I have Imail v6.06 with Declude 1.75. When I run the smtp32.exe
it seems to be passing mail. When I have it call declude.exe it fails.
What is failing? The E-mail is delivered unscanned? The E-mail is
deleted? The E-mail sits in the spool? What do the log files show for a
sample E-mail that
Title: Reading the header..
Scott:
In the following:
X-RBL-Warning: FILTER-BODY: Message failed FILTER-BODY test (line 346, weight 7)
I am under the assumption that the line number is the last or the first line that triggered the weight and the weight is total weight of the filter
Title: Reading the header..
Morning
Kami. The weight is the line weight in the filter file, in this case the weight
that line 346 lists.
Correct that the X-RBL-Warning only shows
one line caught if multiple, but I do not remember if the first or last caught.
John Tolmachoff
Title: Reading the header..
So really
it is meaningless.. since it only says a single event when in fact multiple
lines could have been hit in that filter and the final weight could be totally
different?
It would
be good to be able to see the weight for each filter hit so one could
I have seen a lot of mail like this one scoring low on Declude:
X-F: [EMAIL PROTECTED] Sat Nov 22 06:08:11 2003
Received: from tekes.fi [80.56.186.84] by njaccess.com
(SMTPD32-6.06) id A394206D005E; Sat, 22 Nov 2003 06:08:04 -0500
Message-ID: [EMAIL PROTECTED]
From: Sybil D. Neely [EMAIL
Title: Reading the header..
Yes, it would be helpful if it would list
each line caught with. J
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Thursday,
I have 2 filters for that:
In my BASICFILTER:
SUBJECT 10 ISBLANK
In my GRAYFILTER4:
BODY 25 STARTSWITH g
It has been extremely effective on that.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
In the following:
X-RBL-Warning: FILTER-BODY: Message failed FILTER-BODY test (line 346,
weight 7)
I am under the assumption that the line number is the last or the first
line that triggered the weight and the weight is total weight of the
filter when it was done.
If several lines are hit
Great... If the weight is the total weight of the matches for the entire
filter I am happy..
Because of this you can forget my demand for a million dollars a while
back.. It is Thanksgiving and I am feeling generous..
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
Any body else seeing messages where the subject is only b or bbb and the
body is only b or bbb?
Could this be a spammer checking for valid addresses?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
John..
I have seen many of these..
Also..
Recently we are seeing a lot of email - same type of email- that are
apparently coming from soldiers in Iraq.. It goes on and on but the story is
almost the same.
People receiving it say they have no idea what it is..
I am thinking that it is a new
Every one I see comes from @aol.ca but is not from a AOL.ca server. Does any
one know what the line would be for aol.ca in SPAMDOMAINS?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED]
Can somebody point me to a source for a SpamDomains text file so I can do
some comparisons...
Rich
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
I just checked for the last 2 days, nope.
On a related note, I see rushes where the spam has no body and the same
header appears from multiple open relays all at the same time; I think it's
broken spamware.
-Original Message-
From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED]
Sent:
I update the URL file in Imail by sending all not recognized SPAM
to a mailbox then running the spam_sedeer utility
Now, can Declude filter E-mail based on that file ??
I am new to Declude, just testing it for two days now
It seems good but have some emails that are not caught with
Declude, and
On a related note, I see rushes where the spam has no body and the same
header appears from multiple open relays all at the same time; I think
it's
broken spamware.
You mean like this: (That is the entire D file.)
---
2 things you can do with filters. (Only available in JunkMail Pro.)
1. Have Imail add a header for the URL list and then filter on that header
and add weight.
2. Create a URLFILTER filter file in Declude from the Imail URL list. You
can do this by using Excel.
John Tolmachoff
Is there need for a separate support list, or do you want it sent to you?
One thing I am noticing about the GUI is that it does not always clear
previous settings. Example, if I had set to filter by domain, but now do not
want to, just be removing the domain in the GUI does not always remove it
Hmm, nope, but I have also seen broken headers like you provided, but never
with so much misplaced stuff in the header; from what Scott has previously
mentioned, I would guess that the way your sample message is broken is that
somewhere in the hops a mailserver put in an extraneous CR/LF.
The
Ok, on the first option, how it would work ??
Because the manual says that Declude JunkMail run
earlier that Imail filters...
So even if I add the Imail header, Declude will not detect it.
Or there is a way to change that scanning order ??
-Original Message-
From: [EMAIL PROTECTED]
Yes, the BODY ISBLANK has done well for me.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Thursday, November 27, 2003 12:11 PM
To: '[EMAIL
This is the order:
Imail Kill.lst and control access.
Imail Anti-Spam
Declude Hijack
Declude Virus
Declude JunkMail
Imail Statistics
Imail Rules
The URL file in Imail is part of Imail Anti-Spam, and is therefore run
before Declude.
What you are referring to is the Imail rules kept in rule.ima
is a gap of almost 2 minutes in the JM log.
Anybody anyidea what happened, what would cause something like
this?
I'm using IMail 8.03 and Declude 1.75
Declude virus LogLevel MID
Declude JM LogLevel LOW
log1127:20031127 091726
127.0.0.1 SMTP (03CC01FA) finished
C:\IMail\spool\Qb314003e011cf42d.
Hi;
I suggested body blank but frankly it has never been hit. I think it is
because an email body is NEVER blank.. It always has some code..
I remember exchanging a blank email with Scott that was not detected with
ISBLANK and that was his comment.
Perhaps the test is run by doing a Length
I know I'm late in responding to this thread . .
but my comment is, if the interim releases are only to fix specific problems,
and there is no public announcement or release notesas to what those fixes
are, then how is a person toknow whetherhe does or does not need a
particular interim
Yep, has happened to me a few times during beta testing. I'm investigating some
issue, invest time to dig through logs, report the problem - just to be told oh, that
was fixed in interim release xx.
Duh! Thank's for warning me.
-- Original Message --
Yep, has happened to me a few times during beta testing. I'm
investigating some issue, invest time to dig through logs, report the
problem - just to be told oh, that was fixed in interim release xx.
Duh! Thank's for warning me.
Remember, though, that it was the same way back with just betas
John,
Any anomly you find with the program please send me an email
[EMAIL PROTECTED] and describe the process to reproduce. Any bugs that
are found will be corrected quickly.
Thanks
Darrell
John Tolmachoff (Lists) writes:
Is there need for a separate support list, or do you want it sent
These are the ones I am testing right now. Any comments?
NJABL ip4rdnsbl.njabl.org 127.0.0.2 7
0
NJABLPROXIESip4rdnsbl.njabl.org 127.0.0.9 7 0
CBL ip4rcbl.abuseat.org 127.0.0.2 7
0
AHBLOPEN
Scot,
The 8 bit encoding doesn't have anything to do with why it passes
ANTI-GIBBERISH. It appears that this test got tripped on the ANTI
filter because of a qa string (with the space, line 53 of that filter).
I believe that 8 bit encoding isn't going to be very safe to filter on,
though it
I haven't tested these, however I would very much appreciate knowing
from your tests or those of others two things in particular:
NJABL and AHBLSPAM - Do they FP on a lot of legit advertisements?
AHBLGOOD - Is this absolutely trustworthy and what types of servers does
it list?
Thanks,
Matt
NJABL and AHBLSPAM - Do they FP on a lot of legit advertisements?
AHBLGOOD - Is this absolutely trustworthy and what types of servers does
it list?
I ran across AHBLGOOD and am testing it to see what happens.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was
Scott
if we comment out a test in global.cfg and leave its action in
default.junkmail
will there be any problems ? errors, performance issues, ...
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, November 21, 2003 1:52 PM
Subject:
NJABL for the most part is like ORDB. They test open relays and list them.
Folks that are listed can easily request to be de-listed, but of course they
are not removed if njabl finds them relaying still.
Darrell
Matthew Bramble writes:
I haven't tested these, however I would very much
Since the tests will be dead, remove them is best.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of serge
Sent: Thursday, November 27, 2003 6:43 PM
To: [EMAIL PROTECTED]
These are the bugs that are fixed in the latest interim release,
without specifying which interim release fixed it
Thanks - that would be a great help.
Typically, beta testers come to expect an extra level of support, since they
are sticking their heads out for the developer's benefit. To
Title: Message
Some more grist
for the mill, and a question or two for Scott...
I've seen the
same behaviour in our implementation: the inbound e-mail is received and doesn't
look mangled, but has no declude headers. Until recently, there was no
declude log lines, either.
I'm running
Scott
I do not think it is a good idea to hide tests like ipnotinmx, because we
wont know their weight contribution
we need a hidetest when weight =0, but that will show the negative value
when passed test
something like %weightnot0test% variable with all tests that contributed to
the total
In the case of IPNOTINMX and NOLEGITCONTENT, it works just the opposite. If
the messages fails, no weight is added or subtracted. If the test passes,
the negative weight is subtracted. Therefore, if one of those tests is
listed under %TESTSFAILED%, it means nothing was done.
Likewise, the actions
39 matches
Mail list logo
