We are noticing a large amount of email, approx 20-30%, are not being
processed by Declude.
Here is a typical header:
Received: from friend [68.57.43.190] by mail.nthost.co.uk with ESMTP
(SMTPD-8.20) id A5DA0830; Tue, 25 Apr 2006 06:38:34 +0100
Message-ID: [EMAIL PROTECTED]
From: Henry [EMAIL
not parse
the message, apparently because at most there is only one line in the
message. Don't know if this is your issue, but thought I would point it out
as a possiblity. If that is the case, it was fairly simple to write a test
for it.
Mike
.
- Original Message -
From: David Lewis-Waller
This may be of interest, it even has Declude headers which aren't ours :)
Received: from smtp.wiss.co.uk [213.210.8.50] by mail.nthost.co.uk with
ESMTP
(SMTPD-8.20) id A527139C; Tue, 31 Jan 2006 15:41:27 +
Received: from declude.com ([63.246.13.90]) by smtp.wiss.co.uk with
Microsoft
I would second that. We were blacklisted by SORBS when one of OUR customers
autoresponded to a forged sender, which happended to be a SORBS admin or
tarpit address. We passed the 'fine' of delisting back to the customer as a
salutatory lesson but not before we received many complaints of senders
Karl,
Why delete or bounce? In the scenario that litigation should dictate that
you can't delete or bounce then having to deal with the huge volume of
junkmail is an option that you must live with.
Can I suggest that rather than reap the whirlwind of customer ire you pass
something back to them
This is a small tale of my own incompetence which, I hope, others may learn
from
Our domain had been getting a lot of SPAM email over the Christmas holiday
and I had initially put it down to seasonal ill will but was surprised at
the sheer volume of unmarked email that was getting through.
.
- Original Message -
From: David Lewis-Waller [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, December 05, 2005 3:45 AM
Subject: RE: Re[2]: [Declude.JunkMail] OT Snow
Were just a few miles from Caernarfon. Have to say I wouldn't want to live
elsewhere. Over 100 miles of coastline
in the £.
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: 05 December 2005 15:12
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT Snow
Hi David,
David Lewis-Waller wrote:
If you could put up with
petrol
@declude.com
Subject: Re: Re[2]: [Declude.JunkMail] OT Snow
Ok, I'm drooling... need some onsite assistance with anything... anything
at all... I'll gladly take out the garbage if you want me to... g
Darin.
- Original Message -
From: David Lewis-Waller [EMAIL PROTECTED]
To: Declude.JunkMail
We have a problem with sending email to hotmail.co.uk, it would appears that
any email sent via our mail server to hotmail.co.uk accounts are not
delivered presumably blacklisted. I have contacted hotmail.co.uk but as yet
I have had no response. Has anyone had a similar experince. BTW hotmail.com
people than you get
from the large email houses.
-Dave Doherty
Skywaves, Inc.
- Original Message -
From: David Lewis-Waller [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Thursday, December 01, 2005 8:49 AM
Subject: [Declude.JunkMail] Hotmail.co.uk
We have a problem
I have been tweaking the THREADS value and found that small adjustments can
have quite large effects on CPU usage. I found a value of 15 is a good
compromise when processing 15-20k messages a day on a Xeon 1.4GHz dual
processor box with 1GB RAM. Any higher than 15 and I get 100% CPU for
minutes at
] Declude 3.05
David,
Are you running a dual proc box - you did not say exactly? If you are let
me know and I can help you verify if you are having the same dual proc issue
I see.
Darrell
David Lewis-Waller writes:
I didn't take part in the beta of v3 but upgraded yesterday from 1.8x.
However
Fred,
It's documented in the in declude 3.05 link under myaccount.asp section of
the web site .
All the best,
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: 28 September 2005 05:26
To: Declude.JunkMail@declude.com
Subject:
I didn't take part in the beta of v3 but upgraded yesterday from 1.8x.
However, I do notice a considerable CPU usage penalty some 100% more usage
than in the previous version and commonly long queues in \proc waiting to be
serviced.
I have also seen a couple of emails from users with dual
I'm waiting as well. I emailed Declude who say they will issue a key in due
but I've heard nothing for about a month.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jim
Sent: 25 January 2005 22:28
To: Declude.JunkMail@declude.com
Subject: Re:
This email (part headers) failed the NOABUSE test, yet dnsreport show the
domain as accepting [EMAIL PROTECTED] Any ideas?
David
WiSS Ltd
Disposition-Notification-To: TM Services [EMAIL PROTECTED]
X-RBL-Warning: MTLDB: IP is listed in MTLDB
X-RBL-Warning: NOABUSE: Not supporting [EMAIL
This looks like it's an ongoing, long term issue. DNReports MX connection
problems.
http://www.dnsreport.com/tools/dnsreport.ch?domain=hotmail.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson
Sent: 11 May 2004 20:29
To: [EMAIL
I just received this this from a mail admin of another ISP, Anyone care to
comment...
Your outgoing mail server adds the header:
X-RBL-Warning: SPAM-NONE: Total weight between 0 and 4.
Our filter software scans incomming mesages for a line that starts
X-RBL-Warning:
This is used as an
Not all. I initiated a recent posting on this topic and its fine as long as
the server can handle all requests made of it.
We're running SimpleDNS on our IMail server, others will choose Windows DNS
etc.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
http://news.bbc.co.uk/1/hi/technology/3308989.stm
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.
negative rDNS scores 5. No hold or delete. Subject line maker SPAM-VHIGH @
30+.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of System
Administrator
Sent: 11 December 2003 13:01
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] revdns weight question
I'm
Title: Message
Kami,
I know this sounds
a little primitive but you couldforewarn users at the point when they make
a payment that an automated acknowledgment will be sent but may be blocked if
challenge/response is implemented by their ISP/IT dept.
What happens in
challenge/response when
The answer is going to be obvious and simple but I can't spot it.
I have a filter file:
MAILFROMLISTfilter d:\IMail\declude\mailfrom.txt
x 0 0
That contains the line (mailfrom.txt)
MAILFROM 30 CONTAINS @ideal.co.uk
(I've checked that there isn't a space at
A - I thought the FROM address was the labelled From: not the return
address. Should have sussed that one.
Thanks v.much for pointing this out
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: 24 March 2003 15:01
To: [EMAIL
I recommend SNIFFER. Results will vary depending on your settings but we
rarely get false positives. We don't hold customer emails and we hold
our own email at 30 Sniffer is weighted at 20. If you're holding then
you should always check for false positives anyway so Sniffer in that
respect won't
Title: Message
F-Prot? I recommend it! If you install it to work with Declude ensure
that it doesn't autostart otherwise Declude can't call itbecause it's
already running (you'll see errors in the logs saying this)
"You need to remove
F-Stopw from startup.
You have to do that in the
Chuck,
F-secure isn't F-Prot (not as far as I'm aware anyway)
Windows/ODS pricing details are here
http://www.f-prot.com/products/pricecomwin.html
Note Linux and FreeBSD versions are far more expensive than Windows
versions.
David
WiSS Limited
-Original Message-
From: [EMAIL
I don't pretend to fully understand Declude (others are far more wise
than I). However, I use fairly standard settings with the exception of
using SNIFFER (weight 17) for enhanced spam detection. I weight HOLDs
(for our domain and few others only) at 30+ and have found that I get no
false
Sorry about the off topic topic but seeking advice on the best RAID
configuration for our new twin Xeon processor server, it hast 3x 36GB
drives at present though more can be added and 1GB RAM. It'll be running
Win2k, Imail and Declude AV/JM and currently processing only about 7k
emails a day
Thanks all for the suggestions. Most appreciated.
David
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
The example Scott quoted is a function of IMail rather than Declude.
http://support.ipswitch.com/kb/IM-19980116-JB04.htm KB demonstrates this
well.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Adam Hobach
Sent: 28 January 2003 14:30
To: [EMAIL
http://support.ipswitch.com/kb/IM-20021105-DM01.htm :)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Uhte, Russ
Sent: 28 January 2003 17:26
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] New feature
It should be mentioned that Imail auto
Title: Message
You
could use domlist http://www.declude.com/tools/index.html.
This will analyse your SMTP log file generate by Imail as opposed to those
generated byDeclude.
David
WiSS
Limited
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
On
Title: Message
Gareth,
We
sometimes see Declude using 100% CPU however, this is normal when someone is
sending a lot of mail through the server i.e a large mail shot. It normally
doesn't pose a problem, except mail delivery might be slower than normal until
the queue is cleared. You can
Is it possible to add an X-HEADER that shows the total weight of the
email without using a zero weighted action?
For instance if a WARN action is applied then the total weight range is
shown:
X-RBL-Warning: SPAM-NONE: Total weight between 0 and 4.
If a SUBJECT action is used only test
Scott,
Thanks just the ticket, I couldn't see the wood for the trees.
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: 16 January 2003 13:14
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Total weight as X-header
Is
Create a directory for the domain e.g. a directory called 'mydomain.com'
under the Declude directory. Copy $default$.junkmail into this folder.
You now have domain specific filters. For single users copy
$default$.junkmail to user.name.junkmail and edit accordingly.
e.g.
x:\imail\declude
We use Declude standard weights and add 15 for ones that fail
SortMonster tests. We hold on weights over 30 and I don't think we've
caught legitimate mail from these sources for sometime. Our only real
fine tuning was to negative weight some email domains (below). We don't
use any kill lists at
Jim,
Create a reverse zone in DNS that covers the IP address used in IMail.
i.e. we have
xxx.xxx.xxx.xxx.in-addr.arpa
With entries that cover from xxx-xxx-xxx-0.domain to
xxx-xxx-xxx-255.domain
This ensures that we have a reverse DNS for all possible IPs on that
class C.
David
I'm attempting to set up a system to filter on file extensions per
domain. Delcude Virus can ban per file extension but for per domain. I
can't do it via Imail Web messaging as the customer uses SMTP/ETRN. I've
set up a ATTACHMENT test that looks for:
HEADERS 0 CONTAINS Content-Type:
Jim,
All our domains, some 400, or so share a single IP address - this
shouldn't fail the Reverse DNS test.
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Jim Rooth
Sent: 09 January 2003 18:24
To: [EMAIL PROTECTED]
Subject: RE:
John,
dnstsuff shows that 168.75.225.197 (ip for mail.standardhardware.com)
doesn't have a PTR record. Set one up and you shouldn't fail REVDNS.
http://www.dnsstuff.com/tools/ptr.ch?ip=168.75.225.197
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf
Jim,
Check with your ISP that you have the relevant records for your IP
address range in place
From dnsstuff.com
You could also contact [EMAIL PROTECTED], who is in charge
of the 225.75.168.in-addr.arpa. zone.
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
Sorry about this but am in a bit of a pickle and a panic. A key service
in Win2k has been removed accidently by clicking the remove service ican
(red cross). Does anyone know how to get this service (World Wide Web
Publishing Service) back?
David
---
[This E-mail was scanned for viruses by
Terry,
I was hoping you weren't going to say that. I only has TS access the
server is 280 miles away.
Cheers anway
David
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business
Lists
Sent: 05 January 2003 16:50
To: David Lewis-Waller
Subject
Just as a note to this, we have a DNS (Simple DNS plus) on the same
machine as Imail/Declude and point to this DNS. Another DNS server sits
on the same 10Mb network whilst the primary is elsewhere. Cuts down on
internet look ups.
David
WiSS Limited
-Original Message-
From: [EMAIL
It happend to us on our 7.13 installation, we had to uninstall the
update to get the IMail interface back to something usable. Not clever.
IMail have confirmed to me that this is a problem and suggested the
removal of Q328310, whether this is a problem with IMail or MS I know
not - no other apps
A definite yes.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: 17 December 2002 00:50
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] An optional web interface for Declude
JunkMail?
A lot of our customers seem to want a web
My preference would be for IIS/ASP. PHP adds another installed
application into the equation on a box that really should only be
running IMail. However, I would trust a webserver app from Declude that
would do the job - it would be less prone to vulnerabilities than
IIS/Apache/CF etc. as the
The Declude users lobby group!!! Count me in.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith
Sent: 17 December 2002 16:56
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] An optional web interface for Declude
JunkMail?
Say the word and
Scott,
Would a regular expression be appropriate for this type of specific
filtering? E.g.
BODY 100 REGEXP (regular expression)
If so, could it be added to the wish list as an option? Just an idea.
David
WiSS Limited
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
I have added MYFILTER WARN to $default$.junkmail.txt and removed the
double quotes around the text file leaving
MYFILTERfilter c:\imail\declude\myfilter.txt x 0 0
In global.cfg
I'm sent a few more test emails and the MYFILTER test isn't appearing in
the headers
I am quite
I've been using Declude for more than a year now and I've only just
tried the ATTACH option. However, I don't get the spam email as an
attachment it is simply embedded in the email itself - any ideas?
Extract from email below:
Subject: FSC - Our Top Pick For Making Money!
From: [EMAIL PROTECTED]
Scott,
I'm using Outlook 2002. I'll see if there are any settings that can be
changed to cure this.
David
WiSS Limited
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: 22 November 2002 14:26
To: [EMAIL PROTECTED]
Subject: Re:
The domain that Declude was registered to has to be the same as the
official host in Imail or Declude won't work.
David
WiSS Limited
-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Tom
Sent: 15 November 2002 07:47
To: [EMAIL
Sharyn,
Not as far as I've experienced. An Imail upgrade can sometimes disable
Declude (I've not seen this happen by the way) but run declude.exe to
reinstate (always advise doing this if running Declude Virus then send a
test virus from www.declude.com).
David
WiSS Limited
-Original
Has anyone found MessageSniffer to add any significant CPU load
before/after implementation?
David
WiSS Limited
-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Uhte, Russ
Sent: 04 November 2002 17:06
To: '[EMAIL PROTECTED]'
Subject: RE:
Scott,
Are blank lines okay in a blacklist file? I ask because it's makes it
easier to distinguish different types of email/domains we want to block.
Regards,
David
WiSS Limited
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the
We're developing an ASP solution for this as well, initially just
modifying the users $default$.junkmail file and providing WARN/SUBJECT
changes initially, then progressing onto WEIGHT change etc. later. If we
offer too much at first otherwise we make a rod for our own back and
drown in client
Bob,
I can only reassure you that it's very doubtful to be a Win2k problem, we
run almost exactly the same set up as your selves except that our server is
a humble 1Ghz with only 128MB RAM but with 350 domains and ~3000 users. CPU
usage is very low ~2-5% peaking at 50% very occasionally.
If the
Am I right in thinking that the Declude console can't run when looged in via
Terminal Service as it can't interact with the desktop?
David
WiSS Limited
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of David Lewis-Waller
Sent: Tuesday, July 16, 2002 1:39 AM
To: '[EMAIL PROTECTED]'
Subject: [Declude.JunkMail] HELO:Declude Console
Am I right in thinking that the Declude console can't run when looged in via
Terminal Service as it can't
Initially, this will give us very little protection as most of the SPAM most
we receive is from Asia or the US and it won't protect us from spoofing (we
may even see innocents being prosecuted or litgated unduly).
Ho hum
David (GB)
the Americas
-Original Message-
From: Kami Razvan
We used F-PROT only, updated once every hour, and advise clients this is
just a first line of defence and advise them to keep their AVs up to date as
well.
-Original Message-
From: Bill Newberg [mailto:[EMAIL PROTECTED]]
Sent: 28 May 2002 21:32
To: [EMAIL PROTECTED]
Subject: RE:
As a matter of reference we're using Rules in Outlook Express 6 and Outlook
2000/2, I can't say what the level of support for rules is in Outlook for
older verions.
David
WiSS Limited
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: 20 May 2002 21:02
To: [EMAIL
Scott,
This is also marked as failing REVDNS check 194.82.139.3 but it has a PTR
record
194.82.139.3 PTR record: mail.stokecoll.ac.uk. [TTL = 270984 seconds]
Our primary DNS is 213.210.8.110
Thanks
David
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent:
We're not running win2k DNS, we're using Simply DNS. I am puzzled by this as
this DNS server is hosting 300-400 domains without any apparent problems. If
you run a DNS report agaisnt any of the hosted domains it responds
correctly.
-Original Message-
From: Mark Smith [mailto:[EMAIL
I does appear that that DNS isn't responding corectly, the other two are -
so thanks for the detective work. Now to find out why...
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: 17 May 2002 14:37
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Reverse
Thanks to everyone. I had to reinstall the DNS server to get it working
again, no amount of config changes/restarting would work.
-Original Message-
From: Smart Business Lists [mailto:[EMAIL PROTECTED]]
Sent: 17 May 2002 15:22
To: David Lewis-Waller
Subject: Re[2]: [Declude.JunkMail
Why not use an SMTP feed? Declude will still scan.
-Original Message-
From: Grant Griffith [mailto:[EMAIL PROTECTED]]
Sent: 16 May 2002 16:31
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude in front of exchange servers.
We have a client that uses exchange and what we did
Why not convert your static IP to virtual by editing the IMail options in
the registry (back up registry and IMail first)and changing DNS for each
domain to a default IP on the old server then when all done move all domains
across to new server? Worked fine for us but took a long time.
'// This file is marked as read only
'// Author: David Lewis-Waller
'// Date : 6/12/2001
VBS script to automate the updater via Task Scheduler
'// Set the shell object
Set Shell = CreateObject(wscript.shell)
'// Run the F-Prot Updater to update definition files
'// Switch /internet - update
Scott,
What can I say? All is sunshine and light. A major worry and headache cured
in 20 mins. from across the pond.
You're a veritable genius and the most helpful person I know.
Best regards
David
WiSS Limited
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
I just discovered that Declude Virus and Junk has stopped working. I
think it was after upgrading to Imail 7.07 but not sure. F-Prot is
installed and appears to be working but it seems declude.exe is not
being executed -no AV protection and no Spam detection. I've tried v1.49
and 1.49 beta but
on why this would happen I would be grateful for
the info.
Best regards,
David Lewis-Waller
Technical/Managing Director
WiSS Ltd
Intec
Ffordd y Parc
Parc Menai
BANGOR
Gwynedd, LL57 4FG
0870 4329477 (general enquiries)
0870 4329478 (support desk)
0870 4329479 (fax)
http://wiss.co.uk - Design
Terry,
That makes perfect sense. Lesson learned.
Thanks for this.
Best regards
David
-Original Message-
From: Smart Business Lists [mailto:[EMAIL PROTECTED]]
Sent: 26 April 2002 10:59
To: David Lewis-Waller
Subject: Re: [Declude.JunkMail] NJABL:HELP Declude has stopped working
77 matches
Mail list logo
