[Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread David Barker
You have to use CIDR range as the example you provided: 

WHITELIST   IP  198.107.21.0/24

However remember that users who authenticate with the server are automatically 
whitelisted.

David B 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 11:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
I added the VPN Server ipaddress as well as my current VPN Address to the 
global.cfg whitelist section, but it did not help the problem.  Declude 
immediately grabs any message that I send except for a reply to someone else's 
email and dumps it into the spam folder.



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
Hi David...

I applied the CIDR address range to the global.cfg WHITELIST, but emails sent 
via VPN are still getting filtered into the SPAM folder.  I am still scratching 
my head on this one...so far nothing has affected this problem.

Jon Lucas
Poly-Cast, Inc.
503-648-5357 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 8:46 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


You have to use CIDR range as the example you provided: 

WHITELIST   IP  198.107.21.0/24

However remember that users who authenticate with the server are automatically 
whitelisted.

David B 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 11:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



FW: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
 
Hi David...

I applied the CIDR address range to the global.cfg WHITELIST, but emails sent 
via VPN are still getting filtered into the SPAM folder.  I am still scratching 
my head on this one...so far nothing has affected this problem.

Jon Lucas
Poly-Cast, Inc.
503-648-5357 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 8:46 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


You have to use CIDR range as the example you provided: 

WHITELIST   IP  198.107.21.0/24

However remember that users who authenticate with the server are automatically 
whitelisted.

David B 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 11:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]



---
[This E-mail scanned for viruses by Declude Virus]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread David Barker
Set you LOGLEVEL to DEBUG in your global.cfg then track a message using the 
spool number and see if the whitelisting is taking place. Also does the header 
of the email show whitelisted?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 12:17 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

Hi David...

I applied the CIDR address range to the global.cfg WHITELIST, but emails sent 
via VPN are still getting filtered into the SPAM folder.  I am still scratching 
my head on this one...so far nothing has affected this problem.

Jon Lucas
Poly-Cast, Inc.
503-648-5357 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 8:46 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


You have to use CIDR range as the example you provided: 

WHITELIST   IP  198.107.21.0/24

However remember that users who authenticate with the server are automatically 
whitelisted.

David B 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 11:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



AW: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Hirthe, Alexander
WHITELIST IP192.107.21.0/24


Or the long answer:
http://support.declude.com/Customer/KBArticle.aspx?articleid=41


 -Ursprüngliche Nachricht-
 Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von
 Jon Lucas
 Gesendet: Donnerstag, 3. April 2008 17:33
 An: declude.junkmail@declude.com
 Betreff: RE: [Declude.JunkMail] Spoofed names

 I found out that the problem in part is due to users using VPN, and the
 internal addresses are not whitelisted.  In the Global.cfg file, can
 you whitelist a range of ipaddresses, such as 198.107.21.1 -
 198.107.21.255?

 -Original Message-
 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
 Lucas
 Sent: Thursday, April 03, 2008 8:07 AM
 To: declude.junkmail@declude.com
 Subject: [Declude.JunkMail] Spoofed names



 What is the best way to block spoofed names?  We are getting a lot of
 spoofed emails in our IMail queue that just linger there like
 bipweks@domain name.com.  I tried blacklisting the name, but it
 appears that Declude then filters out all domain name emails.  I then
 went to the spam folder, and put all of the NAMES in ANYWHERE, but
 that did not stop the emails from getting hung in the queue...We are
 running Declude 4.3.46.



 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.

 ---
 [This E-mail scanned for viruses by Declude Virus]





 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.






Siller AG, Wannenaeckerstrasse 43, 74078 Heilbronn
Vorstand: Prof. H.-F. Siller (Vorsitzender), Joern Buelow, Ralf Michi
Aufsichtsratsvorsitzender: Armin Sohler
Reg. Gericht Stuttgart, HRB 107707, Ust-Id Nr. DE145782955


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
I found that if I whitelist each VPN user, then we can successfully send email 
via a VPN connection, so we at least have a viable fix for the problem.  I 
believe that the key is that being authenticated on the VPN server does not 
necessarily mean that the user is authenticated on the mail server.  However, 
even after being authenticated to a server resource still did not allow email 
to send messages without getting filtered out.

At least it is working now.

Jon Lucas
Poly-Cast, Inc.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 8:46 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


You have to use CIDR range as the example you provided: 

WHITELIST   IP  198.107.21.0/24

However remember that users who authenticate with the server are automatically 
whitelisted.

David B 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 11:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
We are through Outlook where we configure our email server requires 
authentication and the password is input there...I just don't know why that is 
getting missed by the email system...

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 9:10 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


Are you authenticating with your mail server?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas
Sent: Thursday, April 03, 2008 12:00 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names

I added the VPN Server ipaddress as well as my current VPN Address to the 
global.cfg whitelist section, but it did not help the problem.  Declude 
immediately grabs any message that I send except for a reply to someone else's 
email and dumps it into the spam folder.



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spoofed names


I found out that the problem in part is due to users using VPN, and the 
internal addresses are not whitelisted.  In the Global.cfg file, can you 
whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255?

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 8:07 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spoofed names


 
What is the best way to block spoofed names?  We are getting a lot of spoofed 
emails in our IMail queue that just linger there like bipweks@domain 
name.com.  I tried blacklisting the name, but it appears that Declude then 
filters out all domain name emails.  I then went to the spam folder, and put 
all of the NAMES in ANYWHERE, but that did not stop the emails from getting 
hung in the queue...We are running Declude 4.3.46.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail scanned for viruses by Declude Virus]





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Todd Richards
I totally agree with Dan’s email.  Declude has been working great for us, so 
it’s money well spent.  On the other hand, our IMail SA just expired, which 
cost us close to $1000 a year and a half ago, and I was never satisfied to the 
point where I could upgrade.  So that amounted to worthless money spent.  I’m 
pretty comfortable when David says an update is available that it really is 
ready.  The support – esp. Linda – has been fantastic.

 

Our SA with Declude is up in June.  I have every intention of renewing.

 

Todd

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Shadix
Sent: Wednesday, April 02, 2008 1:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

I, for one, like infrequent but solid updates.  I don’t have time to be 
constantly installing and testing updates, especially if they are problematic.  
Also, Declude is the only affordable anti-virus / anti-spam e-mail solution 
that I’ve encountered.  I haven’t really been looking lately but the others 
that I’ve seen were a lot more expensive.

 

Everyone has to choose the product that works for them.  Declude works for me.

 

Dan

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Wednesday, April 02, 2008 11:58 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

Kevin,

 

Every effort has been made to ensure that major releases are problem free, this 
has been the reason for the delay in major releases, however if you notice that 
between major releases we make available several interim releases just as Scott 
had done in the past.

 

Reasons for Service Agreement renewal

 

1.   Unlimited telephone and email support

2.   AVG virus signatures  for 12 months

3.   ZEROHOUR updates for 12 months (After initial activation)

4.   Any release of the software during 12 months

5.   Upgrades and releases of new files like all_list.dat etc.

6.   Access to Declude filter updates

7.   Maintenance of a continued SA is required by our TS which means if 
you lapse you can be charged the extra difference to be brought up to date.

8.   Last but not least a team that is dedicated to it’s customers.

9.   NOWHERE can you get this for the price you pay as a perpetual license 
customer. If you do have an alternative that can compare feel free to post it.

 

As for the ZEROHOUR the way it was implemented was different to the other tests 
so it is on our dev list but not with a high priority other items that come 
before it are things like integration with the new message sniffer dll in 
development. A new test being evaluated called FST. Compatibility with SM 5.x – 
Compatibility with IMAIL 10.x etc etc.

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Wednesday, April 02, 2008 1:14 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Reasons to renew

 

After seeing Matt’s post here about not renewing his JunkMail subscription. I’m 
asking Declude to respond to the group as to why any of us with perpetual 
licensing. Our SA expires soon and I would like to know the value of renewing.

 

The updates to Declude have been extremely slow and in some cases painful since 
Scott sold out.

 

Any idea when ZEROHOUR will be available for use in %TESTSFAILED%

 

 

Kevin Bilbee
Network Administrator
Standard Abrasives

3M Simi Valley
[EMAIL PROTECTED]

 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Linda Pagillo
Thank you Todd. It's my pleasure!

If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext.2

Linda Pagillo
Technical Support Engineer | Declude

Your Email Security is our business

Direct: 978-225-8436
Office: 978.499.2933 Ext.2
Toll Free: 1-866.332.5833 Ext.2
Fax: 978.334.0700
Email: [EMAIL PROTECTED]
  - Original Message - 
  From: Todd Richards 
  To: declude.junkmail@declude.com 
  Sent: Thursday, April 03, 2008 11:06 AM
  Subject: RE: [Declude.JunkMail] Reasons to renew


  I totally agree with Dan’s email.  Declude has been working great for us, so 
it’s money well spent.  On the other hand, our IMail SA just expired, which 
cost us close to $1000 a year and a half ago, and I was never satisfied to the 
point where I could upgrade.  So that amounted to worthless money spent.  I’m 
pretty comfortable when David says an update is available that it really is 
ready.  The support – esp. Linda – has been fantastic.

   

  Our SA with Declude is up in June.  I have every intention of renewing.

   

  Todd

   

   

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Shadix
  Sent: Wednesday, April 02, 2008 1:50 PM
  To: declude.junkmail@declude.com
  Subject: RE: [Declude.JunkMail] Reasons to renew

   

  I, for one, like infrequent but solid updates.  I don’t have time to be 
constantly installing and testing updates, especially if they are problematic.  
Also, Declude is the only affordable anti-virus / anti-spam e-mail solution 
that I’ve encountered.  I haven’t really been looking lately but the others 
that I’ve seen were a lot more expensive.

   

  Everyone has to choose the product that works for them.  Declude works for me.

   

  Dan

   

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
  Sent: Wednesday, April 02, 2008 11:58 AM
  To: declude.junkmail@declude.com
  Subject: RE: [Declude.JunkMail] Reasons to renew

   

  Kevin,

   

  Every effort has been made to ensure that major releases are problem free, 
this has been the reason for the delay in major releases, however if you notice 
that between major releases we make available several interim releases just as 
Scott had done in the past.

   

  Reasons for Service Agreement renewal

   

  1.   Unlimited telephone and email support

  2.   AVG virus signatures  for 12 months

  3.   ZEROHOUR updates for 12 months (After initial activation)

  4.   Any release of the software during 12 months

  5.   Upgrades and releases of new files like all_list.dat etc.

  6.   Access to Declude filter updates

  7.   Maintenance of a continued SA is required by our TS which means if 
you lapse you can be charged the extra difference to be brought up to date.

  8.   Last but not least a team that is dedicated to it’s customers.

  9.   NOWHERE can you get this for the price you pay as a perpetual 
license customer. If you do have an alternative that can compare feel free to 
post it.

   

  As for the ZEROHOUR the way it was implemented was different to the other 
tests so it is on our dev list but not with a high priority other items that 
come before it are things like integration with the new message sniffer dll in 
development. A new test being evaluated called FST. Compatibility with SM 5.x – 
Compatibility with IMAIL 10.x etc etc.

   

  David Barker
  VP Operations Declude
  Your Email security is our business
  978.499.2933 x 7007 office
  978.988.1311 fax
  [EMAIL PROTECTED]

   

  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
  Sent: Wednesday, April 02, 2008 1:14 PM
  To: declude.junkmail@declude.com
  Subject: [Declude.JunkMail] Reasons to renew

   

  After seeing Matt’s post here about not renewing his JunkMail subscription. 
I’m asking Declude to respond to the group as to why any of us with perpetual 
licensing. Our SA expires soon and I would like to know the value of renewing.

   

  The updates to Declude have been extremely slow and in some cases painful 
since Scott sold out.

   

  Any idea when ZEROHOUR will be available for use in %TESTSFAILED%

   

   

  Kevin Bilbee
  Network Administrator
  Standard Abrasives

  3M Simi Valley
  [EMAIL PROTECTED]

   


  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.JunkMail. The archives can be found
  at http://www.mail-archive.com. 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Jim Comerford
Over the last several weeks we have seen a dramatic increase in spam hitting
our server.  From about 70,000 mails a day to around 110,000 /day.
 
Most destined for our users is getting properly filtered by declude.
 
What is getting thru is backscatter from spam that is forging addresses from
domains we host.  It seems just about any address that is posted on a
website seems to be being used to forge outgoing spam (not from our server)
-- and is generating all sorts of bounce messages.
 
I suspect there is not much I can do to block this backscatter without
blocking legit bounce messages... but I thought I'd ask.
 
Here is our config:
Imail 8.22
Declude 4.3.64
invURIBL 3.1.1
Sniffer


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Darrell ([EMAIL PROTECTED])

Jim,

While others may cringe regarding this, but some of the backscatter I 
have had to deal with (excess of 500-1000 messages a minute at times) I 
have had to put filters in place to delete null senders for periods of time.


Darrell

Jim Comerford wrote:
Over the last several weeks we have seen a dramatic increase in spam 
hitting our server.  From about 70,000 mails a day to around 110,000 /day.
 
Most destined for our users is getting properly filtered by declude.
 
What is getting thru is backscatter from spam that is forging addresses 
from domains we host.  It seems just about any address that is posted on 
a website seems to be being used to forge outgoing spam (not from our 
server) -- and is generating all sorts of bounce messages.
 
I suspect there is not much I can do to block this backscatter without 
blocking legit bounce messages... but I thought I'd ask.
 
Here is our config:

Imail 8.22
Declude 4.3.64
invURIBL 3.1.1
Sniffer

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.


--
--
Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Craig Edmonds
I have been having exactly the same problem on both mail servers.

 

Both are.

 

Imail 8.15

Declude 4.3.64

 invURIBL 3.1.1

 Sniffer

 

Kindest Regards
Craig Edmonds
123 Marbella Internet
W: www.123marbella.net
 

LEGAL DISCLAIMER - This message may contain confidential, proprietary or
legally privileged information and is intended only for the use of the
addressee named above. If you are not the intended recipient of this message
you are hereby informed that you must not use, disseminate, copy it in any
form or take any action in reliance on it. If you have received this message
in error please delete it and any copies of it and notify it to the sender. 

 

AVISO LEGAL - Este mensaje puede contener informacion confidencial, en
propiedad o legalmente protegida y esta dirigida unicamente para el uso de
la persona destinataria. Si usted no es la persona destinataria de este
mensaje, por la presente se le comunica que no debe usar, difundir, copiar
de ninguna forma, ni emprender ninguna accion en relacion con ella.

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim
Comerford
Sent: 03 April 2008 20:46
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Forged-Spam Backscatter

 

Over the last several weeks we have seen a dramatic increase in spam hitting
our server.  From about 70,000 mails a day to around 110,000 /day.

 

Most destined for our users is getting properly filtered by declude.

 

What is getting thru is backscatter from spam that is forging addresses from
domains we host.  It seems just about any address that is posted on a
website seems to be being used to forge outgoing spam (not from our server)
-- and is generating all sorts of bounce messages.

 

I suspect there is not much I can do to block this backscatter without
blocking legit bounce messages... but I thought I'd ask.

 

Here is our config:

Imail 8.22

Declude 4.3.64

invURIBL 3.1.1

Sniffer


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread David Barker
We use 2 filters to address the issue which work well for us. I will make
them available on our website this week.

David  B

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim
Comerford
Sent: Thursday, April 03, 2008 2:46 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Forged-Spam Backscatter

 

Over the last several weeks we have seen a dramatic increase in spam hitting
our server.  From about 70,000 mails a day to around 110,000 /day.

 

Most destined for our users is getting properly filtered by declude.

 

What is getting thru is backscatter from spam that is forging addresses from
domains we host.  It seems just about any address that is posted on a
website seems to be being used to forge outgoing spam (not from our server)
-- and is generating all sorts of bounce messages.

 

I suspect there is not much I can do to block this backscatter without
blocking legit bounce messages... but I thought I'd ask.

 

Here is our config:

Imail 8.22

Declude 4.3.64

invURIBL 3.1.1

Sniffer


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Exclude a single user from a banned file rule

2008-04-03 Thread Goran Jovanovic
Hi,

Is it possible to BANEXT EXE for everyone except for one user? The user in 
question would be allowed to receive all the .exe files they can handle?

Let me know please

Thanks

Goran Jovanovic
Omega Network Solutions


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Herb Guenther
Same here, we normally run 100 or so messages a min @ 70% spam, now 
seeing peaks of 400-500 @ 97%  Seems much worse in the last 2 weeks or 
so.  I think that we all have lots of company.


Herb

Darrell ([EMAIL PROTECTED]) wrote:

Jim,

While others may cringe regarding this, but some of the backscatter I 
have had to deal with (excess of 500-1000 messages a minute at times) 
I have had to put filters in place to delete null senders for periods 
of time.


Darrell

Jim Comerford wrote:
Over the last several weeks we have seen a dramatic increase in spam 
hitting our server.  From about 70,000 mails a day to around 110,000 
/day.
 
Most destined for our users is getting properly filtered by declude.
 
What is getting thru is backscatter from spam that is forging 
addresses from domains we host.  It seems just about any address that 
is posted on a website seems to be being used to forge outgoing spam 
(not from our server) -- and is generating all sorts of bounce messages.
 
I suspect there is not much I can do to block this backscatter 
without blocking legit bounce messages... but I thought I'd ask.
 
Here is our config:

Imail 8.22
Declude 4.3.64
invURIBL 3.1.1
Sniffer

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.




--
Herb Guenther
Lanex, LLC
www.lanex.com
(262)789-0966x102 Office
(262)780-0424 Cell (off hours or if out of office)


This e-mail is confidential and is for the use of the intended 
recipient(s)only. If you are not an intended recipient please advise us of our 
error by return e-mail then delete this e-mail and any attached files. You may 
not copy, disclose or use the contents in any way.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Todd Richards
Jim -

 

I'm running the exact same set up as you are.  We had the same problem about
two weeks ago.  I don't know if this made much difference or not, but I
noticed the domains that we were seeing this with did not have any SPF
records in place.  So when I saw this sudden increase come through, I added
a strict SPF policy for that domain.  The backscatter for that domain all
but stopped.  A few days later, a different domain was targeted - without an
SPF record - and adding one seemed to cure that.  This happened a few more
times, with the results all the same.

 

I'm not at an expert level to say whether this did or did not do the trick.
Perhaps it was just coincidental.  All the new domains that are set up and
running services through us get strict SPF records put in place from the
start.  However, the older domains that have been around for a while - that
didn't have SPF in place - were the ones that seemed to have had the
problem.  And since then, we haven't had any more problems with that.

 

I can't say for sure that them having their email addresses on their
websites was the problem for sure or not.  For what it's worth, my new
policy is to not put email addresses on public websites.

 

Anyway, just thought I would throw that out there.  

 

Todd

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim
Comerford
Sent: Thursday, April 03, 2008 1:46 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Forged-Spam Backscatter

 

Over the last several weeks we have seen a dramatic increase in spam hitting
our server.  From about 70,000 mails a day to around 110,000 /day.

 

Most destined for our users is getting properly filtered by declude.

 

What is getting thru is backscatter from spam that is forging addresses from
domains we host.  It seems just about any address that is posted on a
website seems to be being used to forge outgoing spam (not from our server)
-- and is generating all sorts of bounce messages.

 

I suspect there is not much I can do to block this backscatter without
blocking legit bounce messages... but I thought I'd ask.

 

Here is our config:

Imail 8.22

Declude 4.3.64

invURIBL 3.1.1

Sniffer


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Jon Lucas
Will the filter keep spoofed email senders from getting into the queue
manager in IMail?  the format I am seeing is like
bipweks@domain-name.com .  The biggest problem I see is the server keeps
re-trying to send the email, but bipweks account does not exist in our email
system, so I would like to keep them from getting into the queue manager.
  -Original Message-
  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
  Sent: Thursday, April 03, 2008 12:25 PM
  To: declude.junkmail@declude.com
  Subject: RE: [Declude.JunkMail] Forged-Spam Backscatter


  We use 2 filters to address the issue which work well for us. I will make
them available on our website this week.

  David  B



  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim
Comerford
  Sent: Thursday, April 03, 2008 2:46 PM
  To: declude.junkmail@declude.com
  Subject: [Declude.JunkMail] Forged-Spam Backscatter



  Over the last several weeks we have seen a dramatic increase in spam
hitting our server.  From about 70,000 mails a day to around 110,000 /day.



  Most destined for our users is getting properly filtered by declude.



  What is getting thru is backscatter from spam that is forging addresses
from domains we host.  It seems just about any address that is posted on a
website seems to be being used to forge outgoing spam (not from our
server) -- and is generating all sorts of bounce messages.



  I suspect there is not much I can do to block this backscatter without
blocking legit bounce messages... but I thought I'd ask.



  Here is our config:

  Imail 8.22

  Declude 4.3.64

  invURIBL 3.1.1

  Sniffer


  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.JunkMail. The archives can be found
  at http://www.mail-archive.com.


  ---
  This E-mail came from the Declude.JunkMail mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
  type unsubscribe Declude.JunkMail. The archives can be found
  at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread David Barker
The filter deals with Backscatter. Jon is the issue you are talking about is
your mail server bouncing messages?

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon
Lucas
Sent: Thursday, April 03, 2008 3:59 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Forged-Spam Backscatter

 

Will the filter keep spoofed email senders from getting into the queue
manager in IMail?  the format I am seeing is like 

bipweks@ mailto:[EMAIL PROTECTED] domain-name.com .  The biggest
problem I see is the server keeps re-trying to send the email, but bipweks
account does not exist in our email system, so I would like to keep them
from getting into the queue manager.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Forged-Spam Backscatter

We use 2 filters to address the issue which work well for us. I will make
them available on our website this week.

David  B

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim
Comerford
Sent: Thursday, April 03, 2008 2:46 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Forged-Spam Backscatter

 

Over the last several weeks we have seen a dramatic increase in spam hitting
our server.  From about 70,000 mails a day to around 110,000 /day.

 

Most destined for our users is getting properly filtered by declude.

 

What is getting thru is backscatter from spam that is forging addresses from
domains we host.  It seems just about any address that is posted on a
website seems to be being used to forge outgoing spam (not from our server)
-- and is generating all sorts of bounce messages.

 

I suspect there is not much I can do to block this backscatter without
blocking legit bounce messages... but I thought I'd ask.

 

Here is our config:

Imail 8.22

Declude 4.3.64

invURIBL 3.1.1

Sniffer


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Stephan Chayer
Dan, Todd, 
 
I feel a little like you.
 
We are using, selling and supporting Declude for the past 4 years.  It works
great for us.  Especially since they brought up version 4 including
Commtouch and AVG, that was a nice move.
 
We went through all the product and pricing changes for the past years.  We
were surprised when they conbined all the products but they honoured all the
previous purchases from all our customers.  We deal with other vendors that
would have been much more agressive that Declude in some situations.
 
I believe that Decluce's pricing is fair and attractive for customers, the
product works well and the support is just amazing. 
 
Bottom line, if you do not make money, you can't give support and put
ameliorations in a product.
 
I wish that everyone could continue to do business and make money.
 
Keep the good work
 
Stephan Chayer 
IntraSoft Solutions Inc. 
[EMAIL PROTECTED]
 
  _  

De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Linda
Pagillo
Envoyé : 3 avril, 2008 14:35
À : declude.junkmail@declude.com
Objet : Re: [Declude.JunkMail] Reasons to renew


Thank you Todd. It's my pleasure!
 
If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext.2
 
Linda Pagillo
Technical Support Engineer | Declude
 
Your Email Security is our business
 
Direct: 978-225-8436
Office: 978.499.2933 Ext.2
Toll Free: 1-866.332.5833 Ext.2
Fax: 978.334.0700
Email: [EMAIL PROTECTED]

- Original Message - 
From: Todd Richards mailto:[EMAIL PROTECTED]  
To: declude.junkmail@declude.com 
Sent: Thursday, April 03, 2008 11:06 AM
Subject: RE: [Declude.JunkMail] Reasons to renew


I totally agree with Dan’s email.  Declude has been working great for us, so
it’s money well spent.  On the other hand, our IMail SA just expired, which
cost us close to $1000 a year and a half ago, and I was never satisfied to
the point where I could upgrade.  So that amounted to worthless money spent.
I’m pretty comfortable when David says an update is available that it really
is ready.  The support – esp. Linda – has been fantastic.

 

Our SA with Declude is up in June.  I have every intention of renewing.

 

Todd

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan
Shadix
Sent: Wednesday, April 02, 2008 1:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

I, for one, like infrequent but solid updates.  I don’t have time to be
constantly installing and testing updates, especially if they are
problematic.  Also, Declude is the only affordable anti-virus / anti-spam
e-mail solution that I’ve encountered.  I haven’t really been looking lately
but the others that I’ve seen were a lot more expensive.

 

Everyone has to choose the product that works for them.  Declude works for
me.

 

Dan

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, April 02, 2008 11:58 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

Kevin,

 

Every effort has been made to ensure that major releases are problem free,
this has been the reason for the delay in major releases, however if you
notice that between major releases we make available several interim
releases just as Scott had done in the past.

 

Reasons for Service Agreement renewal

 

1.   Unlimited telephone and email support

2.   AVG virus signatures  for 12 months

3.   ZEROHOUR updates for 12 months (After initial activation)

4.   Any release of the software during 12 months

5.   Upgrades and releases of new files like all_list.dat etc.

6.   Access to Declude filter updates

7.   Maintenance of a continued SA is required by our TS which means if
you lapse you can be charged the extra difference to be brought up to date.

8.   Last but not least a team that is dedicated to it’s customers.

9.   NOWHERE can you get this for the price you pay as a perpetual
license customer. If you do have an alternative that can compare feel free
to post it.

 

As for the ZEROHOUR the way it was implemented was different to the other
tests so it is on our dev list but not with a high priority other items that
come before it are things like integration with the new message sniffer dll
in development. A new test being evaluated called FST. Compatibility with SM
5.x – Compatibility with IMAIL 10.x etc etc.

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin
Bilbee
Sent: Wednesday, April 02, 2008 1:14 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Reasons to renew

 

After seeing Matt’s post here about not renewing his JunkMail subscription.
I’m asking Declude to respond to the group as to why any of us with
perpetual licensing. Our SA expires soon and I would like to 

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Jim Comerford
... but I noticed the domains that we were seeing this with did not have any
SPF records in place.  So when I saw this sudden increase come through, I
added a strict SPF policy for that domain.  The backscatter for that domain
all but stopped.  ... 

 

Good thing to check... the latest domain to get hit did NOT have an SPF
record (and this seems to have been the worst so far)... BUT MOST of the
ones that did get hit - did have an SPF record and we still get backscatter.

 

We typically add SPF on all domains.. but in reviewing we had missed a
couple of them.

 

Hopefully the Filter that David is referring to will help.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Craig Edmonds
I second that.

I am not trying to brown nose or anything here but without declude we would
be completely screwed.

In 3 years with declude I think I have only had to email them once with a
support query and that was answered pretty much within an hour.

Sure, some spam gets through now and again but there have been times where I
have mucked about with the declude config settings and the spam floodgates
opened and boy, my clients noticed the difference and were thanking me the
next day.

I have no problem renewing my subscriptions every year.

 

Kindest Regards
Craig Edmonds
123 Marbella Internet
www.123marbella.net

 

LEGAL DISCLAIMER - This message may contain confidential, proprietary or
legally privileged information and is intended only for the use of the
addressee named above. If you are not the intended recipient of this message
you are hereby informed that you must not use, disseminate, copy it in any
form or take any action in reliance on it. If you have received this message
in error please delete it and any copies of it and notify it to the sender. 

 

AVISO LEGAL - Este mensaje puede contener informacion confidencial, en
propiedad o legalmente protegida y esta dirigida unicamente para el uso de
la persona destinataria. Si usted no es la persona destinataria de este
mensaje, por la presente se le comunica que no debe usar, difundir, copiar
de ninguna forma, ni emprender ninguna accion en relacion con ella.

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephan
Chayer
Sent: 03 April 2008 22:21
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

Dan, Todd, 

 

I feel a little like you.

 

We are using, selling and supporting Declude for the past 4 years.  It works
great for us.  Especially since they brought up version 4 including
Commtouch and AVG, that was a nice move.

 

We went through all the product and pricing changes for the past years.  We
were surprised when they conbined all the products but they honoured all the
previous purchases from all our customers.  We deal with other vendors that
would have been much more agressive that Declude in some situations.

 

I believe that Decluce's pricing is fair and attractive for customers, the
product works well and the support is just amazing. 

 

Bottom line, if you do not make money, you can't give support and put
ameliorations in a product.

 

I wish that everyone could continue to do business and make money.

 

Keep the good work

 

Stephan Chayer 
IntraSoft Solutions Inc. 
[EMAIL PROTECTED]

 

  _  

De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Linda
Pagillo
Envoyé : 3 avril, 2008 14:35
À : declude.junkmail@declude.com
Objet : Re: [Declude.JunkMail] Reasons to renew

Thank you Todd. It's my pleasure!

 

If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext.2

 

Linda Pagillo
Technical Support Engineer | Declude

 

Your Email Security is our business

 

Direct: 978-225-8436
Office: 978.499.2933 Ext.2
Toll Free: 1-866.332.5833 Ext.2
Fax: 978.334.0700
Email: [EMAIL PROTECTED]

- Original Message - 

From: Todd Richards mailto:[EMAIL PROTECTED]  

To: declude.junkmail@declude.com 

Sent: Thursday, April 03, 2008 11:06 AM

Subject: RE: [Declude.JunkMail] Reasons to renew

 

I totally agree with Dan’s email.  Declude has been working great for us, so
it’s money well spent.  On the other hand, our IMail SA just expired, which
cost us close to $1000 a year and a half ago, and I was never satisfied to
the point where I could upgrade.  So that amounted to worthless money spent.
I’m pretty comfortable when David says an update is available that it really
is ready.  The support – esp. Linda – has been fantastic.

 

Our SA with Declude is up in June.  I have every intention of renewing.

 

Todd

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan
Shadix
Sent: Wednesday, April 02, 2008 1:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

I, for one, like infrequent but solid updates.  I don’t have time to be
constantly installing and testing updates, especially if they are
problematic.  Also, Declude is the only affordable anti-virus / anti-spam
e-mail solution that I’ve encountered.  I haven’t really been looking lately
but the others that I’ve seen were a lot more expensive.

 

Everyone has to choose the product that works for them.  Declude works for
me.

 

Dan

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, April 02, 2008 11:58 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Reasons to renew

 

Kevin,

 

Every effort has been made to ensure that major releases are problem free,
this has been the reason for the delay in major releases, however if you
notice that between major releases we make available several interim
releases just as Scott had done 

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Colbeck, Andrew
Symantec says that backscatter-as-deliberate-spam-technique is back in
vogue. See their April State of Spam Report
 
http://www.symantec.com/enterprise/security_response/weblog/2008/04/post
_8.html
 
 
Andrew.
 
 




From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Todd Richards
Sent: Thursday, April 03, 2008 12:43 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Forged-Spam Backscatter



Jim -

 

I'm running the exact same set up as you are.  We had the same
problem about two weeks ago.  I don't know if this made much difference
or not, but I noticed the domains that we were seeing this with did not
have any SPF records in place.  So when I saw this sudden increase come
through, I added a strict SPF policy for that domain.  The backscatter
for that domain all but stopped.  A few days later, a different domain
was targeted - without an SPF record - and adding one seemed to cure
that.  This happened a few more times, with the results all the same.

 

I'm not at an expert level to say whether this did or did not do
the trick.  Perhaps it was just coincidental.  All the new domains that
are set up and running services through us get strict SPF records put in
place from the start.  However, the older domains that have been around
for a while - that didn't have SPF in place - were the ones that seemed
to have had the problem.  And since then, we haven't had any more
problems with that.

 

I can't say for sure that them having their email addresses on
their websites was the problem for sure or not.  For what it's worth, my
new policy is to not put email addresses on public websites.

 

Anyway, just thought I would throw that out there.  

 

Todd

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Jim Comerford
Sent: Thursday, April 03, 2008 1:46 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Forged-Spam Backscatter

 

Over the last several weeks we have seen a dramatic increase in
spam hitting our server.  From about 70,000 mails a day to around
110,000 /day.

 

Most destined for our users is getting properly filtered by
declude.

 

What is getting thru is backscatter from spam that is forging
addresses from domains we host.  It seems just about any address that is
posted on a website seems to be being used to forge outgoing spam (not
from our server) -- and is generating all sorts of bounce messages.

 

I suspect there is not much I can do to block this backscatter
without blocking legit bounce messages... but I thought I'd ask.

 

Here is our config:

Imail 8.22

Declude 4.3.64

invURIBL 3.1.1

Sniffer


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Kevin Rogers
I'm looking for a little help creating SPF records.  I'm trying to use 
the tools at openspf.org.
We only have one server that sends out mail for our domain.  We have a 
secondary server that accepts email sent to our domain if our primary 
server is down (myriadnetwork.com).  After going through the creation 
tool, it generated:


To be put in our zone file:
rogersbenefit.com. IN TXT v=spf1 a mx mx:rogersbenefit.com ~all

To be put in our DNS records:
mail.rogersbenefit.com. IN TXT v=spf1 a -all
mx2.myriadnetwork.com. IN TXT v=spf1 a -all

We host our DNS records at Network Solutions.  If anyone else uses 
NetSol for the DNS records, how do we go about adding these lines to our 
DNS records?  And also, is it recommended to use the all modifier or not?


Kevin


Jim Comerford wrote:


... but I noticed the domains that we were seeing this with did not 
have any SPF records in place.  So when I saw this sudden increase 
come through, I added a strict SPF policy for that domain.  The 
backscatter for that domain all but stopped.  ... 

 

Good thing to check... the latest domain to get hit did NOT have an 
SPF record (and this seems to have been the worst so far)... BUT MOST 
of the ones that did get hit - did have an SPF record and we still get 
backscatter.


 

We typically add SPF on all domains.. but in reviewing we had missed a 
couple of them.


 


Hopefully the Filter that David is referring to will help.


---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.