[Declude.JunkMail] Filter Rule Mistake
I've got a custom filter that isn't generating any error messages, but fails to catch the spam I want it to. Perhaps someone could point out the problem? From my Global.CFG: SPAMFILTER filter D:\IMail\Declude\spamfilter.txt x 0 0 From spamfilter.txt: MAILFROM 0 CONTAINS $stderr$ MAILFROM 0 CONTAINS $bounce$ MAILFROM 0 CONTAINS $odc.ca$@ From $default$.junkmail: SPAMFILTER ROUTETO [EMAIL PROTECTED] However I'm still seeing messages like this pass through. From: Pay Advance [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Need Extra Dough? Get it now! MIME-Version: 1.0 Content-Type: text/html; charset=iso-8859-1 X-Declude-Sender: [EMAIL PROTECTED] [207.158.45.51] and... To: [EMAIL PROTECTED] Subject: Have What it Takes? I Cracked the Code! Mime-Version: 1.0 Content-Type: multipart/alternative; boundary==_Part_1093706_14516957.1057719304125 ew-bounceaddress: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [216.128.76.59] Have I done this wrong somehow? Thanks, Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
I've got a custom filter that isn't generating any error messages, but fails to catch the spam I want it to. Perhaps someone could point out the problem? From spamfilter.txt: MAILFROM 0 CONTAINS $stderr$ MAILFROM 0 CONTAINS $bounce$ MAILFROM 0 CONTAINS $odc.ca$@ The problem is the $ in there -- it should look like: MAILFROM 0 CONTAINS stderr MAILFROM 0 CONTAINS bounce MAILFROM 0 CONTAINS odc.ca@ If that doesn't work, the next step would be to search the log file for SPAMFILTER, to see if E-mails are actually failing the test (you can't rely on the E-mail being re-routed by the ROUTETO command, as it is possible that a different configuration file may be used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
I understood the $'s to behave as wildcards. Removing them will work for the stderr, and bounce rules but if I leave odc.ca in there without a wildcard and an @ it will drop all internal mail. Is there another way I can fix this? Also, what can I do to ensure the proper config files are used? I thought global.cfg and $default$.junkmail where the only ones used. Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
Rob, Wednesday, July 9, 2003 you wrote: RS I understood the $'s to behave as wildcards. Just as a matter of interest where did you get the idea that $ was a wildcard character? Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
I understood the $'s to behave as wildcards. Removing them will work for the stderr, and bounce rules but if I leave odc.ca in there without a wildcard and an @ it will drop all internal mail. Is there another way I can fix this? Declude JunkMail doesn't include wildcards. For the odc.ca rule, what are you looking to block? Also, what can I do to ensure the proper config files are used? Nothing -- Declude JunkMail takes care of that automatically. :) I thought global.cfg and $default$.junkmail where the only ones used. That is correct (unless you have set up per-user or per-domain configuration files). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] argh! change!
That's the HOLD action. Although you can use it, the HOLD action will prevent the E-mail from being delivered. So if you use the HOLD action, the recipient will not receive the E-mail. Right, I understand that option, which is why I'd prefer to be able to COPY the lower weighted mails to be reviewed by spamreview, but still be delivered. The way I had it set before, and still do to an extent, was to copy the failed email to a review area to get headers, etc. to add to filters with. This way, mail was still being delivered, and we could update filters at the same time. Spamreview seems to be an easier approach to this, so I wanted to copy the lower failing mail still let it be delivered and review it with Spamreview. I apologize if I'm not being clear enough. =) But I'll assume the answer then is No, you cannot copy lower failing e-mail to the spam folder for review, this is only accomplished by the HOLD action. =) If this is wrong, PLEASE correct me. Question 2: Correct (unless you have modified the configuration to specifically force Declude JunkMail to run first). Ok, got that, thanks. Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] argh! change!
That's the HOLD action. Although you can use it, the HOLD action will prevent the E-mail from being delivered. So if you use the HOLD action, the recipient will not receive the E-mail. Right, I understand that option, which is why I'd prefer to be able to COPY the lower weighted mails to be reviewed by spamreview, but still be delivered. The problem here is that the COPYTO action sends a copy of the E-mail to someone else, so it wouldn't be viewable with spamreview (which I believe only works with held E-mail). The way I had it set before, and still do to an extent, was to copy the failed email to a review area to get headers, etc. to add to filters with. This way, mail was still being delivered, and we could update filters at the same time. Spamreview seems to be an easier approach to this, so I wanted to copy the lower failing mail still let it be delivered and review it with Spamreview. It sounds like you're looking for an action that acts like the HOLD action (by copying the Q*.SMD and D*.SMD files to a specific directory), but also delivers the E-mail. Unfortunately, there isn't anything like that in Declude JunkMail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] argh! change!
It sounds like you're looking for an action that acts like the HOLD action (by copying the Q*.SMD and D*.SMD files to a specific directory), but also delivers the E-mail. Unfortunately, there isn't anything like that in Declude JunkMail. Right, that's what I was looking for. It makes sense to me now why that's not practical, that would involve creating a copy of the Q + D files, causing higher processing time, etc. Better to keep it as it is, it's working just fine now, no need to mess it up. =) Thanks Scott. Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
Just as a matter of interest where did you get the idea that $ was a wildcard character? The way its written in the manual it just looked like it would be a wildcard. You can't have a $ sign in a valid domain name or an email address so I just assumed thats what it was. On closer examination of the explanitory text, seeing the $domain and $success$@ within quotes should have clued me in. [quote] HELO 8 CONTAINS $domain SUBJECT 3 CONTAINS enlarge MAILFROM 3 STARTSWITH $success$@ BODY 3 CONTAINS To unsubscribe, click here The first one would look for HELO/EHLO text that contains $domain in it (and if it does, a weight of 8 will be added to the weight of the E-mail), the second one would look for an E-mail that contains enlarge in it and add 3 to the weight of the E-mail, and the last one would look for a return address beginning with $success$@ (and add 3 to the weight of the E-mail if there is a match). [/quote] For the odc.ca rule, what are you looking to block? We've been getting messages like this: From: Pay Advance [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Need Extra Dough? Get it now! MIME-Version: 1.0 Content-Type: text/html; charset=iso-8859-1 X-Declude-Sender: [EMAIL PROTECTED] [207.158.45.51] With the sending username containing odc.ca we could block these no problem. But if I don't cut it off before the @ it'll drop all our internal email too. Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] argh! change!
I just started seeing junkmail that is addressed to an everyone@ the mailserver domain name. It looks like the real message was sent to an email address at a domain hosted on that mailserver and the everyone@ was added. Is this a new technique? Thanks David Stavert --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
Just as a matter of interest where did you get the idea that $ was a wildcard character? The way its written in the manual it just looked like it would be a wildcard. You can't have a $ sign in a valid domain name or an email address so I just assumed thats what it was. Thanks for pointing this out -- the manual has been changed to clearer examples. For the odc.ca rule, what are you looking to block? We've been getting messages like this: X-Declude-Sender: [EMAIL PROTECTED] [207.158.45.51] With the sending username containing odc.ca we could block these no problem. But if I don't cut it off before the @ it'll drop all our internal email too. Perhaps blocking on odc.ca. would be the best option here (including the . at the end)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Novice question, weight gain
Scott, How can I add a weight to this email message? -- Received: from airip2.emailvalues.com [65.60.9.93] by mx2.cooking.com (SMTPD32-7.07) id AC6A688008A; Tue, 08 Jul 2003 12:32:58 -0700 From: Weight Loss [EMAIL PROTECTED] Subject: It's not a diet, it's a patch! To: [EMAIL PROTECTED] X-Mailer: 3.1.76-XP/NG [Jun 30 2003, 07:15:19] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=105769106248969; class-id=1:8SLss98ttYhD478tS:447028 Date: Tue, 8 Jul 2003 14:33:17 CST Message-ID: [EMAIL PROTECTED] X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?65.60.9.93 X-Declude-Sender: [EMAIL PROTECTED] [65.60.9.93] X-Declude-Spoolname: D1c6a0688008ab2d4.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: [Spam:7] SPAMCOP, IPNOTINMX X-Country-Chain: UNITED STATES-destination X-Note: This E-mail was sent from 93.9.60.65.in-addr.arpa ([65.60.9.93]). X-Spam-Prob: 0.973329 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 350342350 --- The REVDNS hostname is 93.9.60.65.in-addr.arpa, Yes, they have a RDNS entry but it does not match the HELO hostname or is a legitimate value. I would like to add a value when this happens. As more spammers realize that they have to create a RDNS entry we need to have a way to verify that it is a correct value. Should I start a private blacklist? I am trying to keep this low maintenance. Thanks, Mike Kruidhof Cooking.com, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] argh! change!
Could he not copy the messages to a special user, then use the command line to move all the *.SMD to the SPAM directory from that user's mailbox? Set up a batch file and schedule the task to move them every few minutes? -Original Message- From: R. Scott Perry It sounds like you're looking for an action that acts like the HOLD action (by copying the Q*.SMD and D*.SMD files to a specific directory), but also delivers the E-mail. Unfortunately, there isn't anything like that in Declude JunkMail. -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Novice question, weight gain
How can I add a weight to this email message? -- Received: from airip2.emailvalues.com [65.60.9.93] by mx2.cooking.com (SMTPD32-7.07) id AC6A688008A; Tue, 08 Jul 2003 12:32:58 -0700 The REVDNS hostname is 93.9.60.65.in-addr.arpa, Yes, they have a RDNS entry but it does not match the HELO hostname or is a legitimate value. I would like to add a value when this happens. As more spammers realize that they have to create a RDNS entry we need to have a way to verify that it is a correct value. The problem is determining whether or not it is a correct value. For example, our mailserver has a reverse DNS entry that doesn't correspond to any of the domains that we send from. Even if it did, would the HELO/EHLO our mailserver sends have to be the same for all domains, just so that it will match the reverse DNS entry? It gets difficult doing matching like this, unfortunately. Should I start a private blacklist? I am trying to keep this low maintenance. That may be the best thing to do here. I'm guessing that this is an E-mail that resulted from the address being supplied to a company without checking the Do not send me any partner offers box. This type of E-mail can technically be considered solicited, which makes it unlikely that their IP will get listed in many spam databases. For this type of E-mail, you often have to create your own blacklist (or unsubscribe, which often works for this type of E-mail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bizarre DJM Pro Situation
Hello, All, We are using DJM Pro. I'm having an issue with a message that I don't think should have been delivered. Here are the headers... - Received: from out017.tpcper.com [69.24.239.37] by pagerover.com (SMTPD32-6.06) id A4323AA80134; Sun, 06 Jul 2003 15:10:42 -0400 To: [EMAIL PROTECTED] From: Distribution [EMAIL PROTECTED] Subject: re: Take a Short Survey, Win a New Computer System! Date: Sun, 06 Jul 2003 12:08:04 -0700 Message-ID: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable X-Declude-Sender: [EMAIL PROTECTED] [69.24.239.37] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: OSSRC, EASYNET-DNSBL, IPNOTINMX, WEIGHT05, WEIGHT07, WEIGHTRANGE05-59, WEIGHTRANGE07-59 [8] X-Spam-Prob: 0.451398 X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 345762330 Status: U - This message was sent to one of our internal domains microgallery.com which is a host aliases on the IMail site pagerover.com The active entries in the $default$.junkmail are... - CATCHALLMAILS COPYTO [EMAIL PROTECTED] FROMFILE-HOLD HOLD IPFILE-HOLD HOLD MAILFROM HOLD WEIGHTRANGE05-59 HOLD WEIGHT60 ROUTETO [EMAIL PROTECTED] FILTER-BODY-IP WARN FILTER-BODY-PHONE WARN FILTER-BODY-URL WARN FILTER-MAILFROM WARN SPAMCOP WARN - and associated entries in GLOBAL.CFG are - WEIGHT60 weight x x 60 0 WEIGHTRANGE05-59 weightrange x x 5 59 FILTER-BODY-IP filter D:\iMail\declude\JunkMail.Filter.Body.IP.txt x 0 0 FILTER-BODY-PHONE filter D:\iMail\declude\JunkMail.Filter.Body.Phone.txt x 0 0 FILTER-BODY-URL filter D:\iMail\declude\JunkMail.Filter.Body.URL.txt x 0 0 FILTER-MAILFROM filter D:\iMail\declude\JunkMail.Filter.MailFrom.txt x 0 0 FROMFILE-HOLD fromfile D:\iMail\declude\JunkMail.FromFile.Hold.txt x 0 0 IPFILE-HOLD ipfile D:\iMail\declude\JunkMail.IPFile.Hold.txt x 0 0 - For the life of me I cannot figure out why this was delivered to the recipient. Does anyone have any insight? Thanks, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bizarre DJM Pro Situation
We are using DJM Pro. I'm having an issue with a message that I don't think should have been delivered. X-Spam-Tests-Failed: OSSRC, EASYNET-DNSBL, IPNOTINMX, WEIGHT05, WEIGHT07, WEIGHTRANGE05-59, WEIGHTRANGE07-59 [8] For the life of me I cannot figure out why this was delivered to the recipient. Do you have the log file entries for this E-mail? That may help determine what happened. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Novice question, weight gain
Scott, I understand your point but would it be possible to do a DNS lookup on the RDNS hostname. The IP address that is returned should match the IP address that they used. In your case it would match, but in this case 93.9.60.65.in-addr.arpa does not even have an record. I am looking for a way to validate the RDNS hostname. Thanks again for your quick response, Mike Kruidhof Cooking.com, Inc. How can I add a weight to this email message? -- Received: from airip2.emailvalues.com [65.60.9.93] by mx2.cooking.com (SMTPD32-7.07) id AC6A688008A; Tue, 08 Jul 2003 12:32:58 -0700 The REVDNS hostname is 93.9.60.65.in-addr.arpa, Yes, they have a RDNS entry but it does not match the HELO hostname or is a legitimate value. I would like to add a value when this happens. As more spammers realize that they have to create a RDNS entry we need to have a way to verify that it is a correct value. The problem is determining whether or not it is a correct value. For example, our mailserver has a reverse DNS entry that doesn't correspond to any of the domains that we send from. Even if it did, would the HELO/EHLO our mailserver sends have to be the same for all domains, just so that it will match the reverse DNS entry? It gets difficult doing matching like this, unfortunately. Should I start a private blacklist? I am trying to keep this low maintenance. That may be the best thing to do here. I'm guessing that this is an E-mail that resulted from the address being supplied to a company without checking the Do not send me any partner offers box. This type of E-mail can technically be considered solicited, which makes it unlikely that their IP will get listed in many spam databases. For this type of E-mail, you often have to create your own blacklist (or unsubscribe, which often works for this type of E-mail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
h:RE: [Declude.JunkMail] Novice question, weight gain
Please remember to restart the services too... :) Glad I could help. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Kruidhof Sent: Wednesday, July 09, 2003 12:38 PM To: [EMAIL PROTECTED] Scott, I understand your point but would it be possible to do a DNS lookup on the RDNS hostname. The IP address that is returned should match the IP address that they used. In your case it would match, but in this case 93.9.60.65.in-addr.arpa does not even have an record. I am looking for a way to validate the RDNS hostname. Thanks again for your quick response, Mike Kruidhof Cooking.com, Inc. How can I add a weight to this email message? -- Received: from airip2.emailvalues.com [65.60.9.93] by mx2.cooking.com (SMTPD32-7.07) id AC6A688008A; Tue, 08 Jul 2003 12:32:58 -0700 The REVDNS hostname is 93.9.60.65.in-addr.arpa, Yes, they have a RDNS entry but it does not match the HELO hostname or is a legitimate value. I would like to add a value when this happens. As more spammers realize that they have to create a RDNS entry we need to have a way to verify that it is a correct value. The problem is determining whether or not it is a correct value. For example, our mailserver has a reverse DNS entry that doesn't correspond to any of the domains that we send from. Even if it did, would the HELO/EHLO our mailserver sends have to be the same for all domains, just so that it will match the reverse DNS entry? It gets difficult doing matching like this, unfortunately. Should I start a private blacklist? I am trying to keep this low maintenance. That may be the best thing to do here. I'm guessing that this is an E-mail that resulted from the address being supplied to a company without checking the Do not send me any partner offers box. This type of E-mail can technically be considered solicited, which makes it unlikely that their IP will get listed in many spam databases. For this type of E-mail, you often have to create your own blacklist (or unsubscribe, which often works for this type of E-mail). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
Perhaps blocking on odc.ca. would be the best option here (including the . at the end)? Hey! Good idea. Dropping that in right now. Thanks ;) Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] REDIRECT configuration
Finally getting around to updating my Declude Junkmail config. I would like to use the REDIRECT command, but want to make sure I'm using it correctly before throwing myself to the wolves! :) 1. Using the REDIRECT command, I don't need the domain folders. For example: I'm a mail gateway for example.com. I currently have a x:\imail\declude\example.com folder. Can this folder can go away when the REDIRECT command is used properly? 2. In the archives, ( This message specifically http://www.mail-archive.com/[EMAIL PROTECTED]/msg09131.html) it says to put the configuration in the global.cfg file. However, if I'm reading the manual correctly, it says to put the configuration in $default$.junkmail. Just a little guidance please!! Thanks in Advance, Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] X-Declude-Sender Missing from Header
We are seeing several spam emails delivered to our clients which are apparently able to bypass JMPro filters as there is no X-Declude-Sender line in the header. Can anyone explain why it is missing (see sample header below)? X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420e]. Declude JunkMail definitely scanned this E-mail. Are you using the XSENDER ON option, or are you using your own XINHEADER/XOUTHEADER option to produce the X-Declude-Sender: header? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter Rule Mistake
Perhaps blocking on odc.ca. would be the best option here (including the . at the end)? Hey! Good idea. Dropping that in right now. Thanks ;) Rob Salmond Ontario Die Company (519)-576-8950 ext. 132 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] REDIRECT configuration
2. In the archives, ( This message specifically http://www.mail-archive.com/[EMAIL PROTECTED]/msg09131.html) it says to put the configuration in the global.cfg file. However, if I'm reading the manual correctly, it says to put the configuration in $default$.junkmail. It should actually be the $default$.JunkMail file (technically, it can go in any file, but it needs to be whichever one Declude JunkMail is going to use to determine the actions to take on the E-mail, which would normally be the $default$.JunkMail file for incoming E-mail). So if it's a domain that is not housed on my server, the proper place for the redirect is in the global.cfg? Because the global.cfg is the file responsible for actions on this type of email!! Thanks, Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] REDIRECT configuration
2. In the archives, ( This message specifically http://www.mail-archive.com/[EMAIL PROTECTED]/msg09131.html) it says to put the configuration in the global.cfg file. However, if I'm reading the manual correctly, it says to put the configuration in $default$.junkmail. It should actually be the $default$.JunkMail file (technically, it can go in any file, but it needs to be whichever one Declude JunkMail is going to use to determine the actions to take on the E-mail, which would normally be the $default$.JunkMail file for incoming E-mail). So if it's a domain that is not housed on my server, the proper place for the redirect is in the global.cfg? Because the global.cfg is the file responsible for actions on this type of email!! Actually, I've just checked, and the REDIRECT command will not work in the global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] REDIRECT configuration
Scott I had this problem with a domain that was not on my server and wanted to use REDIRECT to point ot another junkmail file. But it always used the outbound settings in the global.cfg. You said when I had the issue you were going to have this fixed in a future beta release. Has it been fixed Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, July 09, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] REDIRECT configuration 2. In the archives, ( This message specifically http://www.mail-archive.com/[EMAIL PROTECTED]/msg091 31.html) it says to put the configuration in the global.cfg file. However, if I'm reading the manual correctly, it says to put the configuration in $default$.junkmail. It should actually be the $default$.JunkMail file (technically, it can go in any file, but it needs to be whichever one Declude JunkMail is going to use to determine the actions to take on the E-mail, which would normally be the $default$.JunkMail file for incoming E-mail). So if it's a domain that is not housed on my server, the proper place for the redirect is in the global.cfg? Because the global.cfg is the file responsible for actions on this type of email!! Actually, I've just checked, and the REDIRECT command will not work in the global.cfg file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] REDIRECT configuration
I had this problem with a domain that was not on my server and wanted to use REDIRECT to point ot another junkmail file. But it always used the outbound settings in the global.cfg. You said when I had the issue you were going to have this fixed in a future beta release. Has it been fixed The REDIRECT option was set up that way by design, and I'm not aware of any plans to change the behavior. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] REDIRECT configuration
At 02:39 PM 7/9/2003, you wrote: I had this problem with a domain that was not on my server and wanted to use REDIRECT to point ot another junkmail file. But it always used the outbound settings in the global.cfg. You said when I had the issue you were going to have this fixed in a future beta release. Has it been fixed The REDIRECT option was set up that way by design, and I'm not aware of any plans to change the behavior. So if I was only going to use the REDIRECT command with those types of domain, don't worry about it? I should just stay with the tried and true method? I'll agree with Kevin, this would be a nice feature for store-and-forward domains. That way I don't have to maintain a bunch of separate folders and files. Thanks, Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bizarre DJM Pro Situation
.tpcper is Topica. They come out with new spamming domains continuously while keeping their IPs fixed. Blocking their IPs however, also blocks all the newsletters they publish. I've been testing their removal system for the last 2 months, if you enter the recipients email address here with the bottom 2 boxes checked, the tpcper spam stops: http://www.topica.com/help/unsub_all.html Dan On Wednesday, July 9, 2003 9:31, Dan Geiser [EMAIL PROTECTED] wrote: Hello, All, We are using DJM Pro. I'm having an issue with a message that I don't think should have been delivered. Here are the headers... - Received: from out017.tpcper.com [69.24.239.37] by pagerover.com (SMTPD32-6.06) id A4323AA80134; Sun, 06 Jul 2003 15:10:42 -0400 To: [EMAIL PROTECTED] From: Distribution [EMAIL PROTECTED] Subject: re: Take a Short Survey, Win a New Computer System! Date: Sun, 06 Jul 2003 12:08:04 -0700 Message-ID: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable X-Declude-Sender: [EMAIL PROTECTED] [69.24.239.37] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: OSSRC, EASYNET-DNSBL, IPNOTINMX, WEIGHT05, WEIGHT07, WEIGHTRANGE05-59, WEIGHTRANGE07-59 [8] X-Spam-Prob: 0.451398 X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 345762330 Status: U - This message was sent to one of our internal domains microgallery.com which is a host aliases on the IMail site pagerover.com The active entries in the $default$.junkmail are... - CATCHALLMAILS COPYTO [EMAIL PROTECTED] FROMFILE-HOLD HOLD IPFILE-HOLD HOLD MAILFROM HOLD WEIGHTRANGE05-59 HOLD WEIGHT60 ROUTETO [EMAIL PROTECTED] FILTER-BODY-IP WARN FILTER-BODY-PHONE WARN FILTER-BODY-URL WARN FILTER-MAILFROM WARN SPAMCOP WARN - and associated entries in GLOBAL.CFG are - WEIGHT60 weight x x 60 0 WEIGHTRANGE05-59 weightrange x x 5 59 FILTER-BODY-IP filter D:\iMail\declude\JunkMail.Filter.Body.IP.txt x 0 0 FILTER-BODY-PHONE filter D:\iMail\declude\JunkMail.Filter.Body.Phone.txt x 0 0 FILTER-BODY-URL filter D:\iMail\declude\JunkMail.Filter.Body.URL.txt x 0 0 FILTER-MAILFROM filter D:\iMail\declude\JunkMail.Filter.MailFrom.txt x 0 0 FROMFILE-HOLD fromfile D:\iMail\declude\JunkMail.FromFile.Hold.txt x 0 0 IPFILE-HOLD ipfile D:\iMail\declude\JunkMail.IPFile.Hold.txt x 0 0 - For the life of me I cannot figure out why this was delivered to the recipient. Does anyone have any insight? Thanks, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bizarre DJM Pro Situation
I had a very interesting and nice talk with the CEO of Topica at ISPCon in April. She was very proactive on the double opt-in service and to get their higher level of service, you must be double opt-in only! I encouraged her to set a deadline for everyone on their servers to be double opt-in and stick to it. They are way ahead of the rest of the mail houses and she was very blunt in saying it is actually good for their service as it all but eliminates customer support issues. But she also said she is meeting a lot of unnecessary resistance to it... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain - Original Message - From: Dan Patnode [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, July 09, 2003 2:48 PM Subject: Re: [Declude.JunkMail] Bizarre DJM Pro Situation .tpcper is Topica. They come out with new spamming domains continuously while keeping their IPs fixed. Blocking their IPs however, also blocks all the newsletters they publish. I've been testing their removal system for the last 2 months, if you enter the recipients email address here with the bottom 2 boxes checked, the tpcper spam stops: http://www.topica.com/help/unsub_all.html Dan On Wednesday, July 9, 2003 9:31, Dan Geiser [EMAIL PROTECTED] wrote: Hello, All, We are using DJM Pro. I'm having an issue with a message that I don't think should have been delivered. Here are the headers... - Received: from out017.tpcper.com [69.24.239.37] by pagerover.com (SMTPD32-6.06) id A4323AA80134; Sun, 06 Jul 2003 15:10:42 -0400 To: [EMAIL PROTECTED] From: Distribution [EMAIL PROTECTED] Subject: re: Take a Short Survey, Win a New Computer System! Date: Sun, 06 Jul 2003 12:08:04 -0700 Message-ID: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable X-Declude-Sender: [EMAIL PROTECTED] [69.24.239.37] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: OSSRC, EASYNET-DNSBL, IPNOTINMX, WEIGHT05, WEIGHT07, WEIGHTRANGE05-59, WEIGHTRANGE07-59 [8] X-Spam-Prob: 0.451398 X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 345762330 Status: U - This message was sent to one of our internal domains microgallery.com which is a host aliases on the IMail site pagerover.com The active entries in the $default$.junkmail are... - CATCHALLMAILS COPYTO [EMAIL PROTECTED] FROMFILE-HOLD HOLD IPFILE-HOLD HOLD MAILFROM HOLD WEIGHTRANGE05-59 HOLD WEIGHT60 ROUTETO [EMAIL PROTECTED] FILTER-BODY-IP WARN FILTER-BODY-PHONE WARN FILTER-BODY-URL WARN FILTER-MAILFROM WARN SPAMCOP WARN - and associated entries in GLOBAL.CFG are - WEIGHT60 weight x x 60 0 WEIGHTRANGE05-59 weightrange x x 5 59 FILTER-BODY-IP filter D:\iMail\declude\JunkMail.Filter.Body.IP.txt x 0 0 FILTER-BODY-PHONE filter D:\iMail\declude\JunkMail.Filter.Body.Phone.txt x 0 0 FILTER-BODY-URL filter D:\iMail\declude\JunkMail.Filter.Body.URL.txt x 0 0 FILTER-MAILFROM filter D:\iMail\declude\JunkMail.Filter.MailFrom.txt x 0 0 FROMFILE-HOLD fromfile D:\iMail\declude\JunkMail.FromFile.Hold.txt x 0 0 IPFILE-HOLD ipfile D:\iMail\declude\JunkMail.IPFile.Hold.txt x 0 0 - For the life of me I cannot figure out why this was delivered to the recipient. Does anyone have any insight? Thanks, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] REDIRECT configuration
The asumption is that multiple folders are needed, you are running multiple domains through the same gateway. I've been using REDIRECT for over a year and there are advantages to customization, being able to REDIRECt with some and SUBJECT with others, or different versions of each. Additionally, having or not have a default file for a given domain allows me to control which domains get filtering and when. Right now, for example, I'm working with a client who passed away in the middle of ramping up so I turned off filtering to let his wife take a breath before having to deal with it. To automate the process, you can use a .bat file such as this, which I use to update multiple servers at the same time: copy \\[source file]\\[destination server]\c$\imail\declude\domain.com Dan On Wednesday, July 9, 2003 13:46, Russ Uhte [EMAIL PROTECTED] wrote: At 02:39 PM 7/9/2003, you wrote: I had this problem with a domain that was not on my server and wanted to use REDIRECT to point ot another junkmail file. But it always used the outbound settings in the global.cfg. You said when I had the issue you were going to have this fixed in a future beta release. Has it been fixed The REDIRECT option was set up that way by design, and I'm not aware of any plans to change the behavior. So if I was only going to use the REDIRECT command with those types of domain, don't worry about it? I should just stay with the tried and true method? I'll agree with Kevin, this would be a nice feature for store-and-forward domains. That way I don't have to maintain a bunch of separate folders and files. Thanks, Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Spam News
Thought these might be of interest: New site spoofs PayPal to get billing information http://maccentral.macworld.com/news/2003/07/09/paypal/ Congress fights over spam opt-in rules http://maccentral.macworld.com/news/2003/07/09/spam/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Harvesting Attempt
The harvesting attempt is increasing every day. In 1 hour period , i can see minimum 20 different ip address trying to harvest user database. Many connection is made from the same user via proxy but it is really annoying for mail servers to deal with many ip address and to waste processor time and memory for this. We have finished the Dynamic Ip blocking system on the firewall , i am sending imail logs to sql server via kiwi syslog server , and a little program is accessing the firewall to block port 25 for the harvester ip address for 1 hour. My mail server is serving around 15000 user. I would like to know if anybody else had the harvesting problem ?? Or try any other method to prevent this. Here is the log : SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] SMTPD (014200EE) [218.64.154.82] ERR atlas.net.tr invalid user [EMAIL PROTECTED] Regards Rifat Levis --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam Attack
Just to let everyone know so others don't get hit with it, I just had a Spam attack/Bomb from one particular location. As soon as I found out I blocked everything possible and things are working. It was so bad that it killed the server. It came from: [217.16.118.12] MAIL From:[EMAIL PROTECTED] Every single e-mail was to the same address and from the same address and IP, there were a couple of thousand that attempted this. Just thought some others would like to know. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Attack
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka Sent: Wednesday, July 09, 2003 5:29 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam Attack Just to let everyone know so others don't get hit with it, I just had a Spam attack/Bomb from one particular location. As soon as I found out I blocked everything possible and things are working. It was so bad that it killed the server. It came from: [217.16.118.12] MAIL From:[EMAIL PROTECTED] Every single e-mail was to the same address and from the same address and IP, there were a couple of thousand that attempted this. My guess is there spam software is stuck in a loop and sending the the same address over and over? Just thought some others would like to know. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] X-Declude-Sender Missing from Header
Scott, We use the default XSENDER ON option in the Global.cfg file. The weird thing is that 98% of our email headers do have the X-DECLUDE-SENDER line listed properly. Thank You, JR Tatum, President Performance Dimensions, Inc. (336) 774-1849 mailto:[EMAIL PROTECTED] http://www.triadnetwork.com * This message and any included attachments are from PERFORMANCE DIMENSIONS, INC. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail. * -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, July 09, 2003 2:13 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] X-Declude-Sender Missing from Header We are seeing several spam emails delivered to our clients which are apparently able to bypass JMPro filters as there is no X-Declude-Sender line in the header. Can anyone explain why it is missing (see sample header below)? X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420e]. Declude JunkMail definitely scanned this E-mail. Are you using the XSENDER ON option, or are you using your own XINHEADER/XOUTHEADER option to produce the X-Declude-Sender: header? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] REDIRECT configuration
Scott If the domain is remote the redirect does not work because it is considered outgoing so the rules in the global.cfg are used. But when there is a domain level junkmail file specified for the remote domain declude processes the remote domain using the default.junkmail file for that domain. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Russ Uhte (Lists) Sent: Wednesday, July 09, 2003 1:46 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] REDIRECT configuration At 02:39 PM 7/9/2003, you wrote: I had this problem with a domain that was not on my server and wanted to use REDIRECT to point ot another junkmail file. But it always used the outbound settings in the global.cfg. You said when I had the issue you were going to have this fixed in a future beta release. Has it been fixed The REDIRECT option was set up that way by design, and I'm not aware of any plans to change the behavior. So if I was only going to use the REDIRECT command with those types of domain, don't worry about it? I should just stay with the tried and true method? I'll agree with Kevin, this would be a nice feature for store-and-forward domains. That way I don't have to maintain a bunch of separate folders and files. Thanks, Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Archives
Is may missing from the archives I am looking for a thread from May and I can not seem to find it. I have some of the messages saved locally but I am missing a few. I even search on the word header and nothing in May. Try searching Logging Nothing in April or May. I find this hard to believe unless there has been some data loss or the archives are corrupt somehow?? the thread I am looking for was titled Logging request. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] REDIRECT configuration
Scott, I found your email to me about this issue. Take a look what you wrote -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Friday, May 23, 2003 5:16 AM To: Kevin Bilbee Subject: RE: [Declude.JunkMail] Logging request That is correct but the only line in D:\IMAIL\Declude\sa_notes.sa-internal.com\$default$.junkmail file is the REDIRECT I've found out the problem. The REDIRECT command only works with incoming E-mail, not outgoing E-mail. Since the domain sa_notes.sa-internal.com is not on the IMail server, the REDIRECT command will not work. I'm going to investigate why we have it set up that way. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee Sent: Wednesday, July 09, 2003 5:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] REDIRECT configuration Scott If the domain is remote the redirect does not work because it is considered outgoing so the rules in the global.cfg are used. But when there is a domain level junkmail file specified for the remote domain declude processes the remote domain using the default.junkmail file for that domain. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Russ Uhte (Lists) Sent: Wednesday, July 09, 2003 1:46 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] REDIRECT configuration At 02:39 PM 7/9/2003, you wrote: I had this problem with a domain that was not on my server and wanted to use REDIRECT to point ot another junkmail file. But it always used the outbound settings in the global.cfg. You said when I had the issue you were going to have this fixed in a future beta release. Has it been fixed The REDIRECT option was set up that way by design, and I'm not aware of any plans to change the behavior. So if I was only going to use the REDIRECT command with those types of domain, don't worry about it? I should just stay with the tried and true method? I'll agree with Kevin, this would be a nice feature for store-and-forward domains. That way I don't have to maintain a bunch of separate folders and files. Thanks, Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Archives
They had a big outage during that time. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, July 09, 2003 5:57 PM To: JunkMail Declude Subject: [Declude.JunkMail] Archives Is may missing from the archives I am looking for a thread from May and I can not seem to find it. I have some of the messages saved locally but I am missing a few. I even search on the word header and nothing in May. Try searching Logging Nothing in April or May. I find this hard to believe unless there has been some data loss or the archives are corrupt somehow?? the thread I am looking for was titled Logging request. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Some Help needed on a couple of things
I finally have had the chance to upgrade to 1.65 and need a little help on a couple of things I have in my global.cfg file a couple of tests: BLACKLISTIP ipfile E:\IMail\Declude\ipblacklist.txt x 20 0 BLACKLISTDOMAIN filter E:\IMail\Declude\domainblacklist.txt x 20 0 one is an ip address test and the other is a domain test The domain test file has about 90 lines of: MAILFROM 20 CONTAINS myfulfillments.com MAILFROM 20 CONTAINS forumxpress.com MAILFROM 20 CONTAINS mail.almtal.net The IP test has the following code on separate lines: 80.0.122.0/24 This is a spam IP address 211.43.197.0/24 This is a spam IP address 218.146.185.0/24 This is a spam IP address In my default.jumkmail I have: BLACKLISTIP DELETE BLACKLISTDOMAIN DELETE IN the log files I am seeing this: 07/09/2003 20:21:41 Qbf9a3efa012ca2d1 Msg failed BLACKLISTIP ( This is a spam IP address). Action=IGNORE. 07/09/2003 20:21:41 Qbf9a3efa012ca2d1 Msg failed BLACKLISTDOMAIN (Message failed BLACKLISTDOMAIN test (79)). Action=IGNORE. So it looks like I have both these test set up wrong Can anyone point me in the right direction? Thanks in advance gb --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Some Help needed on a couple of things 2
I just checked the log files again and I am seeing this: 07/09/2003 20:26:04 Qc0a12c1600c8a399 Msg failed BLACKLISTIP ( This is a spam IP address). Action=DELETE. 07/09/2003 20:26:04 Qc0a12c1600c8a399 Msg failed BLACKLISTDOMAIN (Message failed BLACKLISTDOMAIN test (79)). Action=DELETE. So it looks like the test delete sometimes and then sometimes they do ignore Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Attack
I first thought that but there are different messages, just bad jokes each message. There were also some viruses atteched which were caught. Jeff -- Original Message -- From: Kevin Bilbee [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 9 Jul 2003 17:39:39 -0700 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka Sent: Wednesday, July 09, 2003 5:29 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam Attack Just to let everyone know so others don't get hit with it, I just had a Spam attack/Bomb from one particular location. As soon as I found out I blocked everything possible and things are working. It was so bad that it killed the server. It came from: [217.16.118.12] MAIL From:[EMAIL PROTECTED] Every single e-mail was to the same address and from the same address and IP, there were a couple of thousand that attempted this. My guess is there spam software is stuck in a loop and sending the the same address over and over? Just thought some others would like to know. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- ** TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] ** -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam Attack
These IP addresses are blacklisted as an open relay in ORDB etc. Check http://www.dnsstuff.com/tools/ip4r.ch?ip=217.16.118.12 Cheers Adrian - - Original Message - From: Jeff Kratka [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, July 10, 2003 12:43 PM Subject: RE: [Declude.JunkMail] Spam Attack I first thought that but there are different messages, just bad jokes each message. There were also some viruses atteched which were caught. Jeff -- Original Message -- From: Kevin Bilbee [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 9 Jul 2003 17:39:39 -0700 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka Sent: Wednesday, July 09, 2003 5:29 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam Attack Just to let everyone know so others don't get hit with it, I just had a Spam attack/Bomb from one particular location. As soon as I found out I blocked everything possible and things are working. It was so bad that it killed the server. It came from: [217.16.118.12] MAIL From:[EMAIL PROTECTED] Every single e-mail was to the same address and from the same address and IP, there were a couple of thousand that attempted this. My guess is there spam software is stuck in a loop and sending the the same address over and over? Just thought some others would like to know. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- ** TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] ** -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spoolviewer.exe - bug?
Scott: Does spoolviewer.exe look at the registry to determine the actual spool location? We just moved our spool to a different physical volume to improve performance... D:\imail\spool - e:\imail\spool everything else remained on D except the spool. Everything is functioning great (doubled our performance too!) except now spoolviewer.exe reports all 0's Thanks Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
