Re: Re[4]: [Declude.JunkMail] SPAMD external program
On 6 Feb 2005 at 21:13, Sanford Whiteman wrote: Declude, for example, runs in the SYSTEM context by default, and makes outbound connections galore. Well this is good news. And thanks for all the other explanations. I still do not have it working remotely so I am back to local for spamd. This week I will work further to resolve this. [I had to go back local. I really missed my SpamAssassin . Not having SA I felt the same pain as when my kubota had a flat tire..] .-Nick --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download /release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases /download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/dow nload/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT - Outsourcing email
Danny, You can reply to me offlist Sincerely, Randy Armbrecht Global Web SolutionsR, Inc. 804-346-5300 ext. 1 877-800-GLOBAL (4562) ext. 1 http://globalweb.net Richmond's Internet Source since 1996! WEB HOSTING including EMAIL beginning at $29/month! DSL Starting at $39.95.month! Non-Profits - receive a 25% discount on most services! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Danny Sent: Friday, February 04, 2005 5:42 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT - Outsourcing email Can anyone recommend any email outsourcing companies other then everyone.net? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Legit message failing COMMENTS test.
Hello, All, I have an issue where a legit e-mail is failing the COMMENTS test. According to the comments test description... The COMMENTS test will catch spam that uses HTML comments to bypass filters. It is a very effective test, since it will not catch standard comments that occasionally appear in legitimate bulk mail; it only catches comments that are designed to bypass filters. so I don't understand why, if that description is accurate, that it is failing because there's no way in heck this customer would be trying to bypass any filters. In fact this isn't even a bulk mail message. It's handwritten. How can I tell what part of the message is failing the COMMENTS test? Thanks, In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Legit message failing COMMENTS test.
Wow, a hand written e-mail? I would submit the message (D file if possible) and a log snipped to Declude for review. Was the e-mail in HTML formatting? Was there a e-mail signature attached? Any links in the e-mail? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, February 07, 2005 12:21 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Legit message failing COMMENTS test. Hello, All, I have an issue where a legit e-mail is failing the COMMENTS test. According to the comments test description... The COMMENTS test will catch spam that uses HTML comments to bypass filters. It is a very effective test, since it will not catch standard comments that occasionally appear in legitimate bulk mail; it only catches comments that are designed to bypass filters. so I don't understand why, if that description is accurate, that it is failing because there's no way in heck this customer would be trying to bypass any filters. In fact this isn't even a bulk mail message. It's handwritten. How can I tell what part of the message is failing the COMMENTS test? Thanks, In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] BOUNCEONLYIFYOUMUST is looping on a gateway
Our internal users send mail to a partner domain, but they commonly misspell that domain and send the mail to a valid domain that is a completely different party. Since we have no reason to send mail to that completely different party, I wrote a Declude JunkMail Pro filter that checked for that domain, and gives a BOUNCEONLYIFYOUMUST action; the .eml template explains that the sender has likely specified the wrong domain, and encloses their original message. (Side information: but we have outbound mail from our Exchange servers handled by IIS SMTP, so to get Declude back into the loop, my internal DNS has a dummy zone for this 3rd party's domain and MX record pointing to the internal address of my Declude server; the Declude server is a gateway with no mailboxes). The filter works, the action works, and the bounce message is generated. But the resulting file is a .GSC file that is read at every queue run, and fails to deliver the message. The Q*.GSC file looks like this: QD:\IMail\spool\Dc93d0b746832.GSC Hbentall.com Ic94d0470a4de T6 E0, S[EMAIL PROTECTED] V0 [EMAIL PROTECTED] N[EMAIL PROTECTED] R[EMAIL PROTECTED] the mailfrom is [EMAIL PROTECTED] and the destination is the sender, [EMAIL PROTECTED] ... the part that I'm guessing is wrong is the H line... according to Ipswitch, this has to be an IMail server, but I note that this is the entry in my hosts. file to direct IMail to gateway mail for this domain to my internal server. Following that hunch, I tried to butt in and changed that line to the DNS name of this host, mail.bentall.com and re-tried delivery... nope. I tried to change it to my NetBIOS name of this host and re-tried delivery... nope. A little help here? This used to work under v1.79i16, but I'm now at 1.82 Andrew. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Legit message failing COMMENTS test.
In January, I had 97 spam hits and 28 ham hits on Comments before I finally coded it out as not effective enough to use. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 2:20 PM Subject: [Declude.JunkMail] Legit message failing COMMENTS test. Hello, All, I have an issue where a legit e-mail is failing the COMMENTS test. According to the comments test description... The COMMENTS test will catch spam that uses HTML comments to bypass filters. It is a very effective test, since it will not catch standard comments that occasionally appear in legitimate bulk mail; it only catches comments that are designed to bypass filters. so I don't understand why, if that description is accurate, that it is failing because there's no way in heck this customer would be trying to bypass any filters. In fact this isn't even a bulk mail message. It's handwritten. How can I tell what part of the message is failing the COMMENTS test? Thanks, In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BOUNCEONLYIFYOUMUST is looping on a gateway
Andrew, IMail made a change so that E-mail would be forwarded to inline apps somewhere in the last few revisions. This is causing the message to be re-scanned by Declude after being generated (I believe), and would explain why it formerly worked. You might search the archives for a filter that I cobbed together called WHITELIST-GSE (note the spelling) for at least some pointers on how to whitelist internally generated E-mail. It can be easily modified to suit your needs if necessary. Matt Colbeck, Andrew wrote: Our internal users send mail to a partner domain, but they commonly misspell that domain and send the mail to a valid domain that is a completely different party. Since we have no reason to send mail to that completely different party, I wrote a Declude JunkMail Pro filter that checked for that domain, and gives a BOUNCEONLYIFYOUMUST action; the .eml template explains that the sender has likely specified the wrong domain, and encloses their original message. (Side information: but we have outbound mail from our Exchange servers handled by IIS SMTP, so to get Declude back into the loop, my internal DNS has a dummy zone for this 3rd party's domain and MX record pointing to the internal address of my Declude server; the Declude server is a gateway with no mailboxes). The filter works, the action works, and the bounce message is generated. But the resulting file is a .GSC file that is read at every queue run, and fails to deliver the message. The Q*.GSC file looks like this: QD:\IMail\spool\Dc93d0b746832.GSC Hbentall.com Ic94d0470a4de T6 E0, S[EMAIL PROTECTED] V0 [EMAIL PROTECTED] N[EMAIL PROTECTED] R[EMAIL PROTECTED] the mailfrom is [EMAIL PROTECTED] and the destination is the sender, [EMAIL PROTECTED] ... the part that I'm guessing is wrong is the H line... according to Ipswitch, this has to be an IMail server, but I note that this is the entry in my hosts. file to direct IMail to gateway mail for this domain to my internal server. Following that hunch, I tried to butt in and changed that line to the DNS name of this host, mail.bentall.com and re-tried delivery... nope. I tried to change it to my NetBIOS name of this host and re-tried delivery... nope. A little help here? This used to work under v1.79i16, but I'm now at 1.82 Andrew. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Legit message failing COMMENTS test.
Hi Scott: While Comment may not be an effective measure alone it is definitely a good indicator in a combo test. We have a combo test that incorporates the following plus several more in a series of test before releasing the email. TESTSFAILED 2 CONTAINS[NOLEGITCONTENT] TESTSFAILED 1 CONTAINS[SUBJECTSPACES] TESTSFAILED 1 CONTAINS[LONGSUBJ] TESTSFAILED 1 CONTAINS[COMMENTS] The above is simply part of a larger combo test that requires a weight of 6 to fail and it is quite effective.. Just a note since I don't think while not a single test should be considered a great indicator it could be a great tool in a combo test. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Monday, February 07, 2005 3:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Legit message failing COMMENTS test. In January, I had 97 spam hits and 28 ham hits on Comments before I finally coded it out as not effective enough to use. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 2:20 PM Subject: [Declude.JunkMail] Legit message failing COMMENTS test. Hello, All, I have an issue where a legit e-mail is failing the COMMENTS test. According to the comments test description... The COMMENTS test will catch spam that uses HTML comments to bypass filters. It is a very effective test, since it will not catch standard comments that occasionally appear in legitimate bulk mail; it only catches comments that are designed to bypass filters. so I don't understand why, if that description is accurate, that it is failing because there's no way in heck this customer would be trying to bypass any filters. In fact this isn't even a bulk mail message. It's handwritten. How can I tell what part of the message is failing the COMMENTS test? Thanks, In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam tests by months
I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Someexamples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005.
[Declude.JunkMail] OT-Microsoft Exchange Tools
Good afternoon- I was curious for those people using Microsoft Exchange if they had any neat tools for monitoring and management of your Exchange server. Looking for anything, hopefully to tell me about my resource utilization, top users, top hosts, normal things that are useful in using. Would appreciate any information if you are using something and it is working well for you. Haven't begun looking, so I thought I would ask before I re-invent the search for a good tool. Thanks for any information. -- Tim Buenz Director of Technology Jefferson-Scranton Comm. Schools 204 W. Madison Street Jefferson, IA 50129 (515)386-9256 Fax (515)386-3591 http://www.jefferson-scranton.k12.ia.us ...if we teach today's students as we taught yesterday's, we rob them of tomorrow. John Dewey --- [This E-mail Scanned For Viruses By Declude Virus Scanner] [This E-mail Scanned For Spam By Declude JunkMail] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
My weighting system is this: 100 No action (27.7% of all mail in Jan 2005) 100 Subject tag (.5% of all mail) (1/3 of this weight range tend to be spam) 200 Hold (.5% of all mail) (I average 1 a month of Ham in hold) 300 Delete (71.3% of all mail) As I have to draw a line somewhere, I drew the line at 200. Everything held or deleted is considered spam. Everything under 200 is considered ham, I think this is fairly conservative. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:06 PM Subject: Re: [Declude.JunkMail] Spam tests by months Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMD external program
Hi John, yep just pluggin' away here trying to save the world from blasted spam! John Tolmachoff (Lists) wrote: Why Hello Brian. Long time no see/hear/talk. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of SpamManager Sent: Saturday, February 05, 2005 4:41 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SPAMD external program Declude processes are created by an Imail service application. I assume it is the SMTP service, but can't remember for sure. By default all services are created under the SYSTEM account. The system account has no access rights to other machines. You need to change the service to Log on as: to an administrator account that has permissions to access the other machine.Unless there are some gotchas with Imail I am not aware of when doing this, this will probably resolve your problem. Nick wrote: Declude Scott - or anyone else.. I am having difficulty getting an external program to run within DJMP. What I am trying to do is to poll SPAMD on a box other than the one Declude is running on. From a command prompt on the declude box the external programs work fine. But from within Declude nada. Example - this works fine from from dos e:\spamc\winspamc.exe -d 12.152.254.xx -c sample.txt here is the command in DJM that fails: EXTERNAL.WINSPAMC external nonzero e:\spamc\winspamc.exe -d 12.152.254.xx -c 5 0 In the logs the program does run but always returns a '99' (fail) This fails with Sandy's spamc32.exe as well - which started all this... [And all works fine if all runs on the same box] Is this a permissions issue or otherwise can you give me any ideas to how to solve this? Thanks! -Nick Hayer --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
No, I mean what does Ham mean? Does Ham mean legit e-mail? Or is that like mail from BulkSenders which some people might consider Spam and some might consider legit? - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 5:32 PM Subject: Re: [Declude.JunkMail] Spam tests by months My weighting system is this: 100 No action (27.7% of all mail in Jan 2005) 100 Subject tag (.5% of all mail) (1/3 of this weight range tend to be spam) 200 Hold (.5% of all mail) (I average 1 a month of Ham in hold) 300 Delete (71.3% of all mail) As I have to draw a line somewhere, I drew the line at 200. Everything held or deleted is considered spam. Everything under 200 is considered ham, I think this is fairly conservative. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:06 PM Subject: Re: [Declude.JunkMail] Spam tests by months Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BOUNCEONLYIFYOUMUST is looping on a gateway
I solved the bounce problem. Turning on extra logging on my sysMMDD.txt showed what was going wrong - IMail was identifying itself in the HELO as just the domain name, which my Exchange server didn't like and gave a 501 error; Imail simply upped the retry count and queued the file up again. I changed the definition of the mailfrom line in my .eml file to follow the example files, i.e. [EMAIL PROTECTED] and the HELO was then sent in the host dot domain dot com format, instead of just the domain. It's not ideal, because in a gateway scenario such as mine, [EMAIL PROTECTED] is a bogus mailbox, nobody will see the contents. I tried adding a reply-to: line in the .eml file but it was ignored. I think I'll have to add yet another layer by setting up a rule on that mailbox on my IMail gateway to forward mail to a valid mailbox on the internal network... Andrew 8( -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, February 07, 2005 12:51 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] BOUNCEONLYIFYOUMUST is looping on a gateway Our internal users send mail to a partner domain, but they commonly misspell that domain and send the mail to a valid domain that is a completely different party. Since we have no reason to send mail to that completely different party, I wrote a Declude JunkMail Pro filter that checked for that domain, and gives a BOUNCEONLYIFYOUMUST action; the .eml template explains that the sender has likely specified the wrong domain, and encloses their original message. (Side information: but we have outbound mail from our Exchange servers handled by IIS SMTP, so to get Declude back into the loop, my internal DNS has a dummy zone for this 3rd party's domain and MX record pointing to the internal address of my Declude server; the Declude server is a gateway with no mailboxes). The filter works, the action works, and the bounce message is generated. But the resulting file is a .GSC file that is read at every queue run, and fails to deliver the message. The Q*.GSC file looks like this: QD:\IMail\spool\Dc93d0b746832.GSC Hbentall.com Ic94d0470a4de T6 E0, S[EMAIL PROTECTED] V0 [EMAIL PROTECTED] N[EMAIL PROTECTED] R[EMAIL PROTECTED] the mailfrom is [EMAIL PROTECTED] and the destination is the sender, [EMAIL PROTECTED] ... the part that I'm guessing is wrong is the H line... according to Ipswitch, this has to be an IMail server, but I note that this is the entry in my hosts. file to direct IMail to gateway mail for this domain to my internal server. Following that hunch, I tried to butt in and changed that line to the DNS name of this host, mail.bentall.com and re-tried delivery... nope. I tried to change it to my NetBIOS name of this host and re-tried delivery... nope. A little help here? This used to work under v1.79i16, but I'm now at 1.82 Andrew. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] inserting Sniffer log info into header
Hello All, Has anyone successfully been able to insert the Sniffer log entry into the email headers using Declude? Apparently Sniffer has the option to turn on a .xhdr file creation for each message which can then be inserted into the message header. Any help on this would be much appreciated to make Sniffer FPs easier to report. http://www.sortmonster.com/MessageSniffer/NewsUpdates.html * X-Header File option is now available by modifying the .cfg file. This produces a .xhdr file for each message processed. The file contains the x-headers that Message Sniffer would add to the message so that they can be picked up by compatible software and/or scripting (such as on *nix systems) and added to the message or interpreted for greater detail. The headers stubs are configurable and come in two forms that can be used together or separately. One header shows the final result of the scan. The other shows all of the pattern matches that were identified. These headers can be extremely valuable when processing false positives since they travel along with the message - (no more hunting for log file snips). --- The software calling Message Sniffer is responsible for deleting the .xhdr file once it has been used! Thanks, David
RE: [Declude.JunkMail] inserting Sniffer log info into header
Title: Message Interesting sounds like someone would have to write an External Filter. Unless Declude is willing to "integrate" this in their Sniffer support. When you turn this one - where do this XHDR files appear? In the regular "spool" folder together with the queue and data file? If so, one could probably write a command script to insert the content of the XHDR file into the message file and then delete the XHDR? Best RegardsAndy -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of DavidSent: Monday, February 07, 2005 06:54 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] inserting Sniffer log info into header Hello All, Has anyone successfully been able to insert the Sniffer log entry into the email headers using Declude? Apparently Sniffer has the option to turn on a .xhdr file creation for each message which can then be inserted into the message header. Any help on this would be much appreciated to make Sniffer FPs easier to report. http://www.sortmonster.com/MessageSniffer/NewsUpdates.html * X-Header File option is now available by modifying the .cfg file. This produces a .xhdr file for each message processed. The file contains the x-headers that Message Sniffer would add to the message so that they can be picked up by compatible software and/or scripting (such as on *nix systems) and added to the message or interpreted for greater detail. The headers stubs are configurable and come in two forms that can be used together or separately. One header shows the final result of the scan. The other shows all of the pattern matches that were identified. These headers can be extremely valuable when processing false positives since they travel along with the message - (no more hunting for log file snips). --- The software calling Message Sniffer is responsible for deleting the .xhdr file once it has been used! Thanks, David
[Declude.JunkMail] Declude and SmarterMail
Is anyone using Declude and SmarterMail? Can you share your experience? We need to migrate off from Imail to SM and were waiting for SM support in Declude and wanted to test drive them before we made the move. Since there is no trial for Declude for SM I wanted to get some feedback from customers. Anythoughts would be appreciated. Thanks Peter
RE: [Declude.JunkMail] Declude and SmarterMail
Peter, Contact me off list re trial for Declude/SmarterMail. Barry From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mailing Lists Sent: Monday, February 07, 2005 7:37 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude and SmarterMail Is anyone using Declude and SmarterMail? Can you share your experience? We need to migrate off from Imail to SM and were waiting for SM support in Declude and wanted to test drive them before we made the move. Since there is no trial for Declude for SM I wanted to get some feedback from customers. Anythoughts would be appreciated. Thanks Peter
RE: [Declude.JunkMail] Subject problem
Any news of the availability of the new release? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 04, 2005 5:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Subject problem Scott. Any response to this. There should be a new release Monday that covers the issues from this week. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject problem
There is a new build on www.declude.com 2.0.3 which has the fix in it. The only outstanding issue we are aware of is to do with the %localhost% for notifications. Regards Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, February 07, 2005 8:03 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Subject problem Any news of the availability of the new release? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 04, 2005 5:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Subject problem Scott. Any response to this. There should be a new release Monday that covers the issues from this week. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] inserting Sniffer log info into header
On Monday, February 7, 2005, 7:14:03 PM, Andy wrote: AS Interesting sounds like someone would have to write an AS External Filter. Unless Declude is willing to integrate this AS in their Sniffer support. AS AS When you turn this one - where do this XHDR files appear? AS In the regular spool folder together with the queue and data AS file? If so, one could probably write a command script to insert AS the content of the XHDR file into the message file and then AS delete the XHDR? This kind of thing could be done... The .xhdr file should show up right where the message file is. However, since Declude is already adding headers ( most likely ) it would be more efficient if Declude could do the job. Otherwise, the whole message would have to be copied at least once for the .xhdr addition, and then again for any headers or other modifications done by Declude. If Declude does the editing, then all of the headers and mods can be handled at one time. I haven't talked with Declude very much about adding a feature like this, but it would be a good trick if they added it. If done right then other external tests would be able to talk back to the message in the same way... that's more complexity though. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Outlook munging headers
Title: Message Hi, haven't played with this - but I know that people have been complaining about Outlook munging the headers. I wonder if this would help: Additional compatibility can be achieved by enabling Outlook 2003 to save the original MIME source when connecting to a POP3 server. To enable this feature, set the following registry parameter: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Options\MailParameter: SaveAllMIMENotJustHeadersType: REG_DWORDData Value: 0x0001 Best RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206http://www.HM-Software.com/ attachment: HMSoftSmall.jpg
RE: [Declude.JunkMail] Subject problem
If by saying the %LOCALHOST% meaning the wrong domain is used, that has been there for awhile and maybe my fault I have not said anything about it. Any thing I can do to test? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Monday, February 07, 2005 5:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Subject problem There is a new build on www.declude.com 2.0.3 which has the fix in it. The only outstanding issue we are aware of is to do with the %localhost% for notifications. Regards Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, February 07, 2005 8:03 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Subject problem Any news of the availability of the new release? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 04, 2005 5:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Subject problem Scott. Any response to this. There should be a new release Monday that covers the issues from this week. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Outlook munging headers
Title: Message KB number or source of information please? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Monday, February 07, 2005 5:24 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Outlook munging headers Hi, haven't played with this - but I know that people have been complaining about Outlook munging the headers. I wonder if this would help: Additional compatibility can be achieved by enabling Outlook 2003 to save the original MIME source when connecting to a POP3 server. To enable this feature, set the following registry parameter: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Options\Mail Parameter: SaveAllMIMENotJustHeaders Type: REG_DWORD Data Value: 0x0001 Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 http://www.HM-Software.com/ image001.jpg
RE: [Declude.JunkMail] Subject problem
I'll ask the guys to contact you off list tomorrow to discuss. Thanks for the offer. barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, February 07, 2005 8:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Subject problem If by saying the %LOCALHOST% meaning the wrong domain is used, that has been there for awhile and maybe my fault I have not said anything about it. Any thing I can do to test? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Monday, February 07, 2005 5:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Subject problem There is a new build on www.declude.com 2.0.3 which has the fix in it. The only outstanding issue we are aware of is to do with the %localhost% for notifications. Regards Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, February 07, 2005 8:03 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Subject problem Any news of the availability of the new release? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 04, 2005 5:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Subject problem Scott. Any response to this. There should be a new release Monday that covers the issues from this week. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] inserting Sniffer log info into header
I agree that this would be easiest to accomplish with a hook from Declude to add the header info. Scott or Barry do you know if this can be done in the current version? If not it would be a great feature request. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, February 07, 2005 5:13 PM To: Andy Schmidt Subject: Re[2]: [Declude.JunkMail] inserting Sniffer log info into header On Monday, February 7, 2005, 7:14:03 PM, Andy wrote: AS Interesting sounds like someone would have to write an AS External Filter. Unless Declude is willing to integrate this AS in their Sniffer support. AS AS When you turn this one - where do this XHDR files appear? AS In the regular spool folder together with the queue and data AS file? If so, one could probably write a command script to insert AS the content of the XHDR file into the message file and then AS delete the XHDR? This kind of thing could be done... The .xhdr file should show up right where the message file is. However, since Declude is already adding headers ( most likely ) it would be more efficient if Declude could do the job. Otherwise, the whole message would have to be copied at least once for the .xhdr addition, and then again for any headers or other modifications done by Declude. If Declude does the editing, then all of the headers and mods can be handled at one time. I haven't talked with Declude very much about adding a feature like this, but it would be a good trick if they added it. If done right then other external tests would be able to talk back to the message in the same way... that's more complexity though. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
