Hi,
[]
We normally recommend the latest version (either 1.75 (the latest released
version) or 1.80 (the latest beta)). But you need to make sure that your
[]
Hmmm, are you ahead of yourself here? I have not seen a message about 1.80
being released, nor do the junkmail and virus
I'm still trying to come up with an easy to implement way
to give us more control over conflicting final actions.
Specifically, I have several tests set to HOLD or DELETE
(in fact, the vast majority of incoming
mail) - however, a small number of them escaped detection by
Sniffer or
You know if you talk about version 1.80, we'll want to download it...
Anything noteworthy in 1.80?
Sorry, that should have been 1.79.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus:
Maybe one solution would be to set up an action that for instance would
ROUTETO NULL, so that you could use this in place of DELETE and still get
the COPYTO function to work?
Actually, you can get DELETE and COPYTO to work. In this case, the DELETE
action isn't really desired -- you just want
I ran across a case where the NOTIS would be preferred over the NOTCONTAINS.
Can we see the NOTIS and the NOTBEGINSWITH implimented?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
Hi,
I have a client who sent this to me today
Please blacklist anything that has a .cz in the address line
So the way that I see doing this is a filter with the following.
ALLRECIPS END NOTCONTAINS @domain.com
COUNTRIES 50 CONTAINS CZ
MAILFROM50ENDSWITH
I would focus on the mailfrom test, chances are the spam your client is
complaining about did actually come from the country cz but definately nail
it with the country test if thats what they want.
you could even add a filter like
anywhere 50 contains .cz (with a space after the .cz)
anywhere
Please blacklist anything that has a .cz in the
address line
COUNTRIES doesn't look at the address line as your customer asked for.
It will filter if any IP-Address the contained in the mail header is
assigned to the Czech republic.
Why not use something like
MAILFROM50
Markus,
I want to avail HOLD actions as much as possible (that way there is less
work for me :)
ALLRECIPS END NOTCONTAINS @domain.com
MAILFROM50ENDSWITH .cz
They way I understand a filter file is that is it applied and scored
against every e-mail message that comes in. So for
Yesterday's results are more in line with what I expect.
The -ALL are consistantly higher than the -LAST.
I'll keep observing, but I have no explanation why things changed...
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 06/08/04 05:09PM
Scott,
Send me your log
Scott,
Can I name a filter something like:
SPECFIC-DOMAIN.COM
Using the .
Or do I have to stick with -
SPECFIC-DOMAIN-COM
Goran Jovanovic
The LAN Shoppe
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the
Can I name a filter something like:
SPECFIC-DOMAIN.COM
Using the .
That will work fine.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader
Anybody have any experience with this company? A customer of mine has been
asked to use this service for one of his customers and he is trying to
figure out what they are really doing and if we can set up our own way of
doing the archiving.
Thanks,
Chuck Frolick
ArgoLink.net
---
[This E-mail
I'd avoid the ANYWHERE filter if possible.
Perhaps replace it with HEADERS if that's what you want.
The anywhere will include the body, and those short matches on the body seem to match
on strange things in attachments and such a little too often for me.
Also ANYWHERE will be pretty CPU
Is it possible, either through Declude JM or Imail, to verify the return
address of an email is valid ...
Declude JunkMail's MAILFROM test checks to make sure that the domain is
valid. It does not check to see if the E-mail address is valid, as this is
not very reliable (and can cause
Does anyone know what are the zip files are that
are being caught in SpamReview..This has been going on for a while and they look
like viruses but evidently not but I can tell it is SPAMI was getting so
many I decided to Ban .zip files but of course customers complain...so today I
took
You can do that in Imail on the SMTP Security tab
be careful doing that cause it will affect alot of legit mail where gateways
are used
for example my mail domian is nat.com but the mx records point to my
gateways which use the domain nat-mail.com
Rick Davidson
National Systems Manager
North
Scott, can you tell me what might cause a situation like this where are the
Declude spam tests are run, but then Declude cannot unlock the file because
it has been deleted:
06/09/2004 11:15:46 Q53c7027b03ee31a5 Filter: Set min weight to -50.
06/09/2004 11:15:46 Q53c7027b03ee31a5 Triggered
Thank you all for the input
I got so caught up with the filtering that I forgot about the per-domain
blacklist capability.
So all I did was to add a .cz to the blacklist file for that domain and
it took care of it. Got to remember the big picture :)
Goran Jovanovic
The LAN Shoppe
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
Scott, can you tell me what might cause a situation like this where are
the
Declude spam tests are run, but then Declude cannot unlock the file
because
it has been deleted:
06/09/2004 11:15:47 Q53c7027b03ee31a5 WARNING:
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
Scott, can you tell me what might cause a situation like this where are
the
Declude spam tests are run, but then Declude cannot unlock the file
because
it has been deleted:
06/09/2004 11:15:47 Q53c7027b03ee31a5 WARNING:
Scott, an odd thing about this is that the debug output shows that Alligate
was returning a response code of 0 to Declude. I have sent you (off list)
a copy of the debug output for a single message that was deleted, for your
review. I would be curious to know why and how the message was getting
This is the first log line for an e-mail that I used for testing.
06/09/2004 14:59:54 Q5e1f12a8012e3b47 Filter NIGERIAN: Skipping E-mail
with a current weight of 68 (=48)
Since this is the first filter in the global.cfg how did the weight
start off at 68???
Goran Jovanovic
The LAN
Has anyone seen this before - where a test name is preceded by a character
in the logs (in this case : nIPNOTINMX) ? Test failure doesn't show up in
the headers of the message (assuming due to altered name not matching Warn
action) but the points are still added to the total failure points.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
Scott, an odd thing about this is that the debug output shows that
Alligate
was returning a response code of 0 to Declude. I have sent you (off
list)
a copy of the debug output for a single message that was deleted, for
your
Filter test types run after all other tests besides weight and
weightrange. So DNSBL, IP4R, RHSBL, external, spamdomains, ipfile,
mailfrom and I think a few others will always run before the filter type
is executed regardless of the order in your config. The individual
filter files however
Many stupid ridiculous e-mail server AV
programs are configured to clean and deliver virus infected
e-mails. This is probably what you are seeing.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL
Hi all,
I have an email that is getting caught on CMDSPACE
test, but can't find any information on it in the Junkmail manual, are there
other tests that are not listed there?
Jay CalvertSystems AdministratorWeb Support
ServicesCorporate IT
Office: 604.275.3800Direct Phone:
Well, I normally do not do this, but since I have a yahoo account, contact
me off list, and I will have you have him send e-mail to my yahoo account,
which I will then report as OK.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED]
MAILFROM 15
CONTAINS
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Goran Jovanovic
Sent: Monday, June
07, 2004 8:51 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail]
I know it is in the Metabase. You can install and use MetaEdit from the
resource kit CD, or search on the downloads page for it.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On
I believe outlook 2003 can cause this if
it is connecting without authentication. If that is the client youre
using, try enabling authentication for sending email and see if that clears it
up? I had that happen, being marked as spam sending myself a test message.
M
From:
Problem is AOLs new REPORT SPAM
button. What happens is a user on your server has his Imail forward his e-mail
to his AOL address. When that user gets spam, he hits the REPORT SPAM button.
Guess what, he just reported YOUR IP address.
Another example of AOL stupidity.
There
A case of the bug guy bullying everyone
else...instead of fixing the problem and looking further up the chain to see the
actual sender.
On another note, they can't get their feedback loop
notifications straight. We get a ton of them from a neighboring IP
range. 6 weeks, half a dozen phone
John,
Thank you, my local test worked using meta edit to change the Fully
qualified host name for the SMTP service.
Kevin
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff
(Lists)
Sent: Wednesday, June 09, 2004 2:17 PM
To: [EMAIL
How about their damn Joe-Job bounces coming back without even the
content to tag? Then there's Earthlink and their challenge/response
crap.
These companies take all the PR they can get for "solving the spam
problem" when they are in fact inhibiting the solution for the vast
majority of us.
Has anyone seen this before - where a test name is preceded by a character
in the logs (in this case : nIPNOTINMX) ?
That indicates a negative -- meaning that the E-mail did not fail the test,
and had the weight change as a result. So:
06/09/2004 00:05:57 Q8c972f36011c17e2 SBL:6 CMDSPACE:3
I have an email that is getting caught on CMDSPACE test, but can't find
any information on it in the Junkmail manual, are there other tests that
are not listed there?
That's a beta test -- for beta features, you can check the release notes,
or the list archives. If it is outgoing E-mail,
Any hints?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at
Kevin John,
Isn't the field that you want on the properties page of the
Default STMP Virtual Server
Delivery Tab
Advanced Button
In the Fully-qualified domain name field
I know that when I change this in Exchange 2000 or 2003 that is the name
that the server identifies
That is it.
Thank you,
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic
Sent: Wednesday, June 09, 2004 5:37 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] OT: Exchange SMTP Greeting
Kevin John,
Isn't the
Isn't the field that you want on the properties page of the
Default STMP Virtual Server
Delivery Tab
Advanced Button
In the Fully-qualified domain name field
I know that when I change this in Exchange 2000 or 2003 that is the name
that the server identifies itself as
Title: Message
Well,
in AOL's defense, they cannot know which of their clients is having mail
forwarded.
However, you may institute a policy that you will not permit forwarding
to AOL - email has to be read locally at your server - or they can use one of
the registrars to forward they
43 matches
Mail list logo
