[Declude.JunkMail] Negative Weight On A Domain Name
If I was going to setup Negative Weight on certain domains instead of white listing them would I use just a standard sender blacklist with negative weight i.e. DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 Then inside the file I would use @mail.southwest.com Since the Declude sender is X-Declude-Sender: [EMAIL PROTECTED] [12.5.136.142] Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Negative Weight On A Domain Name
If I was going to setup Negative Weight on certain domains instead of white listing them would I use just a standard sender blacklist with negative weight i.e. DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 Then inside the file I would use @mail.southwest.com Since the Declude sender is X-Declude-Sender: [EMAIL PROTECTED] [12.5.136.142] In this case, the only change I would make is to use -5 instead of 5 in the test definition, so that it will lower the weight: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
Just for clarification, The first weight is the weight applied if the test is failed, and the second weight is if the test is passed. In my case I would have @mail.southwest.com entered in the file and I want to decrease the weight of the mail if the message is from the @mail.southwest.com domain. DecreaseWeight fromfile C:\IMail\Declude\AddressesToDecWeightOn.txt x -5 0 Is this correct? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, January 21, 2003 9:39 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Negative Weight On A Domain Name If I was going to setup Negative Weight on certain domains instead of white listing them would I use just a standard sender blacklist with negative weight i.e. DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 Then inside the file I would use @mail.southwest.com Since the Declude sender is X-Declude-Sender: [EMAIL PROTECTED] [12.5.136.142] In this case, the only change I would make is to use -5 instead of 5 in the test definition, so that it will lower the weight: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
If I was going to setup Negative Weight on certain domains instead of white listing them would I use just a standard sender blacklist with negative weight DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 Then inside the file I would use @mail.southwest.com Since the Declude sender is X-Declude-Sender: [EMAIL PROTECTED] [12.5.136.142] In this case, the only change I would make is to use -5 instead of 5 in the test definition, so that it will lower the weight: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 Darrell, a little confusion here. Do you want to have any message from @mail.southwest.com get added a negative weight? And you are going to list that in a file called badaddresses.txt? If so, shouldn't that be called goodaddresses.txt? If you want to add a negative weight to a line listed in the file, I believe it should be: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x -5 0 If you want to add a negative weight to an address NOT listed in the file, then it would be: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 -5 Scott? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
The first weight is the weight applied if the test is failed, and the second weight is if the test is passed. Ah, I see what you're getting at. It gets confusing because there are two meanings of negative weight (negative meaning that the E-mail didn't fail the spam test, or negative as in a negative number added to the weight). Assuming @mail.southwest.com is in the blacklist: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 The above would cause E-mail from @mail.southwest.com to have 0 points, and mail from any other address would have 5 points. Instead, I'm guessing you would want: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x -5 0 With this, 5 points will be deducted from mail from @mail.southwest.com, but other mail won't be affected. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need Some Advise
Discussion being continued off-list unless anyone else is interested.. I'd be interested, but could be included off-list if nobody else is... Jeff Cochran City of Naples, Florida --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Negative Weight On A Domain Name
Scott, Thank you for the clarification, the end of your message was what the intended behavior I was looking for. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, January 21, 2003 10:21 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Negative Weight On A Domain Name The first weight is the weight applied if the test is failed, and the second weight is if the test is passed. Ah, I see what you're getting at. It gets confusing because there are two meanings of negative weight (negative meaning that the E-mail didn't fail the spam test, or negative as in a negative number added to the weight). Assuming @mail.southwest.com is in the blacklist: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x 0 5 The above would cause E-mail from @mail.southwest.com to have 0 points, and mail from any other address would have 5 points. Instead, I'm guessing you would want: DereaseWeight fromfile C:\IMail\Declude\badaddresses.txt x -5 0 With this, 5 points will be deducted from mail from @mail.southwest.com, but other mail won't be affected. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Need Some Advise
I would also be interested, either on or off list. Justin Moose Information Technology Manager Sioux Valley Energy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, January 21, 2003 10:51 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Need Some Advise Discussion being continued off-list unless anyone else is interested.. I'd be interested, but could be included off-list if nobody else is... Jeff Cochran City of Naples, Florida --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] JunkMail log entry questions
and I was wondering why the same entry is getting repeated multiple time. I am running Declude v1.66i7 with my log level set to low. Multiple recipients? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] JunkMail log entry questions
Okay, thanks for the explanations. Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, January 21, 2003 9:38 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] JunkMail log entry questions Scott, I found the following entries in my JunkMail log file. First, I have many entries like the following and was wondering why a DNS lookup was done on an IP address that is whitelisted: == 01/21/2003 07:20:27 Q65310f86012666ad WARNING: DNS server 206.114.137.8 returned a SERVER FAILURE error for MX or A for local.com. The problem here is that your DNS server is reporting that it is failing. However, in most cases it seems that these warnings are caused by DNS servers that pass through a server failure error from a remote DNS server (this is an example of how RFCs can be flawed -- they say that this message is supposed to be reported only when there is a failure on the DNS server returning the response, but it doesn't say how DNS servers should respond if they receive this error from another mailserver). The whitelisting in many cases will occur after the E-mail is scanned, which is why the DNS lookup occurred for this E-mail. Second, I also have entries in the log file like this: == 01/21/2003 08:06:21 Q6ffa06980092867d L0 Message OK 01/21/2003 08:06:21 Q6ffa06980092867d L0 Message OK ... == and I was wondering why the same entry is getting repeated multiple time. I am running Declude v1.66i7 with my loglevel set to low. The multiple entries will occur if there are multiple recipients. There is a bug with the latest interim release that will cause the L0 to always appear -- it should increment for each log file entry (L1 meaning the first recipient for an incoming E-mail, L2 meaning the second recipient, and so forth). This behavior will be fixed for the next release. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bounce Message and the localhost variable
I have domains that are local that I host and several domains that I am a gateway for. Now when a message gets bounced for a local domain the following line works fine. It will substitute the %localhost% for the domain that the message was addressed to. If you feel this message is in error please forward this message to postmaster@%LOCALHOST% However, for domains I gateway for it does not substitute the correct the domain in that line. It always defaults to the mail servers primary domain name instead of the domain in which the mail was addressed to which is not the desired behavior. Any thoughts? Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bounce Message and the localhostvariable
If you feel this message is in error please forward this message to postmaster@%LOCALHOST% However, for domains I gateway for it does not substitute the correct the domain in that line. It always defaults to the mail servers primary domain name instead of the domain in which the mail was addressed to which is not the desired behavior. That was actually the intended behavior, as Declude JunkMail would put i the Official Host Name of the server if neither the sender nor the recipient were local domains. The problem in this case is that Declude JunkMail can't figure out which domain is local (the sender or the recipient), so it can't tell which address to use for %LOCALHOST%. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Base64 encoded
I know in the past it was discussion about legit base64 usage in mail. I found what seems to be a legit e-mail where the mail client is base64 encoding the message. Received: from mail.XX.com [12.28.XX.XXX] by imail.fament.com with ESMTP (SMTPD32-7.13) id A4EE26B0366; Wed, 15 Jan 2003 09:57:34 -0600 Received: from [10.1.102.202] by mail.XX.XXX with SMTP (QuickMail Pro Server for Mac 3.0.1); 15-Jan-2003 09:57:19 -0600 Date: 15 Jan 2003 09:45:15 -0600 Message-ID: [EMAIL PROTECTED] From: X X [EMAIL PROTECTED] Subject: Fwd: To: X XX [EMAIL PROTECTED] X-Mailer: QuickMail Pro 3.0 (Mac) X-Priority: 3 MIME-Version: 1.0 Reply-To: X X [EMAIL PROTECTED] Content-Type: multipart/mixed; boundary=50524848535754575554===1 X-RBL-Warning: BASE64: A binary encoded text or HTML section was found in this E-mail. X-RBL-Warning: WEIGHT10: Weight of 20 reaches or exceeds the limit of 10. X-Tests-Failed: REVDNS, BASE64, WEIGHT10, WEIGHT20. X-Note: Total spam weight of this E-mail is 20. --50524848535754575554===1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=US-Ascii regular text message (seems to be a chainmail) MSN 8: advanced junk mail protection and 2 months FREE* http://g.msn.com/= 8HMNEN/2017 --50524848535754575554===1 Content-Transfer-Encoding: base64 Content-Type: text/html; name=Text00.htm; x-mac-creator=556DC536; x-mac-type=54455854 PGh0bWw+PGRpdiBzdHlsZT0nYmFja2dyb3VuZC1jb2xvcjonPjxESVY+DQo8UD48QlI+PFVuZGlz Y2xvc2VkLVJlY2lwaWVudD rest of the base64 is cut off. Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 8:57:29 PM Scott, do you know when these features might be in beta, including the notification? We cannot use a global setup or most of our users would not get mail. We are anxious to see this work. grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - How would this be implemented on a user or domain basis? R The AUTOWHITELIST option is a global option, and can not be done on a R per-user or per-domain basis. I'm assuming this auto detects the right path regardless of the drive the account resides on? R That is correct. This is a very interesting feature. R I think so too. :) R -Scott -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Base64 encoded
I know in the past it was discussion about legit base64 usage in mail. I found what seems to be a legit e-mail where the mail client is base64 encoding the message. The question here is what legitimate means. Does it mean that it is a legitimate E-mail, which uses base64 encoding for no apparent reason (which we are not too concerned about, as most people only use the BASE64 test towards the weighting system), or is it a legitimate mail that has a legitimate reason for using base64 encoding (which we would care about, as it could indicate that there are false positives that can't be prevented)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Base64 encoded
Well. When I say legit I reference in that it is not a spam mail but a regular mail communication to a user that been sent with a regular mail program. Like you using Eudora Version 5.1 to send a e-mail message directly to me. This person was using QuickMail Pro 3 (mac) to send a e-mail to a client on our service. Reason for doing base64 ? None except poor software engineering and client more then likely using default settings because they don't know better. There is no reason really for the base64 just that it does it anyways in poor practice. I personally put in a word filter rule that now gives this X-mailer a somewhat negative weight to compensate for it's poor e-mail sending behavior. Wasn't sure if anyone ever found a e-mail client that did post standard message in base64 besides what we frequently see from spammers with advertisment junk in it. / Eje Tuesday, January 21, 2003, 2:42:41 PM, you wrote: I know in the past it was discussion about legit base64 usage in mail. I found what seems to be a legit e-mail where the mail client is base64 encoding the message. RSP The question here is what legitimate means. RSP Does it mean that it is a legitimate E-mail, which uses base64 encoding for RSP no apparent reason (which we are not too concerned about, as most people RSP only use the BASE64 test towards the weighting system), or is it a RSP legitimate mail that has a legitimate reason for using base64 encoding RSP (which we would care about, as it could indicate that there are false RSP positives that can't be prevented)? RSP -Scott RSP --- RSP [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP --- RSP This E-mail came from the Declude.JunkMail mailing list. To RSP unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP type unsubscribe Declude.JunkMail. The archives can be found RSP at http://www.mail-archive.com. RSP --- RSP [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 2:58:10 PM I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Scott, do you know when these features might be in beta, including the notification? We cannot use a global setup or most of our users would not get mail. We are anxious to see this work. grin R I'm not sure specifically which feature(s) you are referring to? R The AUTOWHITELIST option is available as an interim release now, and should R be available as a beta within a week or so. R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Base64 encoded
Wasn't sure if anyone ever found a e-mail client that did post standard message in base64 besides what we frequently see from spammers with advertisement junk in it. Outlook Web Access on Exchange 2000. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... Rodger, the NoXMail add on to Declude would provide the functions I think you are looking for. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] Base64 encoded
Thank you I had missed the OWA I added that one myself. Thanks. Tuesday, January 21, 2003, 3:33:06 PM, you wrote: CA As per John's earlier research on OWA as a client, and Eje's report I now CA use this in one of my filter text files: CA #Nov-29-2002 AC Cancel the BASE64 weight when the client was CA # OWA for Exchange 2000 and Enterprise CA HEADERS -4 CONTAINS V6.0.5762.3 CA HEADERS -4 CONTAINS V6.0.6249.0 CA #Jan-21-2003 AC Cancel the BASE64 weight another product that CA # happens to encode body test as BASE64 CA HEADERS -4 CONTAINS QuickMail Pro Server for Mac CA Andrew 8) EG Wasn't sure if anyone ever found a e-mail client that did post EG standard message in base64 besides what we frequently see from EG spammers with advertisement junk in it. JT Outlook Web Access on Exchange 2000. CA --- CA [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] CA --- CA This E-mail came from the Declude.JunkMail mailing list. To CA unsubscribe, just send an E-mail to [EMAIL PROTECTED], and CA type unsubscribe Declude.JunkMail. The archives can be found CA at http://www.mail-archive.com. CA --- CA [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... We have not decided yet whether to add per-user or per-domain settings to the AUTOWHITELIST option (our original thought is that almost everyone would want to use it if there is no performance hit). and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... Ah, I remember now. I'm doing some testing now with the following in the global.cfg file: ALLMAILS1 weight x x -10 0 ALLMAILS2 weight x x -10 0 and the following in the .junkmail file: ALLMAILS1 ATTACH ALLMAILS2 ALERT which should accomplish this. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: John Tolmachoff Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 3:40:53 PM Is there a URL for this. Sorry if I don't have it, but I am on many lists and sometimes I delete something that maybe I should not have. g Thanks again, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... J Rodger, the NoXMail add on to Declude would provide the functions I think J you are looking for. J John Tolmachoff MCSE, CSSA J IT Manager, Network Engineer J RelianceSoft, Inc. J Fullerton, CA 92835 J www.reliancesoft.com J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. The archives can be found J at http://www.mail-archive.com. J -- J ActivatorMail(tm) ver.122102 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
I'm doing some testing now with the following in the global.cfg file: ALLMAILS1 weight x x -10 0 ALLMAILS2 weight x x -10 0 and the following in the .junkmail file: ALLMAILS1 ATTACH ALLMAILS2 ALERT which should accomplish this. The testing seems to show that this will work just fine. The ALLMAILS1/ALLMAILS2 tests will catch all E-mail with a weight of -10 or higher (meaning virtually all E-mail, unless you have weights that go below -10). This is used instead of the CATCHALLMAILS test, since the CATCHALLMAILS test won't get whitelisted. Having the two separate test names allows two actions to be taken. In this case, the ALERT action causes a bounce-like E-mail to be sent to the sender of the E-mail (but still allows the E-mail to be delivered to the recipient). The ATTACH action then changes the E-mail so that you can format it as you like, with the \IMail\Declude\spamattach.eml file (you could remove the message body, and perhaps adding instructions on how to whitelist the E-mail). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?
Is there a URL for this. Sorry if I don't have it, but I am on many lists and sometimes I delete something that maybe I should not have. g It is still in beta right now. I think one of the Bills one this list can explain more, as he is using this option. http://www.noxmail.com/ http://www.noxmail.com/documentation.htm http://www.noxmail.com/Imail/Whitelists.pdf John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] Base64 encoded
While I never followed up or asked any ones opinion, not that it has come up again, read through the attached text file and see what you think. I think, Ugh. M$ at it again, and their faithful admins recite their inconsistent rhetoric as if it's perfectly normal. As you point out, their light MUA uses Quoted-Printable by default, their full-fledged MUAs use None by default, and their web MUA uses Base64 by default. What I'd be most afraid of is that OWA is simply the first wave, and that soon they will make Base64 the default for all their apps, thereby killing the test entirely. -Sandy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[4]: [Declude.JunkMail] Base64 encoded
What I'd be most afraid of is that OWA is simply the first wave, and that soon they will make Base64 the default for all their apps, thereby killing the test entirely. Oh great Sandy, just by you saying that it will probably happen. :(( John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Our filter fromfiles.
Title: Message Hi; In case you are interested, we have created a simple Access database that contains all of our entries in for our fromfile and filter files. Since it is all in the database we thought we can simply replicate it with the web site and provide it to all to use or consider. You may want to visit: http://www.ClickandPledge.com/Support/Mail The categories are all separated since we have a different file for each filter type. Just for the records: We hold on weight 20 so all weights are based on this weight. FreeeMail list - should not be used as a blacklist but a weight list. We add 5 to this list. This list does not contain Hotmail.com or Yahoo.com. It has other (Yahoo.com.tw) domains. Hope it helps... Regards, Kami
Re: [Declude.JunkMail] Base64 encoded
Eje, I use QuickMail on a Mac and Base64 is used as the encoding type by two of their standard configs, but only for attachments. Base64 encoding for the message body requires a manual change. What most likely happened is that the sender in question was swapping around encoding types trying to get an attachment to go through and got sloppy. Dan On Tuesday, January 21, 2003 13:14, Eje Gustafsson [EMAIL PROTECTED] wrote: Well. When I say legit I reference in that it is not a spam mail but a regular mail communication to a user that been sent with a regular mail program. Like you using Eudora Version 5.1 to send a e-mail message directly to me. This person was using QuickMail Pro 3 (mac) to send a e-mail to a client on our service. Reason for doing base64 ? None except poor software engineering and client more then likely using default settings because they don't know better. There is no reason really for the base64 just that it does it anyways in poor practice. I personally put in a word filter rule that now gives this X-mailer a somewhat negative weight to compensate for it's poor e-mail sending behavior. Wasn't sure if anyone ever found a e-mail client that did post standard message in base64 besides what we frequently see from spammers with advertisment junk in it. / Eje Tuesday, January 21, 2003, 2:42:41 PM, you wrote: I know in the past it was discussion about legit base64 usage in mail. I found what seems to be a legit e-mail where the mail client is base64 encoding the message. RSP The question here is what legitimate means. RSP Does it mean that it is a legitimate E-mail, which uses base64 encoding for RSP no apparent reason (which we are not too concerned about, as most people RSP only use the BASE64 test towards the weighting system), or is it a RSP legitimate mail that has a legitimate reason for using base64 encoding RSP (which we would care about, as it could indicate that there are false RSP positives that can't be prevented)? RSP -Scott RSP --- RSP [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP --- RSP This E-mail came from the Declude.JunkMail mailing list. To RSP unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP type unsubscribe Declude.JunkMail. The archives can be found RSP at http://www.mail-archive.com. RSP --- RSP [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Base64 encoded
Hello Dan, I see. Thanks for the clearification. This particular message was a html encoded message where the html part got encoded. Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 - Your Full Time Professionals - eBay UserID : macahan -- DP Eje, DP I use QuickMail on a Mac and Base64 is used as the encoding type by two of their standard configs, but only for attachments. Base64 encoding for the message body requires a manual change. What DP most likely happened is that the sender in question was swapping around encoding types trying to get an attachment to go through and got sloppy. DP Dan DP On Tuesday, January 21, 2003 13:14, Eje Gustafsson [EMAIL PROTECTED] wrote: Well. When I say legit I reference in that it is not a spam mail but a regular mail communication to a user that been sent with a regular mail program. Like you using Eudora Version 5.1 to send a e-mail message directly to me. This person was using QuickMail Pro 3 (mac) to send a e-mail to a client on our service. Reason for doing base64 ? None except poor software engineering and client more then likely using default settings because they don't know better. There is no reason really for the base64 just that it does it anyways in poor practice. I personally put in a word filter rule that now gives this X-mailer a somewhat negative weight to compensate for it's poor e-mail sending behavior. Wasn't sure if anyone ever found a e-mail client that did post standard message in base64 besides what we frequently see from spammers with advertisment junk in it. / Eje Tuesday, January 21, 2003, 2:42:41 PM, you wrote: I know in the past it was discussion about legit base64 usage in mail. I found what seems to be a legit e-mail where the mail client is base64 encoding the message. RSP The question here is what legitimate means. RSP Does it mean that it is a legitimate E-mail, which uses base64 encoding for RSP no apparent reason (which we are not too concerned about, as most people RSP only use the BASE64 test towards the weighting system), or is it a RSP legitimate mail that has a legitimate reason for using base64 encoding RSP (which we would care about, as it could indicate that there are false RSP positives that can't be prevented)? RSP -Scott RSP --- RSP [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP --- RSP This E-mail came from the Declude.JunkMail mailing list. To RSP unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP type unsubscribe Declude.JunkMail. The archives can be found RSP at http://www.mail-archive.com. RSP --- RSP [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. DP --- DP [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] DP --- DP This E-mail came from the Declude.JunkMail mailing list. To DP unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DP type unsubscribe Declude.JunkMail. The archives can be found DP at http://www.mail-archive.com. DP --- DP [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
