[Declude.JunkMail] COPYTO Oddity
I've change the IP number of my server and I've noticed this oddity. Email's that score between 100 and 199, I send a copy to a spam mailbox to scan: WEIGHT100COPY COPYTO mailto:[EMAIL PROTECTED] [EMAIL PROTECTED] After my IP address change, the copyto message is being scanned again by Declude. I would have thought the message shouldn't be scanned again by Declude. Any ideas? Here are some headers: Extra received header: Received: from imail.Farmprogress.com [192.168.191.6] by imail.Farmprogress.com with ESMTP (SMTPD-9.22) id A7BD01FC; Tue, 04 Dec 2007 15:33:49 -0600 Received: from mx1.farmprogress.com [192.168.191.14] by imail.Farmprogress.com with ESMTP (SMTPD-9.22) id A7A70330; Tue, 04 Dec 2007 15:33:27 -0600 Received: from forever21.com [12.129.230.91] by mx1.farmprogress.com (Alligate(TM) SMTP Gateway v3.7.10.21) with ESMPT id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Tue, 04 Dec 2007 15:33:23 -0600 X-VirtualServerGroup: Default X-Destination-ID: [EMAIL PROTECTED] X-MailingID: 0::0::0::030884 X-SMFBL: YXNjaGFyZmVuQGZhcm1wcm9ncmVzcy5jb20= X-Mailer: StrongMail Enterprise 3.2.1(3.00.215) Received: from mail04 by forever21.com (StrongMail Enterprise 3.2.1(3.00.215)); Tue, 04 Dec 2007 13:33:38 -0800 X-SMHeaderMap: mid=X-MailingID DomainKey-Signature: a=rsa-sha1; c=nofws; s=onlinepromo; d=forever21.com; q=dns; b=ncw9REjUL4WsRgooMtB40+CfmDvpeiUhlzJIn3WP9jYCBAUgkOs+Acw70VZSuGXfywj5yvy1p9 vhtFKtCNMP/a7WvVwE/ozcEbUZ87FkTa6Pld5ssUiV1k1ORcLF0V9Ks0ygEf8sNHRTe9f9XcM7U6 /BbOI6EY7XEoRz75PA0Ok= Message-ID: [EMAIL PROTECTED] return-path: [EMAIL PROTECTED] mime-version: 1.0 from: Twelvebytwelve [EMAIL PROTECTED] to: [EMAIL PROTECTED] date: 4 Dec 2007 13:34:01 -0800 Subject: [Possible SPAM]Button Up!! Coats With A French Accent content-type: text/html; charset=us-ascii content-transfer-encoding: quoted-printable X-MXRate-Prob: -1 X-MXRate-Country: US X-MXRate-Action: ALLOW X-Alligate-ReceivingIP: [192.168.191.14] X-Alligate-Grey: Skipped X-Alligate-REVDNS: mx11.forever21.com X-Alligate-Spam: NOSUBD; X-Alligate-ID: 30642 X-RBL-Warning: MXRATE-WHITE-LAST: GOOD SENDER X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MPPT-SIZE-XS: Message failed MPPT-SIZE-XS: 4 X-RBL-Warning: MPPT-MXQUALIFIER: Message failed MPPT-MXQUALIFIER: 512 X-RBL-Warning: MPM-STATICSPAMMER: Message failed MPM-STATICSPAMMER: 1048576 X-RBL-Warning: SNIFFER-NOTFOUND: Message failed SNIFFER-NOTFOUND: 0. X-RBL-Warning: COUNTRY-0POINT: Message failed COUNTRY-0POINT test (line 6, weight 0) X-Declude-RefID: X-FarmProgress: = Inbound Header (incoming) = X-FarmProgress: Spam weight: 165. X-FarmProgress: Tests Failed: MXRATE-WHITE-LAST, IPNOTINMX, SPFPASS, MPPT-SIZE-XS, MPPT-MXQUALIFIER, MPM-STATICSPAMMER, SNIFFER-NOTFOUND, COUNTRY-0POINT, WEIGHT100, WEIGHT100COPY. X-FarmProgress: Tests Failed: MXRATE-WHITE-LAST [-15], IPNOTINMX [0], SPFPASS [0], MPPT-SIZE-XS [10], MPPT-MXQUALIFIER [0], MPM-STATICSPAMMER [180], SNIFFER-NOTFOUND [0], COUNTRY-0POINT [0], WEIGHT100 [100], WEIGHT100COPY [100] X-FarmProgress: Scan Time: 04 Dec 2007 at 15:33:49 X-FarmProgress: Spool Name: Dc7a7021d148d.smd X-FarmProgress: Server Name: forever21.com X-FarmProgress: SMTP Sender: [EMAIL PROTECTED] X-FarmProgress: Received From: mx11.forever21.com [12.129.230.91] X-FarmProgress: Country Chain: UNITED STATES-destination X-FarmProgress: Header code: e X-FarmProgress: == X-FarmProgress: This E-mail was scanned by Farm Progress Companies using Declude 4.3.64 X-FarmProgress: == X-Declude-RefID: Second pass on the email: X-FarmProgress: = Inbound Header (incoming) = X-FarmProgress: Spam weight: 0. X-FarmProgress: Tests Failed: Whitelisted. X-FarmProgress: Tests Failed: Whitelisted X-FarmProgress: Scan Time: 04 Dec 2007 at 15:33:56 X-FarmProgress: Spool Name: Dc7bd02171491.smd X-FarmProgress: Server Name: imail.Farmprogress.com X-FarmProgress: SMTP Sender: mailto:[EMAIL PROTECTED] [EMAIL PROTECTED] X-FarmProgress: Received From: (Private IP) [192.168.191.6] X-FarmProgress: Country Chain: X-FarmProgress: Header code: 0 X-FarmProgress: == X-FarmProgress: This E-mail was scanned by Farm Progress Companies using Declude 4.3.64 X-FarmProgress: == X-RCPT-TO: [EMAIL PROTECTED] Status: X-UIDL: 392717547 X-IMail-ThreadID: c7bd02171491 Scott Fisher Dir of IT Farm Progress Companies 191 S Gary Ave Carol Stream, IL 60188 Tel: 630-462-2323 This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not
Re: [Declude.JunkMail] COPYTO Oddity
This appears to be an IMail behavior and not caused by Declude. There are double IMail headers in there, and they have different spool names too. This may be due to domains being configured for different IP's in IMail. This might require some registry hacking to straighten out. You should check and make sure that the branch with the intended IP is also associated with the domain branch in question. I could reference my own system for how this is configured if you want to share an export of this with me off-line. My system does something similar and it isn't double scanning, so it must like the way that things appear in my registry. Matt Scott Fisher wrote: I've change the IP number of my server and I've noticed this oddity. Email's that score between 100 and 199, I send a copy to a spam mailbox to scan: WEIGHT100COPY COPYTO [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] After my IP address change, the copyto message is being scanned again by Declude. I would have thought the message shouldn't be scanned again by Declude. Any ideas? Here are some headers: Extra received header: *Received: from imail.Farmprogress.com [192.168.191.6] by imail.Farmprogress.com with ESMTP (SMTPD-9.22) id A7BD01FC; Tue, 04 Dec 2007 15:33:49 -0600* Received: from mx1.farmprogress.com [192.168.191.14] by imail.Farmprogress.com with ESMTP (SMTPD-9.22) id A7A70330; Tue, 04 Dec 2007 15:33:27 -0600 Received: from forever21.com [12.129.230.91] by mx1.farmprogress.com (Alligate(TM) SMTP Gateway v3.7.10.21) with ESMPT id [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] for [EMAIL PROTECTED] mailto:[EMAIL PROTECTED]; Tue, 04 Dec 2007 15:33:23 -0600 X-VirtualServerGroup: Default X-Destination-ID: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] X-MailingID: 0::0::0::030884 X-SMFBL: YXNjaGFyZmVuQGZhcm1wcm9ncmVzcy5jb20= X-Mailer: StrongMail Enterprise 3.2.1(3.00.215) Received: from mail04 by forever21.com (StrongMail Enterprise 3.2.1(3.00.215)); Tue, 04 Dec 2007 13:33:38 -0800 X-SMHeaderMap: mid=X-MailingID DomainKey-Signature: a=rsa-sha1; c=nofws; s=onlinepromo; d=forever21.com; q=dns; b=ncw9REjUL4WsRgooMtB40+CfmDvpeiUhlzJIn3WP9jYCBAUgkOs+Acw70VZSuGXfywj5yvy1p9vhtFKtCNMP/a7WvVwE/ozcEbUZ87FkTa6Pld5ssUiV1k1ORcLF0V9Ks0ygEf8sNHRTe9f9XcM7U6/BbOI6EY7XEoRz75PA0Ok= Message-ID: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] return-path: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] mime-version: 1.0 from: Twelvebytwelve [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] to: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] date: 4 Dec 2007 13:34:01 -0800 Subject: [Possible SPAM]Button Up!! Coats With A French Accent content-type: text/html; charset=us-ascii content-transfer-encoding: quoted-printable X-MXRate-Prob: -1 X-MXRate-Country: US X-MXRate-Action: ALLOW X-Alligate-ReceivingIP: [192.168.191.14] X-Alligate-Grey: Skipped X-Alligate-REVDNS: mx11.forever21.com X-Alligate-Spam: NOSUBD; X-Alligate-ID: 30642 X-RBL-Warning: MXRATE-WHITE-LAST: GOOD SENDER X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MPPT-SIZE-XS: Message failed MPPT-SIZE-XS: 4 X-RBL-Warning: MPPT-MXQUALIFIER: Message failed MPPT-MXQUALIFIER: 512 X-RBL-Warning: MPM-STATICSPAMMER: Message failed MPM-STATICSPAMMER: 1048576 X-RBL-Warning: SNIFFER-NOTFOUND: Message failed SNIFFER-NOTFOUND: 0. X-RBL-Warning: COUNTRY-0POINT: Message failed COUNTRY-0POINT test (line 6, weight 0) X-Declude-RefID: X-FarmProgress: = Inbound Header (incoming) = X-FarmProgress: Spam weight: 165. X-FarmProgress: Tests Failed: MXRATE-WHITE-LAST, IPNOTINMX, SPFPASS, MPPT-SIZE-XS, MPPT-MXQUALIFIER, MPM-STATICSPAMMER, SNIFFER-NOTFOUND, COUNTRY-0POINT, WEIGHT100, WEIGHT100COPY. X-FarmProgress: Tests Failed: MXRATE-WHITE-LAST [-15], IPNOTINMX [0], SPFPASS [0], MPPT-SIZE-XS [10], MPPT-MXQUALIFIER [0], MPM-STATICSPAMMER [180], SNIFFER-NOTFOUND [0], COUNTRY-0POINT [0], WEIGHT100 [100], WEIGHT100COPY [100] X-FarmProgress: Scan Time: 04 Dec 2007 at 15:33:49 X-FarmProgress: Spool Name: Dc7a7021d148d.smd X-FarmProgress: Server Name: forever21.com X-FarmProgress: SMTP Sender: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] X-FarmProgress: Received From: mx11.forever21.com [12.129.230.91] X-FarmProgress: Country Chain: UNITED STATES-destination X-FarmProgress: Header code: e X-FarmProgress: == X-FarmProgress: This E-mail was scanned by Farm Progress Companies using Declude 4.3.64 X-FarmProgress: == X-Declude-RefID: Second pass on the email: *X-FarmProgress: = Inbound Header (incoming) = X-FarmProgress: Spam weight: 0. X-FarmProgress: Tests Failed: Whitelisted. X-FarmProgress: Tests Failed: Whitelisted X-FarmProgress: Scan Time: 04 Dec 2007 at 15:33:56 X-FarmProgress: Spool Name: Dc7bd02171491.smd X-FarmProgress: Server Name:
[Declude.JunkMail] Copyto
I am trying to use copyto and copy all mail sent or received from user. I am receiving all mail to the user but nothing from. This is what I have in my filter file. MAILFROM 0 IS [EMAIL PROTECTED] ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] Kyle
RE: [Declude.JunkMail] Copyto
What I found so far is that the user is using AUTH and I whitelist auth so if the whitelist run before my filter it probably wont work right? How could I get this to work? Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher Sent: Thursday, June 02, 2005 10:17 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Copyto I am trying to use copyto and copy all mail sent or received from user. I am receiving all mail to the user but nothing from. This is what I have in my filter file. MAILFROM 0 IS [EMAIL PROTECTED] ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] Kyle
Re: [Declude.JunkMail] Copyto
Good point. Looks like you would have to turn off AUTH for the user, which may be undesirable for other reasons. I don't think you can run filters if AUTH is enabled. You might use an IMail rule instead. I think others have used that successfully to hide the copying from the user. Darin. - Original Message - From: Kyle Fisher To: Declude.JunkMail@declude.com Sent: Thursday, June 02, 2005 2:28 PM Subject: RE: [Declude.JunkMail] Copyto What I found so far is that the user is using AUTH and I whitelist auth so if the whitelist run before my filter it probably wont work right? How could I get this to work? Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle FisherSent: Thursday, June 02, 2005 10:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Copyto I am trying to use copyto and copy all mail sent or received from user. I am receiving all mail to the user but nothing from. This is what I have in my filter file. MAILFROM 0 IS [EMAIL PROTECTED] ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] Kyle
RE: [Declude.JunkMail] Copyto
Ok thanks. I am already using the copyall account for Imail for monitoring a different user, but there might be a way just to use rules to make it work. Ill try it. Thanks Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, June 02, 2005 2:02 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Copyto Good point. Looks like you would have to turn off AUTH for the user, which may be undesirable for other reasons. I don't think you can run filters if AUTH is enabled. You might use an IMail rule instead. I think others have used that successfully to hide the copying from the user. Darin. - Original Message - From: Kyle Fisher To: Declude.JunkMail@declude.com Sent: Thursday, June 02, 2005 2:28 PM Subject: RE: [Declude.JunkMail] Copyto What I found so far is that the user is using AUTH and I whitelist auth so if the whitelist run before my filter it probably wont work right? How could I get this to work? Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher Sent: Thursday, June 02, 2005 10:17 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Copyto I am trying to use copyto and copy all mail sent or received from user. I am receiving all mail to the user but nothing from. This is what I have in my filter file. MAILFROM 0 IS [EMAIL PROTECTED] ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] Kyle
Re: [Declude.JunkMail] Copyto
There was a discussion in the IMail list about a week or so ago about doing this. Ibelieve Eric Shanbrom chimed in at one point if that helps you find it in the archive. Domain rules may have been mentioned as well. Darin. - Original Message - From: Kyle Fisher To: Declude.JunkMail@declude.com Sent: Thursday, June 02, 2005 3:57 PM Subject: RE: [Declude.JunkMail] Copyto Ok thanks. I am already using the copyall account for Imail for monitoring a different user, but there might be a way just to use rules to make it work. Ill try it. Thanks Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Thursday, June 02, 2005 2:02 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Copyto Good point. Looks like you would have to turn off AUTH for the user, which may be undesirable for other reasons. I don't think you can run filters if AUTH is enabled. You might use an IMail rule instead. I think others have used that successfully to hide the copying from the user. Darin. - Original Message - From: Kyle Fisher To: Declude.JunkMail@declude.com Sent: Thursday, June 02, 2005 2:28 PM Subject: RE: [Declude.JunkMail] Copyto What I found so far is that the user is using AUTH and I whitelist auth so if the whitelist run before my filter it probably wont work right? How could I get this to work? Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle FisherSent: Thursday, June 02, 2005 10:17 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Copyto I am trying to use copyto and copy all mail sent or received from user. I am receiving all mail to the user but nothing from. This is what I have in my filter file. MAILFROM 0 IS [EMAIL PROTECTED] ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] Kyle
RE: [Declude.JunkMail] Copyto
Thanks. The article got me working. Kyle From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A. Luis Alberto Arango Sent: Friday, May 20, 2005 4:31 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Copyto Check this archived message. I believe It has the answer you are looking for http://www.mail-archive.com/declude.junkmail@declude.com/msg24505.html it the solution has a small error than is later fixed in the posts. Instead of warn, the test should use COPYTO Hope it helps Luis From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher Sent: Viernes, 20 de Mayo de 2005 03:42 p.m. To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Copyto I would like to use copyto to receive a copy of all email sent/receive from a particular user. I am already using the Imail copy all mail, but I have that setup for another customer to monitor and I now have another customer that wants a user monitored. Is there anyway in Junkmail to monitor all email from a user and to setup multiple sessions? Kyle Imail 8.20 Junkmail 2.0.6 Pro
[Declude.JunkMail] Copyto
I would like to use copyto to receive a copy of all email sent/receive from a particular user. I am already using the Imail copy all mail, but I have that setup for another customer to monitor and I now have another customer that wants a user monitored. Is there anyway in Junkmail to monitor all email from a user and to setup multiple sessions? Kyle Imail 8.20 Junkmail 2.0.6 Pro
RE: [Declude.JunkMail] Copyto
Check this archived message. I believe It has the answer you are looking for http://www.mail-archive.com/declude.junkmail@declude.com/msg24505.html it the solution has a small error than is later fixed in the posts. Instead of warn, the test should use COPYTO Hope it helps Luis From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher Sent: Viernes, 20 de Mayo de 2005 03:42 p.m. To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Copyto I would like to use copyto to receive a copy of all email sent/receive from a particular user. I am already using the Imail copy all mail, but I have that setup for another customer to monitor and I now have another customer that wants a user monitored. Is there anyway in Junkmail to monitor all email from a user and to setup multiple sessions? Kyle Imail 8.20 Junkmail 2.0.6 Pro
RE: [Declude.JunkMail] COPYTO explanation
Hi Scott: COPYTO means Send a copy to (not make a copy of this E-mail and send it to). It just adds an extra recipient. Uuuu - now I get it. Makes sense. Somehow I thought COPYTO also supported copying to a file - so I assumed it was a true copy action. Thanks for clearing this up. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO combined with DELETE/HOLD/BOUNCE
Title: Message Hi Scott: I think the the issue of "mutually exclusive" actions may not be obvious to a user (after reading the manual). I did some more experimenting using the COPYTO action. My logic was - if I use a "copy" to another user, this reallyshouldn't effect how the "primary" recipient's mail is acted on. From my tests it seems as if DELETE/HOLD/BOUNCE basically are "killer" actions that cannot be combined with ANY other action (other than "LOG/IGNORE")? I have the need to DELETE/HOLD/BOUNCE the "original" message - while (depending on test combinations) also route the mail to a special mailbox for inspection. Best RegardsAndy SchmidtHM Systems Software, Inc.600 East Crescent Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206http://www.HM-Software.com/
RE: [Declude.JunkMail] COPYTO combined with DELETE/HOLD/BOUNCE
My logic was - if I use a copy to another user, this really shouldn't effect how the primary recipient's mail is acted on. From my tests it seems as if DELETE/HOLD/BOUNCE basically are killer actions that cannot be combined with ANY other action (other than LOG/IGNORE)? I have the need to DELETE/HOLD/BOUNCE the original message - while (depending on test combinations) also route the mail to a special mailbox for inspection. Actually, I believe the COPYTO action should be safe to use with other actions. The problem, though, is that if combined with the DELETE action the E-mail is deleted (so the extra recipient won't get the E-mail), if the HOLD action is used, the E-mail will be held (also preventing the extra recipient from seeing it), and with BOUNCE the E-mail is not delivered to the recipient (so the extra recipient won't see it either). It sounds like you are looking to split a single E-mail into two, and have different actions taken on each one (something we are considering, but likely will not happen soon). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO combined with DELETE/HOLD/BOUNCE
Let me throw in my two cents worth as well. If you are thinking about changing the way you process actions I would like to see the ability to do multiple actions per test. NEWFILTER WARN,COPYTO [EMAIL PROTECTED],HOLD Not sure how you would do this but for me this makes sense. Want the WARN to see that happens in the header Copy it to an administrator type person to see what is happening HOLD it in the queues for releasing or not. This would allow you to test a new filter and monitor it. I also had a crazy request today that a person wanted all the SPAM for the company in question and they would wade through it. Although I suppose that could be done with a WEIGHT10 ROUTETO [EMAIL PROTECTED] in that domain's config. Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, June 01, 2004 6:32 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] COPYTO combined with DELETE/HOLD/BOUNCE My logic was - if I use a copy to another user, this really shouldn't effect how the primary recipient's mail is acted on. From my tests it seems as if DELETE/HOLD/BOUNCE basically are killer actions that cannot be combined with ANY other action (other than LOG/IGNORE)? I have the need to DELETE/HOLD/BOUNCE the original message - while (depending on test combinations) also route the mail to a special mailbox for inspection. Actually, I believe the COPYTO action should be safe to use with other actions. The problem, though, is that if combined with the DELETE action the E-mail is deleted (so the extra recipient won't get the E-mail), if the HOLD action is used, the E-mail will be held (also preventing the extra recipient from seeing it), and with BOUNCE the E-mail is not delivered to the recipient (so the extra recipient won't see it either). It sounds like you are looking to split a single E-mail into two, and have different actions taken on each one (something we are considering, but likely will not happen soon). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO
Using %SENDER%, it is giving inserting [Unknown Var]. If I use %MAILFROM%, it is also inserting [Unknown Var}. Sorry, it should be actually %MAILFROM% -- there is no %SENDER% variable. Are you sure you are using %MAILFROM%? The only time you should see [Unknown Var] is if Declude is expanding variables (as is the case here), and the variable is one that Declude doesn't recognize (such as %SENDER%). But if Declude recognizes the variable (as has been the case with %MAILFROM% for a long time now), it should not return [Unknown Var]. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO
Are you sure you are using %MAILFROM%? The only time you should see [Unknown Var] is if Declude is expanding variables (as is the case here), and the variable is one that Declude doesn't recognize (such as %SENDER%). But if Declude recognizes the variable (as has been the case with %MAILFROM% for a long time now), it should not return [Unknown Var]. Yep. Declude version 1.77 From the log: 12/23/2003 08:05:32 Q3d98134f028a76bc NOABUSE:3 NOPOSTMASTER:3 BASICFILTER:15 SPAMCHECK:13 . Total weight = 34. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=LOG. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=LOG. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed IPNOTINMX (). Action=LOG. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=LOG. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed BASICFILTER (Message failed BASICFILTER test (line 1, weight 15)). Action=WARN. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed BLANKSUBJECT1 (Message failed BLANKSUBJECT1 test (line 1, weight 0)). Action=SUBJECT. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed BLANKSUBJECT2 (Message failed BLANKSUBJECT2 test (line 1, weight 0)). Action=COPYTO. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed SPAMCHECK (Message failed SPAMCHECK: 13.). Action=WARN. 12/23/2003 08:05:32 Q3d98134f028a76bc Msg failed WEIGHTRANGE30-34 (Total weight between 30 and 34.). Action=HOLD. 12/23/2003 08:05:32 Q3d98134f028a76bc Subject: 12/23/2003 08:05:32 Q3d98134f028a76bc From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 204.127.202.55 ID: 2003122313055301100ihq4ae From the Global.cfg file: BLANKSUBJECT1 filter D:\Imail\Declude\filters\BlankSubject.txt x 0 0 BLANKSUBJECT2 filter D:\Imail\Declude\filters\BlankSubject.txt x 0 0 From the .junkmail file: BLANKSUBJECT1 SUBJECT ADDED BY SPAM REVIEW: PLEASE USE A SUBJECT LINE! BLANKSUBJECT2 COPYTO %MAILFROM% The Q file: Qg:\IMail\spool\D3d98134f028a76bc.SMD Hmail.localdomain.moc Wf:\IMail\sunline_net E0, S[EMAIL PROTECTED] NRCPT TO:[EMAIL PROTECTED] R[EMAIL PROTECTED] NRCPT TO: [Unknown Var] R[Unknown Var] John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO
From the Global.cfg file: BLANKSUBJECT1 filter D:\Imail\Declude\filters\BlankSubject.txt x 0 0 BLANKSUBJECT2 filter D:\Imail\Declude\filters\BlankSubject.txt x 0 0 From the .junkmail file: BLANKSUBJECT1 SUBJECT ADDED BY SPAM REVIEW: PLEASE USE A SUBJECT LINE! BLANKSUBJECT2 COPYTO %MAILFROM% Is there any chance that you still have a file with %SENDER% in it (which would cause the [Unknown Var])? I tried reproducing this here, and was unable to. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO
Is there any chance that you still have a file with %SENDER% in it (which would cause the [Unknown Var])? HANDING HEAD IN SHAME I updated the $default$.junkmail. I then have a batch file to update the various other .junkmail files. I forgot to run the batch file. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] COPYTO
Using %SENDER%, it is giving inserting [Unknown Var]. If I use %MAILFROM%, it is also inserting [Unknown Var}. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Sunday, December 21, 2003 5:21 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] COPYTO Is it possible to use a variable in the copy to command? Yes, it is. Example: TEST1 COPYTO %SENDER% That would work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO
Is it possible to use a variable in the copy to command? Yes, it is. Example: TEST1 COPYTO %SENDER% That would work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] COPYTO
Is it possible to use a variable in the copy to command? Example: TEST1 COPYTO %SENDER% John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] COPYTO
I use the COPYTO action for one of my tests, however if an email is sent to multiple recipients I notice that its adding the COPYTO recipient once for each recipient when this test fails. Any way to make it only add the COPYTO recipient once, regardless of how many original recipients there were? I realize Imail will ignore multiple copies of the same recipient in the Q* file, and it will only deliver 1 copy of the email to that recipient... But I have some custom scripts that run after Declude is called, those duplicate recipients in the Q* file is causing me a problem. Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO
I use the COPYTO action for one of my tests, however if an email is sent to multiple recipients I notice that its adding the COPYTO recipient once for each recipient when this test fails. Any way to make it only add the COPYTO recipient once, regardless of how many original recipients there were? There is a new interim release at http://www.declude.com/release/167i/declude.exe that will ensure that the COPYTO action will not add an address if it has already been added. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO
WOW, you're fast! Thanks, Bill -Original Message- From: R. Scott Perry Sent: Thu, 06 Mar 2003 10:59:47 -0500 Subject: Re: [Declude.JunkMail] COPYTO I use the COPYTO action for one of my tests, however if an email is sent to multiple recipients I notice that its adding the COPYTO recipient once for each recipient when this test fails. Any way to make it only add the COPYTO recipient once, regardless of how many original recipients there were? There is a new interim release at http://www.declude.com/release/167i/declude.exe that will ensure that the COPYTO action will not add an address if it has already been added. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] COPYTO action on an Outgoing test
Is anybody using the COPYTO action for an Outgoing test (requires Declude Pro)? I can't seem to get it to work. It always copies the email to a blank recipient. I've got this line in the global.cfg file... SOMETEST COPYTO [EMAIL PROTECTED] ...but the sender of the email where this outgoing test fails always receives a bounce email saying... Invalid final delivery userid: @localhost Running Declude in debug mode shows that it is being copied to a blank address... Msg failed SOMETEST. Action=COPYTO. Copying spam to . AlterRecip( 3, [EMAIL PROTECTED], ); AlterRecip: Loading queuefile Copying E-mail to . Altering queuefile. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Here it is, and I actually sent a bunch of debug information on this problem to [EMAIL PROTECTED] on Sunday morning... Diagnostics ON (Declude v1.66i11). Declude JunkMail: Config file found (d:\imail\Declude\global.CFG). Declude Virus: Config file found (d:\imail\Declude\Virus.CFG). Declude Hijack:Config file found (d:\imail\Declude\Hijack.CFG). Declude Confirm: Not installed (no d:\imail\Declude\Confirm.CFG file). 42 spam tests defined: LIST KILL WORD COUNTRY DSBL MONKEYFORMMAIL MONKEYPROXIES ORDB OSDUL OSFORM OSLIST OSPROXY OSRELAY OSSMART OSSOFT OSSRC NJABL NJABLDUL NJA BLSOURCES NJABLMULTI NJABLFORMMAIL NJABLPROXIES SPAMCOP WIREHUBDNSBL DSN NOABUSE NOPOSTMASTER BADHEADERS HELOBOGUS MAILFROM REVDNS ROUTING SPAMHEADERS BASE64 IPMX HABEAS DNA WEIGHTFAIL WEIGHTFAILOUT WEIGHTFAILALL PERCENT BULKOUT IMail reports Official Host Name as: mail01.excedent.us. IMail's SendName registry seems OK: d:\imail\Declude.exe. Declude JunkMail Status: PRO version registered. Declude Virus Status:Pro Version Registered. Declude Hijack Status: Registered. End of diagnostics. -Original Message- From: R. Scott Perry Sent: Mon, 27 Jan 2003 12:50:32 -0500 Subject: Re: [Declude.JunkMail] COPYTO action on an Outgoing test Is anybody using the COPYTO action for an Outgoing test (requires Declude Pro)? I can't seem to get it to work. It always copies the email to a blank recipient. I've got this line in the global.cfg file... Which version of Declude JunkMail are you running (\IMail\Declude -diag from a command prompt will show you)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Here it is, and I actually sent a bunch of debug information on this problem to [EMAIL PROTECTED] on Sunday morning... Could you re-send that information? We don't have a record of it here, and it could be very useful in solving the problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Sure thing. I just resent it, but this time to [EMAIL PROTECTED] -Original Message- From: R. Scott Perry Sent: Mon, 27 Jan 2003 13:41:42 -0500 Subject: Re: [Declude.JunkMail] COPYTO action on an Outgoing test Here it is, and I actually sent a bunch of debug information on this problem to [EMAIL PROTECTED] on Sunday morning... Could you re-send that information? We don't have a record of it here, and it could be very useful in solving the problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Hey Scott, let me know if you have received that email now or not, because I noticed the email was getting held by declude because the debug file contained lots for words that set off our filters. But I added a whitlist rule, so it should have gotten to you now. But let me know if not. Thanks, Bill -Original Message- From: Bill B. Sent: Mon, 27 Jan 2003 13:48:00 EST Subject: Re: [Declude.JunkMail] COPYTO action on an Outgoing test Sure thing. I just resent it, but this time to [EMAIL PROTECTED] -Original Message- From: R. Scott Perry Sent: Mon, 27 Jan 2003 13:41:42 -0500 Subject: Re: [Declude.JunkMail] COPYTO action on an Outgoing test Here it is, and I actually sent a bunch of debug information on this problem to [EMAIL PROTECTED] on Sunday morning... Could you re-send that information? We don't have a record of it here, and it could be very useful in solving the problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Hey Scott, let me know if you have received that email now or not, because I noticed the email was getting held by declude because the debug file contained lots for words that set off our filters. But I added a whitlist rule, so it should have gotten to you now. But let me know if not. It did get here this time; I'll let you know what I find out. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Hey Scott, let me know if you have received that email now or not, because I noticed the email was getting held by declude because the debug file contained lots for words that set off our filters. But I added a whitlist rule, so it should have gotten to you now. But let me know if not. This is an issue with Declude JunkMail, and has been fixed in the latest interim release (http://www.declude.com/release/166i/declude.exe). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
