Re: [Declude.JunkMail] KillListGen Utility
At 01:00 AM 06/09/2003, David Dodell wrote: Huh? Link is broken? You should be able to get it here: http://www.nerosoft.com/Download/KillListGenInst.exe Thanks Scott. I was following a link from the Declude website Scott, can you please fix the link on the Declude website? It's pointing to the wrong place. What address were you sending email to? On your main webpage it shows [EMAIL PROTECTED] but it is really linked to [EMAIL PROTECTED] ... and that bounces user unknown. Thanks, got that fixed now. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com
Re: [Declude.JunkMail] KillListGen Utility
Huh? Link is broken? You should be able to get it here: http://www.nerosoft.com/Download/KillListGenInst.exe Thanks Scott. I was following a link from the Declude website Scott, can you please fix the link on the Declude website? It's pointing to the wrong place. It's fixed now. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Fwd:
Is anyone doing anything about these messages. I am getting more and more by the day! Thanks, Kevin Received: from mail.stevenstransport.com [10.100.1.17] by mail.stevenstransport.com (SMTPD32-6.00) id AD69710A015C; Sun, 08 Jun 2003 14:24:25 -0500 Received: FROM declude.com BY mail.stevenstransport.com ; Sun Jun 08 14:24:24 2003 -0500 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [cc200200]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [cc200200]. X-RCPT-TO: [EMAIL PROTECTED] Date: Sun, 8 Jun 2003 14:24:26 -0500 X-UIDL: 2210 Status: U From: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fwd:
Is anyone doing anything about these messages. I am getting more and more by the day! Unfortunately: Received: from mail.stevenstransport.com [10.100.1.17] by mail.stevenstransport.com (SMTPD32-6.00) id AD69710A015C; Sun, 08 Jun 2003 14:24:25 -0500 Received: FROM declude.com BY mail.stevenstransport.com ; Sun Jun 08 14:24:24 2003 -0500 You're running a mailserver that hides the IP address of the remote mailserver. Although: From: [EMAIL PROTECTED] it would *appear* that this probably did come from us, it could also be spam that just happened to use [EMAIL PROTECTED] as a return address. I would recommend switching that poor mailserver to IMail (or any other mailserver that will include the IP address in the headers, which is almost all of them). There was one post to this list Friday that ended up going out as a blank file (because of someone who sent a *huge* attachment that wasn't meant for the list, and the file had to be deleted), but that was only 1 E-mail. If you received it many times, it sounds like that poor mailserver may not handle the situation of a blank E-mail properly. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] spamchk.exe
Hello, We are using Junkmail version 1.60. And we get these error messages every once in awhile which stops the server from sending mail out because of these error messages. Has anyone else run into this and what did you do to correct this.. Application popup: spamchk.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. Application popup: smtp32.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. Application popup: smtpd32.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. Thanks, Adam Adam Hobach CyberLynk Sales/Support [EMAIL PROTECTED] or [EMAIL PROTECTED] ADDITIONAL CYBERLYNK SERVICES CyberLynk GroupLynk - This is a program that can provide home dialup connections for your employees. You would get a login/password to our website where you can add/modify dialup accounts as you please. CyberLynk Toll-Free Dialup - This account includes the first 60 minutes free and then you pay .13cents per minute after that. This is a great way to stay connected while on those important business or personal trips. - For more information please contact me. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Hi all, I want to run this by everyone before I do something potentially stupid...I have occasions where good yahoo.com mail fails a FILTER or SNIFFER test and along with failing NOPOSTMASTER and NOABUSE as yahoo always does, this throws it over my bounce threshhold. I'd like to ward this off by using SPAMDOMAINS as a way to reward legitimate mail from yahoo.com mail servers. Does this make sense? I have NOPOSTMASTER giving a weight of 3, NOABUSE giving 3, most SNIFFER and FILTER tests don't give more than an additional 5 or 6. So failing all of these gives 12 which bounces. And this happens when it shouldn't from time to time with yahoo. I'm thinking about giving a default -5 weight using FILTER to anything from @yahoo.com and then giving a +5 to anything that fails SPAMDOMAINS for yahoo.com. This way any legit mail from yahoo.com mail servers gets a -5 where anything NOT from yahoo.com servers gets -5 and +5 and is no better or worse off. The major benefit here is that legitimate mail from yahoo.com has an extra buffer of 5 points to allow it to fail one more FILTER or SNIFFER test on those occasions where it does happen. Is my logic solid here? Anything I'm missing? Thanks! --Todd. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SMTP authorized versus random email
Eric originally said this would be added in v7.14, but it was not. Perhaps it was added in v8.0; however, we're not running 8.0 yet so I don't know if it was actually added or not. But if it was, this would make it possible for Scott to add a test that flags authenticated SMTP sessions. Bill, no A line here: QF:\Spool\D9c4a15ca01a25261.SMD Hmail.eservicesforyou.net WC:\IMail E0, S[EMAIL PROTECTED] NRCPT TO:[EMAIL PROTECTED] [EMAIL PROTECTED] Running Version 8. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamIPs Test Idea
One other thing to think about. My workstation is in my home office. My mail server is at my NOC. I have a VPN setup between my home office and the NOC for administration of the servers. Any mail I send shows a remote IP of my private address, sense my mail server received it through the VPN. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Is my logic solid here? Anything I'm missing? Why not configure it like SPAMDOMAINS spamdomains C:\IMail\Declude\sd.txt x 5 -5 This will give +5 points to any mail having a sender-domain listet in sd.txt and failing this test. On the other side any legit message having such a sender-domain that come from the right mailserver will have -5 points. So this message can also fail other test without creating false positives. I'm not sure about this. Seems like I miss something - it sounds to simple. ;-) Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamchk.exe
Hi Adam, Can you see these error messages also if you disable the spamchk-test in decludes global.cfg-file? Are there other external exe-files configured in the global.cfg? It seems like all other exe-files called from declude (SMTP, and SMTPD.EXE to deliver the message) cannot be started. Mayby this can also help: (I've found it googling in the net) == The Run Program Task stops triggering error generated: The application failed to initialize properly (0xc142) click OK to terminate the application The 'Desktop Application Heap' value is used by Microsoft to prevent applications from consuming too many resources. For example, in Windows 2000 the default is 512. Increasing this value increases the resources available to an application. This value is found in the Registry Editor: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\SubSy stems\Windows Please refer to Article http://support.microsoft.com/?id=184802 and http://support.microsoft.com/?id=126962 for more information. Note: Even though your system may have infinite resources, there is a maximum limit of 48-MB for the Desktop Heap. Specifying a number beyond this limit will not make any difference. If you have Terminal Services running, this limit will be cut in half for your application. == Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adam Hobach Sent: Monday, June 09, 2003 4:44 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] spamchk.exe Hello, We are using Junkmail version 1.60. And we get these error messages every once in awhile which stops the server from sending mail out because of these error messages. Has anyone else run into this and what did you do to correct this.. Application popup: spamchk.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. Application popup: smtp32.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. Application popup: smtpd32.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. Thanks, Adam Adam Hobach CyberLynk Sales/Support [EMAIL PROTECTED] or [EMAIL PROTECTED] ADDITIONAL CYBERLYNK SERVICES CyberLynk GroupLynk - This is a program that can provide home dialup connections for your employees. You would get a login/password to our website where you can add/modify dialup accounts as you please. CyberLynk Toll-Free Dialup - This account includes the first 60 minutes free and then you pay .13cents per minute after that. This is a great way to stay connected while on those important business or personal trips. - For more information please contact me. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fwd: Blank Emails from Declude
I would recommend switching that poor mailserver to IMail (or any other mailserver that will include the IP address in the headers, which is almost all of them). My poor mail server is IMail v6. I received about 95 of these blank emails since last Friday with different received times, I have not received any today though. Is there anything else I can check if I happen to get another one of these today that would help in the quest to stop this? Kevin --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamchk.exe
Application popup: smtp32.exe - Application Error : The application failed to initialize properly (0xc142). Click on OK to terminate the application. You can find out more about this at http://www.declude.com/dq.htm -- upgrading Declude to v1.65 should help (it's technically a Microsoft issue, that is more likely to occur due to IMail's architecture). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Um...er...yeah...I knew you could do that cough...cough... It DOES sound too simple. Have I been using JM for all these years and I didn't know you could have a pass weight in the config file?! I swear I only ever knew you could add weight if it failed. I guess I never questioned what all those zeros were at the end of the test config lines. Wow...don't I feel stupid now. And I always thought of myself as one of those people that loves to read the entire manual just to see what thinks I CAN do. Must have glazed over that part. Thanks! --Todd. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, June 09, 2003 11:07 AM Subject: RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights? Is my logic solid here? Anything I'm missing? Why not configure it like SPAMDOMAINS spamdomains C:\IMail\Declude\sd.txt x 5 -5 This will give +5 points to any mail having a sender-domain listet in sd.txt and failing this test. On the other side any legit message having such a sender-domain that come from the right mailserver will have -5 points. So this message can also fail other test without creating false positives. I'm not sure about this. Seems like I miss something - it sounds to simple. ;-) Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Why not configure it like SPAMDOMAINS spamdomains C:\IMail\Declude\sd.txt x 5 -5 This will give +5 points to any mail having a sender-domain listet in sd.txt and failing this test. On the other side any legit message having such a sender-domain that come from the right mailserver will have -5 points. So this message can also fail other test without creating false positives. I'm not sure about this. Seems like I miss something - it sounds to simple. ;-) The catch here is that all E-mail from domains that aren't listed in the sd.txt file will get a weight of -5 added to them, so that spam from domains not listed in the sd.txt file will be more likely to be delivered. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
The catch here is that all E-mail from domains that aren't listed in the sd.txt file will get a weight of -5 added to them, so that spam from domains not listed in the sd.txt file will be more likely to be delivered. Is there any easy way to change this in a future release? As I can understand it should not request significant additional cpu-resources but will definitely help to avoid fp's. The question is, how simple it can be implemented in the weighting system structure of declude junkmail. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
A better way to do this is to setup a RDNS Filter and add a negative weight for any domain that you add that resolves correctly, like yahoo.com. For example: Global.cfg: REVDNS-FILTER filter M:\IMail\Declude\RevDNS-Filter.txt x 0 0 REVDNS-FILTER (samples): REVDNS -10 ENDSWITH .travelocity.com REVDNS -10 ENDSWITH .untd.com REVDNS -05 ENDSWITH .verio.com REVDNS -05 ENDSWITH .verio.net REVDNS -05 ENDSWITH .verizon.com REVDNS -05 ENDSWITH .verizon.net REVDNS -10 ENDSWITH .yahoo.com REVDNS -05 ENDSWITH .lockergnome.com Bill - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, June 09, 2003 9:20 AM Subject: RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights? Why not configure it like SPAMDOMAINS spamdomains C:\IMail\Declude\sd.txt x 5 -5 This will give +5 points to any mail having a sender-domain listet in sd.txt and failing this test. On the other side any legit message having such a sender-domain that come from the right mailserver will have -5 points. So this message can also fail other test without creating false positives. I'm not sure about this. Seems like I miss something - it sounds to simple. ;-) The catch here is that all E-mail from domains that aren't listed in the sd.txt file will get a weight of -5 added to them, so that spam from domains not listed in the sd.txt file will be more likely to be delivered. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
The catch here is that all E-mail from domains that aren't listed in the sd.txt file will get a weight of -5 added to them, so that spam from domains not listed in the sd.txt file will be more likely to be delivered. Is there any easy way to change this in a future release? Do you mean that you think the SPAMDOMAINS test should work with domains that aren't listed in the sd.txt file? If so, what should the reverse DNS entry match? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
A better way to do this is to setup a RDNS Filter and add a negative weight for any domain that you add that resolves correctly, like yahoo.com. For example: Global.cfg: REVDNS-FILTER filter M:\IMail\Declude\RevDNS-Filter.txt x 0 0 REVDNS-FILTER (samples): REVDNS -10 ENDSWITH .travelocity.com REVDNS -10 ENDSWITH .untd.com I understand. But if I understand this right this will cause x REVDNS-lookups for every single mail (X is the number of lines in the filter file) Should it by possible to run a new test like the following example? VALIDDOMAINS validdomains c:\imail\declude\vd.txt -5 +5 Vd.txt -- @yahoo.com yahoo.com @msn.comhotmail.com ... - Now if a mail comes in having a sender-adress containing @yahoo.com Declude will see that this domain is listed in the filter file (vd.txt) and REVDNS-check if it comes from a host having the right PTR record. (yahoo.com) If so, this message will recieve -5 points. If the message comes from an IP with an invalid PTR-record the message collects 5 additional points. This all is done by a single DNS-query. I think at least some big emailers (yahoo, hotmail, ...) can be used in such a test, if we see that very few spam mails comes from their mail servers. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Do you mean that you think the SPAMDOMAINS test should work with domains that aren't listed in the sd.txt file? If so, what should the reverse DNS entry match? No. I mean that the test fails only if the from-domain was found in the sd.txt file and the corresponding REVDNS- records does not match. (+X points) On the other side the test should pass only if the from-domain was also found in the sd.txt file and the corresponding REVDNS- records does match. (-X points) If the sd.txt file doesn't contain the sender-domain the test should be ignored completely (0 points) Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Logging optimization question
Speaking of logging, would it be possible to add using a syslog daemon as an option, I don't know off hand if it will save any processing power, but it seems like it might since you will no longer have to manage log file resources (locking, checking creation, destination folder). It would certainly allow for more file IO savings by moving to a remote machine. Plus, syslog daemons should already have the extra code to prevent the garbage log lines Declude occasionally gets under heavy loads (multiple partial entries on one line). Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Sunday, June 08, 2003 8:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Logging optimization question Scott, since we have been discussing optimization techniques on this list lately, I am wondering if in that effort you can do some logging optimization, as well. See the attached JM log snippet and you will notice that a single e-mail with 4 recipients gets written to the log 4 time, with each seceding From/To entry adding one additional recipient e-mail address: This is one we've been meaning to get to for a while, we were just waiting for people to mention it. :) We're concentrating on getting a new released version out, and then plan to tackle this. Any reason this cannot (or should not) be reduced to just a single e-mail entry with the From/To line showing all recipients? The original purpose for the multiple lines was for cases where different recipients had different settings (which accounts for the multiple Message OK and Message failed lines). However, what we may do is change this so that one line will appear for each test that fails (which allows the reason for failure to be included), but then for each recipient, have a single line that shows each test name and the action taken. That should help condense the log file quite a bit. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] fresh spamdomains thread
We haven't beaten SPAMDOMAINS sufficiently to death, so here's my contribution. I have two observations: One: I have a line in my sd.txt file that says: msn.com hotmail.com as have several of the submitted spamdomain candidate lists. I just found a message in my HOLD queue that failed SPAMDOMAINS, the header of that message is: Received: from hotmail.com [65.54.169.82] by mail.mydomain.com with ESMTP (SMTPD32-6.05) id A3A93EE1011C; Mon, 09 Jun 2003 11:11:37 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Mon, 9 Jun 2003 08:11:35 -0700 Received: from 65.128.140.138 by bay3-dav52.bay3.hotmail.com with DAV; Mon, 09 Jun 2003 15:11:35 + X-Originating-IP: [65.128.140.138] X-Originating-Email: [EMAIL PROTECTED] From: Stuff Sender [EMAIL PROTECTED] To: myuser [EMAIL PROTECTED] Subject: Date: Mon, 9 Jun 2003 10:35:27 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0003_01C32E72.D7B7C400 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: MSN Mail 8.00.0022.3100 X-MimeOLE: Produced By Microsoft MimeOLE V8.00.0022.3100 Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 09 Jun 2003 15:11:35.0576 (UTC) FILETIME=[6AF41180:01C32E99] X-RBL-Warning: Spamdomains X-Declude-Sender: [EMAIL PROTECTED] [65.54.169.82] X-Note: Total spam weight of this E-mail is 18. X-Note: QueInControl: Da3a911c.SMD (1) X-Note: Tests failed: NJABL, NOPOSTMASTER, NOABUSE, IPNOTINMX, NOLEGITCONTENT, SPAMDOMAINS, WEIGHT10, WEIGHT14 X-Note: Message followed: UNITED STATES-destination X-Note: RDNS Real Origin: bay3-dav52.bay3.hotmail.com[65.54.169.82] But in the log file I find this line: 06/09/2003 11:12:07 Qa3a911c Msg failed SPAMDOMAINS (Spamdomain 'msn.com' found: Address of [EMAIL PROTECTED] sent from invalid bay3-dav52.bay3.hotmail.com.). Action=WARN. This is not the behavior I expected. Two: Although SPAMDOMAINS is listed in the list of failed tests in my header above, this is a line from the log file: 06/09/2003 11:12:07 Qa3a911c NJABL:8 NOPOSTMASTER:5 NOABUSE:5 . Total weight = 18 Notice the absence of SPAMDOMAINS:5 in that list, which is what I might have expected there. My SPAMDOMAINS test is invoked this way: SPAMDOMAINS spamdomains C:\IMail\Declude\sd.txt x 5 0 It appears that something failed to connect somewhere in processing. I'm guessing that message should have reached 23 points. I'm going to comb the log for more instances of SPAMDOMAINS and see what else is happening, but this little bit was unsettling. -- John Shacklett --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Logging optimization question
Speaking of logging, would it be possible to add using a syslog daemon as an option, I don't know off hand if it will save any processing power, but it seems like it might since you will no longer have to manage log file resources (locking, checking creation, destination folder). It would certainly allow for more file IO savings by moving to a remote machine. Plus, syslog daemons should already have the extra code to prevent the garbage log lines Declude occasionally gets under heavy loads (multiple partial entries on one line). I second that request. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Logging optimization question
Speaking of logging, would it be possible to add using a syslog daemon as an option, I don't know off hand if it will save any processing power, but it seems like it might since you will no longer have to manage log file resources (locking, checking creation, destination folder). This is in the suggestion database, but is something that has a low priority at this point. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] fresh spamdomains thread
Are you sure that the line in your sd.txt file is exactly msn.com hotmail.com (no spaces or other characters after hotmail.com)? Yes. I copied that line and pasted it exactly and I double checked the whitespace before I composed my questions. One last thing to check: Is that the last line in the sd.txt file? If so, try adding a blank line below it. Otherwise, it's time for the debug mode. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, after an E-mail arrives like the one above, you can then switch back to LOGLEVEL LOW (the debug mode adds huge amounts of information to the log file). You can then send me the \IMail\spool\dec.log file (as an attachment, off this list), and I can take a look at it to see what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
The problem here is that instead of having a test with 2 results (pass/fail), you've got a test with 3 results (pass/fail/na). That would require a major change to the Declude architecture to handle. But it would make sense G. Would it? The only tests I can think of that can have more than 2 different outcomes would be set up as multiple tests. In the meantime, couldn't he define the test TWICE, once assigning a positive weight for failure and one with a negative weight for non-failure? Not the way I am looking at it. This would have the same effect as having the test defined once, with both a weight for failure and a negative weight for non-failure. What he is talking about is something like having the SPAMDOMAINS test being split into 2 tests, one that says For E-mail with a return address of yahoo.com or hotmail.com, the E-mail should fail TEST1 if the reverse DNS entry doesn't have yahoo.com or hotmail.com in it, and another that says All E-mail should fail TEST2 unless it comes from yahoo.com or hotmail.com. I think it might be possible to do this with a filter, but this gets very confusing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestion: CONFIDENCE Test
Today's discussions gave me the idea of some form of Confidence test. Ideally, that test should NOT require any external config files (low maintenance). It is somewhat similar to the IPNOTINMX positive test - in that it is intended to assign a negative weight for email that has a high confidence in the sending domain (e.g., the sender is who he says he is.) Is it possible? I've had nearly the same idea after these postings today and I've already begun to formulate such a concept (I'm not very fast writing in english :-) I think Andy's suggestion can be a very effective way to avoid fp's. Spammers have to respect a lot of things if they want to comply with all the requirements of this test. On the other side this test can reward a lot of mails from good maintained and configured mailservers. And the best of all: since all necessary DNS-requests are already available this test should be very resource friendly. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Or, simply fixing the one test to have pass/fail weights assignable with each test (in the .txt file, rather than the weights defined once in the global.cfg, where in this case, they would be set to zero, zero -- thus unknown domains are ignored) something like: .yahoo.co .yahoo. 5 -5 voila - a test with three results (and presumably no major changes to declude's architecture). Karen -Original Message- From: R. Scott Perry The problem here is that instead of having a test with 2 results (pass/fail), you've got a test with 3 results (pass/fail/unknown). That would require a major change to the Declude architecture to handle. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DSN In The Subject?
Hello, All, Can someone tell me what it means, in the context of this discussion list, when someone puts DSN in the subject? Thanks, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights?
Would it? In my opinion, yes. What he basically wants is: A) if domain does not appear in the SPAMDOMAINS file, then the weight should remain uneffected (the outcome is: N/A - Not applicable). B) if domain DOES appear in SPAMDOMAINS file and matches, then credit is given for good behavior C) if domain DOES appear in SPAMDOMAINS file and mismatches, then weight is added for bad behavior. It does make sense to me that these comparative tests against a filtered list (e.g., the SPAMDOMAIN file) could have the does not apply outcome where NO weight is modified. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, June 09, 2003 04:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Using SPAMDOMAINS and negative weights? The problem here is that instead of having a test with 2 results (pass/fail), you've got a test with 3 results (pass/fail/na). That would require a major change to the Declude architecture to handle. But it would make sense G. Would it? The only tests I can think of that can have more than 2 different outcomes would be set up as multiple tests. In the meantime, couldn't he define the test TWICE, once assigning a positive weight for failure and one with a negative weight for non-failure? Not the way I am looking at it. This would have the same effect as having the test defined once, with both a weight for failure and a negative weight for non-failure. What he is talking about is something like having the SPAMDOMAINS test being split into 2 tests, one that says For E-mail with a return address of yahoo.com or hotmail.com, the E-mail should fail TEST1 if the reverse DNS entry doesn't have yahoo.com or hotmail.com in it, and another that says All E-mail should fail TEST2 unless it comes from yahoo.com or hotmail.com. I think it might be possible to do this with a filter, but this gets very confusing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DSN In The Subject?
Hi, Scott, Can someone tell me what it means, in the context of this discussion list, when someone puts DSN in the subject? That normally means that the E-mail failed the DSN test (which is run by http://www.rfc-ignorant.org ). It usually means that the mailserver that sent the E-mail is running IMail's bogus Refuse NULL Senders option (which at least got moved to the Advanced SMTP settings in IMail v8). So are you saying that the sender of the message is not typing DSN as the first 3 characters in the subject field but instead it is being inserted by some automatic mechanism along the way? Specifically I've noticed that almost every message I receive from Kevin Bilbee has DSN in the subject. Is my system adding that? Is his system adding that? Or is the Declude JunkMail list adding that? The most recent example that I have of this is from the 6th... Received: from declude.com [66.189.124.29] by NexusTechGroup.com with ESMTP (SMTPD32-6.06) id AF7B64430030; Fri, 06 Jun 2003 19:10:51 -0400 Received: from mail.idig.net [66.199.168.4] by declude.com with ESMTP (SMTPD32-7.06) id ACA76BFA0428; Fri, 06 Jun 2003 18:58:47 -0400 Received: from HOMEBASE.idig.net [142.179.108.44] by mail.idig.net with ESMTP (SMTPD32-6.06) id ACE243D0542; Fri, 06 Jun 2003 15:59:46 -0700 Message-Id: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Fri, 06 Jun 2003 15:58:00 -0700 To: [EMAIL PROTECTED] From: Kevin [EMAIL PROTECTED] Subject: [Declude.JunkMail] DSN:beta features Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed X-RBL-Warning: DSN: Not supporting null originator (DSN) X-Declude-Sender: [EMAIL PROTECTED] [142.179.108.44] X-CYBERsitter-SpamManager-In: Passed - Adult: 0 (Req: 18) Spam: 0 (Req: 18) Tot: 0 (Req: 20) X-CYBERsitter-SpoolFile: D1ca76bfa04288ae0.SMD X-CYBERsitter-Sender: [EMAIL PROTECTED] [66.199.168.4] X-RBL-Warning: XBL: 44.108.179.142.xbl.selwerd.cx. X-Declude-Sender: [EMAIL PROTECTED] [66.199.168.4] X-Declude-Spoolname: D1ca76bfa04288ae0.SMD X-Note: This E-mail was scanned for viruses by Declude Virus (www.declude.com) X-NRecips: 1 X-Reverse-IP: mail.idig.net X-Weight: -8 (XBL, DSN, HEUR1, SPAMCHK) X-Country-Chain: CANADA-destination. X-Spam-Prob: 0.014505 Precedence: bulk Sender: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [66.189.124.29] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [-3] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 354754535 Status: U What is the syntax for the alias spamdomains in the latest beta update? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. This E-mail is scanned and free from viruses. www.nexustechgroup.com It's sort of annoying. I thought maybe there was some secret code in use on the list which I didn't know about. Thanks, Dan This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DSN In The Subject?
Can someone tell me what it means, in the context of this discussion list, when someone puts DSN in the subject? That normally means that the E-mail failed the DSN test (which is run by http://www.rfc-ignorant.org ). It usually means that the mailserver that sent the E-mail is running IMail's bogus Refuse NULL Senders option (which at least got moved to the Advanced SMTP settings in IMail v8). So are you saying that the sender of the message is not typing DSN as the first 3 characters in the subject field but instead it is being inserted by some automatic mechanism along the way? Correct. While it's possible that the user is doing it, it's unlikely that they are. Specifically I've noticed that almost every message I receive from Kevin Bilbee has DSN in the subject. Is my system adding that? Is his system adding that? Or is the Declude JunkMail list adding that? X-Declude-Sender: [EMAIL PROTECTED] [142.179.108.44] http://www.rfc-ignorant.org/tools/lookup.php?domain=idig.net shows that idig.net is listed is the DSN spam database. It seems that the information is outdated, so if someone from idig.net contacts [EMAIL PROTECTED], they can be removed. What is the syntax for the alias spamdomains in the latest beta update? The file for the SPAMDOMAINS test can either have 1 entry on a line (example.com), which would mean that if an E-mail has a return address with example.com in it, then the reverse DNS entry must have example.com in it as well, or it can have 2 entries (example.com example.net), in which case any E-mail with example.com in the return address must have *either* example.com or example.net in the reverse DNS entry. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
