[Declude.JunkMail] Adding custom header line
Following to the manual there is one action to add a line to the message header: WARN The HEADER-Action does not add it to the message header but to the head of the body. But the WARN-Action is limited as it does add a fixed line X-RBL-Warning: (description) What if I want to add a custom line to the message header if a certain weight was reached? For example: X-Spam-Flag: YES ...so that mailservers and email-clients behind declude could use their own filters based on this header line. I have one possible new customer who already has filters for such a message header and want to switch to our spam filters. But for this we need such custom message header lines. Does I miss here something or is it true that there is no way to do this with current declude versions? Markus --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Yahoo delivery problems
Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Adding custom header line
Markus, I believe that the XINHEADER and XOUTHEADER directives in the global.cfg are what you're looking for. They can be used to create an arbitrary header and populate it with any exposed Declude variables, e.g.: #XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]). #XOUTHEADER Organization: Your Name Here Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Thursday, November 02, 2006 3:10 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Adding custom header line Following to the manual there is one action to add a line to the message header: WARN The HEADER-Action does not add it to the message header but to the head of the body. But the WARN-Action is limited as it does add a fixed line X-RBL-Warning: (description) What if I want to add a custom line to the message header if a certain weight was reached? For example: X-Spam-Flag: YES ...so that mailservers and email-clients behind declude could use their own filters based on this header line. I have one possible new customer who already has filters for such a message header and want to switch to our spam filters. But for this we need such custom message header lines. Does I miss here something or is it true that there is no way to do this with current declude versions? Markus --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Adding custom header line
Oops, sorry, I jumped the gun and gave the wrong answer. What I meant to say was that the %TESTSFAILED% variable could be used with either XINTHEADER/XOUTHEADER and the client would have to parse the whole line for, say, a traditional WEIGHT20 entry. If there's a way to create an arbitrary entry based on a weight or a test status, I'd like to hear about it too. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Thursday, November 02, 2006 3:10 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Adding custom header line Following to the manual there is one action to add a line to the message header: WARN The HEADER-Action does not add it to the message header but to the head of the body. But the WARN-Action is limited as it does add a fixed line X-RBL-Warning: (description) What if I want to add a custom line to the message header if a certain weight was reached? For example: X-Spam-Flag: YES ...so that mailservers and email-clients behind declude could use their own filters based on this header line. I have one possible new customer who already has filters for such a message header and want to switch to our spam filters. But for this we need such custom message header lines. Does I miss here something or is it true that there is no way to do this with current declude versions? Markus --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Yahoo delivery problems
Hey Dave, This has been an ongoing issue for the past month or so. It's been discussed in the Imail newsgroup for weeks. The short of it is that there are issues with Yahoo's mail servers that are causing these intermittent delivery problems. Yahoo claims that it's due to an increase in spam traffic overwhelming their systems. Either way, know that you are not on a blacklist and you're not the only one having this problem. For more info check the Imail archive here: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/, and search for Yahoo Delaying Messages Hope this helps. Troy D. Hilton Serveon, Inc. 302-529-8640 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, November 02, 2006 11:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo delivery problems Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Results ! 92.9 percent delete rate...
Hi, Where did you get the declude log reader from? Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, November 02, 2006 7:13 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Results ! 92.9 percent delete rate... Doing my monthly checkup on how my rules are working, and was blown away at the actual amount I am getting. 11 thousand a day ? Damn, we only have 250 employees ! Anyone else seeing this upswing ? Two-three months ago I was getting 6 thousand a day.. The new version of Declude is rocking.. Check it outhttp://www.casselberry.org/results.bmp Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Yahoo delivery problems
Just throwing this out there. I had heard that Yahoo.com was using greylisting on all email that did not support domain keys. Don't now if it is true, perhaps a rumor may be worth checking out. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, November 02, 2006 11:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo delivery problems Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Yahoo delivery problems
Oh look. Number 1 on google for domain keys. http://antispam.yahoo.com/domainkeys Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 02, 2006 8:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: Yahoo delivery problems Just throwing this out there. I had heard that Yahoo.com was using greylisting on all email that did not support domain keys. Don't now if it is true, perhaps a rumor may be worth checking out. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, November 02, 2006 11:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo delivery problems Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Yahoo delivery problems
This too was discussed in the Imail forum. Someone actually did some testing with the domain keys. The greylisting is not totally valid as emails were passed with and without the keys. It seems to be a random issue in the sense that there doesn't seem to be any particular pattern to the failed emails. Troy D. Hilton Serveon, Inc. 302-529-8640 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, November 02, 2006 2:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: Yahoo delivery problems Just throwing this out there. I had heard that Yahoo.com was using greylisting on all email that did not support domain keys. Don't now if it is true, perhaps a rumor may be worth checking out. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, November 02, 2006 11:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo delivery problems Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Results ! 92.9 percent delete rate...
Wrote it myself ! Kind a 'swiss army knife' for the logs.. Summary report for rules, and the old What happened to Aunt Martha's email she sent me from Tibet. Typical stuff in the daily life of a Declude admin. It doesn't do everything some of the others do, but more than enough for me and my friends. Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Thursday, November 02, 2006 1:20 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Results ! 92.9 percent delete rate... Importance: High Hi, Where did you get the declude log reader from? Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, November 02, 2006 7:13 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Results ! 92.9 percent delete rate... Doing my monthly checkup on how my rules are working, and was blown away at the actual amount I am getting. 11 thousand a day ? Damn, we only have 250 employees ! Anyone else seeing this upswing ? Two-three months ago I was getting 6 thousand a day.. The new version of Declude is rocking.. Check it outhttp://www.casselberry.org/results.bmp Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Results ! 92.9 percent delete rate...
Care to share? Troy D. Hilton Serveon, Inc. 302-529-8640 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, November 02, 2006 3:35 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Results ! 92.9 percent delete rate... Wrote it myself ! Kind a 'swiss army knife' for the logs.. Summary report for rules, and the old What happened to Aunt Martha's email she sent me from Tibet. Typical stuff in the daily life of a Declude admin. It doesn't do everything some of the others do, but more than enough for me and my friends. Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Thursday, November 02, 2006 1:20 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Results ! 92.9 percent delete rate... Importance: High Hi, Where did you get the declude log reader from? Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Thursday, November 02, 2006 7:13 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Results ! 92.9 percent delete rate... Doing my monthly checkup on how my rules are working, and was blown away at the actual amount I am getting. 11 thousand a day ? Damn, we only have 250 employees ! Anyone else seeing this upswing ? Two-three months ago I was getting 6 thousand a day.. The new version of Declude is rocking.. Check it outhttp://www.casselberry.org/results.bmp Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] orphaned .hdr files
Has anyone else using SmarterMail and Declude 4.3.7 experienced orphaned .hdr files in spool\proc\work? I have noticed that these have been occurring for a while and really didn't want to have to deal with the issue. However, we have customers reporting that messages are going missing. I can see that SmarterMail is accepting the missing message in the SMTP log, but then there's nothing in Declude's log or SmarterMail's deliver log. - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] orphaned .hdr files
In follow up to my own email, I can definitively confirm that these left over .hdr files are messages that Declude is barfing on. I searched all of them and found the .hdr that corresponds to the missing message: 1822213885697.HDR --- [EMAIL PROTECTED] [EMAIL PROTECTED] auth: [EMAIL PROTECTED] Searching Declude's logs for this message ID indicates the following: 11/02/2006 09:09:19.883 1822213885697 Skipping E-mail from authenticated user [EMAIL PROTECTED]; whitelisted. 11/02/2006 09:09:19.883 1822213885697 ERROR: Could not open (for write) recip file c:\SmarterMail\Spool\proc\work\1822213885697.hdr [32] All in all, this appears to be happening on a very low percentage of the emails we process. We process about 200,000 messages per day. Searching the Declude log indicates we've had the Could not open error occur 343 times in the past 14 hrs. Even so, this issue is resulting in valid customer email being lost. A search of the archives reveals no similar issues. However, I checked another SmarterMail / Declude server that we manage, and it too is having similar issues. *** Very interesting. The actual mail data file is still in my SmarterMail spool, except it has an x in front of the file name (ex x1822213885697.eml). This really makes me wonder where the issue lies - with SmarterMail or with Declude. Who is responsible for plucking the messages from the spool and putting them into the work directory, Declude or SmarterMail? -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Thursday, November 02, 2006 4:25 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] orphaned .hdr files Has anyone else using SmarterMail and Declude 4.3.7 experienced orphaned .hdr files in spool\proc\work? I have noticed that these have been occurring for a while and really didn't want to have to deal with the issue. However, we have customers reporting that messages are going missing. I can see that SmarterMail is accepting the missing message in the SMTP log, but then there's nothing in Declude's log or SmarterMail's deliver log. - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] orphaned .hdr files
I seem them from time to time too - never been able to figure out what's going on with them. John Has anyone else using SmarterMail and Declude 4.3.7 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Yahoo delivery problems
Yahoo has been having issues since October 16th. This is almost definitely due to the new brute force zombie spammer. My own connection traffic doubled in the space of two weeks, and almost all of that was zombie spam and backscatter to forged addresses. Yahoo probably didn't have the infrastructure to handle the rapid increase in load which is why they are still having problems after almost 3 weeks. Regarding DomainKeys, this is just another one of those completely ineffective E-mail ID techniques. The vast majority of messages that we receive with DomainKeys are from spammers. Since all of these techniques are built to target forging zombie spam, they would be better off just doing something that better targtets zombie spam instead of trying to push yet another E-mail ID scheme. Matt David Barker wrote: Just throwing this out there. I had heard that Yahoo.com was using greylisting on all email that did not support domain keys. Don't now if it is true, perhaps a rumor may be worth checking out. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, November 02, 2006 11:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo delivery problems Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message temporarily deferred - [190] I searched google and I searched Yahoo's site to see if I could find an explanation of this message -- no joy. I didn't know if it meant they are blocking our IP or if Yahoo was having problems. It sounded to me like they are blocking us. I could not find anything on Yahoo's site about who to contact, what the message means -- nothing. Can someone shed some light on what may be going on? Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Backup MX
Hi all -- What is the current best practice for handling backup MXs? It appears to have gotten harder since the bots seem to target the lower priority MXs. It seems that the lower priority MX accepts the mail, and then passes it along to us, but since there isn't the same filtering going on on the backup, a bunch of bad stuff is more likely to get through. Advice, pointers welcomed. Thanks in advance Rob Robert N. Grosshandler --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Backup MX
This is why the IPBYPASS is a very good feature. Skip your backup MX and process the headers starting at the IP that connected to your backup MX. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Robert Grosshandler [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 6:56 PM Subject: [Declude.JunkMail] Backup MX Hi all -- What is the current best practice for handling backup MXs? It appears to have gotten harder since the bots seem to target the lower priority MXs. It seems that the lower priority MX accepts the mail, and then passes it along to us, but since there isn't the same filtering going on on the backup, a bunch of bad stuff is more likely to get through. Advice, pointers welcomed. Thanks in advance Rob Robert N. Grosshandler --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] One step forward, ten back
Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] One step forward, ten back
Hi Todd, Note that the rulebase for the trial of Sniffer lags behind the latest definitions by a few days. That makes a huge difference in the capture rate when spam campaigns change as frequently as they have been doing lately. An up-to-date Sniffer rulebase generally captures 90-95% on our systems. So get and subscription and you can set up a program alias in IMail to update your sniffer rulebase when a new one is available. Pete has them up to about every 3 hours now, I believe. I think it's time to start tweaking your weights. Out of the box gets maybe 80%, but with tweaking a number of us get over 99.5% capture rate with few false positives. That's 40 times less spam. Yes, whitelisting is bad due mainly to forging of addresses/domains. Negative weighting is much better. SPF is also a great way to combat forging of you can control what servers mail is sent from. Contact me off list and we can review your configs, but definitely get a sniffer subscription. Darin. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Results ! 92.9 percent delete rate...
Yep. For us a 50% jump occurred July 16th, but I've heard others say June through October. Other than that it's just a steady growth of ~1% a month. Darin. - Original Message - From: IS - Systems Eng. (Karl Drugge) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 1:12 PM Subject: [Declude.JunkMail] Results ! 92.9 percent delete rate... Doing my monthly checkup on how my rules are working, and was blown away at the actual amount I am getting. 11 thousand a day ? Damn, we only have 250 employees ! Anyone else seeing this upswing ? Two-three months ago I was getting 6 thousand a day.. The new version of Declude is rocking.. Check it outhttp://www.casselberry.org/results.bmp Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Yahoo delivery problems
Thank you all who replied to my inquiry about the Yahoo deliver problems! Good to know I'm not on a blacklist. This was the first we've encountered problems with yahoo so we must have just hit it at a time they were having problems. Thanks again, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] One step forward, ten back
It seems like you're detecting things OK, but not taking action on the results. Make sure you have directives like WEIGHT14MAILBOX SPAM WEIGHT20DELETE in your default.junkmail file - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Backup MX
Hi Rob- In addition to IPBYPASS, make sure your gateway knows what addresses are acceptable to the mail server so unacceptable addresses can be dealt with at the gateway. That will keep dictionary attacks from getting to the server via the gateway. In fact, this technique is so effective at trapping dictionary attacks that you might want to consider two gateways and routing all your mail through them. I have a low-priority MX that swallows about 250,000 dictionary attacks a day. -Dave Doherty Skywaves, Inc. 508-425-7176 [EMAIL PROTECTED] - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:26 PM Subject: Re: [Declude.JunkMail] Backup MX This is why the IPBYPASS is a very good feature. Skip your backup MX and process the headers starting at the IP that connected to your backup MX. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Robert Grosshandler [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 6:56 PM Subject: [Declude.JunkMail] Backup MX Hi all -- What is the current best practice for handling backup MXs? It appears to have gotten harder since the bots seem to target the lower priority MXs. It seems that the lower priority MX accepts the mail, and then passes it along to us, but since there isn't the same filtering going on on the backup, a bunch of bad stuff is more likely to get through. Advice, pointers welcomed. Thanks in advance Rob Robert N. Grosshandler --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] One step forward, ten back
Thanks Dave. Actually, I do, but with settings of weight20 send to spam mailbox. I was worried about too many false positives. I wondered if it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. As an update, I found that I had a discrepancy in my weights. I corrected that, and my filtering is doing great now. I logged into my spam mailbox a little bit ago and the few hundred messages that are in there are definitely spam. So it's catching things now and keeping them from my mailbox - which was my main goal. However, now I'd like to clean things up just a little more... Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:34 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back It seems like you're detecting things OK, but not taking action on the results. Make sure you have directives like WEIGHT14MAILBOX SPAM WEIGHT20DELETE in your default.junkmail file - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] One step forward, ten back
Definitely. We scaled our weights to hold at 100 and delete at 250. Scaling hold to 100 made it easy to think of percentage of hold weight when assigning individual test weights, and also gives a good bit of granularity for tweaking. You just want to make sure you set delete high enough that your risk of deleting a legit email is within your tolerance. Most of our FPs are in the 100-150 range, but every month or two we'll see one in the 200-250 range. We initially had delete at 300, but never saw any legit mail in the 250-300 range, so we set delete at 250 to reduce the review queue. Darin. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:55 PM Subject: RE: [Declude.JunkMail] One step forward, ten back Thanks Dave. Actually, I do, but with settings of weight20 send to spam mailbox. I was worried about too many false positives. I wondered if it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. As an update, I found that I had a discrepancy in my weights. I corrected that, and my filtering is doing great now. I logged into my spam mailbox a little bit ago and the few hundred messages that are in there are definitely spam. So it's catching things now and keeping them from my mailbox - which was my main goal. However, now I'd like to clean things up just a little more... Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:34 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back It seems like you're detecting things OK, but not taking action on the results. Make sure you have directives like WEIGHT14MAILBOX SPAM WEIGHT20DELETE in your default.junkmail file - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
Re: [Declude.JunkMail] One step forward, ten back
I wondered if it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. Absolutely. Several action directives can coexist peacefully in your $default$.junkmail file, like this: WEIGHT10 SUBJECT [%WEIGHT%] WEIGHT20 MAILBOX SPAM WEIGHT30 DELETE Any message scoring at least 10 will have the weight added at the head of the subject in brackets, like: [12] Buy My Stuff! Any message with 20-29 points will be diverted to the spam folder, and anything scoring 30+ will be deleted. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:55 PM Subject: RE: [Declude.JunkMail] One step forward, ten back Thanks Dave. Actually, I do, but with settings of weight20 send to spam mailbox. I was worried about too many false positives. I wondered if it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. As an update, I found that I had a discrepancy in my weights. I corrected that, and my filtering is doing great now. I logged into my spam mailbox a little bit ago and the few hundred messages that are in there are definitely spam. So it's catching things now and keeping them from my mailbox - which was my main goal. However, now I'd like to clean things up just a little more... Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:34 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back It seems like you're detecting things OK, but not taking action on the results. Make sure you have directives like WEIGHT14MAILBOX SPAM WEIGHT20DELETE in your default.junkmail file - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at
[Declude.JunkMail] Can someone help?
Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Can someone help?
Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] One step forward, ten back
Yes the can coexist but be sure to use weightrange to instead of weight. SPAM-LOWweightrange x x 8 13 SPAM-MEDweightrange x x 14 24 SPAM-HIGH weight x x 25 0 SPAM-LOWSUBJECT [%WEIGHT%] SPAM-MEDHOLD SPAM-HIGH DELETE -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:20 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back I wondered if it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. Absolutely. Several action directives can coexist peacefully in your $default$.junkmail file, like this: WEIGHT10 SUBJECT [%WEIGHT%] WEIGHT20 MAILBOX SPAM WEIGHT30 DELETE Any message scoring at least 10 will have the weight added at the head of the subject in brackets, like: [12] Buy My Stuff! Any message with 20-29 points will be diverted to the spam folder, and anything scoring 30+ will be deleted. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:55 PM Subject: RE: [Declude.JunkMail] One step forward, ten back Thanks Dave. Actually, I do, but with settings of weight20 send to spam mailbox. I was worried about too many false positives. I wondered mailboxif it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. As an update, I found that I had a discrepancy in my weights. I corrected that, and my filtering is doing great now. I logged into my spam mailbox a little bit ago and the few hundred messages that are in there are definitely spam. So it's catching things now and keeping them from my mailbox - which was my main goal. However, now I'd like to clean things up just a little more... Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:34 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back It seems like you're detecting things OK, but not taking action on the results. Make sure you have directives like WEIGHT14MAILBOX SPAM WEIGHT20DELETE in your default.junkmail file - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I think everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything.In fact, earlier today I had some spam come through that was from a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score [39] at 17:59:29 on 02 Nov 2006 X-Declude-Fail: CBL [6], FIVETEN-SRC [4], SPAMCOP [7], REVDNS [8], ROUTING [2], SNIFFER [12], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT20a [20] Does anyone have any suggestions to what I might be doing wrong, or what I should look at next? Would anyone (off-list) be willing to look at my config files and see if something is apparently wrong? Are there any sample files where a newbie might be able to see how others have theirs set up? I have been running Declude for over a year, and with the exception of some minor tweaks, it's pretty much running out-of-the-box. For those who are interested, I'm running Imail 8.22 (with latest hotfix) on Windows 2000 server, as well as the Declude Suite, Message Sniffer, and inv-URBL 2.7. Thanks for any input or direction you can offer. Todd
RE: [Declude.JunkMail] Can someone help?
Accessing the services page requires authentication to the OS since specific credentials are required to start/stop services. If you have tweaked the IIS security for the IAdmin page, this may be what is happening. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, November 02, 2006 9:34 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Can someone help?
Thanks so much for your reply, Andy. I do get prompted with the NTFS logon screen. I forgot to mention that. When i put in my user name and password, it gives me the page can't be displayed and then i can't get back to where it prompts me again.. How do i turn on auditing for object access and which folders do i have to do this for? - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:53 PM Subject: RE: [Declude.JunkMail] Can someone help? Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Can someone help?
If the authentication pop-up doesn't appear, that would mean that you only have anonymous access checked on the site or virtual directory in IIS. Going in and adding something like Basic Auth should generate the pop-up. I seem to recall having to make this adjustment on a server that I set up. Matt Andy Schmidt wrote: Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Can someone help?
Matt, i did what you said.. i now have anonomyus and basic auth checked. I'm getting a little closer because now i get this error instead of a page can't be displayed: SWbemLocator error '80041003' Access denied /IAdmin/IMail/services/ServicesAdmin.asp, line 61 Any ideas? If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Ext.7008 Linda Pagillo Technical Support Engineer Declude - Your Email security is our business 978.499.2933 office 978.477.8930 efax [EMAIL PROTECTED] www.declude.com - Original Message - From: Matt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, November 03, 2006 12:11 AM Subject: Re: [Declude.JunkMail] Can someone help? If the authentication pop-up doesn't appear, that would mean that you only have anonymous access checked on the site or virtual directory in IIS. Going in and adding something like Basic Auth should generate the pop-up. I seem to recall having to make this adjustment on a server that I set up. Matt Andy Schmidt wrote: Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Can someone help?
Hi Linda, To turn on auditing (which I never understand, why it's not turned on by default in Windows) - MS gives you quite a run-around: - Windows Explorer - go to the root directories of each disk, properties, security, Advanced, Auditing, add the Everyone user and mark the failed checkmarks for the complete list of accesses (I personally also audit successful change permissions and take ownership). Apply this and let it propagate to all subfolders. - Local Security Policy - to to Local Policies, Audit Policies and turn on all failures. (I personally also audit successful account management and audit policy changes). After doing this, any access rejection will appear in the security event log. I don't know how anyone manages any server (or workstation) without having that information at your finger tips. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Linda Pagillo Sent: Friday, November 03, 2006 01:14 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Can someone help? Thanks so much for your reply, Andy. I do get prompted with the NTFS logon screen. I forgot to mention that. When i put in my user name and password, it gives me the page can't be displayed and then i can't get back to where it prompts me again.. How do i turn on auditing for object access and which folders do i have to do this for? - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:53 PM Subject: RE: [Declude.JunkMail] Can someone help? Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Can someone help?
Hm, If you DO see the NTFS screen and are logging in with a valid NT administrator account, then maybe we need to know more about the page can't be displayed message. Maybe post a screenshot so that we can see the URL and the full text of the message and whether there are any HTTP status codes displayed as part of the message etc. Also, I assume you did already check the application and system logs to see if your action generated any entries? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Linda Pagillo Sent: Friday, November 03, 2006 01:14 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Can someone help? Thanks so much for your reply, Andy. I do get prompted with the NTFS logon screen. I forgot to mention that. When i put in my user name and password, it gives me the page can't be displayed and then i can't get back to where it prompts me again.. How do i turn on auditing for object access and which folders do i have to do this for? - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:53 PM Subject: RE: [Declude.JunkMail] Can someone help? Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Can someone help?
Linda, I'm pretty sure that the access is limited to only Administrator group accounts, so make sure that you login with that. There is a KB article about this exact error also: http://support.ipswitch.com/kb/IM-20051206-DM05.htm Just in case you run into other issues with permissions, you will want to check the following article also. I found that when specifying directories outside of the IMail tree that you had to set the permissions manually for proper IIS access (such as IUSR access to the spool when on a different drive). http://support.ipswitch.com/kb/IM-20060214-JH01.htm After you are done with this stuff, you will need to convert the old address books to the new one: http://support.ipswitch.com/kb/IM-20060627-JH01.htm I would also recommend turning off the dictionary attack prevention in the SMTP properties by setting the limit very high and the time period very low. I ran into an issue on 2006.1 where setting everything to 0 did not functionally disable this, and if you are running a gateway, it is best to not block your gateway :) Matt Linda Pagillo wrote: Matt, i did what you said.. i now have anonomyus and basic auth checked. I'm getting a little closer because now i get this error instead of a "page can't be displayed": SWbemLocator error '80041003' Access denied /IAdmin/IMail/services/ServicesAdmin.asp, line 61 Any ideas? If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Ext.7008 Linda Pagillo Technical Support Engineer Declude - Your Email security is our business 978.499.2933 office 978.477.8930 efax [EMAIL PROTECTED] www.declude.com - Original Message - From: "Matt" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, November 03, 2006 12:11 AM Subject: Re: [Declude.JunkMail] Can someone help? If the authentication pop-up doesn't appear, that would mean that you only have anonymous access checked on the site or virtual directory in IIS. Going in and adding something like Basic Auth should generate the pop-up. I seem to recall having to make this adjustment on a server that I set up. Matt Andy Schmidt wrote: Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Can someone help?
Andy, how do i let it propagate to all folders? I'm sorry guys, i'm used to Linux when it comes to permissions. Also, you said... Local Policies, Audit Policies and turn on all failures. (I personally also audit successful account management and audit policy changes). Where is Local Policies and Audit Policies? - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, November 03, 2006 12:51 AM Subject: RE: [Declude.JunkMail] Can someone help? Hi Linda, To turn on auditing (which I never understand, why it's not turned on by default in Windows) - MS gives you quite a run-around: - Windows Explorer - go to the root directories of each disk, properties, security, Advanced, Auditing, add the Everyone user and mark the failed checkmarks for the complete list of accesses (I personally also audit successful change permissions and take ownership). Apply this and let it propagate to all subfolders. - Local Security Policy - to to Local Policies, Audit Policies and turn on all failures. (I personally also audit successful account management and audit policy changes). After doing this, any access rejection will appear in the security event log. I don't know how anyone manages any server (or workstation) without having that information at your finger tips. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Linda Pagillo Sent: Friday, November 03, 2006 01:14 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Can someone help? Thanks so much for your reply, Andy. I do get prompted with the NTFS logon screen. I forgot to mention that. When i put in my user name and password, it gives me the page can't be displayed and then i can't get back to where it prompts me again.. How do i turn on auditing for object access and which folders do i have to do this for? - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:53 PM Subject: RE: [Declude.JunkMail] Can someone help? Hi, I don't have a solution - just a pointer. When I go to that particular screen, I get an NTFS logon screen. Apparently you don't get prompted - I wonder why? Do you have auditing turned for object access and against your folders in Windows Explorer? Then the security log might show if there is some permission problem. Now, I remember I didn't do anything special. I installed a new Win 2003 SP1 system, set up a new IIS site and then installed Imail. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 03, 2006 12:34 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Can someone help? Hey guys, I know this isn't an Imail list, but i really need some help. I'm running Imail 2006.1 on Windows 2003 server SP1. I can log into my WebAdmin interface with no problem, but if i try to manage my Imail services, i get a page can't be displayed. I can click on anything else in the WebAdmin screen and it takes my to it with no problems, i just can't get to my services. I think it has something to do with IIS, but i'm lost and tired. Could someone please help me with this? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] One step forward, ten back
Hi, As a matter of fact he doesn't have to use weightrange in this case. I use: SPAMSUBJECTweightxx120SPAMHOLDweightrangexx2024SPAMDELETEweightxx250 SPAMSUBJECTSUBJECT [SPAM: %WEIGHT%]SPAMHOLDHOLDSPAMDELETEDELETE As the delete action overrules the holdaction the weightrange is not really neccesary but it makes me feel good and is a bit cleaner. I WANT the spamsubject action in case of held mail (anything over 12 points) as I want to have the ability to sort spam mail by points, this way I can do that by sorting it on the subject. Met vriendelijke groet,Bonno Bloksmahoofd systeembeheer tio hogeschool hotelmanagement en toerisme begijnenhof 8-12 / 5611 el eindhovent 040 296 28 28 / f 040 237 35 20[EMAIL PROTECTED] / www.tio.nl - Original Message - From: Kevin Bilbee To: declude.junkmail@declude.com Sent: Friday, November 03, 2006 7:05 AM Subject: RE: [Declude.JunkMail] One step forward, ten back Yes the can coexist but be sure to use weightrange to instead of weight.SPAM-LOW weightrange x x 8 13SPAM-MED weightrange x x 14 24SPAM-HIGH weight x x 25 0SPAM-LOW SUBJECT [%WEIGHT%]SPAM-MED HOLDSPAM-HIGH DELETE -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:20 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back I wondered if it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. Absolutely. Several action directives can coexist peacefully in your $default$.junkmail file, like this: WEIGHT10 SUBJECT [%WEIGHT%] WEIGHT20 MAILBOX SPAM WEIGHT30 DELETE Any message scoring at least 10 will have the weight added at the head of the subject in brackets, like: [12] Buy My Stuff! Any message with 20-29 points will be diverted to the spam folder, and anything scoring 30+ will be deleted. - Original Message - From: "Todd Richards" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 11:55 PM Subject: RE: [Declude.JunkMail] One step forward, ten back Thanks Dave. Actually, I do, but with settings of weight20 send to spam mailbox. I was worried about too many false positives. I wondered mailboxif it's possible to set another one higher to do the deleting, as I'm seeing a lot of stuff at 40 or more. As an update, I found that I had a discrepancy in my weights. I corrected that, and my filtering is doing great now. I logged into my spam mailbox a little bit ago and the few hundred messages that are in there are definitely spam. So it's catching things now and keeping them from my mailbox - which was my main goal. However, now I'd like to clean things up just a little more... Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, November 02, 2006 9:34 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] One step forward, ten back It seems like you're detecting things OK, but not taking action on the results. Make sure you have directives like WEIGHT14 MAILBOX SPAM WEIGHT20 DELETE in your default.junkmail file - Original Message - From: "Todd Richards" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, November 02, 2006 7:38 PM Subject: [Declude.JunkMail] One step forward, ten back Hi Everyone - We are getting completely hammered by spam and I'm about at my wits end. A few weeks ago I added a 30-day trial of Message Sniffer and it doesn't seem to be doing any good. Today, I upgraded to the newest version of Declude. I "think" everything went ok. After reading through the documentation (again) I went through my global.cfg file and cleaned up some things that were questionable. For instance, we had several domains in the WHITELIST TO and WHITELIST FROM. From what I've read and heard through the lists, it's not a good idea to whitelist anything. In fact, earlier today I had some spam come through that was "from" a whitelisted domain so it just let it through. So I commented them out and planned to watch my spam account (instead of deleting I have caught messages sent to another account for review) to see the results. So... This happened about 5pm tonight. I went through a short spurt but in the last 90 minutes since then I alone have received over 150 spam messages. Before I made my changes tonight, that is about the number I would receive in one day (which is still too many). In one message, this was in the header. To me, it should have failed and been stopped. X-Declude-Scan: Incoming Score
RE: [Declude.JunkMail] Can someone help?
To turn on auditing (which I never understand, why it's not turned on by default in Windows) - MS gives you quite a run-around: First, in the NT 4.0 days, auditing could easily use up resources and create a huge security log file depending upon the configuration of the security log file. Second, auditing can produce a lot of data, even if configured very narrowly, that one then has to wade through. - Windows Explorer - go to the root directories of each disk, properties, security, Advanced, Auditing, add the Everyone user and mark the failed checkmarks for the complete list of accesses (I personally also audit successful change permissions and take ownership). Apply this and let it propagate to all subfolders. - Local Security Policy - to to Local Policies, Audit Policies and turn on all failures. (I personally also audit successful account management and audit policy changes). Actually, what I do for my servers and for client, is in the Default domain policy (local security policy if no domain,) enable those auditing policies that are appropriate (not all are needed for normal business) AND enable both success and failure on object access. NOTE that auditing of object access is the ONLY auditing that requires 2 steps. All other auditing takes affect without further intervention. Then, only when needed, (or if by company policy they want to track changes to files in a particular folder such as say payroll data sheets) I go to the folders properties that I want to audit and enable auditing again for what is needed only. Once I am done auditing, I disable on that directory. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
