Brian, if you have Terminal Services or PCAnywhere installed, contact me off
list if you would like me to take a look at what happened.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On
A friend of mine at Safe-t.net in Mt. Vernon Ohio just called
me and said his spool in Imail is loading up and holding all
messages..He thinks the Declude has stopped working...Imail
tech support not available..
hmmm... very strange. The same thing happend on my server yesterday evening
Hello,
hmmm... very strange. The same thing happend on my server
yesterday evening at 11:30 pm (GMT+1)
are you running Imail 7.x or 8.x?
Alex
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.
hmmm... very strange. The same thing happend on my server yesterday
evening at 11:30 pm (GMT+1)
are you running Imail 7.x or 8.x?
IMail v7.15
Beside declude's whitelisting for authenticated users working only with v8.x a haven't
found any reason to upgrade.
Markus
A couple of posters offered some help on this, where I don't
have the original messages (they're at home and I'm at work).
The FP rate is fairly heavy on spamchk so far... including
bagging about half of the traffic on this list today. I'm
sure its something easily fixed.
The best way
Im running version 6 and have not found a reason to upgrade.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Gufler Markus
Sent: Wednesday, December 03, 2003 12:09 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Server Gone Wild
hmmm... very
Here is one from lastnight.
Received: from maineconnect.net [216.204.154.7] by mail.sslsales.com with
ESMTP
(SMTPD32-7.14) id A80954B50060; Tue, 02 Dec 2003 22:27:05 -0500
Received: from web1.sslsales.com [216.204.153.96] by maineconnect.net with
ESMTP
(SMTPD32-8.01) id A9C262450100; Tue, 02
X-RBL-Warning: Declude CAUGHT-NO ABUSE
X-RBL-Warning: HELOBOGUS: Domain web1.sslsales.com has no MX or A records.
In this case, part of the problem seems to be that your local DNS server
isn't able to resolve web1.sslsales.com -- could it be that you have a
local DNS server that is resolving
Im running version 6 and have not found a reason to upgrade.
MS Patch display problems and KWM templates.
Not very much but what new features do you want if already a declude
customer? ;-)
V8 also provides finally an API but this problem we've already solved with
the command line tools
hmmm... very strange. The same thing happend on my server yesterday
evening at 11:30 pm (GMT+1)
All D*.SMD spoolfiles finished in the spool folder. There was no Q file
but a lot of files beginning with _ (instead of Q)
When I tried to resend the messages from the IMail queue viewer this _
Hi all,
All of the recent talk about SpamChk has finally prompted me to give it
a spin. Per the documentation, I am considering change my weight
scale. That is, I normally hold on 10 and delete on 25. Of course, my
per-test weights are adjusted accordingly.
I am thinking about doing what
does anyone see any problems with weights potentially being in the -1000
to 1000+ ranges? Obviously, it's all relative to my tests, but I'm more
curious about how JunkMail is designed and if there would be any problems
with much larger values.
No, there won't be any problems. You should be
We had same thing happen to us (Spool files started to collect with no
delivery processes) immediately after doing an Fprot update last night
at 6.15pm; had to uninstall Fprot and reload older version of it (3.14
I believe) to get it back up
Sincerely,
Randy Armbrecht
Global Web
... does anyone see any problems with weights
potentially being in the -1000 to 1000+ ranges?
We use the hold-on-100 weighting system and have daily hold spam messages
between 100 and 1200 points
Also, I don't suppose there's a way to set up spamchk so that
it does not add any
We had same thing happen to us (Spool files started to
collect with no delivery processes) immediately after doing
an Fprot update last night at 6.15pm; had to uninstall Fprot
and reload older version of it (3.14 I believe) to get it back up
This was also one of my first assumtions.
We ran a manual update last night - this is how we new this was the
issue...
Sincerely,
Randy Armbrecht
Global Web SolutionsR, Inc.
804-346-5300 ext. 1
877-800-GLOBAL (4562) ext. 1
http://globalweb.net
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Let me also clarify - this was a program update - not a def file
update...
Sincerely,
Randy Armbrecht
Global Web SolutionsR, Inc.
804-346-5300 ext. 1
877-800-GLOBAL (4562) ext. 1
http://globalweb.net
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
The problem has been identified; there was a problem with v1.76 (beta) and
subsequent interim releases and the BANNAME option. This issue is fixed
in
a new interim release v1.76i30 at
http://www.declude.com/release/176i/declude.exe . Alternatively, you can
comment out the BANNAME options by
Over the past couple of weeks I have found about a dozen messages with this
header:
X-RBL-Warning: [Unknown Var]TESTNAME[Unknown Var]WARNING
The JunkMail log entries for these messages look normal, so I'm not sure
what the problem might be.
Scott, any ideas?
Bill
---
[This E-mail was
Over the past couple of weeks I have found about a dozen messages with this
header:
X-RBL-Warning: [Unknown Var]TESTNAME[Unknown Var]WARNING
The JunkMail log entries for these messages look normal, so I'm not sure
what the problem might be.
Scott, any ideas?
That will happen if you are using
How can I get on the Declude Virus scan list
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The
PERSONAL STORY
December 3, 1998. 9:03 AM
It was a clear crisp day in Fresno, CA.
Then, at the hands of 2 inattentive drivers, I nearly lost my life.
Driving/Operating a motor vehicle is a responsibility!
Please...Treat it with the respect it deserves.
Thank you.
John Tolmachoff
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
Over the past couple of weeks I have found about a dozen messages with
this
header:
X-RBL-Warning: [Unknown Var]TESTNAME[Unknown Var]WARNING
The JunkMail log entries for these messages look normal, so I'm not sure
X-RBL-Warning: [Unknown Var]TESTNAME[Unknown Var]WARNING
I have nothing like that in my global.cfg. Just to make sure, I did a find
on TESTNAME, and WARNING and neither were found in my global.cfg file.
In fact, these are the only two entries in my global.cfg that use the
percent % sign:
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
X-RBL-Warning: [Unknown Var]TESTNAME[Unknown Var]WARNING
I have nothing like that in my global.cfg. Just to make sure, I did a
find
on TESTNAME, and WARNING and neither were found in my global.cfg
file.
In fact,
I am now seeing this also. This is disturbing as it is allowing viruses
through.
The particular message that I am concerned with (containing a virus) does
show up in the c:\declude.log file but is not in the virus or hijack log but
is seen in this line in the JM log:
12/03/2003 06:11:30
I am now seeing this also. This is disturbing as it is allowing viruses
through.
The particular message that I am concerned with (containing a virus) does
show up in the c:\declude.log file but is not in the virus or hijack log but
is seen in this line in the JM log:
12/03/2003 06:11:30
Thanks Markus. I am using SpamChk with about 70 other tests. One thing
that helped solve the fp problem was going to your weight 100 scheme.
By adding a zero to every weight it brought spamchk's results into
proportion with everything else.
I didn't want to mess with the config for precisely
Here are the headers from one of the error messages your list
server threw. The mails had no content. Only the subject
you see here. I got subscribed just fine with the other link
you sent me. It appears that this other link doesn't ask for
my name, as that's the only diff I saw
To help track this down, it would be helpful to do the following:
Compare the number of messages logged in C:\declude.log to the number logged
in the virus log in a 24 hour period.
Any one know how to do that?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original
Also another interesting finding.
It seems as when this is happening, the Imail Spam statistics header line
does not appear either. Any one else confirm this?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: John Tolmachoff (Lists) [mailto:[EMAIL
Markus,
The last f-prot update is from 12/01/2003
Our F-Prot Updater runs every hour at xx:20 o clock.
Mail processing stopped at 11:43 pm.
I set up a program alias that the F-Prot notifications email to. That
in turn kicks off update.exe [the f-prot update program]. Nothing
wrong for sure
You could use ATTACH to attach the spam to the email so it does not get
viewed.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Alejandro
Valenzuela
Sent: Wednesday, December 03, 2003 12:39 PM
To: [EMAIL PROTECTED]
Subject:
Why would this be caught with SPAMDOMAINS when closeout-sale.com is not in
the spamdomains.txt file?
X-RBL-Warning: SPAMDOMAINS: Spamdomain 'domain.moc' found: Address of
[EMAIL PROTECTED] sent from invalid
mail.closeout-sale.com.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
Why would this be caught with SPAMDOMAINS when closeout-sale.com is not in
the spamdomains.txt file?
X-RBL-Warning: SPAMDOMAINS: Spamdomain 'domain.moc' found: Address of
[EMAIL PROTECTED] sent from invalid
mail.closeout-sale.com.
That's because the SPAMDOMAINS test looks for the domain within
John,
If you include an @ symbol before the domain name, it will stop it from
tagging this VERP stuff.
@domain.moc domain.moc
@aol.com .aol.com
@yahoo. .yahoo.
etc...
The only drawback here is that you can only have one match (the second
column) because the first
John, a few weeks ago I sent you a copy of my 1st draft UNIX Utilities
Reference Guide I had put together, but heard no response back from you.
Had you reviewed it you probably would have been able to figure this out.
Anyway, here is what I found on one of my IMail servers:
gawk {print $3}
Scott, any more thought to optimizing the log files? As I was doing the
checking the message counts of the virus, junkmail, and declude.log files, I
was astonished to find that some of the messages logged in the JunkMail file
had over 500 entries because of the number of recipients.
Bill
---
That's because the SPAMDOMAINS test looks for the domain within the E-mail
address, even if it appears in the username.
But wouldn't that create a lot of false positives in such things like
newsletters that have the receipients address embedded in the from address
as part of the user part?
Scott, any more thought to optimizing the log files? As I was doing the
checking the message counts of the virus, junkmail, and declude.log files, I
was astonished to find that some of the messages logged in the JunkMail file
had over 500 entries because of the number of recipients.
It's
Question..
SPAMDOMAIN will test the REVDNS only for the domains included in the
spamdomains.txt file ??
Any domain not included will not be tested ??
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Wednesday, December 03, 2003 2:42
That's why making the SPAMDOMAINS test an ENDSWITH instead of CONTAINS type
of test would resolve lots of these kinds of questions and headaches.
Bill
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 1:29 PM
Subject: Re:
This is interesting. We are happy with the configuration of declude jm so we
use the EXACT same setting on our other mail server. I sent a test message
from our web server to both with the same exact information and below is
what I got.
X-OriginalArrivalTime: 03 Dec 2003 14:54:01.0812 (UTC)
X-RBL-Warning: HELOBOGUS: Domain web1.sslsales.com has no MX or A records.
Is that odd ? Could it be something with the mail server ???
My guess is that the two different mailservers are using two different DNS
servers, one of which thinks it is authoritative for sslsales.com (and is
reporting
Found the issue..
While I was waiting for a response I went back to the non beta of declude
version same as the other mail server and the helobogus error is gone. I
then reinstalled the beta version and the error is back.
Dave
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
Bill, usort was not included in the files on the unixtools site you posted
before, but I was able to find it here:
http://www.profsoftware.com/unixdos/ud09.htm However, now when running the
command, I am getting an error saying needed dll udbase.dll not found.
John Tolmachoff
Bill, never mind. I just got the reference paper from you and it is listed
in there where it is at and such. Works. Thanks.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December
And for the last 15 minutes I have been trying to figure out what I am doing
wrong to where I keep getting a result of 0. ;)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of
So back to my original idea, in my case, yesterday 5 messages did not make
it to Virus or JunkMail processing. That is barely over 1/10 of 1%.
What are others experiences? (I will also do this latter on the other
servers I work on.)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
Bill Landry wrote:
That's why making the SPAMDOMAINS test an ENDSWITH instead of CONTAINS type
of test would resolve lots of these kinds of questions and headaches.
...and create some others at the same time. No one option is perfect,
so if Scott decides to change the functionality of this
Alejandro,
From the Declude JunkMail manual page:
This test will catch E-mail that is not coming from a mailserver
that it should be coming from. This test will only work if you set
up a file listing domains that you wish to be included in this test.
Specifically, it will check the
I don't know how hard it would be, but what about just adding in a pre filter in the
spamdomains test that will bypass the test. Like:
Spamdomains.txt:
[RDNS excluded from check]
ebay.com
greetingcardvendor.com
[includes]
.yahoo.com
@msn.com
etc, etc
This would also allow us to build our
Hiya All -
We're seeing outbound e-mail to AOL.com happening very, very slowly.
Our outbound server (64.4.213.165 / 64.4.213.169) appears to be configured
correctly (no problems last week, and no changes since then).
Anybody else seeing AOL delays today?
=
Rob
Everything is already excluded from the spamdomains test except that which
you specifically included. So I'm not sure I understand what you're asking
for here?
Bill
- Original Message -
From: Jason Newland [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 5:29
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
That's why making the SPAMDOMAINS test an ENDSWITH instead of CONTAINS
type
of test would resolve lots of these kinds of questions and headaches.
...and create some others at the same time. No one option is perfect,
so
Say for example I have 10,000 people using MSN.com addresses to spam me
with.
I add the spamdomains test and enter in @msn.com into it.
Now it does well to stop the spammers, but now I am falsely tagging mail
from ebay.com [EMAIL PROTECTED] making a bid inquiry.
If we could have a spamdomains
How does Sniffer work?
Their web page says:
In the best implementations allow you to assign a weight to each possible
result code. Declude, mxGuard, and SpamAssassin are all good examples of
systems that allow weights to be assigned to the result codes from Message
Sniffer.
So if Sniffer says
Yes, it would be nice if you could add more that just one alternate domain
per line in the spamdomains.txt file, like:
@msn.com.msn.com .hotmail.com .ebay.com
Maybe in a future release (hint, hint)... ;-)
Bill
- Original Message -
From: Jason [EMAIL PROTECTED]
To: [EMAIL
Brad,
Sniffer has a rule base that they code based on spam they receive.
Depending on the type of spam it is (porn, av, hosting, etc) they place that
rule in an appropriate category. When sniffer scans a message it will
return a code. The code that is returned is what you will use in your
Jason,
I have a separate 'white' filter for that sort of thing :)
Matt
Jason Newland wrote:
I don't know how hard it would be, but what about just adding in a pre filter in the spamdomains test that will bypass the test. Like:
Spamdomains.txt:
[RDNS excluded from check]
ebay.com
Brad, Sniffer does message based pattern matching (Pete, correct me if I am
wrong). If you opt to separate the 20 or so tests that Sniffer currently
supports, then you can set whatever weight you want to each individual test.
Here is how I currently have the individual Sniffer tests defined in my
Bill Landry wrote:
Having the ability to define the test type (*WITH) per line would be nice.
However, short of that, how many people would wonder why:
sale.com
in the spamdomains.txt file would cause this to fail:
[EMAIL PROTECTED]
versus this in the spamdomains.txt file:
You CAN create your own RDNS whitelist. You can even use your DNS server to
maintain it.
Not sure if that's what your trying to do?
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206
---
[This E-mail was scanned for viruses by Declude Virus
Whitelisting in the traditional sense is also discouraged from where I
sit. Build a filter file that just simply deducts some points, but not
too many, so that the message could fail a few important filters or
RBL's and still pass. There will be limited circumstances where a
spammer will
Ahh, but us poor folks that have the standard version are out of luck
:-(
Guess I have a good reason to upgrade now.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Wednesday, December 03, 2003 9:17 PM
To: [EMAIL
- Original Message -
From: Matthew Bramble [EMAIL PROTECTED]
Having the ability to define the test type (*WITH) per line would be
nice.
However, short of that, how many people would wonder why:
sale.com
in the spamdomains.txt file would cause this to fail:
[EMAIL
Well that and at least 10 other filters that have been shared on this
list or available at my site. It really depends on how tight you want
your system of course and how much processing power you can throw at
things. The recent beta functionality to limit the processing of
filters helps a
Brad,
That's right.
:-)
Heuristics for patterns are grouped by the spam that prompts us to generate
them, or by how we created them. Most of the time they are at least close
to classifying the type of spam. Each system that uses Message Sniffer is
encouraged to specify adjustable weights for
Bill Landry wrote:
If you use the @ symbol in the first column, then you have severely limited
yourself to supporting only one RDNS per domain.
I don't feel limited, in fact, I have a lot more confidence in this test
not FP'ing on VERP stuff which may be forwarded to an account hosted on
my
Several people have reported issues with E-mail not being delivered over
the past few days.
The problem has been identified; there was a problem with v1.76 (beta) and
subsequent interim releases and the BANNAME option. This issue is fixed in
a new interim release v1.76i30 at
70 matches
Mail list logo
