RE: Re[2]: [Declude.JunkMail] Declude and SPF
Now one of our customers send a legit message trough our mailserver. Your use of legit is confusing. Rephrased, an SPF TXT record _is_ a legitimate use policy. For the purposes of an SPF check, there is no greater arbiter of legitimacy than that record. I specified legit in this case to simply indicate that the message is not spam. The current implementation of SPF will identify this message as FAIL because it's coming from another IP then allowed in the SPF record. If I have to allow in the SPF record that the message can come in from many (all?) other IP's then the defensive function of SPF becomes pretty useless, or not? Wouldn't this create a wrong result for SPFFAIL? There are no wrong results with SPF (provided the SPF parser is written correctly). If you're saying that you set up an SPF record that will cause a fail for an IP or PTR that isn't listed explicitly in the record, and you send mail from such an IP, then a fail isn't wrong! Either the policy is wrong outright, or you haven't created a setup in which you can use non-SPF tokens (such as SMTP AUTH) to counteract the weight you're assigning to SPF FAIL. So it's important to clarify that without SMTP-AUTH whitelisting or IP-RANGE counterweighting Decludes SPF-implementation shouldn't be used with a strict SPF record that indicates to the rest of the world that a legit message from domain-xy.com should come only from our servers IP. Do I have to whitelist all local users in order to avoid false positives. Well, what's a local user? If a local user is an AUTHed user, then use WHITELIST AUTH; if a local user comes from a known IP range, then you can whitelist that IP if you think that's safe, or add that IP range to the SPF record (which will allow for sensitivity to other tests). I don't think local user is really such a helpful term, since it could cover just MAIL FROM: @example.com (as Declude uses in short-circuiting some tests), or something more true. A local user in my terms is anyone that connect to our server and both Imail and Declude handle this as outgoing message. Remote users send (incomming) messages that are delivered to local users. Wouldn't be possible to let declude check for SPF-Records only for incomming messages? BTW: We use Imail v7 without the possibility to whitelist SMTP-AUTHenticated users and without well defined IP ranges from which our customers connect from. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude headers missing from several e-mails
No backup software, no on access scanning. I am having some other problems with the machine - I'm about to nuke it regardless - I just wanted to make sure that declude was still being called to scan for viruses until I get this box formatted... ugh Unfortunately, if the files can't be locked by Declude, then it is likely that the E-mails would not get scanned for viruses. Declude expects to have exclusive access to those files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude headers missing from several e-mails
Thanks - It looks as if it was an aberration. I've checked a few different day's logs and didn't see could not lock file in any other log. Something must have been up. Maybe I should look through the logs more thouroughly and more often : ) Anything out there that could alert me to the fact that Declude hasn't scanned a file (I know that is a broad question) something that would scan the logs and e-mail me immediately if Declude encounters a severe error that causes an e-mail (or e-mails) not to be scanned? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, May 06, 2004 7:17 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude headers missing from several e-mails No backup software, no on access scanning. I am having some other problems with the machine - I'm about to nuke it regardless - I just wanted to make sure that declude was still being called to scan for viruses until I get this box formatted... ugh Unfortunately, if the files can't be locked by Declude, then it is likely that the E-mails would not get scanned for viruses. Declude expects to have exclusive access to those files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Attach Command
I am using the ATTACH command with the default spamattach.eml file. Is there a method to specify a different .eml file? I would like to have one per domain or for testing etc. Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] %WEIGHT% variable as -100
Scott, This may be very minor and possibly just cosmetic, I have found that some messages will have a %WEIGHT% variable returned for a WARN action that is -100 when such a score is impossible on our system. The example below is from a message that scored 0 in the logs (seemingly correct), but shows differently in the headers. I'm using 1.79i6 currently and am not aware of any ill effects as a result. Thanks, Matt 05/06/2004 10:21:44 Q49f201ad01ca801f L1 Message OK 05/06/2004 10:21:44 Q49f201ad01ca801f Subject: Your are ON OUR LIST -- from John 05/06/2004 10:21:44 Q49f201ad01ca801f From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 209.120.224.16 ID: 05/06/2004 10:21:44 Q49f201ad01ca801f Tests failed [weight=0]: CATCHALLMAILS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE SIZE-XS=IGNORE NOTNULL=IGNORE PASSED=IGNORE 05/06/2004 10:21:44 Q49f201ad01ca801f Last action = ""> Received: from lion.glypto.com [209.120.224.16] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A9F21AD01CA; Thu, 06 May 2004 10:21:38 -0400 Received: from nobody by lion.glypto.com with local (Exim 4.24) id 1BLjkl-0005Xn-Dr for [EMAIL PROTECTED]; Thu, 06 May 2004 09:21:35 -0500 To: [EMAIL PROTECTED] Subject: Your are ON OUR LIST -- from John From: [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] Date: Thu, 06 May 2004 09:21:35 -0500 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - lion.glypto.com X-AntiAbuse: Original Domain - inno-tech.com X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - no-reply.com X-MailPure: X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 10:21:44 on 05/06/2004 X-MailPure: Spool File: D49f201ad01ca801f.SMD X-MailPure: Server Name: lion.glypto.com X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: lion.glypto.com [209.120.224.16] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] IP In Hello
I have created a similar test that you pass teh %HELO% variable to here is my setup. I have 0 0 for the weights because I am still testing. I have found 1 false positive classmates.com has the ip xx-xx-xx-xx.classmates.com in their helo string. I have also seen a few of our customers sendign wellformed ip addresses as the helo string [xxx.xxx.xxx.xxx]. CIP-WellFormed external 10 D:\Imail\declude\ContainsIP.exe %HELO% 0 0 CIP-OnlyIpexternal 11 D:\Imail\declude\ContainsIP.exe %HELO% 0 0 CIP-FullMatch external 12 D:\Imail\declude\ContainsIP.exe %HELO% 0 0 CIP-LeadingTextMatctexternal 13 D:\Imail\declude\ContainsIP.exe %HELO% 0 0 CIP-TrailingTextMatch external 14 D:\Imail\declude\ContainsIP.exe %HELO% 0 0 Here is an example of each type of test match WellFormed- [12.9.25.244] This would be an ATT ip address wellformed in the HELO OnlyIp- 12.9.25.244 or 12-9-25-244 FullMatch - cpe-069-132-189-042.carolina.rr.com or client-200.106.20.200.speedy.net.pe LeadingTextMatch - xx3-client64-27-5-222-test.com TrailingtextMatch - xx3-client64-27-5-222test.com although this has a Leadgin and Trailing the Trailing will be the one returned. I have seen one abnomily with my code which I have not found a good way arround wbar1.tampa1-4-4-052-139.tampa1.dsl-verizon.net would match on 1.4.4.52 and return a LeadingTextMatch Here are my tats from yesterday for this test Total unique messages scanned: 3645 CIP-FullMatch : 78 3.31 %2.14 % CIP-LeadingTextMatch: 15 0.64 %0.41 % CIP-OnlyIp : 76 3.23 %2.09 % CIP-WellFormed : 1 0.04 %0.03 % Out of these there was 1 wellformed ip in the helo from a customer (it was also the only wellformed match for the day) I am not going to add weight for well formed ip address in the HELO 2 false positives from classmates.com 8 messages in the hold queue that would have been deleted if I was adding weight 4 messages that would have been held if I was adding weight Since the string to search is being passed as a variable you could use this test with the reverse dns string or pass any declude variable to the test. If anyone wants a copy let me know and I will send it to you. It is a .net 1.1 application I will be more than willing to add tests if anyone can think up any others that have a high probability of being spam. Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and SPF
Wouldn't be possible to let declude check for SPF-Records only for incomming messages? Not on version 7. decluse does not know if it is a local or remote user until Imail 8 and SMTP auth. Imail 8 indicates in the Q file it the user authed or not not if the user is local or remote. Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Email viewer
Hi All, What app are you using to view emails that have been held by Junkmail? TIA, Patrick Patrick Allison Information Technology System Specialist III Technology and Computer Service Centralia College Centralia, WA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Email viewer
Try SpamReview... http://www.slsoft.com/spamreview.htm Darin. - Original Message - From: Patrick Allison [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, May 06, 2004 2:14 PM Subject: [Declude.JunkMail] Email viewer Hi All, What app are you using to view emails that have been held by Junkmail? TIA, Patrick Patrick Allison Information Technology System Specialist III Technology and Computer Service Centralia College Centralia, WA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and SPF
Wouldn't be possible to let declude check for SPF-Records only for incomming messages? Not on version 7. decluse does not know if it is a local or remote user until Imail 8 and SMTP auth. Imail 8 indicates in the Q file it the user authed or not not if the user is local or remote. And why we can specify separate XINHEADER and XOUTHEADER lines? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and SPF
Good question I did not think of that. Scott will have to answer. I beleive that all message are incomming at one point. 1) User sends a message from client 2) the message is oncomming to SMTP 3) SMTP determines that it is for another server 4) It then becomes an outgoing message??? My Best Guess correct me if I am wrong. Kevin -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Thursday, May 06, 2004 12:19 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] Declude and SPF Wouldn't be possible to let declude check for SPF-Records only for incomming messages? Not on version 7. decluse does not know if it is a local or remote user until Imail 8 and SMTP auth. Imail 8 indicates in the Q file it the user authed or not not if the user is local or remote. And why we can specify separate XINHEADER and XOUTHEADER lines? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Attach Command
I am using the ATTACH command with the default spamattach.eml file. Is there a method to specify a different .eml file? I would like to have one per domain or for testing etc. No, only the \IMail\Declude\spamattach.eml file can be used with the ATTACH action. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and SPF
Not on version 7. decluse does not know if it is a local or remote user until Imail 8 and SMTP auth. Imail 8 indicates in the Q file it the user authed or not not if the user is local or remote. And why we can specify separate XINHEADER and XOUTHEADER lines? That's different. XINHEADER/XOUTHEADER looks to see whether the E-mail is incoming or outgoing (based on the recipient(s), which is never forged). All spam is incoming; the problem with SPF is determining if it is a local user that sent the E-mail. Declude can't trust the sender address (which is often forged). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude and SPF
And why we can specify separate XINHEADER and XOUTHEADER lines? That's different. XINHEADER/XOUTHEADER looks to see whether the E-mail is incoming or outgoing (based on the recipient(s), which is never forged). All spam is incoming; the problem with SPF is determining if it is a local user that sent the E-mail. Declude can't trust the sender address (which is often forged). Ok, I understand. So it would be usefull that a positive SPFFAIL result would be ignored if Declude can detect an SMTP-Authenticated user on v8 systems. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Attach Command
Scott, Then let me add that to the request for enhancement pile. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, May 06, 2004 3:34 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Attach Command I am using the ATTACH command with the default spamattach.eml file. Is there a method to specify a different .eml file? I would like to have one per domain or for testing etc. No, only the \IMail\Declude\spamattach.eml file can be used with the ATTACH action. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %WEIGHT% variable as -100
This may be very minor and possibly just cosmetic, I have found that some messages will have a %WEIGHT% variable returned for a WARN action that is -100 when such a score is impossible on our system. The example below is from a message that scored 0 in the logs (seemingly correct), but shows differently in the headers. I'm using 1.79i6 currently and am not aware of any ill effects as a result. X-MailPure: Spam Score: -100 How is the WARN action set up? Which version of Declude are you running? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %WEIGHT% variable as -100
Scott, Sorry, it wasn't the WARN action, it's coming from the XOUTHEADER (gatewayed client in this example): XOUTHEADERX-MailPure: Spam Score: %WEIGHT% - or - XINHEADERX-MailPure: Spam Score: %WEIGHT% 1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights were appearing about 500 points above what they really were (only in the %WEIGHT% variable). I don't believe this has affected how Declude handles the E-mail, just the %WEIGHT% variable itself. It appears that the issue with the -100 only happens when the total score is zero. I believe this is being passed off in the variable when used for external tests, but I haven't verified that yet. Thanks, Matt Received: from mx2.mailpure.com [63.170.56.5] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A5496AC01E4; Mon, 12 Apr 2004 21:41:29 -0400 Received: from mail.pluscentury.biz ([64.205.141.39]) by mx2.mailpure.com with Microsoft SMTPSVC(6.0.3790.0); Mon, 12 Apr 2004 21:40:16 -0400 Received: (qmail 31553 invoked from network); 13 Apr 2004 13:52:18 - Received: from mail.pluscentury.biz (HELO localhost.localdomain) (64.205.141.39) by mail.pluscentury.biz with SMTP; 13 Apr 2004 13:52:18 - User-Agent: KMail/1.4.3 From: Mackenna [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: I bet we can hit it off Reply-To: [EMAIL PROTECTED] Precedence: first-class Mime-Version: 1.0 X-cid: 190 X-eid: 434378 X-lid: 143 Bounces-to: [EMAIL PROTECTED] Content-Type: multipart/alternative;boundary=MuLtIpArT_BoUnDaRy Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 13 Apr 2004 01:40:17.0371 (UTC) FILETIME=[462032B0:01C420F8] Date: 12 Apr 2004 21:40:17 -0400 X-MailPure: X-MailPure: LEGITCONTENT: Passed, legitimate content detected (weight -2). X-MailPure: MXBAIT: Message failed MXBAIT test (line 3, weight 1). X-MailPure: SPAMMYURL: Message failed SPAMMYURL test (line 10, weight 1). X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 21:41:38 on 04/12/2004 X-MailPure: Spool File: D454906ac01e4fad2.SMD X-MailPure: Server Name: mail.pluscentury.biz X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: mail.pluscentury.biz [64.205.141.39] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Received: from lakermmtao02.cox.net [68.230.240.37] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A7E6A008A; Tue, 13 Apr 2004 21:46:14 -0400 Received: from fairview ([68.102.33.6]) by lakermmtao02.cox.net (InterMail vM.6.01.03.02 201-2131-111-104-20040324) with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Tue, 13 Apr 2004 21:45:56 -0400 Return-Receipt-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: Matt Bramble [EMAIL PROTECTED] Subject: e-mail account Date: Tue, 13 Apr 2004 20:56:11 -0500 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000__01C42199.C15A9AF0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-MailPure: X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 21:46:48 on 04/13/2004 X-MailPure: Spool File: D97e6000a008a0bf7.SMD X-MailPure: Server Name: lakermmtao02.cox.net X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: lakermmtao02.cox.net [68.230.240.37] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Received: from qwertyx1.qwertyx.net [12.107.136.168] by mx1.mailpure.com (SMTPD32-8.05) id AC456C7C00A0; Mon, 19 Apr 2004 21:26:29 -0400 Received: by qwertyx1.qwertyx.net (Postfix, from userid 515) id 15B829286D; Mon, 19 Apr 2004 21:26:30 -0400 (EDT) Received: from [192.168.237.100] (dwolk-home [68.236.149.197]) by qwertyx1.qwertyx.net (Postfix) with ESMTP id 8A1839284F for [EMAIL PROTECTED]; Mon, 19 Apr 2004 21:26:29 -0400 (EDT) Subject: Re: DNS errors on my server From: [EMAIL PROTECTED] To: Matthew Bramble [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] References:
[Declude.JunkMail] Thank heaven for JM headers
This is a thank you to Scott and his team for all of the great features in JM. We havea few customers who relay all of their mail to a AOL accounts, insist onnobody aliases,and don't want filtering. One of these hadn't checked email in months and started today, clicking the AOL SPAM button like crazy. Obviously we started getting a ton of AOL TOS notifications, unfortunately theyfiltered out the destination email address.Thanks to the addition of an XINHEADER to display%ALLRECIPS%, we were able to quickly identity the culprit and get them stopped, thus protecting mail relay services to AOL for the rest of our customers. Scott,thanks for thelifesaving features and unfailingsupport! Darin.
Re: [Declude.JunkMail] %WEIGHT% variable as -100
1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights were appearing about 500 points above what they really were (only in the %WEIGHT% variable). I don't believe this has affected how Declude handles the E-mail, just the %WEIGHT% variable itself. It appears that the issue with the -100 only happens when the total score is zero. I believe this is being passed off in the variable when used for external tests, but I haven't verified that yet. I've found the problem. When we made the change to the %WEIGHT% variable to calculate the current weight in the middle of testing, it would check to see if the final weight was 0 and if so would then calculate it directly. It looks like we'll need to change that. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
