I'm getting the same for several days. There are few recent comments over
on the Imail forum, but nothing that clears up their purpose.
What I find worrisome over the few weeks is the increase of all the various
spam problems. Number of Nigerian letters are way up; spam coming through
passing
-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
John
Carter
Sent: Tuesday, June 06, 2006 8:52 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Please take a look at this - forged
mail
headers?
I'm getting the same for several days. There are few
I'm seeing the same thing. However the headers show all of the tests failed
and the score - well above my delete weight.
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett
Sent: Monday, June 05, 2006 6:37 AM
To:
From the Junkmail manual
6.7.2 Whitelist Files
If you need to have unlimited whitelist entries, or if you need per-user or
per-domain whitelisting, you may find the WHITELISTFILE option helpful.
To use this option, you need to add a line in the format WHITELISTFILE
Is anyone running an alternative to Message Sniffer under Declude? Was
about to renew at the new price and was just wondering.
Thanks,
John C
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Asked because I didn't know if there were any other alternatives. Sniffer has
performed well, but with the price jump, reduced educational discount (10 down
from 20%), and some really tight budgets, the smart thing to do is ask.
The Razor you mentioned, is that Vipul's Razor at Sourceforge?
I know some of you have seen such before, but the text below is the most
extreme (useless) attempt to get around filters I've seen. It looks like
something my son would text message.
LOL
John
Your c a redi z t doesn't matter to us ! lf you O n WN real e O st 6 at x e
and want IMMED beIA when
Todd
Check for the possibility of tests that were PASSED, which would also reduce
the score. X-Spam-Tests-Failed will only show those test FAILED. I went
through this some time back and had to run DEBUG mode for a while to
understand it.
John C
-Original Message-
From: [EMAIL
This may not be the problem, but I don't remember seeing TO, FROM etc lines
appearing before the Received: from line, except in msgs sent internal to
Imail. Every header I've seen started with Received:. (I guess it can happen.
Does here.) Could this be a case of broken client/headers messing
I think mine are the Declude defaults, but I have not
adjusted the overall scoring like some have. (tag at 10, delete at
20)
MXRATE-BLOCK
127.0.0.2 for 7 on failure
MXRATE-SUSPICIOUS 127.0.0.4 for 2 on
failure
John C
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harry
Hmmm, interesting. I've gotten over 3200 hits in 2 1/2
hours with ip4r ***.mxrate.net. I'll test these with a zero score and WARN
to see if there is a difference.
John C
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott
FisherSent: Wednesday, March 01, 2006 1:56 PMTo:
). The ones I really
wanted help with - those that hit only SNIFFER, which I weight at 7 - don't
seem to be tripping MXRATE...
-Dave Doherty
Skywaves, Inc.
- Original Message -
From: John Carter
To: Declude.JunkMail@declude.com
Sent: Wednesday, March 01, 2006
Thanks, will look at blackholes.us.
My real problem is time. I've written a program and spreadsheet that
extracts the domains and IP's of delivered messages and shows the unique
IP's and how many messages came from them. But when I spend time
cross-checking with SenderBase and ARIN, I can
Starting to catch EXE attached messages with following subject lines coming (at
least currently) MESWILLEY.org [68.63.231.44].
You steal from innocent people
You are a criminal and will be busted!
Phshing is illigal
Where did you learn to scam?
John C
9:15p CST
---
This E-mail
Yea, I go for the write-in.
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox
Sent: Wednesday, February 15, 2006 10:18 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] ? Name Voting Time
I'd like to vote for a write-in
Of course, all of this is "your mileage will vary", but
Scott's filter might be simpler (therefore better), but I
have a country filter (which I got from Scott) which allows me to set the score
by the country.
The
Global.cfg is
Could the Word files go in RTF format? Sometimes I
find they are smaller, but still readable in Word.
Feeling your pain,
John C
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bonno
BloksmaSent: Tuesday, February 14, 2006 8:47 AMTo:
Declude.JunkMail@declude.comSubject: Re:
Sorry, Barry, not doubting you sent it, but didn't get the message here.
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Friday, February 10, 2006 12:47 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail]
W32/[EMAIL PROTECTED] virus eat the memo. I think it had a statement to the
effect of
If Instr(msg, take day off) then shell(delete_memo.exe /noprompt)
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)
Sent: Friday, February 03,
In 7.X on the SMTP panel, you will have tries before returning to sender
and queue timer. What are the settings there?
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Guhl, Markus (LDS)
Sent: Wednesday, January 25, 2006 9:48 AM
To:
Is the filter file method any better than that found in the
manual.
In $default$.junkmail add "WHITELISTFILE
[location]\whitelist.txt"
Then in the WHITELIST.TXT, put addresses, domains,
etc.
@mec.ms .sirsi.com
[EMAIL PROTECTED]
John C
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
http://www.cnn.com/2006/TECH/internet/01/18/internet.spam.ap/index.html
One spammer down - ???,???,??? to go.
John C
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to
Can't he go into global.cfg and use
WHITELIST TO receiving_domain
or is that a Pro version thing?
John
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Shayne
EmbrySent: Tuesday, January 17, 2006 12:12 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail]
This was suppose to be a holiday ... I didn't need this.
Imail 8.22
Declude 3.0.5.22 EVA Junkmail Pro
F-Prot/ClamAV/Sniffer
I had a problem similar to Darrell's. After noticing very little mail going
through the server yesterday and then this morning, came in to find 20,000+
msg in \proc
Thanks, David.
Can't remember precisely what I included in my earlier message to the list, but
my installation definitely went south around 8 a.m. yesterday. In addition to
only allowing a few emails through (10's instead of 10,000's) over 24 hours,
Decludeproc memory went over 500MB
PROTECTED] On Behalf Of John Carter
Sent: Monday, December 26, 2005 9:13 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] All I wan't for Christmas is
not to be paged!
This was suppose to be a holiday ... I didn't need this.
Imail 8.22
Declude 3.0.5.22 EVA Junkmail
Sorry if 99% of you already know this, but give me a minute. Sometime ago
someone here mentioned Senderbase. If you haven't used www.senderbase.org
to help lookup IP's, domains, network owners, etc, it is worth trying out.
(I'm sure there are other good lookup sites.) It has been helpful
Check the patch page at
http://www.ipswitch.com/support/imail/releases/imail_professional/index.asp.
There is a 8.15 fix.
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Wednesday, December 07, 2005 7:55 AM
To:
: [Declude.JunkMail] Bugfix: Imail 8.22 and ICS 2.02 released
After looking at that - it appears that those patches are from the exploits
early this summer (May 2005) and not from this recent round.
Darrell
Darrell ([EMAIL PROTECTED]) writes:
Thanks John,
Darrell
John Carter writes:
Check
Would adding an extra filter linebe in order? Such
as:
BODY 0 BEGINSWITH lt;IMG
src="">
John
C
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin
BilbeeSent: Wednesday, December 07, 2005 2:09 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] CBL:Fw:
May wish to consider CONTAINS instead of BEGINSWITH.
This is one I just got.
John C
!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0
Transitional//EN"HTMLHEADMETA
http-equiv=Content-Type content="text/html; charset=us-ascii"META
content="MSHTML 6.00.2800.1106"
Title: OT: Old Imail Forum
Sharyn
Your message just showed up on both the Junkmail forum and
the Imail forum. Yes, the email based forum is still around.
Try going to : http://www.ipswitch.com/support/mailing-lists.html
John
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
I think I may be double scoring a test. If you have a score in the filter
file 0 and a score in the global 0, does it add the two into the overall
weight?
Example
Filter file entry
REVDNS 1 ENDSWITH .liverandcherrys.com
Global.cfg
JCREVDNS filter d:\Decludefilters\jcrevdns.txt x 1 0
Would a
Travis
Anti-virus: In the virus.cfg you turn off/on outgoing scanning. Look for
#
# The following options allow you to limit scanning to only incoming or
outgoing
# E-mail.
#
INCOMINGON
OUTGOINGON
For spam checking, look at the bottom of the global.cfg for
# OUTBOUND ONLY
#
Travis
I don't know if I've overlooked this suggestion from someone else, but post
your global.cfg (without code) to the list. We could take a look at it.
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Friday, November 18, 2005 1:22
I am getting a lot of spam for 64.192.25.* (which come in with constantly
changing domains, but actually resolve back to
outgoing.liverandcherrys.com). I am reluctant to block the whole class C,
but will likely end up doing so. Is there a better way to handle this?
Kind of a best practices?
@declude.com
Subject: Re: [Declude.JunkMail] Blocking on resolved domain name
You could create a filter file to block REVDNS matching
outgoing.liverandcherrys.com if you have Junkmail Pro, or create a simple
external filter if you don't.
Darin.
- Original Message -
From: John Carter [EMAIL
weight... that weight,
my content filters, body/subject, and combo filters take care of the rest.
So, in the event a real person is sitting on that class C, their email still
comes though, unless they are selling Viagra :)
Travis
- Original Message -
From: John Carter [EMAIL PROTECTED
I may be breaking rules, but I have one list that I create only the
user.lst file (email address only) and don't bother with more involved
user.txt (address and name). Haven't had any problems.
John C
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Susan
David
If one doesn't have the following in the declude.cfg, what are the default
values used by Declude?
WAITFORMAIL
WAITFORTHREADS
WAITBETWEENTHREADS
Thanks,
John
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type
PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Tuesday, October 25, 2005 10:05 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Declude.cfg defaults
David
If one doesn't have the following in the declude.cfg, what are the default
values used by Declude?
WAITFORMAIL
Duh, I failed 1st grade math. Try THREADS 75.
John
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Monday, October 24, 2005 3:36 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] 30511 problem
Someone correct me
Imail 8.21
Decludeproc 3.0.5.5
Declude.cfg set to THREADS 25, no further entries in file.
Local users are whitelisted and bypass spam check, but not virus checking.
System not under heavy load at time of issue.
End user reports slow mail delivery. She was sending a single Word doc file
(44kb) to
for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
John Carter writes:
Imail 8.21
Decludeproc 3.0.5.5
Declude.cfg set to THREADS 25, no further entries in file.
Local users are whitelisted and bypass spam
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
John Carter writes:
I would say not. I watched it for a few minutes and it bounced from
around 30 msgs (60 files
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
John Carter writes:
Imail 8.21
Decludeproc 3.0.5.5
Declude.cfg set to THREADS 25, no further entries in file.
Local
Imail 8.21
Was/is Declude 2.0.6.16
I just attempted the upgrade to 3.0.5.5 by doing the following:
Downloaded current 3.0.5.5
Stopped SMTP
Stopped Queuemgr
Created \proc under \spool
Ran the 3.0.5.5 upgrade
Created declude.cfg under c:\imail\declude\ and entered THREADS 5
Made sure decludeproc
directory. I would also suggest you start on about 20 threads.
To check the version of declude, at your command prompt for Imail type
Declude -v
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Carter
Sent: Friday, October 07
Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of John Carter
Sent: Friday, October 07, 2005 1:57 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Ok, what did I do wrong?
Imail 8.21
Was/is Declude 2.0.6.16
I just attempted
Darrell
Before 3.x, to get the default global.cfg file, I downloaded Declude.exe and
ran it don't install. It dumped everything to a folder for examination.
Is 3.x the same? Couldn't tell from the Beta page.
Thanks,
John
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Forum members:
I need to let you know I can not duplicate the so called CONTAINS problem
I ran into in earlier. In other words the CONTAINS directive seems to be
working ok.
David Barker requested I send sample emails, log entries, etc. for
evaluation. Not having any of the emails or Declude
Then may I ask why prior to 2.0.6.12(or so) did the following work
HEADER 1 CONTAINS gfsinc.com against the header information of:
Received: from mail.gfsinc.com [206.165.223.43] by bobcat.jcjc.edu
(SMTPD32-8.15) id A9D24988001E; Wed, 09 Mar 2005 23:23:30 -0600
Now to catch this, I have to
I have reported to Declude a problem with the "CONTAINS"
statement. Prior to 2.0.6 (or somewhere around there)it worked
oncharacter match, but after an upgrade to Declude it only works on a word
match. (In other words you could not longer match on a string of characters
within a word.) This
How important is it to have ONLY one space or one tab between the items on a
rule line in a filter file? I have seen filters where to have columns for
readability there were multiple tabs or spaces. Is this a problem?
Also, is anyone else having a problem with the CONTAINS statement in a
filter
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.
http://www.invariantsystems.com
John Carter writes:
How important is it to have ONLY one space or one tab between the
items on a rule line in a filter file? I have seen
My understanding from the JunkMail manual is that the CONTAINS test uses
character match, not word match (as in a whitespace before and after). I
have one filter set to delete any message which fails any entry.
Particularly one entry is:
HEADERS 1 CONTAINShuntersrobe.com
]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Monday, May 23, 2005 1:23 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] CONTAINS test
Is there a carriage return after the domain name?
- Original Message -
From: John Carter [EMAIL PROTECTED]
To: Declude.JunkMail
While reviewing some held emails, I have seen messages with what I'll call
split headers -- as in the normal header lines are at the beginning of the
msg file and the Declude headers are the end of the msg file with the msg
body in between. My question is will this mess up any test results, esp.
After getting some help from Declude support yesterday, I am much more
pleased with it. The number of vulnerabilities held that should have been
deleted by JM are down dramatically. I return 2-3 msgs a day to the queue,
but now don't have to wade through 100's to get there. Also I feel that I am
Help me out here. When I extracted the files by manual process, I was given
the option to specify the directory (which I did - d:\Declude 2.0.6\) Why
did anything end up in C:\program files\declude\?
John
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf
I found yesterday that MAILPOLICE Bulk and Porn have been combined into
Block (although there may be legitimate reasons to do separate lookups.)
http://rhs.mailpolice.com/usage.php One page says fraud is in there too,
but they are not consistent with that.
John
-Original Message-
From:
Don't know if this contributes anything, but I have noted one thing. At LOW
logging in 2.0.5 for a message weighing more than the delete threshold,
the dec.log shows L1 Message OK indicating it was ok for delivery, but
will still be deleted. This is confirmed by looking at the sys.txt
Has something happened to Mailpolice? I've not seen a log entry on any of
their DB's since late Monday afternoon. I've double checked the global and
default.junkmail files and everything looks fine. After revisiting their
website, I did combine fraud, bulk, and porn into block as suggested, but
The following header lines are the basis of my question. The from domain
(mine) does not match the from [IP] address (not mine.)
Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP
(SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600
From: Returned mail [EMAIL
Scott:
If ANYWHERE only gets subject and body, then to fully cover everything in
the message would we then need
ANYWHERE# CONTAINS
HEADERS # CONTAINS
Thanks
John
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Based on the following description of XBL from
the spam database listing at http://www.declude.com/Articles.asp?ID=97
SBL Exploits Block List. This
contains the same data as the CBL test. Can be combined with SBL by using
sbl-xbl.spamhaus.org. Lists IP addresses of exploited servers.
Please explain. BLITZED-ALL and CBL
dont check Spamhaus, do they? Scotts spam database page
makes it look like BLITZED-ALL goes to opm.blitzed.org and CBL goes to
cbl.abuseat.org. Is there a relationship of these to
Spamhaus? And if I do drop those two for SBL-XBL, should I increase the
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of John Carter
Sent: Wednesday, December 01, 2004
12:32 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
Spamhaus
Please explain. BLITZED-ALL and CBL
dont check Spamhaus, do they? Scotts spam database page
makes it look like BLITZED-ALL
I've asked the same in the past and never got an answer. I'd like to know
what is included in #3 (most?) and #7 (extra tests).
John
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Terry Parks
Sent: Friday, November 26, 2004 6:29 PM
To: Declude. JunkMail
I've been looking at the archives about the N*i*g*e*r*i*a*n letter filters
and saw a lot of discussion back in January, but couldn't tell what people
concluded would be the best filter for this. Does anyone have anything to
share? (Prefer a Declude only solution as I don't have SpamAssassin.)
I have a problem I think relates to the priority of holding vulnerabilities
before the actions of filters kicks in.
My filter file, among other things, has the following:
BODY 1 CONTAINS GenerationX Solutions
The action in the $default$.junkmail is to delete. This works when no
Looks like either way I have to go through 100's of held messages daily to
find that 99.9% are spam and then manually delete them. I guess I'll pull
the ol' Visual Basic out and work up a solution.
Thanks,
John
(Scott wrote)
Your option here would be to add a line AVAFTERJM ON to the
in your spam folder? If
they're held, they're effectively quarantined and the user isn't bothered by
it, just as they're not bothered by the spam in that folder.
Please share,
Andrew 8)
-Original Message-
From: John Carter [mailto:[EMAIL PROTECTED]
Sent: Wednesday, November 03, 2004 11
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Vulnerability hold conflicting with filter
You've got more faith in F-Prot than I do.
According to my logs, F-prot is missing encrypted zips that McAfee and
ClamAV catch here.
- Original Message -
From: John Carter [EMAIL PROTECTED
So we have been baited for seven years?? And now the ol' Ipswitch-a-roo??? I
know there is a lot of anger, frustration, etc., but the talk of legal
action is a waste of bandwidth. I'm not happy either, but am not about to
spend 10's of thousands to end up with (as someone said yesterday) a coupon
Scott:
I set up a filter of MAILFROM 0 STARTSWITH [EMAIL PROTECTED] I am only holding right
now.
The following was caught. Notice the coups@ is in the Received: line, not
the From: line. Should this one have been caught or skipped?
BTW, in 24 hours have caught around 600 msgs with this and
I promised I read the manual.
I'm wanting to handle mail based on sender name. Particularly I'm
getting considerable spam from coups@ and sender@, among others.
What I am thinking about is:
GLOBAL.CFG
JCFILTERfilter D:\decludefilters\jcfilters.txt x 0 0
$DEFAULT.JUNKMAIL$
JCFILTER
There does seem to be a variety of needs and wants regarding logging.
Scott, could you consider providing configurable logging instead of just
logging levels or some degree of configurable logging within the levels?
As in maybe:
SHOWINLOG MAILFROM
SHOWINLOG RECPT
SHOWINLOG TESTFAILED
etc., etc.,
looks like it would do what you were trying to do.
Matt
John Carter wrote:
I promised I read the manual.
I'm wanting to handle mail based on sender name. Particularly I'm
getting considerable spam from coups@ and sender@, among others.
What I am thinking about is:
GLOBAL.CFG
JCFILTER
We may have a new scam or virus going on. Just got about twenty emails
with zips (subject line: Subject: Your login information has been
updated). Supposedly from USdBill Support (sender address and sending
server keep changing -- surprise, surprise). Attached zip is call
panel_v1.7. The D*.SMD
Do you have a CDW product number on this? Called and they took forever
to come back with $20+
Thanks,
John
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, May 18, 2004 9:55 AM
To: [EMAIL PROTECTED]
Subject: Re:
I'm starting an IPFILE test in which I will place IPs with I want to
block. For management reasons I would like to do this through JunkMail
(as opposed to Imail access control list). Problem: From looking at
the logs I have a NEAR consecutive range of IPs 12.129.205.42 to .89
(FLOW*GO) to put
Forgive the ignorance. To use the SPF test, do we have to have
implemented SPF ourselves or can it be used to check against those who
have?
Thanks,
John
---
For those that are interested, we now have an interim release with SPF
support in it. [interim information removed] To use the new SPF
Just was looking a drug spam that came through with a weight of 12
(failing SORBS-DUHL and CMDSPACE). I know many of you have seen this
(which is why I asking for help.) It had the standard random gibberish
of correctly spelled words, but making no sense -- I guess to throw
phrase analysis. Ex.:
I know it is best to handle mail based on test results, but ... for
those FROM addresses we wish to block (the Flowgo's and the like), is it
better to:
1 - put in the Imail kill file and return the 501 message,
or
2 - accept the message, but then delete before delivery and not send the
501
Do DOW HOURS stand alone as individual tests or is there some way they
could be used to run alternate versions of tests which give different
scores (or even run tests that you might not during regular operations)?
Maybe unclear, so example: the percentage of spam to legit mail is
higher on
It appears that emails addressed to two of more local users is tested
for each recipient even though it is the same message. Is that right?
If so, isn't it a waste of effort/resources? If so, can that be
stopped?
02/11/2004 21:39:11 Qf55a016a01105362 Msg failed HELOBOGUS (Domain
Title: Message
Sharyn:
Were
getting the same thing endlessly, but none of the links match what you have
except the v*9.gif. Im trying to see if blocking only on the graphic
name will work.
John
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Does WHITELISTFILE allow entries for IP, TODOMAIN, and/or ANYWHERE
whitelisting? Or are only from addresses/domains allowed?
If it doesn't, is there conflict in having some WHITELIST IP and
WHITELIST TODMAIN entries in the global.cfg and a WHITELISTFILE entry in
the $default$.junkmail?
BTW, have
Have I missed something about DNSSTUFF being down? Link at Declude
Tools page gives error page. Thanks.
John
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to
How would I test in Declude for the presence of the X-Imail-Spam
header? (or does running order prevent this?) I want Declude to put a
Spam notation in the subject line when an email fails enough of either Imail or
Declude checking.
Thanks,
John
I use Blat for some email web forms. Since putting in JunkMail I see
that its use equals/exceeds WEIGHT 10. Is there some way to get the
weight down or is there a better form emailer out there?
Thanks,
John
Headers below: (FYI - 172.22.#.# are our inside VPN numbers.)
Subject: Spam:Website
There may be truth to the cafe tale. I have an instructor who used a
friend's apartment complex cafe for email and now is getting hit with
tons of stuff. We can trace some of it back through the air2lan.net
system (cafe provider).
John C.
Sanford Whiteman wrote:
However he does travel
93 matches
Mail list logo
