RE: [Declude.JunkMail] BackScatter
Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd Richards Sent: Saturday, May 16, 2009 6:11 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Thanks Craig. From all indications our server is tightened down pretty good right now. We moved from Imail to SM at the start of April, and I implemented grey listing at the start of May. So we did have a fair amount of backscatter in between until I really understood what greylisting could do. Unfortunately, I can't talk the bosses into dropping another $800 or so to try and fix the problem. I know others have used ASSP with success, so I might look at that. SmarterMail's greylisting seems to be a lot better than what the rules in Declude offer. I might look at implementing ASSP in front of SM. I've heard a lot of people talk about the advantages of running something in front of your mail server. So it might be time. Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig Edmonds Sent: Saturday, May 16, 2009 1:53 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, I think grey listing prevents backscatter coming INTO your mail server, it does not prevent you getting on blacklists. If you are on a blacklist then I think you need to figure out how your smtp server is configured because it would indicate an issue somewhere. Since using Alligate (www.alligate.com) as the first line of defence in front of declude, we have had zero black listings and all the backscatter has disappeared. The backscatter rules in declude really blow which is why I would highly recommend looking at Alligate as your smtp gateway. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com http://www.123marbella.com/ E : cr...@123marbella.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: 16 May 2009 13:54 To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] BackScatter I think Greylisting reduces backscatter. Greylisting stops the majority of the SPAM from ever reaching our mail server, so it never has a chance to get bounced back because of a non existent user, etc. Mike _ Hi Everyone - We've been having a few issues with mail servers refusing our mail. Today I ran a test on DNSStuff and found that our IP is on BackScatter.org. They are referencing an event on 4/27, and supposedly we will be removed after 4 weeks if they haven't had any other issues. Of course we can pay to have it removed sooner. I'm not sure if being listed in their DB is the main culprit to the server refusals that I've seen? We switched over to SmarterMail in mid-April. Since 4/27, we have implemented grey listing. Is grey listing a good first line of defense? Is there anything else I should be doing to prevent back scatter? Thanks for your thoughts on this. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BackScatter
We've been running Declude Interceptor for a few months now and I agree completely with David's comments. It has been great and the transition was very easy. Dan From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 18, 2009 1:04 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.commailto:dbar...@declude.com The information contained in this communication is privileged and confidential. If you have received this communication in error, please forward back to the sender and delete your copy immediately. You are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BackScatter
From what I read, Interceptor (which we tried in its earlier incarnation, eons ago) doesn't include the Hijack functionality (the design wouldn't support it.) Rob From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dan Shadix Sent: Monday, May 18, 2009 3:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter We've been running Declude Interceptor for a few months now and I agree completely with David's comments. It has been great and the transition was very easy. Dan From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 18, 2009 1:04 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com _ The information contained in this communication is privileged and confidential. If you have received this communication in error, please forward back to the sender and delete your copy immediately. You are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BackScatter
That is correct, as Interceptor is a Gateway and runs outside the server as opposed to inside the mail server. Declude Hijack is not supported with Interceptor. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Robert Grosshandler Sent: Monday, May 18, 2009 4:32 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter From what I read, Interceptor (which we tried in its earlier incarnation, eons ago) doesn't include the Hijack functionality (the design wouldn't support it.) Rob From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dan Shadix Sent: Monday, May 18, 2009 3:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter We've been running Declude Interceptor for a few months now and I agree completely with David's comments. It has been great and the transition was very easy. Dan From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 18, 2009 1:04 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com _ The information contained in this communication is privileged and confidential. If you have received this communication in error, please forward back to the sender and delete your copy immediately. You are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BackScatter
Todd - I will second David on this - Alligate is the best gateway - no question about it - and it does integrate perfectly with Declude. -Nick David Barker wrote: Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com mailto:dbar...@declude.com *From:* supp...@declude.com [mailto:supp...@declude.com] *On Behalf Of *Todd Richards *Sent:* Saturday, May 16, 2009 6:11 PM *To:* declude.junkmail@declude.com *Subject:* RE: [Declude.JunkMail] BackScatter Thanks Craig. From all indications our server is tightened down pretty good right now. We moved from Imail to SM at the start of April, and I implemented grey listing at the start of May. So we did have a fair amount of backscatter in between until I really understood what greylisting could do. Unfortunately, I can't talk the bosses into dropping another $800 or so to try and fix the problem. I know others have used ASSP with success, so I might look at that. SmarterMail's greylisting seems to be a lot better than what the rules in Declude offer. I might look at implementing ASSP in front of SM. I've heard a lot of people talk about the advantages of running something in front of your mail server. So it might be time. Todd *From:* supp...@declude.com [mailto:supp...@declude.com] *On Behalf Of *Craig Edmonds *Sent:* Saturday, May 16, 2009 1:53 PM *To:* declude.junkmail@declude.com *Subject:* RE: [Declude.JunkMail] BackScatter Hi Todd, I think grey listing prevents backscatter coming INTO your mail server, it does not prevent you getting on blacklists. If you are on a blacklist then I think you need to figure out how your smtp server is configured because it would indicate an issue somewhere. Since using Alligate (www.alligate.com http://www.alligate.com) as the first line of defence in front of declude, we have had zero black listings and all the backscatter has disappeared. The backscatter rules in declude really blow which is why I would highly recommend looking at Alligate as your smtp gateway. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com http://www.123marbella.com/ E : cr...@123marbella.com mailto:cr...@123marbella.com *From:* supp...@declude.com [mailto:supp...@declude.com] *On Behalf Of *Michael Graveen *Sent:* 16 May 2009 13:54 *To:* declude.junkmail@declude.com *Subject:* re: [Declude.JunkMail] BackScatter I think Greylisting reduces backscatter. Greylisting stops the majority of the SPAM from ever reaching our mail server, so it never has a chance to get bounced back because of a non existent user, etc. Mike Hi Everyone - We've been having a few issues with mail servers refusing our mail. Today I ran a test on DNSStuff and found that our IP is on BackScatter.org. They are referencing an event on 4/27, and supposedly we will be removed after 4 weeks if they haven't had any other issues. Of course we can pay to have it removed sooner. I'm not sure if being listed in their DB is the main culprit to the server refusals that I've seen? We switched over to SmarterMail in mid-April. Since 4/27, we have implemented grey listing. Is grey listing a good first line of defense? Is there anything else I should be doing to prevent back scatter? Thanks for your thoughts on this. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This
RE: [Declude.JunkMail] BackScatter
Hi David, Can you elaborate on why SmarterMail's greylisting is dangerous? In SmarterMail all mail gets greylisted until it passes. When it passes subsequent email get's whitelisted (for a period of time). There is a greylist exclusion list for mail server that are known not play well. How does this differ from the Alligate/Declude combination? Thanks, Mike Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd Richards Sent: Saturday, May 16, 2009 6:11 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Thanks Craig. From all indications our server is tightened down pretty good right now. We moved from Imail to SM at the start of April, and I implemented grey listing at the start of May. So we did have a fair amount of backscatter in between until I really understood what greylisting could do. Unfortunately, I can't talk the bosses into dropping another $800 or so to try and fix the problem. I know others have used ASSP with success, so I might look at that. SmarterMail's greylisting seems to be a lot better than what the rules in Declude offer. I might look at implementing ASSP in front of SM. I've heard a lot of people talk about the advantages of running something in front of your mail server. So it might be time. Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig Edmonds Sent: Saturday, May 16, 2009 1:53 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, I think grey listing prevents backscatter coming INTO your mail server, it does not prevent you getting on blacklists. If you are on a blacklist then I think you need to figure out how your smtp server is configured because it would indicate an issue somewhere. Since using Alligate (www.alligate.com) as the first line of defence in front of declude, we have had zero black listings and all the backscatter has disappeared. The backscatter rules in declude really blow which is why I would highly recommend looking at Alligate as your smtp gateway. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : cr...@123marbella.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: 16 May 2009 13:54 To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] BackScatter I think Greylisting reduces backscatter. Greylisting stops the majority of the SPAM from ever reaching our mail server, so it never has a chance to get bounced back because of a non existent user, etc. Mike Hi Everyone - We've been having a few issues with mail servers refusing our mail. Today I ran a test on DNSStuff and found that our IP is on BackScatter.org. They are referencing an event on 4/27, and supposedly we will be removed after 4 weeks if they haven't had any other issues. Of course we can pay to have it removed sooner. I'm not sure if being listed in their DB is the main culprit to the server refusals that I've seen? We switched over to SmarterMail in mid-April. Since 4/27, we have implemented grey listing. Is grey listing a good first line of defense? Is there anything else I should be doing to prevent back scatter? Thanks for your thoughts on this. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---
RE: [Declude.JunkMail] BackScatter
I might add that the Interceptor front end (Alligate) does have some capabilities in this area. I am not really familiar with Hijack myself, but Alligate tracks volume from every senders IP address regardless of whether the message is incoming or outgoing. You can, for example, limit messages from a particular client (or a user definable subnet range of that client) to 'x' number of messages in 'x' minutes. You can also limit the number of concurrent client connections to deal with multi-threaded spam blaster apps. These features are designed primarily for incoming mail, however they work equally well throttling outgoing email. In order for a message to be counted as one hit, it must be a separate connection. Messages with multiple CCs are only counted as a single hit. So you can basically set it to reject connections with a 550 error if they send more than 25 messages in 5 minutes, or whatever suits your needs. The client will not be able to send a message again until they cease activity for 5 minutes or whatever you have set the time limit to be. Specific IP addresses or ranges can also be excluded from volume metering if you like. Brian From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 18, 2009 1:53 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter That is correct, as Interceptor is a Gateway and runs outside the server as opposed to inside the mail server. Declude Hijack is not supported with Interceptor. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Robert Grosshandler Sent: Monday, May 18, 2009 4:32 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter From what I read, Interceptor (which we tried in its earlier incarnation, eons ago) doesn't include the Hijack functionality (the design wouldn't support it.) Rob From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dan Shadix Sent: Monday, May 18, 2009 3:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter We've been running Declude Interceptor for a few months now and I agree completely with David's comments. It has been great and the transition was very easy. Dan From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: Monday, May 18, 2009 1:04 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com _ The information contained in this communication is privileged and confidential. If you have received this communication in error, please forward back to the sender and delete your copy immediately. You are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BackScatter
Hi Mike, I can help with this. Greylisting it tremendously effective however it can cause a lot of problems if it is not done selectively. We worked closely with Matt Bramble and a few other Declude power users to develop ways to apply greylisting only when it is most likely to be beneficial. Blanket greylisting is dangerous in that not everything plays well with greylisting. Also, you'll always have those users who are expecting an immediate email from someone, and greylisting is going to delay it if they have not successfully passed greylisting before. Rather than greylisting everyone (which you can do If you want), what we did is to allow you to specify a number of criteria that will trigger greylisting. In these cases, greylisting is not triggered until something suspicious is encountered. Because Interceptor/Alligate is designed from the ground up to examine every aspect of the SMTP conversation, there are several points in the transaction where greylisting can be invoked. These include the senders reputation based on our MXRate rating, the originating country, volume, recent history, suspicious HELOs, blacklist hits, and several other items. This provides a much more effective way to employ greylisting without inconveniencing most users or senders. In fact, most end users never realize greylisting is being used. The idea here is to determine if something is probably spam, and if we have reason to believe that it may be, then impose a greylist check. You do not have to educate your users this way, and you will have far less complaints. Hope this helps. Brian From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: Monday, May 18, 2009 3:57 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi David, Can you elaborate on why SmarterMail's greylisting is dangerous? In SmarterMail all mail gets greylisted until it passes. When it passes subsequent email get's whitelisted (for a period of time). There is a greylist exclusion list for mail server that are known not play well. How does this differ from the Alligate/Declude combination? Thanks, Mike _ Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax mailto:dbar...@declude.com dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd Richards Sent: Saturday, May 16, 2009 6:11 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Thanks Craig. From all indications our server is tightened down pretty good right now. We moved from Imail to SM at the start of April, and I implemented grey listing at the start of May. So we did have a fair amount of backscatter in between until I really understood what greylisting could do. Unfortunately, I can't talk the bosses into dropping another $800 or so to try and fix the problem. I know others have used ASSP with success, so I might look at that. SmarterMail's greylisting seems to be a lot better than what the rules in Declude offer. I might look at implementing ASSP in front of SM. I've heard a lot of people talk about the advantages of running something in front of your mail server. So it might be time. Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig Edmonds Sent: Saturday, May 16, 2009 1:53 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, I think grey listing prevents backscatter coming INTO your mail server, it does not prevent you getting on blacklists. If you are on a blacklist then I think you need to figure out how your smtp server is configured because it would indicate an issue somewhere. Since using Alligate (www.alligate.com http://www.alligate.com/ ) as the first line of defence in front of declude, we have had zero black listings and all the backscatter has disappeared. The backscatter rules in declude really blow which is why I would highly recommend looking at Alligate as your smtp gateway. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com http://www.123marbella.com/ E : cr...@123marbella.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: 16 May 2009 13:54 To: declude.junkmail@declude.com Subject: re:
RE: [Declude.JunkMail] BackScatter
Hi Brian, Thanks for the explanation. Mike Hi Mike, I can help with this. Greylisting it tremendously effective however it can cause a lot of problems if it is not done selectively. We worked closely with Matt Bramble and a few other Declude power users to develop ways to apply greylisting only when it is most likely to be beneficial. Blanket greylisting is dangerous in that not everything plays well with greylisting. Also, you'll always have those users who are expecting an immediate email from someone, and greylisting is going to delay it if they have not successfully passed greylisting before. Rather than greylisting everyone (which you can do If you want), what we did is to allow you to specify a number of criteria that will trigger greylisting. In these cases, greylisting is not triggered until something suspicious is encountered. Because Interceptor/Alligate is designed from the ground up to examine every aspect of the SMTP conversation, there are several points in the transaction where greylisting can be invoked. These include the senders reputation based on our MXRate rating, the originating country, volume, recent history, suspicious HELOs, blacklist hits, and several other items. This provides a much more effective way to employ greylisting without inconveniencing most users or senders. In fact, most end users never realize greylisting is being used. The idea here is to determine if something is probably spam, and if we have reason to believe that it may be, then impose a greylist check. You do not have to educate your users this way, and you will have far less complaints. Hope this helps. Brian From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: Monday, May 18, 2009 3:57 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi David, Can you elaborate on why SmarterMail's greylisting is dangerous? In SmarterMail all mail gets greylisted until it passes. When it passes subsequent email get's whitelisted (for a period of time). There is a greylist exclusion list for mail server that are known not play well. How does this differ from the Alligate/Declude combination? Thanks, Mike Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Todd Richards Sent: Saturday, May 16, 2009 6:11 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Thanks Craig. From all indications our server is tightened down pretty good right now. We moved from Imail to SM at the start of April, and I implemented grey listing at the start of May. So we did have a fair amount of backscatter in between until I really understood what greylisting could do. Unfortunately, I can't talk the bosses into dropping another $800 or so to try and fix the problem. I know others have used ASSP with success, so I might look at that. SmarterMail's greylisting seems to be a lot better than what the rules in Declude offer. I might look at implementing ASSP in front of SM. I've heard a lot of people talk about the advantages of running something in front of your mail server. So it might be time. Todd From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig Edmonds Sent: Saturday, May 16, 2009 1:53 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, I think grey listing prevents backscatter coming INTO your mail server, it does not prevent you getting on blacklists. If you are on a blacklist then I think you need to figure out how your smtp server is configured because it would indicate an issue somewhere. Since using Alligate (www.alligate.com) as the first line of defence in front of declude, we have had zero black listings and all the backscatter has disappeared. The backscatter rules in declude really blow which is why I would highly recommend looking at Alligate as your smtp gateway. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : cr...@123marbella.com From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: 16 May 2009 13:54 To:
