RE: [Declude.JunkMail] OT- SpamReview the Kill File
tj In some cases, not necessarily this one, SpamReview will use tj mindspring or the reply address where as Declude will say it's from tj a different address. SW Sounds like a pretty useless app, if so. Not entirely, it allows you to read the message headers, re-que, delete, or hold it in another directory. It's allot easier than using notepad or some other editor. Being able to review the message this way allows you to sometimes see a common thread that some spammers may use. This can help some develop better filters and applications to help catch spam. SW You would go after the second-level domains of faked intermediate SW gateways? This is going to be counterproductive, since the only good SW reason to use such fake Received: lines is to throw legitimate hosts SW into the mix. Not exactly, I actually verify each and every site before I consider listing them in my kill file or ISP file. This is a fair amount of work, however, it has been paying off for us. The names in the kill file are cleaned out after X number of days by a program if they have not been in use. You can basically consider it a slap on the wrist to those spammers, since they will move on to another address while other lists get overly congested with bogus and/or useless addresses. - like a virus, spam can be a never ending battle, however, - we never stop fighting it. If we did, McAfee and Symantec - would be poor. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] OT- SpamReview the Kill File
Not exactly, I actually verify each and every site before I consider listing them in my kill file or ISP file. Great--the point is that SpamReview's bugs, if they're grabbing faked intermediate second-level domains (mindspring.net in your example) and suggesting that they be killed when found in source addresses, are going to have, almost by design, a destructive number of false positives. I understand that you're saying it's just a tool in your kit, and that your example was hypothetical. -Sandy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT - Listed on Spwes!
I haven't seen them block a Class B before, just Class Cs. Actually they haven't blocked the whole class B. That was my mistake... Here's the short version of my experience... Two of our T1's come from an ISP that was called CAIS. CAIS filed for Ch 11 and reorganized as Ardent. Ardent was then sold to BTN who now owns that netblock. The transition is still taking place... Apparently CAIS was a 'spam friendly' ISP meaning that if you had a T1/DSL, etc with them they didn't mind if you spammed as long as you paid the bill. I can understand this -- maybe I don't agree but if you're paying for a dedicated T1 type pipe, I figure that whatever bits you move are your business. Dialups are another story... Anyway... We've had these two T1's for two years now (5 year total contract) and they've never missed a beat. Our other two T1's come from Worldcom and are just as reliable. Two years ago I don't think that SPAM awareness was at the level that it is now so who would have thought to ask if CAIS was a 'spam friendly' ISP. The reason that I mention this is because SPEWS suggestion is to change ISP's. Well, that's absurd because of all of the reconfiguration, planning, etc that goes into changing IP addresses. They also make comments like well you should have checked to see if the ISP was spam friendly... It's as I'm talking to 13 year olds who don't know how to configure/manage networks... Anyway... The way that SPEWS works is that if they find a 'spammer friendly' ISP then they start blocking their network blocks. If they don't respond to their letters to stop the spammers they start adding other network blocks that they DON'T EVEN HAVE EVIDENCE for. IOW, they add adjacent netblocks like ours that AREN'T SPAMMERS. They do is as a guerrilla tactic in an attempt that legitimate customers (in their words) will pressure the ISP to stop our network neighbors (CAIS' other customers) to stop spamming. I'm sorta' torn on this one because their mission is a good one and I support it -- they want to abolish all SPAM and so do I. However, they do so at the cost of blocking legitimate customers. Additionally, since SPAMing isn't illegal (yet) I'm also torn on where the blame is. They blame the ISP for providing the service to the spammer. I blame the spammer. It's like blaming/blocking ATT because they provide phone lines to a telemarketing call center. Let me make one thing perfectly clear. I DO NOT SUPPORT SPAMMING. But I've just decided to drastically lower the SPEWS weight test in my Junkmail configuration. You can see the flaw in SPEWS logic... By doing this they are creating an very inaccurate list/service. So Scott, when we kill all of the spammers, what will you do? :) Mark Smith -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, September 17, 2002 8:35 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT - Listed on Spwes! I've found out that our netblock (/24 bit net carved out of a Class B net) has been listed on Spews!. Not because of our doing but because it's part of a upper block of Worldcom. The 'evidence' pages show this coming from a completely different network. That's what SPEWS does. I haven't seen them block a Class B before, just Class Cs (where the spammer and the innocent victim each shared IPs on the same Class C). However, it is generally agreed that the SPEWS test should not be used as a spam test -- because of their approach, they list a lot of legitimate mailservers. Does anyone have any experience with this and/or getting removed? I haven't heard of anyone getting removed, but I believe there is some ritual you can perform by going onto a newsgroup somewhere and being extremely polite... but that could just be a rumor. -Scott --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Common items in Spam addresses
Tom, Here's another one that I've been using for a while in addition to the ones you list: -SENTTO SENTTO1 SENTTO- SENTTO2 @SENTTO SENTTO3 SENTTO@ SENTTO4 .SENTTO SENTTO5 SENTTO. SENTTO6 ...and today I saw a www- come through which I am considering adding. Bill -Original Message- From: Tom Sent: Tue, 17 Sep 2002 18:35:10 -0400 Subject: [Declude.JunkMail] Common items in Spam addresses I have compiled yet another list of items commonly found in spam and mass marketing addresses. You can use this list of words at your own risk. I suggest you use it with a weight value and not something drastic like delete. Some of these words may also be commonly used for list services so make sure your weight value does not exceed your limit causing yahoo and bounce to be deleted. It should take more than 2 tests to fail in some cases. However, you are in control so make the best of it. Good Luck, Tom Image`fx - @BOUNCE BOUNCE1 .BOUNCE BOUNCE2 BOUNCE. BOUNCE3 BOUNCE@ BOUNCE4 -BOUNCE BOUNCE5 BOUNCE- BOUNCE6 -GENERICGENERIC1 GENERIC-GENERIC2 .GENERICGENERIC3 GENERIC.GENERIC4 @GENERICGENERIC5 GENERIC@GENERIC6 -RETURN RETURN1 RETURN- RETURN2 @RETURN RETURN3 RETURN@ RETURN4 .RETURN RETURN5 RETURN. RETURN6 @OPT-IN OPT-IN1 .OPT-IN OPT-IN2 OPT-IN. OPT-IN3 OPT-IN@ OPT-IN4 @OPT-OUTOPT-OUT1 .OPT-OUTOPT-OUT2 OPT-OUT.OPT-OUT3 OPT-OUT@OPT-OUT4 @PROXY PROXY1 .PROXY PROXY2 PROXY. PROXY3 PROXY@ PROXY4 -PROXY PROXY5 PROXY- PROXY6 @SPECIALS SPECIAL1 .SPECIALS SPECIAL2 SPECIALS. SPECIAL3 SPECIALS@ SPECIAL4 -SPECIALS SPECIAL5 SPECIALS- SPECIAL6 www.WWW1 @wwwWWW2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist Request
Hi Bob, There are a few reasons I want/need the whitelist separate. One being that it will be easy to push a copy of the whitelist via ftp to each relevant system instead of manually or programaticly attaching to each server and editing the global.cfg. Secondly the global.cfg file is basicly static infomation aside from the whitelist, so interfacing with it programaticly seems like wasted effort to me. I don't believe Scott intended the whitelist to be used as much as it is but unfortunately the amount of legit servers needing whitelisting is enough to make the whitelist an important feature of Declude. The level of modification will just be adding and removing white and black list entries as well as word and phrase filter lines. We can do this via the web and email. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Robert Shubert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 17, 2002 5:57 PM Subject: Re: [Declude.JunkMail] Whitelist Request Rick, I too am planning to advance Declude administration to my users via a web application. Although I saw no reason why I couldn't programmaticaly change the global.cfg and other files. Could I ask your reasoning? Also, to what level of modification do you anticipate. The numerous options that declude allows for will make 100% remote editing quite a challange. Thanks for your input. Bob Rick Davidson wrote: Howdy Scott, Was wondering if you would consider creating a separate whitelist file for management purposes. Currently I have one customer with 4 Imail servers peered as a single domain across the country (US :-) I maintain master black lists and word filters on my workstation and use a batch file to FTP them to each server. Also, we are developing some web based management tools for Declude and would rather not have to programmaticly access the global.cfg file. Figured I would ask :-) Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: SPAMCOP:Re: [Declude.JunkMail] HELOBOGUS
It does fail to recognize that ISP's, and especially Hosting Providers, often have people using their email from work or, in the case of personal domains, from another service provider, which means their test messages from [EMAIL PROTECTED] to [EMAIL PROTECTED] would be from a foreign IP. But as a weighted test it would still be very useful since the message shouldn't fail any other tests under normal conditions. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, September 17, 2002 7:00 PM To: [EMAIL PROTECTED] Subject: Re: SPAMCOP:Re: [Declude.JunkMail] HELOBOGUS The problems here are that you have to enter your IP ranges (so the test wouldn't work automatically), and that some people will send mail from the Internet (especially in the case of sending test messages). If the IP block is setup up in the Global.cfg like Netblock10.10.2.0/22,192.168.1.0/23 Then declude would know the local IP address block and this would make it automatic. Automatic after you enter the IP ranges, and if the IP ranges don't change. :) The non-automatic part is that the test would have to be disabled by default, and people wanting to use it would need to add the list of IPs. However, it could be set up to automatically allow the E-mail if it came from an internal IP address (which would satisfy the needs of a lot of our customers). Now for testing from the Internet I would log on to Hotmail and send from me@hotmail to me@myaddress. This e-mail would pass for the return address and the recipient's address do not match. Good point. :) This test is something that we are still looking into. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Sample config
Hello, Ok first where is the list archived? I did fine it at www.mail-archive.com/ is that correct? Second I am having some what of a hard time making heads and tails of the weighing test and what to assign to each test. I want to figure this out because I need to support it in the long run but i was hoping someone would be willing to share a sample of there golbal.cfg and $default$.junkmail. I think someone asked this a week ago but i could not fine it or if it was replied to. I know I am not really posting a question but I am not sure if i know how to word it as of yet so the archive and a sample would be great! :) -- Best regards, ~Paul~ mailto:[EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Sample config
Hello, Wednesday, September 18, 2002, 11:20:58 AM, you wrote: Paul Hello, Paul Ok first where is the list archived? Paul I did fine it at www.mail-archive.com/ is that correct? Never mind on the archive the message i was looking at had the footer trimed. So i got it. The sample config still would be nice. Thanks. -- Best regards, ~Paul~mailto:[EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist Request
That's what I did...using the address list, I give it a weight of -140, which is more than the total of ALL of my tests added together... Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 11:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request I decided I will start using filter file to whitelist legitimate mailing lists from listservers that also support spammers, since they seem to be the bulk of my false positives. I am giving them all 0 weight in the list, but will give the whole test a very high negative weight. I currently only have a few examples, since I am not that aggressive yet in my weights, but I welcome any suggestions. This should allow everyone to be much more aggressive. Maybe a version of the filter test that is a whitelist wouldn't be a bad idea. The filter tests allow for more flexability than the standard whitelist, leaving in many cases less room for error. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith Sent: Wednesday, September 18, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Rick, I completely agree with you. I don't like risking corruption to the global.cfg file through a ASP/CGI script error. Our idea is to turn up the weight tests and whitelist all of our customer base. The external whitelsit makes it easier to keep that update. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, September 18, 2002 10:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist Request Hi Bob, There are a few reasons I want/need the whitelist separate. One being that it will be easy to push a copy of the whitelist via ftp to each relevant system instead of manually or programaticly attaching to each server and editing the global.cfg. Secondly the global.cfg file is basicly static infomation aside from the whitelist, so interfacing with it programaticly seems like wasted effort to me. I don't believe Scott intended the whitelist to be used as much as it is but unfortunately the amount of legit servers needing whitelisting is enough to make the whitelist an important feature of Declude. The level of modification will just be adding and removing white and black list entries as well as word and phrase filter lines. We can do this via the web and email. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Robert Shubert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 17, 2002 5:57 PM Subject: Re: [Declude.JunkMail] Whitelist Request Rick, I too am planning to advance Declude administration to my users via a web application. Although I saw no reason why I couldn't programmaticaly change the global.cfg and other files. Could I ask your reasoning? Also, to what level of modification do you anticipate. The numerous options that declude allows for will make 100% remote editing quite a challange. Thanks for your input. Bob Rick Davidson wrote: Howdy Scott, Was wondering if you would consider creating a separate whitelist file for management purposes. Currently I have one customer with 4 Imail servers peered as a single domain across the country (US :-) I maintain master black lists and word filters on my workstation and use a batch file to FTP them to each server. Also, we are developing some web based management tools for Declude and would rather not have to programmaticly access the global.cfg file. Figured I would ask :-) Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned
RE: [Declude.JunkMail] OT- SpamReview the Kill File
I must agree spamreview saves us alot of time in doing what the designer of the software orginally wrote it for. Reviewing spam and virus emails that are held in your folder is a snap with this software. Without it you have to open the file in and editor and go through each individual file looking for things. then manually move both files back into que with this product you just point click and thats it quick and efficient. I am sure the developer would take all constructive critisism and suggestions and try to implement a fix. My 2 cents Allen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNS Stuff - wrong analysis?
Hi Scott: Take a look at http://www.dnsstuff.com/tools/ptr.ch?ip=12.165.0.3 The result is: 12.165.0.3 PTR record: westcomail.westco.net.0.165.12.in-addr.arpa. [TTL = 86400 seconds]. You have one or more obviously bogus PTR records (pointing to in-addr.arpa). I believe the ACTUAL error is, that their zone file is missing the . at the end, e.g., they intended to have a pointer to: westcomail.westco.net. but specified: westcomail.westco.net The latter syntax automatically appends the context of the current zone file which of course would be .0.165.12.in-addr.arpa. So - your help text could be much more specific. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist Request
Would you mind sharing your list? Mine, sadly enough, only has 8 rules currently, all except two are for mailing I get that are false positives. My current list is: MAILFROM 0 STARTSWITH [EMAIL PROTECTED] MAILFROM 0 CONTAINS @declude.com MAILFROM 0 CONTAINS @verisign.com MAILFROM 0 CONTAINS @verisign.net MAILFROM 0 CONTAINS @networksolutions.com MAILFROM 0 CONTAINS aarl.org MAILFROM 0 STARTSWITH bounce-ethnicjokes- BODY 0 CONTAINS Beliefnet, Inc. All rights reserved. So far the list only includes entries I have had problems in the past with, the verisign ones were whitelist entries, and I may refine them to specific mailings from them. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Bill Kaylor, Domain Mail Administrator Sent: Wednesday, September 18, 2002 11:16 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request That's what I did...using the address list, I give it a weight of -140, which is more than the total of ALL of my tests added together... Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 11:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request I decided I will start using filter file to whitelist legitimate mailing lists from listservers that also support spammers, since they seem to be the bulk of my false positives. I am giving them all 0 weight in the list, but will give the whole test a very high negative weight. I currently only have a few examples, since I am not that aggressive yet in my weights, but I welcome any suggestions. This should allow everyone to be much more aggressive. Maybe a version of the filter test that is a whitelist wouldn't be a bad idea. The filter tests allow for more flexability than the standard whitelist, leaving in many cases less room for error. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith Sent: Wednesday, September 18, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Rick, I completely agree with you. I don't like risking corruption to the global.cfg file through a ASP/CGI script error. Our idea is to turn up the weight tests and whitelist all of our customer base. The external whitelsit makes it easier to keep that update. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, September 18, 2002 10:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist Request Hi Bob, There are a few reasons I want/need the whitelist separate. One being that it will be easy to push a copy of the whitelist via ftp to each relevant system instead of manually or programaticly attaching to each server and editing the global.cfg. Secondly the global.cfg file is basicly static infomation aside from the whitelist, so interfacing with it programaticly seems like wasted effort to me. I don't believe Scott intended the whitelist to be used as much as it is but unfortunately the amount of legit servers needing whitelisting is enough to make the whitelist an important feature of Declude. The level of modification will just be adding and removing white and black list entries as well as word and phrase filter lines. We can do this via the web and email. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Robert Shubert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 17, 2002 5:57 PM Subject: Re: [Declude.JunkMail] Whitelist Request Rick, I too am planning to advance Declude administration to my users via a web application. Although I saw no reason why I couldn't programmaticaly change the global.cfg and other files. Could I ask your reasoning? Also, to what level of modification do you anticipate. The numerous options that declude allows for will make 100% remote editing quite a challange. Thanks for your input. Bob Rick Davidson wrote: Howdy Scott, Was wondering if you would consider creating a separate whitelist file for management purposes. Currently I have one customer with 4 Imail servers peered as a single domain across the country (US :-) I maintain master black lists and word filters on my workstation and use a batch file to FTP them to each server. Also, we are developing some web based management tools for Declude and would rather not have to programmaticly access the global.cfg file. Figured I would ask :-) Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the
RE: [Declude.JunkMail] Whitelist Request
What does networksolutions and verisign fail that you whitelist them? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 12:46 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Would you mind sharing your list? Mine, sadly enough, only has 8 rules currently, all except two are for mailing I get that are false positives. My current list is: MAILFROM 0 STARTSWITH [EMAIL PROTECTED] MAILFROM 0 CONTAINS @declude.com MAILFROM 0 CONTAINS @verisign.com MAILFROM 0 CONTAINS @verisign.net MAILFROM 0 CONTAINS @networksolutions.com MAILFROM 0 CONTAINS aarl.org MAILFROM 0 STARTSWITH bounce-ethnicjokes- BODY 0 CONTAINS Beliefnet, Inc. All rights reserved. So far the list only includes entries I have had problems in the past with, the verisign ones were whitelist entries, and I may refine them to specific mailings from them. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Bill Kaylor, Domain Mail Administrator Sent: Wednesday, September 18, 2002 11:16 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request That's what I did...using the address list, I give it a weight of -140, which is more than the total of ALL of my tests added together... Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 11:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request I decided I will start using filter file to whitelist legitimate mailing lists from listservers that also support spammers, since they seem to be the bulk of my false positives. I am giving them all 0 weight in the list, but will give the whole test a very high negative weight. I currently only have a few examples, since I am not that aggressive yet in my weights, but I welcome any suggestions. This should allow everyone to be much more aggressive. Maybe a version of the filter test that is a whitelist wouldn't be a bad idea. The filter tests allow for more flexability than the standard whitelist, leaving in many cases less room for error. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith Sent: Wednesday, September 18, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Rick, I completely agree with you. I don't like risking corruption to the global.cfg file through a ASP/CGI script error. Our idea is to turn up the weight tests and whitelist all of our customer base. The external whitelsit makes it easier to keep that update. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, September 18, 2002 10:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist Request Hi Bob, There are a few reasons I want/need the whitelist separate. One being that it will be easy to push a copy of the whitelist via ftp to each relevant system instead of manually or programaticly attaching to each server and editing the global.cfg. Secondly the global.cfg file is basicly static infomation aside from the whitelist, so interfacing with it programaticly seems like wasted effort to me. I don't believe Scott intended the whitelist to be used as much as it is but unfortunately the amount of legit servers needing whitelisting is enough to make the whitelist an important feature of Declude. The level of modification will just be adding and removing white and black list entries as well as word and phrase filter lines. We can do this via the web and email. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Robert Shubert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 17, 2002 5:57 PM Subject: Re: [Declude.JunkMail] Whitelist Request Rick, I too am planning to advance Declude administration to my users via a web application. Although I saw no reason why I couldn't programmaticaly change the global.cfg and other files. Could I ask your reasoning? Also, to what level of modification do you anticipate. The numerous options that declude allows for will make 100% remote editing quite a challange. Thanks for your input. Bob Rick Davidson wrote: Howdy Scott, Was wondering if you would consider creating a separate whitelist file for management purposes. Currently I have one customer with 4 Imail servers peered as a single domain across the country (US :-) I maintain master black lists and word filters on my workstation and use a batch file to FTP them to each server. Also, we are developing some web based management tools for Declude and would rather not have to programmaticly access
RE: [Declude.JunkMail] Whitelist Request
I use the RFC-Ignorant tests at a low weight of 3, but they fail them all. I have also had them fail BADHEADERS and SPAMHEADERS in the past. After missing a couple of important notifications from them (renewing my SSL certificate, had to reapply), I whitelisted them. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Darrell L. Sent: Wednesday, September 18, 2002 12:08 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request What does networksolutions and verisign fail that you whitelist them? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 12:46 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Would you mind sharing your list? Mine, sadly enough, only has 8 rules currently, all except two are for mailing I get that are false positives. My current list is: MAILFROM 0 STARTSWITH [EMAIL PROTECTED] MAILFROM 0 CONTAINS @declude.com MAILFROM 0 CONTAINS @verisign.com MAILFROM 0 CONTAINS @verisign.net MAILFROM 0 CONTAINS @networksolutions.com MAILFROM 0 CONTAINS aarl.org MAILFROM 0 STARTSWITH bounce-ethnicjokes- BODY 0 CONTAINS Beliefnet, Inc. All rights reserved. So far the list only includes entries I have had problems in the past with, the verisign ones were whitelist entries, and I may refine them to specific mailings from them. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Bill Kaylor, Domain Mail Administrator Sent: Wednesday, September 18, 2002 11:16 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request That's what I did...using the address list, I give it a weight of -140, which is more than the total of ALL of my tests added together... Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick Sent: Wednesday, September 18, 2002 11:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request I decided I will start using filter file to whitelist legitimate mailing lists from listservers that also support spammers, since they seem to be the bulk of my false positives. I am giving them all 0 weight in the list, but will give the whole test a very high negative weight. I currently only have a few examples, since I am not that aggressive yet in my weights, but I welcome any suggestions. This should allow everyone to be much more aggressive. Maybe a version of the filter test that is a whitelist wouldn't be a bad idea. The filter tests allow for more flexability than the standard whitelist, leaving in many cases less room for error. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith Sent: Wednesday, September 18, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist Request Rick, I completely agree with you. I don't like risking corruption to the global.cfg file through a ASP/CGI script error. Our idea is to turn up the weight tests and whitelist all of our customer base. The external whitelsit makes it easier to keep that update. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson Sent: Wednesday, September 18, 2002 10:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist Request Hi Bob, There are a few reasons I want/need the whitelist separate. One being that it will be easy to push a copy of the whitelist via ftp to each relevant system instead of manually or programaticly attaching to each server and editing the global.cfg. Secondly the global.cfg file is basicly static infomation aside from the whitelist, so interfacing with it programaticly seems like wasted effort to me. I don't believe Scott intended the whitelist to be used as much as it is but unfortunately the amount of legit servers needing whitelisting is enough to make the whitelist an important feature of Declude. The level of modification will just be adding and removing white and black list entries as well as word and phrase filter lines. We can do this via the web and email. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Robert Shubert [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 17, 2002 5:57 PM Subject: Re: [Declude.JunkMail] Whitelist Request Rick, I too am planning to advance Declude administration to my users via a web application. Although I saw no reason why I couldn't programmaticaly change the global.cfg and other files. Could I ask your reasoning? Also, to what level of modification do you anticipate. The numerous options that declude allows for will make 100% remote editing quite a challange. Thanks for your
RE: [Declude.JunkMail] OT- SpamReview the Kill File
Thanks for the information. I am fairly sure I am handling it according to Scott's recomendations but you never know. I will review the process again and make sure I am doing it right. I will then post the details so everyone knows how it works and can offer additional comments. Tom -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Allen Taylor Sent: Wednesday, September 18, 2002 11:41 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT- SpamReview the Kill File Importance: Low I must agree spamreview saves us alot of time in doing what the designer of the software orginally wrote it for. Reviewing spam and virus emails that are held in your folder is a snap with this software. Without it you have to open the file in and editor and go through each individual file looking for things. then manually move both files back into que with this product you just point click and thats it quick and efficient. I am sure the developer would take all constructive critisism and suggestions and try to implement a fix. My 2 cents Allen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview Update and From EMail Discussion
To SpamReview Users, v1.0.47 is now available. If you are already using v1.0.45 just click on File/Check for Program Updates to download the new version. Changes in this version. SpamReview now extracts the From email address for the list from the Q file if you have theShow Subject in List option selected in the Settings. Added a new field in the Settings so you can configure a string to use when trying to locate the From email address in the settings file. By default X-Declude-Sender: is used since Declude already includes this in the message if you have XSENDER ON set in the global.cfg file. No changes were made to the Add to Kill except to use the new string to locate the From email address. -- I hope this helps resolve some of the problems, questions, and confusion. -- A few weeks ago I started to update the web page. You can find help here. http://www.slsoft.com/spamreviewhelp.htm You can also find some of the following discussion regarding the From EMail address in the QA section. Here it is in text form. Q. Where does SpamReview get the From EMail address from? A. The From EMail Address can come from a couple of different places depending on how SpamReview is configured in the Settings. If you have selected the Show Subject in List option then the From EMail Address comes from the Q file using the Locate From EMail Address String: value in the Settings. If the Show Subject in List option is not selected the From EMail Address comes from the D file. In this case it may not be right but it's the best we have since we have not read the Q file yet. The Default Value for Locate From EMail Address String: is X-Declude-Sender:. You must have XSENDER ON in the global.cfg file for this to work. If you have setup your own custom method for doing this just make sure the resulting string has one and only one space between your text and the start of the email address. ex. MyFromEMailAddress: [EMAIL PROTECTED] Important Note: Regardless of the Settings, the From EMail address located by using the Locate From EMail Address String: is used when adding to the kill.lst file. There are no exceptions to this. If you have not properly matched the SpamReview Settings with the Declude JunkMail settings you will get a blank entry in the kill.lst file. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamReview Update and From EMail Discussion
Thanks for your work and effort Tom!!! We dropped some beer money in your pay pal account, enjoy. Have a great day! Rick Davidson Buckeye Internet Services www.buckeyeweb.com 440-953-1900 - - Original Message - From: Tom Schwarz [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, September 18, 2002 4:00 PM Subject: [Declude.JunkMail] SpamReview Update and From EMail Discussion To SpamReview Users, v1.0.47 is now available. If you are already using v1.0.45 just click on File/Check for Program Updates to download the new version. Changes in this version. SpamReview now extracts the From email address for the list from the Q file if you have theShow Subject in List option selected in the Settings. Added a new field in the Settings so you can configure a string to use when trying to locate the From email address in the settings file. By default X-Declude-Sender: is used since Declude already includes this in the message if you have XSENDER ON set in the global.cfg file. No changes were made to the Add to Kill except to use the new string to locate the From email address. -- I hope this helps resolve some of the problems, questions, and confusion. -- A few weeks ago I started to update the web page. You can find help here. http://www.slsoft.com/spamreviewhelp.htm You can also find some of the following discussion regarding the From EMail address in the QA section. Here it is in text form. Q. Where does SpamReview get the From EMail address from? A. The From EMail Address can come from a couple of different places depending on how SpamReview is configured in the Settings. If you have selected the Show Subject in List option then the From EMail Address comes from the Q file using the Locate From EMail Address String: value in the Settings. If the Show Subject in List option is not selected the From EMail Address comes from the D file. In this case it may not be right but it's the best we have since we have not read the Q file yet. The Default Value for Locate From EMail Address String: is X-Declude-Sender:. You must have XSENDER ON in the global.cfg file for this to work. If you have setup your own custom method for doing this just make sure the resulting string has one and only one space between your text and the start of the email address. ex. MyFromEMailAddress: [EMAIL PROTECTED] Important Note: Regardless of the Settings, the From EMail address located by using the Locate From EMail Address String: is used when adding to the kill.lst file. There are no exceptions to this. If you have not properly matched the SpamReview Settings with the Declude JunkMail settings you will get a blank entry in the kill.lst file. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Common items in Spam addresses
Here's another one that I've been using for a while in addition to the ones you list: -SENTTO SENTTO1 SENTTO- SENTTO2 @SENTTO SENTTO3 SENTTO@ SENTTO4 .SENTTO SENTTO5 SENTTO. SENTTO6 ...and today I saw a www- come through which I am considering adding. Try these... WWW.WWW1 @WWWWWW2 WWW-WWW3 -WWWWWW4 Regards, Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sample config
but i was hoping someone would be willing to share a sample of there golbal.cfg and $default$.junkmail. I think someone asked this a week ago but i could not fine it or if it was replied to. Here is an example config file: --- LOGFILE D:\imail\spool\dec.log LOGLEVELLOW HOP 0 CONSOLE OFF XINHEADER X-Note: This E-mail was scanned for spam. XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]). XINHEADER X-Test-Failed: %TESTSFAILED% XOUTHEADER X-Note: This E-mail was scanned for spam. XSENDER ON XSPOOLNAME ON LOOSENSPAMHEADERS OFF WHITELIST IP 206.181.98 WHITELIST IP 206.181.99 WHITELIST FROM.ibm.com WHITELIST FROM@ibm.com WHITELIST FROMmicrosoft.com WHITELIST FROMciscomessage.com WHITELIST FROMipswitch.com WHITELIST FROMdeclude.com WHITELIST FROM netsol.com WHITELIST FROMpassport.com WHITELIST FROMziffdavis.com WHITELIST FROMntbugtraq.com OSSRC ip4rrelays.osirusoft.com127.0.0.4 12 0 OSSMART ip4rrelays.osirusoft.com127.0.0.5 12 0 SPAMCOP ip4rbl.spamcop.net 127.0.0.2 12 0 MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 12 0 MONKEYPROXIES ip4rproxies.relays.monkeys.com * 12 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 2 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 1 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 1 0 BASE64 base64 x x 4 0 BADHEADERS badheaders x x 4 0 HELOBOGUS helovalid x x 4 0 MAILFROMenvfrom x x 4 0 REVDNS revdnsexistsx x 4 0 ROUTING spamrouting x x 4 0 SPAMHEADERS spamheaders x x 4 0 PERCENT percent x x 15 0 KFROM fromfiled:\imail\declude\fromfile.txt x 15 0 BFROM fromfiled:\imail\declude\wfile.txt x 4 0 MFROM fromfiled:\imail\declude\mfile.txt x 4 0 WEIGHTRANGE10-14 weightrangex x 10 14 WEIGHT15 weight x x 15 0 CATCHALLMAILS catchallmails x x 0 0 --- Use it at your own risk, although it works for us. Here is an example junk file: --- KFROM HOLD or DELETE - you must choose WEIGHT15HOLD or DELETE - you must choose WEIGHTRANGE10-14 HOLD BFROM WARN MFROM WARN OSSRC WARN OSSMART WARN SPAMCOP WARN MONKEYFORMMAIL WARN MONKEYPROXIES WARN DSN WARN NOABUSE WARN NOPOSTMASTERWARN BASE64 WARN BADHEADERS WARN HELOBOGUS WARN MAILFROMWARN PERCENT HOLD or DELETE - you must choose REVDNS WARN ROUTING WARN SPAMHEADERS WARN --- Regards, Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamReview Update and From EMail Discussion
Reply to: Tom Schwarz Re: [Declude.JunkMail] SpamReview Update and From EMail Discussion on Wednesday 3:00:02 PM This feature to add to kill still fails here. In place of X-Declude-Sender: I put X-Note-Real-Mail-From: Wondering what I might be doing wrong? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T To SpamReview Users, T v1.0.47 is now available. If you are already using v1.0.45 just click on T File/Check for Program Updates to download the new version. T Changes in this version. T SpamReview now extracts the From email address for the list from the Q T file if you have theShow Subject in List option selected in the Settings. T Added a new field in the Settings so you can configure a string to use when T trying to locate the From email address in the settings file. By default T X-Declude-Sender: is used since Declude already includes this in the T message if you have XSENDER ON set in the global.cfg file. T No changes were made to the Add to Kill except to use the new string to T locate the From email address. T -- T I hope this helps resolve some of the problems, questions, and confusion. T -- T A few weeks ago I started to update the web page. You can find help here. T http://www.slsoft.com/spamreviewhelp.htm T You can also find some of the following discussion regarding the From T EMail address in the QA section. Here it is in text form. T Q. Where does SpamReview get the From EMail address from? T A. The From EMail Address can come from a couple of different places T depending on how SpamReview is configured in the Settings. If you have T selected the Show Subject in List option then the From EMail Address T comes from the Q file using the Locate From EMail Address String: value T in the Settings. If the Show Subject in List option is not selected the T From EMail Address comes from the D file. In this case it may not be T right but it's the best we have since we have not read the Q file yet. T The Default Value for Locate From EMail Address String: is T X-Declude-Sender:. You must have XSENDER ON in the global.cfg file for T this to work. If you have setup your own custom method for doing this just T make sure the resulting string has one and only one space between your text T and the start of the email address. ex. MyFromEMailAddress: T [EMAIL PROTECTED] T Important Note: Regardless of the Settings, the From EMail address located T by using the Locate From EMail Address String: is used when adding to the T kill.lst file. There are no exceptions to this. If you have not properly T matched the SpamReview Settings with the Declude JunkMail settings you will T get a blank entry in the kill.lst file. T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. The archives can be found T at http://www.mail-archive.com. T -- T ActivatorMail(tm) ver.082302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Date Header wrong - REALLY?
Scott- why do I get http://www.declude.com/tools/header.php?code=c020020c for this: Received: from mta541.mail.yahoo.com [216.136.131.23] by hm-software.com (SMTPD32-7.07) id A0461AEF00BE; Wed, 18 Sep 2002 17:29:42 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Loop: [EMAIL PROTECTED] Subject: SPAM: [See Headers] Delivery failure Message-Id: [EMAIL PROTECTED] X-Declude-Note: This E-mail was sent from a broken mail client [c020020c]. See: http://www.declude.com/tools/header.php?code=c020020c X-RBL-Warning: This E-mail has headers consistent with spam [c020020c]. See: http://www.declude.com/tools/header.php?code=c020020c X-Declude: Version 1.60; Df0461aef00be8b36.SMD from mta541.mail.yahoo.com [216.136.131.23] X-Declude: Failed BADHEADERS, SPAMHEADERS, WEIGHT8 [8] Return-Path: Date: Wed, 18 Sep 2002 17:29:49 -0400 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 896287752 Message from yahoo.de. Unable to deliver message to the following address(es). [EMAIL PROTECTED]: This user doesn't have a yahoo.de account ([EMAIL PROTECTED]) [EMAIL PROTECTED]: This user doesn't have a yahoo.de account ([EMAIL PROTECTED]) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Date Header wrong - REALLY?
why do I get http://www.declude.com/tools/header.php?code=c020020c for this: The easiest way is to look at the headers that are sent to IMail: From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Loop: [EMAIL PROTECTED] Subject: SPAM: [See Headers] Delivery failure From this, you can see that it is missing the Date: header. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Date Header wrong - REALLY?
My guess is that it didn't have any date header. Imail automatically adds a Date header if it is missing. /Eje Wednesday, September 18, 2002, 5:02:44 PM, you wrote: AS Scott- AS why do I get http://www.declude.com/tools/header.php?code=c020020c for AS this: AS Received: from mta541.mail.yahoo.com [216.136.131.23] by hm-software.com AS (SMTPD32-7.07) id A0461AEF00BE; Wed, 18 Sep 2002 17:29:42 -0400 AS From: [EMAIL PROTECTED] AS To: [EMAIL PROTECTED] AS X-Loop: [EMAIL PROTECTED] AS Subject: SPAM: [See Headers] Delivery failure AS Message-Id: [EMAIL PROTECTED] AS X-Declude-Note: This E-mail was sent from a broken mail client [c020020c]. AS See: http://www.declude.com/tools/header.php?code=c020020c AS X-RBL-Warning: This E-mail has headers consistent with spam [c020020c]. See: AS http://www.declude.com/tools/header.php?code=c020020c AS X-Declude: Version 1.60; Df0461aef00be8b36.SMD from mta541.mail.yahoo.com AS [216.136.131.23] AS X-Declude: Failed BADHEADERS, SPAMHEADERS, WEIGHT8 [8] AS Return-Path: AS Date: Wed, 18 Sep 2002 17:29:49 -0400 AS X-RCPT-TO: [EMAIL PROTECTED] AS Status: U AS X-UIDL: 896287752 AS Message from yahoo.de. AS Unable to deliver message to the following address(es). AS [EMAIL PROTECTED]: AS This user doesn't have a yahoo.de account ([EMAIL PROTECTED]) AS [EMAIL PROTECTED]: AS This user doesn't have a yahoo.de account ([EMAIL PROTECTED]) AS --- AS [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] AS --- AS This E-mail came from the Declude.JunkMail mailing list. To AS unsubscribe, just send an E-mail to [EMAIL PROTECTED], and AS type unsubscribe Declude.JunkMail. The archives can be found AS at http://www.mail-archive.com. AS --- AS [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Date Header wrong - REALLY?
So are you inferring that either Imail or the client's Exchange Server inserted that DATE header on the bottom? Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, September 18, 2002 06:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Date Header wrong - REALLY? why do I get http://www.declude.com/tools/header.php?code=c020020c for this: The easiest way is to look at the headers that are sent to IMail: From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Loop: [EMAIL PROTECTED] Subject: SPAM: [See Headers] Delivery failure From this, you can see that it is missing the Date: header. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Date Header wrong - REALLY?
So are you inferring that either Imail or the client's Exchange Server inserted that DATE header on the bottom? Correct. Any headers below the first header that Declude adds are added by IMail during the delivery process (this includes the Date: header that IMail adds). Any headers just above the first header that Declude adds may have been added before the E-mail reached IMail, or may have been added by IMail (this includes the Message-ID: header that IMail adds). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Date Header wrong - REALLY?
Okay, I knew that Imail added Message ID headers - I did NOT know that it also added DATE headers. Is there a knowledge base entry listing the headers that Imail injects? Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Date Header wrong - REALLY?
Is there a knowledge base entry listing the headers that Imail injects? No. But these are they, AFAIK: Received: Message-Id: From: Date: X-RCPT-TO: Status: X-UIDL: Note that messages must have basic RFC822-style header and body sections in order for these headers to be injected in. Unformatted messages will only get Received: and X-UIDL: injected, and will likely be unreadable in a standard MUA because the intended data will be encapsulated by the added headers. -Sandy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
