Richard, Instead of whitelisting we use negative weight on DNS names.
REVDNS -10 ENDSWITH .dell.com Darrell ---------------------------------------- DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus. http://www.invariantsystems.com Richard Farris writes:
So whitelisting the recipient is always a last resort? Better to find out where they are not getting their mail and whitelist that or find out why they are not getting their expected mail..? Richard Farris Ethixs Online 1.270.247.5555 Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" ----- Original Message ----- From: David Franco-Rocha [ Declude ] To: [email protected] Sent: Tuesday, July 26, 2005 8:59 AM Subject: Re: [Declude.JunkMail] Whitelisting Richard, The problem here is, first of all, that Declude does not look at the cc: or bcc: in the headers. It deals with recipients of the email solely on the basis of what is in the message envelope (q*.smd file), which is discarded by IMail after processing; all you eventually see is the contents of the message itself (the d*.smd file). Whitelisting ensures that the email will pass all tests. Under optimal circumstances, if an email source or destination is whitelisted, all tests should be skipped. If there are two recipients and only one were whitelisted, the headers of te email would have to indicate a whitelisted weight of 0 for one recipient and the actual weight for the other (non-whitelisted) recipient. That would necessitate two different sets of headers, which would require two separate message files and therefore two separate envelopes: If the non-whitelisted weight exceeded the HOLD threshold, one copy of the email would be placed into the HOLD folder with the envelope modified for that single recipient; the other would be whitelisted and the held recipient would be deleted from that envelope. In other words, Declude would have to generate multiple emails from a single email, which is not practical. How would Declude assign a new queue number to the duplicate email? If one recipient were whitelisted and the other had a weight of 5 (to be delivered), there would be different sets of headers and therefore different emails. They could not both have the same queue number because they could no be placed into the spool at the same time (one would overwrite the other). The email server generates a separate copy of the email for each recipient after processing by Declude. However, there is no practical way for Declude to create multiple emails from a single message. David Franco-Rocha Declude Technical Support ----- Original Message ----- From: Richard Farris To: [email protected] Sent: Monday, July 25, 2005 4:24 PM Subject: [Declude.JunkMail] Whitelisting I just took out all the email addresses I had whitelisted in my Global file last week because I thought this would help stop more spam getting thru....and of course folks are now emailing me saying they are missing mail..newsletters and such... My question is "Why is it not possible with Declude to whitelist an email address and it only applies to that email address and not any others that might be in CC or BCC"? Richard Farris Ethixs Online 1.270.247.5555 Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" ----- Original Message ----- From: Matt To: [email protected] Sent: Monday, July 25, 2005 1:47 PM Subject: Re: [Declude.JunkMail] Filter not triggering Kevin, Just a thought if you wanted to confirm this as a bug, maybe try a filter for this same message, but match a full word to see if it triggers. I did decode this segment and there is no additional encoding or other tricks that would cause a filter to not hit. IMO, knowing about bugs like this would be very helpful at times, especially considering the time that it would take each one of us that was affected by it to figure it out on our own. Maybe if Declude doesn't want to post this information on their site, we could take it upon ourselves to share such information with the list when it is discovered. This is for the most part how the list used to function in the old days, though most of us seemed to desire a page dedicated to the topic regardless. Matt Kevin Bilbee wrote: Well that would explain why many of my filters are not as effective as they used to be. Has Declude announced when the fix will be available???? Kevin Bilbee -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Carter Sent: Monday, July 25, 2005 8:05 AM To: [email protected] Subject: RE: [Declude.JunkMail] Filter not triggering I have reported to Declude a problem with the "CONTAINS" statement. Prior to 2.0.6 (or somewhere around there) it worked on character match, but after an upgrade to Declude it only works on a word match. (In other words you could not longer match on a string of characters within a word.) This would affect your situation. I believe the fix is caught up in the wait for the newest version (the one they are testing now.) John ---------------------------------------------------------------------- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 25, 2005 9:10 AM To: JunkMail Declude Subject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points???? Could declude not be decoding the BASE64???? This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C00000333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C00000333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C00000333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C00000333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C00000333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C00000333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C00000333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C00000333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C00000333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C00000333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action=WARN. 07/24/2005 19:57:36 Q551E097C00000333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C00000333 L1 Message OK 07/24/2005 19:57:36 Q551E097C00000333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C00000333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C00000333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C00000333 Action(s) taken for [copyall_account] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C00000333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C00000333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C00000333 Msg failed NOABUSE ("Not supporting [EMAIL PROTECTED]"). Action=WARN. 07/24/2005 19:57:36 Q551E097C00000333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C00000333 L2 Message OK 07/24/2005 19:57:36 Q551E097C00000333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C00000333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C00000333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C00000333 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C00000333 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] Kevin Bilbee -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
------------------------------------------------------------------------ Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
