Re: [Declude.JunkMail] Bonded Sender

2003-12-24 Thread Matthew Bramble
Cyan, Thanks for coming on board. If you don't mind, I would like to jump right into a early Christmas Eve discussion on the topic :) Recently I came across a service that was listed in both Bonded Sender as well as Spamhaus, out003.toptx.com - 38.113.200.23. The company, Topica (

Re: [Declude.JunkMail] SpamCop listing Webtv.net IP

2003-12-24 Thread Matthew Bramble
SpamCop and MailPolice both got demoted on my system by a point today, and I hope to bring them down another point soon (after measuring the effect on my system). When I see ISP mail servers listed, it is generally due to one of two things...they either have no controls on someone doing a bulk

Re: [Declude.JunkMail] Suggestions on whitelisting web servers

2003-12-24 Thread Matthew Bramble
Scot, The E-mail that comes in for accounts that are no longer hosted on that server can be safely refused after 2 days passes. I believe a lot of mail servers will try the A record when delivery fails to the MX, or the MX can't be resolved. The E-mail should be queued on the sending server

Re: [Declude.JunkMail] Suggestions on whitelisting web servers

2003-12-24 Thread Scot Desort
The E-mail that comes in for accounts that are no longer hosted on that server can be safely refused after 2 days passes. I believe a lot of mail servers will try the A record when delivery fails to the MX, or the MX can't be resolved. The E-mail should be queued on the sending server and

[Declude.JunkMail] Yahoo postmaster address

2003-12-24 Thread Omar K.
Does anyone know what's the best way to get in touch with the people who are responsible for yahoo's mail operation? Thanks, --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just

Re: [Declude.JunkMail] Suggestions on whitelisting web servers

2003-12-24 Thread Matthew Bramble
Scot, If you delete the domain from the old IMail server, and leave the HOSTS entry in there along with the relay settings, I believe that the old IMail server will forward the E-mail from the default domain's IP address. The trick is to delete the domain from IMail, then you can IPBYPASS

Re: [Declude.JunkMail] Suggestions on whitelisting web servers

2003-12-24 Thread Scot Desort
If you delete the domain from the old IMail server, and leave the HOSTS entry in there along with the relay settings, I believe that the old IMail server will forward the E-mail from the default domain's IP address. The trick is to delete the domain from IMail, then you can IPBYPASS the

[Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread John Tolmachoff \(Lists\)
What is the best way to have Declude not do DNS tests on user IP addresses? This is in a ISP scenario. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail

Re: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread R. Scott Perry
What is the best way to have Declude not do DNS tests on user IP addresses? This is in a ISP scenario. I would say that WHITELIST IP is the best option in this case. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail

RE: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread John Tolmachoff \(Lists\)
I'll take a stab at this one - dns tests run regardless - its a global.cfg thing. I was thinking along the lines of IPBYPASS, but you can only list 20 IP addresses. Does IPBYPASS work with partials or ranges, or is it exact only? John Tolmachoff Engineer/Consultant/Owner eServices For You

RE: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread R. Scott Perry
I was thinking along the lines of IPBYPASS, but you can only list 20 IP addresses. Does IPBYPASS work with partials or ranges, or is it exact only? IPBYPASS will not do what you want. IPBYPASS was designed *only* to be used when you receive E-mail from trusted IPs that do not do spam scanning

RE: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread R. Scott Perry
In this case, it will still cause the DNS tests to be run (just on different IP(s)). That's why I recommend WHITELIST IP in this situation. But that would just prevent action, correct? The DNS tests will still be run. (Unless using PREWHITELIST ON which I do not want to use.) WHITELIST IP with

RE: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread John Tolmachoff \(Lists\)
The intent is to still run other tests on those messages, but since they are from users and not mail servers, wanted to see if there was a way to save processing time by not running DNS based tests on those IPs. Ah, it does appear that you are looking for IPBYPASS or something similar.

Re: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread Matthew Bramble
If I recall correctly, when you IPBYPASS a single hop message, this can throw off some of the technical tests that are built into Declude since there will be no data element for the IP, REVDNS and HELO. If that's the case, it's because it wasn't designed for that use. This can be tested by

RE: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread R. Scott Perry
Does IPBYPASS work by exact match only then? Yes. IPBYPASS only lets you list a single IP (per the original design, based on expected usage). In this case, you can either use IPBYPASS (with the 20 IP limitation), or you can use HOPHIGH to accomplish this (which will scan more than 1 IP for

RE: [Declude.JunkMail] Bypassing User IP addresses

2003-12-24 Thread John Tolmachoff \(Lists\)
Anywho...I remember the days back when I wasn't using any custom filters, and Declude might have used 2% of my processor per typical message. It's very different now. You could probably easily save that amount of processing by paying extra attention to the filter efficiency if you are using

Re: [Declude.JunkMail] Comments test

2003-12-24 Thread R. Scott Perry
Maybe im not quite familiar with the workings of the COMMENTS test, but shouldn't the included text trigger that test? FAQ. :) O/incinerateur This is not an HTML comment -- you can search the archives for more details. If not, what suggestions do you have? I see so much spam slip by that has

[Declude.JunkMail] Funny false positives :)

2003-12-24 Thread Matthew Bramble
This came to a customer that recently move over to our service from Verizon because they were deluged with spam. I found it to be funny that we blocked it since most of it points to a very poorly configured mail server, and the topic of the announcement from Verizon was E-mail maintenance.

Re: [Declude.JunkMail] Comments test

2003-12-24 Thread Nick Hayer
Omar, I get tons of this stuff too - but it is easy to filter on for example in your bodyfilter have lines like: BODY2 CONTAINSMedicatio/ BODY2 CONTAINSOverni/ in your bodydomains filter: BODY10 CONTAINS.p1x.jpg.com Just a suggestion -

RE: [Declude.JunkMail] Comments test

2003-12-24 Thread Kami Razvan
Hi; Actually I am now curious... Based on Scott Declude will take away the / before checking the email. So.. Does Medicat/ion work as a filter? If Declude takes off the ... then we should just use Medication since really Medicat/... can not be detected. True? False? Kami -Original

RE: [Declude.JunkMail] Comments test **Answered

2003-12-24 Thread Nick Hayer
Kami, The filters do work with the embeded html. I just sent myself a test email with the Medicat/ and it was snagged. Go home. Merry xmas! -Nick Hayer From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject:

Re: [Declude.JunkMail] Yahoo postmaster address

2003-12-24 Thread William Baumbach
[EMAIL PROTECTED] Yahoo! Customer Care - Mail Investigations http://abuse.yahoo.com Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 -

RE: [Declude.JunkMail] Comments test

2003-12-24 Thread R. Scott Perry
Does Medicat/ion work as a filter? Yes, but it isn't necessary, as: If Declude takes off the ... then we should just use Medication since really Medicat/... can not be detected. you can just use Medication. That's why I say that it really isn't an issue -- while it isn't possible to detect

RE: [Declude.JunkMail] Subject Starts with

2003-12-24 Thread John Tolmachoff \(Lists\)
Will it be added? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, December 01, 2003 12:08 PM To: [EMAIL PROTECTED] Subject: Re:

[Declude.JunkMail] Happy Holidays

2003-12-24 Thread Jeff Kratka
I would like to wish everyone a Safe and Happy Holiday. EVERYONE that has helped over the past year (and I've needed it) a big THANK YOU. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel/fax: (541) 839-6027