RE: [Declude.JunkMail] receiving a message enoded in base64 that the body text displays in garbage
I would first find out if the base64 encoding arrived in tact...this is a link to a base64 decoder.. http://www.opinionatedgeek.com/dotnet/tools/Base64Decode/ Just copy and paste the message into the window, and if it has arrived correctly, it should be readable. If it is readable, then there is something wrong with the recipient's end user environment. If it is not readable, then there is a problem with the transmission architecture...somewhere. It sounds like one possibility is a character is getting stripped out of the encoding, but running the test above would test for that. Try just a simple message to the client and have them run the test. It might help to narrow down the problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Howard Smith (N.O.R.A.D.) Sent: Thursday, May 01, 2008 5:54 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] receiving a message enoded in base64 that the body text displays in garbage Need help I have a client that is receiving important emails encoded in base64 , that displays un translated in the body of the message , this in outlook2007 and webmail . I am running Imail 9.23 and Declude 4.3.46 Howard Smith N.O.R.A.D. Inc. P.O. Box 680116 Miami, Florida 33168 www.norad.com www.securetrek.com www.siteshuttle.com www.audiovideotrek.com [EMAIL PROTECTED] Office - (305) NETWORK (638-9675) Sales - (786) 206-0045 Fax 1 - (305) 359-5144 Confidentiality Notice: This email message, including any Attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact [EMAIL PROTECTED] by email and destroy all copies of the original message. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.image002.png
[Declude.JunkMail] Spoofed names
What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spoofed names
I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:07 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spoofed names What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spoofed names
I added the VPN Server ipaddress as well as my current VPN Address to the global.cfg whitelist section, but it did not help the problem. Declude immediately grabs any message that I send except for a reply to someone else's email and dumps it into the spam folder. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:33 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:07 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spoofed names What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spoofed names
Hi David... I applied the CIDR address range to the global.cfg WHITELIST, but emails sent via VPN are still getting filtered into the SPAM folder. I am still scratching my head on this one...so far nothing has affected this problem. Jon Lucas Poly-Cast, Inc. 503-648-5357 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thursday, April 03, 2008 8:46 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names You have to use CIDR range as the example you provided: WHITELIST IP 198.107.21.0/24 However remember that users who authenticate with the server are automatically whitelisted. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 11:33 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:07 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spoofed names What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
FW: [Declude.JunkMail] Spoofed names
Hi David... I applied the CIDR address range to the global.cfg WHITELIST, but emails sent via VPN are still getting filtered into the SPAM folder. I am still scratching my head on this one...so far nothing has affected this problem. Jon Lucas Poly-Cast, Inc. 503-648-5357 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thursday, April 03, 2008 8:46 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names You have to use CIDR range as the example you provided: WHITELIST IP 198.107.21.0/24 However remember that users who authenticate with the server are automatically whitelisted. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 11:33 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:07 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spoofed names What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spoofed names
I found that if I whitelist each VPN user, then we can successfully send email via a VPN connection, so we at least have a viable fix for the problem. I believe that the key is that being authenticated on the VPN server does not necessarily mean that the user is authenticated on the mail server. However, even after being authenticated to a server resource still did not allow email to send messages without getting filtered out. At least it is working now. Jon Lucas Poly-Cast, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thursday, April 03, 2008 8:46 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names You have to use CIDR range as the example you provided: WHITELIST IP 198.107.21.0/24 However remember that users who authenticate with the server are automatically whitelisted. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 11:33 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:07 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spoofed names What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spoofed names
We are through Outlook where we configure our email server requires authentication and the password is input there...I just don't know why that is getting missed by the email system... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thursday, April 03, 2008 9:10 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names Are you authenticating with your mail server? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 12:00 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I added the VPN Server ipaddress as well as my current VPN Address to the global.cfg whitelist section, but it did not help the problem. Declude immediately grabs any message that I send except for a reply to someone else's email and dumps it into the spam folder. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:33 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 8:07 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spoofed names What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@domain name.com. I tried blacklisting the name, but it appears that Declude then filters out all domain name emails. I then went to the spam folder, and put all of the NAMES in ANYWHERE, but that did not stop the emails from getting hung in the queue...We are running Declude 4.3.46. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Forged-Spam Backscatter
Will the filter keep spoofed email senders from getting into the queue manager in IMail? the format I am seeing is like bipweks@domain-name.com . The biggest problem I see is the server keeps re-trying to send the email, but bipweks account does not exist in our email system, so I would like to keep them from getting into the queue manager. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thursday, April 03, 2008 12:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Forged-Spam Backscatter We use 2 filters to address the issue which work well for us. I will make them available on our website this week. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Comerford Sent: Thursday, April 03, 2008 2:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Forged-Spam Backscatter Over the last several weeks we have seen a dramatic increase in spam hitting our server. From about 70,000 mails a day to around 110,000 /day. Most destined for our users is getting properly filtered by declude. What is getting thru is backscatter from spam that is forging addresses from domains we host. It seems just about any address that is posted on a website seems to be being used to forge outgoing spam (not from our server) -- and is generating all sorts of bounce messages. I suspect there is not much I can do to block this backscatter without blocking legit bounce messages... but I thought I'd ask. Here is our config: Imail 8.22 Declude 4.3.64 invURIBL 3.1.1 Sniffer --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Decludeproc stops for no reason
Good Morning, Rick... I have noticed a big increase in the number of DoS attacks on our mail server...Time, Event, Intruder, Count, Destination Port, Source Port 10-04-07 7:10:51 AM, Email_Mailman_Date_DoS, pD9E67014.dip.t-dialin.net, 1, 25, 3731, and it is a malformed header,([Denial of Service] This signature detects an email that contains a 'Date:' or 'X-List-Received-Date:' header that contains a malformed date.) and they are mostly coming out of Europe and China (go figure). I use a secondary ISS firewall on our server mostly for monitoring port probes. Otherwise, you may not see these attacks. Because of the timing you mentioned, and the timing of the increased attacks I am seeing, I thought there may be a correlation. We are running Imail 8.05 and Declude 4.3.46. The service stopping could be related to a filter that you have turned on that we have not, which wouldn't be good in any case because that means we are letting the Dos through, and you are are filtering it, but it is stopping your service... Jon Lucas Poly-cast, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Rick Hogue Sent: Thursday, October 04, 2007 12:59 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason Yes the service stops. The event viewer states that DecludeProc stopped unexpectedly and has done this 1 time and that the service will be restarted. I am currently using version 4.3 Most times it will restart but if it stops like this two or three times in a 30 to 40 minute range then it hangs and will not restart without at least one reboot. Rick Hogue I love woodworking! What is your hobby? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (lists) Sent: Thursday, October 04, 2007 3:25 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason Since Hobbies are something we do when we have the time, my hobby is sleeping. ;-) Oh, sorry, your question. When this happens, is the service actually stopped? (Is decludeproc listed in Task Manager?) When you try to restart it, what error is displayed or logged in the Windows Event log? What version of Declude? John T -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Hogue Sent: Wednesday, October 03, 2007 11:25 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Decludeproc stops for no reason Over the past 3 days I have had to reboot one of our mail servers at least 6 times due to the decludeproc stopping for no reason and not restarting. We run 8.21 Imail with declude and sniffer but I keep getting these stops. This was happening about once per week for a while and then it stopped but now it seems to be doing it daily. Any help on this would be appreciated. Rick Hogue I love woodworking! What is your hobby? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
