Here's my global.cfg. I have commented out sniffer, ipnotinmx and nolegitcontent as those are my suspects... Everything else is how the configuration was when I became aware I had problems.
Thanks! AHBL ip4r dnsbl.ahbl.org * 6 0 BLITZEDALL ip4r opm.blitzed.org * 7 0 CBL ip4r cbl.abuseat.org 127.0.0.2 6 0 DSBL ip4r list.dsbl.org * 6 0 ORDB ip4r relays.ordb.org * 5 0 SBL ip4r sbl.spamhaus.org * 7 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 5 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 5 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 5 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 5 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 4 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 5 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 5 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 5 0 SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 4 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 7 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 1 0 BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -10 0 BADHEADERS badheaders x x 4 0 BASE64 base64 x x 4 0 CMDSPACE cmdspace x x 8 0 COMMENTS comments x x 7 0 HELOBOGUS helovalid x x 5 0 #IPNOTINMX ipnotinmx x x 0 -3 MAILFROM envfrom x x 12 0 #NOLEGITCONTENT nolegitcontent x x 0 -5 PERCENT percent x x 10 0 REVDNS revdnsexists x x 4 0 ROUTING spamrouting x x 2 0 SPAMHEADERS spamheaders x x 3 0 #SPFFAIL spffail x x 3 0 #SNIFFER external nonzero "C:\IMail\Declude\Sniffer\wuckd6ww.exe y5abucz7zhoqeg0o" 0 9 WEIGHT10 weight x x 10 0 WEIGHT20 weight x x 20 0 CATCHALLMAILS catchallmails x x 0 0 Katie LaSalle-Lowery Centric Internet Services 1410 Reserve St. Missoula, MT 59801 Local Phone 549-3337 ext. 21 Toll Free (888)593-2776 ext. 21 Fax (406)721-3438 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, December 13, 2004 2:18 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Upgraded Declude Thurs night -- since then getting false positives on MessageSniffer If you post those relevant sections of your Global.cfg, we can help figure it out. John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Katie LaSalle-Lowery > Sent: Monday, December 13, 2004 1:14 PM > To: [EMAIL PROTECTED] > Cc: Ken DeCosta > Subject: RE: [Declude.JunkMail] Upgraded Declude Thurs night -- since > then getting > false positives on MessageSniffer > > Okay, upon further review, and if I'm reading things right, it looks > like MessageSniffer is *not* getting a false postive (logs shows > "clean") but Declude is penalizing by applying the weight as though > the test was failed. > I sent an example to [EMAIL PROTECTED] earlier today. It looks > like maybe Declude is scoring ipnotinmx and nolegitcontent as a > positive weight instead of as a counterbalance. > > > Katie LaSalle-Lowery > Centric Internet Services > 1410 Reserve St. > Missoula, MT 59801 > Local Phone 549-3337 ext. 21 > Toll Free (888)593-2776 ext. 21 > Fax (406)721-3438 > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Katie > LaSalle-Lowery > Sent: Monday, December 13, 2004 1:52 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Upgraded Declude Thurs night -- since then > getting false positives on MessageSniffer > > Thurs evening I upgraded our Declude installation to version 1.81 (we > had been at 1.65). I have become aware of a number of false positives > in MessageSniffer since Friday. We had not seen any false positives > in MessageSniffer previously. > > Any thoughts or suggestions? > > > Katie LaSalle-Lowery > Centric Internet Services > 1410 Reserve St. > Missoula, MT 59801 > Local Phone 549-3337 ext. 21 > Toll Free (888)593-2776 ext. 21 > Fax (406)721-3438 > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
