You don't have to have PRO. You can also use a FROMFILE test with a text
file listing all of the email addresses and/or domains you want to penalize.
Just put a line like this in your Global.CFG:
FROMBLACKLIST fromfile C:\IMail\Declude\fromblacklist.txt x 200
0
This penalizes every address/domain in the fromblacklist.txt file with 200
points.
You'll need to add the action for the test name to the bottom of your
Global.cfg for outgoing messages, and add it to your $default$.junkmail as
well.
Lastly, make sure you have a carriage return at the end of the
fromblacklist.txt to avoid the last line being ignored..
Darin.
----- Original Message -----
From: "Scott Fisher" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, June 02, 2005 6:37 PM
Subject: Re: [Declude.Virus] Newbie question
If you've got pro, you could add a filter:
MAILFROM10 CONTAINS [EMAIL PROTECTED]
that will check the envelope mailfrom.
To check for those addresses in the headers:
HEADERS 10 CONTAINS [EMAIL PROTECTED]
Another option is to update your virus software more often to minimize the
opportunity window for the virus.
----- Original Message -----
From: "Kevin Rogers" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, June 02, 2005 5:15 PM
Subject: [Declude.Virus] Newbie question
> How do I ban certain email addresses?
>
> Some viruses have gotten through lately (first that I know about since
> installing Declude) sent from forged email addresses using our own domain.
> We do not whitelist our domain. I'd like to ban some of these common
> addresses (e.g., [EMAIL PROTECTED], [EMAIL PROTECTED], etc.)
>
> Thanks.
>
> ---
> [This E-mail was scanned for viruses.]
>
> ---
> This E-mail came from the Declude.Virus mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus". The archives can be found
> at http://www.mail-archive.com.
>
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
