to expect all mailservers to change how they operate, or you need to say I feel that it is OK to reject all bounce messages and DSNs because I think there is a better way for them to be sent. Part of the problem, though, is backwards compatibility, which is always a big issue on the Internet. Also, you should note that refusing the sender also means that double-bounces will occur, so someone somewhere will likely end up getting (and having to deal with) the bounce that you should have received and dealt with. Has any one else seen this problem? Is there any way to get an RFC repealed? I personally would like to see an RFC instituted that makes sending mail from a null sender a violation of RFC. It is impossible to repeal an RFC, but it is possible to have a new RFC that corrects/alters it. However, it is a long and tedious process, and in this case I would guess that it is unlikely that it would get approval. But, feel free to try. :) You can go to http://www.rfc-editor.org/ for a starting place on the process. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Null Senders (Kind of OT)
Is there any way to get an RFC repealed? I personally would like to see an RFC instituted that makes sending mail from a null sender a violation of RFC. It ain't gonna happen! So you had better start accepting null senders or find yourself blacklisted at www.rfc-ignorant.org. And then things get real ugly... It gets real complicated, but the null sender is needed to help PREVENT mail loops and double bounces. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist is still failing
Scott I believe I found the problem ... before I took over looking after the mail server, with all its quirks, I think a test version of an early junkmail was loaded ... I found another config and junkmail file in the imail root so I have a version of the config and junk files there and one in \imail\declude ... Is one folder or the other a better location ??? Presently I have duplicate config and junkmail files in both folders ... and the blacklist is really working now .. Thanks Scott !! Doris - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, September 09, 2002 4:31 PM Subject: Re: [Declude.JunkMail] Blacklist is still failing Scott .. I updated to the beta version of junk mail checked my blacklist.txt file and the test and this one still came through. I am attaching the newest config, junkmail and blacklist files as well. Are you really running the latest beta (type \IMail\Declude -diag from a command prompt, *exactly* like that, to find out)? Are other IPs in the blacklist getting caught? If that isn't the case, the debug mode may be necessary to track this down. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Null Senders (Kind of OT)
FWIW, Exchange uses Null senders for their out of office notification and other rules/server side messages. If you turn that off in iMail you'll block these messages. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Sheldon Koehler Sent: Wednesday, September 11, 2002 4:00 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Null Senders (Kind of OT) Is there any way to get an RFC repealed? I personally would like to see an RFC instituted that makes sending mail from a null sender a violation of RFC. It ain't gonna happen! So you had better start accepting null senders or find yourself blacklisted at www.rfc-ignorant.org. And then things get real ugly... It gets real complicated, but the null sender is needed to help PREVENT mail loops and double bounces. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Null Senders (Kind of OT)
Thanks for your replies. Good luck! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist is still failing
Declude.exe should be in the IMail root and the config files in the IMail\Declude directory. Bill -Original Message- From: Doris Dean [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 11, 2002 1:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Blacklist is still failing Scott I believe I found the problem ... before I took over looking after the mail server, with all its quirks, I think a test version of an early junkmail was loaded ... I found another config and junkmail file in the imail root so I have a version of the config and junk files there and one in \imail\declude ... Is one folder or the other a better location ??? Presently I have duplicate config and junkmail files in both folders ... and the blacklist is really working now .. Thanks Scott !! Doris - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, September 09, 2002 4:31 PM Subject: Re: [Declude.JunkMail] Blacklist is still failing Scott .. I updated to the beta version of junk mail checked my blacklist.txt file and the test and this one still came through. I am attaching the newest config, junkmail and blacklist files as well. Are you really running the latest beta (type \IMail\Declude -diag from a command prompt, *exactly* like that, to find out)? Are other IPs in the blacklist getting caught? If that isn't the case, the debug mode may be necessary to track this down. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist is still failing
Scott I believe I found the problem ... before I took over looking after the mail server, with all its quirks, I think a test version of an early junkmail was loaded ... I found another config and junkmail file in the imail root so I have a version of the config and junk files there and one in \imail\declude ... Is one folder or the other a better location ??? The only place that Declude will look for config files is the \IMail\Declude\ directory, so that's the best (and only) place for config files for Declude to use. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] More encoded spam
All this is good I guess. Until we come up with some good examples of legitimate messages with text/html base64 then we won't completely settle the issue. It does seem that the evidence so far is strongly in favor of a spam/no-spam test for base64 encoded html. Any news on this front? It will be in the next release. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Timed weight?
Hi Scott, Only a suggestion, maybe I'm wrong: Can it be usefull to give a few points for messages delivered in a certain time range?(for example between 10.00 pm and 05.00 am) A great part of the messages delivered in this time range are spam. The problem is that there are also newsletter and other auto-generated mails. But the important thing is that this test should be very easy to implement, it is very ressource friendly and it covers only messages that are not hand written (not important) Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Timed weight?
Only a suggestion, maybe I'm wrong: Can it be usefull to give a few points for messages delivered in a certain time range?(for example between 10.00 pm and 05.00 am) That is a good idea, and something that we have been giving some thought to. It would likely only be beneficial to a small group of our customers (businesses that do business primarily in their own country, as opposed to ISPs and schools and such), but would probably work well for them. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Timed weight?
Now there's a sophisticated element to the test. You could key the time to the geographic region of the sender's IP range. Not much more work (since it's generally hard-coded) but makes the test useful for determining the time of day at the sender's location -- in theory anyway. Thoughts? _M ]-Original Message- ]From: [EMAIL PROTECTED] ][mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry ]Sent: Wednesday, September 11, 2002 6:39 PM ]To: [EMAIL PROTECTED] ]Subject: Re: [Declude.JunkMail] Timed weight? ] ] ] ]Only a suggestion, maybe I'm wrong: Can it be usefull to give a few ]points for messages delivered in a certain time range?(for example ]between 10.00 pm and 05.00 am) ] ]That is a good idea, and something that we have been giving some thought ]to. It would likely only be beneficial to a small group of our customers ](businesses that do business primarily in their own country, as opposed to ]ISPs and schools and such), but would probably work well for them. ] -Scott ] ]--- ][This E-mail was scanned for viruses by Declude Virus ](http://www.declude.com)] ] ]--- ]This E-mail came from the Declude.JunkMail mailing list. To ]unsubscribe, just send an E-mail to [EMAIL PROTECTED], and ]type unsubscribe Declude.JunkMail. The archives can be found ]at http://www.mail-archive.com. ] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Timed weight?
Now there's a sophisticated element to the test. You could key the time to the geographic region of the sender's IP range. Not much more work (since it's generally hard-coded) but makes the test useful for determining the time of day at the sender's location -- in theory anyway. Now that sounds interesting if it can be implemented. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
