[Declude.JunkMail] IPNOTINMX and REVDNS Questions
Hello, Most of the mail sent by mail clients within my organization fails the IPNOTINMX and REVDNS. Is there a way for me to setup Declude to skip this test if the mail is sent from a range of IP blocks? Alternatively is there a way for mail to automatically pass the IPNOTINMX and REVDNS if sent from a range of IP blocks? Thanks, Burzin -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: FireWall VPN Opinion
Go for Checkpoint's 25 user/IP option. You can buy two Nokia IP350's on Ebay for $400.00 each. Blows Sonicwall, Watchguard and anything else outtta' the water. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Sunday, November 16, 2003 3:49 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: FireWall VPN Opinion I need to setup a VPN between two offices with under 25 computers one location and 5 at the other end. Both offices also need client remote VPN from windows XP What are your opinions on the SONICWALL and WATCHGUARD products Sonicwall SOHO 3 or Warchguard SOHO 6tc Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IPNOTINMX and REVDNS Questions
Most of the mail sent by mail clients within my organization fails the IPNOTINMX and REVDNS. That is quite common. Is there a way for me to setup Declude to skip this test if the mail is sent from a range of IP blocks? No. However: Alternatively is there a way for mail to automatically pass the IPNOTINMX and REVDNS if sent from a range of IP blocks? You could whitelist your IP range if you like. For example, you could add a line WHITELIST IP 192.0.2.0/24 to the \IMail\Declude\global.cfg file, which would whitelist all E-mail in the 192.0.2.0 Class C range. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Updater
Hi Markus, Yep. I installed it on my XP Pro (SP1+) workstation, created a zero-length declude.exe in the Imail directory, and got the same results. I figured that this may have been because I didn't actually have Imail on the machine, so I repeated the process on a Imail Express box (W2K SP4+). Same results. In both cases DU downloaded the Release and Beta. It just didn't copy them to c:\imail. I suppose its possible that it's trying to copy and not overwriting, but I'm not sure how to figure that out. Burzin At 12:16 PM 11/16/2003, you wrote: Burzin, I have no idea why I doesn't work. Have you tried to install DU on another machine for testing? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] unacceptable mail address?
I just started receiving this error in my imail log files the other, and only from this domain... does any one know what this means? or how i can fix it?? 11:17 12:00 SMTPD(25D0010C) [216.0.0.8] unacceptable mail address in MAIL From:[EMAIL PROTECTED] thanks in advance for your time! ken --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] unacceptable mail address?
I just started receiving this error in my imail log files the other, and only from this domain... does any one know what this means? or how i can fix it?? 11:17 12:00 SMTPD(25D0010C) [216.0.0.8] unacceptable mail address in MAIL From:[EMAIL PROTECTED] There's about a 95% chance that you have [EMAIL PROTECTED] or @netnitco.net in your IMail SMTP Kill File. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: DNS Issues
I just finished moving all of my servers to all new boxes on a new backbone connection with my own ARIN designation. The problem I seem to suffering from is, even though I have 1 hour TTL's some ISP's are taking days to refresh the records for many of the servers and the hosted domains. I moved the Mail server and DNS servers about 2 weeks earlier with no problems, but the others are killing me since now I have a lot of customers complaining they can't see or modify their sites. I have checked DNSStuff and many similar sites, and all say everything is correct, yet customers still see the wrong thing, even after ipconfig /flushdns on XP and 2k. Everything has been moved now, and is coming back to normal, however, I would like to be able to prevent it in the future, I will be moving servers from other companies into my address space (we are aquiring). My zone is argolink.net, and one zone I had particular problems with is houstonsweddingguide.com. If you want more examples, I have plenty of zones to poke at. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] unacceptable mail address?
yup, that was it,. thanks! ken Monday, November 17, 2003, 12:58:34 PM, you wrote: I just started receiving this error in my imail log files the other, and only from this domain... does any one know what this means? or how i can fix it?? 11:17 12:00 SMTPD(25D0010C) [216.0.0.8] unacceptable mail address in MAIL From:[EMAIL PROTECTED] RSP There's about a 95% chance that you have [EMAIL PROTECTED] or RSP @netnitco.net in your IMail SMTP Kill File. RSP -Scott RSP --- RSP Declude JunkMail: The advanced anti-spam solution for IMail mailservers. RSP Declude Virus: Catches known viruses and is the leader in mailserver RSP vulnerability detection. RSP Find out what you've been missing: Ask about our free 30-day evaluation. RSP --- RSP [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP --- RSP This E-mail came from the Declude.JunkMail mailing list. To RSP unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP type unsubscribe Declude.JunkMail. The archives can be found RSP at http://www.mail-archive.com. RSP --- RSP [This E-mail scanned for viruses by Declude Virus] -- Best regards, Administrationmailto:[EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blacklist format question
Is this the proper format for a blacklist entry in global.cfg (I use tabs in my actual file instead of spaces) I-BLACKLIST fromfile z:\blah\blah\i-bl.txt x 6 0 And inside that file, are these sample entries properly formatted? @05.pn01.com I-Blacklist @05vvec.gq.nu I-Blacklist @05world.co.kr I-Blacklist Just checking. I installed a new blacklist but it hasn't caught anything yet. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist format question
Is this the proper format for a blacklist entry in global.cfg (I use tabs in my actual file instead of spaces) I-BLACKLIST fromfile z:\blah\blah\i-bl.txt x 6 0 That will work fine for a sender blacklist. And inside that file, are these sample entries properly formatted? @05.pn01.com I-Blacklist @05vvec.gq.nu I-Blacklist @05world.co.kr I-Blacklist That looks perfect. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail blacklist, phrase list converter
I've written a ColdFusion program that converts Imail blacklist entries to Declude format. The same program takes the Imail phrase list and creates a Declude filter file, where the text of each line in the original file becomes a SUBJECT CONTAINS and BODY CONTAINS test. Don't know how many CF'ers there are out there. If you want a copy let me know. Suggestions for improvement gladly accepted. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: DNS Issues
Chuck, I don't believe there is any way to prevent that from happening. Some ISP's configure their DNS servers to override your TTL settings and can keep things cached in DNS for as long as 48 hours (from what I hear). The only thing that I could think of doing what you already did in this case would be to set up a router or proxy server on the old address space to do do some translation while that block is still active. Starting such cutovers early Saturday morning is also probably a good idea :) Matt Charles Frolick wrote: I just finished moving all of my servers to all new boxes on a new backbone connection with my own ARIN designation. The problem I seem to suffering from is, even though I have 1 hour TTL's some ISP's are taking days to refresh the records for many of the servers and the hosted domains. I moved the Mail server and DNS servers about 2 weeks earlier with no problems, but the others are killing me since now I have a lot of customers complaining they can't see or modify their sites. I have checked DNSStuff and many similar sites, and all say everything is correct, yet customers still see the wrong thing, even after ipconfig /flushdns on XP and 2k. Everything has been moved now, and is coming back to normal, however, I would like to be able to prevent it in the future, I will be moving servers from other companies into my address space (we are aquiring). My zone is argolink.net, and one zone I had particular problems with is houstonsweddingguide.com. If you want more examples, I have plenty of zones to poke at. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
I'm a CFer; I'd like to see a copy of that. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Robertson Sent: Monday, November 17, 2003 1:22 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Imail blacklist, phrase list converter I've written a ColdFusion program that converts Imail blacklist entries to Declude format. The same program takes the Imail phrase list and creates a Declude filter file, where the text of each line in the original file becomes a SUBJECT CONTAINS and BODY CONTAINS test. Don't know how many CF'ers there are out there. If you want a copy let me know. Suggestions for improvement gladly accepted. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
I would be interested. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Robertson Sent: Monday, November 17, 2003 11:22 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Imail blacklist, phrase list converter I've written a ColdFusion program that converts Imail blacklist entries to Declude format. The same program takes the Imail phrase list and creates a Declude filter file, where the text of each line in the original file becomes a SUBJECT CONTAINS and BODY CONTAINS test. Don't know how many CF'ers there are out there. If you want a copy let me know. Suggestions for improvement gladly accepted. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
OK, give me a bit to spiff it up a bit. I'm going to add in the ability to download and unzip the source files from the Ipswitch site, and have it check a 'skip list' before adding domains, so you only have to remove unwanted blacklistings once. In response to another off-list query, I have averaged the performance I'm getting, and with logs set to 'debug' I averaged 245ms per mailpiece over several dozen receipts. No idea what it was before I added the phrase and black list checking. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Store and Forward Question
Since Imail doesn't have a way to reject an email based on its size when a domain is setup in a Gateway scenario (i.e. store and forward), I thought I would post this to the Declude community. Does Declude JMPro have a way to bounce an email based upon its size? What we are seeing, is when an email comes in to Imail (Store and forward setup), Declude scans it for viruses and spam and then Imail attempts delivery to remote SMTP server. The remote SMTP server has restrictions placed upon acceptance, in that if the email is over 3mb in size, it will not accept. The remote server kindly tells our Imail server that it was rejected due to size restrictions (shows in syslog on Imail), however, Imail then bounces the email back to the sender as undeliverable, no notation that it failed due to size restrictions. I understand that the sending server doesn't connect directly with the remote server, however, there has to be a better way to get a 'size rejected notification' back to the original sender. Thanks for any aid. Keith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Strange Anomaly
We are running Declude JMPro Version 1.76i13. Most of our domains are setup using the Per Domain configuration, in those configs, we have setup ROUTETO statements to route their spam to a certain email address either local or remote. Since last Thursday (off and on before that), some spam email has been appearing in the SPAM folder in the Spool directory (although we do not send any spam to that folder). I just checked it and we had over a 1000 in there. I looked at the D* files and they show that these emails were sent to domains that had per domain setup configs. These domains have been setup and working for well over a year. We run Imail 8.04 on Windows 2000 SP4. Has anyone seen this. Also, we have started to see several emails that don't show any X information placed in them by Declude. We traced them in the Imail syslog and they show accepted and Q* assignment given with delivery. They arrive to the inbox of the users untouched by Declude (no header info inserted). Anyone seen this as well. Thanks for the aid, Keith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Scott, Can I set up a blacklist as follows, where the blacklisted url is also the url's description? I want to be able to see the failed url in the logs. @zthub.ct.flasail.com zthub.ct.flasail.com @zthub.oo.flasail.com zthub.oo.flasail.com @zthub.wc.flasail.com zthub.wc.flasail.com @ztjxr.ct.flasail.com ztjxr.ct.flasail.com If so, whats the char limit? Accepts special chars like % ? Thx, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Strange Anomaly
- Original Message - From: Keith Johnson [EMAIL PROTECTED] Has anyone seen this. We don't use any per-user configurations, so have not seen this one. Also, we have started to see several emails that don't show any X information placed in them by Declude. We traced them in the Imail syslog and they show accepted and Q* assignment given with delivery. They arrive to the inbox of the users untouched by Declude (no header info inserted). Anyone seen this as well. Yes, we have seen this one and I have posted info to the list about these message with missing Declude headers a couple of times. Scott says it is most likely because the E-mail was incorrectly being sent with a CR or LF character instead of the proper CRLF sequence, and that's where it's been left. The messages look fine to me and I do not see any headers in the body of the message, and the IMail and JunkMail logs look perfectly normal, so...? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Can I set up a blacklist as follows, where the blacklisted url is also the url's description? I want to be able to see the failed url in the logs. @zthub.ct.flasail.com zthub.ct.flasail.com @zthub.oo.flasail.com zthub.oo.flasail.com @zthub.wc.flasail.com zthub.wc.flasail.com @ztjxr.ct.flasail.com ztjxr.ct.flasail.com If so, whats the char limit? Accepts special chars like % ? That would work fine -- I believe there is a limit of 1000 characters on the line, and any standard (non-high-bit and non-control) characters can be used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Strange Anomaly
Since last Thursday (off and on before that), some spam email has been appearing in the SPAM folder in the Spool directory (although we do not send any spam to that folder). This will happen if the HOLD action is used. I would suggest checking your config files to see where the HOLD action appears -- it's almost certainly somewhere in your config files. Also, we have started to see several emails that don't show any X information placed in them by Declude. We traced them in the Imail syslog and they show accepted and Q* assignment given with delivery. They arrive to the inbox of the users untouched by Declude (no header info inserted). Anyone seen this as well. Does the Declude JunkMail log file show any information about the E-mail? There have been unconfirmed reports of IMail v8 skipping Declude processing that we are investigating. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail blacklist, phrase list converter
OK, I've completed what I suppose you could call the first version of my Imail-to-Declude black- and phrase-list converter. Get it here: http://foohbar.com/declude_importer.zip It turned into a complete ColdFusion application. The system will 1. Retrieve source files from ftp.ipswitch.com 2. Convert the url blacklist into a Declude sender blacklist (skipping any entries you have placed in a separate skip list) 3. Convert the phrase list into a Declude filter file. Filters will be created for matches in subject and body. 4. FTP the newly minted files to the location you specify. NOTES: a. All settings are made in application.cfm, including filter weights. b. You can use the browser interface (index.cfm) to run all tests in sequence automatically, or individually. c. Since they can be run individually, you can opt to schedule the files to run automatically. d. You have to set up global.cfg and $default$.junkmail to use the new tests and files. e. With these tests in place, all mail tests take about 250ms per email tested. However, this is on MY server with MY configuration. Your mileage may vary. f. On a very fast server (dual 2ghz xeon with gobs of ram, super-duper scsi) the download/conversion/upload process takes just under three minutes. Most of this is the processing of the 17,000-entry url blacklist. On a slow server, it takes a lot longer. External dependencies: 1. The app uses the pkzip Command Line tool to unzip the Imail source files. You can alter the batch file and import01.cfm to use whatever command line unzip program you use. 2. cf_ProgressMeter is used to display a progress bar. This is a $5 tool I *highly* recommend. If you don't own it or don't want to buy it just go in and remove the calls to it in import02.cfm and import03.cfm. I'm in the process of rolling out a new web site in the next couple of days. I'll add this and anything else useful I can think of in the spamfighting section. If anyone has improvements to this, please pass 'em on! Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Analogs to Imail stuff?
If you couldn't already tell, I'm phasing out my use of some of Imail's anti-spam features by moving them into Declude where they can be run more responsibly. What I want is for Declude to be on the front line, but have Imail bat cleanup if it can do things Declude can't. With that in mind, Imail has the ability to Verify MAIL FROM address Perform a RevDNS on the connecting mail server Verify HELO/EHLO and delete (only :( ) at a threshold I specify. I already use Declude for the reverse DNS. Can it do the other two somehow? If not, I'd be considering dropping the RevDNS test in Declude and running the Imail versions, with a delete if all three hit. Does this sound like a good, bad or awful idea? -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] unknown (HELO localhost)
I notice a lot of "unknown (HELO localhost)" in the second received line.Would this ever be legit or could I filter on it?
RE: [Declude.JunkMail] Strange Anomaly
Does the Declude JunkMail log file show any information about the E-mail? There have been unconfirmed reports of IMail v8 skipping Declude processing that we are investigating I have a few emails saved that passed through Declude unscanned if they would be helpful. We are starting to see this every now and then. I'll look in the Declude log for the id. Thanks, Keith winmail.dat
