[Declude.JunkMail] OT: The Titian Key Product to Remove Spam.. patent pending?
FWIW.. Looks like a variation of a mail gateway at a cost of $1000.00 per month! http://www.titankey.com/features.asp eddie :)
RE: [Declude.JunkMail] DNS server returned server failure for
I have suffered from this also, so much so that I have even explored the use of SimpleDNS without success thinking that this was a external DNS problem. I was hoping that by bringing the DNS (as a DNS cache) locally to the mail server did infact reduce the frequency of this error, unfortunately it did not solve the occurance of this error. Although this may not help, I am just laying out on the table my observations for all to pounder over.. Eddie :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff Sent: Tuesday, March 11, 2003 9:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] DNS server returned server failure for What is the best way to diagnose/investigate these: 03/11/2003 11:04:05 Q33230c6100e83de9 WARNING: DNS server 67.94.227.35 returned a SERVER FAILURE error for MX or A for John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Forcing sum of weights to exact weight question...
I'm pretty sure this can't be done, but what the heck right :) Overview of weights Filter1 (foreign characters) RouteTo [EMAIL PROTECTED] Filter2 (adult spam) RouteTo [EMAIL PROTECTED] Weight23-30 Action HOLD Weight31-200 Action RouteTo [EMAIL PROTECTED] Here is my problem, When I have spam that fails filter1 or filter2 tests with a score of 25, the HOLD action superceeds the RouteTo action. Is it possible to state somewhere in the Golbal.cfg that: If filter1 fails, reset Total weights to 210. If filter2 fails, reset Total weights to 220. This way i do not need to make extremely wide ranges above 200 to compensate for the various sums.. Did I lose anyone yet? :) Sincerely, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: Filters
Do the filters have to be a single word, or can it contains a exact phrase? e.g. BODY 100 CONTAINS Foreign Liaison Officer of the board of trustee of RWA Agency ( Relief West Africa) Thanks, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: Filters
Better yet, maybe if it was stated in the documentation, a search would not be needed. Nor would a email of this question would have materialized. Eddie Pang. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Friday, November 29, 2002 2:10 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] FW: Filters A search of the archives would show that this has been asked before and the answer is no, spaces are not allowed. Declude is working on possibly changing this. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of eddie pang Sent: Friday, November 29, 2002 3:38 PM To: Declude. JunkMail@declude. com Subject: [Declude.JunkMail] FW: Filters Do the filters have to be a single word, or can it contains a exact phrase? e.g. BODY 100 CONTAINS Foreign Liaison Officer of the board of trustee of RWA Agency ( Relief West Africa) Thanks, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Displaying Message weight in the header
Add a %WEIGHT% into the header. e.g. XINHEADER X-Spam-Tests-Failed: %WEIGHT% %TESTSFAILED% eddie :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of malcolm Sent: Friday, November 29, 2002 5:38 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Displaying Message weight in the header Hi, Is it possible to display the final weight of the message in the header Regards, Malcolm --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: Filters
This example is used to remove s*pam with korean characters in emails, contributed to me by Heinrich. e.g. HEADERS 50 CONTAINSeuc-kr HEADERS 50 CONTAINSks_c eddie :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of malcolm Sent: Friday, November 29, 2002 4:55 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] FW: Filters Is there a test like this for headers? Regards -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Fri, 29 Nov 2002 19:26:15 -0500 spaces are not allowed. Spaces are actually fine in the filters; the problem is that you can't have spaces before or after what you are filtering. For example, you can have: BODY 100 CONTAINS Foreign Liaison Officer of the board of trustee of RWA Agency ( Relief West Africa) but, that would function identically to: BODY 100 CONTAINS Foreign Liaison Officer of the board of trustee of RWA Agency ( Relief West Africa) (which has spaces before and after the filter text). This is typically a problem when trying to match words, so that word won't catch crossword. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Charset filter.
Thank you, Very very much!!! I've been bashing my head trying to get this to work... Sincerely, Eddie :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Heinrich Richter Sent: Wednesday, November 27, 2002 10:18 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Charset filter. Hi Eddie, we receive a lot of SPAM from Korea. For this reason we have set up a filter by charset and assign this mails a high weight. This works very good for us. Following is the context of the korea.txt file. HEADERS 15 CONTAINS big5 HEADERS 15 CONTAINS euc-kr HEADERS 15 CONTAINS gb2312 HEADERS 15 CONTAINS iso-2022-jp HEADERS 15 CONTAINS iso-2022-kr HEADERS 15 CONTAINS ks_c Heinrich - Original Message - From: eddie pang [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 28, 2002 8:39 AM Subject: [Declude.JunkMail] Charset filter. Does anyone check the charset of a email? We are receiving a bunch of korean emails from hotmail and yahoo, I was wondering if anyone has setup a filter isolating emails by charsets? Thanks, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - [This E-mail was scanned for viruses by Declude Virus/F-Prot] - [This E-mail was scanned for viruses by Declude Virus/F-Prot] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Charset filter.
Does anyone check the charset of a email? We are receiving a bunch of korean emails from hotmail and yahoo, I was wondering if anyone has setup a filter isolating emails by charsets? Thanks, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Habeas Test - Invalid WHITELIST Type.
Hi Jeff, I just tried using the default stated in the http://www.declude.com/Release/162/GLOBAL.CFG and I get this message. 11/22/2002 16:23:02 Invalid WHITELIST type: HABEAS I just tried it last night without success, and your email reminded me reply to this post... Sincerely, Eddie :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jeff Kratka Sent: Friday, November 22, 2002 11:54 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Habeas Test Just as a curiosity, is anyone using the Habeas test and if so does it help? Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Helobogus error..
Hi All, I was wondering if someone can has experienced a error in helobogus. For some weird reason, I consistantly get a error with helobogus like hotmail.com with the msg failed. For some reason cs.com does not resolve either. 11/19/2002 00:05:07 Q0cd19bfb002cf91d HELOBOGUS:8 REVDNS:4 . Total weight = 12 11/19/2002 00:05:07 Q0cd19bfb002cf91d Msg failed HELOBOGUS (Domain [EMAIL PROTECTED] by has no MX/A records.). 11/19/2002 00:05:07 Q0cd19bfb002cf91d Msg failed REVDNS (This E-mail was sent from a MUA/MTA with no reverse DNS entry.). 11/19/2002 00:05:07 Q0cd19bfb002cf91d Msg failed WEIGHT10 (Weight of 12 reaches or exceeds the limit of 10.). 11/19/2002 00:05:07 Q0cd19bfb002cf91d Msg failed WEIGHT12 (Weight of 12 reaches or exceeds the limit of 12.). 11/19/2002 00:05:07 Q0cd19bfb002cf91d Subject: [FWD: Fwd: FW: Fun Stuff] 11/19/2002 00:05:07 Q0cd19bfb002cf91d From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Thanks in advance, eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
If you feel that for some reason I am wrong for placing them into the list then I would like to here it. I am only human and un-like a computer I do make mistakes and unlike a computer I try to rectify them. I hope Spews is listening... Sorry i just could not resist... eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FX Apps
Hi Karl, You may want to checkout http://www.iopus.com/beee.htm Its a neefty little program that will email a single file or a group of files in a subdirectory when its created. Its great for reports that take overnight to complete. eddie. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Karl Hentschel Sent: Friday, November 08, 2002 6:43 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] FX Apps That would be useful but in the meantime I wrote a little batch file that runs delog, pauses (to let it complete) then renames the default text file to the current date. It worked last night so now I am going to have it move it to the spool directory. I would also like to have it email me a copy automatically. Any ideas how to accomplish that? Karl -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Tom Sent: Thursday, November 07, 2002 5:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] FX Apps Does this update include the option to set the t_rep: option to LOG in order to write a report to the Spool directory? Not yet, though I am considering it. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Junkmail on a backup relay to another Imail server filtered once again.
Hi all, I have a quick question. We have just installed a backup relay to capture all incoming emails in the event our mail server goes down. I have basically made the 2 systems the same priority on the DNS so I can capture some traffic to the backup relay for data. I want to make our relay server just kill off all emails that it captures that are on our blacklist for definite kills. All others will then be directed to our primary email server for final spam filtering. I want this so i can just evaluate all emails on HOLD on our main server rather than going to 2 servers and evaluating the HOLD mails. This is what I have so far. All emails are scanned and filtered on the backup relay, as expected. But!! As the email is fowarded to the main email server, the email server does not scan the relayed mail again in greater detail, instead i get a message E-mail whitelisted - automatically passing all spam tests [@domain.edu] Our mail relay is called MGateway.domain.edu and in our global.cfg I have WHITELIST FROM @Domain.edu. Any hints as to where MGateway.domain.edu is considered okay for processing in Junkmail? Thanks in advance, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOLD action using Imail/Junkmail as a multiple domain gateway
Hi Everyone, We are currently using our email server as a primary email/virus/junkmail server for [ourdomain.edu]. I want to service another external domain [aaa.edu] with virus/junkmail, using Imail as a smarthost/gateway for the other domain. Here is my question. If I setup virus and junkmail as a per-domain config, where does the junkmail hold files get stored for [aaa.edu] domain? The default is \IMail\spool\spam for a single domain like ourdomain.edu[default], would aaa.edu get stored in \IMail\spool\aaa.edu\spam ?? I would like to separate our holds from the other site's hold files. Is this possible? Many thanks, Eddie :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HOLD action using Imail/Junkmail as a multiple domain gateway
Thanks Scott for the update.. Sincerely, Eddie :) = No -- the HOLD action always will quarantine the E-mail to the \IMail\spool\spam directory. However, we have had a number of requests for a way to have the directory configurable on a per-domain basis, so this will likely get added at some point. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Customizing filters
I'm stumpted... How can I apply a weight system to the filter list? I am trying to create a word filter that will flag out Subject: Monday's Motivation from a certain user. Yet, be okay from another user using that subject. I am just testing the word monday's in the subject. Total weight=4. It rejects because of the Filters HOLD in $default.junkmail. Good... Now i remove FILTERS HOLD, and everything passes.. How can I apply a weight system to the filter list? Thanks in advance... Eddie :) == Filter.txt SUBJECT 3 CONTAINS Monday's SUBJECT 3 CONTAINS Motivation MAILFROM5 IS [EMAIL PROTECTED] edited == Global.cfg FILTERS filter D:\IMail\Declude\filter.txt X1 0 WEIGHT10 weight xx 10 0 WEIGHT20 weight xx 20 0 CATCHALLMAILS catchallmails xx 0 0 == $default$.junkmail FILTERS HOLD WEIGHT10 HOLD WEIGHT20 HOLD == Declude log 10/16/2002 15:37:58 Q1474081900e8abf4 FILTERS:4 . Total weight = 4 10/16/2002 15:37:58 Q1474081900e8abf4 Msg failed FILTERS (Message failed FILTERS test (1)). 10/16/2002 15:37:58 Q1474081900e8abf4 Subject: monday's 10/16/2002 15:37:58 Q1474081900e8abf4 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] edited --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam Mail Statistics
Hi everyone, New user to JunkMail here.. I know that declude has a spam trap. Is there data available on this to determine how effective each test is? I am very interested in expanding our definitions from the current defaults, but before i can do that, i kinda would like to see how the each test compares at a bigger sampling.. Or is everyone going on different pathways... Also, how can i create a spam trap, to evaluate how effective each test is to properly setup each weights. e.g. Is there a test that is 100% effective in identifying spam like helobogus, but many spam can bypass this. This way this test is tier one. If a spam fails this, go no further and delete. If helobogus is okay, then apply test 2, etc... I know this is very linear, but without any data on the effectiveness of each test, customizing the defs is gonna be purely trial and error, which I so want to limit.. I dont know... What you you all recommend on how new users should approach to building a better and efficient definitions... Is there a tool available that will read the junkmail logs and break down each test as to their effectiveness? Sincerely, eddie. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Mail Statistics
EXCELLENT!! :) Many thanks :) Atleast now I aint going in blind, although I still dont know what to do, but thats another issue :) Cheers! eddie. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Smart Business Lists Sent: Monday, October 14, 2002 12:24 AM To: eddie pang Subject: Re: [Declude.JunkMail] Spam Mail Statistics eddie, Monday, October 14, 2002 you wrote: EP New user to JunkMail here.. Welcome to the war. EP I know that declude has a spam trap. Is there data available on EP this to determine how effective each test is? Scott posts his monthly spam stats to the IMAIL forum - see http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ search for Spam Statistics or for September see http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg58649.html I think a lot of others keep stats on test results but I don't think I've seen them widely posted. There are 3rd party programs to help you monitor tests and results. See http://www.declude.com/tools/index.html EP I am very interested in expanding our definitions from the current EP defaults, but before i can do that, i kinda would like to see how EP the each test compares at a bigger sampling.. Or is everyone going EP on different pathways... My experience indicates that communities are sufficiently different to require research and subsequent changes. The September and August report from Scott referenced above will certainly give you a larger picture. The problem is not so much trapping messages as that is easy but not trapping legitimate (and wanted) messages that fail tests. There are a good many blacklists of IP's and addresses posted all over the web and there are contributors both here and on the IMAIL list that post such lists. But for the most part where I have tried these in the past I just end up having to weed out more false spam messages. EP Also, how can i create a spam trap, discussed at http://www.mail-archive.com/declude.junkmail@declude.com/msg02642.html and try a google on the phrase create a spam trap EP to evaluate how effective each test is to properly setup each EP weights e.g. Is there a test that is 100% effective in EP identifying spam like helobogus There is really nothing that 100% of spam fails and 100% of non-spam doesn't fail as far as I know. I fail on the single tests: ORDB, MAILFROM, PERCENT, SNIFFER, and one IP blacklist. All other tests have to accumulate to a fail weight. EP recommend on how new users should approach to building a better EP and efficient definitions... It depends a bit on what you want to do. You can take a wholesale approach and delete or mark many messages and try to figure out a way to move the responsibility downstream to the user - or not. Or you can take a more granular approach and try to refine your system so that you are more and more effective on trapping spam and reducing false positives. In the former case it doesn't matter too much what you do. In the latter though you have to develop a review strategy for your spam control system. It is not something you can do just once and forget because things change. 1) develop a review strategy a) LOG action and then review declude logs b) HOLD action and then review with a program like spam review (you have to add lines to the header to indicate tests failed and weights) c) combination of a and b 2) develop your own weighting system a) some have several levels with different action b) I use pass/HOLD but I review HOLD 3) the Plus and Minus weights with filters is very good and allows really good tweaking 4) develop actions you can manage It is not possible for very high volume systems to hold and review messages as an example. I think it is better to start simpler and then gradually add complexity as you understand what is happening. Another very good tool for us was Sniffer - see http://www.sortmonster.com/MessageSniffer/ helped reduce our false positives to about 1% from 4% EP Is there a tool available that will read the junkmail logs and EP break down each test as to their effectiveness? http://www.declude.com/tools/index.html lots of good things reported about spam review. HTH Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
