RE: [Declude.JunkMail] Whitelisting Issue
Hi Chris: No- that statement goes into Global.cfg. In our global statement all Whitelist issues are at the top so in ours it is one of the first few lines.. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 6:17 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue Very Nice, Should I add anything to the default.junkmail file? EMERGENCYBYPASS WARN ?? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems -Original Message- From: Kami Razvan [mailto:[EMAIL PROTECTED] Sent: Monday, December 20, 2004 5:57 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue Chris: We were having a similar issue- Scott suggested the following: EMERGENCYBYPASS bypasswhitelist 40 2 0 0 So now if the weight passes 40 the whitelist will not work if 2 more people are in the list. You can adjust the settings per your environment. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 5:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting Issue
Chris: We were having a similar issue- Scott suggested the following: EMERGENCYBYPASS bypasswhitelist 40 2 0 0 So now if the weight passes 40 the whitelist will not work if 2 more people are in the list. You can adjust the settings per your environment. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 5:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting Issue
That is why whitelisting from or to an e-mail address is very touchy and dangerous. Why is anything for that user configured to be whitelisted? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 2:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting Issue
Very Nice, Should I add anything to the default.junkmail file? EMERGENCYBYPASS WARN ?? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems -Original Message- From: Kami Razvan [mailto:[EMAIL PROTECTED] Sent: Monday, December 20, 2004 5:57 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue Chris: We were having a similar issue- Scott suggested the following: EMERGENCYBYPASS bypasswhitelist 40 2 0 0 So now if the weight passes 40 the whitelist will not work if 2 more people are in the list. You can adjust the settings per your environment. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 5:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting Issue
He likes his spam. I am wide open to better ideas, other than teaching spammers how to be better spammers. Thanks, Chris Patterson, CCNA Network Engineer -Original Message- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Monday, December 20, 2004 6:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue That is why whitelisting from or to an e-mail address is very touchy and dangerous. Why is anything for that user configured to be whitelisted? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 2:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting Issue
Chris Patterson wrote: Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Yes we did. Our solution was to go with an IMGate server and serialize the messages. This will not work for messages sent from user-to-user (domain-to-domain also) on the same iMail system. the mesage gets passed to Declude which does it's magic then passed back to iMail for final delivery. Any spam checks passed of failed for one recipient apply to all. The bcc issue is trickier still. Rod -- Roderick A. Anderson Technology Services Management Group http://www.technologyservicesmanagementgroup.com/ Spokane WA, 99202 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting Issue
Aside from EMERGENCYBYPASS there is another compromise with JunkMail Pro: 1) Take out the WHITELIST TO statement 2) Add ALLRECIPS -100 IS [EMAIL PROTECTED] [EMAIL PROTECTED] Assuming that you have a weighted system and no tests that have HOLD or DELETE that this guy would want to see, this will work. If those tests are filter texts, you could add this to the beginning of the file to ignore that particular test with ALLRECIPS END IS [EMAIL PROTECTED] [EMAIL PROTECTED] The result is that he can have all the mail that is addressed to him and only him, even if it's spam. The odd looking ALLRECIPS user is because Declude sees the Internet email address plus the alias. I've probably got the terminology wrong, and I hope someone else will clarify (Scott Fisher and Bill Landry in particular have both run into this, and of course Declude Support could clarify the usage). Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 3:22 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue He likes his spam. I am wide open to better ideas, other than teaching spammers how to be better spammers. Thanks, Chris Patterson, CCNA Network Engineer -Original Message- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Monday, December 20, 2004 6:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue That is why whitelisting from or to an e-mail address is very touchy and dangerous. Why is anything for that user configured to be whitelisted? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 2:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting Issue
If you have the PRO version, you can set up per domain and per user filtering, and configure no actions for that user. That way, scanning is done properly, nothing is white listed, and everything to that user is delivered. This is the way I do it for any one wanting all their messages, even spam. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 3:22 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue He likes his spam. I am wide open to better ideas, other than teaching spammers how to be better spammers. Thanks, Chris Patterson, CCNA Network Engineer -Original Message- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Monday, December 20, 2004 6:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting Issue That is why whitelisting from or to an e-mail address is very touchy and dangerous. Why is anything for that user configured to be whitelisted? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, December 20, 2004 2:50 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisting Issue Hi all, I am having trouble with an issue where spam is getting by showing whitelisted in the header. Neither the domain or e-mail address that it is coming from is whitelisted in the global config, nor are they showing as Auth-user. However, one of the recipients (local user) is Whitelisted; which you can't see because they are apparently in the BCC field . Apparently it is causing all recipients on this e-mail to receive it as Whitelisted. Has anyone else ran into this issue? Thanks, Chris Patterson, CCNA Network Engineer Rapid Systems --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting issue
on 4/16/04 8:39 AM, Kami Razvan wrote: I know this has been discussed in the past but I am not sure if any solution is available. If one person has [EMAIL PROTECTED] in the address book it appears that an email sent to this person and many others will be whitelisted for all. We have a situation that a person receives a lot of news emails and has whitelisted his address. Now anything that is sent to this organization's info address (going to him and 3 others) is being whitelisted for everyone. Of course info address being one of the favorite addresses of spammers it is not helping the situation. If nothing can be done - may be one idea is to rethink the way whitelist works. Add BYPASSWHITELIST bypasswhitelist xx y 0 0 to your global.cfg file. If a message weight exceeds xx and the message was sent to y or more addresses the assigned action will take place. We use delete and have a line in our $default$.JunkMail file(s) that is BYPASSWHITELIST DELETE Basically, this command lets the administrator have the final word as to what should happen with a message. We use 40 and 2 for the values. If tom wants everything whitelisted but dick, harry and joe don't then tom causes the others to get spam (not good). The bypasswhitelist command, which isn't listed on the junkmail page, but is on the release page, let's the admin overrule tom, and depending upon the settings, causes none of them to get the message. Tom won't miss his spam message and the others will never get to see it. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting issue
If one person has mailto:[EMAIL PROTECTED][EMAIL PROTECTED] in the address book it appears that an email sent to this person and many others will be whitelisted for all. Correct. We have a situation that a person receives a lot of news emails and has whitelisted his address. Now anything that is sent to this organization's info address (going to him and 3 others) is being whitelisted for everyone. Of course info address being one of the favorite addresses of spammers it is not helping the situation. If nothing can be done - may be one idea is to rethink the way whitelist works. What if mailto:[EMAIL PROTECTED][EMAIL PROTECTED] simply means no action be taken so spam filters and tests are done but the action is not taken - then others without mailto:[EMAIL PROTECTED][EMAIL PROTECTED] can have the action taken on their emails. The problem with that is that if someone else has the DELETE action, the E-mail will be deleted, yet the one recipient wanted it whitelisted. There is, however, a bypasswhitelisting test that you can set up to help with this situation. It can be defined with a line such as EMERGENCYBYPASS bypasswhitelisting 60 3 0 0. The 60 refers to the weight the E-mail must reach, and the 3 refers to the minimum number of recipients. In this case, it would attempt to bypass the whitelisting for E-mail with 3 or more recipients and a weight of 60 or higher. This way, the more blatant spam will get blocked, even if it was whitelisted. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
