RE: [Declude.JunkMail] Trying to install Declude 3.1.20 anew
Title: Message LOL, sorry, just had laugh. And RE: David Barker's response: "However we have encouraged customers to move to 4.x as that is where future development will be focused." This was not what Barry Simpson said when the 4.0X was released. We are atlost too. Over 2 years now with the same problem; but yet we still pay our agreement. Bad us. Still running 2.0.6.16 here and no release to date of Declude corrects the problem(s) we have. Kristina (at Declude) sent us email on 6/2/2006 that this would be corrected in JUNE and still has not. One of the problems is withbroken images. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy SchmidtSent: Wednesday, July 12, 2006 8:36 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Trying to install Declude 3.1.20 anew Hi, I'm trying to set up a server from scratch and thus downloaded and ran: Declude_IM_N310.exe and chose the option to let it do its install (rather than the option for "experienced" admins). PS - that screen has a typo! The setupcreated a C:\Program Files\Declude folder that contains just the 5 config files it also created the SAME files in: D:\Imail\Declude together with binaries and the various other Declude files. I'm at loss! Which location is the "right" one for the config files (I'm assuming the D:\Imail\Declude)? What's the point of creatinga "dummy" Folder in the C:\Program Files\ that contains no programs and that contains files that are not being used at all (assuming that being the case)? Should I be deleting this Program Files folder to avoid confusion when someone else maintains this server? Come on, the cold war has been over since Reagan - are we still trying to confuse the Russians? Best RegardsAndy SchmidtPhone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, May 23, 2006 03:25 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Experience with 4.x Andrew,Thanks for your notes and their history.I'm using the following settings right now: THREADS 30WAITFORMAIL 500WAITFORTHREADS 200WAITBETWEENTHREADS 100WINSOCKCLEANUP OFFINVITEFIX ONAUTOREVIEW ONThere are a few reasons for trying these values. THREADS 30 - I'm pretty confident that dual 3.2 Ghz Xeons and RAID can only handle 30 threads with average messages. In reality, one single message can spike the system to 100%, but these are uncommon. I figure that if I open this up too wide and I am dealing with a backup or something, launching more threads when at 100% CPU utilization will actually slow the system down. This was the same with 2.x and before. There is added overhead to managing threads and you don't want that to happen on top of 100% CPU utilization. I am going to back up my server later tonight to see if I can't find what the magic number is since I don't want to be below that magic number, and it would probably be best to be a little above it.WAITFORMAIL 500 - On my server, this never kicks in, but if it did, it wouldn't make sense to delay for too long because I could build up messages. A half second seems good.WAITFORTHREADS 200 - This apparently kicks in only when I reach my thread limit; sort of like a throttle. I don't want it to be too long because this should only happen when I am hammered, but it is wise not to keep hammering when you are at 100%. Sort of a mixed bag choice here.WAITBETWEENTHREADS 100 - I see this setting as being the biggest issue with sizing a server. Setting it at 100 ms means that I can only handle 10 messages per second, and this establishes an upper limit for what the server can do. I currently average about 5 messages per second coming from my gateways at peak hours, so I figured that to be safe, I should double that value.INVITEFIX ON - I have it on because it comes on by default and I don't know any better. I know nothing about the cause for needing this outside of brief comments. It seems strange that my Declude setup could ruin an invitation unless I was using footers. If this is only triggered by footer use, I would like to know so that I could turn it off. I would imagine that this causes extra load to do the check.AUTOREVIEW ON - I have this on for the same reason that Andrew pointed out. When I restart Decludeproc, messages land in my review folder, and I don't wish to keep manually fishing things out. If there is an issue with looping, it would be wise for Declude to make this only trigger say every 15 minutes instead of more regularly.Feel free t
RE: [Declude.JunkMail] Test - can I post?
If you have ever whitelisted the REVDNS of: .declude.com (like it has been in the past - for several years); you will need to change this. We had too. Before, Declude always had the correct REVDNS based on their domain but since their move to a new location and provider... Their new REVDNS is: .xiolink.com (nothing relating to Declude or CPHZ.COM) To me, this is ironic considering that Declude is in the SPAM business control. And the .xiolink.com full text lookup returns a dotted/dashed IP address used by most dialup/residential customers and for most of us; we use filters and external filters to detect the dotted/dashed IP. (Full REVDNS for the current Declude is: 63-246-31-248.xiolink.com ([63.246.31.248])) Whitelisting based just on a to/from/return address is not enough as these can be forged. In the past we used both the to/from/return address AND the REVDNS as the whitelisting. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Wednesday, June 14, 2006 3:28 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test - can I post? Checking to see if I can post... --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test - can I post?
On other thing... As I mentioned before about the declude site/ip Lookup on Scott's DNS Report: http://www.dnsreport.com/tools/dnsreport.ch?domain=xiolink.com Notice all the errors??? Now lookup: http://www.dnsreport.com/tools/dnsreport.ch?domain=declude.com easydns.com ? I don't know about the most of you; but don't you find that easydns.com is mostly listed on spam sources; this based on our logs from Darrell's URLBL program. You would think that a company that is SPAM control and offer a product for SPAM control would look more into who they use for their ISP and how they setup their service. Just as Scott Fisher said once awhile back (I believe it was him)... Ironic. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Wednesday, June 14, 2006 3:28 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test - can I post? Importance: High Checking to see if I can post... --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test - can I post?
Yes, it is a common place holder... But for how long? Shouldn't a company be on top of that based on the type business they are in? Lookup those IP ranges to see if they those ranges are listed on any list; use DNS that is also not listed on any URI lookup? Normally, what... 7 to 10 days max for have a REVDNS to populate? Have you noticed now... The REVDNS now shows .declude.com (ironically after I mentioned it)? When did their move occur... Over a month ago? Yes. That's not what I said on the REVDNS alone Sandy. What I said was: ...dotted/dashed IP address used by most filters and external filters to detect the dotted/dashed IP Whitelisting based just on a to/from/return address is not enough as these can be forged. In the past we used both the to/from/return address AND the REVDNS as the whitelisting. - More important, why would you think that whitelisting based on the REVDNS domain of a known and targeted anti-spam company would be trustworthy? --Sandy -- Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. mailto:[EMAIL PROTECTED] -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] No action taken
I have heard a response from them; but only from a new comer at Declude Never a response from Barry Simpson anymore... And from a quick look at their contacts... Barry isn't even listed anymore. Who I heard from was from Kristina M. O'Connell and David Barker (both of whom are not Engineers and indicated so); but were very helpful into understanding the Declude company and their search of engineers. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, June 07, 2006 11:20 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] No action taken Doesn't seem like it. I haven't seen a response from them to the list, and I also CC'd [EMAIL PROTECTED] with no response. Anyone had any contact with the company lately? Darin. - Original Message - From: Heimir Eidskrem [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, June 07, 2006 4:28 PM Subject: Re: [Declude.JunkMail] No action taken No response from Declude yet? Its been days. Are they still in business? Heimir Eidskrem wrote: Why would no action been taken on this email. We hold on 100. From Declude log: 06/04/2006 17:38:44.987 q60eb0182d92b.smd Triggered COUNTRIES CONTAINS filter COUNTRYFILTER on ES [weight-10]. 06/04/2006 17:38:45.003 q60eb0182d92b.smd Filter: Set max weight to 60. 06/04/2006 17:38:45.112 q60eb0182d92b.smd Filter: Set max weight to 70. 06/04/2006 17:38:45.159 q60eb0182d92b.smd Filter REVDNSBLACKLIST: Skipping E-mail with a current weight of 245 (=80) 06/04/2006 17:38:45.159 q60eb0182d92b.smd Filter BADWORDFILTER: Skipping E-mail with a current weight of 245 (=30) 06/04/2006 17:38:45.159 q60eb0182d92b.smd SPAMCOP:70 FIVETENSRC:30 SORBS-DUL:35 COUNTRYFILTER:10 SNIFFERGETRICH:100 . Total weight = 245. 06/04/2006 17:38:45.159 q60eb0182d92b.smd Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN Received: from jose-mih7wjftkx [62.42.134.246] by xxx with ESMTP (SMTPD-8.22) id A0EC1404; Sun, 04 Jun 2006 17:38:36 -0500 Date: Sun, 4 Jun 2006 22:38:39 -0060 From: Rene Benjamin [EMAIL PROTECTED] X-Mailer: The Bat! (3.69.9) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: [EMAIL PROTECTED] To: Subject: Under The Radar Equity Alert MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Declude-Sender: [62.42.134.246] X-Declude-Spoolname: D60eb0182d92b.smd X-Spam-Tests-Failed: SPAMCOP, FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, COUNTRYFILTER, SNIFFERGETRICH, WEIGHT75, WEIGHT100, CATCHALLMAILS [245] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 440029386 X-IMail-ThreadID: 60eb0182d92b --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] No Tests Run
I will agree with you Matt. Even Declude support in the past months have been lacking. Very much, lacking and development lacking... But you'll notice the force in promoting Declude to it's users to upgrade with costs to versions that include different programs. I did get an email from a non-support person at declude recently (finally) indicating they know the issues and said that they are continuing to add development talent to our growing company. Which translate to me, they do not have the people for it (support) or development of declude but are seeking it -- as you will notice on their website for positions that are open. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, June 05, 2006 11:47 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] No Tests Run John, I guess my point is more about how to use a list for support. I'm sure that Declude wouldn't want to deal with dozens of people separately when they can deal with them (and learn from them) all at once. They reverted to responding to such things posted on the list in private in many cases for some reason that totally escapes me. Not only that, but not all support requests are answered, or answered in a timely manner. Things would work much better if they were open and responsive to this list. They might not prefer this, but I'm virtually certain that I speak for almost everyone here. Matt John Shacklett wrote: Matt, I did get a reply from Gerry earlier and I resubmitted my earlier support email to him, and he indicated they would escalate things, but that's it. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, 05 June 2006 4:29 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] No Tests Run Glenn, I understand that logs might be difficult for you to post, but I would like to suggest that everyone experiencing such issues should attempt to share log entries if at all feasible. That would go a long way, especially when there could be multiple issues occurring that people are speaking about in one thread. So far it looks like every message was sent from a null sender that was reported to the list. Could people also confirm if they have settings for weight-based tests configured with actions in their Global.cfg? Something like: WEIGHT10 SUBJECT [SPAM] WEIGHT20 HOLD WEIGHT30 DELETE Needless to say, when a half dozen people post about issues like this, it would be nice to get some list feedback from Declude within 8 hours. There's no sense in keeping this all a secret. Since I haven't heard anything back about this stuff, I have to now go on a goose chase in my system trying to figure out if there is an issue without even knowing exactly what it is. That wastes a lot of time when multiplied by the dozens of people that might react the same way on this list to such reports. Thanks, Matt Glenn \ WCNet wrote: I've had a swarm of stock-quote spam in the last few days. Declude 1.81, Imail 7.15. Appears from the headers there are no Declude tests running at all on these msgs, but there are Declude headers added. Majority are null senders. Various IPs. Some have my addy referenced as an X-RCPT, some do not. Majority also have an SMTP-FWD header. Those that are to legitimate recipients on my host, none of them (that I've checked thus far) have a fowarding addy set. Some but not all are being sent using The Bat! client. My Declude logs run up to 800MB per day, difficult to search them for details. Received: from SMTP32-FWD by wcnet.net (SMTP32) id A0E38; Mon, 5 Jun 2006 00:48:32 -0500 Received: from SMTP32-FWD by wcnet.net (SMTP32) id A0F48; Mon, 5 Jun 2006 00:48:32 -0500 Received: from ZIA [203.81.233.129] by wcnet.net with ESMTP (SMTPD32-7.15) id A5A187B7034E; Mon, 05 Jun 2006 00:48:17 -0500 Date: Mon, 5 Jun 2006 05:48:33 -0300 From: Blair Montano [EMAIL PROTECTED] X-Mailer: The Bat! (3.78.20) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: You Too Can Profit From Microcaps MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Declude-Sender: [203.81.233.129] X-Declude-Spoolname: Dc5a187b7034ef2f2.SMD Status: R X-UIDL: 323778081 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives
RE: [Declude.JunkMail] Experience with 4.x
Matt, is your Delcude gatewayed? Or is it running on the same server as Imail? -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, May 24, 2006 5:58 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x I indicated earlier that it looked like a relative 10% improvement (about the difference between 35% and 32% hourly average CPU utilization). I would think that this comes primarily from not needing to start the old declude executable every time, and the improvement might be more substantial on a system with a overtaxed disk. I don't think the code is any more efficient as far as actual scanning goes. Besides that, it's typically the virus scanners and external tests that eat up most of the CPU on a Declude system and not Declude itself, and those things haven't changed. I'm guessing that it might perform much better when redlined though if you tweak it right. I believed that old Declude when getting rammed with overflow seemed to not perform linearly with normal performance with free CPU, but instead dropped, probably due to having a lot of CPU wait time overhead (there's probably a more accurate term for this). The new Declude can be more effectively controlled so as to not bog down the system as much. So performance here might be 2x or more when redlined under optimal conditions. This effect would be maximized if Declude would tie launching threads to a CPU monitor instead of a fixed number with no real clue as to what is perfect under any particular situation. Matt Nick Hayer wrote: Hi Matt, So you see any substantive performance improvement over 2x? -Nick Matt wrote: Jay, It's not about moving along, it's about limiting the CPU to only 100%, or at least not piling it on when it gets there. I could be wrong in assuming that 1 thread = 1 message (hopefully I will be corrected if so), but 30 average messages being processed at once will most definitely peg my processors, and adding more threads when you are at 100% will actually slow down performance. Another note, not all systems are configured equally. A vanilla install of Declude would likely handle 4 times the number of messages that mine does since I run 4 external filters, two virus scanners, and something like 100 Declude filters (though they mostly get skipped with SKIPIFWEIGHT and END statements as they are targeted). Running a single virus scanner and RBL's is just a fraction of the load. With my pre-scanning gateways blocking more than 90% of all traffic (about half of that is dictionary attacks and most of the rest is done with 'selective greylisting'), I can scale one server to handle over 20,000 addresses, possibly as many as 40,000 (doesn't host the accounts though), so despite the heavy config, it is optimized. But back to the real topic...I'm just guessing that 30 messages/threads is the limit for my box, but I'm sure that it isn't as high as 80, though setting it at 80 would be of no consequence outside of a prolonged heavy load caused by something like a backup of my spool. It would be a bigger mistake to set it too low. Matt Jay Sudowski - Handy Networks LLC wrote: 30 threads seems awfully low. We set ours to 80 on a dual xeon box with a separate drive for spool/logging and we move right along without any issues. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Tuesday, May 23, 2006 3:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Experience with 4.x Andrew, Thanks for your notes and their history. I'm using the following settings right now: THREADS30 WAITFORMAIL500 WAITFORTHREADS200 WAITBETWEENTHREADS100 WINSOCKCLEANUPOFF INVITEFIXON AUTOREVIEWON There are a few reasons for trying these values. THREADS 30 - I'm pretty confident that dual 3.2 Ghz Xeons and RAID can only handle 30 threads with average messages. In reality, one single message can spike the system to 100%, but these are uncommon. I figure that if I open this up too wide and I am dealing with a backup or something, launching more threads when at 100% CPU utilization will actually slow the system down. This was the same with 2.x and before. There is added overhead to managing threads and you don't want that to happen on top of 100% CPU utilization. I am going to back up my server later tonight to see if I can't find what the magic number is since I don't want to be below that magic number, and it would probably be best to be a little above
RE: [Declude.JunkMail] What happened to the logging since 2.x????, it's HUGE
Title: Message LOL, had to laugh at Nick. I'll wait to hear from Matt after his upgrade before we attempt to do it again. I think Matt's and our servers handle about the same email volume. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick HayerSent: Monday, May 22, 2006 2:52 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] What happened to the logging since 2.x, it's HUGEHi Matt,Matt wrote: I'm trying an upgrade from the 2.x release for the first time, Why on earth would you want to do that? Was 2x too bug free and you need some excitement?-Nick
RE: [Declude.JunkMail] What happened to the logging since 2.x????, it's HUGE
Title: Message Thanks Matt. We are running Imail 8.22 (2005.10.19.3) and Declude version 2.06.16 on a Windows 2000 Sever version5.00.2195 Service Pack 4 with will no issues other then the ones I submitted to Declude for support and what I've mentioned on this list (which they "declude" will not not provide us support on since we do not run their "current" version)... but the problem even exists in their "current" version according to the lists of others postings.So unfortunately, Declude will not provide us support (even though we are a paid customer of their product) based on the version we run. So I'd be interested to know on our your servers run the latest 3.0X version of Declude. Thanks! -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Monday, May 22, 2006 9:25 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] What happened to the logging since 2.x, it's HUGEErik,Honestly, I was between a rock and a hard place. Declude 2.x doesn't work with IMail 8.2+, and IMail 8.15- has issues with killer messages that crash the Queue Manager service (which I found out the hard way, and 8.21 apparently fixes). For a while the killer messages were somewhat common, and all it took was one leaking through Declude to crash the services, and then you had to dig it out of the spool.So to keep my Queue Manager stable, I had to make the leap.I'll follow up with some comments about my experience.MattErik wrote: LOL, had to laugh at Nick. I'll wait to hear from Matt after his upgrade before we attempt to do it again. I think Matt's and our servers handle about the same email volume. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick HayerSent: Monday, May 22, 2006 2:52 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] What happened to the logging since 2.x, it's HUGEHi Matt,Matt wrote: I'm trying an upgrade from the 2.x release for the first time, Why on earth would you want to do that? Was 2x too bug free and you need some excitement?-Nick
RE: [Declude.JunkMail] What happened to the logging since 2.x????, it's HUGE
Title: Message
Thanks
Matt,
Please
keep us posted on our results ("us" meaningthose that not running the the
latest 3.0.XX or 4.XX.XX release of Declude). I've mentioned this before;
Delculde will not support us for the 2.XX.XX version we run; even though we have
current service agreement). So your results will matter at least to us as
I said before, I think your servers and ours run about the the same amount of
inbound emails.
I'm
not sure, but I think you mentioned once to either me directly or to the list
that your servers are setup as a gateway? Ours are not. Our Declude
and Imail are on the same server.
Thanks,
-Erik
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Monday, May 22, 2006 11:02
PMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] What happened to the logging since 2.x, it's
HUGEEric and Greg,I'm basing the compatibility
thing on reports to this list, and those reports prompted Declude to change
it's architecture for processing messages. Something clearly was
happening, but I don't recall ever hearing exactly what the cause was. I
haven't tried 2.0.6.16 with IMail 8.22 myself yet, but I'm considering falling
back.MattErik wrote:
Thanks Matt.
We
are running Imail 8.22 (2005.10.19.3) and Declude version 2.06.16 on a
Windows 2000 Sever version5.00.2195 Service Pack 4 with will no issues
other then the ones I submitted to Declude for support and what I've
mentioned on this list (which they "declude" will not not provide us support
on since we do not run their "current" version)... but the problem even
exists in their "current" version according to the lists of others
postings.So unfortunately, Declude will not provide us support
(even though we are a paid customer of their product) based on the version
we run.
So
I'd be interested to know on our your servers run the latest 3.0X version of
Declude.
Thanks!
-Erik
-Original Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of MattSent: Monday, May 22, 2006 9:25
PMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] What happened to the logging since 2.x, it's
HUGEErik,Honestly, I was between a rock and a
hard place. Declude 2.x doesn't work with IMail 8.2+, and IMail
8.15- has issues with killer messages that crash the Queue Manager service
(which I found out the hard way, and 8.21 apparently fixes). For a
while the killer messages were somewhat common, and all it took was one
leaking through Declude to crash the services, and then you had to dig it
out of the spool.So to keep my Queue Manager stable, I had to make
the leap.I'll follow up with some comments about my
experience.MattErik wrote:
LOL, had to laugh at Nick. I'll wait to hear from Matt
after his upgrade before we attempt to do it again. I think Matt's
and our servers handle about the same email volume.
-Erik
-Original Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Nick HayerSent: Monday, May 22, 2006
2:52 PMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] What happened to the logging since 2.x,
it's HUGEHi Matt,Matt wrote:
I'm
trying an upgrade from the 2.x release for the first time,
Why on earth would you want to do that? Was 2x too bug
free and you need some
excitement?-Nick
RE: [Declude.JunkMail] Emails not be scanned by Declude
John, As I wrote to you before on 3/7/2006: I also wrote that 3.0X does not work for us; I did not say it does not work for you. Does your server receive 15,000 emails a day? Does your server host over 2000 email accounts? Like I said, the 3.0X version does not work for us and from the past emails on this list, others are experiencing the same. What works for you; does not work for us. The problem we have is that Declude is not handling headers correctly on inbound malformed email. Just like others to list are experiecing. Doesn't matter if they are running an old version of Declude or the latest. As with you, we've been on Declude since 1.26 as well. My point to David was that he denied support when a support was sent based on the fact we do not run the current version of Declude. Ridiculously? Hardly... Read the posts. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, May 02, 2006 12:04 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Emails not be scanned by Declude Because the is no fix. I can follow this newsgroup and see no reason to upgrade. Why upgrade and cause more issues/problems. Upgrading (and the list will show) that things that were once working got broke. And then later corrected back to the version we are running. And things that are mention on this list are things have been mentioned every since the 3.0 release. So why upgrade? Nothing is fixed. I can point to you many list emails. Erik, as it gets stated from time to time, the only reason you see mentions about problems is that I am not going to post on every list everytime I upgrade or update to a new version of company X's product Z's software that everything is fine. I have been using Declude since 1.26 and am currently running version 4.1.0. As with ALL software, there are bumps and bruises along the way but we preserver and continue on to the betterment of all. A statement of Nothing is fixed. is so ridiculously ultamative in form that it can not be taken seriously. John T eServices For You Seek, and ye shall find! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Emails not be scanned by Declude
Sorry Charlie, I'm not asking for a fix for version 2.0.6. I'm asking a fix to their latest release. One that others on this are asking for about Declude reading the headers who ARE using the latest release. And I've sent those emails to Declude. Seek, and ye shall find!; some of your post are just as ridiculous as others. Refer to your post on 3/10/2006 with a subject of: OT: SPAM from Invariant Systems. Sometimes you need to Seek until you shall find. No offense, John T. I know you and I have been on this list for a long time. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, May 02, 2006 12:11 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Emails not be scanned by Declude I want to make a correction to the list. The version we are running is 2.0.6 (not 1.82). David, my point is; why upgrade when the problem exists in Decludes' latest release as well. And why deny support. I can post your reply to this list if you want. Basically it was blunt in saying to upgrade to have further support. Granted, most software companies want you to upgrade to correct a problem or to see if the problem exists. The problem does exist as this list will show from others posting to it. We can take this off-list if you want. It was just your last email to us (via Declude support) was blunt and ended; until you wanted us to upgrade. -Erik Erik, send me a message in question (D and Q Files) zipped and off list and I will run then through my server to see what happens. As for upgrading, sorry Charlie there is going to be no fix to version 2.0.6. That means your understanding of what support is needs to change. You are asking for fix for 2.0.6 but without having to go to a version newer than that. Well, here is breaking news for you: Fixes have newer version numbers. Wow, who would have thought. So, unless you want to follow their instructions to use a newer version number, how do you expect the problem to be fixed? And no, I have absolutely nothing to do with Declude nor any one that works there nor with the creator/founder of Declude. John T eServices For You Seek, and ye shall find! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Mailing Lists - Etiquette - A gentle reminder
That's what I do. Separate email client for lists. That way my auto responders; tag lines, high importance flag, return receipts (requests and read) does not effect the lists I'm on. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Monday, March 13, 2006 3:02 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude Mailing Lists - Etiquette - A gentle reminder Why not set up a second email address and use Outlook Express or Thunderbird or whatever for your list activities? Then you can set the defaults to Text / Noreceipts, leave off the disclaimers, and never have to worry about it... -d --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: SPAM from Invariant Systems.
John, Darrell caught the SPAM and removed them from his list. They are/were a customer of Invariant Systems products and subed to his lists just like you and I do. They posted to the list. But Darrell was quick to take action. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Friday, March 10, 2006 11:49 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: SPAM from Invariant Systems. Importance: High I am posting this here to publicly shame them with intent. Invariant Systems is in the same business as most of us are. They also happen to sell a couple of apps that work well for Declude. Today they sent out to the lists that we who have purchased their software to work with Declude marketing material proclaiming their business. The lists are for the purpose of communicating with the purchasers of their software with a way for us to talk about problems and what not, the same as Declude is providing us with this list to communicate about Declude JM. I consider those SPAM! John T eServices For You Seek, and ye shall find! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: SPAM from Invariant Systems.
John should adhere to his tag line: Seek, and ye shall find! ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Saturday, March 11, 2006 12:31 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: SPAM from Invariant Systems. John, Actually shame on you. Had you did any bit of researching and asking before opening your mouth you mouth you would have found out the following facts: Innovation Networks is a subscriber of several of our lists. They inadvertently entered the email address of our list that they are a subscriber to into their CRM system. My understanding is that it should have been tagged not to receive their monthly newsletters. However, when they sent out a monthly newsletter it went to the lists we host for support of our products. It was an honest accident on their part and they have assured me they have corrected the issue. If you look at the email (again see my note from above) you would have seen there is absolutly no reference to any product we sell or support. Again, John shame on you. Next time do some research... Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, March 10, 2006 5:48 PM Subject: [Declude.JunkMail] OT: SPAM from Invariant Systems. I am posting this here to publicly shame them with intent. Invariant Systems is in the same business as most of us are. They also happen to sell a couple of apps that work well for Declude. Today they sent out to the lists that we who have purchased their software to work with Declude marketing material proclaiming their business. The lists are for the purpose of communicating with the purchasers of their software with a way for us to talk about problems and what not, the same as Declude is providing us with this list to communicate about Declude JM. I consider those SPAM! John T eServices For You Seek, and ye shall find! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking
Title: Message Another question: Why should we upgrade to 4.0? You charge more for this version as it's a canned package that we don't need. What do you mean by "since it does not appear you have upgraded to v 4"? Are you forcing everyone to pay more for the same product in order to have support? From others on the list, this problem exists in any of your versions. 2.06.16 runs with us with the exception noted below. Your 3.0X version does not work with us. Every time we've installed it; we've reverted back and from others on the list; it appears it is also the same. It is our understanding that your provide support to those that have a SA with you. We pay you for this. Our SA is current and has been since 2001. Please explain your words. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, March 06, 2006 7:19 PMTo: [EMAIL PROTECTED]Subject: [139-0B9B7BC7-18FF] Declude not inserting headers and MarkingErik,Our tracking and fixing of bugs is done on the latest version of Declude. This would be v 3.0.6 (since it does not appear you have upgraded to v 4). You will have to install the latest v 3 of the software and report whether you continue to experience this issue.As for the broken headers in general, all instances we have thus far seen of this have been spam sent from broken email clients. Because of the way the emails are processed, making changes at the present time to the header handling creates a high risk of causing serious problems elsewhere in the email. We are in the process of making several changes to the software, among which we have included a complete retooling of the header handling.David Franco-RochaDeclude Technical / Engineering From: "Erik" [EMAIL PROTECTED]Sent: Fri, 03 Mar 2006 22:12:23 -0500To: [EMAIL PROTECTED]Subject: Declude not inserting headers and MarkingHello,In a discussion on your list for the thread: "Re: [Declude.JunkMail]Damaged Image Files":Attached is an email with the "broken" image mentioned as well as our Imaillog and Declude log of that email.The email "passed" through Declude and did not insert any Declude headers ormarking.Note that this email was forwarded; but it was forwarded to another"virtual" domain on the same server; same Imail, same Declude.Running Declude version 2.06.16 / Imail 8.22-Erik
RE: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking
John, What David said was in plain text. Did you read it? Quote: This would be v 3.0.6 (since it does not appear you have upgraded to v 4). And my response was why he mentioned to upgrade to 4.0 when it's really a canned package of 3.0X. I think my comments were inline. I also wrote that 3.0X does not work for us; I did not say it does not work for you. Does your server receive 15,000 emails a day? Does your server host over 2000 email accounts? Like I said, the 3.0X version does not work for us and from the past emails on this list, others are experiencing the same. I have nothing against Declude as we have continued to renew our agreement as Declude has been productive with us until their 3.0X release and the problem noted in the email. And the problem noted has also been presented by other customers of Declude. So yes, it should brought to the list. Sorry to offend you; read it and move on and learn. As with you, we too have been with Declude for many years. You and I both know of it's up's and down's and learning experience of the new Declude owners. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, March 07, 2006 5:41 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking Erik, I fail to see any where in David's response to you where he is telling you to upgrade to version 4. You post also shows your lack of understanding on the licensing for version 4. As for the actual problem, I have seen this but as David has said every message was spam and had broken headers. So, while I would like to see it fixed, it is no where on my priority list of what I want to see fixed/changed from Declude. As for version 3.0.x, I have been running it for quite a while without reverting back. IMHO, it is in very poor taste to post your message here. Barry's contact information is readily available and if you have issues with Declude you are free to contact him directly. John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Tuesday, March 07, 2006 4:42 AM To: [EMAIL PROTECTED] Cc: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking Another question: Why should we upgrade to 4.0? You charge more for this version as it's a canned package that we don't need. What do you mean by since it does not appear you have upgraded to v 4? Are you forcing everyone to pay more for the same product in order to have support? From others on the list, this problem exists in any of your versions. 2.06.16 runs with us with the exception noted below. Your 3.0X version does not work with us. Every time we've installed it; we've reverted back and from others on the list; it appears it is also the same. It is our understanding that your provide support to those that have a SA with you. We pay you for this. Our SA is current and has been since 2001. Please explain your words. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, March 06, 2006 7:19 PM To: [EMAIL PROTECTED] Subject: [139-0B9B7BC7-18FF] Declude not inserting headers and Marking Erik, Our tracking and fixing of bugs is done on the latest version of Declude. This would be v 3.0.6 (since it does not appear you have upgraded to v 4). You will have to install the latest v 3 of the software and report whether you continue to experience this issue. As for the broken headers in general, all instances we have thus far seen of this have been spam sent from broken email clients. Because of the way the emails are processed, making changes at the present time to the header handling creates a high risk of causing serious problems elsewhere in the email. We are in the process of making several changes to the software, among which we have included a complete retooling of the header handling. David Franco-Rocha Declude Technical / Engineering From: Erik [EMAIL PROTECTED] Sent: Fri, 03 Mar 2006 22:12:23 -0500 To: [EMAIL PROTECTED] Subject: Declude not inserting headers and Marking Hello, In a discussion on your list for the thread: Re: [Declude.JunkMail] Damaged Image Files: Attached is an email with the broken image mentioned as well as our Imail log and Declude log of that email. The email passed through Declude and did not insert any Declude headers or marking. Note that this email was forwarded; but it was forwarded to another virtual domain on the same server; same Imail, same Declude. Running Declude version 2.06.16 / Imail 8.22 -Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking
I agree with you Matt that these type of flaws should be treated with top priorities rather a feature enhancement request. To us, this is SPAM and Declude is to prevent this. A lot has been broken in the initial 3.0.6 release and was gradually corrected in other releases (that where working in previous versions of Declude). You and I have been around Declude long enough to see this as well as others. What gateway are you using to normalizes the headers before it reaches Declude? If this isn't a priority of Declude to fix; then I'd be interested alternatives. It's the same with Declude's confirm (yes a freebie); but has worked since nearly it's concept. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Tuesday, March 07, 2006 6:48 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking Erik, I believe that you can get 3.0 to work for you, but you probably have to tweak the default settings. Out of the box, the default settings seem to cause issues with higher volume hosts, but they can be tweaked. It also appears to be mostly stable now, though I'm not using it either at this moment. I'm don't believe that 3.0.6 will provide resolution for this particular issue, but I wouldn't expect for them to patch the 2.x versions at this point so if it is fixed, it will probably require an upgrade to the new version. Personally, I would like to see things like this handled as top priorities instead of treating them like feature requests. Any bug that causes spam or viruses to be missed is critical in my view, and I'm sure most others around here would agree. I do recognize that Declude wants to re-write large chunks of their code, but in cases like this, it seems appropriate to respond with a more timely fix. I do see this as a disconnect with some of us, but I don't think it is the result of any bad intentions, just a different view of priorities. I would like to help Declude understand why such things need more attention. There is no doubt that the E-mail is 'broken', but both good and bad E-mail comes this way, and as long as our servers will deliver it, and our clients will read it, we need a proper way to handle it. The inability to handle the headers could also be causing other pieces of functionality to not work properly, and the inability to add headers or tag subjects makes this bug cause E-mail to slip when one uses either method for identifying spam after Declude does it's work. Personally, I'm not affected by this bug due to my gateway which normalizes the headers before it reaches Declude, but that gateway will soon change to another product and I'm not sure if I am also going to be affected by this. Matt Erik wrote: John, What David said was in plain text. Did you read it? Quote: This would be v 3.0.6 (since it does not appear you have upgraded to v 4). And my response was why he mentioned to upgrade to 4.0 when it's really a canned package of 3.0X. I think my comments were inline. I also wrote that 3.0X does not work for us; I did not say it does not work for you. Does your server receive 15,000 emails a day? Does your server host over 2000 email accounts? Like I said, the 3.0X version does not work for us and from the past emails on this list, others are experiencing the same. I have nothing against Declude as we have continued to renew our agreement as Declude has been productive with us until their 3.0X release and the problem noted in the email. And the problem noted has also been presented by other customers of Declude. So yes, it should brought to the list. Sorry to offend you; read it and move on and learn. As with you, we too have been with Declude for many years. You and I both know of it's up's and down's and learning experience of the new Declude owners. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, March 07, 2006 5:41 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] [139-0B9B7BC7-18FF] Declude not inserting headers and Marking Erik, I fail to see any where in David's response to you where he is telling you to upgrade to version 4. You post also shows your lack of understanding on the licensing for version 4. As for the actual problem, I have seen this but as David has said every message was spam and had broken headers. So, while I would like to see it fixed, it is no where on my priority list of what I want to see fixed/changed from Declude. As for version 3.0.x, I have been running it for quite a while without reverting back. IMHO, it is in very poor taste to post your message here. Barry's contact information is readily available and if you have issues with Declude you are free to contact him directly. John T eServices For You Seek, and ye shall find! -Original
RE: [Declude.JunkMail] Damaged Image Files
Title: Message Matt, I have sent Declude what I sent you. I'll keep you and the list posted; if Declude does not. Thanks for your time and input, Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Saturday, March 04, 2006 3:56 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Damaged Image FilesEric,Forwarded E-mail that goes outside of your server is handled by actions contained within the Global.cfg instead of a JunkMail file. This causes a lot of confusion. This would explain some of the issues. If you have questions about this, just post them to the list and I or someone else will help out.Forwarded E-mail within the same server I believe is always handled by a JunkMail file. This is clearly the case in the sample that you sent me off-list. Your logs on that sample shows the SUBJECT action should have been called and it seems that it wasn't. I believe that the message is using non-compliant line breaks based on other reports for this spammer, and this is probably why it didn't put the SUBJECT in (or rather the bugs in Declude in handling poorly formated messages).You should forward what you sent me to Declude's support and let them know that this is in reference to the discussion on the list about missing/broken headers and zombie spam. Even though the messages are broken, Declude is clearly not handling them properly and it should be fixed.Thanks for following up. Please share whatever else you find with the list. MattErik wrote: Matt, I have emailed you off-list with an example of this type of email that Declude fails to "mark". Let me know if you receive it. I attached the email along with our Imail log and Declude log. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Tuesday, February 28, 2006 8:18 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Damaged Image FilesErik,I don't doubt the possibility of a bug causing the scanning of such a message to fail, but there is a possibility of this also just simply being a spam that passed, and a failure to insert the headers in the correct place. It would be great if you guys could supply the full source of one such E-mail and check your logs for an entry that matches, and clarify which version you are running.Thanks,MattErik wrote: Yes, they are passing SNIFFER and Darrell's INV-URIBL at this time. But what Evans wrote is true. Either this "spammer" has corrected "his" image.. the fact remains that in the past when it was a corrupted; Declude failed in our version. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, AndrewSent: Tuesday, February 28, 2006 7:34 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files Ditto. I've received and held 24 messages with the same title. Re-queuing 3 of these to myself, they had an image that was intact. They fail the usual RBL tests plus Message Sniffer. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Harry VanderzandSent: Tuesday, February 28, 2006 10:10 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files Judgement is quick to pass for some around here. These are getting caught by my system X-Note: Spam Tests Failed: SBL [28], SORBS-DUHL [4], HELOBOGUS [3], SNIFFER [13] Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of ErikSent: Tuesday, February 28, 2006 12:49 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files The problem that we've seen this "spammer" is that the image is corrupted as you mentioned... and Declude is exiting; thus why it's being allowed to be delivered. "Smart" coding on the spammer... Not so smart on Declude. -Erik -Original Message-From: [EMAIL PR
RE: [Declude.JunkMail] Damaged Image Files
Title: Message The problem that we've seen this "spammer" is that the image is corrupted as you mentioned... and Declude is exiting; thus why it's being allowed to be delivered. "Smart" coding on the spammer... Not so smart on Declude. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave BeckstromSent: Tuesday, February 28, 2006 6:41 PMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Damaged Image Files Were getting the same. Also using Declude with smartermail. Because Declude doesnt appear to be scanning the headers there is no way for us to stop them. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans MartinSent: Tuesday, February 28, 2006 12:38 AMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Damaged Image Files Im getting a lot of messages that have only a graphic in them. The graphic appears to have been damaged as only about ½ of it displays. Declude has not modified the headers at all so Im not sure if these are being scanned or not. I dont know how it could be bypassing Declude. I have attached the .msg file. Anyone have any ideas what might be causing this? Im running Declude 3.0.5.22 and SmarterMail 2.6. The header is as follows: Return-Path: [EMAIL PROTECTED] Tue Feb 28 00:24:32 2006 Received: from 225-65-10-72.planters.net [72.10.65.225] by matrix.martek.net with SMTP; Tue, 28 Feb 2006 00:24:32 -0600 Date: Tue, 28 Feb 2006 01:24:22 +0100 Return-path: [EMAIL PROTECTED] From: "Abrahams"[EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: C1alis 10 Pills 20 mg $89.95 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="ms020700070106060404020304" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser IPBs IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96
RE: [Declude.JunkMail] Damaged Image Files
Title: Message Yes, they are passing SNIFFER and Darrell's INV-URIBL at this time. But what Evans wrote is true. Either this "spammer" has corrected "his" image.. the fact remains that in the past when it was a corrupted; Declude failed in our version. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Tuesday, February 28, 2006 7:34 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files Ditto. I've received and held 24 messages with the same title. Re-queuing 3 of these to myself, they had an image that was intact. They fail the usual RBL tests plus Message Sniffer. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Tuesday, February 28, 2006 10:10 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files Judgement is quick to pass for some around here. These are getting caught by my system X-Note: Spam Tests Failed: SBL [28], SORBS-DUHL [4], HELOBOGUS [3], SNIFFER [13] Harry Vanderzand inTown Internet Computer Services 519-741-1222 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ErikSent: Tuesday, February 28, 2006 12:49 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Damaged Image Files The problem that we've seen this "spammer" is that the image is corrupted as you mentioned... and Declude is exiting; thus why it's being allowed to be delivered. "Smart" coding on the spammer... Not so smart on Declude. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave BeckstromSent: Tuesday, February 28, 2006 6:41 PMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Damaged Image Files Were getting the same. Also using Declude with smartermail. Because Declude doesnt appear to be scanning the headers there is no way for us to stop them. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans MartinSent: Tuesday, February 28, 2006 12:38 AMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Damaged Image Files Im getting a lot of messages that have only a graphic in them. The graphic appears to have been damaged as only about ½ of it displays. Declude has not modified the headers at all so Im not sure if these are being scanned or not. I dont know how it could be bypassing Declude. I have attached the .msg file. Anyone have any ideas what might be causing this? Im running Declude 3.0.5.22 and SmarterMail 2.6. The header is as follows: Return-Path: [EMAIL PROTECTED] Tue Feb 28 00:24:32 2006 Received: from 225-65-10-72.planters.net [72.10.65.225] by matrix.martek.net with SMTP; Tue, 28 Feb 2006 00:24:32 -0600 Date: Tue, 28 Feb 2006 01:24:22 +0100 Return-path: [EMAIL PROTECTED] From: "Abrahams"[EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: C1alis 10 Pills 20 mg $89.95 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="ms020700070106060404020304" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thanks, Evans Martin EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser IPBs IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96
RE: [Declude.JunkMail] Banks (and Ebay) Phising Filters
Kami, Thank you for the files; this is great! We can use this and customize for us. Thank you, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, February 20, 2006 10:40 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Banks (and Ebay) Phising Filters Erik: We have a set of filters as follows: - Phish_Body_bankName.txt - Phish_Body_words.txt - Phish_Header_Bankname.txt - Phish_TestsFailed.txt Hope it is not a problem to send zip files (3k) to the list. [PHISH.EXCEPTION.PAYPAL]filter C:\IMail\Declude\Filters\Phish_Exception_PayPal.txt x 0 0 [PHISH.HEADER.BANKNAME] filter C:\IMail\Declude\Filters\Phish_HEADER_BankName.txt x 0 0 [PHISH.BODY.BANKNAME] filter C:\IMail\Declude\Filters\Phish_Body_BankName.txtx 0 0 [PHISH.BODY.WORDS] filter C:\IMail\Declude\Filters\Phish_Body_Words.txt x 0 0 [PHISH.ATTEMPT] filter C:\IMail\Declude\Filters\Phish_TestsFailed.txt x 1000 0 I reroute any weight of 1000 and more to the admin account for review with PHISH in the subject. WEIGHT-REDIRECT-FRAUD-S SUBJECT [PHISH: %WEIGHT%] WEIGHT-REDIRECT-FRAUD-R ROUTETO [EMAIL PROTECTED] So far we have not had any false positives.. A few happened when people were using ebay response to ask seller options. So we wrote an exception filter. It works like a charm. We are seeing now clean IP's and new tactics .. Like using: @secure-chase.com Our filters were looking for @chase.com - so this is a new set of changes I am making as I am seeing them. Hope this helps. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Friday, February 17, 2006 6:32 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Banks (and Ebay) Phising Filters Help from you all: We've setup the following individual filters for major banks that are phising scams (and ebay.com) Do you see any problems with using the following (we mark as SPAM at weight 70): HEADERS END NOTCONTAINS wellsfargo.com BODY 0 CONTAINS .wellsfargo.com SUBJECT 30 CONTAINS account REVDNS 50 NOTENDSWITH .wellsfargo.com #Give weight back for users that forward or use reply for REAL email from wellsfargo.com SUBJECT -40 STARTSWITH re: SUBJECT -40 STARTSWITH fwd: SUBJECT -40 STARTSWITH fw: Citibank uses different REVDNS from what we've noticed. The envelope from is generally @citibank.com and the REVDNS is .ssmb.com OR .citibank.com or .citicorp.com How do you all deal with this? Same with SearsCard.com... they are also Citibank and coming from ssmb.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Banks (and Ebay) Phising Filters
Scott, So Clam AV detects these? We do have Declude AV but, not the PRO version and I think only this version can use multiple AV programs? We use the standard with F-PROT. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Sunday, February 19, 2006 8:18 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Banks (and Ebay) Phising Filters If you have Declude Virus, and can afford the CPU time... The best phish beater I have is Clam AV and PRESCAN ON. With bank consolodations, the using the reverse dns can be dicey. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, February 17, 2006 5:32 PM Subject: [Declude.JunkMail] Banks (and Ebay) Phising Filters Help from you all: We've setup the following individual filters for major banks that are phising scams (and ebay.com) Do you see any problems with using the following (we mark as SPAM at weight 70): HEADERS END NOTCONTAINS wellsfargo.com BODY 0 CONTAINS .wellsfargo.com SUBJECT 30 CONTAINS account REVDNS 50 NOTENDSWITH .wellsfargo.com #Give weight back for users that forward or use reply for REAL email from wellsfargo.com SUBJECT -40 STARTSWITH re: SUBJECT -40 STARTSWITH fwd: SUBJECT -40 STARTSWITH fw: Citibank uses different REVDNS from what we've noticed. The envelope from is generally @citibank.com and the REVDNS is .ssmb.com OR .citibank.com or .citicorp.com How do you all deal with this? Same with SearsCard.com... they are also Citibank and coming from ssmb.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] blacklist file
Title: Message There's a manual for Declude? Where? hahaha joking... I don't think the "manual" has been updated since the 14th Century. Every timewe've needed to lookup a statement in Declude from searching on the list that others are using; it's not in the "manual". A product should have a manual. Declude lacks in this. A manual needs to go with "a working" product. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guhl, Markus (LDS)Sent: Tuesday, February 21, 2006 3:09 PMTo: Declude.JunkMail@declude.comSubject: AW: [Declude.JunkMail] blacklist fileSensitivity: Confidential hi, according to the manual (http://www.declude.com/Version/Manuals/JunkMail/JM_3.0.5.asp) "6.9 Your own sender blacklists" you need some file (blacklist.txt) with the adresses you want to block. this file needs lines like: @mastercardconfirm.com bad adress [EMAIL PROTECTED] spams my folders badserver.com spamsending server please note, that you need an adress AND a reason in every line. the next thing is a line in you're global cfg like: BLACKLIST fromfileC:\IMAIL\Declude\Filters\blacklist.txtx200 this would punish every mail that was send by an adress that is in you're blacklist.txt with a weight of 20 points (so this would only block the mail if you hold mails with a weight of 20 or more). if you want to block the mail right away you need a line in you're $default$.junkmail like BLACKLIST HOLD or BLACKLIST DELETE an other way to block mails by the senderadress is imail itselfe. there should be something like a "SMTP inbound kill list" (i have something like that in my imail 7.14). hope it helps best regards from germany mfgi.a.gez.markus guhl***lds nrwref. 241tel.: 0211 9449 6947fax.: 0211 9449 8344mailto:[EMAIL PROTECTED]*** Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Craig EdmondsGesendet: Dienstag, 21. Februar 2006 11:44An: Declude.JunkMail@declude.comBetreff: [Declude.JunkMail] blacklist fileWichtigkeit: HochVertraulichkeit: Vertraulich Newbie question here... Using Declude 3.05 on IMAIL. I want to blacklist email addresses so that when a spammer sends an email to my server, the email does not go through to my end users. my global.cfg file has the following line.. BLACKLIST fromfile C:\IMAIL\Declude\Filters\blacklist.txtx200 My blacklist.txt file has the following entry BLACKLIST FROM @mastercardconfirm.com Is the above syntax correct for blocking email addresses/domains? Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.comE : [EMAIL PROTECTED]
[Declude.JunkMail] Banks (and Ebay) Phising Filters
Help from you all: We've setup the following individual filters for major banks that are phising scams (and ebay.com) Do you see any problems with using the following (we mark as SPAM at weight 70): HEADERS END NOTCONTAINS wellsfargo.com BODY 0 CONTAINS .wellsfargo.com SUBJECT 30 CONTAINS account REVDNS 50 NOTENDSWITH .wellsfargo.com #Give weight back for users that forward or use reply for REAL email from wellsfargo.com SUBJECT -40 STARTSWITH re: SUBJECT -40 STARTSWITH fwd: SUBJECT -40 STARTSWITH fw: Citibank uses different REVDNS from what we've noticed. The envelope from is generally @citibank.com and the REVDNS is .ssmb.com OR .citibank.com or .citicorp.com How do you all deal with this? Same with SearsCard.com... they are also Citibank and coming from ssmb.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ? Name Voting Time
I agree with Markus. First have a working product, then name it. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Thursday, February 16, 2006 10:46 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] ? Name Voting Time dreamI imagine how I will install Declude Security Suite 2006 - Service Pack 3 and nearly everything is working as it should - including things like thread-differentiated internal variables... :-) /dream Well: for me it's absolutley not important if it will be called suite or yust declude.exe. Central issue: It should work and have as many features as possible _before_ it turns out a Saturday evening that we need it urgently to manage our email traffic. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Thursday, February 16, 2006 3:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] ? Name Voting Time Yeah, I agree, Security Suite is the best so far. Definitely no 4 in there. For now, it's still Version 3 - just repackaged differently. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Evans Martin Sent: Thursday, February 16, 2006 09:15 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] ? Name Voting Time Cool! This one is even better! Wish I had seen it before I posted in favor of simply Suite. Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, February 15, 2006 10:18 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] ? Name Voting Time I'd like to vote for a write-in g Declude Mail Security Suite You can add a 4 in there if you want...as in Declude Mail Security Suite 4.0 Darin. - Original Message - From: Barry Simpson [EMAIL PROTECTED] To: Declude.JunkMail@declude.com; Declude.Virus@declude.com Sent: Wednesday, February 15, 2006 5:39 PM Subject: [Declude.JunkMail] ? Name Voting Time Here are the choices: Please send your votes to [EMAIL PROTECTED] no later than 5pm Eastern Time Friday 17th February. - Declude Quattro - DEC4 - Suite4 - R/4 (release four) - Declude Total - Declude Power Suite 4 - Declude Max4 - Declude ForePlay just making sure you're paying attention) - Declude-ES4 (E-mail security 4) Thanks Barry --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
RE: [Declude.JunkMail] Declude 3.0 / 4.0
Title: Message Very well said, Matt. I mentioned in my earlier post about this as well. The product has not advanced to counter weight the costs; nor is there a truly working product "release" for 100% of the users. Time spent tweaking and paying for 3rd party plug-ins is expensive. For us, we've been considering going back to open source. We are already spending time on tweaking Declude and paying for it; might as well spend that time tweaking a free product. Declude is a maintenance nightmare when you have to train someone to handle what is already in place. Their documentation is not update with their product. It's a lot of time on the end user end. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Sunday, February 12, 2006 9:10 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Declude 3.0 / 4.0Barry,Before you publish your future strategy, you should take a lot more time to consider the willingness of your customers to come along. I have never heard of a similar piece of software that expires in this way, and effectively forces a customer to renew their license. The only things that are remotely close are Microsoft products which are sold a different way for volume licensing, but they offer these subscriptions at a price that is just a fraction of the full product price, they are generally considered to be discounted by the companies purchasing them, and the choice is optional to choose the subscription or the standard purchase. That is clearly not the case here.Declude is not a service, it's a piece of software, and I expect to pay for software the way that software is paid for. I will never pay an annual license to use such a piece of software. Never. Especially when that piece of software requires me to pay for multiple other products in order to have acceptable protection, and work many long hours in developing plug-ins to enhance functionality that doesn't exist in the product itself. The strength of Declude is it's flexibility as a framework, but not as a solution in itself. There is a major disconnect between your perception of the market, and what I an others on this end see.While this model might seem appealing to you, it is grossly uncompetitive, and it comes at an incredibly inopportune time. We as a community have been mostly understanding of the disruption associated with the change of ownership, but up to this point there has been only small advancements in the product that benefit us. With the exception of one piece of added functionality, I could still be using the same release that I was using two years ago when you took over the company. Whether or not it is apparent to you, it is very apparent to the majority of your customers that I communicate with that the product is lagging, and not it is being priced uncompetitively on top of that. People who are one day faced with the prospect of renewing a service agreement and feeling angry over not having used a single release in the previous year are now being faced with a choice between a dead-end product (non-annually licensed software), and upgrading to an annual license at a greatly increased price.The issues with development and price on their own aren't my only concerns. Since I see this as grossly uncompetitive, I also worry about whether or not Declude can be a going concern under these conditions, and a large part of my own business has been built on top of the functionality that the product offers. I don't perceive the possibility of success in this model, and I likewise don't believe that I can rely on Declude going forward as long as this is the model that you choose. As a business person, I must protect my own interests and find a suitable solution for my needs.It's not yet too late to rethink your licensing and other plans going forward, but I fear that you won't get very far before the damage can't be undone.MattBarry Simpson wrote: Each customer has a price on their host record which reflects their individual special price. This is confidential for each customer and I will not be posting details on a public forum. We are currently developing some documentation that should be published next week outlining changes and future strategy. As soon as this is available we will inform our customers. Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Sunday, February 12, 2006 10:03 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 3.0 / 4.0 I misspoke... switch SA for upgrade. Also, please answer the implicit questions at the end of the email as well. Thanks, Darin. - Original Message - From: "Barry Simpson" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, Fe
[Declude.JunkMail] COUNTRIES and COUNTRYCHAIN and Filters
In our GLOBAL.CFG we make use of %COUNTRYCHAIN% to be placed in our headers. We have several filters that use COUNTRIES Are these 2 different? Example of one failed email: From the Declude Log: 02/10/2006 11:26:37 QDADA01EA87F1 Triggered COUNTRIES STARTSWITH filter MN-HOTMAILSCAM on US [weight-0; US UK ]. From the HEADER using %COUNTRYCHAIN%: X-MN: Country Chain: UNITED KINGDOM-UNITED STATES-destination COUNTRIES is showing that it started in US but the COUNTRYCHAIN is showing a starting in UK. This is causing our filter not to work. Are we doing this wrong? And it's our understaning that COUNTRYCHAIN can NOT be used in a filter. -Erik --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What are all the NOT comparable statements in Declude?
For example: NOTCONTAINS Are these available?: NOTENDSWITH NOTSTARTSWITH Thanks! Erik --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail 3.0 is out - has anyone tried it yet?
Title: Message Hi Luis, What is your average count of inbound/outbound email messages on your server and what type of server specs/speed? -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A. Luis Alberto ArangoSent: Thursday, February 09, 2006 8:10 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] SmarterMail 3.0 is out - has anyone tried it yet? I just upgraded my production/testing server from professional 2.6 (unlimited) to 3.0 unlimited (I am running in that box 220 users in 15 sites). Plan to work with over 300 domains and 4500 usersfrom my current Imail installation. so far I like the product very, very much. Ithas some things only available in Imail until now. For example the ability to send an email directly to a subfolder in the mailbox account or read from an specific folder via POP3. It is called Plus Addressing The SMTP port uses also an alternate port. "Users will be able to access their mail through either the SMTP port and the alternate SMTP port, as both will be available simultaneously. I haven't tested yet." It has also: Message archiving per domain seems to be working fine. It is organized by date. Outlook integration is only one way. From your Outlook you can see your calendar, contacts, tasks. It is very easy to setup, and works perfectly. Calendar, Tasks and Contacts intregration within the domain works great, but have't tested deeeply yet. You can import and export contacts easily. Message preview is a fantastic Speed is great if you have a good internet connection of course. more here http://www.smartertools.com/Products/SmarterMail/ReleaseNotes.aspx I am using declude and sniffer (persistent mode) and so far no problem. I will upgrade to version 4.08 there are a lot.. lot.. lot of new features. Not all tested yet.. but so far I am extremely pleased with it. give me a few days and I will keep posting what I found with it. Luis Arango From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert E. SpivackSent: Jueves, 09 de Febrero de 2006 02:37 a.m.To: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] SmarterMail 3.0 is out - has anyone tried it yet? According to SmarterTools site, version 3 is finally out. Im anxious to hear if the port 587 stuff is working right, among all the other new things this one is important catch-up feature with Imail. It also looks like they added subfolder handling to smtp and pop just like Imail.
RE: [Declude.JunkMail] What are all the NOT comparable statements in Declude?
I agree! NOTSTARTSWITH would be useful. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, February 09, 2006 10:46 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] What are all the NOT comparable statements in Declude? Scott, These were introduced one at a time based on Scott's interest and proof of a need (or so it seemed). I think that you might have nailed down the list pretty good, or at least those three are the ones that I am familiar with. NOTSTARTSWITH of course makes sense as an addition. Matt Scott Fisher wrote: NOTCONTAINS was introduced in 1.79i7. NOTENDSWITH was introduced in 1.78. Bug with country filters fixed 1.79i6. Pairs nicely with MAILFROM and REVDNS. NOTIS was introduced in 179i16. no NOTSTARTSWITH... - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, February 09, 2006 1:01 PM Subject: [Declude.JunkMail] What are all the NOT comparable statements in Declude? For example: NOTCONTAINS Are these available?: NOTENDSWITH NOTSTARTSWITH Thanks! Erik --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] elabs3.com
John, We were at point blocking them or weighted them heavy until several of our customers where complaining about missing emails. In my opinion should be blocked; but we are letting them come in now as well as elabs4.com. To me, they are on the same line as ed10.com, m0.net, etc. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Wednesday, February 08, 2006 9:01 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] elabs3.com What do others have about this sender? John T eServices For You Seek, and ye shall find! --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spam tactic???
I guess it is! We've had 2 reports day about it (and both ARE real estate agents; say he is not on their list). Interesting -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Saturday, February 04, 2006 7:37 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] New spam tactic??? Almost all of my agents received a letter like this: -- Original Message -- From: Joe Anderson [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Fri, 3 Feb 2006 22:21:39 -0500 I believe I received an real estate newsletter from Joseph Moleano in Tarrytown, NY. Please remove me from future emails. Thanks Joe It seems very personal, addressed to the agent and with a reference to the town the agent's office is in or service - but none of the agents sent a newsletter to this guy. I e-mailed him for a copy of it to make sure my agents weren't spamming and very soon after I started to get more than usual Viagra ads directed right to me, almost as if my reply subscribed me to the suckers list. Just wondering if anyone else has seen anything like this. I have included the headers below: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A0CE902BD0086B842; Fri, 3 Feb 2006 21:09:47 Received: from rrcs-queue-03.hrndva.rr.com [24.28.200.155] by mail.prudentialrand.com with ESMTP (SMTPD32-8.15) id ACE92BD0086; Fri, 03 Feb 2006 21:09:45 -0500 Received: from rrcs-fep-10.hrndva.rr.com (rrcs-fep-10b.hrndva.rr.com [172.28.200.148]) by rrcs-queue-03.hrndva.rr.com (8.13.5+Sun/8.12.10) with ESMTP id k1429WcM008010 for [EMAIL PROTECTED]; Fri, 3 Feb 2006 21:09:32 -0500 (EST) Received: from ZBDS ([24.199.134.250]) by rrcs-fep-10.hrndva.rr.com with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Fri, 3 Feb 2006 21:08:32 -0500 From: Joe Anderson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Unsubscribe from Realtor Newsletter Date: Fri, 3 Feb 2006 21:03:28 -0500 MIME-Version: 1.0 X-Mailer: Internal Email Service (4.1.1.692) Message-ID: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Declude-Sender: [EMAIL PROTECTED] [24.28.200.155] X-Declude-Spoolname: D0CE902BD0086B842.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: CATCHALLMAILS [0] X-Country-Chain: X-Note: This E-mail was sent from rrcs-mta-03.hrndva.rr.com ([24.28.200.155]). X-RCPT-TO: Status: U X-UIDL: 428126141 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] F-Prot
Hi Richard, We use a scheduled task in Windows. We've removed the Scheduler from FPROT and use this command line: C:\Program Files\FSI\F-Prot\FP-Updater\Updater.exe /INTERNET /QUIT /HIDDEN And we run that task every 4 hours. No errors as of yet on our end as we have experienced the same as you have with using FPROT's scheduler. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Tuesday, January 31, 2006 1:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] F-Prot A lot of times my server has an error on it that it encountered an error while trying to update F-Prot and I hit OK and then it goes ahead and updates...is there a way to automatically say OK so it will go ahead and update... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] F-Prot
Simple BAT File: - C:\Program Files\FSI\F-Prot\FP-Updater\Updater.exe /INTERNET /QUIT /HIDDEN - We do not use a BAT file, it's just a command line in the Windows Task Scheduler -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Shimwell Sent: Tuesday, January 31, 2006 3:26 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] F-Prot How do you write that in a bat file? Kevin Shimwell Link Brokers Group, Inc. 1600 Hwy 17 South North Myrtle Beach, SC 29582 Phone: 843-663-1004 Fax: 843-663-1007 Email: [EMAIL PROTECTED] 24/7 Help :http://www.linkbrokers.com/help_ticket.cfm Support Forum: http://www.linkbrokers.com/chatboard/index.cfm?CFB=1 Support M-F 1-888-546-5631 This message is intended only for the use of the individual or entity towhich it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and/or e-mail. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Tuesday, January 31, 2006 7:24 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] F-Prot Hi Richard, We use a scheduled task in Windows. We've removed the Scheduler from FPROT and use this command line: C:\Program Files\FSI\F-Prot\FP-Updater\Updater.exe /INTERNET /QUIT /HIDDEN And we run that task every 4 hours. No errors as of yet on our end as we have experienced the same as you have with using FPROT's scheduler. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Tuesday, January 31, 2006 1:13 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] F-Prot A lot of times my server has an error on it that it encountered an error while trying to update F-Prot and I hit OK and then it goes ahead and updates...is there a way to automatically say OK so it will go ahead and update... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by Link Brokers Group, Inc Virus Protection] [This E-mail scanned for viruses by Link Brokers Group, Inc Virus Protection] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Another forged Declude address e-mail?
Yep, here too. The message exceeded weight of 200+ You'd think Declude would know how to use the DELETE action of their software. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of mail-lists Sent: Tuesday, January 31, 2006 4:45 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Another forged Declude address e-mail? This one came to my main address not the list (obviously...) Received: from declude.com [63.246.13.90] by cottonwoodfinancial.com with ESMTP (SMTPD-8.21) id A4E201A0; Tue, 31 Jan 2006 09:40:18 -0600 Received: from asdfas.net [213.136.107.177] by mail.declude.com (SMTPD32-8.05) id A23124B00D4; Tue, 31 Jan 2006 10:28:49 -0500 Message-ID: [EMAIL PROTECTED] Subject: CBL:colander medley Date: Tue, 31 Jan 2006 10:27:37 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0001_01C62650.F51D11C0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c03]. X-RBL-Warning: WEIGHT10: Weight of 204 reaches or exceeds the limit of 100. X-RBL-Warning: WEIGHT20: Weight of 204 reaches or exceeds the limit of 200. X-Declude-Sender: [EMAIL PROTECTED] [213.136.107.177] X-Declude-Spoolname: D8231024b00d4a426.smd X-Declude-Note: Scanned by Declude 4.0.2b for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [204] at 10:29:11 on 31 Jan 2006 X-Declude-Fail: CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50], WEIGHT10 [100], WEIGHT20 [200], WEIGHT20b [200] X-Country-Chain: [RIPE Unlisted]-destination X-Declude-IM_IN: Precedence: bulk Sender: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [63.246.13.90] X-Declude-Spoolname: D84e201442505.smd X-Declude-Note: Scanned by Declude 3.0.5.5 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [0] at 09:40:34 on 31 Jan 2006 X-Declude-Tests: Whitelisted X-Country-Chain: [RIPE Unlisted]-UNITED STATES-destination From: [EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 434752482 X-IMail-ThreadID: 84e201442505 Cavell McDermott Network Administrator Cottonwood Financial 972.753.0822 Office 214.403.4918 Cell http://www.thecashstore.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 31, 2006 9:28 AM Subject: CBL:colander medley V V C l A l A L A G l L R U l A M S $ $ $ 69 85 99 ( ( ( 10 30 10 ) ) ) See more at http://www.sairabbin.com Quit overpaying for your meds with http://www.sairabbin.com Confidentiality Notice: The information contained in this transmission is intended only for the personal and confidential use of the designated recipient named above. If the receiver of this transmission is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error, and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you are not the intended recipient, please immediately notify the sender and delete this e-mail message from your system. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Another forged Declude address e-mail?
And this has what to do with the influx of immigrants from Russia to Czech Republic? My statement was a joke. Notice the ;-) at the end. However, giving the fact that Declude is in the business of SPAM control, this should have been prevented. Look that their X-Declude headers. And from a standpoint of being in the SPAM preventing software; they should also secure their SMTP to prevent outside posts to groups. Wouldn't the test on the email CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50] be enough for a COMBO test to be used to filter to a HOLD or DELETE? No, I'm not bashing Declude. We've been a Declude user since 2000. Just pointing out the obvious. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, January 31, 2006 6:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? http://dictionary.reference.com/search?q=irony -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Tuesday, January 31, 2006 7:56 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? Yep, here too. The message exceeded weight of 200+ You'd think Declude would know how to use the DELETE action of their software. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of mail-lists Sent: Tuesday, January 31, 2006 4:45 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Another forged Declude address e-mail? This one came to my main address not the list (obviously...) Received: from declude.com [63.246.13.90] by cottonwoodfinancial.com with ESMTP (SMTPD-8.21) id A4E201A0; Tue, 31 Jan 2006 09:40:18 -0600 Received: from asdfas.net [213.136.107.177] by mail.declude.com (SMTPD32-8.05) id A23124B00D4; Tue, 31 Jan 2006 10:28:49 -0500 Message-ID: [EMAIL PROTECTED] Subject: CBL:colander medley Date: Tue, 31 Jan 2006 10:27:37 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0001_01C62650.F51D11C0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c03]. X-RBL-Warning: WEIGHT10: Weight of 204 reaches or exceeds the limit of 100. X-RBL-Warning: WEIGHT20: Weight of 204 reaches or exceeds the limit of 200. X-Declude-Sender: [EMAIL PROTECTED] [213.136.107.177] X-Declude-Spoolname: D8231024b00d4a426.smd X-Declude-Note: Scanned by Declude 4.0.2b for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [204] at 10:29:11 on 31 Jan 2006 X-Declude-Fail: CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50], WEIGHT10 [100], WEIGHT20 [200], WEIGHT20b [200] X-Country-Chain: [RIPE Unlisted]-destination X-Declude-IM_IN: -- -- Precedence: bulk Sender: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [63.246.13.90] X-Declude-Spoolname: D84e201442505.smd X-Declude-Note: Scanned by Declude 3.0.5.5 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [0] at 09:40:34 on 31 Jan 2006 X-Declude-Tests: Whitelisted X-Country-Chain: [RIPE Unlisted]-UNITED STATES-destination From: [EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 434752482 X-IMail-ThreadID: 84e201442505 Cavell McDermott Network Administrator Cottonwood Financial 972.753.0822 Office 214.403.4918 Cell http://www.thecashstore.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 31, 2006 9:28 AM Subject: CBL:colander medley V V C l A l A L A G l L R U l A M S $ $ $ 69 85 99 ( ( ( 10 30 10 ) ) ) See more at http://www.sairabbin.com Quit overpaying for your meds with http://www.sairabbin.com Confidentiality Notice: The information contained in this transmission is intended only for the personal and confidential use of the designated recipient named above. If the receiver of this transmission is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error, and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you are not the intended recipient, please immediately notify the sender and delete this e-mail message from your system. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
RE: [Declude.JunkMail] Another forged Declude address e-mail?
Title: Message Matt, I see that now. It was WHITELISTED as it is shown in the headers. So someone has guessed the AUTH to Declude or they (DECLUDE) are WHITELISTing on some type of header match. Matt, just to make mention to the list and you, I'm not hashing on Declude or Andrew. As both have been an asset to this list and we've learned a lot by it. But I was displeased with Andrew's generic brief response as in the past; he's been helpful. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, January 31, 2006 7:21 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Another forged Declude address e-mail?Erik,This is likely the difference between incoming and outgoing E-mail. Many of us don't block outgoing E-mail, but some do tag it with test failures. If it was AUTHed, it probably would have been whitelisted, so it was likely an open relay mistake. Spammers will capitalize on this within moments.MattErik wrote: And this has what to do with the influx of immigrants from Russia to Czech Republic? My statement was a joke. Notice the " ;-) " at the end. However, giving the fact that Declude is in the business of SPAM control, this should have been prevented. Look that their "X-Declude" headers. And from a standpoint of being in the SPAM preventing software; they should also secure their SMTP to prevent outside posts to groups. Wouldn't the test on the email "CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50]" be enough for a "COMBO" test to be used to filter to a HOLD or DELETE? No, I'm not bashing Declude. We've been a Declude user since 2000. Just pointing out the obvious. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Tuesday, January 31, 2006 6:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? http://dictionary.reference.com/search?q=irony -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Erik Sent: Tuesday, January 31, 2006 7:56 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? Yep, here too. The message exceeded weight of 200+ You'd think Declude would know how to use the "DELETE" action of their software. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of mail-lists Sent: Tuesday, January 31, 2006 4:45 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Another forged Declude address e-mail? This one came to my main address not the list (obviously...) Received: from declude.com [63.246.13.90] by cottonwoodfinancial.com with ESMTP (SMTPD-8.21) id A4E201A0; Tue, 31 Jan 2006 09:40:18 -0600 Received: from asdfas.net [213.136.107.177] by mail.declude.com (SMTPD32-8.05) id A23124B00D4; Tue, 31 Jan 2006 10:28:49 -0500 Message-ID: [EMAIL PROTECTED] Subject: CBL:colander medley Date: Tue, 31 Jan 2006 10:27:37 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_0001_01C62650.F51D11C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c03]. X-RBL-Warning: WEIGHT10: Weight of 204 reaches or exceeds the limit of 100. X-RBL-Warning: WEIGHT20: Weight of 204 reaches or exceeds the limit of 200. X-Declude-Sender: [EMAIL PROTECTED] [213.136.107.177] X-Declude-Spoolname: D8231024b00d4a426.smd X-Declude-Note: Scanned by Declude 4.0.2b for spam. "http://www.declude.com/x-note.htm" X-Declude-Scan: Incoming Score [204] at 10:29:11 on 31 Jan 2006 X-Declude-Fail: CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50], WEIGHT10 [100], WEIGHT20 [200], WEIGHT20b [200] X-Country-Chain: [RIPE Unlisted]-destination X-Declude-IM_IN: -- -- Precedence: bulk Sender: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [63.246.13.90] X-Declude-Spoolname: D84e201442505.smd X-Declude-Note: Scanned by Declude 3.0.5.5 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [0] at 09:40:34 on 31 Jan 2006 X-Declude-Tests: Whitelisted X-Country-Chain: [RIPE Unlisted]-UNITED STATES-destination From: [EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 434752482 X-IMail-ThreadID: 84e201442505 Cavell McDermott Network Administrator Cottonwood Financial 972.753.0822 Office 214.403.4918 Cell http://www.thecashstore.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, January 31, 2006 9:28 AM Subject: CBL:colande
RE: [Declude.JunkMail] Another forged Declude address e-mail?
Title: Message ROFL now I understand. I think my 3 years in Easter Europe is getting to me. It's time to come home! -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, AndrewSent: Tuesday, January 31, 2006 7:41 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Another forged Declude address e-mail? Sorry, Erik, my short response to the list was not at your expense, my URL was meant to indicatethatI feltit was ironicthat a support list about an antispam product is being spammeddespite the software manufacturer's use of their own product. I don't score points* on people in a public forum to boost my self esteem. I don't feed the trolls. Andrew 8) * p.s. Doesn't stop me from poking Matt, Nick and John T in the ribs, though. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of ErikSent: Tuesday, January 31, 2006 10:32 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Another forged Declude address e-mail? Matt, I see that now. It was WHITELISTED as it is shown in the headers. So someone has guessed the AUTH to Declude or they (DECLUDE) are WHITELISTing on some type of header match. Matt, just to make mention to the list and you, I'm not hashing on Declude or Andrew. As both have been an asset to this list and we've learned a lot by it. But I was displeased with Andrew's generic brief response as in the past; he's been helpful. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, January 31, 2006 7:21 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Another forged Declude address e-mail?Erik,This is likely the difference between incoming and outgoing E-mail. Many of us don't block outgoing E-mail, but some do tag it with test failures. If it was AUTHed, it probably would have been whitelisted, so it was likely an open relay mistake. Spammers will capitalize on this within moments.MattErik wrote: And this has what to do with the influx of immigrants from Russia to Czech Republic? My statement was a joke. Notice the " ;-) " at the end. However, giving the fact that Declude is in the business of SPAM control, this should have been prevented. Look that their "X-Declude" headers. And from a standpoint of being in the SPAM preventing software; they should also secure their SMTP to prevent outside posts to groups. Wouldn't the test on the email "CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50]" be enough for a "COMBO" test to be used to filter to a HOLD or DELETE? No, I'm not bashing Declude. We've been a Declude user since 2000. Just pointing out the obvious. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Tuesday, January 31, 2006 6:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? http://dictionary.reference.com/search?q=irony -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Erik Sent: Tuesday, January 31, 2006 7:56 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? Yep, here too. The message exceeded weight of 200+ You'd think Declude would know how to use the "DELETE" action of their software. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of mail-lists Sent: Tuesday, January 31, 2006 4:45 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Another forged Declude address e-mail? This one came to my main address not the list (obviously...) Received: from declude.com [63.246.13.90] by cottonwoodfinancial.com with ESMTP (SMTPD-8.21) id A4E201A0; Tue, 31 Jan 2006 09:40:18 -0600 Received: from asdfas.net [213.136.107.177] by mail.declude.com (SMTPD32-8.05) id A23124B00D4; Tue, 31 Jan 2006 10:28:49 -0500 Message-ID: [EMAIL PROTECTED] Subject: CBL:colander medley Date: Tue, 31 Jan 2006 10:27:37 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_0001_01C62650.F51D11C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c03]. X-RBL-Warning: WEIGHT10: Weight of 204 reaches or exceeds the limit of 100. X-RBL-Warning: WEIGHT20: Weight of 204 reaches or exceeds the limit of 200. X-Declude-Sender: [EMAIL PROTECTED] [213.136.107.177] X-Decl
RE: [Declude.JunkMail] Another forged Declude address e-mail?
Title: Message Got it. No, don't give Andrew a hard time. We all need him. :-) -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, January 31, 2006 8:43 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Another forged Declude address e-mail?Erik,Actually, it was only whitelisted by the receiving server. The Declude headers from Declude's server still suggests an open relay. I can't claim to have never made a mistake like this, so irony is all that I see here.That Andrew guy can sure be a dink sometimes :)And for clarification, I did read the follow-ups, and that was a joke. I don't always read things the right way myself.MattErik wrote: Matt, I see that now. It was WHITELISTED as it is shown in the headers. So someone has guessed the AUTH to Declude or they (DECLUDE) are WHITELISTing on some type of header match. Matt, just to make mention to the list and you, I'm not hashing on Declude or Andrew. As both have been an asset to this list and we've learned a lot by it. But I was displeased with Andrew's generic brief response as in the past; he's been helpful. -Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Tuesday, January 31, 2006 7:21 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Another forged Declude address e-mail?Erik,This is likely the difference between incoming and outgoing E-mail. Many of us don't block outgoing E-mail, but some do tag it with test failures. If it was AUTHed, it probably would have been whitelisted, so it was likely an open relay mistake. Spammers will capitalize on this within moments.MattErik wrote: And this has what to do with the influx of immigrants from Russia to Czech Republic? My statement was a joke. Notice the " ;-) " at the end. However, giving the fact that Declude is in the business of SPAM control, this should have been prevented. Look that their "X-Declude" headers. And from a standpoint of being in the SPAM preventing software; they should also secure their SMTP to prevent outside posts to groups. Wouldn't the test on the email "CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50]" be enough for a "COMBO" test to be used to filter to a HOLD or DELETE? No, I'm not bashing Declude. We've been a Declude user since 2000. Just pointing out the obvious. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew Sent: Tuesday, January 31, 2006 6:05 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? http://dictionary.reference.com/search?q=irony -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Erik Sent: Tuesday, January 31, 2006 7:56 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Another forged Declude address e-mail? Yep, here too. The message exceeded weight of 200+ You'd think Declude would know how to use the "DELETE" action of their software. ;-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of mail-lists Sent: Tuesday, January 31, 2006 4:45 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Another forged Declude address e-mail? This one came to my main address not the list (obviously...) Received: from declude.com [63.246.13.90] by cottonwoodfinancial.com with ESMTP (SMTPD-8.21) id A4E201A0; Tue, 31 Jan 2006 09:40:18 -0600 Received: from asdfas.net [213.136.107.177] by mail.declude.com (SMTPD32-8.05) id A23124B00D4; Tue, 31 Jan 2006 10:28:49 -0500 Message-ID: [EMAIL PROTECTED] Subject: CBL:colander medley Date: Tue, 31 Jan 2006 10:27:37 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_0001_01C62650.F51D11C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c03]. X-RBL-Warning: WEIGHT10: Weight of 204 reaches or exceeds the limit of 100. X-RBL-Warning: WEIGHT20: Weight of 204 reaches or exceeds the limit of 200. X-Declude-Sender: [EMAIL PROTECTED] [213.136.107.177] X-Declude-Spoolname: D8231024b00d4a426.smd X-Declude-Note: Scanned by Declude 4.0.2b for spam. "http://www.declude.com/x-note.htm" X-Declude-Scan: Incoming Score [204] at 10:29:11 on 31 Jan 2006 X-Declude-Fail: CBL [34], SBL-XBL [53], BADHEADERS [32], REVDNS [35], FILTER-USERS [50], WEIGHT10 [100], WEIGHT20 [200], WEIGHT
RE: [Declude.JunkMail] OT - Server Watching.
We use (mostly): IPMonitor We also use our own scripts to monitor ports (i.e., 80, 53, 110, 25, 587, etc). IPMonitor is customizable and effective. http://ipmonitor.tsarfin.com -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jerod M. Bennett Sent: Monday, January 23, 2006 8:25 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT - Server Watching. Hey, I know this is off topic, but I respect the knowledge and opinions of the people on this list. What software / services do you guys use to watch your servers for up/down status? -Jerry --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT - Server Watching.
IPMonitor is good. And if anyone is tired of any IPSwitch products (such as us) We've found this to be good and a good price. We were using IPSwitch What's Up Gold until IPSwitch started it's Imail pricing change. We've switched from their FTP Client and Server, Server Monitoring and soon we'll switch their Imail product. We've used a lot of IPSwitch products in the past years. And with IPSwitch's stance on things; they are not in our line-up any more. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kaj Søndergaard Laursen Sent: Monday, January 23, 2006 9:06 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT - Server Watching. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: 23. januar 2006 20:41 To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT - Server Watching. We use (mostly): IPMonitor Another vote for ipMonitor, except it's another product. www.ipmonitor.com That's what we use. Regards, Kaj --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Yes, that spam campaign keeps changing subjects. Unfortunately, if you filter only on the CID tag; you will filter some legitimate newsletters as they do use the CID tag. As long as you will be monitoring your HOLD queue; you should fine so you filter out the false positives. Also in that thread was discussion of some variants used to the CID html coding. I believe Scott brought that up in his postings. Another thing Scott brought up is that this spam campaign also fails the CMDSPACE in Declude. We make use of that combo test TESTSFAILED when looking for the CID tag. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 6:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Yes, you are correct with the use of BEGINSWITH. This campaign is and has been lately using html code before the CID tag to throw off spam filters. Your use of BEGINSWITH to detect the CID tag should be effective then as very few email bodies begin with just a CID tag. Below is what we are currently using as a filter in Declude for this spammer (if you use this; adjust your weight according to your HOLD/DELETE weight - our DELETE weight is 125 and our HOLD weight is 80): SKIPIFWEIGHT 125 BODYEND NOTCONTAINS Content-Type: image/gif #MN NOTE - Mark: Removed as this spammer is now using different HELO's #HEADERSEND NOTCONTAINS Received: from unknown (HELO HEADERS END NOTCONTAINS 192.168. TESTSFAILED END NOTCONTAINS CMDSPACE BODY20 CONTAINSimg src=cid: BODY20 CONTAINSimg src=3Dcid: #subjects used in this spam; values used to increase the weight to DELETE based on the above tests SUBJECT 50 STARTSWITH fax received SUBJECT 50 STARTSWITH breaking news SUBJECT 50 STARTSWITH OTC News SUBJECT 50 STARTSWITH press release SUBJECT 50 STARTSWITH news SUBJECT 50 STARTSWITH top news SUBJECT 50 STARTSWITH headline news Hope that helps you. ;-) -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 7:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Erik, I thought that the beginswith meant that we are testing the very first line of the message? A newsletter would never have just one line -- that being the CID tag. I could see where contains would be a problem though. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 12:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Yes, that spam campaign keeps changing subjects. Unfortunately, if you filter only on the CID tag; you will filter some legitimate newsletters as they do use the CID tag. As long as you will be monitoring your HOLD queue; you should fine so you filter out the false positives. Also in that thread was discussion of some variants used to the CID html coding. I believe Scott brought that up in his postings. Another thing Scott brought up is that this spam campaign also fails the CMDSPACE in Declude. We make use of that combo test TESTSFAILED when looking for the CID tag. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 6:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.ht ml Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
RE: [Declude.JunkMail] Combo Filter
Title: Message Hi Goran, We use CMDSPACE and SNIFFER as a combo and push it to our delete weight; effective. Also we use CMDSPACE and INV-URIBL as a combo; effective but we weigh it slightly lower and push it to our spam weight. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran JovanovicSent: Thursday, January 12, 2006 9:40 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Combo Filter Hi, Would CMDSPACE and SNIFFER be a good combo test to have? I already have some other combos with SNIFFER. Thanx Goran Jovanovic Omega Network Solutions
[Declude.JunkMail] CMDSPACE Percent of Weight based on your (DELETE) action
I would like to ask those that having been using CMDSPACE; what percentage of your weight do you assign to this? TIA, Erik --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] CMDSPACE Percent of Weight based on your (DELETE) action
Thanks. This is what we've been using so far; but were planning on increasing it to 60%. Our SMTP is on the same AUTH server so our users aren't effected. We've used this all along in combo/testsfailed tests; but now been wanting to assign weight to the test to help push spam over our 'skipifweight' Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gufler Markus Sent: Monday, January 09, 2006 12:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] CMDSPACE Percent of Weight based on your (DELETE) action If you're able to whitelist (by IP or AUTH-ed users) all users who connect from inbound to outbound to your server then you can use a very high weight for this test. I give 50% of my hold weight for the test and add additional points if there is a combination with certain other test. For example one of the reliable IP4R-Tests. --- Gufler Markus -- Original Message -- From: Erik [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Mon, 9 Jan 2006 10:01:41 +0100 I would like to ask those that having been using CMDSPACE; what percentage of your weight do you assign to this? TIA, Erik --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hardware Issue -- NOT!
Title: Message I agree with you Andy and John T. In my opinion, Declude always worked in the past and we trusted it to deliver email. Every since this 3.X release; nothing but problems. Things have broke in this release that were working before. Granted they have added gradual fixes to get what was working in the past; working again. And these "current" problems effect email delivery to end users. This is not an option in most any ISP. We've been a Declude user for some time now. But becoming more and more disappointed in hearing of others' "buggy" responses on this list to the 3.X release. Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy SchmidtSent: Monday, December 26, 2005 7:00 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Hardware Issue -- NOT! Hi David: Thanks for acknowledging the hardware problem. However, I don't think anyone here really would be too upset about hardware problems on your end - if it didn't uncover what appears to be a HUGE software problem? It's the DecludeSOFTWARE that deactivates/downgrades itself, if we are to trust the reports of those who suffered the outcome!? Best RegardsAndy SchmidtPhone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Franco-RochaSent: Monday, December 26, 2005 12:29 PMTo: Declude.JunkMail@declude.comCc: Declude.Virus@declude.comSubject: [Declude.Virus] Hardware Issue Due to the long holiday weekend, we have been away from the office for a few days. Unfortunately it has come to our attention that there could be a problem with key validation on the server there. After some testing, we have determined that there is in fact a hardware issue that we expect to have resolved today. We appreciate that you have taken the time to bring this matter to our attention and appreciate your patience while we rectify the situation. We will once again post to this list when the issue has been corrected. Declude Technical / Engineering
RE: [Declude.JunkMail] WAY OT: COVAD VOIP
I'll agree with Evans. We tried Lingo and Skype. Vonage is far better. I live in Prague, Czech Republic 9 months of the year... 3 months in USA. We use Vonage to connect to North America via phone. Vonage does have settings to control how much bandwith is used when on the phone and on the internet at the same time. If you lower the setting from their default, you do not notice difference in voice or internet downloading; and the voice quality is good. Erik -- Original Message -- From: Evans Martin [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Mon, 12 Dec 2005 17:56:40 -0600 I have been using Vonage at home and love it. I had tried Lingo before Vonage and HATED it, although I think most of the problems were due to the D-Link hardware that they supplied. I have had some experience with Linux based PBX systems and have found them to be much more cost effective than hardware PBXs. This along with VoIP really has the possibility of cutting quite a bit of cost around the office. Evans Martin --- EVANS MARTIN [EMAIL PROTECTED] HOSTING: http://www.martek.net PROGRAMMING: http://www.martekware.com iPlus Info Browser - IPB's IMail Migration Tool, password browser, reporting suite make IPlus Info Browser something no IMail administrator should be without. http://www.martek.net/Default.aspx?tabid=96 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Monday, December 12, 2005 11:35 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] WAY OT: COVAD VOIP I have been considering switching many of our office from POTS lines to COVAD voice over IP. Since this is such a diverse and well informed group, I was wonder if anyone has any experience with them or suggestions as to alternate VOIP providers. Off list replies are welcomed. Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] CBL:Fw: news
Using CONTAINS will trap a lot of real email if that is the only line in your filter. Could try this and set up the $default$.junkmail to HOLD so you can monitor the filter for false positives: SKIPIFWEIGHT 125 --your delete weight MAXWEIGHT 70 --your hold weight BODY END NOTCONTAINS Content-Type: image/gif HEADERS END NOTCONTAINS Received: from unknown (HELO HEADERS END NOTCONTAINS [192.168. BODY 20 CONTAINS img src=cid: SUBJECT 50 STARTSWITH breaking news SUBJECT 50 STARTSWITH OTC News SUBJECT 50 STARTSWITH press release SUBJECT 50 STARTSWITH news SUBJECT 50 STARTSWITH top news SUBJECT 50 STARTSWITH headline news -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Wednesday, December 07, 2005 1:16 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] CBL:Fw: news Try CONTAINS instead of BEGINSWITH Make sure you have at least one crlf [a bunch would not hurt] at the end of the filter file. -Nick Todd wrote: I created a filter with the string BODY 0 BEGINSWITH img src=3Dcid: The declude.cfg goes like this GIFINBODYFILTER filter d:\imail\declude\filters\gifinbodyfilter.txtx1500 After searching the declude log I dont see where the filter has been triggered a single time in the last day. There are no errors in the declude log calling the test either. To check it I took one of the gifs and sent it to myself. I received it. Here is the header from the email. You will see in red where the gif seems to have a but the original emails did not. Todd Received: from backup.progressive.loc [192.168.1.19] by net.smart-mail.net (SMTPD32-8.15) id A7821E0198; Wed, 07 Dec 2005 13:26:58 -0600 Received: (from office [68.203.154.122]) by backup.progressive.loc (SMSSMTP 4.0.0.59) with SMTP id M2005120713264209805 for hunter; Wed, 07 Dec 2005 13:26:42 -0600 Message-ID: [EMAIL PROTECTED] From: Hunter hunter To: Todd -Progressive.biz hunter Subject: breaking news Date: Wed, 7 Dec 2005 13:26:41 -0600 MIME-Version: 1.0 Content-Type: multipart/related; type=multipart/alternative; boundary==_NextPart_000_0095_01C5FB31.DC30EB90 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-mxGuard-Info: Processed by net.smart-mail.net using mxGuard v1.5.0 X-mxGuard-Spool-ID: 377c001e01984a62 X-mxGuard-Sender: hunter@ X-mxGuard-Spam-Score: 0 X-Note: This message has been scanned for spam and viruses using mxGuard for IMail X-RBL-Warning: IPNOTINMX: X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: -10. X-Declude-Sender: hunter [68.203.154.122] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: IPNOTINMX, SPFUNKNOWN, SPAMCHK, CATCHALLMAILS [-25] X-Note: Total spam weight of this E-mail is -25 . X-Country-Chain: UNITED STATES-destination X-Note: This E-mail was sent from cpe-68-203-154-122.houston.res.rr.com ([68.203.154.122]). X-RCPT-TO: hunter@ Status: R X-UIDL: 370538202 This is a multi-part message in MIME format. --=_NextPart_000_0095_01C5FB31.DC30EB90 Content-Type: multipart/alternative; boundary==_NextPart_001_0096_01C5FB31.DC30EB90 --=_NextPart_001_0096_01C5FB31.DC30EB90 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable --=_NextPart_001_0096_01C5FB31.DC30EB90 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN HTMLHEAD META http-equiv=3DContent-Type content=3Dtext/html; = charset=3Diso-8859-1 META content=3DMSHTML 6.00.2800.1400 name=3DGENERATOR STYLE/STYLE /HEAD BODY bgColor=3D#ff DIVIMG src=3Dcid:009401c5fb64$26cb5b90$1401a8c0@office = /DIV/BODY/HTML --=_NextPart_001_0096_01C5FB31.DC30EB90-- --=_NextPart_000_0095_01C5FB31.DC30EB90 Content-Type: image/gif; name=lzj.gif Content-Transfer-Encoding: base64 Content-ID: [EMAIL PROTECTED] - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 3:51 PM Subject: Re: [Declude.JunkMail] CBL:Fw: news basically it will end the filter if any of the statements are not true. These stock emails have always met these 4 criteria, so if it doesn't meet them end the filter. 1. contains a gif attachment hence:Content-Type: image/gif 23. contains a header like: Received: from unknown (HELO randomword [192.168. 4. Always fails cmdspace You could use mine and Kevin's combined: BODY END NOTCONTAINS Content-Type: image/gif HEADERS END NOTCONTAINS Received: from unknown (HELO HEADERS END NOTCONTAINS [192.168. TESTSFAILED END NOTCONTAINS CMDSPACE BODY 15 CONTAINS img src=3Dcid - Original Message - From: Todd To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 3:28 PM Subject: Re: [Declude.JunkMail] CBL:Fw:
RE: [Declude.JunkMail] CBL:Fw: news
Yep, I agree with Kevin. Using CONTAINS will trap a lot of legitimtate emails. Scott posted a good filter to use if using DECLUDE and the external tests he mentioned. -Erik -- Original Message -- From: Kevin Bilbee [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Tue, 6 Dec 2005 12:55:24 -0800 Contains will trap too many legitimate emails that embed images. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Carter Sent: Tuesday, December 06, 2005 12:35 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] CBL:Fw: news May wish to consider CONTAINS instead of BEGINSWITH. This is one I just got. John C !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN HTMLHEAD META http-equiv=Content-Type content=text/html; charset=us-ascii META content=MSHTML 6.00.2800.1106 name=GENERATOR STYLE/STYLE /HEAD BODY bgColor=#ff DIVÂ /DIV DIVA href=http://www.persorela.com;http://www.persorela.com/A/DIV DIVIMG src=cid:000101c5faa3$244e631d$b821a8c0@shyer/DIV DIVÂ /DIV DIVCrow: My good Crow, your voice is right enough, but your wit isBR wanting. BR The Two Dogs BR A MAN had two dogs: a Hound, trained to assist him in his sports,BR and a Housedog, taught to watch the house. When he returned homeBR after a good days sport, he always gave the Housedog a largeBR share of his spoil. The Hound, feeling much aggrieved at this,BR reproached his companion, saying, It is very hard to have allBR this labor, while you, who do not assist in the chase, luxuriateBR on the fruits of my exertions. The Housedog replied, Do notBR blame me, my friend, but find fault with the master, who has notBR taught me to labor, but to depend for subsistence on the labor ofBR others. /DIV/BODY/HTML -- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, December 06, 2005 1:55 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] CBL:Fw: news We use a body filter BODY 15 BEGINSWITH img src=3Dcid: This puts the message at our hold weight. I have not seen one false positive from this test. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Richard Farris Sent: Tuesday, December 06, 2005 11:25 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] CBL:Fw: news Does anyone have an answer to filter these type emails? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 06, 2005 3:20 AM Subject: news --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] CBL:Fw: news
Todd, It is because this spam campaign is using Content-Type: image/gif in the body. NOTCONTAINS means to skip that filter or test if the body does not contain Content-Type: image/gif in the body. Erik -- Original Message -- From: Todd [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Tue, 6 Dec 2005 15:28:24 -0600 Scott, I am looking through the Declude manual to determine what you are doing. I don't think I understand NOTCONTAINS. I would think CONTAINS mean it has this string in the body and NOTCCONTAINS means it does not. So why NOTCONTAINS Content-Type: image/gif? I feel like I am probably missing something painfully obvious here. Todd - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 1:50 PM Subject: Re: [Declude.JunkMail] CBL:Fw: news I use this filter: STOPATFIRSTHIT BODY END NOTCONTAINS Content-Type: image/gif HEADERS END NOTCONTAINS Received: from unknown (HELO HEADERS END NOTCONTAINS [192.168. TESTSFAILED END NOTCONTAINS CMDSPACE TESTSFAILED 100 CONTAINS HELO-IS-REVDNS TESTSFAILED 100 CONTAINS HELOISIP TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT HELOISIP and HELO-IS-REVDNS are from external tests that I run. - Original Message - From: Richard Farris To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 1:25 PM Subject: [Declude.JunkMail] CBL:Fw: news Does anyone have an answer to filter these type emails? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 06, 2005 3:20 AM Subject: news --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sniffer Invuribl
Presumably, if both tests hit you would be _very sure_ it was spam. Presumably, yes... Be careful about deleting on that combination, here are false positives with tests failing both SNIFFER and INVURIBL. Awhile back (thanks Scott Fisher), I asked the list about COUNTRY tests. One of the tests I had was using the TESTSFAILED that included both SNIFFER and INVURIBL in a combo test. Then the COUNTRY test was used to see if that email originated outside of USA and/or started in USA then bounced to another country, then back to USA. In our testing, those that failed those 2 tests, were indeed SPAM. But on some emails that filed both our combo test (SNIFFER and INVURIBL) and originated in USA and destined to USA, were true emails. Ironically, these emails do not fail the ROUTING test in Declude. I would recommend using the TESTSFAILED for SNIFFER and INVURIBL and then another one testing that combo test with the use of another external filter for COUNTRY. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Sunday, October 02, 2005 12:19 PM To: Serge Cc: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Sniffer Invuribl On Sunday, October 2, 2005, 1:23:21 PM, Serge wrote: S Hi all, S  S I have been using sniffer for a year and recently add INVURIBL. i am S trying to find the corrolation between the 2 test to set the weight. S I tag at 10 and delete at 30.. I had sniffer at 14. S now i added invuribl with a max weight of 14. S i have spamcop at 9. S and a set of negative weight filter to compensate for most FP. S Should i lower sniffer now that I added Invuribl ? S (this is an isp setting) I'm pretty sure the only reason to decrease a weight would be if a test became less accurate... so you should probably leave it as it is. Presumably, if both tests hit you would be _very sure_ it was spam. MHO Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Wow, that would be great! :-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, September 19, 2005 9:38 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter Erik, I have also asked the engineers to look into this for us, ie. A directive to force tests to run in a specific order. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Saturday, September 17, 2005 5:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Title: Message Thanks Matt. The variable %COUNTRIES% does not pass to a parm line; nor does %COUNTRY%. But, I've noticed in our config file, we do not have a country test; but I thought this was internal to Declude? Is this what I need to add to my config? At one point we did have this in our config as we still have the ALL_LIST.DAT file. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=1012 I want to be able to detect multiple countries and pass that to our external program. But as Scott mentioned, externals are ran before filters. Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Saturday, September 17, 2005 4:10 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help in creating a FilterErik,Flexibility is a nice thing, but this isn't really practical to do for Declude without a major, major rewrite.The better approach would be to actually introduce the ability to use operators and variables in custom filters so that the exact order didn't matter. That would also be a rather involved new feature, but it would seem more practical and would have a greater overall utility. I'm sure if time wasn't an issue and there weren't more pressing things, they would have leaped to provide this a long time ago.As far as your specific need, some of this could be written in _vbscript_ as an external test in Declude. Note that %COUNTRIES% is definitely preferable to %COUNTRYCHAIN% as the data used for %COUNTRIES% is updated more often if I am not mistaken. The two letter country codes in standardized format are also preferable for filtering. You can then combo a single test with the others and probably have no concern about the order of tests that you can't easily overcome.MattErik wrote: It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
RE: [Declude.JunkMail] Help in creating a Filter
If Declude could confirm the order of how/which tests are run, it would be nice to know. As far as reading our combo filter of failed tests (%TESTSFAILED%), we can read/code that from our combo filter file (same file that declude is reading) and do our own tests failed combo (since Declude isn't doing this at the point our external program is called; as per our order in the Config file). But, we still need to know the country chain; of which is not passed to our external program... %COUNTRYCHAIN% passes a NULL value. Without knowing the country chain, this program will not work. Upon looking at our CONFIG file for Declude, we do not use any COUNTRY or COUNTRIES test (in the past I believe we did). Do you know if this needs to be in the default config file or is it internal to Declude? Thanks Scott for the thread. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 2:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I believe the order is: IP4R RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe
RE: [Declude.JunkMail] Help in creating a Filter
It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
That we do have. ;-) But it appears the %COUNTRYCHAIN% doesn't register with Declude until all other tests have been run (filters and external calls). Declude does not pass this to a command line. We've re-coded our external program to read the combo filter; since declude doesn't read it before hand (per our ordering of tests in the config file). But the problem remains of determining of how the email was received based on bounces from countries. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 10:08 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter One more comment. The country processing won't occur unless you have the all_list.dat file in the declude folder. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 3:42 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter If Declude could confirm the order of how/which tests are run, it would be nice to know. As far as reading our combo filter of failed tests (%TESTSFAILED%), we can read/code that from our combo filter file (same file that declude is reading) and do our own tests failed combo (since Declude isn't doing this at the point our external program is called; as per our order in the Config file). But, we still need to know the country chain; of which is not passed to our external program... %COUNTRYCHAIN% passes a NULL value. Without knowing the country chain, this program will not work. Upon looking at our CONFIG file for Declude, we do not use any COUNTRY or COUNTRIES test (in the past I believe we did). Do you know if this needs to be in the default config file or is it internal to Declude? Thanks Scott for the thread. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 2:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I believe the order is: IP4R RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's
[Declude.JunkMail] Help in creating a Filter
Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Can the %COUNTRYCHAIN% variable be used instead of %COUNTRIES%? Right about be careful... But the MN-COMBO is a mix of 3 to 5 TESTSFAILED combos already. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 12:57 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Server Running at 100%
Yes, just put it in there. I also think that it requires the PRO version to work ? Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Thursday, September 08, 2005 10:08 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Server Running at 100% PRESCAN is not in the virus.cfg file...just put it in there? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, September 08, 2005 11:00 AM Subject: RE: [Declude.JunkMail] Server Running at 100% In your virus.cfg file: AVAFTERJM ON Also ensure that you have the directive: PRESCANON David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Thursday, September 08, 2005 11:56 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Server Running at 100% Importance: High I was told to see if using AVAFTERJM would help on resources on my server...right now I almost dead in the water..my server is cralling to send mailhow do I use this command...exactly how does it go into the config.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: Richard Farris mailto:[EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, August 04, 2005 11:21 AM Subject: [Declude.JunkMail] Spam box Is there a box I can put in front of my Imail server that will help take some of the load off of the spam filtering that Declude is doing Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestions on catching a spam message?
I'll comment. ;-) invURIBL and Sniffer are very effective. With these two alone we have nearly removed ALL body/subject/header/etc... Filtering from Declude. The email that you questioned about and as Darrell pointed out, did fail invURIBL on our system as well. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 02, 2005 7:55 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Suggestions on catching a spam message? Dave, One of the biggest things you can do since to help out since you are already running Sniffer is look at adding URI filtering. For example that domain is currently listed in black.uribl.com. If you want to give URI filtering a try check out our site - http://www.invariantsystems.com (invURIBL). URI filtering is very effective. Hopefully, other will comment on how well URI filtering is working for them as well. Darrell Dave Beckstrom writes: Hi Everyone, I just purchased declude two days ago. I'm running Declude with message sniffer on a smartermail server. So far, it is working very well. The approach that I have been trying to take is to, wherever possible, avoid creating a custom filter entry to trap a specific email. Below is an example of a spam email which slipped through this morning. I sanitized the mail headers so any reference to myserver or mydomain or myaddress is where I replaced our details in the headers. As you can see from the headers, there was very little wrong with this email that would enable us to score it high enough for it to be considered spam. I tag the subject at a score of 14. At the bottom of this message is the actual body of the html email. Obviously I could add a filter entry to look for agnheqe3.com and to delete or hold the message. The problem with that approach, in my opinion, is it never ends. If they have 1000 different domains that means a 1000 filter entries. I hate filtering to block a specific email and I would rather block based upon a pattern common to all spam. I am wondering if you have had any success on trapping emails like the one below? What would you add or change to have caught this message? The only thing I saw, that is common to spam, which I think I could filter on is the /track? in the URL. I've seen a lot of spam that triggers various ASP or PHP or other programs in the IMG SRC tag which enables a spammer to verify that the email was opened and read. What do you think? How can I tighten up my filtering to catch an email such as the one below? Do you guys forward spam to spamcop or other places to help with the RBLs? Thanks! Dave Return-Path: [EMAIL PROTECTED] Fri Sep 02 07:34:48 2005 Received: from sip.agnheqe3.com [206.131.238.29] by myserver.mydomain.com with SMTP; Fri, 2 Sep 2005 07:34:48 -0500 MIME-Version: 1.0 X-Accept-Language: en X-Priority: Normal From: Energy Drink [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Nationwide Energy Drink Survey Date: Fri, 2 Sep 2005 04:08:28 EST Message-ID: q8tz5,[EMAIL PROTECTED] Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8008000e]. X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line 223, weight 0) X-Note: X-Note: Spam Score: [6] X-Note: Scan Time:07:35:08 on 02 Sep 2005 X-Note: Spool File: 37143703.EML X-Note: Server Name: sip.agnheqe3.com X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Reverse DNS IP: sip.agnheqe3.com [206.131.238.29] X-Note: Recipient(s): fwd[EMAIL PROTECTED] X-Note: Country Chain:UNITED STATES-destination X-Note: Failed Weights: BADHEADERS [8], SPFUNKNOWN [1], Filter_Country [0] X-Note: html bodybr a href=http://agnheqe3.com/track?e=3p5seppESTe4spEnBsK4I3YMp1m=6225115 l=0 img src=http://agnheqe3.com/t?m=6225115l=3; border=0/abrbr img src=http://agnheqe3.com/t?m=6225115l=2; border=0/abrbr a href=http://agnheqe3.com/t?m=6225115l=4; img src=http://agnheqe3.com/track?e=46UqH66PCSHeq6PD4qbeBnKu6zm=6225115l=1; border=0/abr brbrfont color='#ff' face='arial,helvetica' size='1'5;46UqH66PCSHeq6PD4qbeBnKu6z;6225115/font/body/html --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail
RE: [Declude.JunkMail] BADHEADERS and HELOBOGUS coming up a lot
Hi Kevin, This email is more our/your FYI than much an answer to your question: We've also noticed this on other tests of Declude that are built in; but not much on BADHEADERS. Decludes BADHEADERS test is a good test and accurate in our opinion; but we have lowered the score on this test as well as SPAMHEADERS and HELOBOGUS. We and (myself; now living outside of USA.. Where email bounces thru servers to USA and then back to me from USA (to another Country) have notice the ROUTING test will fail on email received to me; when it is received by a Country I am in; and where I have respond/created an email to that Country. And that email is legit. I use SMTP to our servers in USA; so this bypasses our Declude (incoming authorize email). Also so does the NOPOSTMASTER and NOABUSE fail here. Many ISP's (at least in Eastern Europe) do not use these anymore. Although, yes an RFC requirement, they have chose to disregard that rule; and not setup those addresses. We have disable these tests in Declude due to a number of false positives. At first we lowered the weight returned by these tests... Then later removed them completely. We have learned over the past year, that most of the built-in tests of Declude are not effective like they were in the past. Now yes, DNS lookup tests are good if you use an active source. Very good. And in our experience in just the past year, external tests called by Declude like SNIFFER and Invariant Systems ... Very, very, effective. Infact, we have removed most of our BODY, HEADERS, and SUBJECT filters; infact about 95% of them. We also do use a few of Matt's filters for scam detection; but have lowered much these weights as Invariant's URI program and SNIFFER takes the most blunt in punishing the email. Matt, on this list, is very good. :-) (in my opinion). So is Andy and Darrell. I have learned a lot about them just by being silent on the list and observing their feedbacks. Now, our servers have only received a maximum of 12,356 emails a day (last peak recorded on 8/4/2005). I know other ISP's / servers that use Declude receive more or less then us.) The above is based on our usage and feedback. Each ISP/email server can be different. -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Rogers Sent: Thursday, August 18, 2005 9:48 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] BADHEADERS and HELOBOGUS coming up a lot These tests (especially BADHEADERS) seem to be catching a lot of legit mail lately. I've attached one of the headers It seems like many of the emails are sent from Exchange servers. What exactly makes the headers bad?Any ideas? Received: from ss_email.ssc.internal [216.201.186.154] by Rogersbenefit.com with ESMTP (SMTPD-8.21) id AA0C60F44; Wed, 17 Aug 2005 10:55:24 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=_=_NextPart_001_01C5A354.6BB3DE4D Subject: FW: Erecycler - Request for quote Date: Wed, 17 Aug 2005 12:52:22 -0500 Message-ID: [EMAIL PROTECTED] http://68.167.205.203:8383/Xa4139bcbc899cb92c89cefa5b204/newmsg.cgi?mbx=bul k[EMAIL PROTECTED] X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: Erecycler - Request for quote Thread-Index: AcWilPivw61uWKcZTbmhEGnyYpc9YgAvrosg X-Priority: 1 Priority: Urgent Importance: high From: Carrie MateerEMAIL PROTECTED X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [840a]. X-RBL-Warning: HELOBOGUS: Domain ss_email.ssc.internal has no MX or A records [0301]. X-Declude-Sender: EMAIL PROTECTED [216.201.186.154] X-Note: Scanned by Declude JunkMail http://www.declude.com/x-note.htm X-Spam-Tests-Failed: BADHEADERS, HELOBOGUS, WEIGHT10 [13] X-Note: Scanned by Declude JunkMail http://www.declude.com/x-note.htm X-Note: This E-mail was sent from mail2.sleepersewell.com ([216.201.186.154]). X-RCPT-TO:EMAIL PROTECTED http://68.167.205.203:8383/Xa4139bcbc899cb92c89cefa5b204/newmsg.cgi?mbx=bul k[EMAIL PROTECTED] Status: R X-UIDL: 417013027 X-IMail-ThreadID: 7a0c0e8c19d1 --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Savvis 64.14.0.0/16
We took block some IP's from Savvis: 64.41.183.130 Savvis 64.241.72.0/24 SAVVIS Communications Corporation 64.28.76.0/24 Savvis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, July 27, 2005 3:49 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Savvis 64.14.0.0/16 Savvis is a legit provider, not a spam house. That said they don't seem to be kicking off spammers too well. I've got these blocks in my IPFILE: 64.14.33.0/24 64.14.33.0/24 inboxcircular2.com added 03-11-05 SBL22016 64.14.48.128/26 64.14.48.128/26 freelotto.com updtd 04-16-05 64.14.6.112/30 64.14.6.112/30 creditmailings.com added 05-15-05 - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, July 27, 2005 8:23 AM Subject: Re: [Declude.JunkMail] Savvis 64.14.0.0/16 Hello - I am looking for some insight on these guys. I get quite a bit of what is best described as suspicious email from their networks - are they a legit or are they clever spammers? Thanks! -Nick [EMAIL PROTECTED] wrote: Yesterday I complained about the lack of participation on this list from Declude. Today alone there have been over a half a dozen posts. This has not gone unnoticed. Keep up the good work! Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Who is the real connecting server? (Headers vs Spamcop)
Andrew thank for the input and your time to respond. Confirms what I thought. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Thursday, July 21, 2005 6:37 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Who is the real connecting server? (Headers vs Spamcop) Well, you're reading the report correctly. Yes, the server that sent you the mail was indeed Yahoo. Note the SpamCop report line that says relay trusted... They are skipping that hop because they trust that relay. Your Declude configuration has no idea what SpamCop's opinion is, so it applies the counterweight from the IP belonging to Yahoo. The SpamCop report then goes on to examine the next hop, which is the broadband IP that originated the spam, and they have an abuse address, so a report is sent there. Should SpamCop send a report to Yahoo about somebody abusing their relay, which presumably requires authentication? You think so, and I think so. SpamCop apparently doesn't think so. I know that complaints to Yahoo about their relays is practically a lost cause. You should try taking it directly to them anyway. As for leaning on SpamCop, you'd have to take this issue to the SpamCop forum, or send a support email to one of the deputies. If this is going to be a configuration problem for you, then either lower your Yahoo counterweight, or create a combo test that only counterweights Yahoo if the mailfrom address is also from Yahoo, e.g. something basic like: MAILFROM END NOTCONTAINS @yahoo REVDNS-5 CONTAINS.yahoo. The test details could certainly be much more ornate; I won't make any claims that Yahoo has well-formed reverse DNS names, nor whether valid mail comes from Yahoo partners through their servers that ought to be counterweighted too. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Wednesday, July 20, 2005 8:59 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Who is the real connecting server? (Headers vs Spamcop) Can someone help me explain this. Why does Imail/Declude report YAHOO as the receiving server when SPAMCOP ignores Yahoo as the receiving server? We add a negative weight from Yahoo REVDNS. Should SPAMCOP also abuse to Yahoo? Or do I not fully understand? Imail log DOES show 66.163.175.81 as the connecting server (Yahoo). Shouldn't the abuse really be sent to Yahoo since it come from their server (from our logs)? Erik EMAIL HEADERS: Received: from smtp004.bizmail.sc5.yahoo.com [66.163.175.81] by mail.montananetwork.net (SMTPD-8.20) id A5E40300; Wed, 20 Jul 2005 21:26:28 -0600 Received: (qmail 37210 invoked from network); 21 Jul 2005 03:26:27 - Received: from unknown (HELO User) ([EMAIL PROTECTED]@70.245.85.9 with login) by smtp004.bizmail.sc5.yahoo.com with SMTP; 21 Jul 2005 03:26:26 - Reply-To: [EMAIL PROTECTED] From: PayPal[EMAIL PROTECTED] Subject: Unauthorized access to your PayPal account ! Date: Wed, 20 Jul 2005 22:26:16 -0500 MIME-Version: 1.0 Content-Type: text/html; charset=Windows-1251 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: MN-WHITELIST: Message failed MN-WHITELIST test (line 21, weight -50) X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c400120a]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c400120a]. X-RBL-Warning: SPAMDOMAINS: Spamdomain '@paypal.com' found: Address of [EMAIL PROTECTED] sent from invalid smtp004.bizmail.sc5.yahoo.com. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 10. X-MN: X-MN: Scanned for viruses and weighted for SPAM X-MN: Scan Time: 21:26:33 on 20 Jul 2005 X-MN: Spool File: D15E401AD093A.SMD X-MN: X-MN: Failed Tests: X-MN: MN-WHITELIST, NOLEGITCONTENT, NOABUSE, BADHEADERS, SPAMHEADERS, SPAMDOMAINS, SPAMCHK X-MN: X-MN: Receiving Server: mail.montananetwork.net X-MN: Spam Score: 57 X-MN: SMTP Sender: [EMAIL PROTECTED] X-MN: Recipients: X X-MN: Country Chain: UNITED STATES-destination X-MN: Sent from: smtp004.bizmail.sc5.yahoo.com ([66.163.175.81]) X-MN: Status: R X-UIDL: 419936643 X-IMail-ThreadID: 15e401ad093a SPAMCOP REPORTS: --- Received: from smtp004.bizmail.sc5.yahoo.com [66.163.175.81] by mail.montananetwork.net (SMTPD-8.20) id A5E40300; Wed, 20 Jul 2005 21:26:28 -0600 66.163.175.81 found
[Declude.JunkMail] Who is the real connecting server? (Headers vs Spamcop)
Can someone help me explain this. Why does Imail/Declude report YAHOO as the receiving server when SPAMCOP ignores Yahoo as the receiving server? We add a negative weight from Yahoo REVDNS. Should SPAMCOP also abuse to Yahoo? Or do I not fully understand? Imail log DOES show 66.163.175.81 as the connecting server (Yahoo). Shouldn't the abuse really be sent to Yahoo since it come from their server (from our logs)? Erik EMAIL HEADERS: Received: from smtp004.bizmail.sc5.yahoo.com [66.163.175.81] by mail.montananetwork.net (SMTPD-8.20) id A5E40300; Wed, 20 Jul 2005 21:26:28 -0600 Received: (qmail 37210 invoked from network); 21 Jul 2005 03:26:27 - Received: from unknown (HELO User) ([EMAIL PROTECTED]@70.245.85.9 with login) by smtp004.bizmail.sc5.yahoo.com with SMTP; 21 Jul 2005 03:26:26 - Reply-To: [EMAIL PROTECTED] From: PayPal[EMAIL PROTECTED] Subject: Unauthorized access to your PayPal account ! Date: Wed, 20 Jul 2005 22:26:16 -0500 MIME-Version: 1.0 Content-Type: text/html; charset=Windows-1251 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: MN-WHITELIST: Message failed MN-WHITELIST test (line 21, weight -50) X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c400120a]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c400120a]. X-RBL-Warning: SPAMDOMAINS: Spamdomain '@paypal.com' found: Address of [EMAIL PROTECTED] sent from invalid smtp004.bizmail.sc5.yahoo.com. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 10. X-MN: X-MN: Scanned for viruses and weighted for SPAM X-MN: Scan Time: 21:26:33 on 20 Jul 2005 X-MN: Spool File: D15E401AD093A.SMD X-MN: X-MN: Failed Tests: X-MN: MN-WHITELIST, NOLEGITCONTENT, NOABUSE, BADHEADERS, SPAMHEADERS, SPAMDOMAINS, SPAMCHK X-MN: X-MN: Receiving Server: mail.montananetwork.net X-MN: Spam Score: 57 X-MN: SMTP Sender: [EMAIL PROTECTED] X-MN: Recipients: X X-MN: Country Chain: UNITED STATES-destination X-MN: Sent from: smtp004.bizmail.sc5.yahoo.com ([66.163.175.81]) X-MN: Status: R X-UIDL: 419936643 X-IMail-ThreadID: 15e401ad093a SPAMCOP REPORTS: --- Received: from smtp004.bizmail.sc5.yahoo.com [66.163.175.81] by mail.montananetwork.net (SMTPD-8.20) id A5E40300; Wed, 20 Jul 2005 21:26:28 -0600 66.163.175.81 found host 66.163.175.81 = smtp004.bizmail.sc5.yahoo.com (cached) smtp004.bizmail.sc5.yahoo.com is 66.163.175.81 Possible spammer: 66.163.175.81 Received line accepted Relay trusted (66.163.175.81 bizmail.sc5.yahoo.com) Received: (qmail 37210 invoked from network); 21 Jul 2005 03:26:27 - Ignored Received: from unknown (HELO User) ([EMAIL PROTECTED]@70.245.85.9 with login) by smtp004.bizmail.sc5.yahoo.com with SMTP; 21 Jul 2005 03:26:26 - 70.245.85.9 found host 70.245.85.9 = adsl-70-245-85-9.dsl.hstntx.swbell.net (cached) adsl-70-245-85-9.dsl.hstntx.swbell.net is 70.245.85.9 Possible spammer: 70.245.85.9 Possible relay: 66.163.175.81 66.163.175.81 not listed in relays.ordb.org. 66.163.175.81 has already been sent to relay testers Received line accepted Tracking message source: 70.245.85.9: Routing details for 70.245.85.9 [refresh/show] Cached whois for 70.245.85.9 : [EMAIL PROTECTED] Using abuse net on [EMAIL PROTECTED] abuse net sbcglobal.net = [EMAIL PROTECTED] Using best contacts [EMAIL PROTECTED] Yum, this spam is fresh! Message is 0 hours old 70.245.85.9 not listed in dnsbl.njabl.org 70.245.85.9 not listed in dnsbl.njabl.org 70.245.85.9 not listed in cbl.abuseat.org 70.245.85.9 not listed in dnsbl.sorbs.net 70.245.85.9 not listed in relays.ordb.org. 70.245.85.9 not listed in accredit.habeas.com 70.245.85.9 not listed in plus.bondedsender.org 70.245.85.9 not listed in iadb.isipp.com Finding links in message body Parsing HTML part Resolving link obfuscation http://larry.clsnp.edu.hk/~larry/uit/.ssls/user_data_login_account_secure_en cryption_ssl_user_signin_online_login/index.htm host larry.clsnp.edu.hk (checking ip) = 210.0.178.155 host 210.0.178.155 (getting name) no name Tracking link: http://larry.clsnp.edu.hk/~larry/uit/.ssls/user_data_login_account_secure_en cryption_ssl_user_signin_online_login/index.htm [report history] Resolves to 210.0.178.155 Routing details for 210.0.178.155 [refresh/show] Cached whois for 210.0.178.155 : [EMAIL PROTECTED] [EMAIL PROTECTED] Using abuse net on [EMAIL PROTECTED] abuse net hgc.com.hk = [EMAIL PROTECTED
RE: [Declude.JunkMail] Sorry off topic - Can't unsubscribe from list
Are you using Declude? If so, are you using Declude's Confirm configuration? If so That is why you can't unsubscribe. There is a big problem with Declude's Confirm. Disable the Confirm file and unsubscribe. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of M Pilletere Sent: Friday, July 15, 2005 8:24 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Sorry off topic - Can't unsubscribe from list Sorry for intrusion. I unsubscribed from Junk mail list last week and still getting them. Could someone please unsubscribe me? Thanks you. Michael --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Ipswitch problems
Funny you mention this I too I am not receiving them as near the date you mentioned. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Wednesday, July 06, 2005 4:30 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Ipswitch problems Sorry to waste DJM bandwidth. I just realized that I stopped receiving Imail_Forum Digests on April 26th. I've tried to re-subscribe, but is this just me, or have they somehow scrambled their Digests? Thanks. -- John Shacklett [EMAIL PROTECTED] [EMAIL PROTECTED] www.continentaloffice.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WHITELIST LOCAL Question
Does anyone know with the new directive WHITELIST LOCAL, if this should not be used with WHITELIST AUTH? Or can the 2 be used together? Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Spam or Virus????!!
Coming in though us too. Using FPROT, but appears now they've updated their defs so they are being caught now. They were non-encrypted ZIP's with different file names, single EXE in the zip. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, April 21, 2005 2:09 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] New Spam or Virus!! Nothing yet. Are these standard zips or encrypted? We block encrypted. Darin. - Original Message - From: Chuck Schick [EMAIL PROTECTED] To: Declude. JunkMail Declude.JunkMail@declude.com Sent: Wednesday, April 20, 2005 8:05 PM Subject: [Declude.JunkMail] New Spam or Virus!! Starting to see messages that have a zip attachement with the format 5.zip or 7.zip - I do not know if it is spam or a virus. Anyone else seeing this? Virus scanner is not catching it so I do not know if it is a virus or not. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail crashes after declude 2.0.6
Title: Message I'll add our point too. We also are crashing with 2.0.6 (also SP1 installed). We've put back 1.82 into production. No issues. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of scott_pownerSent: Tuesday, April 19, 2005 4:35 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Imail crashes after declude 2.0.6 We just put SP1 on this morning but have not had a crash since we went back to 1.81 on Declude. Thanks, Scott -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gufler MarkusSent: Tuesday, April 19, 2005 8:31 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Imail crashes after declude 2.0.6 I haven't upgraded jet to v2 but can see the same problems with imail since installed win2003 SP1 Haven't seen any crash since removing SP1 but this is not 100% sure at the moment.I will report it later this week. Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of scott_pownerSent: Tuesday, April 19, 2005 1:48 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Imail crashes after declude 2.0.6 Last Friday I finally upgraded from 1.81 to 2.0.6. We use Declude Pro Anti-Spam and Anti-Virus. On Friday after the install Imail web messaging crashed several times. We let the problem go until Monday. On Monday the problems got worse with numerous crashes of web messaging. I finally recopied 1.81 and have been crash free for 2 hours. What is going on with 2.0.6? Do I need to reconfigure something? Win2003 on a xeon processor with 2gb memory. Thank you, Scott Powner MIU4 [EMAIL PROTECTED]
RE: [Declude.JunkMail] newbie question: imail antispam vs junkmail
Agree. We also use the same as Scott. Imail's anti-spam is not used. Only Declude, Sniffer and Invariant's URIBL. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, April 15, 2005 9:52 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] newbie question: imail antispam vs junkmail I've turned off all of Imail's stuff. I also use Sortmonster's Message Sniffer and Invariant's Invuribl addons. - Original Message - From: M Pilletere [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, April 15, 2005 2:35 PM Subject: [Declude.JunkMail] newbie question: imail antispam vs junkmail Hi, I just started using junkmail and was wondering how people used it. I would like to know if both imail's antispam and junkmail are used together or if it is better to turn off imail and just tweak junkmail? Seems like using junkmail only would make maintenance easier, but maybe imail has something junkmail does not. Thanks Michael Pilletere Network Administrator RSR Group, Inc. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Legalities of adding header info
Dan, we do the same thing. Our terms of service, privacy page and contracts state that we reveal BCC's in the headers. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Friday, April 08, 2005 4:17 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Legalities of adding header info I have a customer that is PO'ed at us. We put the recipients of emails into the headers of every email using Declude's %ALLRECIPS% variable. This is so we can identify the people who incorrectly report us as spammers to AOL just because we forward their mail for them. Since AOL strips that out, we use Declude to figure out who the message was sent to. So this customer gets a bounce message from an email he sent to his clients making extensive use of BCC:. In the headers of the bounced email, he saw his whole client list. Now he's PO'ed, threatening legal action, etc, claiming we are intentionally forwarding identifying information a user thought was confidential. Any thoughts on the legal liabilities of bypassing the BCC: functionality in this way? My supes has tasked me with finding out about our responsibility in this matter (the email admin instead of the lawyer, natch). -Dan Horne --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Off Topic.
HELM is good for Windows, but lacks in Password Policies. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Oren Sent: Friday, March 18, 2005 6:46 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Off Topic. HostingAccelerator is not very good at all, it's full of bugs and the support is awful. We host and manage over 100 servers and have tried our just about every control panel out there. In my opinion, Plesk 7.x or later on Linux and HELM on Windows is the way to go. We looked at Plesk on Windows a while back and it was not quite ready for prime time, but the new versions may be much improved. We plan to take another look soon. David Barker wrote: Fred, There are quite a few out there I have heard that http://www.hostingaccelerator.com/ is pretty good. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Friday, March 18, 2005 11:24 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Off Topic. I am looking for recommendations of software that allows users to manage there own web domain. We host websites for many people and we are looking to give them more control. Some sort of Portal/Control Panel. We are a windows shop. Thanks. Fred Samarelli --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. __ NOD32 1.1028 (20050318) Information __ This message was checked by NOD32 antivirus system. http://www.nod32.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Best Regards, Steve Oren President ServerSide, Inc. 317-596-5000 voice 317-596-5010 fax 888-682-2544 toll free www.serverside.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Any word on the 2.06 release?
Title: Message Me either Declude has been pretty silent with a lack of communication in all areas. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Wednesday, March 16, 2005 5:17 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Any word on the 2.06 release? I haven't heard anything in the past couple of weeks about the fixes to 2.05 that were being worked on...still waiting to see the fixes before upgrading from 1.82. Darin.
RE: [Declude.JunkMail]Log Question
There is an issue with 2.0+ and the DELETE action when there's a certain type of configuration used. Declude seems to be aware of it, but no official notice or known issues have been posted; other then from user's of DECLUDE. We've elected to revert back to 1.82 (with the subject fix) for the time being. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Shaffer Sent: Monday, March 07, 2005 9:01 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail]Log Question Declude 2.0.5 iMail I have an entry in $default$.junkmail of WEIGHT7 DELETE Log reads 02/28/2005 00:01:01 Qcfa509be026a910d Tests failed [weight=68]: AHBL=WARN BLITZEDALL=WARN CBL=WARN DSBL=WARN SORBS-SOCKS=WARN SORBS-MISC=WARN SORBS-SPAM=WARN SORBS-WEB=WARN SPAMCOP=WARN CMDSPACE=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE REVDNS=WARN #WEIGHT1=IGNORE #WEIGHT2=IGNORE #WEIGHT3=IGNORE #WEIGHT4=IGNORE #WEIGHT5=IGNORE #WEIGHT6=IGNORE WEIGHT7=DELETE #WEIGHT8=IGNORE #WEIGHT9=IGNORE WEIGHT10=DELETE #WEIGHT11=IGNORE #WEIGHT12=IGNORE #WEIGHT13=IGNORE #WEIGHT14=IGNORE #WEIGHT15=IGNORE WEIGHT20=DELETE CATCHALLMAILS=IGNORE 02/28/2005 00:01:01 Qcfa509be026a910d Last action = IGNORE. message is deleted. Shouldn't all messages above 7 read? 02/28/2005 00:01:01 Qcfa509be026a910d Last action = DELETE. not 02/28/2005 00:01:01 Qcfa509be026a910d Last action = IGNORE. This seams to have changed apx 1-15-05. What changed? Thanks Chuck --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 2.x
Title: Message And also: If you have the COPY ALL EMAIL active in Imail.. the DELETE action does does not work. In our setup, we do not use any ROUTETO in any of our config files. And you can not setup a per domain/user for that copy all email account. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Friday, March 04, 2005 6:17 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Declude 2.xJohn Tolmachoff (Lists) wrote: I have not been following the thread in detail, but if some one that is having the problem would change to WEIGHTRANGE instead of WEIGHT and ensure there are no overlappings, I have a feeling the at least part of the "problem" might be resolved.No, this isn't an appropriate solution. The change makes ROUTETO the final action, and now it has precedence over DELETE. If you have a filter called BLACKLIST-NO-MATTER-WHAT set to DELETE, and a message fails that test plus it fails something that has a ROUTETO action, it will not be deleted. This change removes our ability to override ROUTETO in special circumstances. While most issues will be fixed by preventing the overlapping of weight ranges and the actions, that only applies to weight based things, and this ties our hands when it comes to taking actions regardless of weight. That's completely unacceptable, and I also assume that it was unintentional; the result of an oversight.If DELETE is to be changed in the way that they did, they must make it be able to target a recipient that has already been tagged with ROUTETO. It makes no sense to use the changed ROUTETO address for determining further actions. This will also be very difficult to troubleshoot in some circumstances and also difficult to keep track of.Declude needs to make sure that the actions are not applied based on the ROUTETO address' config, but instead the original recipient's config. If they did that, all problems would be solved, including the overlapping weight range issue that seemingly has stung so many here.Matt-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] OT: Clock Time on Declude Support
Is just my browser, or is Declude's clock on: https://www.declude.com/SearchResults.asp?Cat=5 Off? In CET (Central European Time) of 2:15AM, their clock shows 4:15AM EST when it should be showing 9:15PM EST. .hope this doesn't reflect in their 2.0 programming code. ;-) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Version 2.x, High-Weight Junkmail Not Deleted
I can agree with you Fritz... We too have had the same issues and in response to David Franco-Rocha message, we DID submit to Declude support our problems with STILL no resolve or further communication about it. [RNJ-98263] Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fritz Squib Sent: Thursday, March 03, 2005 2:44 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Version 2.x, High-Weight Junkmail Not Deleted Gee, Me too, this is what I have been complaining about, and submitted an unresolved trouble ticket [INN-34053] since the first 2.x release. I've got it half working by changing my global config to: WEIGHT20weightrangexxxx WEIGHT32weightxxxx fill in your own values for x, my config used to be weight / weight, changing to weightrange / weight *seemed* to help. Fritz Frederick P. Squib, Jr. Network Operations/Mail Administrator Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html email /\- against microsoft attachments --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 2.0 Issues
It would be nice Declude would post this information instead of ignoring requests or using not a priority as a result. The DELETE action is not taking the action it should. We too have reverted back to 1.82 as this version seems to be steady for us. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Thursday, March 03, 2005 4:27 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 2.0 Issues On 2 Mar 2005 at 18:07, Darin Cox wrote: Hi Darin, 2.05 will pass email that should have been deleted. The total weight may be 3 times your delete weight and the email will still be delivered. Declude tech support is aware of the problem - and as far as I know it is unresolved. I am back to 1.82 -Nick Repost. Just to clarify: Other than the logging issue you referred to, are there any known issues with 2.05? If so, is there a list I can review to determine if we're ready to upgrade? - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, March 01, 2005 1:51 PM Subject: Re: [Declude.JunkMail] Declude 2.0 Issues Great response to the concerns, David. Much appreciated. Just to clarify: Other than the logging issue you referred to, are there any known issues with 2.05? If so, is there a list I can review to determine if we're ready to upgrade? Thanks, Darin. - Original Message - From: David Franco-Rocha [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, March 01, 2005 1:43 PM Subject: [Declude.JunkMail] Declude 2.0 Issues No issue reported to us regarding Declude software will ever be considered trivial or unimportant. It is essential that all issues be reported to Declude Support. A number of comments made recently on these lists refer to issues never reported to Declude. It should also be understood that the Declude forums are very informative for finding out from others whether they have experienced similar issues with the software. They are not, however, intended to be a mechanism for reporting problems to us. We have been monitoring the list messages regarding the DELETE action when there is a COPYALL account and we are concerned as to perceptions that there is a problem or issue with the software. There is a difference of opinion on how a COPYALL account should actually function: (a) to receive a copy of every message processed by the mail server, whether legitimate or not; (b) to receive a copy of only those messages for which there is at least one valid delivery. Aside from differing opinions on how the COPYALL account should function, our tests show that individual recipients whose per-user configurations specified DELETE were in fact being deleted from the recipient list and were not receiving the messages. At the same time, however, we discovered that there was information in the log file that would lead one to believe that the recipient was not being deleted. If the last recipient did not have DELETE as the action to take, the last action in the log file would not read DELETE, even if the previous recipient had been deleted. We are making the appropriate changes to the log file to ensure that all actions taken will be accurately recorded. In addition, we are implementing a configurable parameter to allow or disallow actions to apply to the COPYALL account. This release will be available after user testing and acceptance. It is important to know that we respond to each and every issue raised through our support system and also that when making a quote as to what 'Declude' may have said that the correct words are used within the appropriate context. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The
RE: [Declude.JunkMail] Is declude.com down?
It is on our end too... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Che Vilnonis Sent: Thursday, March 03, 2005 5:24 PM To: Declude Email List Subject: [Declude.JunkMail] Is declude.com down? anyone? Che Vilnonis Application Developer Advertising Systems Incorporated 8470C Remington Avenue Pennsauken, NJ 08110 p: 856.488.2211 f: 856.488.1990 www.asitv.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 2 and DELETE
Fritz, We've experienced the same problem as you and for us, it was narrowed down to the catchall account in Imail. If you have a catchall account in the Imail setup, Declude will not work correctly. After many emails to Declude about this, they confirmed to me this IS a problem and one of not a high priority to fix. We've reverted back to 1.82 until it's fixed. Also, Decludes' COMFIRM.CFG does not work correctly either when there is a catchall account. The local Declude will intercept any confirmation email that going to another Imail/Declude Confirm system (thus the email never reaches it's intended source. Again, response from Declude was: it's not a high priority. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fritz Squib Sent: Tuesday, March 01, 2005 2:42 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 2 and DELETE Apparently I missing something bloody obvious, but with 2.0 running it seems like my delete action doesn't work as expected any more. Running the latest 2.x release downloaded last night. --Global Config-- WEIGHT20weight x x 20 0 WEIGHT30weight x x 32 0 --Default.junkmail-- WEIGHT20HOLD WEIGHT30DELETE In a brief conversation with Declude the response I got was: The problem is probably the change in the way the DELETE action works. In the past, it would delete the E-mail for all recipients. Now, it only deletes the E-mail for recipients that use the DELETE action. It still seems like the HOLD action is taking precedence over the DELETE action since mail with weight over my WEIGHT30 test winds up in the hold folder even though the log file says: 02/01/2005 12:25:06 Qbb6c48770128853b Msg failed WEIGHT30 (Weight of 44 reaches or exceeds the limit of 32.). Action=DELETE. I has sent Scott debug log files but I still haven't figure out what I'm missing. Yes there are a *few* per user .junkmail files, with an action of WARN, but most of the held mail is either not for them (nor are they CC'd or BCC'd as far as I can tell) and/or (may or may not be related) in the spam review application there is no To: field reported. I have also tried changing 'weight' to 'weightrange' with the appropriate scores, and still see the same results Anyone else ? Fritz Frederick P. Squib, Jr. Network Operations/Mail Administrator Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html email /\- against microsoft attachments --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 2 and DELETE
I should confirm my post... By the catchall account, I'm referring to the Copy All Mail enabled setting in IMAIL. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, March 01, 2005 3:04 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 2 and DELETE What exactly is the problem with the catchall account, and when is a fix expected? We haven't yet upgraded to 2.0 because of the periodic mention of problems with it on this list, but would like to as soon as all known issues are resolved. We don't have many nobody aliases, but we haven't been able to convince a couple of customers to remove them yet. Darin. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, March 01, 2005 8:54 AM Subject: RE: [Declude.JunkMail] Declude 2 and DELETE Fritz, We've experienced the same problem as you and for us, it was narrowed down to the catchall account in Imail. If you have a catchall account in the Imail setup, Declude will not work correctly. After many emails to Declude about this, they confirmed to me this IS a problem and one of not a high priority to fix. We've reverted back to 1.82 until it's fixed. Also, Decludes' COMFIRM.CFG does not work correctly either when there is a catchall account. The local Declude will intercept any confirmation email that going to another Imail/Declude Confirm system (thus the email never reaches it's intended source. Again, response from Declude was: it's not a high priority. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fritz Squib Sent: Tuesday, March 01, 2005 2:42 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 2 and DELETE Apparently I missing something bloody obvious, but with 2.0 running it seems like my delete action doesn't work as expected any more. Running the latest 2.x release downloaded last night. --Global Config-- WEIGHT20 weight x x 20 0 WEIGHT30 weight x x 32 0 --Default.junkmail-- WEIGHT20 HOLD WEIGHT30 DELETE In a brief conversation with Declude the response I got was: The problem is probably the change in the way the DELETE action works. In the past, it would delete the E-mail for all recipients. Now, it only deletes the E-mail for recipients that use the DELETE action. It still seems like the HOLD action is taking precedence over the DELETE action since mail with weight over my WEIGHT30 test winds up in the hold folder even though the log file says: 02/01/2005 12:25:06 Qbb6c48770128853b Msg failed WEIGHT30 (Weight of 44 reaches or exceeds the limit of 32.). Action=DELETE. I has sent Scott debug log files but I still haven't figure out what I'm missing. Yes there are a *few* per user .junkmail files, with an action of WARN, but most of the held mail is either not for them (nor are they CC'd or BCC'd as far as I can tell) and/or (may or may not be related) in the spam review application there is no To: field reported. I have also tried changing 'weight' to 'weightrange' with the appropriate scores, and still see the same results Anyone else ? Fritz Frederick P. Squib, Jr. Network Operations/Mail Administrator Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html email /\- against microsoft attachments --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 2.0 Issues
Since we did use the essential means of reporting this problem, we still got back: No. Declude Confirm hasn't been changed in a number of years, so it is not currently a high priority. -Scott And: As for Declude Confirm, I understand that it is a priority for you. The reasons why it isn't a very high priority right now are that [1] it is a free program, and taking time to modify it takes away from time making changes to products our customers are paying for, and [2] this is an issue that has been in the Declude Confirm code for many years without anyone reporting it. Unfortunately, there are just too many things that need to be done, and not enough time for everything. -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Franco-Rocha Sent: Tuesday, March 01, 2005 7:43 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude 2.0 Issues No issue reported to us regarding Declude software will ever be considered trivial or unimportant. It is essential that all issues be reported to Declude Support. A number of comments made recently on these lists refer to issues never reported to Declude. It should also be understood that the Declude forums are very informative for finding out from others whether they have experienced similar issues with the software. They are not, however, intended to be a mechanism for reporting problems to us. We have been monitoring the list messages regarding the DELETE action when there is a COPYALL account and we are concerned as to perceptions that there is a problem or issue with the software. There is a difference of opinion on how a COPYALL account should actually function: (a) to receive a copy of every message processed by the mail server, whether legitimate or not; (b) to receive a copy of only those messages for which there is at least one valid delivery. Aside from differing opinions on how the COPYALL account should function, our tests show that individual recipients whose per-user configurations specified DELETE were in fact being deleted from the recipient list and were not receiving the messages. At the same time, however, we discovered that there was information in the log file that would lead one to believe that the recipient was not being deleted. If the last recipient did not have DELETE as the action to take, the last action in the log file would not read DELETE, even if the previous recipient had been deleted. We are making the appropriate changes to the log file to ensure that all actions taken will be accurately recorded. In addition, we are implementing a configurable parameter to allow or disallow actions to apply to the COPYALL account. This release will be available after user testing and acceptance. It is important to know that we respond to each and every issue raised through our support system and also that when making a quote as to what 'Declude' may have said that the correct words are used within the appropriate context. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Imail / DNS / and 2nd MX records
This is OT for this list but am hoping someone could provide me some input. We have been having problems sending to one domain that we do not host. After investigating it, here is what I have found. The domain ipapilot.org has 2 MX records. Sometimes, our DNS server wants to use their 2 MX record even though that domain has properly configured priority numbers and their primary server is active. The problem when it does resolve to their 2 MX record, is that server does not except email. So then the message gets requeued and still tries to deliver to the 2nd MX until finally the number tries have been reached in iMail and the email returns to sender. We have, after talking to ipapilot.org to them about (why they have 2nd email server that doesn't accept any mail); proves useless. To me, it appears they are using that 2 MX as a greylist server as the response from it is always: 451 Try Again. Our caching in Imail has been turned off for years. So the problem may be in our DNS Server (Simple DNS Plus) where it's not retrying to get the MX record again; but rather using it's cache. Sometimes our DNS does pull the primary MX, other times the 2 MX. Is this a problem with our DNS? Or does DNS pull any MX it finds (no matter the priority?) Thanks, Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail / DNS / and 2nd MX records
Thanks Darrell, Our Imail version is 8.15 with the latest hotfix of 2005.02.01.8 Our DNS server is Simple DNS Plus version 3.50 which runs on the same server as Imail (Imail Declude) use this DNS. According to dnsreports.com, ipapilot.org is configured corrected (a few warnings; but I don't think is the cause of our problems)? If I clear the cache in our DNS server, it will resolve correctly for the next queue run. But then later at random when another email needs to go to ipapilot.org, it will still at times choose their 2nd MX record. Temporarily, I've added ipapilot.org to our Windows HOSTS file until I can find out what is going on. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Saturday, February 19, 2005 6:32 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Imail / DNS / and 2nd MX records Erik, IMAIL should observe the priority of the MX records. In older versions of IMAIL I beleive it did not do this correctly. I beleive using the MX with the correct priority came into version 7.1x of IMAIL. What version are you running? My understanding is that 4xx error codes are temporary errors codes which means that IMAIL will not attempt to try the other MX record causing it to be requeued and attempted to be delivered later. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, February 19, 2005 9:28 AM Subject: [Declude.JunkMail] OT: Imail / DNS / and 2nd MX records This is OT for this list but am hoping someone could provide me some input. We have been having problems sending to one domain that we do not host. After investigating it, here is what I have found. The domain ipapilot.org has 2 MX records. Sometimes, our DNS server wants to use their 2 MX record even though that domain has properly configured priority numbers and their primary server is active. The problem when it does resolve to their 2 MX record, is that server does not except email. So then the message gets requeued and still tries to deliver to the 2nd MX until finally the number tries have been reached in iMail and the email returns to sender. We have, after talking to ipapilot.org to them about (why they have 2nd email server that doesn't accept any mail); proves useless. To me, it appears they are using that 2 MX as a greylist server as the response from it is always: 451 Try Again. Our caching in Imail has been turned off for years. So the problem may be in our DNS Server (Simple DNS Plus) where it's not retrying to get the MX record again; but rather using it's cache. Sometimes our DNS does pull the primary MX, other times the 2 MX. Is this a problem with our DNS? Or does DNS pull any MX it finds (no matter the priority?) Thanks, Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail / DNS / and 2nd MX records
Thanks So do would need to make a change to our DNS cache - to expire sooner? It is just strange that it is only happening on this domain (as far as we are aware). And the only reason we are aware of it is that domain has a second MX that does not accept email; so it's being returned to sender. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Saturday, February 19, 2005 7:04 PM To: Erik Subject: Re: [Declude.JunkMail] OT: Imail / DNS / and 2nd MX records Sometimes, our DNS server wants to use their 2 MX record even though that domain has properly configured priority numbers and their primary server is active. Use the secondary, if it's the only MX record IMail ever sees = perfectly valid for IMail, broken in DNS. Use the secondary, even if the primary MX record was returned to IMail = broken for Imail, valid for DNS. The problem when it does resolve to their 2 MX record, is that server does not except email. i.e., their server is broken, and they're showing it off. Our caching in Imail has been turned off for years. So the problem may be in our DNS Server (Simple DNS Plus) where it's not retrying to get the MX record again; but rather using it's cache. The cache should contain all MX records that were originally returned. It's not one-at-a-time. Sometimes our DNS does pull the primary MX, other times the 2 MX. i.e., your DNS server is _also_ broken. Is this a problem with our DNS? Or does DNS pull any MX it finds (no matter the priority?) It must pull all valid MXes -- how else would it be able to retry? --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/re lease/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Phone's Home
The software used to do this in prior versions as well. My company has asked me to look into other spam control because of the non-discloser of such activity the software does behind doors; as it is a privacy issue using our resources without consent; is how they put it to me. It sucks, as I, from an IT standpoint, like Declude. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Monday, October 04, 2004 2:20 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude Phone's Home Did you guys know Declude phone's home now: undeliverable to [EMAIL PROTECTED] Original message follows. Date: Fri, 1 Oct 2004 18:48:12 -0400 Message-Id: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: @***.com Reply-To: @***.com To: [EMAIL PROTECTED] Subject: Re: decdata install X-Mailer: IMail v7.13 Declude v1.81.2590 installed on mail.**.com. I completely agree that IP owners have the right to make sure their license agreements are being honored, however, if you're going to start doing stuff like this, then you'd better be fully disclosing what you're software does. I have a valid SA and downloaded the new version from my account but I don't like not knowing what software on my systems is doing. BTW-this was a manual copy of the .exe, not an automated install. -- Best regards, David mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Phone's Home
I agree with you Andy. I have no problems with Declude at all. The software must ask for permission to send any information back to it's authors... Just like Microsoft and it's new licensing requirement. We also develop software; as I'm sure most on this list does. Our software does have privacy (a make sure they are licensed) type of code it... But it never sends out any information without that Clients knowledge. Again, just so everyone is aware... I (personally) have no problem with Declude. It is a great product. But sending out information that is not made aware of when it does so, it's a privacy concern to our upper management. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Monday, October 04, 2004 3:06 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude Phone's Home I agree - I love Declude. My company has asked me to look into other spam control because of the non-discloser of such activity the software does behind doors But with that information, I can tell you that my management would be in the same boat. If a security software (virus protection / defending against phishing, etc.) turns out to have ONE hidden enablement for the software vendor - then they'd automatically assume that the vendor is not playing with an open deck and there could be other, much worse, backdoors. I fully approve and agree that Declude should strictly enforce their rights to annual maintenance. But an underhanded approach like this questions their ethics (not in my mind - but in the mind of those who don't need to know the details and only look at the big picture.) Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Outlook HTML Question
Right-click in the body of the HTML message and choose, View Source -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Wednesday, May 12, 2004 5:57 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Outlook HTML Question Hi, Does anyone know how to do this? If an HTML mail arrives in Outlook how can you look to see what the HTML source is? I have looked and do not see any View Source and the Save as options did not work. Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] JunkMail configurable front end
Has anyone else built a front end for JM, so the end user (in our case our ISP customers) can configure certain aspects of Declude JM? What we have in mind is to charge each subscriber for using JM, and also to give some control over the actions, i.e. let them choose between IGNORE, WARN, SUBJECT, MAILBOX and DELETE within the 6 weightranges we set. Initially we will choose ranges going up to 100 and adjust the test values accordingly so that we may have a reasonable certainty that anything at 100 or over can be deleted. Perhaps the Spam-Prob test will be helpful here when it becomes available. I had hoped that there would be a possibility of per-user filtering, but perhaps it is for the best that there is not, so we are instead considering building a half dozen standard filters to choose from, such as Adult/Porn, Medical/Drugs, Financial/Mortgage/Insurance, and Home/Garden, Get-Rich-Quick/Franchieses/Work-at-Home, etc. Any thoughts or experiences? Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
