[Declude.JunkMail] Legitimate email syntax?
Title: Message Hi; Is there anyway a test can be made for detection of wrong email address syntax? Example: == From: "John Stoner" [EMAIL PROTECTED]Reply-To: "John Stoner" [EMAIL PROTECTED]To: DELETED Subject: [48~]Advertise by emailDate: Mon, 21 Jul 03 10:25:26 GMTX-Mailer: Internet Mail Service (5.5.2650.21)MIME-Version: 1.0Content-Type: multipart/alternative;boundary="AF_12._E1..3_C6_.79FF"X-Priority: 3X-MSMail-Priority: Normal X-MSMail-Priority: NormalX-RBL-Warning: DSN: Not supporting null originator (DSN)X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [a014010f].X-RBL-Warning: HELOBOGUS: Domain 12.4.218.129 has no MX or A records.X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected.X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 62.101.162.127 with no reverse DNS entry.X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [a014010f].X-RBL-Warning: COUNTRY: Message failed COUNTRY test (65)X-Declude-Sender: [EMAIL PROTECTED] [62.101.162.127]X-Declude-Spoolname: Dbf1300040020ad87.SMDX-Note: This E-mail was scanned filtered by Declude [1.70i21] for SPAM virus.X-Spam-Tests-Failed: DSN, NOABUSE, BADHEADERS, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, REVDNS, REVDNSa, ROUTING, COUNTRY, WEIGHT20s, WEIGHT20rX-Weight: 48X-Mailfrom: *.myownemail.comX-Note: Sent from: [EMAIL PROTECTED]X-Note: Sent from Reverse DNS: [No Reverse DNS] ([62.101.162.127]). == Naturally the email: [EMAIL PROTECTED]could not possibly be a valid email? or can it? It could be a good weight test. Regards, Kami
Re: [Declude.JunkMail] Legitimate email syntax?
Naturally the email: mailto:[EMAIL PROTECTED][EMAIL PROTECTED] could not possibly be a valid email? or can it? Surprisingly, that is a valid E-mail address. It is rarely used, but perfectly valid. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Legitimate email syntax?
Nevertheless, I think having a test that would look at invalid, or like this case, rarely used format in a weighted environment with a low appropriate weight would help in reducing spam. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, July 21, 2003 2:28 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Legitimate email syntax? Naturally the email: mailto:[EMAIL PROTECTED][EMAIL PROTECTED] could not possibly be a valid email? or can it? Surprisingly, that is a valid E-mail address. It is rarely used, but perfectly valid. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Legitimate email syntax?
From: Omar K. [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 21 Jul 2003 15:38:52 +0200 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Legitimate email syntax? Nevertheless, I think having a test that would look at invalid, or like this case, rarely used format in a weighted environment with a low appropriate weight would help in reducing spam. Sounds like something you could put in a filter file MAILFROM 10 STARTSWITH *@ No? I make filters with stuff like that all the time now. I never did the filters because I thought they were too much work, but now that I have made a DNS filter, and a content filter I am catching MUCH more spam because I give weight to things that have words that are commonly in spam subjects and bodies and such, and in my DNS filter I check for things like servers claiming to be my server's IP or name. Filters are very cool. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
I've seen that most of the spam emails, regardless of the weight, seem to fail the SPAMHEADERS, BADHEADERS, and IPNOTINMX tests. Question: do you guys HOLD email based on any of these three tests? If so, how is this done? Is this a smart approach? Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser Sent: Thursday, July 17, 2003 12:02 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Best Practices question Hi, Jose, Being a 2 months-old user of JunkMail I'm trying to find out best practices for dealing with spam. Sorry in advanced if this topic has been to death, but I couldn't find any helpful threads on the archives. Anyhow, I'm using the following rules but a TON of spam still making it through: WEIGHT10 WARN WEIGHT15 HOLD WEIGHT20 HOLD First of all, I believe using... WEIGHT15HOLD WEIGHT20HOLD ...in your $default$.junkmail is redundant. Using... WEIGHT15HOLD ...alone encompasses what... WEIGHT20HOLD does as well. Of course, the spam comes through because it doesn't meet the HOLD criteria. For example, I have spam emails with a weight of 7, others with 11, etc. My question is, what WEIGHT do you guys use to HOLD email? My configuration is still sub optimal. Our primary domain, NEXUSTECHGROUP.COM, has a hold weight of 9. But we use per-domain settings so some of our domains also have a hold weight of 5, 7 and 10. The thing is, there is no one one right weight. It all depends on the type of traffic that your IMail server is seeing. To any new Declude JunkMail user, the first thing I would recommend doing is establishing the optimal hold weight for either the server, if you aren't using per-domain settings, of for the domain, if you are. Now different people will have different definitions of optimal. For me, the optimal hold weight is the weight at which most spam is caught and hardly any false positives are generated. Another person might want to set their hold weight so high that zero false positives are caught. And yet another might want to set the weight so low such that zero spam makes it through. I like to have a mixture of both. Once you have established a hold weight you can then take further steps to add points to the weight of any spams making it in under the hold weight, thereby causing that spam to get caught. And you can take steps to subtract points to the weight of any legit e-mails that are over the hold weight, thereby keeping those legit e-mails from being caught. I think a good start for anyone is to establish that hold weight and then have just the one active line... WEIGHTXX HOLD ...in your $default$.junkmail file, where XX is your hold weight and WEIGHTXX is defined in GLOBAL.CFG as... WEIGHTXX weight x x XX 0 That's how I would start if I knew then when I began what I know now. Others may differ with me. TIA, Jose Take Care, Dan This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Legitimate email syntax?
Yep, this is what I have in my mailfrom filter file:
MAILFROM 10 CONTAINS `
MAILFROM 10 CONTAINS ~
MAILFROM 10 CONTAINS !
MAILFROM 10 CONTAINS #
MAILFROM 10 CONTAINS $
MAILFROM 10 CONTAINS %
MAILFROM 10 CONTAINS ^
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS *
MAILFROM 10 CONTAINS (
MAILFROM 10 CONTAINS )
MAILFROM 05 CONTAINS =
MAILFROM 10 CONTAINS +
MAILFROM 10 CONTAINS [
MAILFROM 10 CONTAINS ]
MAILFROM 10 CONTAINS {
MAILFROM 10 CONTAINS }
MAILFROM 10 CONTAINS \
MAILFROM 10 CONTAINS |
MAILFROM 10 CONTAINS ;
MAILFROM 10 CONTAINS :
MAILFROM 10 CONTAINS '
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS ,
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS /
MAILFROM 10 CONTAINS ?
MAILFROM 10 ENDSWITH 0
MAILFROM 10 ENDSWITH 1
MAILFROM 10 ENDSWITH 2
MAILFROM 10 ENDSWITH 3
MAILFROM 10 ENDSWITH 4
MAILFROM 10 ENDSWITH 5
MAILFROM 10 ENDSWITH 6
MAILFROM 10 ENDSWITH 7
MAILFROM 10 ENDSWITH 8
MAILFROM 10 ENDSWITH 9
and slightly modified versions in my rdns and helo filter files.
Bill
- Original Message -
From: Joshua Levitsky [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, July 21, 2003 6:10 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
From: Omar K. [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Date: Mon, 21 Jul 2003 15:38:52 +0200
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Legitimate email syntax?
Nevertheless, I think having a test that would look at invalid, or like
this
case, rarely used format in a weighted environment with a low
appropriate
weight would help in reducing spam.
Sounds like something you could put in a filter file
MAILFROM 10 STARTSWITH *@
No? I make filters with stuff like that all the time now. I never did the
filters because I thought they were too much work, but now that I have
made
a DNS filter, and a content filter I am catching MUCH more spam because I
give weight to things that have words that are commonly in spam subjects
and
bodies and such, and in my DNS filter I check for things like servers
claiming to be my server's IP or name. Filters are very cool.
-Josh
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] Legitimate email syntax?
sorry for the dumb question ...being kinda new at this... how would i
implement this filter??
thanks
Sheldon
- Original Message -
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, July 21, 2003 8:47 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
Yep, this is what I have in my mailfrom filter file:
MAILFROM 10 CONTAINS `
MAILFROM 10 CONTAINS ~
MAILFROM 10 CONTAINS !
MAILFROM 10 CONTAINS #
MAILFROM 10 CONTAINS $
MAILFROM 10 CONTAINS %
MAILFROM 10 CONTAINS ^
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS *
MAILFROM 10 CONTAINS (
MAILFROM 10 CONTAINS )
MAILFROM 05 CONTAINS =
MAILFROM 10 CONTAINS +
MAILFROM 10 CONTAINS [
MAILFROM 10 CONTAINS ]
MAILFROM 10 CONTAINS {
MAILFROM 10 CONTAINS }
MAILFROM 10 CONTAINS \
MAILFROM 10 CONTAINS |
MAILFROM 10 CONTAINS ;
MAILFROM 10 CONTAINS :
MAILFROM 10 CONTAINS '
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS ,
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS /
MAILFROM 10 CONTAINS ?
MAILFROM 10 ENDSWITH 0
MAILFROM 10 ENDSWITH 1
MAILFROM 10 ENDSWITH 2
MAILFROM 10 ENDSWITH 3
MAILFROM 10 ENDSWITH 4
MAILFROM 10 ENDSWITH 5
MAILFROM 10 ENDSWITH 6
MAILFROM 10 ENDSWITH 7
MAILFROM 10 ENDSWITH 8
MAILFROM 10 ENDSWITH 9
and slightly modified versions in my rdns and helo filter files.
Bill
- Original Message -
From: Joshua Levitsky [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, July 21, 2003 6:10 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
From: Omar K. [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Date: Mon, 21 Jul 2003 15:38:52 +0200
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Legitimate email syntax?
Nevertheless, I think having a test that would look at invalid, or
like
this
case, rarely used format in a weighted environment with a low
appropriate
weight would help in reducing spam.
Sounds like something you could put in a filter file
MAILFROM 10 STARTSWITH *@
No? I make filters with stuff like that all the time now. I never did
the
filters because I thought they were too much work, but now that I have
made
a DNS filter, and a content filter I am catching MUCH more spam because
I
give weight to things that have words that are commonly in spam subjects
and
bodies and such, and in my DNS filter I check for things like servers
claiming to be my server's IP or name. Filters are very cool.
-Josh
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelist (was OT: National Do Not Call Registry)
There are ways to get around the limitation though -- we are investigating to see if there is a good way that we can do so. I certainly hope so! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Legitimate email syntax?
Another 2 cents. Kami, on your prompting I looked back 4 days and saw that we'd received 34 messages that were in the format [EMAIL PROTECTED]; most of those domain names were perfectly legitimate... and faked. I found that each one of the messages had heavily triggered other tests and were all held. What's true today, though, isn't true tomorrow. I'm going to add in a new test as per Joshua's suggestion, but I wanted to point out a caveat to others, which is to NOT look for an asterisk somewhere in the MAILFROM field, just check for the left hand side; in the same 4 day period we had 313 messages that were mailing lists (mostly legitimate) where the MAILFROM is rather different from the from: in the header, e.g. [EMAIL PROTECTED] (where [EMAIL PROTECTED] was a valid subscriber to this mailing list) In short, don't get carried away while filtering for asterisks. Andrew 8) -Original Message- From: Joshua Levitsky [mailto:[EMAIL PROTECTED] Sent: Monday, July 21, 2003 6:10 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Legitimate email syntax? Sounds like something you could put in a filter file MAILFROM 10 STARTSWITH *@ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ORDB problem, slightly off topic
Glenn, When I click on that link it says... - This host is not listed in ORDB as an open mail relay - So what's the problem? Dan - Original Message - From: Glenn Brooks To: [EMAIL PROTECTED] Sent: Friday, July 18, 2003 9:00 PM Subject: [Declude.JunkMail] ORDB problem, slightly off topic We got listed on the ORDB database as a mail relay...everywhere I test mail relay, it says we are not running a relay. When looking at the logs...it appears ORDB can get my mail server to mail to their email address of [EMAIL PROTECTED] from my [EMAIL PROTECTED]you can see the report at: http://ordb.org/lookup/?host=216.165.193.28I can not for the life of me block this action for retesting by ORDBI have had ORDB retest 5 times...and it still goes through.anyone have any suggestions Glenn BrooksWebWize, Inc.713-688-4382http://www.webwize.com
Re: [Declude.JunkMail] Legitimate email syntax?
I believe that the filter feature is only available in the JunkMail Pro
version. If you are running PRO, then you can find out more about how to
implement this feature from the Declude JunkMail manual site at:
http://www.declude.com/junkmail/manual.htm
If you still have specific questions after reviewing the Filtering section
of the manual, post them to the list and I sure we can help you out.
Bill
- Original Message -
From: Webmaster Oilfield Directory [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, July 21, 2003 10:08 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
sorry for the dumb question ...being kinda new at this... how would i
implement this filter??
thanks
Sheldon
- Original Message -
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, July 21, 2003 8:47 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
Yep, this is what I have in my mailfrom filter file:
MAILFROM 10 CONTAINS `
MAILFROM 10 CONTAINS ~
MAILFROM 10 CONTAINS !
MAILFROM 10 CONTAINS #
MAILFROM 10 CONTAINS $
MAILFROM 10 CONTAINS %
MAILFROM 10 CONTAINS ^
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS *
MAILFROM 10 CONTAINS (
MAILFROM 10 CONTAINS )
MAILFROM 05 CONTAINS =
MAILFROM 10 CONTAINS +
MAILFROM 10 CONTAINS [
MAILFROM 10 CONTAINS ]
MAILFROM 10 CONTAINS {
MAILFROM 10 CONTAINS }
MAILFROM 10 CONTAINS \
MAILFROM 10 CONTAINS |
MAILFROM 10 CONTAINS ;
MAILFROM 10 CONTAINS :
MAILFROM 10 CONTAINS '
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS ,
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS
MAILFROM 10 CONTAINS /
MAILFROM 10 CONTAINS ?
MAILFROM 10 ENDSWITH 0
MAILFROM 10 ENDSWITH 1
MAILFROM 10 ENDSWITH 2
MAILFROM 10 ENDSWITH 3
MAILFROM 10 ENDSWITH 4
MAILFROM 10 ENDSWITH 5
MAILFROM 10 ENDSWITH 6
MAILFROM 10 ENDSWITH 7
MAILFROM 10 ENDSWITH 8
MAILFROM 10 ENDSWITH 9
and slightly modified versions in my rdns and helo filter files.
Bill
- Original Message -
From: Joshua Levitsky [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, July 21, 2003 6:10 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
From: Omar K. [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Date: Mon, 21 Jul 2003 15:38:52 +0200
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Legitimate email syntax?
Nevertheless, I think having a test that would look at invalid, or
like
this
case, rarely used format in a weighted environment with a low
appropriate
weight would help in reducing spam.
Sounds like something you could put in a filter file
MAILFROM 10 STARTSWITH *@
No? I make filters with stuff like that all the time now. I never did
the
filters because I thought they were too much work, but now that I have
made
a DNS filter, and a content filter I am catching MUCH more spam
because
I
give weight to things that have words that are commonly in spam
subjects
and
bodies and such, and in my DNS filter I check for things like servers
claiming to be my server's IP or name. Filters are very cool.
-Josh
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
I've seen that most of the spam emails, regardless of the weight, seem to fail the SPAMHEADERS, BADHEADERS, and IPNOTINMX tests. Question: do you guys HOLD email based on any of these three tests? If so, how is this done? Is this a smart approach? The SPAMHEADERS test will catch quite a bit of legitimate E-mail (mostly solicited E-mail, such as orders and bulk E-mail from companies you have done business with, as opposed to individual person-to-person E-mail), mostly because of all the web mailers that were written by web developers rather than purchased or written by web programmers. The IPNOTINMX test shouldn't be used to block E-mail, as it is one of the few tests that it is OK for a legitimate mailserver to fail. This is often the case with larger domains, where there are separate mailservers for incoming vs. outgoing E-mail. The BADHEADERS test, though, now catches about 50% of all spam, and will never catch any legitimate E-mail (unless it is sent from a broken mail client that needs to be fixed, and where you might not have received the E-mail anyways). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ORDB problem, slightly off topic
I got it fixedwe are not in their database any longer At 12:14 PM 7/21/2003 -0400, you wrote: Glenn, When I click on that link it says... - This host is not listed in ORDB as an open mail relay - So what's the problem? Dan - Original Message - From: Glenn Brooks To: [EMAIL PROTECTED] Sent: Friday, July 18, 2003 9:00 PM Subject: [Declude.JunkMail] ORDB problem, slightly off topic We got listed on the ORDB database as a mail relay...everywhere I test mail relay, it says we are not running a relay. When looking at the logs...it appears ORDB can get my mail server to mail to their email address of [EMAIL PROTECTED] from my [EMAIL PROTECTED] you can see the report at: http://ordb.org/lookup/?host=216.165.193.28 I can not for the life of me block this action for retesting by ORDBI have had ORDB retest 5 times...and it still goes through.. ...anyone have any suggestions Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com
[Declude.JunkMail] X-Note: Number Recipient(s): 2?
All messages show the following headers (intentional): X-Note: Number Recipient(s): 2 X-Note: Recipient(s): [EMAIL PROTECTED] But the curious item is why does it show 2 recipients? We do use the Copy All account from time to time. Is this what it is picking up on, and just not showing? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] X-Note: Number Recipient(s): 2?
All messages show the following headers (intentional): X-Note: Number Recipient(s): 2 X-Note: Recipient(s): [EMAIL PROTECTED] But the curious item is why does it show 2 recipients? We do use the Copy All account from time to time. Is this what it is picking up on, and just not showing? That's correct. IMail tells Declude JunkMail that there are 2 recipients when the Copy All account is used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Great, thanks for the detailed explanation. I would like to HOLD all mail that fails the BADHEADERS test, then. How do I go about doing this? Thanks again -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, July 21, 2003 12:40 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question I've seen that most of the spam emails, regardless of the weight, seem to fail the SPAMHEADERS, BADHEADERS, and IPNOTINMX tests. Question: do you guys HOLD email based on any of these three tests? If so, how is this done? Is this a smart approach? The SPAMHEADERS test will catch quite a bit of legitimate E-mail (mostly solicited E-mail, such as orders and bulk E-mail from companies you have done business with, as opposed to individual person-to-person E-mail), mostly because of all the web mailers that were written by web developers rather than purchased or written by web programmers. The IPNOTINMX test shouldn't be used to block E-mail, as it is one of the few tests that it is OK for a legitimate mailserver to fail. This is often the case with larger domains, where there are separate mailservers for incoming vs. outgoing E-mail. The BADHEADERS test, though, now catches about 50% of all spam, and will never catch any legitimate E-mail (unless it is sent from a broken mail client that needs to be fixed, and where you might not have received the E-mail anyways). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
I would like to HOLD all mail that fails the BADHEADERS test, then. How do I go about doing this? To do that, you can change the BADHEADERS WARN line in your \Imail\Declude\$default$.JunkMail file can to BADHEADERS HOLD. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Thanks. One last question, since certain email addresses are more likely to receive more spam than others, is it possible to apply different tests/actions based on the TO address? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, July 21, 2003 1:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question I would like to HOLD all mail that fails the BADHEADERS test, then. How do I go about doing this? To do that, you can change the BADHEADERS WARN line in your \Imail\Declude\$default$.JunkMail file can to BADHEADERS HOLD. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
Thanks. One last question, since certain email addresses are more likely to receive more spam than others, is it possible to apply different tests/actions based on the TO address? Yes (with Declude JunkMail Pro). You can either use per-user configurations to do that, or you can set up a filter that filters on ALLRECIPS (a list of the recipients). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base?
Hello, All, I am considering creating a Declude JunkMail Knowledge Base or at the very minimum some sort of Frequently Answered Questions document. I was curious to know if there are any equivalent documents or resources in existence, perhaps that I've not come across, that would cover the type of information that would be contained within a KB or FAQ. Also, do the power that be at Horizons have any issues with me making a resource of this type? Do any of the subscribers to this list think that this would be a good idea? Initially I'm thinking of creating something which just covers the basics and work my way out from there. Thanks for your feedback! Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base?
I have had the intent but not the time. I am willing to host it. In fact, I already have it set up just need the documents to include. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, July 21, 2003 1:19 PM To: Declude JunkMail Subject: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base? Hello, All, I am considering creating a Declude JunkMail Knowledge Base or at the very minimum some sort of Frequently Answered Questions document. I was curious to know if there are any equivalent documents or resources in existence, perhaps that I've not come across, that would cover the type of information that would be contained within a KB or FAQ. Also, do the power that be at Horizons have any issues with me making a resource of this type? Do any of the subscribers to this list think that this would be a good idea? Initially I'm thinking of creating something which just covers the basics and work my way out from there. Thanks for your feedback! Dan Geiser [EMAIL PROTECTED] === = This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Practices question
A fairly large number of large companies have email systems that fail badheaders -- holding on it brought daily FP's here. We use a weight on BADHEADERS instead and then a negative weight (WHITELST filter below) on known mail servers with problems. From today's samples: Received: from l-qmqp3.marketwatchmail.com [63.240.173.125] by OURDOMAIN.COM (SMTPD32-7.15) id A181222017A; Mon, 21 Jul 2003 16:48:01 -0400 Received: (qmail 23921 invoked from network); 21 Jul 2003 20:37:35 - Received: from unknown (10.10.220.86) by l-qmqp3.marketwatchmail.com with QMQP; 21 Jul 2003 20:37:35 - Mailing-List: contact [EMAIL PROTECTED] Precedence: bulk X-No-Archive: yes List-Help: mailto:[EMAIL PROTECTED] List-Unsubscribe: mailto:[EMAIL PROTECTED] List-Subscribe: mailto:[EMAIL PROTECTED] From: CBS MarketWatch [EMAIL PROTECTED] To: [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] Delivered-To: moderator for [EMAIL PROTECTED] Received: (qmail 14389 invoked from network); 21 Jul 2003 20:28:35 - Date: Mon, 21 Jul 2003 20:26:03 (GMT) X-MSMail-Priority: Normal X-mailer: AspMail 3.53 (SMTP546388) Subject: Personal Finance Daily: July 21, 2003 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: [EMAIL PROTECTED] X-RBL-Warning: WHITELST: Message failed WHITELST test (109) X-RBL-Warning: SPAMDOMAINS: Spamdomain 'OURDOMAIN.COM' found: Address of [EMAIL PROTECTED] com sent from invalid 125.173.240.63.in-addr.arpa. X-RBL-Warning: SPAMTEXT: Message failed SPAMTEXT test (15) X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c040020e]. X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c040020e]. X-RBL-Warning: BFROM: RETURN2 X-Declude-Sender: [EMAIL PROTECTED] com [63.240.173.125] X-Declude-Spoolname: D51810222017aaade.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Declude: Version 1.70i14; D51810222017aaade.SMD X-Declude: Failed WHITELST, SPAMDOMAINS, SPAMTEXT, IPNOTINMX, SPAMHEADERS, BADHEADERS, BFROM [-65] X-Note: This E-mail was sent from 125.173.240.63.in-addr.arpa ([63.240.173.125]). X-Countries: UNITED STATES-destination Return-Path: [EMAIL PROTECTED] .com X-Note: - Total spam weight of this E-mail is -65. X-Spam-Prob: 0.922557 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 300602461 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jose Gosende Sent: Monday, July 21, 2003 1:31 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question Great, thanks for the detailed explanation. I would like to HOLD all mail that fails the BADHEADERS test, then. How do I go about doing this? Thanks again -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, July 21, 2003 12:40 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Best Practices question I've seen that most of the spam emails, regardless of the weight, seem to fail the SPAMHEADERS, BADHEADERS, and IPNOTINMX tests. Question: do you guys HOLD email based on any of these three tests? If so, how is this done? Is this a smart approach? The SPAMHEADERS test will catch quite a bit of legitimate E-mail (mostly solicited E-mail, such as orders and bulk E-mail from companies you have done business with, as opposed to individual person-to-person E-mail), mostly because of all the web mailers that were written by web developers rather than purchased or written by web programmers. The IPNOTINMX test shouldn't be used to block E-mail, as it is one of the few tests that it is OK for a legitimate mailserver to fail. This is often the case with larger domains, where there are separate mailservers for incoming vs. outgoing E-mail. The BADHEADERS test, though, now catches about 50% of all spam, and will never catch any legitimate E-mail (unless it is sent from a broken mail client that needs to be fixed, and where you might not have received the E-mail anyways). --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base?
Don, I think that would be a great idea and hopefully Scott will bless the effort. Bill - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude JunkMail [EMAIL PROTECTED] Sent: Monday, July 21, 2003 1:19 PM Subject: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base? Hello, All, I am considering creating a Declude JunkMail Knowledge Base or at the very minimum some sort of Frequently Answered Questions document. I was curious to know if there are any equivalent documents or resources in existence, perhaps that I've not come across, that would cover the type of information that would be contained within a KB or FAQ. Also, do the power that be at Horizons have any issues with me making a resource of this type? Do any of the subscribers to this list think that this would be a good idea? Initially I'm thinking of creating something which just covers the basics and work my way out from there. Thanks for your feedback! Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Does Spam Domains Accept 3rd-Level Domains?
Hello, All, Does anyone know if the SPAMDOMAINS accepts 3rd-level domains in the domains text file, e.g. us.buy.com? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Does Spam Domains Accept 3rd-LevelDomains?
Does anyone know if the SPAMDOMAINS accepts 3rd-level domains in the domains text file, e.g. us.buy.com? Yes, it will. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge Base?
I am considering creating a Declude JunkMail Knowledge Base or at the very minimum some sort of Frequently Answered Questions document. I was curious to know if there are any equivalent documents or resources in existence, perhaps that I've not come across, that would cover the type of information that would be contained within a KB or FAQ. Also, do the power that be at Horizons have any issues with me making a resource of this type? This is a very good idea -- and one we have no problem with. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Yahoo Groups.
Hi , I dont know if anyone else has made a suggestion like this. Do you think that we can move the declude list to yahoo for the following reasons. People can put their config files and share it with others, we can use the database feature. Using the bookmarks ,we can put the link to some interesting web pages , etc. The final decision belong to Scott of course. Regards Rifat Levis --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Yahoo Groups.
Monday, July 21, 2003 you wrote: RL Do you think that we can move the declude list to yahoo for the following I hope not. It is torture - at best. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Yahoo Groups.
- Original Message - From: Rifat Levis [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 21, 2003 8:17 PM Subject: [Declude.JunkMail] Yahoo Groups. People can put their config files and share it with others, we can use the database feature. Using the bookmarks ,we can put the link to some interesting web pages , What about a WikiWeb kind of thing? Then we could all easily contribute to documentation in an easy to read and change fassion. Would be better than a Yahoo group because with Yahoo groups you upload files and with WikiWeb we can build a whole web of knowledge. Much more potential. I would contribute tons to something like that. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Yahoo Groups.
RL Do you think that we can move the Declude list to yahoo for the following I veto (if I had that authority) any such idea or move. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Yahoo Groups.
This is an attempt at Monday humor right? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain - Original Message - From: Rifat Levis [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 21, 2003 5:17 PM Subject: [Declude.JunkMail] Yahoo Groups. Hi , I dont know if anyone else has made a suggestion like this. Do you think that we can move the declude list to yahoo for the following reasons. People can put their config files and share it with others, we can use the database feature. Using the bookmarks ,we can put the link to some interesting web pages , etc. The final decision belong to Scott of course. Regards Rifat Levis --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Faking valid Email Addresses
Instead of whitelisting your domain, whitelist your IMail server's IP address (or IP addresses), it's much harder to spoof those: WHITELIST IP xxx.xxx.xxx.xxx or WHITELIST IP xxx.xxx.xxx.0/24 Also, I don't think that the WHITELIST REVDNS kendra.com is your problem here, since the connecting mail server's IP address, 213.182.166.7, does not resolve via RDNS to kendra.com. Are you sure that you do not have something like the following in your global.cfg file: WHITELIST FROM @kendra.com or WHITELIST TODOMAIN @kendra.com If so, that would be your problem. You will need to parse your log file for this message to see exactly why this message was actually whitelisted. Bill - Original Message - From: Rich [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 21, 2003 7:17 PM Subject: [Declude.JunkMail] Faking valid Email Addresses I've got a problem with spam that fakes our Email address in the header, example below... Received: from kendra.com [213.182.166.7] by kendra.com (SMTPD32-6.06) id AEA89090136; Mon, 21 Jul 2003 14:44:08 -0700 From: jenna knowly [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Take advantage of lower interest rates Mime-Version: 1.0 Content-Type: text/html; charset=ISO-8859-1 Date: Âò, 22 èþë 2003 01:45:08 -0600 Content-Transfer-Encoding: 8bit Abuse-Tracking: Y21Ob1lXNWtiR1Z5UUd0bGJtUnlZUzVqYjIwPQ== Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [213.182.166.7] X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was sent from [No Reverse DNS] ([213.182.166.7]). X-Spam-Prob: 1.00 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-Mozilla-Status: 8001 X-Mozilla-Status2: X-UIDL: 332149997 It uses the intended To: address as the from address, I've got WHITELIST REVDNS kendra.com in global.cfg. Any ideas, I've been searching the archives for a similar problem. Rich -- Rich Griebel [EMAIL PROTECTED] http://www.kendra.com Scanned for Viruses using Declude and F-Prot --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Customising User Interface
Hi, I am in the process of creating a web based user interface allowing users to customise the actions that Junkmail will do when an email fails certain weightings. The only problem I am having is creating individual cfg files that they can create for their own blacklists or filters. The Global cfg file defines the test however I can't see how I can personalize the filters. Any ideas? _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
