[Declude.JunkMail] X-Declude-Sender missing IP

2004-09-28 Thread Terry Fritts
With the latest beta I am seeing messages where the X-Declude-Sender is missing the IP address, i.e., [0.0.0.0]. Ones I've seen are from my internal network. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the

[Declude.JunkMail] 100 Point scale / DNS

2004-09-28 Thread Kornitz, David
First Question: I know this issue has been discussed in the past, but I would like to make sure I understand the discussions: 1. We are contemplating revising the scoring to a 100 point scale 2. I assume that when the conversion is made that initially you select the value for 100

Re: [Declude.JunkMail] 100 Point scale / DNS

2004-09-28 Thread Matt
David, There is a problem with Win2003 DNS and some firewalls due to packet size or something like that. I forget exactly what the issue is, but there is a modification that should be made to your system if in fact you are getting a lot of time-outs. Hopefully one of those affected will chime

RE: [Declude.JunkMail] 100 Point scale / DNS

2004-09-28 Thread Markus Gufler
If you're happy with the weight settings of your current weighting system (hold on 20 ?) you can simply change to a hold-on-100 system by multipling all wheigts in your cfg file by factor 5 and change your WEIGHT20 test to WEIGHT100 Then save the cfg file and it's done. Beside more

Re: [Declude.JunkMail] 100 Point scale / DNS

2004-09-28 Thread Dan Geiser
David, I migrated our Declude JunkMail setup to a 100 point system awhile back. With our current setup as it is today we HOLD on 100 and DELETE on 300. When I first migrated over the way that I did it was I set my HOLD weight to 100 and had no DELETE weight and then I assigned arbitrary

[Declude.JunkMail] E-Mail to download v1.8

2004-09-28 Thread Jeff Maze
Hello, Just wanted to know if there's a place to download the latest .cfg files to handle the v1.8 additions. Or even an updated declude manual? Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the

RE: [Declude.JunkMail] E-Mail to download v1.8

2004-09-28 Thread Keith Johnson
Jeff, I was able to get it via my account login at www.declude.com. Keith -Original Message- From: [EMAIL PROTECTED] on behalf of Jeff Maze Sent: Tue 9/28/2004 10:33 AM To: [EMAIL PROTECTED] Cc: Subject: [Declude.JunkMail]

Re: [Declude.JunkMail] E-Mail to download v1.8

2004-09-28 Thread Nick Hayer
On 28 Sep 2004 at 10:33, Jeff Maze wrote: Hi Jeff, Hello, Just wanted to know if there's a place to download the latest .cfg files to handle the v1.8 additions. Or even an updated declude manual? http://www.declude.com/Articles.asp?ID=116 -Nick Thanks.. --- [This E-mail was

RE: [Declude.JunkMail] E-Mail to download v1.8

2004-09-28 Thread Jeff Maze
Really? I don't see it.. I see the manual and automatic downloads for it, and the other links take me other places.. What am I missing? Think it may just be a blonde moment.. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Tuesday, September 28,

RE: [Declude.JunkMail] E-Mail to download v1.8

2004-09-28 Thread Chuck Schick
Keith Where did you find the manual or the cfg files? I can find the download but not the link to the manual. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: Keith Johnson [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Tuesday, September

RE: [Declude.JunkMail] 100 Point scale / DNS

2004-09-28 Thread David
David, Here is the DNS workaround for win2003 servers. Basically win2003 increased the packet size to larger than 512k when performing a DNS query. This is a default setting in win2003. The problem is many firewalls still dont allow packets larger than 512k. Here is a link to a

RE: [Declude.JunkMail] E-Mail to download v1.8

2004-09-28 Thread Andy Ognenoff
Really? I don't see it.. I see the manual and automatic downloads for it, and the other links take me other places.. What am I missing? The cfg files, eml templates, and manuals are included in the zipped up version. - Andy --- [This E-mail was scanned for viruses by Declude Virus

[Declude.JunkMail] HiJack

2004-09-28 Thread Richard Farris
Now that I have HiJack, I found out yesterday when sending a mass email to all my customers that they were held...how do I take myself out of HiJack...just turn it off while I send out messages or is there another way.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech

Re: [Declude.JunkMail] HiJack

2004-09-28 Thread Nick Hayer
On 28 Sep 2004 at 11:44, Richard Farris wrote: Hi Richard, You need to whitelist your ip, regretfully there is no way to config by domain - -Nick Now that I have HiJack, I found out yesterday when sending a mass email to all my customers that they were held...how do I take myself out of

RE: [Declude.JunkMail] HiJack

2004-09-28 Thread Mike Wiegers
In the hijack.cfg file add: # An ALLOWIP line will let an IP address send unlimited E-mail. ALLOWIP x.x.x.x -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Tuesday, September 28, 2004 11:45 AM To: [EMAIL PROTECTED] Subject:

Re: [Declude.JunkMail] X-Declude-Sender missing IP

2004-09-28 Thread R. Scott Perry
With the latest beta I am seeing messages where the X-Declude-Sender is missing the IP address, i.e., [0.0.0.0]. Ones I've seen are from my internal network. Are you using HOP or IPBYPASS? Could you post all the Received: headers for one of these?

Re: [Declude.JunkMail] HiJack

2004-09-28 Thread Glenn \\ WCNet
The current version of HiJack supports 'whitelisting' by sending address in hijack.cfg. ALLOWADDR [EMAIL PROTECTED] - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 28, 2004 11:57 AM Subject: RE: [Declude.JunkMail] HiJack In

Re: [Declude.JunkMail] HiJack

2004-09-28 Thread Nick Hayer
Scott - wow. Now when did that occur? I see no reference of this anywhere. Are there any other switches? Thanks -Nick Hayer On 28 Sep 2004 at 14:37, Glenn \ WCNet wrote: The current version of HiJack supports 'whitelisting' by sending address in hijack.cfg. ALLOWADDR [EMAIL

[Declude.JunkMail] SPF

2004-09-28 Thread Karl Hentschel
I was hoping someone could help me with SPF settings. Currently any domain that has an unknown SPF, is not supported or does not exist has -3 (same as SPF pass) applied to the overall total. I found the log file spf.none that has these domains listed. How do I get 0 points applied if a domain is

Re: [Declude.JunkMail] Version 1.80 Logfile Changes

2004-09-28 Thread R. Scott Perry
We installed Declude JunkMail Version 1.80 and immediately observed that the logfile format and behavior have changed. Correct. By design, all the Msg failed... lines were taken out of LOGLEVEL LOW, and moved to LOGLEVEL HIGH. To prevent a loss of important information, a new log file entry

Re: [Declude.JunkMail] SPF

2004-09-28 Thread R. Scott Perry
I was hoping someone could help me with SPF settings. Currently any domain that has an unknown SPF, is not supported or does not exist has -3 (same as SPF pass) applied to the overall total. spfpass spf pass x 0 -3 spffail spf fail x 0 -3 With these settings, any E-mail that does not pass and/or

Re: [Declude.JunkMail] Version 1.80 Logfile Changes

2004-09-28 Thread Elise Lewis
At 9/28/2004 03:58 PM, you wrote: LOG_OK NONE does not seem to be working. Even messages which fail no tests are included in the log files. Details? Are you seeing the Message OK lines? Typical log entries: 09/28/2004 15:59:07 Qc28b026d0172aa34 L1 Message OK 09/28/2004 15:59:07

[Declude.JunkMail] DNS Puzzler

2004-09-28 Thread Dave Doherty
Hi, I have one for you DNS experts out there. We host DNS for a client that runs his own mail server, and we have received delegation from ATT for his IP block. I can see nothing wrong in our setup, yet some places can see the PTR record for his mail server's IP address, and some

Re: [Declude.JunkMail] HiJack

2004-09-28 Thread Nick Hayer
On 28 Sep 2004 at 16:15, R. Scott Perry wrote: That was added to v1.69, per http://www.declude.com/relnotes.htm . Thanks. It may make a nice addition to the manual as well. :) -Nick -Scott --- Declude JunkMail: The advanced anti-spam solution for

[Declude.JunkMail] New Bagle W32/Bagle.az@MM

2004-09-28 Thread Todd - Smart Mail
We just started getting hit with this new Bagle.az. Anyone else seeing it? McAfee has defs but Symantec doesnt yet. Just started getting calls within the last hour. Todd Hunter Smart Mail.

[Declude.JunkMail] Declude 1.80 and e-mail notifications

2004-09-28 Thread Kaj Søndergaard Laursen
Hi Just upgraded to 1.80, and checked the configuration. Everything seems to be working except that I noticed that I got no notifications of the test Eicar-virus e-mails I sent to myself after upgrading. Just sent Eicarplain base 64 MIME enocoded mails from

RE: [Declude.JunkMail] Declude 1.80 and e-mail notifications

2004-09-28 Thread Kaj Søndergaard Laursen
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Thanks for pointing that out -- it should be fixed now. The format used for the forging virus lookups was changed, and we had to also make a change on our end to reflect that

RE: [Declude.JunkMail] New Bagle W32/Bagle.az@MM

2004-09-28 Thread Colbeck, Andrew
Title: Message Trend calls it something else and claims that it is 13 hours old. We haven't seen any copies yet. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.AM Andrew 8) -Original Message-From: Don Hickey [mailto:[EMAIL PROTECTED] Sent:

[Declude.JunkMail] SPF Envelope Rewriting

2004-09-28 Thread A. Clausen
We've implemented SPF for all the domains we do mail hosting for, and have enabled SPF checking on Declude. Only one thing remains, and that is the issue of message envelopes. The big thing that busts SPF is a message forwarding, and the only way around this is to rewrite the envelope. I know

Re: [Declude.JunkMail] SPF Envelope Rewriting

2004-09-28 Thread R. Scott Perry
We've implemented SPF for all the domains we do mail hosting for, and have enabled SPF checking on Declude. Only one thing remains, and that is the issue of message envelopes. The big thing that busts SPF is a message forwarding, and the only way around this is to rewrite the envelope. This is

Re: [Declude.JunkMail] DNS Puzzler

2004-09-28 Thread Dave Doherty
Hey Scott- So I changed it to 99.96/28IN PTR mail.crofuttsmith.com And now it works. Can you explain why? -Dave - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 28, 2004 4:42 PM Subject: Re: [Declude.JunkMail] DNS Puzzler I

Re: [Declude.JunkMail] Version 1.80 Logfile Changes

2004-09-28 Thread Elise Lewis
Yes. My global.cfg (which I sent to you in a separate email) contains the lines LOG_OK NONE LOGLEVEL MID --Elise At 9/28/04 04:48 PM, you wrote: Details? Are you seeing the Message OK lines? Typical log entries: 09/28/2004 15:59:07 Qc28b026d0172aa34 L1 Message OK Is this with LOG_OK NONE?

Re: [Declude.JunkMail] DNS Puzzler

2004-09-28 Thread R. Scott Perry
http://www.dnsstuff.com/tools/ptr.ch?ip=12.20.208.99 shows that ATT is delegating the reverse DNS for 12.20.208.99 to dns.skywaves.net, using the hostname 99.96/28.208.20.12.in-addr.arpa. But dns.skywaves.net doesn't have a PTR record for 99.96/28.208.20.12.in-addr.arpa. So I changed it to

Re: [Declude.JunkMail] DNS Puzzler

2004-09-28 Thread Dave Doherty
Ok, thanks. -d - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 28, 2004 7:26 PM Subject: Re: [Declude.JunkMail] DNS Puzzler http://www.dnsstuff.com/tools/ptr.ch?ip=12.20.208.99 shows that ATT is delegating the reverse DNS for

[Declude.JunkMail] suggestions on handling a problem

2004-09-28 Thread David Dodell
I have a alias on my Imail server running declude 1.80 junkmail pro. That alias [EMAIL PROTECTED] forwards to another box running my lyris mail list software. To prevent people from being bounced due to spam filtering, I have a whitelist domain for the actual lyris box ie [EMAIL PROTECTED] is

Re: [Declude.JunkMail] suggestions on handling a problem

2004-09-28 Thread Matt
Set up your IMail/Declude server as a gateway for the Lyris box so that all E-mail sent to it is spam blocked prior to being delivered by Lyris and then whitelist the IP of the Lyris box. You can then also blacklist anything that has the Lyris domain name since the whitelist IP overrides the

[Declude.JunkMail] Disable Declude Updater

2004-09-28 Thread Markus Gufler
Everyone running Declude Updater as a scheduled task, can disable it as new versions are not more published on www.declude.com/version.txt and it looks like future releases wouldn't be available as simple .exe file. regards Markus --- [This E-mail was scanned for viruses by Declude Virus