Re: [Declude.JunkMail] IP whitelisting

[Darin Cox]

I've thought about using it, but haven't had a need as yet.  It believe it
would work something like the following in the Global.CFG.

IPWHITELIST  ipfile C:\IMail\Declude\ipwhitelist.txt   x -10 0

This would subtract 10 from the weight of an email from an ip contained in
the C:\IMail\Declude\ipwhitelist.txt file.

IPs could be listed singly or via CIDR in the file.  For example,

65.60.49.58
66.154.0.0/18

Anything after the IP is ignored, so that space can be used for comments.
For example,

65.60.49.58  spam host subdomain.domain.com
66.154.0.0/18 spammer range for domain.com

Darin.


- Original Message - 
From: "Imail Admin" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, June 25, 2004 1:08 AM
Subject: Re: [Declude.JunkMail] IP whitelisting


How does that work?

Ben

- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 24, 2004 6:15 PM
Subject: Re: [Declude.JunkMail] IP whitelisting


> Couldn't you use the ipfile test type to perform ip-based whitelisting?
>
> Darin.
>
>
> - Original Message - 
> From: "R. Scott Perry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, June 24, 2004 8:11 PM
> Subject: Re: [Declude.JunkMail] IP whitelisting
>
>
>
> >In a whitelist file, in a per-user configuration, to whitelist by IP,
> >wouldn't the line be:
>
> The whitelist files do not allow IPs -- they only allow whitelisting the
> return address of the E-mail.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] IP whitelisting

[Imail Admin]

How does that work?

Ben

- Original Message - 
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 24, 2004 6:15 PM
Subject: Re: [Declude.JunkMail] IP whitelisting


> Couldn't you use the ipfile test type to perform ip-based whitelisting?
>
> Darin.
>
>
> - Original Message - 
> From: "R. Scott Perry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, June 24, 2004 8:11 PM
> Subject: Re: [Declude.JunkMail] IP whitelisting
>
>
>
> >In a whitelist file, in a per-user configuration, to whitelist by IP,
> >wouldn't the line be:
>
> The whitelist files do not allow IPs -- they only allow whitelisting the
> return address of the E-mail.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] IP whitelisting

[Darin Cox]

Couldn't you use the ipfile test type to perform ip-based whitelisting?

Darin.


- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 24, 2004 8:11 PM
Subject: Re: [Declude.JunkMail] IP whitelisting



>In a whitelist file, in a per-user configuration, to whitelist by IP,
>wouldn't the line be:

The whitelist files do not allow IPs -- they only allow whitelisting the
return address of the E-mail.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] NEw tests runs for all email

[Roderick A. Anderson]

Thanks Darrell.  I was thinking this.  I wrote a web interface that
allows users to set their own spam filtering level from 4 predefined
settings.  In that case I just copy the level .junkmail file (that
someone else created/defined) to the username.junkmail in the domain's
directory and I never thought much about what was going on.  I assumed
Declude was only running the tests that were defined for that user.
   So I'll now change my test to exit early if a file is not present and
run if it is.


Again thanks,
Rod
--

Darrell ([EMAIL PROTECTED]) wrote:

>Rod,
>
>It's because with seperate default.junkmail files you can have different
>actions based on those tests defined in the global.config.  For example I
>have customers who want mail held at weight 10 while other customers want it
>held at weight 20.  The only way to accomplish this is having seperate
>default.junkmail files for each domain.
>
>Darrell
>
>
>Check out http://www.invariantsystems.com for utilities for Declude And
>Imail.
>IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers.
>
>- Original Message - 
>From: "Roderick A. Anderson" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Thursday, June 24, 2004 7:43 PM
>Subject: Re: [Declude.JunkMail] NEw tests runs for all email
>
>
>  
>
>>OK.
>>
>>Is there anyway around this, perhaps by defining the test in a domain
>>$default$.junkmail or individual's .junkmail file?
>>
>>I wonder why we put anything in the .junkmail files if all the tests in
>>GLOBAL.CFG are run any.  Not to pick-nits, it is just that I'm still
>>pretty new to this and been assigned a near death-march task.
>>
>>
>>Rod
>>--
>>
>>R. Scott Perry wrote:
>>
>>
>>
The problem is as soon as I save GLOBAL.CFG the test runs for all
inbound mail not just the one juser.junkmail file I added it to.


>>>That is just the way that Declude JunkMail works -- the tests will be
>>>run for all users (for example, in many cases, people define tests in
>>>the global.cfg file without any other reference to them, just using
>>>the weighting system -- in which case the test should be run for
>>>everyone).
>>>
>>>   -Scott
>>>---
>>>Declude JunkMail: The advanced anti-spam solution for IMail
>>>mailservers since 2000.
>>>Declude Virus: Ultra reliable virus detection and the leader in
>>>mailserver vulnerability detection.
>>>Find out what you've been missing: Ask for a free 30-day evaluation.
>>>
>>>---
>>>[This E-mail was scanned for viruses by Declude Virus
>>>(http://www.declude.com)]
>>>
>>>---
>>>This E-mail came from the Declude.JunkMail mailing list.  To
>>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>>type "unsubscribe Declude.JunkMail".  The archives can be found
>>>at http://www.mail-archive.com.
>>>---
>>>[This E-mail scanned for viruses by Declude Virus]
>>>
>>>  
>>>
>>-- 
>>Roderick A. Anderson
>>Project Manager
>>Technology Services Management Group
>>
>>
>
>  
>
>>Spokane WA, 99202
>>
>>---
>>[This E-mail scanned for viruses by Declude Virus]
>>
>>---
>>[This E-mail was scanned for viruses by Declude Virus
>>
>>
>(http://www.declude.com)]
>  
>
>>---
>>This E-mail came from the Declude.JunkMail mailing list.  To
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>type "unsubscribe Declude.JunkMail".  The archives can be found
>>at http://www.mail-archive.com.
>>
>>
>>
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>  
>

-- 
Roderick A. Anderson
Project Manager
Technology Services Management Group 

Spokane WA, 99202

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] NEw tests runs for all email

[R. Scott Perry]

Is there anyway around this, perhaps by defining the test in a domain
$default$.junkmail or individual's .junkmail file?
No (not that I am aware of, at least -- some people have done some very 
creative things with Declude JunkMail, but I doubt this can be accomplished).

I wonder why we put anything in the .junkmail files if all the tests in
GLOBAL.CFG are run any.
If you only take action on the WEIGHT10 test, you could just have that 
listed in the .junkmail file.  That would work fine.

However, the default settings use the WARN action for the tests (which most 
people use), which is why they need to be in the .junkmail file.  The 
global.cfg file is for global options and actions for outgoing E-mail; the 
other files are for actions on incoming E-mail.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Conditional test weighting

[Darrell \([EMAIL PROTECTED])]

Yes, you can do this with filters.  Create a fromfile filter and apply
negative weight to it and than list your domains in that filter.

@domain.com
@domain1.com

But be advised no matter if the email was orginated from one of your users
or a spammer it will still have the negative weight applied to it.

Darrell



Check out http://www.invariantsystems.com for utilities for Declude And
Imail.
IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers.

- Original Message - 
From: "Imail Admin" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 24, 2004 6:07 PM
Subject: [Declude.JunkMail] Conditional test weighting


> Is it possible to make the weight of a test conditional?
>
> Here is my thinking: we've been having problems with our own users getting
> zapped by the CMDSPACE test.  We are running IMail 7.15, so we don't have
> access to the whitelist auth option.  We can whitelist our own domains,
but
> that would let a lot of spam through, since spammers often falsely use
your
> own domain name as the from: line.  However, it would be nice to have the
> weight of CMDSPACE be 8 most of the time, but reduce it to, say, 2, when
the
> message comes from our clients' own domain names.  So we're not
whitelisting
> our own clients' domain names, just changing the weight of one of the
tests.
> Can this be done?
>
> Thanks,
>
> Ben
> BC Web
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] IP whitelisting

[R. Scott Perry]

In a whitelist file, in a per-user configuration, to whitelist by IP,
wouldn't the line be:
The whitelist files do not allow IPs -- they only allow whitelisting the 
return address of the E-mail.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] NEw tests runs for all email

[Darrell \([EMAIL PROTECTED])]

Rod,

It's because with seperate default.junkmail files you can have different
actions based on those tests defined in the global.config.  For example I
have customers who want mail held at weight 10 while other customers want it
held at weight 20.  The only way to accomplish this is having seperate
default.junkmail files for each domain.

Darrell


Check out http://www.invariantsystems.com for utilities for Declude And
Imail.
IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers.

- Original Message - 
From: "Roderick A. Anderson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 24, 2004 7:43 PM
Subject: Re: [Declude.JunkMail] NEw tests runs for all email


> OK.
>
> Is there anyway around this, perhaps by defining the test in a domain
> $default$.junkmail or individual's .junkmail file?
>
> I wonder why we put anything in the .junkmail files if all the tests in
> GLOBAL.CFG are run any.  Not to pick-nits, it is just that I'm still
> pretty new to this and been assigned a near death-march task.
>
>
> Rod
> --
>
> R. Scott Perry wrote:
>
> >
> >> The problem is as soon as I save GLOBAL.CFG the test runs for all
> >> inbound mail not just the one juser.junkmail file I added it to.
> >
> >
> > That is just the way that Declude JunkMail works -- the tests will be
> > run for all users (for example, in many cases, people define tests in
> > the global.cfg file without any other reference to them, just using
> > the weighting system -- in which case the test should be run for
> > everyone).
> >
> >-Scott
> > ---
> > Declude JunkMail: The advanced anti-spam solution for IMail
> > mailservers since 2000.
> > Declude Virus: Ultra reliable virus detection and the leader in
> > mailserver vulnerability detection.
> > Find out what you've been missing: Ask for a free 30-day evaluation.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > [This E-mail scanned for viruses by Declude Virus]
> >
>
> -- 
> Roderick A. Anderson
> Project Manager
> Technology Services Management Group

> Spokane WA, 99202
>
> ---
> [This E-mail scanned for viruses by Declude Virus]
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] IP whitelisting

[Imail Admin]

In a whitelist file, in a per-user configuration, to whitelist by IP,
wouldn't the line be:

IP 66.224.41.3

I tried this and it didn't work.

Ben
BC Web

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] NEw tests runs for all email

[Roderick A. Anderson]

OK.

Is there anyway around this, perhaps by defining the test in a domain
$default$.junkmail or individual's .junkmail file?

I wonder why we put anything in the .junkmail files if all the tests in
GLOBAL.CFG are run any.  Not to pick-nits, it is just that I'm still
pretty new to this and been assigned a near death-march task.


Rod
--

R. Scott Perry wrote:

>
>> The problem is as soon as I save GLOBAL.CFG the test runs for all
>> inbound mail not just the one juser.junkmail file I added it to.
>
>
> That is just the way that Declude JunkMail works -- the tests will be
> run for all users (for example, in many cases, people define tests in
> the global.cfg file without any other reference to them, just using
> the weighting system -- in which case the test should be run for
> everyone).
>
>-Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail
> mailservers since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in
> mailserver vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]
>

-- 
Roderick A. Anderson
Project Manager
Technology Services Management Group 

Spokane WA, 99202

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] NEw tests runs for all email

[Roderick A. Anderson]

I'm in the process of creating a custom test.

To test that I've got the correct calls to it, it currently just creates
a unique named file and writes the command line arguments to it.  It
defined as an EXTERNAL test and I have added the the following line to
GLOBAL.CFG

MPALERT   EXTERNAL   nonzero   "d:\iMail\Declude\mpalert.exe %ALLRECIPS%
%LOCALHOST% %MAILFROM%"

The problem is as soon as I save GLOBAL.CFG the test runs for all
inbound mail not just the one juser.junkmail file I added it to.  This
should not run for all users/e-mail but only when it is in a *.junkmail
file.  I've looked through the list archives and get the impression this
should work the way I think it should not the way it is.

So is there a step or twelve I've missed or added that causes it to run
for all e-mail instead of just for the ones where it is in the
*.junkmail file?


TIA,
Rod

-- 
Roderick A. Anderson
Technology Services Management Group 

Spokane WA, 99202

---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] NEw tests runs for all email

[R. Scott Perry]

The problem is as soon as I save GLOBAL.CFG the test runs for all
inbound mail not just the one juser.junkmail file I added it to.
That is just the way that Declude JunkMail works -- the tests will be run 
for all users (for example, in many cases, people define tests in the 
global.cfg file without any other reference to them, just using the 
weighting system -- in which case the test should be run for everyone).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Conditional test weighting

[Imail Admin]

Is it possible to make the weight of a test conditional?

Here is my thinking: we've been having problems with our own users getting
zapped by the CMDSPACE test.  We are running IMail 7.15, so we don't have
access to the whitelist auth option.  We can whitelist our own domains, but
that would let a lot of spam through, since spammers often falsely use your
own domain name as the from: line.  However, it would be nice to have the
weight of CMDSPACE be 8 most of the time, but reduce it to, say, 2, when the
message comes from our clients' own domain names.  So we're not whitelisting
our own clients' domain names, just changing the weight of one of the tests.
Can this be done?

Thanks,

Ben
BC Web

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Question about filters..

[R. Scott Perry]

The text filters check on BODY or SUBJECT,
What about the text on the HEADERS ??
Yes, the filters work fine on headers, such as:
HEADERS 5 CONTAINS EvilWord
Also, how can I put wildcards on filters ??
You cannot, but you can do things such as:
HEADERS 5 STARTSWITH EvilWord
to catch "EvilWord*".
Couldn't find the manual at declude.com
www.declude.com\manual.htm
Anybody have the correct link ??
You can use the old link http://www.declude.com/junkmail/manual.htm (which 
redirects to the new URL, which I can never remember).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Question about filters..

[Alejandro Valenzuela]

The text filters check on BODY or SUBJECT,

What about the text on the HEADERS ??

Also, how can I put wildcards on filters ??

Couldn't find the manual at declude.com
www.declude.com\manual.htm

Anybody have the correct link ??

Thanks
AV

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Why did this get delivered.

[R. Scott Perry]

Subject: [SPAM] -Money in the mattress at zero % - Hot pick over 
300%?"swbiernd
X-RBL-Warning: HTML: Message failed HTML test (line 12, weight 9) [2-1-800]
X-Declude-Sender: 
[EMAIL PROTECTED] [151.198.15.73]
X-Spam-Tests-Failed: HTML, GIBBERISH, SORBS-DUHL, CMDSPACE, WEIGHT10, 
WEIGHT15, WEIGHT20 [26]

We tag at 10 and have an IMail rule that if the subject is tagged with 
[SPAM] then forward to a hold account for review
That means that Declude is doing its job -- it has added "[SPAM]" to the 
Subject: header.

I would recommend checking your IMail SMTP log file to see what it 
says.  Or, you could use an action in Declude JunkMail such as "WEIGHT10 
ROUTETO [EMAIL PROTECTED]" to have Declude automatically take care of it.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] AutoWhite by eServices

[decjunkmail]

Thanks for the feedback - the designed evolved here internally and it is good to know 
we are doing things "right" and others have been down this path.

We briefly tried having all the hosts gateway the outbound email through a single 
outbound-only host, but we ran into some issues with form mailers and some specialized 
apps that we run that include email notification that we have "relay for ip" 
configured and would need to chase down everywhere they originate in our network.

We also saw some of our own mail getting flagged as spam because the outbound relay 
changed the way our own MX/DNS/Hello messages look to other servers.

Although we might have debugged all this, a quick check of the log summary (the new 
Imail 8.x can send one email per server with a nice simple traffic summary) we found 
that 85% of our traffic is inbound so having each server directly deliver their own 
mail is not really much of a load.

Further, if all delivery must go through a smarthost, then that is an added failure 
point - with each server delivering directly, we have a much better scenario for mail 
still getting out if one server has a problem it doesn't take down all outbound 
delivery.

The other, less obvious aspect of our config is by keeping the layering of servers 
symmetric we should be able to implement secondary MX easily as long as we simply 
duplicate the Declude config folders on each inbound server.

That leaves only the mailbox servers as a weak point - given the Imail architecture 
limitation on using only direct-attached storage, I think only a SAN could be used to 
brute-force add redundancy to Imail and we are not ready to step-up to that cost or 
complexity yet.



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Thursday, June 24, 2004 7:54 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] AutoWhite by eServices

You configuration is fine with one recommendation: You would off load
additional workload from the main server by having it send all outbound
e-mail through a smart host, that being the Ant-spam server. This way, the
server does not have to do outbound resolution and communications with all
the other Internet servers, it simply sends all outgoing to the next server.

They way you are tiering your servers is actually a recommended way once a
server reaches saturation. Example, a client I consult for is in the process
of splitting the work load from one server to 2. The front server which will
be configured for S&F for all domains and will do all JunkMail scanning and
do all the receiving and sending to the Internet. The main server will do
all Imail functions and Declude Virus Scanning. But again, all incoming and
outgoing will flow through the front server, the main server sending all
outbound to it to offload that work from the main server. 

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of decjunkmail
> Sent: Wednesday, June 23, 2004 7:40 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] AutoWhite by eServices
> 
> Here's why we are converting our "monolithic" Imail/Declude servers to a
multi-tier
> store & forward configuration as follows:
> 
> Incoming MX servers:
> 
> Receives inbound mail from Internet
> Runs Declude anti-virus to delete all viruses (single global config)
> Forwards all mail to Anti-spam servers
> 
> Anti-spam servers:
> 
> Receives de-virused email from MX servers
> Runs Declude junkmail with per-domain settings
> Forwards mail to mailbox servers
> 
> Mailbox servers:
> 
> Runs IMAP, POP, WebMail Mailboxes
> Delivers outbound mail directly for -
>   Locally originated email
>   Internet-originated but SMTP authenticated remote mail
> 
> 
> The reason for this migration is a "love/hate" relationship with Ipswitch
Imail:
> 
> It's cost effective and has the features we need (plus the support for
Declude plug-
> ins), BUT
> 
> It is a CPU hog - WebMail or IMAP often spike the server
> It has been buggy at times (recent IMAP problems for example)
> It cannot be clustered - all functions for a domain must be on one server
> It does not have any HA (high-availability) or redundancy capability
> 
> By offloading incoming MX, virus scanning, and spam blocking to other
servers we are
> creating a much more robust configuration.
> 
> Massive virus attacks or spam attacks will not affect our user's ability
to access their
> existing email boxes via pop/imap/webmail.
> 
> Scalability -- as virus and spam continue to grow much faster than real
> mail/mailboxes, we can put extra processing power where it is needed most.
> Currently, we had to prune our Declude rules/filters because they were
spiking our
> boxes to 100% cpu too much.
> 
> High-availability -- (partially)  By isolating the mailbox functions
(pop,imap,webmail)
> and keeping relatively simpler inbound hand

RE: [Declude.JunkMail] SPF support

[R. Scott Perry]

> SPFPASS spf passx   -5  0
> SPFFAIL spf failx   8   0

Scott, just to make sure.  Just one x in there?  It seems the other tests
are setup differently.
Example:  CMDSPACE  cmdspacex   x   8   0
That is correct.  The "x"'s are just placeholders (each line has the test 
name, followed by the test type, then 2 test-specific pieces of 
information, and then the fail/pass weights).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Why did this get delivered.

[Jay Calvert]

Another Example...
 
Received: from host-49-97-220-24.midco.net 
[24.220.97.49] by mail.canspec.com  (SMTPD32-8.12) id ADFB17430112; 
Thu, 24 Jun 2004 10:23:07 -0700X-Message-Info: 
UOPjR7oDfr/ubnGJkjkPbfVBVptNCVnocrzPrj62CReceived: from 
expelled-l035.cupboard.msn.com (34.129.194.144) by dcr274-hr043.msn.com with 
Microsoft SMTPSVC(5.0.2195.6824);  Thu, 24 Jun 2004 20:32:11 
-0400From: Jewell Singleton <[EMAIL PROTECTED]>To: [EMAIL PROTECTED]
Subject: [SPAM] -Search For Matches NowDate: 
Fri, 25 Jun 2004 01:38:11 +0100 ESTMessage-ID: <[EMAIL PROTECTED]>Mime-Version: 
1.0Content-Type: 
multipart/alternative; boundary="--87831119194381943305"X-RBL-Warning: 
HTML: Message failed HTML test (line 12, weight 8) [2-1-800]X-RBL-Warning: 
NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" 
[2-29-e800]X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . 
[2-33-10800]X-Declude-Sender: [EMAIL PROTECTED] 
[24.220.97.49]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.X-Spam-Tests-Failed: HTML, NOPOSTMASTER, CMDSPACE, WEIGHT10, WEIGHT15, 
WEIGHT20 [21]X-Note: This E-mail was sent from host-49-97-220-24.midco.net 
([24.220.97.49]).X-RCPT-TO: <[EMAIL PROTECTED]>Status: 
UX-UIDL: 384040686

  - Original Message - 
  From: 
  Jay 
  Calvert 
  To: [EMAIL PROTECTED] 
  
  Sent: Thursday, June 24, 2004 10:53 
  AM
  Subject: [Declude.JunkMail] Why did this 
  get delivered.
  
  From: "Angela Kramer" <[EMAIL PROTECTED]>To: 
  , Subject: [SPAM] -Money 
  in the mattress at zero % - Hot pick over 
  300%?    
  "    swbierndDate: Thu, 24 Jun 2004 11:23:07 
  -0600Message-ID: <[EMAIL PROTECTED]>MIME-Version: 
  1.0Content-Type: 
  text/html; charset="US-ASCII"Content-Transfer-Encoding: 
  quoted-printableX-Priority: 3 (Normal)X-MSMail-Priority: 
  NormalX-Mailer: Microsoft Outlook IMO, Build 9.0.6604 
  (9.0.2911.0)X-RBL-Warning: HTML: Message failed HTML test (line 12, weight 
  9) [2-1-800]X-Declude-Sender: [EMAIL PROTECTED] 
  [151.198.15.73]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
  spam.X-Spam-Tests-Failed: HTML, GIBBERISH, SORBS-DUHL, CMDSPACE, WEIGHT10, 
  WEIGHT15, WEIGHT20 [26]X-RCPT-TO: X-UIDL: 
  336093401X-MimeOLE: Produced By Microsoft MimeOLE 
  V6.00.2800.1409Importance: Normal
   
   
   
  We tag at 10 and have an IMail rule that if the 
  subject is tagged with [SPAM] then forward to a hold account for 
  review
   
   

[Declude.JunkMail] Why did this get delivered.

[Jay Calvert]

From: "Angela Kramer" <[EMAIL PROTECTED]>To: 
, Subject: [SPAM] -Money in 
the mattress at zero % - Hot pick over 
300%?    
"    swbierndDate: Thu, 24 Jun 2004 11:23:07 
-0600Message-ID: <[EMAIL PROTECTED]>MIME-Version: 
1.0Content-Type: 
text/html; charset="US-ASCII"Content-Transfer-Encoding: 
quoted-printableX-Priority: 3 (Normal)X-MSMail-Priority: 
NormalX-Mailer: Microsoft Outlook IMO, Build 9.0.6604 
(9.0.2911.0)X-RBL-Warning: HTML: Message failed HTML test (line 12, weight 
9) [2-1-800]X-Declude-Sender: [EMAIL PROTECTED] 
[151.198.15.73]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.X-Spam-Tests-Failed: HTML, GIBBERISH, SORBS-DUHL, CMDSPACE, WEIGHT10, 
WEIGHT15, WEIGHT20 [26]X-RCPT-TO: X-UIDL: 
336093401X-MimeOLE: Produced By Microsoft MimeOLE 
V6.00.2800.1409Importance: Normal
 
 
 
We tag at 10 and have an IMail rule that if the 
subject is tagged with [SPAM] then forward to a hold account for 
review
 
 

RE: [Declude.JunkMail] SPF support

[Grant Griffith - Declude JM]

Scott, just to make sure.  Just one x in there?  It seems the other tests
are setup differently.

Example:  CMDSPACE  cmdspacex   x   8   0

Sincerely,
Grant Griffith
EI8HT LEGS Enhanced Web Management
http://www.getafreewebsite.com
877-483-3393

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Thursday, June 24, 2004 10:33 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SPF support



>Is this a current test we can use with Declude?  I would like to begin
>adding it to our weighting system if it is something that is beginning to
be
>used.

---
To use the new SPF test, you can add lines such as:

SPFPASS spf passx   -5  0
SPFFAIL spf failx   8   0

to your global.cfg file.  SPF returns "PASS" for E-mail that passes SPF
(that comes from an IP that is acceptable to the owner of the domani that
it claims to be coming from), "FAIL" for E-mail that fails SPF (that does
not come from an acceptable IP for the domain), or "UNKNOWN" (for E-mail
from domains that do not use SPF yet, or for some other reason should
return UNKNOWN).
---

>If it is used, does it automatically accept an email if a TXT record is not
>found for that domain?

If there is no SPF record, the E-mail will be treated exactly as it had
before (being blocked as spam if it fails enough spam tests).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re[4]: [Declude.JunkMail] Declude/SpamAssasin Question

[Sanford Whiteman]

> Would it make a difference if the spool is g:/imail/spool ?

Nope.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange Addresses into IMail Aliases!
  
http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPF support

[R. Scott Perry]

Is this a current test we can use with Declude?  I would like to begin
adding it to our weighting system if it is something that is beginning to be
used.
---
To use the new SPF test, you can add lines such as:
SPFPASS spf passx   -5  0
SPFFAIL spf failx   8   0
to your global.cfg file.  SPF returns "PASS" for E-mail that passes SPF 
(that comes from an IP that is acceptable to the owner of the domani that 
it claims to be coming from), "FAIL" for E-mail that fails SPF (that does 
not come from an acceptable IP for the domain), or "UNKNOWN" (for E-mail 
from domains that do not use SPF yet, or for some other reason should 
return UNKNOWN).
---

If it is used, does it automatically accept an email if a TXT record is not
found for that domain?
If there is no SPF record, the E-mail will be treated exactly as it had 
before (being blocked as spam if it fails enough spam tests).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Local email being tagged as spam

[Jay Calvert]

We have a few users who insist that their email passes through the system
unfiltered.  However, we have discovered that if that user is in a list of
recipients in a spam message, that message is passed on via IMail rules to
the users who do not want to receive spam.

I thought that I had found the answer with BYPASSWHITELIST but this has
backfired on me.  If the sender is an authenticated user then, I would like
their emails to be whitelisted no matter what.


Is there a way to do this?


Thanks.


- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, June 23, 2004 4:52 PM
Subject: Re: [Declude.JunkMail] Local email being tagged as spam


>
> >Wait a second, does BYPASSWHITELIST bypass the WHITELIST AUTH Too?
>
> That it does.  :)
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude "deactivated" itself

[R. Scott Perry]

Did you check the log I sent you?
I read through it and it seemed rather "short" for a debug?  I'm used to
seeing pages over pages for a single message.  These logs seem to be done in
a few lines?
I'll do some investigating on this to see if the debug log file entries 
provide any more details.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] AutoWhite by eServices

[John Tolmachoff \(Lists\)]

You configuration is fine with one recommendation: You would off load
additional workload from the main server by having it send all outbound
e-mail through a smart host, that being the Ant-spam server. This way, the
server does not have to do outbound resolution and communications with all
the other Internet servers, it simply sends all outgoing to the next server.

They way you are tiering your servers is actually a recommended way once a
server reaches saturation. Example, a client I consult for is in the process
of splitting the work load from one server to 2. The front server which will
be configured for S&F for all domains and will do all JunkMail scanning and
do all the receiving and sending to the Internet. The main server will do
all Imail functions and Declude Virus Scanning. But again, all incoming and
outgoing will flow through the front server, the main server sending all
outbound to it to offload that work from the main server. 

John Tolmachoff
Engineer/Consultant/Owner
eServices For You

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of decjunkmail
> Sent: Wednesday, June 23, 2004 7:40 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] AutoWhite by eServices
> 
> Here's why we are converting our "monolithic" Imail/Declude servers to a
multi-tier
> store & forward configuration as follows:
> 
> Incoming MX servers:
> 
> Receives inbound mail from Internet
> Runs Declude anti-virus to delete all viruses (single global config)
> Forwards all mail to Anti-spam servers
> 
> Anti-spam servers:
> 
> Receives de-virused email from MX servers
> Runs Declude junkmail with per-domain settings
> Forwards mail to mailbox servers
> 
> Mailbox servers:
> 
> Runs IMAP, POP, WebMail Mailboxes
> Delivers outbound mail directly for -
>   Locally originated email
>   Internet-originated but SMTP authenticated remote mail
> 
> 
> The reason for this migration is a "love/hate" relationship with Ipswitch
Imail:
> 
> It's cost effective and has the features we need (plus the support for
Declude plug-
> ins), BUT
> 
> It is a CPU hog - WebMail or IMAP often spike the server
> It has been buggy at times (recent IMAP problems for example)
> It cannot be clustered - all functions for a domain must be on one server
> It does not have any HA (high-availability) or redundancy capability
> 
> By offloading incoming MX, virus scanning, and spam blocking to other
servers we are
> creating a much more robust configuration.
> 
> Massive virus attacks or spam attacks will not affect our user's ability
to access their
> existing email boxes via pop/imap/webmail.
> 
> Scalability -- as virus and spam continue to grow much faster than real
> mail/mailboxes, we can put extra processing power where it is needed most.
> Currently, we had to prune our Declude rules/filters because they were
spiking our
> boxes to 100% cpu too much.
> 
> High-availability -- (partially)  By isolating the mailbox functions
(pop,imap,webmail)
> and keeping relatively simpler inbound handling/queuing on separate
servers, we
> preserve the ability to receive inbound mail even if we have
crashes/bugs/failures in
> mailbox processing.
> 
> For our needs, we prefer several affordable servers distributing the tasks
than one
> mega-server box -- better protection against human errors/mistakes which
are more
> likely than hardware failures day-in and day-out.
> 
> Finally, by modularizing the processing, we gain a little more freedom -
in the future
> we might choose to replace one of the processing nodes with a different
> vendor/technology.  Replacing one function is easier than trying to do an
en masse
> migration the entire mail system.
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
> Sent: Wednesday, June 23, 2004 6:01 PM
> To: [EMAIL PROTECTED]
> Subject: RE: Re[2]: [Declude.JunkMail] AutoWhite by eServices
> 
> > A client has a pair of generic incoming MX servers.  These then feed
> > into a Declude server, storing and forwarding to the mailbox server.
> > The mailbox server does its own outbound mail.
> 
> > I'd like to know if it will ever be possible to do this, perhaps by a
> > routine that can parse the log on the mail box server(in the case of
> > AutoWhite) or by remote interrogation of web address lists(in the case
> > of Declude's whitelist feature).  I fear that not enough people are
> > using Declude as a store and forward device and therefore demand will
> > not be high enough to justify the change.
> 
> The issue as you have pointed out is that both Declude and AutoWhite for
> Declude need to see both incoming and outgoing to work.
> 
> Generally speaking, it appears that most configurations where
Imail/Declude
> scan the incoming only for a S&F domain are in corporate configurations
> where it is used as a cost effective well balanced tool to fight incoming
> viruses and spam

Re: [Declude.JunkMail] SPF files

[Bud Durland]

R. Scott Perry wrote:
You can delete them, archive them, or let them grow.  It's up to you.

Cool; just wanted to make sure I wasn't gonna break anything
--
-
"Good is better than Evil because it's nicer"
-- Mammy Yokum
-
Bud Durland, CNE   Mold-Rite Plastics
Network Administrator   http://www.mrpcap.com
-
---
[This E-mail scanned for viruses by Declude Virus / Sophos AV]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPF support

[Grant Griffith]

Scott,

Is this a current test we can use with Declude?  I would like to begin
adding it to our weighting system if it is something that is beginning to be
used.

If it is used, does it automatically accept an email if a TXT record is not
found for that domain?  I would assume it would as I am sure it will take
some time for everyone to get this added to DNS records.

Sincerely,
Grant Griffith
EI8HT LEGS Enhanced Web Management
http://www.getafreewebsite.com
877-483-3393

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Thursday, June 24, 2004 6:28 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Imail SPF support



>A postmaster at AOL just told me they are going to start using SPF
>(http://spf.pobox.com) in the next month or two.

Correct.

>I'm a little overwhelmed by the info at that website, but in a nutshell, I
>can get the TXT record working in the DNS for my outgoing emails.
>
>But, will IMail server need a upgrade so I can check someones SPF record on
>a incoming email?

There are two parts to SPF.  One is publishing an SPF record (you can see
ours at http://www.dnsstuff.com/tools/lookup.ch?name=declude.com&type=TXT
).  That will help ensure that your E-mail gets delivered properly without
being blocked, and helps ensure that spammers don't abuse your domain (if
they do, their E-mail can get blocked on mailservers implementing SPF).

The other part is implementing SPF on your mailserver.  With IMail, the
only way to do it now (without adding a gateway) is to purchase Declude
JunkMail, which has had SPF support for about 6 months now (I believe we
were the first commercial anti-spam product to add SPF support).  That will
allow you to take advantage of all the domains that are publishing SPF
records, helping ensure that legitimate E-mail gets through, and helping
block spam.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]


To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Officials arrested an America Online (AOL) employee for allegedly stealing 92 million account IDs

[Bridges, Samantha]

Good morning -

This came out in the news this morning.  Below are a few "snippets" from
the article just to peak your interest.  Sounds as though  "You Got
Mail!" is taking on a whole new meaning...Should be "You Got
Mail, but We Got Your Personal Information!".  I am sure we could all
come up with a funny one for this AOL blunder but at the end of the day
this is a very serious issue that hopefully gets addressed and
corrected.  I am not sure if any AOL users know about this or if they
would fully understand the ramifications of this security breach?  

"Officials arrested an America Online (AOL) employee for allegedly
stealing 92 million members' screen names, which were later sold to
spammers."

>From there, he "began assembling a complete list of AOL's customer
account screen names and related zip codes, credit card types (but no
credit card numbers), and telephone numbers of AOL customers,"
authorities said in a statement. AOL keeps credit card numbers in a
separate storage area.

The spammers used the lists to market "herbal penile enlargement pills,"
the complaint alleges.

Below is the link to the full article.  
http://www.internetnews.com/xSP/article.php/3372711


Samantha Bridges
Communications Technician
Macomb Intermediate School District
44001 Garfield Road
Clinton Township  MI  48038-1100
(586) 228-3300

[EMAIL PROTECTED]
http://www.misd.net


CONFIDENTIALITY NOTICE: This email message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender by reply email and destroy all
copies of the original message.

  
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPF files

[R. Scott Perry]

Do the SPF.LOG and SPF.NONE files in C:\ belong to DECLUDE?
Yes.
Is there any housekeeping that I need to do?
You can delete them, archive them, or let them grow.  It's up to you.
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude "deactivated" itself

[Andy Schmidt]

Hi Scott:

Did you check the log I sent you?

I read through it and it seemed rather "short" for a debug?  I'm used to
seeing pages over pages for a single message.  These logs seem to be done in
a few lines?

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, June 24, 2004 08:16 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude "deactivated" itself



>It happened again.
>
>Declude stopped working at 2:30.  And all I did it at 2:43, is activate
>Debug mode and saved the Config file - and it suddenly started logging
again...
>
>I'm enclosing a text file with the log.

The problem here is that one Declude process doesn't know about other 
Declude processes.

So if there is a problem with Declude not running, and changing the log 
file to debug mode fixes it, then either [1] reverting back to its original 
level will cause the problem to occur again, or [2] the act of 
changing/saving the file altered something that affected Declude.  I'll bet 
it is #2.

The question, then, becomes what could cause this?  The only thing that I 
can think of is that the global.cfg file is locked somehow and that saving 
it fixes the problem.  But that wouldn't account for Declude Virus not 
running -- the only thing that should affect both is if the Declude.exe 
file was locked, but if that was the case, changing the global.cfg file 
wouldn't affect anything.  So that would suggest something else happened at 
the same time that you were saving the global.cfg file that caused Declude 
to start again -- but I can't think of anything that could do that.



-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: Re[2]: [Declude.JunkMail] Declude/SpamAssasin Question

[Chris Patterson]

Would it make a difference if the spool is g:/imail/spool ?

Thanks,
 
Chris Patterson, CCNA
Network Engineer

 


-Original Message-
From: Sanford Whiteman [mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 24, 2004 1:59 AM
To: Chris Patterson
Subject: Re[2]: [Declude.JunkMail] Declude/SpamAssasin Question

> I installed but can't see anything in the declude logs for it.

Try  running  at  log  level  debug  for a little while to see verbose
output.

Also  make  sure  you can run SPAMC32 from the command line against an
existing  D  file  (in  your  \spool\spam, for example) using the same
syntax you have in GLOBAL.CFG.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
 
http://www.mailmage.com/products/software/freeutils/SPAMC32/download/rel
ease/

Defuse Dictionary Attacks: Turn Exchange Addresses into IMail Aliases!
 
http://www.mailmage.com/products/software/freeutils/exchange2aliases/dow
nload/release/

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPF files

[Bud Durland]

Do the SPF.LOG and SPF.NONE files in C:\ belong to DECLUDE?
Is there any housekeeping that I need to do?
--
-
"Good is better than Evil because it's nicer"
-- Mammy Yokum
-
Bud Durland, CNE   Mold-Rite Plastics
Network Administrator   http://www.mrpcap.com
-
---
[This E-mail scanned for viruses by Declude Virus / Sophos AV]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Declude "deactivated" itself

[R. Scott Perry]

It happened again.
Declude stopped working at 2:30.  And all I did it at 2:43, is activate 
Debug mode and saved the Config file - and it suddenly started logging again...

I'm enclosing a text file with the log.
The problem here is that one Declude process doesn't know about other 
Declude processes.

So if there is a problem with Declude not running, and changing the log 
file to debug mode fixes it, then either [1] reverting back to its original 
level will cause the problem to occur again, or [2] the act of 
changing/saving the file altered something that affected Declude.  I'll bet 
it is #2.

The question, then, becomes what could cause this?  The only thing that I 
can think of is that the global.cfg file is locked somehow and that saving 
it fixes the problem.  But that wouldn't account for Declude Virus not 
running -- the only thing that should affect both is if the Declude.exe 
file was locked, but if that was the case, changing the global.cfg file 
wouldn't affect anything.  So that would suggest something else happened at 
the same time that you were saving the global.cfg file that caused Declude 
to start again -- but I can't think of anything that could do that.


   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.