My experience with NJABL has been its absolutely solid. Not maybe what
others have had. Just my 0.02.
Matt Robertson [EMAIL PROTECTED]
MSB Designs, Inc. http://mysecretbase.com
---
[This E-mail
I have in one of my filter files the following line:
BODY 5 STARTSWITH
Yet, it is not catching the following:
I believe there is an issue (that will be fixed in the next release) where
the BODY STARTSWITH might not work properly (I believe it was including the
CRLF separator).
I have the held.vbs running every 10 minutes, and it has only be sending
notices occasionally about HOLD1.
Hijack is configured as such:
RELAYTHRESHOLD1 10 20
RELAYTHRESHOLD2 30 150
There are 3 C blocks of addresses allowed and 3 others per the client
request.
Should I try again
What effect will this have on the endless work we are doing on here fighting spam ?
Benny
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED],
Title: Redirect Spam to another folder
Good morning,
Sorry in advance if this has been covered.
Is there a way to either:
1. Move the Spam folder that receives the hold emails out of the Imail\spool directory
OR
2. Have emails with a hold action be placed in another folder
1. Move the Spam folder that receives the hold emails out of the
Imail\spool directory
OR
2. Have emails with a hold action be placed in another folder totally?
No, this is not possible -- but fairly high on the to do list.
-Scott
---
Declude
Well,
Here is how my replacement tests are doing (turned off EasyNet at noon):
DLAnalyzer(v2.0.B.I) Report Generated At 11/25/2003 12:19:41 AM For
Argos.net
Report Start Time: 11/24/2003 00:00:00
Report End Time: 11/24/2003 23:59:59
Total Messages: 12,777
Messages That Failed: 8,475
Spam
Where can i find this versjon of DLAnalyzer(v2.0.B.I)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: 25. november 2003 16:13
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] EasyNet Replacements
Well,
Here is how
Hi,
Where can i find this versjon of DLAnalyzer(v2.0.B.I)
Amazingly enough at:
http://www.dlanalyzer.com
G
Best Regards
Andy
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe,
The latest version of DLAnalyzer was released last week. The current
version is 2.0R. Many new features were added including a GUI based
configuration utility to ease configuration. There are many other reports
it can generate besides the one listed below (Domain Summaries
yeah yeah
but how to find more info about route problem
Isn't this a faily high amount of routing failure ?
Report Start Time: 11.25.2003 00:00:00
Report End Time: 11.25.2003 23:59:59
Total Messages: 28 149
Messages That Failed: 19 519
Spam Percentage: 69,34%
TEST # FAILED
Hi,
How is your ROUTING test defined in your GLOBAL.CFG? Is that the
'SPAMROUTING' test? If so - yes, 42% seems extremely high.
but how to find more info about route problem
You should look into the headers of some of the emails that fail the ROUTE
test. If you can't tell why they failed
Isn't this a faily high amount of routing failure ?
Note that the ROUTING test is designed for mailservers in North America --
if your mailserver is located outside of North America, it will not work as
well.
-Scott
---
Declude JunkMail: The
IPBYPASS193.217.93.5 an extern server forwarding mail
IPBYPASS213.236.237.186 a mail gateway local
IPBYPASS213.236.237.163 a mail server local sending trough 186
IPBYPASS213.236.237.227 a mail server local sending trough 186
IPBYPASS213.236.237.228 a mail
So you say that i should take it out ?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R.
Scott Perry
Sent: 25. november 2003 18:07
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] EasyNet Replacements
Isn't this a faily high amount of
but for an example
Received: from mailgw1.mailserveren.com [213.236.237.228] by mailserveren.com with
ESMTP
(SMTPD32-7.13) id AFA214230116; Tue, 25 Nov 2003 17:13:22 +0100
Received: from mail.fluidhosting.com (mail.fluidhosting.com [66.150.201.72])
by mailgw1.mailserveren.com (Postfix)
Hi,
If 42% of your mail fails the routing test, then you probably will get such
a mail sometime today and you can post the header then?
Also - note Scott's response. It appears as if the SPAMROUTING test is
hard-wired to the U.S. That alone may be a clue to what's going on. The
headers will
I predict no effect.
- Original Message -
From: ISPhuset Nordic AS [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, November 25, 2003 8:46 AM
Subject: [Declude.JunkMail] CAN-SPAM
What effect will this have on the endless work we are doing on here
fighting spam ?
Benny
---
So you say that i should take it out ?
Unless you have reason to believe that it will be a useful test for you,
you may want to remove it. Because of the way that IPs are allocated, it
only works as designed if the mailserver receiving the mail is in North
America (IPs allocated by ARIN).
I know you are busy, but I need to ask.
When can we expect that? One of the servers I am working on is getting about
500 of these a day. All from different IPs and domains. Only common
characteristic is the body starts with g and has a blank subject line, and
I do not want to raise the weight of
I know you are busy, but I need to ask.
When can we expect that?
You know the rule -- ask and ye shall receive. :)
http://www.declude.com/release/176i/declude.exe has 1.76i27, which has this
change in it. Note that this specific interim release will also record one
log file entry to
Scott,
For those of us that have had email (daily) skipping Declude
calling would it be good for us to move up to the 1.76i27 to have that
logged for you?
Keith
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]
Sent: Tuesday, November 25, 2003 1:03 PM
To: [EMAIL
For those of us that have had email (daily) skipping Declude
calling would it be good for us to move up to the 1.76i27 to have that
logged for you?
Yes, that would be a good idea.
-Scott
---
Declude JunkMail: The advanced anti-spam
I predict it will make no difference in blocking spam; it will however,
lower your rate of false positives because it will be easier to identify
trustworthy e-mail partners.
Andrew 8)
-Original Message-
From: ISPhuset Nordic AS [mailto:[EMAIL PROTECTED]
Sent: Tuesday, November 25, 2003
Scott:
Are all those features recently talked about included in this release?
Skip Max weight?
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
Sent: Tuesday, November 25, 2003 2:43 PM
To: [EMAIL PROTECTED]
Subject: RE:
Are all those features recently talked about included in this release?
Skip Max weight?
Yes.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in
:)
How subtle you are... Just YES.. Just like that..
This calls for celebration...
This indeed is great news.
So I guess we should start ordering our tests in the order we want them
executed and then start adding the codes to the top of the filter.
When are you planning to elaborate on your
I would like to try and compile a list of IP's and senders to add to my
kill.lst and to the SMTP Access Table to stop more mail at the front door.
Any recommendations on the best method to do this?
I have a lot of messages in the hold folder that I could search for. Should
I just search for the
Wow! Very kool. Thanks Scott!
-Nick
Date sent: Tue, 25 Nov 2003 15:11:33 -0500
To: [EMAIL PROTECTED]
From: R. Scott Perry [EMAIL PROTECTED]
Subject:RE: [Declude.JunkMail] BODY STARTSWITH
Send reply to:
Typical network administration function.
It is working fine now, max CPU is 3% momentarily. I have held.vbs checking
every minute and so far only about 10 notifications in the last hour, and
only 4-6 at a time.
I will continue to monitor and see what happens.
John Tolmachoff
Now with the added features, what is the order by type in which the tests
are run?
External
Filter
Fromfile
Ip4r
Rhsbl
And does the order in which they are listed in the global.cfg matter?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by
Now with the added features, what is the order by type in which the tests
are run?
External
Filter
Fromfile
Ip4r
Rhsbl
Unfortunately, we do not have this information easily available at this time.
And does the order in which they are listed in the global.cfg matter?
It rarely matters. Cases
That first line was supposed to be frustration, not function. :(
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Tuesday, November 25, 2003
Am I missing something? Should I be subscribed to a different list? Or
are you just wondering about things when they are released?
Thanks,
Matt
John Tolmachoff (Lists) wrote:
Now with the added features, what is the order by type in which the tests
are run?
External
Filter
Fromfile
Ip4r
Scott,
Is there an order to which tests are executed in the global config?
Are filterfiles read/executed last? Is there any way to determine the
order that each filterfile is run ?
Thanks
-Nick Hayer
Date sent: Tue, 25 Nov 2003 15:11:33 -0500
To:
Ok, I was reading backwards and just saw this :)
I'm going to code up GIBBERISH to work in this fashion so that the
functionality as well as the filter modification can be tested out.
I'll share it tomorrow probably. Lots of playing around to do though
:) At least it still feels something
Are filterfiles read/executed last?
They are close to the last tests run.
Is there any way to determine the order that each filterfile is run ?
They will be run in the order they are defined in the global.cfg file.
-Scott
---
Declude JunkMail:
???
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Tuesday, November 25, 2003 1:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test
Thanks Scott!
Another question:
Very kool addition but I'm having trouble with MAXWEIGHT
Gotta be simple but I just don't get it:
DJMPro v1.76i27
I created a filter called testfilter.txt
it contains
SKIPIFWEIGHT 40
MAXWEIGHT 20
HEADERS 1 CONTAINSfrom
I sent myself an
Scott, I am ROFLOL at this:
11/17/2003 12:12:20 Q2ba00068020856ba Triggered ISBLANK filter BASICFILTER
on THIS_STRING_SHOULD_NEVER_BE_IN_AN_EMAIL_OR_IT_WILL_BE_MARKED_AS_SPAM
[weight-5].
Some times, you are just too funny.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This
Scott, I am ROFLOL at this:
11/17/2003 12:12:20 Q2ba00068020856ba Triggered ISBLANK filter BASICFILTER
on THIS_STRING_SHOULD_NEVER_BE_IN_AN_EMAIL_OR_IT_WILL_BE_MARKED_AS_SPAM
[weight-5].
Some times, you are just too funny.
:)
Actually, that was designed for internal use, and wasn't meant to
Very kool addition but I'm having trouble with MAXWEIGHT
Gotta be simple but I just don't get it:
DJMPro v1.76i27
I created a filter called testfilter.txt
it contains
SKIPIFWEIGHT 40
MAXWEIGHT 20
HEADERS 1 CONTAINSfrom
This should [1] skip the test completely if the weight
Scott:
I added the
following:
SKIPIFWEIGHT60MAXWEIGHT60
I thought this
would force the filter to skip if the weight is 60 and if the weight inside the
filter reaches 60 it should also exit.
Interestingly
enough none of the filters that have this at the top ever
execute.
Regards,
Kami
I added the following:
SKIPIFWEIGHT 60
MAXWEIGHT 60
I thought this would force the filter to skip if the weight is 60 and if
the weight inside the filter reaches 60 it should also exit.
Interestingly enough none of the filters that have this at the top ever
execute.
There is a new interim
Munged twice so far, so I am resending this time without the zip file
attachment in the event that there is some sort of restriction on this.
The referenced file can be downloaded from the following link:
http://www.mailpure.com/software/decludefilters/gibberish/Gibberish_v2-0-0.txt
Matt
Hi Scott:
What I did was to move all of our negative weights to the top of the
global.cfg file.
None of our filter files have mixed positive negative weights- they are
either all positive or all negative. Considering what you stated earlier
that the tests are run according to the order they
If I were to create a custom DNS based blacklist on a DNS server, how would
that perform compared to a fromfile or filter file with MAILFROM ENDSWITH?
MAILFROM ENDSWITH would perform a bit better. The DNS-based blacklist
would have extra network overhead -- such as the CPU time
If I were to create a custom DNS based blacklist on a DNS server, how would
that perform compared to a fromfile or filter file with MAILFROM ENDSWITH?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Thanks.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday, November 25, 2003 4:51 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail]
I have been thinking about setting up an in-house DNSBL and would
appreciate it if some kind person here could point me in the right
direction on getting started. I can pretty much figure out how to
create a e-mail submission for the service when I want to make updates,
but I'm not to sure on the
I have been thinking about setting up an in-house DNSBL and would
appreciate it if some kind person here could point me in the right
direction on getting started. I can pretty much figure out how to
create a e-mail submission for the service when I want to make updates,
but I'm not to sure on
A message was delivered with a weight of 38. The logs show this:
11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT10 (Weight of 38 reaches or
exceeds the limit of 10.). Action=WARN.
11/25/2003 01:09:06 Q1c273da Msg failed WEIGHT15 (Weight of 38 reaches or
exceeds the limit of 15.). Action=MAILBOX.
Scott,
Is there a summary of the new tests, what they do and how to use them? It's
almost like there needs to be class to go to, for setting up filters.
Today I discovered that some of the adjustments I've made to config files
were catching legitimate list serv mailand so it goes. Is there
What version of JunkMail (Pro or Standard) and what version of Imail?
MAILBOX is only available in JunkMail Pro.
Could that message have been White Listed?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
54 matches
Mail list logo
