RE: [Declude.JunkMail] safe way to whitelist this
We negative weight and whitelist on rare occasions. The best thing is to notify them that they have configuration errors and let them know the consequences of the configuration errors. My bet is they do not even know there is a problem. You will be doing them a favor by notifying them. My guess is they have been trying to figure out why the occosional email never maket it to the intended recipient when in fact it is making it to their server it is just being deleted. I have found that many admins do not even know there is a problem. I have about a 30% success rate on getting them to fix their end. for example I notified Office Depot of their HELO and RDNS issues and they had them fixed in a day, they thanked me and told me that they had added a new mail server and the DNS admin added incorrect entries. If I had not notified them they might have lost customers over bad service due to legitimate mail being tagsed as spam. Notify susd.org and let them know the problem. If they fix the issue you need not change your configuration at all. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Dodell (by way of R. Scott Perry [EMAIL PROTECTED]) Sent: Tuesday, January 13, 2004 5:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] safe way to whitelist this I get email from the susd.org domain on a regular basic, but they are poorly setup. The headers appear as such: X-Declude-Sender: [EMAIL PROTECTED] [204.228.60.250] X-Spam-Tests-Failed: BASE64, HELOBOGUS, REVDNS, WEIGHT10 [10] X-Country-Chain: UNITED STATES-destination X-Note: This E-mail was sent from [No Reverse DNS] ([204.228.60.250]). X-Hello: pyle.susd.org X-Declude-Date: 01/13/2004 13:46:08 [0] I have the domain setup in a reverse domain test, but that doesn't negative weigh because they don't have a valid reverse DNS. How can I whitelist this domain safely? David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MIME encoding
How does Declude handle MIME encoded text? Or more to the point, which of the following would work properly for text that is only MIME encoded? BODY 25 CONTAINS .unbreak.biz BODY 25 CONTAINS =2eunbreak=2ebiz TIA, -Marc --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MIME encoding
Use this one declude does not decode the message before scanning the body BODY 25 CONTAINS =2eunbreak=2ebiz Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Marc Hilliker Sent: Wednesday, January 14, 2004 12:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] MIME encoding How does Declude handle MIME encoded text? Or more to the point, which of the following would work properly for text that is only MIME encoded? BODY 25 CONTAINS .unbreak.biz BODY 25 CONTAINS =2eunbreak=2ebiz TIA, -Marc --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist help
Hi We do business with BeFree. We've never actually seen any spam from them (we've seen people spamming using BeFree links, but that's an entirely different kettle of fish). Because of that, I want to get their e-mail when it is truly sent from them to us. So, if I've got this right, whitelist revdns .bfast.com does that for me. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, January 14, 2004 12:13 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist help bfast.com is only very partially legit, so I wouldn't be counterbalancing their domain. http://groups.google.com/groups?hl=enlr=ie=ISO-8859-1scoring=dq=bfast.co m+group%3A*abuse*btnG=Google+Search ValueClick owns BeFree, and recently bought the notorious Rokso listed spam house, Hi-Speed Media to add to their operations. The company generally sends spam for first rate clients from their closely associated operations, but make no bones about it, they are a very high volume host that controls over 10,000 IP's. 64.70.10.64/26ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.70.10.64 - 64.70.10.127] - 12/26/2003 64.70.17.0/24ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.70.17.0 - 64.70.17.255] - 12/26/2003 64.70.38.156/30ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.70.38.156 - 64.70.38.159] - 12/26/2003 64.70.54.0/24ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.70.54.0 - 64.70.54.255] - 12/26/2003 64.158.223.0/24ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.158.223.0 - 64.158.223.255] - 12/26/2003 65.167.38.0/25ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [65.167.38.0 - 65.167.38.127] - 12/26/2003 64.251.4.0/24ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.251.4.0 - 64.251.4.255] - 12/26/2003 64.251.16.192/27ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [64.251.16.192 - 64.251.16.223] - 12/26/2003 66.117.0.0/19ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [66.117.0.0 - 66.117.31.255] - 12/26/2003 66.207.130.0/23ValueClick/BFAST/Hi-Speed Media (SBL10912, 8948, 11533, ROK2762, etc.) [66.207.130.0 - 66.207.131.255] - 12/26/2003 64.251.19.0/24ValueClick/BFAST/Hi-Speed Media/HBCLB.com (SBL10912, 8948, 11533, ROK2762, etc.)[64.251.19.0 - 64.251.19.255] - 01/04/2004 For places like this, I would recommend only negative weighting what's unique to the list owner, in some cases a header search might be required if the MAILFROM uses the bfast.com domain, i.e. HEADERS -10 CONTAINS from: [EMAIL PROTECTED] I'm not sure if you've verified this either, but I think that PrintPal may buy spamming services, in which case, they picked the right spammer to carry their messages. Matt Robert Grosshandler wrote: Hi I have Whitelist revdns .befree.com in my global.cfg. The following e-mail didn't get whitelisted. When I check out the reverse on it, I find that it is pg1bms00.bfast.com So, if I add Whitelist revdns .bfast.com I should be in better shape. Am I missing anything? Received: from PG1BMS00.BEFREE.COM [66.207.131.110] by smtp.igive.com with ESMTP (SMTPD32-8.05) id AF8C64470020; Tue, 13 Jan 2004 14:05:32 -0600 Received: from omitted by PG1BMS00.BEFREE.COM (LSMTP for Windows NT v1.1b) with SMTP id [EMAIL PROTECTED]; Tue, 13 Jan 2004 15:20:58 -0500 Date: Tue, 13 Jan 2004 13:50:00 -0500 From: [EMAIL PROTECTED] Subject: Printpal.com January Affiliate News To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Message-Id: [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To
Re: [Declude.JunkMail] Whitelist help
Robert Grosshandler wrote: Hi We do business with BeFree. We've never actually seen any spam from them (we've seen people spamming using BeFree links, but that's an entirely different kettle of fish). It's not a different kettle of fish, just a different kettle of domains and IP's that they spam from. Because of that, I want to get their e-mail when it is truly sent from them to us. So, if I've got this right, whitelist revdns .bfast.com does that for me. Yes. rant=on I would hope though that people wouldn't support organizations like this because the fact that there's money in this is why they're doing it. Over 80% of my mail volume is junk, and countless businesses have been paralyzed in regards to E-mail because people stop checking their accounts when they get 300 pieces of spam per day, the majority of which comes from a small group of companies like ValueClick. rant=off Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Does Diskeeper Help on an imail server
My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks Sent via the WebMail system at mail1.cmsinter.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
Our experience with Diskeeper on a very busy machine is quite honestly, no. Diskeeper needs disk I/O cycles to do its work and must steal them from other processes. Unfortunately, IMail is also disk intensive, creating massive contention for drive resources. Suggestion: DO NOT use Smart Scheduling mode on a server as it may start at any time without regard to high load time segments. Do you have a window when the server is less loaded? Perhaps 3-5am? That is our window for virus scans, backups and diskeeper defrags (every night) on all our servers. Our activity is light during this window and the impact to our customers is negligible. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Timothy Bohen Sent: Wednesday, January 14, 2004 9:47 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Does Diskeeper Help on an imail server My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks Sent via the WebMail system at mail1.cmsinter.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNSstuff.com down??
Is DNSstuff.com down??? I can not seem to get to it. Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DNSstuff.com down??
Is DNSstuff.com down??? I can not seem to get to it. Yes, it is down. We are investigating to see what the problem is. Until it is back online, you can use http://ca.dnsstuff.com , which has most of the DNS tools available. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
I use diskeeper and use the set it and forget. I use the smart scheduling and it works like a champ on my servers (gateway and pop3/webmail server). Thanks, Kris McElroy [EMAIL PROTECTED] Chief Technology Officer Duracom, INC. www.duracom.net I am always doing that which I can not do, in order that I may learn how to do it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Timothy Bohen Sent: Wednesday, January 14, 2004 11:47 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Does Diskeeper Help on an imail server My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks Sent via the WebMail system at mail1.cmsinter.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Does Diskeeper Help on an imail server
At 12:47 PM 1/14/2004, Timothy Bohen wrote: My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks I generally process about 200,000 messages per day (or roughly 2/sec.) Diskeeper made a world of difference on my server. I schedule it to do smart scheduling on off peak hours, and it has no problem keeping up. Well worth the money in my opinion. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
This is good stuff, other than the obvious scheduling capability, does diskeeper do a better job than the built-in defrag in windows server? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Russ Uhte (Lists) Sent: Wednesday, January 14, 2004 8:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Does Diskeeper Help on an imail server At 12:47 PM 1/14/2004, Timothy Bohen wrote: My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks I generally process about 200,000 messages per day (or roughly 2/sec.) Diskeeper made a world of difference on my server. I schedule it to do smart scheduling on off peak hours, and it has no problem keeping up. Well worth the money in my opinion. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Does Diskeeper Help on an imail server
I'm wondering about similar things along these lines. I assume that Diskeeper does a better job and is more efficient and has nice reporting tools, but is this more of a convenience for those with lower volume servers? I'm particularly interested in the effect on RAID 5. Thanks, Matt Omar K. wrote: This is good stuff, other than the obvious scheduling capability, does diskeeper do a better job than the built-in defrag in windows server? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Russ Uhte (Lists) Sent: Wednesday, January 14, 2004 8:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Does Diskeeper Help on an imail server At 12:47 PM 1/14/2004, Timothy Bohen wrote: My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks I generally process about 200,000 messages per day (or roughly 2/sec.) Diskeeper made a world of difference on my server. I schedule it to do smart scheduling on off peak hours, and it has no problem keeping up. Well worth the money in my opinion. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] Does Diskeeper Help on an imail server
Hmm, some answers possibly: http://www.serverworldmagazine.com/monthly/2002/02/xpdefrag.shtml Sounds better, definitely faster, more configurable, but it doesn't sound like it's a huge leap ahead of built in functionality when it comes to results. This could though make a big difference on a stressed server as every bit counts, and the automation acts pre-emptively. Matt Omar K. wrote: This is good stuff, other than the obvious scheduling capability, does diskeeper do a better job than the built-in defrag in windows server? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Russ Uhte (Lists) Sent: Wednesday, January 14, 2004 8:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Does Diskeeper Help on an imail server At 12:47 PM 1/14/2004, Timothy Bohen wrote: My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks I generally process about 200,000 messages per day (or roughly 2/sec.) Diskeeper made a world of difference on my server. I schedule it to do smart scheduling on off peak hours, and it has no problem keeping up. Well worth the money in my opinion. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Why is FROM Header wrong?
Scott: the de facto standard is to have a space after the colon in all Internet headers. There IS space after the colon - do you mean a space after between the quote and the less-than symbol? From: GOERING iSeries Solutions[EMAIL PROTECTED] Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Why is FROM Header wrong?
the de facto standard is to have a space after the colon in all Internet headers. There IS space after the colon - do you mean a space after between the quote and the less-than symbol? Sorry, you are correct (I hate variable spaced fonts...). In this case, the problem is that there is no space after the quote and before the less-than symbol. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
At 01:54 PM 1/14/2004, Omar K. wrote: This is good stuff, other than the obvious scheduling capability, does diskeeper do a better job than the built-in defrag in windows server? I found that I had to run windows defrag a few times before it would effectively defrag the drive. By the time it was defragged, it was time to defrag again. So I use the scheduling feature in diskeeper, and I don't have to worry about it anymore. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Does Diskeeper Help on an imail server
At 02:29 PM 1/14/2004, Matt wrote: I'm wondering about similar things along these lines. I assume that Diskeeper does a better job and is more efficient and has nice reporting tools, but is this more of a convenience for those with lower volume servers? I'm particularly interested in the effect on RAID 5. I've never really used the reporting tools, and I don't know that they're really all that great. As far as my other servers (web, dns, file...) I just use the built in defrag utility, and that works great on those servers. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Habeus log entry
I am not entirely sure what the log entries mean for Habeas. I have changed from the whitlisting to a standard test as follows: HABEAS habeas x x 0 10 What I get is a log entry like this: nHABEAS:10 It was intended to reduce the total if a Habeus warrant mark was detected, whether a legitimate one or not, but when I add up all scores, like this: SNIF-FINANC:16 nHABEAS:10 NOLEGITCONTENT:2 SPAMHEADERS:12 . Total weight = 40 there has been no reduction, but rather an increase. What gives? Erik Erik Hjelholt, Managing Director Alberni-dot-Net, a div. of Tandem Security Inc. 4716 Roger St., Port Alberni, BC V9Y 3Z2 Phone: 250-720-8110 - Fax: 250-723-0901 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Habeus log entry
- Original Message - From: Tandem Group [EMAIL PROTECTED] I am not entirely sure what the log entries mean for Habeas. I have changed from the whitlisting to a standard test as follows: HABEAS habeas x x 0 10 What I get is a log entry like this: nHABEAS:10 It was intended to reduce the total if a Habeus warrant mark was detected, whether a legitimate one or not, but when I add up all scores, like this: SNIF-FINANC:16 nHABEAS:10 NOLEGITCONTENT:2 SPAMHEADERS:12 . Total weight = 40 there has been no reduction, but rather an increase. What gives? Try: HABEAS habeas x x 0 -10 (add the minus - sign) if you want a weight reduction. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Habeas log entry
I thought Scott had it configured that if the Habeas headers were found, it was considered a fail and therefore the negative weight should be the first weight parameter, not the second. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Wednesday, January 14, 2004 4:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Habeus log entry - Original Message - From: Tandem Group [EMAIL PROTECTED] I am not entirely sure what the log entries mean for Habeas. I have changed from the whitlisting to a standard test as follows: HABEAS habeas x x 0 10 What I get is a log entry like this: nHABEAS:10 It was intended to reduce the total if a Habeus warrant mark was detected, whether a legitimate one or not, but when I add up all scores, like this: SNIF-FINANC:16 nHABEAS:10 NOLEGITCONTENT:2 SPAMHEADERS:12 . Total weight = 40 there has been no reduction, but rather an increase. What gives? Try: HABEAS habeas x x 0 -10 (add the minus - sign) if you want a weight reduction. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Habeas log entry
I thought Scott had it configured that if the Habeas headers were found, it was considered a fail ... Correct. ... and therefore the negative weight should be the first weight parameter, not the second. Correct. So: HABEAS habeas x x -10 0 would probably be the best way to set it up. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
Always remember, You get what you pay for. The windows defrager is free and is essentially Diskeeper Light. Our testing has shown that the full version is faster and does a better job during each pass (usually only a single pass is required). And I don't remember if the windows defragger supports boot-time defragmentation. We run this about once a month to cleanup the things that can't be done during normal windows operation. However, this does require that the server be down during the boot-time defrag. Don't short change yourself, go with the full version! You'll be very happy with it. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Omar K. Sent: Wednesday, January 14, 2004 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Does Diskeeper Help on an imail server This is good stuff, other than the obvious scheduling capability, does diskeeper do a better job than the built-in defrag in windows server? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Russ Uhte (Lists) Sent: Wednesday, January 14, 2004 8:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Does Diskeeper Help on an imail server At 12:47 PM 1/14/2004, Timothy Bohen wrote: My imail server is obviously hugely fragmented. If I spend the money on diskeeper will it be able to keep up with the fragmentation on a very busy imail server? I know this isn't a diskeeper mailing list but I always get the best/fastest answers on this list. Thanks I generally process about 200,000 messages per day (or roughly 2/sec.) Diskeeper made a world of difference on my server. I schedule it to do smart scheduling on off peak hours, and it has no problem keeping up. Well worth the money in my opinion. -Russ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Unknown Var log entries
Scott, have you determined yet what is causing these random Unknown Var log entries? I am running 1.77i18 and still seeing about 250 of these log entries per day. Unknown Var: %: %WARNING% %: %WARNING% Unknown Var: %rning: %TESTNAME%: X-RBL-Warning: %rning: %TESTNA Unknown Var: %: %WARNING% X-RBL-Warning: %rning: %TESTNA Unknown Var: %X-RBL-Warning: %TES X-RBL-Warning: %X-RBL-Warning: Unknown Var: %: %WARNING% X-RBL-Warning: %X-RBL-Warning: Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Habeas Infringers ip4r test
I decided to test the Habeas Infringers ip4r test to see if it was working, and in 10 minutes the test has flagged 8 messages. Here is the entry I am using: HABEAS-INFRIGERip4rhil.habeas.com*50 It looks like a good way to offset the weight reduction Habeas test by making the positive weight for the infringer test greater then the negative weight for the normal Habeas test. Here is a sample of what I'm seeing thus far: 01/14/2004 16:54:57 Qe4cc575a0028a01d Msg failed HABEAS-INFRIGER 01/14/2004 16:54:57 Qe4cc575a0028a01d Msg failed HABEAS 01/14/2004 16:59:40 Qe5d26b5000949e45 Msg failed HABEAS-INFRIGER 01/14/2004 16:59:40 Qe5d26b5000949e45 Msg failed HABEAS 01/14/2004 16:59:41 Qe5d26b5000949e45 Msg failed HABEAS-INFRIGER 01/14/2004 16:59:41 Qe5d26b5000949e45 Msg failed HABEAS 01/14/2004 16:59:55 Qe5e76b590094f30c Msg failed HABEAS-INFRIGER 01/14/2004 17:02:05 Qe66a578a0028f1f9 Msg failed HABEAS-INFRIGER 01/14/2004 17:02:25 Qe67f579100284410 Msg failed HABEAS 01/14/2004 17:03:34 Qe6c657ab00285968 Msg failed HABEAS 01/14/2004 17:04:02 Qe6b457a00028126c Msg failed HABEAS 01/14/2004 17:04:34 Qe7126b7e00947f99 Msg failed HABEAS-INFRIGER 01/14/2004 17:06:08 Qe6fa6b7300942563 Msg failed HABEAS-INFRIGER 01/14/2004 17:06:08 Qe6fa6b7300942563 Msg failed HABEAS 01/14/2004 17:10:28 Qe85257e1002862b2 Msg failed HABEAS 01/14/2004 17:10:34 Qe85d57e700288f50 Msg failed HABEAS-INFRIGER 01/14/2004 17:11:53 Qe8b858040028f316 Msg failed HABEAS And the messages failing the infringers test are indeed spam. Just curious, is anyone else using the Habeas Infringers test? If so, what are your results like? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Habeas Infringers ip4r test
Okay, so it was 16 minutes and I spelled INFRINGER wrong. So what... ;-) Bill - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 14, 2004 5:18 PM Subject: [Declude.JunkMail] Habeas Infringers ip4r test I decided to test the Habeas Infringers ip4r test to see if it was working, and in 10 minutes the test has flagged 8 messages. Here is the entry I am using: HABEAS-INFRIGERip4rhil.habeas.com*50 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Habeas Infringers ip4r test
:)) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Wednesday, January 14, 2004 5:26 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Habeas Infringers ip4r test Okay, so it was 16 minutes and I spelled INFRINGER wrong. So what... ;-) Bill - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 14, 2004 5:18 PM Subject: [Declude.JunkMail] Habeas Infringers ip4r test I decided to test the Habeas Infringers ip4r test to see if it was working, and in 10 minutes the test has flagged 8 messages. Here is the entry I am using: HABEAS-INFRIGERip4rhil.habeas.com*50 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Unknown Var log entries
Scott, have you determined yet what is causing these random Unknown Var log entries? I am running 1.77i18 and still seeing about 250 of these log entries per day. Unknown Var: %: %WARNING% %: %WARNING% Unknown Var: %rning: %TESTNAME%: X-RBL-Warning: %rning: %TESTNA Unknown Var: %: %WARNING% X-RBL-Warning: %rning: %TESTNA Unknown Var: %X-RBL-Warning: %TES X-RBL-Warning: %X-RBL-Warning: Unknown Var: %: %WARNING% X-RBL-Warning: %X-RBL-Warning: We are still investigating this issue, and trying to find the cause of it. If you could E-mail me off-list a full list of all those lines (using 'find Unknown Var dec.log file.txt' or similar), that would be useful. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] turn off one client
I know this has been answered before, but I can not find it in the archives. I have one client that wants to turn off the spam filter. I have individual directories for each domain that is running special weights and they are one. How can I disable declude for their specific domain without doing a global whitelist of their domain. thanks in advance gents gb --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] A single domain not able to whitelist
Initially I was trying to whitelist an entire hosted domain but was not able to do so. Declude still caught spam being sent to them. So upon further checking I found that that individual domain was actually using my top level config files when email was sent to that particular doamin, instead of the config files in their domain directory. So to please the client I simply tried to whitelist their entire domain, but no matter if I use the whitelist todomain or create a whitelistfilter, I can not seem to whitelist everything sent to their individual domain. I still see where spam is being caught in the log files. Where should I start to track down the problem...other domains with custom directories for weighting and filters work fine. I simply need to whitelist all email sent to them. Thanks in advance Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] turn off one client
I believe you want to make a per-domain config and inthe config file you put in there just make all the tests have WARN and nothing else so if a user in that domain wanted to they could filter mail based on the headers but you would not be blocking any mail at all. http://www.declude.com/JunkMail/manual.htm Per-Domain ConfigurationThe Standard and Pro versions of Declude JunkMail allow you to have different settings for each domain that you have. These will let you have different actions for each domain. In order to do this, you first need to create a subdirectory off of the Declude directory, with the same name as the domain you wish to change. For example, to add a per-domain configuration for "example.com", you would create the directory \IMail\Declude\example.com. Note that this needs to be the official domain name, not a domain alias (so if you have a domain "mail.example.com" with "example.com" as an alias, the directory should be "\IMail\Declude\mail.example.com\"). The exception is that if you have a user alias, the domain you use in the alias will take priority (for example, if the alias is "sales" that points to "[EMAIL PROTECTED]", you would need to use the directory "example.com"). It may be necessary to use two different directories, if you have users aliases pointing to domain aliases (a quirk in IMail). The next step is to copy the $default$.JunkMail file into that directory. Then, edit that file to reflect the settings you want for that domain. Or, to quickly disable spam control for a specific domain, you can whitelist all mail to the domain by using the "WHITELIST TODOMAIN @example.com" setting in the global.cfg file. Note that you should not delete the \IMail\Declude\$default$.JunkMail file. If that file does not exist, there will be no default settings for E-mail addressed to domains that do not have their own per-domain settings. Redirecting (groups)Another way for you to use per-domain configurations is by using redirecting, or groups. The REDIRECT command in a config file will instruct Declude JunkMail to use a different configuration file for a specific user or domain. To use this, the \IMail\Declude\$default$.JunkMail (or any of the per-user or per-domain config files) can have a line in the format "REDIRECT @example.com C:\IMail\Declude\filename.cfg". When Declude JunkMail sees this line, if it is processing mail to @example.com, Declude JunkMail will instead use the C:\IMail\Declude\filename.cfg file for determining the action to take on the E-mail. Note that while this option can be used in any of the Declude JunkMail configuration files, it will only be used in whatever configuration file that Declude JunkMail is using for an E-mail. For example, if you have a REDIRECT line in the \IMail\Declude\example.com\$default$.JunkMail file, Declude JunkMail won't use it for an E-mail to [EMAIL PROTECTED] --Joshua Levitsky, MCSE, CISSPSystem EngineerTime Inc. Information Technology[5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] - Original Message - From: "Glenn Brooks" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 14, 2004 11:01 PM Subject: [Declude.JunkMail] turn off one client I know this has been answered before, but I can not find it in the archives. I have one client that wants to turn off the spam filter. I have individual directories for each domain that is running special weights and they are one. How can I disable declude for their specific domain without doing a global whitelist of their domain. thanks in advance gents gb --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
