Re: [Declude.JunkMail] Copy To
serge wrote: thanks matt let me see if i finally understand this To and CC are in the headers but not BCC the recepient can be either in To, CC, or BCC, and therefore may nit be in the header when you say address used in smtp connection, you mean the recepient address, which is what we find in the Q.smd (called envelop??) Am i correct so far ? Yes. Finnaly, can we use ALLRECIPS and REALRECIPS in filters ? Yes than, to answer the original question, we can have a filter test "Monitor" with REALRECIPS 0 Contains [EMAIL PROTECTED] and an action MONITOR copyto monitoracc Yes, however it would be generally recommended to use ALLRECIPS unless you have a specific need to use REALRECIPS. REALRECIPS might not match the addresses contained in the Q file if those addresses are aliased or forwarded to others. That is of course if I understand it correctly (it might do both, but not according to the way the documentation is written). Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] Tagging a mail if its weighted as spam
No. You can't have multiple actions per test -- to do what you want, you would need to create a new test, such as WEIGHT10A, that is identical to the WEIGHT10 test (except fort the name). Then you could have: WEIGHT10SUBJECT [Spam] WEIGHT10AHEADER [This E-mail is likely to be spam; see http://www.example.com/spam for details] and both actions will work together for E-mail that fails the WEIGHT10 test. Thanks --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude reporting wrong IP... why?
Complete Received: headers below: Received: from smtp.fidnet.com [216.229.64.74] by mail.csimo.com (SMTPD32-8.12) id AD2B20D0070; Thu, 22 Jul 2004 16:10:03 -0500 This shows that IMail received the E-mail from 216.229.64.74, so: X-Declude-Sender: mailto:[EMAIL PROTECTED][EMAIL PROTECTED] [216.229.64.74] X-Note: This message was sent from 216-229-64-74-empty.fidnet.com ([216.229.64.74]). This header is to be expected. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Copy To
Thank you Matt BTW, installed size.vbs and it is working great - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Friday, July 23, 2004 6:40 AM Subject: Re: [Declude.JunkMail] Copy To serge wrote: thanks matt let me see if i finally understand this To and CC are in the headers but not BCC the recepient can be either in To, CC, or BCC, and therefore may nit be in the header when you say address used in smtp connection, you mean the recepient address, which is what we find in the Q.smd (called envelop??) Am i correct so far ?Yes. Finnaly, can we use ALLRECIPS and REALRECIPS in filters ?Yes than, to answer the original question, we can have a filter test "Monitor" with REALRECIPS 0 Contains [EMAIL PROTECTED] and an action MONITOR copyto monitoraccYes, however it would be generally recommended to use ALLRECIPS unless you have a specific need to use REALRECIPS. REALRECIPS might not match the addresses contained in the Q file if those addresses are aliased or forwarded to others. That is of course if I understand it correctly (it might do both, but not according to the way the documentation is written).Matt-- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] [OT] Microsoft to enforce Sender ID checks
http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [OT] Microsoft to enforce Sender ID checks
http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html Does anyone know where to get a copy of the proposed standard? Does that standard help nail down the specifications for the SPF part? If I'm publishing an SPF record now, will that need to change to meet the new standard? Regards, Brad Morgan IT Manager Horizon Interactive Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [OT] Microsoft to enforce Sender ID checks
- Original Message - From: Brad Morgan [EMAIL PROTECTED] http://www.infoworld.com/article/04/07/22/HNmicrosoftid_1.html Does anyone know where to get a copy of the proposed standard? Does that standard help nail down the specifications for the SPF part? If I'm publishing an SPF record now, will that need to change to meet the new standard? For information about SPF/CID, see: http://spf.pobox.com/ For the latest IETF specification, see: http://www.ietf.org/internet-drafts/draft-ietf-marid-protocol-00.txt Which will be discussed at the next IETF meeting: http://www.ietf.org/meetings/IETF-60.html Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 179i16 interim
FYI: The 179i16 interim does include support for the NOTIS filter type. From my log: Triggered REVDNS NOTIS filter TESTNOTIS Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 179i16 interim
- Original Message - From: Scott Fisher [EMAIL PROTECTED] The 179i16 interim does include support for the NOTIS filter type. Wow, we are up to 1.79i16 already? What's changed since 1.79i8? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] MTLDB observations
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Sent: Friday, July 16, 2004 1:18 PM Unless the database gets cleaned up, I don't see this as a useable test. We're working on that. There will be a major change to the listings within the next week. Scott, has this happened yet? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 179i16 interim
Other than NOTIS, I saw this posting: With the latest interim (http://www.declude.com/version/interim), you can add a line SKIPIFEXT EZIP to the bannotify.eml file. That's kind of why I posted to see if we could come up with some changes. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/23/04 04:07PM - Original Message - From: Scott Fisher [EMAIL PROTECTED] The 179i16 interim does include support for the NOTIS filter type. Wow, we are up to 1.79i16 already? What's changed since 1.79i8? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 179i16 interim
FYI, SKIPIFEXT works with the following: - Any BANEXT extension - Any BANNAME file name - EZIP-[extension] (best option IMO because you can achieve a higher level of detail) These entries must go in the top of your BanNotify.eml file. If you aren't using 1.79i16 or higher, adding these entries will cause your BanNotify.eml to stop working. All of the matches have to be complete and not partial matches. Because there are only so many varieties in EZIP's presently, I have limited those entries to the following: SKIPIFEXT ZIP-EXE SKIPIFEXT ZIP-SCR SKIPIFEXT ZIP-PIF SKIPIFEXT ZIP-COM SKIPIFEXT RAR-EXE SKIPIFEXT RAR-SCR SKIPIFEXT RAR-PIF SKIPIFEXT RAR-COM I have also listed every one of the BANNAME's that are in my config. I would still prefer more granularity when it comes to exceptions and also when it comes to configuring which EZIP's to exclude, but this definitely takes care of the bouncing problem if all you want to do is turn it off, which is currently by far the lesser of the evils at this point. My postmaster account is now virtually empty with only undetected viruses getting bounced back, and having these isolated also serves as an early warning system for trouble on your system (I didn't care to keep up with the 20+ EZIP bounces that were coming in daily before). Matt Scott Fisher wrote: Other than NOTIS, I saw this posting: With the latest interim (http://www.declude.com/version/interim), you can add a line "SKIPIFEXT EZIP" to the bannotify.eml file. That's kind of why I posted to see if we could come up with some changes. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 07/23/04 04:07PM - Original Message - From: "Scott Fisher" [EMAIL PROTECTED] The 179i16 interim does include support for the NOTIS filter type. Wow, we are up to 1.79i16 already? What's changed since 1.79i8? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] SPF Text Record Help Needed
Weird posting to yourself but figured it may be good for the archives for anyone in the same boat. I never did get a response from anyone on the list and frankly knew was asking a lot for folks to digest on a busy Monday morning. Anyway, I got all the SPF set-up and the wizard figured out for our different client situations. If you have something similar and need help, hit me and be glad to share. Thanks. -Don - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 19, 2004 9:10 AM Subject: [Declude.JunkMail] SPF Text Record Help Needed I need help understanding the correct SPF text record for a customer domain . I have read the archives, been to the pobox site and read and still not absolutely certain. We allow some customers to SMTP relay from their dedicated IP and also from their e-mail Contact Form via their web site - we also host on a separate server and within the same network Workgroup. Our Workgroup of servers communicate to each other via private IP addresses. Thanks in advance to anyone who has the time. -Don Our set-up is IMail (8.12) and Declude (1.79). Customer domain is configured as a virtual host on the IMail server. a) Sample customer dedicated IP is (64.x.x.123) and allowed to SMTP relay from their office via IMail. b) Sample IMail server Public Host IP is (imail.hosting.com 209.x.x.567) c) Sample Web server Private IP is (webA 192.x.x.10) where their Contact Form e-mail orginates. *Note the pobox wixard finds 2 MX records for this sample customers domain, the first being as on IMail their MX (mail.customerdomain.com) and the second being our colo router (vacant.colodomain.com). The POBOX Wizard Questions and My Question below... -- 1) Let's set up SPF records for mail.customerdomain.com. mail.customerdomain.com's IP address is 209.x.x.567. Does that server send mail from mail.customerdomain.com? yes no My Question: Do I answer yes or no? The domain is configured as (customerdomain.com) and alias of (mail.customerdomain.com) as a virtual host in Imail. They send email from their office dedicated IP of (64.x.x.123) and via WebMail for the IMail server public and virtual domain IP (209.x.x.567), and also originating from the Web server IP (webA 192.x.x.10) to the Imail server. -- 2) This wizard found 2 names for mail.customerdomain.com's MX servers. MX servers receive mail for mail.customerdomain.com. Do they also send mail from mail.customerdomain.com? yes no My Question: Do I answer yes or no? In addition to the above info for the first question, our DNS only has one primary MX record entered for the (customerdomain.com) (209.x.x.567), but apparently it is also picking up our colo router name too (vacant.colodomain.com) with the same IP number (209.x.x.567). -- 3) Do you want to just approve any host whose name ends in mail.customerdomain.com? yes no My Question: Do I answer yes or no? I feel I should answer No, again not sure and concerned with this question as mail typically identified from this domain as customerdomain.com and not mail.customerdomain.com which is the alias configured in Imail. -- 4) Do any other servers send mail from mail.customerdomain.com? My Questions: Here they provide 3 fields to list other servers with regular hostnames, MX servers, and IP addresses. A) For the Host names field, do I also list the Web server private Web server name (web)? This is where some e-mail is originating from the customers Web site contact form. Do I also list our IMail server hostname (imail.hosting.com) since the mail.customerdomain.com is virtual? Do I enter the colo router hostname too (vacant.colodomain.com) being identified by the wizard with our IMail host IP? B) For the MX servers field, I am assuming to enter only the customer MX (mail.customerdomain.com) or should I also enter the IMail server primary hostname (imail.hosting.com)? C) For the IP addresses field, do I enter the IP's for the IMail server which is the same for the customers virtual domain? Should I also enter the Web server private IP (192.x.x.10) to cover their contact form on the Web server? -- 5) Could mail from mail.customerdomain.com originate through servers belonging to some other domain? If you send mail through your ISP's servers, name the ISP here. My Question: This is not the case for this customer who only sends from a dedicated IP at their office. Wondering however what you would enter if we also allowed SMTP auth and they had several employees in the field with different IPS connects? -- 6) Do the above lines describe all the hosts that send mail from mail.customerdomain.com? yes no My Questions: For this customer I would assume answering
Re: [Declude.JunkMail] MTLDB observations
Unless the database gets cleaned up, I don't see this as a useable test. We're working on that. There will be a major change to the listings within the next week. Scott, has this happened yet? No. There's an issue with the SQL database that is storing the information, where it can't update as fast as we want it to, so the test is still running the same as when it started. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
