Re[2]: [Declude.JunkMail] Legalities of adding header info
Hello Darin, Friday, April 8, 2005, 10:07:51 AM, you wrote: DC Certainly true...but in the case of reasonable doubt grin, a good lawyer DC could use that argument wellbut hopefully it won't come to that. DC Darin. Civil cases do not require 'beyond a reasonable doubt', only criminal. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Smarter Mail and ODBC
Hello Don, Friday, December 24, 2004, 6:01:43 AM, you wrote: DS I cannot find where Smarter Mail supports ODBC? Our IMail set-up is with SQL DS database for usernames and passwords integrated with our Cold Fusion DS applications. Does anyone know if Smarter Mail will work with database? DS Thanks. DS -Don SmarterMail uses an XML based config set. They do provide web services for account management, and you should be able to find a way to leverage that from your CF apps. Check their forums and see if anyone else does. http://forums.smartertools.com/ -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Imail/Declude queues backing up
Hello DLAnalyzer, Tuesday, December 14, 2004, 10:01:47 AM, you wrote: DS Because of this issue I wrote a Windows service that not only monitors the DS imail queue it also monitors the declude overflow directory. You can setup DS different types of alerts (size and growth percentage) to notify you or run DS an external script when things exceed your thresholds. This has saved me DS many times. It's always better to get an alert when the queue has 1000 DS Q*.smd files backed up than 50K... I'll take a look at it, that'll save me time from making my own. Since mine hung over the weekend, I had over 250K messages between spool and overflow before any one bothered to call me and say they weren't getting any mail. I average around 300K+ per day and it had been down for over 24 hours over a slow day fortunately. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail/Declude queues backing up
Hello Mark, Monday, December 13, 2004, 10:04:38 AM, you wrote: MES Has anyone experienced a problem when using Imail/Declude as a gateway where MES some random messages just seem to backup in the queue for no reason? We'll MES go into Imail's queue manager, select them and hit send now and the queue MES opens up a flood gate of messages. MES I wish I had more info but I'm not sure where to dig right now. I have just spent the last 24 hours slowly feeding messages back into the message queue after queue manager quit delivering. It has happened before, and I have seen posts on the Imail list discussing queue manager hanging. The real problem is, the service is running, it just isn't doing anything. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] External RegEx tests using FINDSTR
Hello Darin, Tuesday, December 7, 2004, 10:12:56 AM, you wrote: DC Here's an example test config: DC REGEX14 external 0 c:\winnt\system32\cmd.exe /c findstr If you require DC any of the medications below, 1 0 Try single quotes around the string. e.g.: REGEX14 external 0 c:\winnt\system32\cmd.exe /c findstr 'If you require any of the medications below,' 1 0 -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] 2003 Server DNS Declude
Hello Kyle, Friday, November 19, 2004, 2:14:57 AM, you wrote: KF I just applied the hot fix and we will seeif it works. I KF wont know until about 8:30am CST when the emailload really KF hits. Just to let you all know that I setup 3different DNS KF servers with 2003 and they all had the same memory leak. I KF setupone NT4.0 and it worked fine. So in my case any 2003 DNS KF server had thememory leak. I only have about 60,000 messages a KF day and it should havehandled it fine, but due to Microsofts KF great programming it didnt. KF KF I am learning Linux and BIND and will soonbe switching, but I KF want to know it like the back of my hand before I go KF intoproduction. If the hot fix works this will most likely be the KF reason whya good bit of spam was still getting through. KF KF I will keep you all updated. KF KF Kyle KF Instead of Linux and BIND, why not a reliable windows solution? I run SimpleDNS Plus from http://www.jhsoft.com/ on 6 servers, and process around 300K messages per day against one of them, and have dial customers using the same name server. It is very fast, reliable, easy to administer, and the developers are on the ball if problems occur. Pricing is reasonable too. Of course, you caould also run windows BIND. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Question on Dell Poweredge 1750
Hello Markus, Tuesday, November 9, 2004, 10:20:16 AM, you wrote: MG 1.) Anyone has had the known Imail-NIC problems with this Ethernet ports? Yep. MG And your solution? Installing another NIC card (3Com) beside the other four MG existing ethernet ports? Don't do that. Create 2 more partitions with the rest of your 69G. One for Imail program files and one for spool only. Spool partition should NOT be larger than 4G. 2G is plenty, just make sure you move Imail log files out daily. Oh yea, and don't put your virus hold or declude log files in spool either. Both of those can be separated to another partition. (Imail log files can't) MG So considering also Matt's reply: MG - Delete the existing 69 GB partition MG - Create the two small (and so faster) partitions with around 2 or 3 GB for MG Imail program files and Spool-folder MG - Create the last partition with all the remaining space to move out log- MG and hold-files from the spool folder. MG As I know I can specify the virus-folder in virus.cfg but I don't know how MG to specify the hold-folder outside the Imail-spoolfolder for the Declude MG HOLD action. Have I missed something? MG Thanks in advance MG Markus Just as a note, you can use Kiwi Syslog as your syslog server (it's free if you don't want to use the more advanced features), then write the log files from Kiwi to anywhere on the system you want, you can even run it from another server and log there. The log format can be customized to look like IMail logs. Be aware though, IMail only lets some of the services log to syslog. http://www.kiwisyslog.com/ -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Anti-Virus Feeds for Web Site
Hello Dan, Thursday, October 28, 2004, 10:23:25 AM, you wrote: DG Hello, All, DG We are in the process of re-doing are web site and I am looking for a good, DG current, reliable Anti-Virus breaking news feed that we can put on our web DG site. We are currently a registed Symantec Partner and we also use McAfee DG so I'm looking into registering as a partner with them. I know that part of DG our parternship will probably give us access to feeds through them, although DG I've been a little unimpressed by their AV feeds. I'm curious to know if DG there are any other good ones out there. DG Thanks, Much! DG Dan Geiser DG [EMAIL PROTECTED] DG --- DG Sign up for virus-free and spam-free e-mail with Nexus Technology Group DG http://www.nexustechgroup.com/mailscan DG --- DG [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] DG --- DG This E-mail came from the Declude.JunkMail mailing list. To DG unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DG type unsubscribe Declude.JunkMail. The archives can be found DG at http://www.mail-archive.com. TrendMicro has one http://www.trendmicro.com/syndication/vinfo/. We use it on our site. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Best Practices for handing legit email flagged as spam?
Hello Darin, Monday, October 25, 2004, 10:22:11 AM, you wrote: DC We're working on an independent version of SpamReview that has more DC information and adjustments capabilities built in, but there are two DC existing freeware products on the Declude Utilities page: SpamReview being a DC desktop app, and another one (sorry forgot the name) being web based. I made one of the web based solutions, they all have a slightly different approach, but the end result is the end user is, for the most part, in control. Mine is called Spam Review Web App (I am very bad at comming up with names for these things). I have not actively made changes in over a year, but I use it in production myself with 8.05, and it works well even though it was designed around 6.06. I may, if I can get free the time, rework it into ASP.Net with some newer tricks I have been thinking about, but I have not really had the time. If you want to look at, even for ideas for your own app, it can be found at: http://spamreview.argolink.net/software/ DC We review the hold queue several times a day, adjusting for false positives, DC and have a spam reporting address to adjust for false negatives. We figure DC it takes us about an hour/10k messages/day for the review and tweaking DC process. We are considering moving to a bulk folder mentality, with DC automated processes for users to report messages as spam or not spam. If I follow the math, for my 300K messages/day, you would spend 30 hours per day reviewing and tweaking, OUCH! BTW, I work for an ISP, so in many ways it is better to let the end user decide the protection level and report false positives for review. In a corporate environment, company policy can dictate a joke mailing list as not a false positive, but as unwanted mail, I don't have the same liberties. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Somewhat OT question...
MES Also, Exchange 2003 doesn't run POP3/IMAP4 by default and in our org so MES that's why I can't use Outlook Express. The Bat! is a MAPI client and it allows viewing of headers inline with the message=. I do not have an Exchange server to test the MAPI functionality, but you can download a trial. http://www.ritlabs.com I've quit using Outlook and OE all together. -- Best regards, Charlesmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Interim versions issue (again)
Something else not touched on by John, it is one file for three product tracks (Junk Mail, Virus, and Hijack), any one of them can cause a new interim, even as a minor bug fix. Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Saturday, July 24, 2004 10:42 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Interim versions issue (again) I feel the need to come out some what in defense of Scott on this issue. 1. From the readme.txt file on the interim version site dated 4/12/04: We do not keep detailed release notes for interim releases, so we may not be able to tell you whether or not a specific interim release has a specific feature or fix. 2. Interim version numbers can increase dramatically quickly, as per the nature of them. An interim is available, some one tests, reports back this or that, it is changed and an 30 minutes later a new one is available, it is tested and reports back, etc. etc. I remember last year when Scott was working with me on preparing AutoWhite for Declude, he had 4 interim versions in one day just on one single issue. Therefore, just because the version went from xi1 to xi10 in a matter of a day or 2 or 3 does not mean other functions were added. 3. Interim versions should only be used to 1) test a fix for a bug and 2) to test a new function. Either way, it is temporary, and not meant for a true production environment. The fact that many of us do run with Interim versions in production is a sole credit to the relative simplicity of Declude. 4. Once an interim version has included new functions/features, a new beta version should be created within a month. Limit the amount of new functions/features in a beta to 2 or 3 to keep it simple. 5. Once a beta version has come out, limit the introduction of new functions/features to one or two until a new released version is out. 6. Once a beta version has come out, within a month, either a new beta should be out, or a released version should be out. Just my thoughts, your thoughts may and should differ. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Messagerite
Anybody have any experience with this company? A customer of mine has been asked to use this service for one of his customers and he is trying to figure out what they are really doing and if we can set up our own way of doing the archiving. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ARGOLINKs SPAM Graph
For the record, it does not read the whole log unless you are not running it regularly, it writes the last read position to a file and seeks to that position on the next gather. If ran regularly using scheduler, it wasn't that bad of a process hog on my old single proc system. I have not set it up on my new server yet, but since, I am building an even bigger replacement for that one, I may get it running again, besides I need to look at the new LOG format, make it work with the summaries. Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support Sent: Wednesday, April 14, 2004 10:13 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] ARGOLINKs SPAM Graph Terry, I orginally looked at the argolink spam graph, but as the doc's mentioned it goes through the full log file from beginning to end. Our log files are big, but it would tie up the cpu for a bit ~10-15 minutes. We just finished a seperate program that can be used with MRTG to graph junkmail stats. The program is done and I am using it. I just have to package it up and write some small doc's on it. I am in the process of finishing up the program that can be used to link Imail to MRTG as well. Both will be made available for free shortly. I will send a note out when everything is posted on our site.. Darrell Terry Parks writes: OT, A little, any body got it going? I got it to display just the page with the word GRAPH on it. Using Windows 2003. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.invariantsystems.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Notification to customers of change of ownership
I saw that when you posted it (also know as when it hit my mailbox), after I posted mine. And I stand corrected. Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Monday, April 12, 2004 3:49 PM To: Charles Frolick Subject: Re[2]: [Declude.JunkMail] Notification to customers of change of ownership I have never seen a cheap addin for MS SMTP, even simple ones. http://www.mail-archive.com/declude.junkmail%40declude.com/msg17599.html I suppose it depends on what you mean by add-in, but... --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.79 (beta) released
Did you mean WEIGHT10 COPYFILE C:\Imail\spool\weight10\? Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, April 05, 2004 9:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude JunkMail v1.79 (beta) released We have just released Declude JunkMail v1.79 (beta). See http://www.declude.com/junkmail/manual.htm . Notable changes since the last beta include: o ALL FIX Added code to bypass IMail v8.1's duplicate scanning of forwarded E-mails. o JM FIX Subject filters will now work on both decoded and undecoded versions of subject. o JM FIX Fixes an issue that could force IGNORE action to be used if more than 100 tests were defined. o JM FIX Fixes an issue with an infinite loop that could occur in SPF processing with invalid SPF strings. o JM FIX Fixes an issue that could cause UNKNOWN VAR to appear o JM ADD COPYFILE action to copy the IMail D*.SMD and Q*.SMD files to a specific directory (for example, WEIGHT10 COPYTO C:\IMail\spool\weight10\). Other additions and fixes can be found in the release notes, at http://www.declude.com/relnotes.htm . Anyone with an up-to-date Service Agreement is entitled to free upgrades (see http://www.declude.com/agree.htm for information on the Declude Service Agreement). --- Quick Resource Reference: Tech Support: [EMAIL PROTECTED] Mailing List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.junkmail your name in the body New Releases List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.releases your name in the body Troubleshooting: See manual URL above; look at Troubleshooting section Emergency Uninstall: See manual URL above; look at Emergency Uninstall section Urgent Support: urgent @declude.com (for urgent/time-sensitive issues only) Declude Addons/Tools URL: http://www.declude.com/tools Manual: http://www.declude.com/junkmail/manual.htm --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Question about MAILBOX action.
I don't use the MAILBOX action at all, I write a filterable header and use Imail filters to sort mail. Means it will work even on forwarded accounts to other servers or in clients with header filtering capabilities. Also, since I classify spam rank, you can take different actions based on rank, delete, hold, forward, and I can whitelist with a rule before it. Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky Sent: Saturday, January 31, 2004 5:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Question about MAILBOX action. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 31, 2004 9:14 AM Subject: Re: [Declude.JunkMail] Question about MAILBOX action. Received: from SMTP32-FWD by joshie.com (SMTP32) id A047C0052; Fri, 30 Jan 2004 20:31:00 This line shows that the E-mail was forwarded -- note that forwarded E-mail won't have the MAILBOX action applied to it (since it may be forwarded to another server that doesn't support mailboxes the way that IMail does). After posting I realized that it is of course a forward because IMail won't let me delete the root account. Both domains are on the same IMail server though. What do others with multiple domains that use MAILBOX do for their root acocunts and such to consolidate the mail but still have the MAILBOX action do its thing? -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Challenge/Response with Declude
I can see it as a viable option for grey items using weighting, but it still doesn't answer the licensing problem. You could also use the existing action of bounce (I know it has changed), just let them know that the mail is rejected, or you can use attach. There are options that already exist in Declude. In my personal account I hold only low weighted spam and delete all mid and high weighted spam, yet I hold 600-700 messages in 5 days (the age of my hold). All of that mail is spam with the very rare exception (I do still get spam in my inbox so it isn't as tight as it could be), so all of that would be bad C/R bounces to invalid or joe jobbed emails. That is just my account, there are thousands of accounts on my server. I really don't think C/R is good. Selective Alert messages for certain high FP tests may not be bad though. Thanks, Chuck Frolick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, January 28, 2004 1:25 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Challenge/Response with Declude Hi, I think the consensus is it is not acceptable Then let mine be the only opposing voice. I think because of Declude's weight features, Challenge/Response would be a very valuable and very usable option. Any messages with LOW weight pass. This addresses your concern of breaking e-commerce. If they want to make money, they better have their mail server set up appropriately. Any messages with HIGH weight, get held or deleted. I have yet to hear a complaint. In the middle are a small percentage of medium weights that do fail a spam test or two - but are possibly legitimate. Those few messages currently get a bounce message so that a false positive victim has a chance to intervene. I have gotten zero complaints from people saying hey, you spammed me with your bounce message, but every so often I do get a thank you from a false positive victim who, due to my bounce message, is able to address THEIR problem. It is those bounce messages, which in the future could come with a challenge/response URL, containing the URL with the queue-ID as a parameter to a web application that will release their message. It's a shame that we currently are forced to manually manage the false positives when Declude could automate that process! (Hm - now that I'm saying this - I should just write a little web application that copies the held D and Q file back to the spool and include the parameterized URL in my bounce messages... If I only had the time...) Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Checking blacklists entire CIDR blocks
Does anyone know of an easy way to check an entire netblock for listings? We are suppsed to be getting some additional IP's but I want to make sure they are clean first. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Overflow
I seriously don't think they would bother with the code needed to detect the difference between accepting everything in the dictionary and bouncing some or all addresses. A spammer using dictionary attacks may not be harvesting addresses, they may just be spamming a dictionary of addresses. The best way to handle them is to have some sort of detection routine to temporarily block them with temp errors so that legit mailers will retry. Imail is not capable of doing this, so either process a buch of postmaster bounces or trashcan them. Big drawback to using nobody to trashcan, if someone typoed an important email, they would never know. Thank you, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 22, 2003 9:47 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Overflow Nick, I think I might have been asking the question the other way around, though I'm not positive it was taken the wrong way. The theory here is that domains which accept every E-mail address in the HELO won't be dictionary attacked past a few attempts because the attacker's software will quickly determine that the attack isn't exposing any addresses due to a catch all situation. So maybe adding the nobody alias back in, and redirecting that E-mail to an account that deletes each E-mail automatically will resolve the issue of dictionary attacks? I see this stuff in my logs on occasion, but it never happens for a prolonged period of time. I'm thinking this is because 90% of my domains had nobody aliases. Unless someone only wants to DOS my server, dictionary attacking a domain with a nobody alias is a waste of their processing power just like it is a waste of mine. Matt Nick Hayer wrote: Hi Matt, Is anyone getting dictionary attacked for long periods of time on a domain with a nobody alias or something that is gatewayed? Thanks, Yes. I get hammered everyday..; I got rid of the nobody alias, filter the log files for the ip's that connected - and add them to my Imail Access control list. Currently that list contains nearly 10,000 ip's... -Nick Hayer Matt Fritz Squib wrote: Hey guys, this sounds like same problem that I have been experiencing, however it has been a bunch of spam with c.c. 's to non-existant mail addresses on my server (dictionary attack style) ..My DNS is working fine. I spent the weekend returning mail from the old spool to a new spool that I had to create. I had around 67,000 of these buggers to deal with...no fun. All of the mail seems to be originating from dsl and cable modems with forged return addresses. My server is swamped again today - started again about 2-3 hours ago. Fritz Frederick P. Squib, Jr. Network Operations/Mail Administrator Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html mail /\- against microsoft attachments --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: DNS Issues
I just finished moving all of my servers to all new boxes on a new backbone connection with my own ARIN designation. The problem I seem to suffering from is, even though I have 1 hour TTL's some ISP's are taking days to refresh the records for many of the servers and the hosted domains. I moved the Mail server and DNS servers about 2 weeks earlier with no problems, but the others are killing me since now I have a lot of customers complaining they can't see or modify their sites. I have checked DNSStuff and many similar sites, and all say everything is correct, yet customers still see the wrong thing, even after ipconfig /flushdns on XP and 2k. Everything has been moved now, and is coming back to normal, however, I would like to be able to prevent it in the future, I will be moving servers from other companies into my address space (we are aquiring). My zone is argolink.net, and one zone I had particular problems with is houstonsweddingguide.com. If you want more examples, I have plenty of zones to poke at. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log file' total' analyser
You're welcome to use/modify my stats grapher, it uses RRD to graph the logs from Declude. I had to stop using it for resource reasons on my old server, and just haven't had time to set it up on my new server. It is at http://spamreview.argolink.net/software/declude.htm. It is in perl. Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nathan Fouarge Sent: Tuesday, October 28, 2003 10:25 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log file' total' analyser Has anyone made a program/script that reads the declude log(s) and gives a graph or summary of the total weights so you can get a good idea of what weights to hold on. I am just asking before I put my perl hat on. Nathan Fouarge Amberwave Communications 114 N Dodge Algona, IA 50511 515-295-6900 x33 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What Happens with Multiple To addresses.
The only thing you could do is find some way to split the messages into one copy per recipient. Imail does not handle them this way, but some MTA's do. You could set up your MX server(s) to be a gateway box that uses an MTA that splits the message to per recipient (note: this still won't help with aliases). I have done some testing with Xmail Server and it does handle each recipient one by one, creating a new copy of the message for each recipient. Downside is, in your example, even if you whitelist user2, Declude will run all tests on twice on essentially the same message. Once for user1 and once for user3. If you didn't whitelist, then it is three times. i.e., if you have a heavy load it will increase it. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Royce Fessenden Sent: Thursday, October 02, 2003 3:09 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] What Happens with Multiple To addresses. The problem is I have an executive user who does not understand the flagging at all. They panic when they see any indication that the mail has been scanned and are afraid that important mail is going to be deleted. (I upgraded to the pro version to try and solve this problem by enabling user level controls.) If [EMAIL PROTECTED] has all Actions set to WARN, but the global setting is HEADER will they see the Header text? If so, is there any solution other than passing the spam on with WHITELIST TO [EMAIL PROTECTED] Royce -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, October 02, 2003 12:17 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] What Happens with Multiple To addresses. What rules apply if an email is sent to several users only one of which has custom settings? Declude JunkMail will combine the settings the best that it can, erring on the side of assuming the E-mail is spam. The idea is that if someone sends legitimate mail to multiple recipients and one doesn't want it, it's up to the sender to take care of the problem (they can just send one at a time, for example). For example: An email is sent to mailto:[EMAIL PROTECTED][EMAIL PROTECTED], mailto:[EMAIL PROTECTED][EMAIL PROTECTED] and mailto:[EMAIL PROTECTED][EMAIL PROTECTED] The following files exist: c:\Imail\Declude\$default$.junkmail c:\Imail\Declude\example.com\$default$.junkmail (Which is identical to the global file c:\Imail\Declude\$default$.junkmail.) c:\Imail\Declude\example.com\user2.junkmail I want mailto:[EMAIL PROTECTED][EMAIL PROTECTED] to get the email. Everyone else should not get it. I tried WHITELIST TO mailto:[EMAIL PROTECTED][EMAIL PROTECTED] in global.cfg. That also passed the spam on to everyone else who is listed in the TO: address. That's correct. The WHITELIST action will make sure that the E-mail is received. If you have a sender that is sending mail that some of your customers want and others do not, they have a serious problem. The best thing to do is get the people who do not want the E-mail to unsubscribe. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Sobig Remailer
It appears the Sobig.F remailer capabilities are being used. I have received 4 complaints in the last 2 days about spamming from my dial pool with headers like these: Return-Path: [EMAIL PROTECTED] Delivered-To: x Received: (qmail 14974 invoked by uid 88); 24 Sep 2003 03:39:33 - Received: from unknown (HELO 209?144?2?150.dr?tw211.du.argolink.net) (209.144.2.150) by mail5.safeserver.com with SMTP; 24 Sep 2003 03:39:33 - Received: from [188.207.43.80] by 209_144_2_150.dr_tw211.du.argolink.net with ESMTP id 940513-87248; Wed, 24 Sep 2003 05:29:57 +0100 Message-ID: [EMAIL PROTECTED] From: Donnell Childress [EMAIL PROTECTED] Reply-To: Donnell Childress [EMAIL PROTECTED] To: x Subject: Fw: x vali-um, xan-ax, am-bien, no dr visit shipped to ur door amity z rlq nbw Date: Wed, 24 Sep 03 05:29:57 GMT X-Mailer: eGroups Message Poster MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=0_.FCE6ED9E.C X-Priority: 3 X-MSMail-Priority: Normal Note the first received line is using one of my dial customers as the outbound server. (du.argolink.net is the zone I use for my dial customers) The HELO string is always the proper PTR hostname, although it looks like some servers (like the one above) don't like the underscores (2 of the reports have them correct, 2 have the question marks). Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries IP'd reverse DNS entries
You might want to add underscores, I use underscores as my seperator, and I doubt I am the only ISP to do so. Also, why did you start the list at 30? I know that it I very unlikely for a residential IP to be all numbers under 30, but why 30? And finally, what about those that pad with zero's? i.e. 192-168-054-003.dynamic.isp.tld. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Wednesday, September 17, 2003 8:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries IP'd reverse DNS entries Actually, you don't get scored with this filter. You would need to have dashes or dots on both sides of a number. Even if you did, you would have a real tough time scoring anything over 1 coming to my machine. Your mileage may vary of course. Also, I can't see why it would be even workable to tag frame or T-1's with an IP address in the reverse. Too many such clients use full class C's and the practice of using numbered naming conventions in dial-up because they're fixed and easy to identify (i.e. they don't have to assign new names upon request). The only thing that might match your IP in that reverse entry is the 88, not the 224, that's probably reference to a customer number or region so they can look you up in a database i'm guessing. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
Why do they have to have a real mail box? I send mail as aliases all the time, my support, sales, postmaster, hostmaster, webmaster, staff, etc., addresses are all aliases but I have no problem sending as them, as long as the client is configured correctly. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 11:42 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action It appears that I spoke too soon... I have figured it out. I really don't want to beat a dead horse, but I really needed a solution for this. We have Addresses that need to have mail come from them, but note really receive mail, that why it needs to have a real mailbox (valid user) to send mail. Such as techsupport, etc. But these mailboxes are forwarded to multiple people, but with the configuration all the end mailboxes get a ton of spam, that's why it very important, that I find a solution. So for anybody that's interested here is the fix. For the mailbox that is currently forwarded: [EMAIL PROTECTED] Remove all the forwarding on this box. Create an Alias that has the same name as the Mailbox: [EMAIL PROTECTED] Forward this alias to the user(s) you need, to make sure that you can use the existing config files, make sure you forward to the Full Host, such as [EMAIL PROTECTED] You can also setup the forwarding to a list file, See the Imail documentation for that. There you have it. Any spam that comes in for the Alias will get redirected before in gets tested by declude, making declude think that the message came directly to the end user and test it accordingly. --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action So in other words, If I have mailboxes with forwarding on them Spam will still get through. Disappointing... --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. That is the way that it should work. E-mail that is forwarded from one user to another automatically in IMail (as opposed to aliases or forwarding from a mail client) bypasses any scanning. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Very close. The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Unfortunately, I'm not aware of any way around this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---
RE: [Declude.JunkMail] SMTP Relay Limit
I like Xmail server (http://www.xmailserver.org), it is multi platform and can easily do what you want. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Wednesday, September 10, 2003 2:34 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SMTP Relay Limit I'm running Declude as a gateway for various IPs and just hit a limit. Under Addresses specified here are to be considered local addresses for mail gatewaying Adding entries to Access Control under SMTP, the 100th entry produces an error: Maximum table size reached So now, no more clients can be added because I can't relay their mail. Ipswitch says its hard coded across all versions and a fix is months away, if they agree to do it. What I'm thinking is sending all mail to a down stream server that doesn't have this limit that would in turn forward to clients. This leaves two questions: 1) What's the best email server software to do this with, providing both unlimited relay IPs and easy text editing of the delivery list (Linux, Windows, Mac)? 2) What's the best way to deliver from Imail to this server? The obvious is to add this same IP to every domain listed in the hosts file, but would it be better to use Gateway Option, Send all remote mail through gateway Any comments/insights would be appreciated. Thanks! Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action
Just futther proof, here are the headers from the message I sent: Received: from gershwin.mpgis.net [65.199.185.236] by argolink.net with ESMTP (SMTPD32-6.06) id A9D822F401B0; Wed, 10 Sep 2003 15:30:16 -0500 Received: from argolink.net [209.144.1.45] by gershwin.mpgis.net (SMTPD32-7.07) id A8201DF00DE; Wed, 10 Sep 2003 15:14:40 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Relay Test Date: Sept 10, 2003 14:27 -0500 Message-ID: [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [801e]. X-Declude-Sender: [EMAIL PROTECTED] [209.144.1.45] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Declude-Warning: [BADHEADERS] This message may be SPAM. This E-mail was sent from a broken mail client [801e]. X-SPAM-Level: SPAM-NONE X-Declude-Sender: [EMAIL PROTECTED] [65.199.185.236] X-Declude-Spoolname: D89d81b0.SMD X-Note: This E-mail was scanned for SPAM by ArgoLink.net with Declude JunkMail. X-Note: More info at http://help.argolink.net/spam.asp X-Declude-Failed: BADHEADERS, NOLEGITCONTENT, SPAM-NONE X-Declude-Total-Weight: 2 X-Declude-RCPT-Count: 1 X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 363051832 Status: U Ignore the BADHEADERS, I hand typed the message source. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charles Frolick Sent: Wednesday, September 10, 2003 2:32 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action Just relayed an email through your server from my desk. Transcript folows: Opening mail.mpgis.net... 220 gershwin.mpgis.net (IMail 7.07 36033-2) NT-ESMTP Server X1 HELO argolink.net 250 hello gershwin.mpgis.net MAIL FROM: [EMAIL PROTECTED] 250 ok RCPT TO: [EMAIL PROTECTED] 250 ok its for [EMAIL PROTECTED] DATA 354 ok, send it; end with CRLF.CRLF Sending Data... 250 Message queued QUIT 221 Goodbye You are an open relay. The ONLY acceptable settings are, relay for address or no relay. Thank you, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 1:57 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action See now you've confused me... Which isn't very hard. I believe I have Relay for Local Users Only (If I look in the Imail admin interface, that what it says, but it says relay by addresses in the web admin). Yet If I test relaying (by telneting in and trying to send something with a local user address), I still get a relaying error and it won't let it. To me that means I'm am not a Open relay. But I still need a local usermailbox to send from my App mailers. --Jason W. Allen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Message Delay. Was: Feature request: no displayable text in body no displayable text in body
I have customers here in the building that host domains with us that come visit me when there is a fifteen minute delay in their email since there are deals with tens of thousands of dollars relying on the speed of email, too late and someone else has the deal. Unless you know about their businees, you wouldn't know how critical email delivery is for them, and I know it is a bad idea to rely on email to this extent, but try to convice businesses that. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Saturday, September 06, 2003 5:44 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Message Delay. Was: Feature request: no displayable text in body no displayable text in body They would be delayed only on the first day. Ever after they would be passed normally because they would be in the list. Often delays such as this are introduced randomly in email systems due simply to system loads or perhaps the chance that the poor sap on the receiving end was buried in unplanned meetings the entire afternoon (been there more than once? I have)... so, most of the time nobody would notice - and somebody new would have no immediate expectations regarding the speed of response so they would be even less likely to notice. Once their first message went through everything would work at wire speed so to speak. _M PS: I'm sure that certain tweaks could easily be added to the process to help also... such as anything explicitly white-listed passing through immediately and so forth. An example might be if a corp used their product names and IDs in special rules in Message Sniffer, then that rule group's code might be used to white-rule any messages to the sales department for immediate transit. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Multiple recipients seeing action
We changed our handling because of this. We classify and rank using weights, then add a formatted header, they then can use Imail rules or client rules to handle as they wish. I also built a web app that will modify their rules for them by providing a simple how aggressive do you want to be and hold or delete on levels. If you are running Imail 8.x, imsgexp.exe now supports cleaning of individual .mbx files so you could turn it loose on all spam.mbx files on the server (it used to clean all .mbx files found in the folder or subfolder) Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tandem Group Sent: Monday, September 08, 2003 12:47 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Multiple recipients seeing action Scott: That would, in my view, be quite a serious problem for anyone using per-user settings, and I hope you can find a way to deal with it. I suppose the upside is that some customers will see the Subject add-on and call and ask 'what's this?' giving us an opportunity to sell our spam control programme, but more like they are going to tell us not to mess with their messages. For those who never use or even know about WebMail, their spam mailbox could be filled over time thus blocking the main mailbox as well. Yep, quite serious indeed. Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Multiple recipients seeing action
If you don't mind running a MX gateway or switching to a different one, Xmail server (www.xmailserver.org) does split all messages into individual recipients, I tested it. Downside is you will run declude for every recipient which will increase server load. I would guess at least a 5-10% increase in message volume, especially from those users that love to send junk to everybody they know every time. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, September 08, 2003 2:31 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Multiple recipients seeing action I would actually think that this should be an configuration option in Imail, where if you wanted to, each incoming message, if to more than one recipient on the local server, would be separated. In other words, if Imail received a message destined to 3 people on the server, instead of creating one message and delivering it to 3 mailboxes, it would create 3 messages to deliver one to each mail box. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, September 08, 2003 10:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Multiple recipients seeing action I have a concern with messages to multiple recipients where the action chosen by a single recipient is used on others. Unfortunately, that's a problem inherent in SMTP, where a single E-mail can be sent to multiple recipients -- and it's expected that the E-mail be identical for all recipients. Is this normal behaviour for DJM? If so, that would be a concern because obviously some mail which one person would delete would not get to another. That is correct. However, this is more a social issue -- if someone sends a legitimate E-mail to multiple recipients, they need to realize that by sending it as a single E-mail, the E-mail needs to be treated the same way for all the recipients. We are, however, looking into ways around this. If we do, though, it would require significant extra resources. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange Subject
I believe the Outlook XP and 2003 mail config test uses the subject encoding as well on the test message. Had acustomer with bad pop settings leave several test on webmail and they looked like that. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Monday, September 08, 2003 4:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange Subject SUBJECT 40 CONTAINS =?ISO-8859-1?b? Assuming you don't ever get emails from European countries, Canada or other locations that use accented characters. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Possible test suggestion
I'm trying to remember if this has been suggested before, couldn't seem to find anything in the archives (probably bad search terms). How about a test similar to MAILFROM but it checks the intended recipients of all local domains and fails if any of them are invailid, ignoring the nobody alias. It could even return the count as weight or a multiplier of count as weight. I can't think of a reason legitimate mail will have more than a couple outside of a mailing list, which, if I'm remembering right, generally only uses single recipients. Pros, cons, extensions? Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test No Messages
I just finished getting all the latest updates, service packs and patches on my servers last week (spent a couple days double checking and catching what auto update doesn't show). I believe they all had that patch already, but could have been bad. I have been considering putting filters on all my access servers (I'm an ISP) to kill anything in our out for the commonly exploited windows ports (135, 139, etc.) to protect my users, and the internet. My concern is, that it might break some other type of functionality for users. Ayone have any thoughts? Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of paul Sent: Wednesday, August 13, 2003 2:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test No Messages Too many people dealing with the msblast virus to complain about getting spam... :) Isn't THAT the truth sheesh. And what's even funnier, is the # of machines I've cleaned that have HAD the update sitting, waiting to be installed ARGH! What's updates ready to install mean? Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Ideas
This probably won't be your only reply, but, the netblock is 69.60.0.0/24 (256 addresses), they only have a standard Class C allocation. I have 9 of them, if you can prove to your upstream provider the need, the good ones will give them to you, or many others will let you pay a one time setup for the routing. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, August 05, 2003 1:02 PM To: JunkMail Declude Subject: [Declude.JunkMail] re: Ideas This ISP or what ever they are send us a lot of spam I would not usually block this many IP addresses but? What do you all think? Ultimate Offers LLC. NET-69-60-0-0-24 (NET-69-60-0-0-2) 69.60.0.0 - 69.60.0.2 How did they get such a large block of IP Addresses I have randomly picked address in this block and they all come up in spam databases. 69.60.0.0/20 is listed in SBL. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reverse Lookup Delegation
Scott, I have a customer who hosts their web and DNS with me and their mail on SWBell DSL. SWBell would not create a custom PTR but will delegate the reverse zone of their IP's to my name server (which is cool). The problem is I do not think they did it correctly or my NS handles it in an odd way. The customer's CIDR Block: 65.69.21.192/27 Zone in my NS: 192/27.21.69.65.in-addr.arpa (this is from the SimpleDNS Plus reverse zone wizard) Mail server: smtp.gbltx.com [65.69.201.195] If I nslookup 65.69.201.195, all is fine, if I nslookup 195.201.69.65.in-addr.arpa, it only lists NS records (mine and swbell.net's). This is my first time dealing with reverse zones for anything other than /24 CIDR blocks. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reverse Lookup Delegation
I typoed, it is 65.69.201.192/27, and my zone is 192/27.201.69.65.in-addr.arpa. And lookup of http://www.dnsstuff.com/tools/ptr.ch?ip=65.69.201.192 shows: Asking d.root-servers.net for 192.201.69.65.in-addr.arpa PTR record: d.root-servers.net says to go to FIGWORT.arin.net. (zone: 65.in-addr.arpa.) Asking FIGWORT.arin.net. for 192.201.69.65.in-addr.arpa PTR record: figwort.arin.net says to go to NS2.SWBELL.NET. (zone: 69.65.in-addr.arpa.) Asking NS2.SWBELL.NET. for 192.201.69.65.in-addr.arpa PTR record: ns2.swbell.net says to go to argo21.argohouston.com. (zone: 192.201.69.65.in-addr.arpa.) Asking argo21.argohouston.com. for 192.201.69.65.in-addr.arpa PTR record: Got unknown response (rc=0 an=0 type= err=). But http://www.dnsstuff.com/tools/ptr.ch?ip=65.69.201.195 shows: Asking b.root-servers.net for 195.201.69.65.in-addr.arpa PTR record: b.root-servers.net says to go to DILL.arin.net. (zone: 65.in-addr.arpa.) Asking DILL.arin.net. for 195.201.69.65.in-addr.arpa PTR record: dill.arin.net says to go to NS1.SWBELL.NET. (zone: 69.65.in-addr.arpa.) Asking NS1.SWBELL.NET. for 195.201.69.65.in-addr.arpa PTR record: Got CNAME referral to argo21.argohouston.com. (zone 195.192.201.69.65.in-addr.arpa.) Asking argo21.argohouston.com. for 195.192.201.69.65.in-addr.arpa. PTR record: Got unknown response (rc=0 an=0 type= err=). The CNAME response is weird to me. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, July 29, 2003 1:29 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Reverse Lookup Delegation Actually, http://www.dnsstuff.com/tools/ptr.ch?ip=65.69.21.192 shows that swbell isn't delegating authority for the reverse DNS to your servers -- it is simply reporting an answer of adsl-65-69-21-192.dsl.hstntx.swbell.net. You'll need to contact swbell.net to have them delegate authority for the reverse DNS to your servers. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reverse Lookup Delegation
Thanks, For some reason I wasn't catching that they were referring to a zone named 192.201.69.65.in-addr.arpa instead of 192/27.201.69.65.in-addr.arpa as I had it. All works now. I guess I was expecting my server to need the CIDR notation to know that it needs to find the delegating server for the rest of the range. How does that work? I don't see any notation of the range in the zone file, does it assume the largest subnet from that IP? Just curious. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, July 29, 2003 3:59 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Reverse Lookup Delegation I typoed, it is 65.69.201.192/27, and my zone is 192/27.201.69.65.in-addr.arpa. Actually, the swbell servers are just sending the request to your DNS servers, so DNS clients will look up 192.201.69.65.in-addr.arpa (without using any CNAMEs). Your DNS server is not returning any answers for that. If you add a PTR record for 192.201.69.65.in-addr.arpa, you should be all set. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fw: - Resolution of Suspected AUP Violation -(INFLOW:36688) ([SpamCop id:347295673])
I find it funny that EV1 is a major spam source for you, they are my lagrest competitor here in Houston (they are Houston based). I know they use Imail and Declude (they really should monitor these lists, maybe even try providing some input), and with a reported 300k users, they should be very conscerned about being reported as a spam source, I'm sure they expect promt action from anyone they report spammers to. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky Sent: Friday, July 25, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Fw: - Resolution of Suspected AUP Violation -(INFLOW:36688) ([SpamCop id:347295673]) - Original Message - From: Rifat Levis [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 25, 2003 5:07 PM Subject: Re: [Declude.JunkMail] Fw: - Resolution of Suspected AUP Violation -(INFLOW:36688) ([SpamCop id:347295673]) ABOUT http://www.blackholes.us As long as it is not a dynamic blocking site , it does not mean anything . Blocking big ranges of ip address , will do a lot of harm ,if the abuse address of the ISP take in consideration every abuse report, why blocking the whole ip ranges. Yes, but in my case I have a few ISPs like EV1, ATTBI (Comcast) and INFLOW (I should call them SpamFlow) that ignore reports of spam. They write me back notes about how I must have been subscribed to the mail lists or they didn't know I didn't want their customers spam. When there are abusers like the above 3 I flag them, and I could care less if some legit mail is held because I use ROUTE TO to put all held mail in a mailbox of mine. I then do a sort on subject line. I quickly remove all the obvious spam, and then I spend 5 minutes each day quickly moving through the rest of it. Everything in that folder that is clearly spam I submit to SpamCop.net because they are very good at emailing the appropriate people from headers and message body content. When I submit spam reports I have noticed EV1, ATTBI, and INFLOW being my main abusers. Since I put in weights for those just now I have seen much more spam caught rather than delivered to my users so the high weights given to these ISPs was a good thing. Speaking of your example of blocking a country... well I am giving high weights to MALAYSIA, KOREA, and CHINA. Again... if 1000 messages are caught as spam an I have 10 false positives it's still good to give them high weights because those 10 FPs I will catch in my ROUTETO mailbox and deliver. And when I do that I will look and see if there wasn't a way to give positive points to those FPs so they would make it through the next time. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Truth in advertising.
I just had to share the following. Look at the name given for the sender. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: Annoying!! [mailto:[EMAIL PROTECTED] Sent: Friday, July 04, 2003 1:11 AM To: [EMAIL PROTECTED] Subject: PopUps - BeGone!! **Subscriber details for DailyMailSaver are at the bottom of this message.** Do you hate those annoying, unwanted pop-up ads? Sure you do!! Everyone does!! Get rid of pop-up ads with the Pop-Up Defender Software!! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Strange logging
When I wrote the stats grapher app, I ran across the same problem at all log levels (I generally run MID). When I mentioned it on the list, some otheres who wrote log analyzers had noticed the same thing. I'm sure it has to do with the volume of mail received, since more mail means more declude processes running and increased likelyhood of two or more trying to write to the logs at the same time. Does anyone know if Virus has the same issue? Scott, ever thought about sending writes to the console app and using it as a buffer to prevent overlaps? Of course then there's the issue of resetting Hijack by killing deccon.exe, so you would have to look at some way of sending a reset signal to Hijack counts instead. Just a thought for the very long suggestion database. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, July 02, 2003 7:58 PM To: JunkMail Declude Subject: [Declude.JunkMail] re: Strange logging Note some of the log lines in the attached log snip are merged together I caught this when my log analyser told me that I have a test called SPAM07/02/2003 LOGLEVELHIGH Declude version 1.70i14 Look at the time slice if 09:24:32 - 09:24:33 it looks like 6 processes were trying to write to the log at the same time. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] re: Strange logging
I love email, I received your reply about an hour and a half before I received my post, and the headers show the delay was in delivery to my mail server from declude.com, yet I received 4 other posts between. Don't worry about finding what happened, I'm sure it is temporary errors (my server busy) combined with 30 queue times. Just making an observation. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, July 03, 2003 9:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] re: Strange logging Does anyone know if Virus has the same issue? Yes, it should. Scott, ever thought about sending writes to the console app and using it as a buffer to prevent overlaps? That still might not work (although probably would) -- if the OS can mangle writes from two separate processes, it could also mangle two consecutive writes from the same process. The amount of testing that would be required would be quite high (since it isn't an easily reproducible situation). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Question about DNSStuff.com Spam DB lookup
Scott, I had someone point out that two addresses in my range (209.144.1.100, 209.144.1.14) are listed in ORDB, I went to DNSStuff.com and the lookup tool said they were not, bud a direct query of ORDB shows them. I know the l;istings are old, from 2001, and neither IP is in use for mail, so I resubmitted. How could I get two different results? Are you looking for a different response on the site (they respond 127.0.0.2)? Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Console and Hijack question
I thought Win2003 was supposed to have added console access to Terminal Services (I have some recollection that you are running 2003, could be wrong though)? If you are not running 2003, just install VNC for the occasions you need console access. That's what I had to do. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, June 25, 2003 6:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Console and Hijack question If the console is not being used at all, how does Hijack keep track of IP addresses? It does not. Without the Declude console running, Declude Hijack will not work. However, if the \IMail\Deccon.exe file exists, then it will automatically get started by Declude Hijack as needed. Thanks. Along that same line then, as has been discussed before, any thought to changing deccon.exe so as to be able to access from other than the console, and other than the lengthy work around we discussed last year but that I have not had the time to try yet? Not high priority. (Unless of course an IP gets listed ala hold 2 and the server has to be restarted.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Console and Hijack question
I don't know what they did, and it is running as a service, but, SimpleDNS Plus by jhsoftware.com had a similar issue with the need for console access, however they found a way around it in their beta version (not publicly released thought). I may have to poke at it a bit to see if I can figure it out. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, June 25, 2003 7:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Console and Hijack question Along that same line then, as has been discussed before, any thought to changing deccon.exe so as to be able to access from other than the console, and other than the lengthy work around we discussed last year but that I have not had the time to try yet? The problem is that it must run when the system is first started, but it seems that Terminal Services doesn't have any way to let you access the default window. There may be a way to get around this in Declude, but we haven't stumbled across anything yet. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Console and Hijack question
You don't have to leave it logged on, you can log in and out remotely with VNC, you can even lock out the local inputs while in remote mode. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, June 26, 2003 10:33 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Console and Hijack question I thought Win2003 was supposed to have added console access to Terminal Services (I have some recollection that you are running 2003, could be wrong though)? If you are not running 2003, just install VNC for the occasions you need console access. That's what I had to do. I was using Windows Server 2003 on one server, but that server is no longer in use. Do to business startup and move, I have not had time to do the testing with it on Windows Server 2003 in a lab. I will not leave any production server logged on. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS
Would you mind sharing your two lists? I would like to be more aggressive with SPAMDOMAINS, but I know the FP potential. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, June 25, 2003 4:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPAMDOMAINS Yesterday I posted that ameritech.net was coming from a yahoo mail server. Today this one os coming from adelphia.net... as a result I have removed amertiech.net from the sd.txt file. Is this not only because there is some user with an ameritech.net address using the adelphia smtp-server? Yesterday I've divided my sd file in two files and defined 2 tests: SPAMDOMAINS_HIGH and SPAMDOMAINS_LOW From now on I move all domains that has had false positives on HIGH to the LOW file. I give 70% of our hold value to the high test and 35% of our hold value to the low test. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sheldon Koehler Sent: Wednesday, June 25, 2003 8:46 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SPAMDOMAINS Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A6C982F01F6; Wed, 25 Jun 2003 11:15:37 -0700 Received: from mta8.adelphia.net (mta8.adelphia.net [64.8.50.196]) by Hyperion.tenforward.com (Postfix) with ESMTP id 02D803ADD5 for [EMAIL PROTECTED]; Wed, 25 Jun 2003 11:15:35 -0700 (PDT) Received: from nick0hp8iie4j8 ([68.70.184.73]) by mta8.adelphia.net (InterMail vM.5.01.05.32 201-253-122-126-132-20030307) with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Wed, 25 Jun 2003 14:15:33 -0400 From: PCP Unlimited Sales Team [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: RE: Undeliverable Mail Date: Wed, 25 Jun 2003 14:14:59 -0400 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600. Importance: Normal In-Reply-To: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [64.8.50.196] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from mta8.adelphia.net ([64.8.50.196]). X-Spam-Prob: 0.05 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 319669515 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How Did DJM Pro Arrive At This Weight?
They are all applied. The trick is, so far there are very few, and only recently used, negative if pass tests. It might not be hard for Declude to add a %TESTPASSED% variable, but if you use a lot of tests, this will be a very long list, especially for good email. It has been suggested for them to add a mechanism to say report these test if passed to some variable, but it may be fairly complex to add compared to the level of use. i.e. I know I use IPNOTINMX and NOLEGITCONTENT and that both are pass tests with a weight of -3, so if they are not in tests failed list I subtract 3 for each one, I know at a glance. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, June 20, 2003 11:01 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How Did DJM Pro Arrive At This Weight? Hi, Scott, We are using DJM Pro. I have a message that was held by DJM and I'm not clear on why it was held. According to the headers the weight exceeded the current hold weight for the domain but I can't figure out how DJM added up the tests that it failed to come up with that weight. The best way to troubleshoot weights is to use LOGLEVEL MID in the \IMail\Declude\global.cfg file. This will add a line to the log file that shows how Declude JunkMail came up with the weight (except that it does not include weights from lines within filters; that should be changed soon). The current log level in \imail\declude\global.cfg file is set to HIGH. I'm assuming HIGH has the same stuff has MID (and more). How do I locate the relevant lines in the log file? Is there some of identifier in the original e-mail headers that I can use? If add up all of the weights... OSSOFT + EASYNET-DNSBL + SBL + ROUTING + WEIGHT05 + WEIGHT07 + WEIGHT09 + WEIGHT10 + WEIGHT13 + FILTER-MAILFROM I get... 5 + 7 + 5 + 4 + 0 + 0 + 0 + 0 + 0 + (-5) = 16 ... but the number in brackets at the end of the X-Spam-Tests-Failed: is 13. I can't figure out where it's coming up with the number 13. It's probably because you have a test with a negative weight -- one that the E-mail did *not* fail, so a weight was subtracted from the total weight of the E-mail. The IPNOTINMX and NOLEGITCONTENT tests are two tests that work this way. It just so happens that IPNOTINMX is enabled in my global.cfg... - IPNOTINMX ipnotinmx x x 0 -3 - So, because of the nature of IPNOTINMX then if a message does NOT fail the IPNOTINMX then -3 points are added on to its weight? If so, then that explains the weight being 3 points lower. One thing that's of consternation to me here is that a test that's being applied to the message, i.e. IPNOTINMX, is not being represented in the headers of the message. Is there any way that DJM Pro can be configured to display not just X-Spam-Tests-Failed: but X-Spam-Tests-Applied:? Thanks for your always prompt feedback! Dan This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Logging optimization question
Speaking of logging, would it be possible to add using a syslog daemon as an option, I don't know off hand if it will save any processing power, but it seems like it might since you will no longer have to manage log file resources (locking, checking creation, destination folder). It would certainly allow for more file IO savings by moving to a remote machine. Plus, syslog daemons should already have the extra code to prevent the garbage log lines Declude occasionally gets under heavy loads (multiple partial entries on one line). Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Sunday, June 08, 2003 8:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Logging optimization question Scott, since we have been discussing optimization techniques on this list lately, I am wondering if in that effort you can do some logging optimization, as well. See the attached JM log snippet and you will notice that a single e-mail with 4 recipients gets written to the log 4 time, with each seceding From/To entry adding one additional recipient e-mail address: This is one we've been meaning to get to for a while, we were just waiting for people to mention it. :) We're concentrating on getting a new released version out, and then plan to tackle this. Any reason this cannot (or should not) be reduced to just a single e-mail entry with the From/To line showing all recipients? The original purpose for the multiple lines was for cases where different recipients had different settings (which accounts for the multiple Message OK and Message failed lines). However, what we may do is change this so that one line will appear for each test that fails (which allows the reason for failure to be included), but then for each recipient, have a single line that shows each test name and the action taken. That should help condense the log file quite a bit. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Queue size quota\alert
I built a simple VBScript for alerting if mail gets held in the Hijack hold folders, it wouldn't take much to make it alert if number of Q files in Overflow exceeds a threshhold or if any files exist at all. It is available at http://spamreview.argolink.net/software, called the Hijack Held Notifier. It shouldn't require any aditional software to run, just a little editing of variables, I could even help if you need it. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Marchette Sent: Thursday, June 05, 2003 1:32 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Queue size quota\alert One of the nice features of Declude is the overflow queue which helps Imail 7.x to not trip on itself as frequently. From my testing, the only time the overflow queue gets activity is when either a dictionary attack, mail loop, dns issue or spam flood is occurring(because the number of processes hits a threshold, I'm guessing). So, this has become a great way to gauge when an Imail server is having overload issues. I'm looking for a very easy, efficient way to monitor the size of the overflow directory(on NT4) and then take an action, like sending an alert, if the file grows an x amount over an x time period. I have found a few shareware proggies that can do this but before I commence testing, I figured I'd ask the experts. Has anyone fiddled with this concept yet? If so would you care to share your experience\suggestion? Dave --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: The Titian Key Product to Remove Spam.. patent pending?
If you read the article they link to, it is a combination of challenge response and virtual addresses, complete with the problems of not one, but both anti-spam systems. They did do some interesting things, but still seems like more work to deal with than most users will tolerate over the long haul. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Holt Sent: Friday, June 06, 2003 10:57 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: The Titian Key Product to Remove Spam.. patent pending? But wait, there's more!!! If you order today, we will include absolutely free.the amazing Ginzu SPAM knife. It never needs sharpening and can slice the fat off your SPAM messages just as easy as that! It slices.it dices.it even makes julienne fries!! Blah, blah, blah Ginger. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Eddie Pang Sent: Friday, June 06, 2003 3:09 AM To: Declude. [EMAIL PROTECTED] com Subject: [Declude.JunkMail] OT: The Titian Key Product to Remove Spam.. patent pending? FWIW.. Looks like a variation of a mail gateway at a cost of $1000.00 per month! http://www.titankey.com/features.asp eddie :)
RE: [Declude.JunkMail] New Variable Question ?
I use weightrange to define 6 distinct levels of spam (the last one actually is just weight so anything over is caught). Then all I do is add a header X-SPAM-Level: TESTNAME. End result is what you are asking for, just use stars instead of TESTNAME. Global.cfg SPAM-NONE weightrange x x 0 4 SPAM-VLOW weightrange x x 5 9 SPAM-LOWweightrange x x 10 14 SPAM-MIDweightrange x x 15 19 SPAM-HIGH weightrange x x 20 29 SPAM-VHIGH weight x x 30 0 $default$.junkmail SPAM-NONE WARN X-SPAM-Level: %TESTNAME% SPAM-VLOW WARN X-SPAM-Level: %TESTNAME% SPAM-LOWWARN X-SPAM-Level: %TESTNAME% SPAM-MIDWARN X-SPAM-Level: %TESTNAME% SPAM-HIGH WARN X-SPAM-Level: %TESTNAME% SPAM-VHIGH WARN X-SPAM-Level: %TESTNAME% Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, May 30, 2003 11:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New Variable Question ? Scott, Would it be possible to have a variable like the %weight% variable say %weight*% that would convert the weight into a series of stars based on a set division number with the division number possibly held in the global.cfg file. This way only one x-header can be used rather than a series of x-headers showing up if with different x-headers for each weight level. Using the weight alone is difficult because of all the combinations that can develop (3 30 33) all look the same it trying to filter on x-header contains xx 3. Using a division number of say 5 this could be represented as xxand xx ** or xx *** (depending on rounding factor) and be represented with 1 x-header instead of several depending on the weight levels defined. Stu - CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Summer hours - Monday thru Saturday 8am - 12pm (June - July - August) CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] observation to share...
Scott, Have you thought about using Declude Console as a short term dns cache for Declude? I think the results Kami is seeing is because Ipswitch included a DNS cache in the new Queue Manager, and their ip4r test may be using it instead of the DNS. Declude could definitely benefit from it since spammers usually send in bursts and from the same server, so all messages from that host will have the same results. Right now Declude requeries the DNS for each separate message, even if they are received simultaneously, am I correct? Just a thought. Kami, are you running the DNS cache in Imail 8? Could you test the performance difference without it? I know I saw a post on the Imail list about someone having to disable it to get rid of certain problems they were having, so if the cache is the boost, they won't benefit. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Wednesday, May 28, 2003 5:24 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] observation to share... Scott: Thank you for your response. Since we started doing this (almost a week) I have noticed several real-life behavior from our server. What we used to see: - When a list was hitting our server I was seeing many Declude.exe processes at the same time - one after another taking 100% of CPU and disappearing. As stated a while back, in one case, the server was almost down for 2-3 hours. By down I mean it could not do anything else but process what was being sent to it. We could not check email, outlook was timing out, and web messaging would return error. Once the processing ended the server was back to normal. Of course part of the problem is the way we do things (isn't it always?). We have a lot of filter files and were checking a lot of ip4r tests. Actions we took: - we commented a lot of ip4r tests in Declude and that helped a lot with times when a lot of email was hitting the server at the same time (lists) but still we were getting time outs in Outlook and web messaging was very slow when the emails were arriving. In essence we stopped using so much of the ip4r tests and only used about 8 or so, rather than all that was listed in the Declude site. - with IMail 8 I thought of moving all the ip4r tests to IMail so I can test a few things. Now the results are interesting. We no longer have that problem. The Outlook does not time out and looking at the Declude processes they appear and disappear fast and even if they hit 100% CPU it is for a very short time. We have not changed our filter files and actually have added two more. So the processing for Declude has not changed at all but it is not doing any ip4r tests. We now simply do all the ip4r tests in IMail, add the header and have a X-Header filter file. After reviewing the log files we will eventually get rid of some of the ip4r tests that we find are not effective but for now we are looking at majority of what you have listed in the Declude site. The header weights ranges from 1 - 8. Myth? Fact? Or just my imagination... May be our mail ends up in our backup mail server while IMail is busy checking ip4r's and since all email is not arriving at the same time Declude can manage it without assuming control of the server for a long time. So in essence we are managing delivery of email in a pipeline .. Of course the users may not mind waiting a minute before the mail arrives but they get frustrated when their mail client times out. Our problem is solved for now. - IMail do ip4r tests - Declude do the filters This was just a report from the field... Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Interesting article on SPAM
Here is an interesting article on spam from the legitimate marketer's perspective. http://sanjose.bizjournals.com/sanjose/stories/2003/03/31/story4.html Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Custom Filter file Log question
My only thought is, by some weird chance a spammer is using a real return adress (I know that is truly funny), they would be able troubleshoot the fails by sending to an invalid email address or a known full mailbox and simply read the headers in the standard bounce message. But I think this is a pretty long shot and more work than a spammer is willing to do, plenty of unprotected servers out there. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, April 01, 2003 4:14 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Custom Filter file Log question Now adding the phrase to the mid level in conjunction or in place of the line number might work even if the phrase was limited to the first 10-15 characters. The line number would give the approx location and the first part of the phrase could narrow it down further. I think that would work. I think the best option would be to add the phrase to the warning message, which will normally appear in the logs, as well as the X-RBL-Warning: header if the WARN action is used. However, I'd like to hear if anyone may have a problem with having the phrase appear in an X-RBL-Warning: header. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Reference documents needed
The online docs and the mailing list archives tends to be a very good reference, however since the program is so flexible, even Scott doesn't know it's full potential. There are often threads where people have managed to come up with some new and unforseen way of using Declude. Now, that being said, maybe a nice How-To site where users can post their little tricks and tips would be very helpful. Generally speaking, the only things not listed in the online manual are beta features, and they are listed in the revision history and very well discussed in the archives. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, March 26, 2003 11:13 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Reference documents needed Hello, All, This sounds very similiar to the request that I made when I first started using Declude.JunkMail. Unfortunately I don't think these documents exist. But I could be wrong. Once our management agrees to buy JunkMail Pro for us I plan on writing up something along these lines. If I had one complaint about Declude JunkMail that would probably be the only one. The program itself is awesome. Scott's technical support is outstanding. But the current documentation seems too conversational in tone. Now that tone is a good way for some people to learn. But some people (like Adrian, Joseph, myself and others, I'm guessing) need documentation which reads as more of a reference guide. I can't think of any other way to describe it. (Un)fortunately I've made it past the hump in the learning curve where something like this seems absolutely necessary but I still could many situations where it would be beneficial. Dan - Original Message - From: Joseph Acac [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 11:27 AM Subject: Re: [Declude.JunkMail] Reference documents needed I second that. At 08:15 03.26.2003, you wrote: Hi Scott, I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on this list on a daily basis. Excellent discussions and I have already learned a lot. In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? Thanks in advance, PS: If Declude doesn't have such documents, then maybe one of the list subscribers have compiled them. Any help would be much appreciated. -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. This E-mail is scanned and free from viruses. www.nexustechgroup.com This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
RE: [Declude.JunkMail] Habeas headers
This should not be an issue since Habeas headers implies they are adhereing to the strict rules put forth by Habeas, and had to pay for the right to use them, if they are in violation, report them to Habeas, who will take legal action against topica.com for violating the agreement. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Helpdesk Sent: Tuesday, March 25, 2003 8:37 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Habeas headers If anyone is using the Habeas headers whitelist option you should be aware that topica.com is sending their messages with habeas headers. We have them blacklisted but since the whitelisting overrides everything, their messages were getting through. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spaced Out
Sounds like this test might be a good negative weight test like IPNOTINMX. Of course if they use a good mailfrom it could reduce the positive. Any thoughts? Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, March 20, 2003 5:59 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spaced Out Its a much more sensitive (strict) version of MAILFROM. Weighted less than MAILFROM, it sees things that otherwise get through. I forget what it is, so Scott would have to explain what that actually is. The standard MAILFROM test will check to see if the domain on the return address has either an MX or A record in DNS. So if an E-mail fails the MAILFROM test, the return address can't receive mail. The strict version (defined with the mailfromstrict test type) only checks for the MX record. Although a domain with an A record can receive mail (if there is a mailserver at the IP corresponding to the A record for the domain), it isn't advertising that it allows E-mail. It will have more false positives -- people seem to think there isn't a problem with having no MX record, since the RFCs do require mailservers to attempt to send to the A record if there is no MX record. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] savvis.net
I looked through those since I use Savvis as well and have been very pleased. It looks like most where DNS servers serving spamvertised domains, the first one was used to relay mail through a router in what sounds like a bad router design, but is a webmail company who may not have secured their server correctly. In short, doesn't seem like Savvis is housing spammers, they always forward complaints and expect a response promptly. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Tuesday, March 11, 2003 3:10 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] savvis.net Here are the Spam Huas savvis.net entries, all /32's: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5743 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5722 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5721 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL3485 On Tuesday, March 11, 2003 12:45, Madscientist [EMAIL PROTECTED] wrote: Hmmm... just noticed that savvis.net was in the bottom of that list. (I know it's odd replying to myself - did it to keep the thread...) I have first hand experience with their zero tollerance policy. I'd be curious to understand the source of that listing. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED] On Behalf Of Madscientist | Sent: Tuesday, March 11, 2003 3:18 PM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Good ISP? | | | Recommend switching to Savvis/Bridge. They have been our primary for | years and they are awesome. | | hth, | _M | --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Message body in Headers Problem
Has anyone else been seeing messages where the body is in the headers? I
have a n example below. Just started happening, and since declude
appends to the end, the body shows blank in Outlook.
Bad MSG
Received: from 202.88.150.30 [202.88.150.30] by argolink.net
(SMTPD32-6.06) id AE78CF100E0; Wed, 05 Mar 2003 07:41:12 -0600
From: George Absalom Adams [EMAIL PROTECTED]
To: George Absalom Adams [EMAIL PROTECTED]
Subject: 100% Natural Formula
Content-Type: text/html;
charset=windows-1251
html
head
style
!--
li.MsoNormal
{mso-style-parent:;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Times New Roman;
margin-left:0in; margin-right:0in; margin-top:0in}
table.MsoNormalTable
{mso-style-parent:;
font-size:10.0pt;
font-family:Times New Roman}
h3 { font-family: Verdana, Arial, Helvetica, sans-serif; font-size:
10pt; text-transform: uppercase}
default {font-size:11pt; font-family:serif; color:#336600;}
--
/style
/head
body bgcolor=#FF
div align=center
center
table border=1 cellspacing=0 style=border-collapse: collapse
width=75% cellpadding=0 id=AutoNumber1 bgcolor=#FF
bordercolor=#00 height=71
tr
td width=100% height=71
p align=centerbfont size=5br
/font/b
font size=6 color=#FF6699
ibIBlossoms /b/i/fontfont size=6
color=#FFb7gianeg/b/fonttable cellSpacing=0
cellPadding=0 width=674 bgColor=#ff border=0 height=1
tr
td width=674 height=1 bgcolor=#FF
p class=MsoNormalnbsp;/p
h1 style=margin-left: 4px align=centerb
font face=Arial size=5span style=color: #FF
Breast Enhancement and Enlargement NOW... /span
font color=#FF7gianee/font/font/b/h1
div align=center
table cellSpacing=0 cellPadding=0 width=568
border=1 height=49 bgcolor=#FF bordercolor=#FF
style=border-collapse: collapse
tr
td width=568 height=49
p align=centerubfont color=#FF
size=5Naturally
Enlarge You Breast Size!/font/b/ufont
color=#FF /font/td
/tr
tr
td width=568 height=1
bfont face=Arial size=4After decades of
medical research, it is now quick, easy and inexpensive
for you
to permanently achieve the bust line you've always
wanted!
Bigger, firmer breasts ithat look
natural!/i/font/bp align=center
font size=1 color=#FF6699
ibnbsp;/b/i/fontfont size=1
color=#FFb7gianez/b/font/td
/tr
/table
/div
/td
/tr
/table
p class=MsoNormal align=centerb
font size=6
a href=http://www.fc2000.org/enhance/index.php?id=9DM1;ENTER
HERE/a/fontfont size=1 /font/b
font size=1 color=#FF6699
ibnbsp;/b/i/fontfont size=1
color=#FFb7giane5/b/font/td
/tr
/table
/center
/div
pnbsp;/p
pfont color=#FF
ibnbsp;/b/ib7gianeh/b/font/p
p align=centerfont color=#FF /font/p
pnbsp;/p
pnbsp;/p
pfont color=#FFb7gianew/b/font/p
pnbsp;/p
pfont color=#FF /font/p
pnbsp;/p
pnbsp;/p
pnbsp;/p
/body
/html
X-Declude-Warning: [DSBL] This message may be SPAM.
http://dsbl.org/listing?ip=202.88.150.30 ::W5
X-Declude-Warning: [MONKEYPROXIES] This message may be SPAM. BLOCKED:
See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=202.88.150.30 ::W5
X-Declude-Warning: [WIREHUB-DNSBL] This message may be SPAM. Blacklisted
by Wirehub! Internet DNSBL - http://blackholes.wirehub.net/errors.html
::W5
X-Declude-Warning: [SPAMCOP] This message may be SPAM. Blocked - see
http://spamcop.net/bl.shtml?202.88.150.30 ::W5
X-Declude-Warning: [BADHEADERS]
http://www.declude.com/tools/header.php?code=8020002d ::W5
X-Declude-Warning: [REVDNS] This message may be SPAM. This E-mail was
sent from a MUA/MTA 202.88.150.30 with no reverse DNS entry. ::W3
X-SpecialFilters: BODYCURSE
X-Declude-Warning: [SPAMCHK] This message may be SPAM. Message failed
SPAMCHK: 2.
X-SPAM-Level: SPAM-VHIGH
X-Declude-Sender: [EMAIL PROTECTED] [202.88.150.30]
X-Declude-Spoolname: Dfe780e0.SMD
X-Note: This E-mail was scanned for SPAM by ArgoLink.net with Declude
JunkMail. More info at http://help.argolink.net/spam.asp
X-Declude-Failed: DSBL, MONKEYPROXIES, WIREHUB-DNSBL, SPAMCOP,
BADHEADERS, REVDNS, IPNOTINMX, WORDFILTER, BODYCURSE, SPAMCHK,
SPAM-VHIGH
X-Declude-Total-Weight: 32
X-UIDL: 346874786
Thanks,
Chuck Frolick
ArgoNet, Inc.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Forcing sum of weights to exact weight question...
Hey scott, ever thought about adding a special action keyword like FORCE, to force an action in the odd situation where you want to override the the severity scale? It would only need to be handled in the .junkmail files. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Sunday, March 02, 2003 12:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Forcing sum of weights to exact weight question... Here is my problem, When I have spam that fails filter1 or filter2 tests with a score of 25, the HOLD action superceeds the RouteTo action. Is it possible to state somewhere in the Golbal.cfg that: If filter1 fails, reset Total weights to 210. If filter2 fails, reset Total weights to 220. This way i do not need to make extremely wide ranges above 200 to compensate for the various sums.. Did I lose anyone yet? :) Unfortunately, there isn't any way to do that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng?
I agree as an ISP that SPAMCOP alone does not work, but as a corporate email, it might be considerably different, positive or negative. Another test you might consider is SpamChk, I just started using it and it makes a huge difference in my mail box, I do need to tune it though, it trapps my Daily Dilbert and my rules delete at the level it's pushing it to. From what I see you can make it inch spam weight up or really push it. You can find it on the Tools page at www.declude.com. BTW, Scott, I know there are other add-ons out there that are not on your tools list, if it is not your intention to maintain a comprehensive list then maybe someone else might want to put one together. It would be nice to know all the options we have. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, February 28, 2003 11:00 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng? In our experience as an ISP, this was our INITIAL reaction (based on my personal mailbox), However SPAMCOP turned into about 50% accuracy system wide, and we had to move to at least 2 RBL tests failed to hold, or SNIFFER. It would be a good idea to run the sniffer (http://www.sortmonster.com/sniffer/) trial as well. What declude is currently passing through sniffer should catch most of. -Tom -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Friday, February 28, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? In my experience SPAMCOP has been very good at weeding out SPAM and we hold/block using this test alone. We do occasionally get a false positive or two, but no more or less than any of RBL's that list known open relays. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 11:36 AM To: Declude JunkMail Subject: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng?
I see you updated it recently, I was killing myself yesterday to remember the name of Spammanager, had to search the archives. Also, could you include a link to my add-ons site http://spamreview.argolink.net/software, I have several tools there, one is the zipfile for the Hijack notifier. As I make new utils or update old ones, I will update the page. As for others that should be on there, I can't think of any off hand. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 28, 2003 12:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng? You can find it on the Tools page at www.declude.com. BTW, Scott, I know there are other add-ons out there that are not on your tools list, if it is not your intention to maintain a comprehensive list then maybe someone else might want to put one together. It would be nice to know all the options we have. It definitely is intended to be a comprehensive list -- if you know of any other programs, scripts, tools, etc. that you think should be on the page at http://www.declude.com/tools , please let me know, and I'll add it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng?
Thank you, it is a nice way to see how the filters are doing, and it keeps the data set small, all 28 of my tests take up less than a meg to store (rrd's are created at their final size). Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 28, 2003 1:09 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng? I see you updated it recently :) Also, could you include a link to my add-ons site http://spamreview.argolink.net/software, I have several tools there, one is the zipfile for the Hijack notifier. It's set up now with one link to each tool, I hope that isn't a problem (it should be easier for people to find them that way). By the way, I really like the Junkmail Statistics Grapher. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude.JunkMail Statistics
Delog is good, there is a thread about a beta log analyzer Log Analyzer - Comments Needed, sounds real promising. You might check those out. I seem to remember there being others, but can't think of them off hand. The only other one is Netcomm LogTool, but I don't think you want to spend $200 just to show quick stats for a tool you are evaluating. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 2:57 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude.JunkMail Statistics Hello, All, We've been running Declude.JunkMail in filtering (HOLD action) mode for about a week now. I think the powers that be are interested in seeing some real, concrete numbers regarding what sort of benefit Declude.JunkMail has been brining to our mail server lo these last 7 days. I am not looking for anything fancy (no graphs or anything) just something simple that can take our JunkMail logs for the last week and run some totals on how many messages were scanned, how many were id'ed as spam, etc. I found the JunkMail Statistics Grapher off of the Tools page but I was interested in looking at something a little less graphical. Are there any simple, good tools out there for producing and/or analyzing the status which a new JunkMail installation might produce? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Interesting Question
Scott, Since IPNOTINMX only has use when it passes, there is no way to add a header using WARN, and it doesn't show up in %FAILEDTESTS% (obviously), so the problem is, it adjusts the weight but unless you go to the log file, you don't know for shure it did. Is there a way to make it show up in the headers when it passes? I added it today and a message eeked through that normally would have been caught. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Interesting Question
Not when it passes, which is when it has an effect on weight. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Delbridge Sent: Tuesday, February 25, 2003 3:14 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Interesting Question Shows up in MY %FAILEDTESTS% just fine: X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [802c]. X-RBL-Warning: HELOBOGUS: Domain S1001EXM01.macromedia.com has no MX or A records. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 63.109.193.64 with no reverse DNS entry. X-Declude-Sender: [EMAIL PROTECTED] [63.109.193.64] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Weight: 20 X-Spam-Tests-Failed: BADHEADERS, HELOBOGUS, IPNOTINMX, REVDNS, WEIGHT05, WEIGHT10, WEIGHT15, WEIGHT20 Dave Charles Frolick wrote: Scott, Since IPNOTINMX only has use when it passes, there is no way to add a header using WARN, and it doesn't show up in %FAILEDTESTS% (obviously), so the problem is, it adjusts the weight but unless you go to the log file, you don't know for shure it did. Is there a way to make it show up in the headers when it passes? I added it today and a message eeked through that normally would have been caught. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- David M. Delbridge President CEO Circa 3000 ColdFusion Hosting http://www.circa3k.com 775-832-2445 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High Resource Usage
It's not Declude and Imail that's the problem, it's the extreme number of postmaster messages balling up in your spool that will never be delivered. At least that has been my experience, I'm in the same boat (small isp ~6,000 accounts but 60k - 80k messages per day). I wrote a utility to help control this problem, you can download it at http://spamreview.argolink.net/software, it's called Imail bounce control. My server (p4 1.8GHz, 512MB RAM), went from 5k-6k messages in queue to 400-500. I am fairly aggressive at killing the messages though. Imagine your server is retrying 500 bounce messages every 30 minutes until max tries is reached, now remember you get 500 more to try every 30 minutes, even with only 6 tries that is 3,000 messages to try every 30 minutes. i.e. 3,000 SMTP sessions that should have never been. The program kill messages by 2 conditions, max attempts, and header match. Max tries is self explanatory, header match looks for a perl regular expression at the beginning of each header line of the original message (always included in Imail postmaster messages). Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin S. Dome Sent: Wednesday, February 19, 2003 3:40 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] High Resource Usage I am looking for suggestions to reduce the amount of resources that Imail/Declude use. We are a small ISP and now and then we get hit hard by a spammer mass mailing our users ( which equal ~20,000 ) and we get hit our mail server all but shuts down due to the mass amount of incoming mail and Declude scanning each individual email, etc. Our mail server is a 2u Dell server with 2 pentium 1.13 gHz CPUs and 1 gb of ram. Kevin S. Dome Stic.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] f-prot
Ok, I do not see F-prot on the F-secure site at all, and F-secure antivirus is $80 for personal edition, $424 for the server edition, and I so not see mention of 20 user license. Thanks, Chuck Frolick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 18, 2003 8:36 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] f-prot Hate to sounds like the idiot butcould someone answer a couple questions on F-prot It anti-virus? Does in run at the server level? Does it run at the client level also, or only at client level? It is an anti-virus program that a lot of people use with Declude Virus, as it is reliable and very inexpensive. F-Prot can run both on servers and client machines (as opposed to many other AV programs that are set up not to install on servers). It comes with a minimum of 20 licenses, so a lot of people buy it to use with Declude Virus, but then use the extra licenses on workstations. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] f-prot
Thanks all, my yahoo searches kept turning up to f-secure's site. Thanks, Chuck Frolick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Markus Gufler Sent: Tuesday, February 18, 2003 9:40 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] f-prot As I know there exists some licensing/reseling/developing contracts between frisk (f-prot.com) and f-secure. Probably this is also the cause of the short delay on virus updates compared to other AV engines. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Charles Frolick Sent: Tuesday, February 18, 2003 4:17 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] f-prot Ok, I do not see F-prot on the F-secure site at all, and F-secure antivirus is $80 for personal edition, $424 for the server edition, and I so not see mention of 20 user license. Thanks, Chuck Frolick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 18, 2003 8:36 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] f-prot Hate to sounds like the idiot butcould someone answer a couple questions on F-prot It anti-virus? Does in run at the server level? Does it run at the client level also, or only at client level? It is an anti-virus program that a lot of people use with Declude Virus, as it is reliable and very inexpensive. F-Prot can run both on servers and client machines (as opposed to many other AV programs that are set up not to install on servers). It comes with a minimum of 20 licenses, so a lot of people buy it to use with Declude Virus, but then use the extra licenses on workstations. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Making My Own Tests
He could also use WEIGHT02 weightmatch x x 2 0 Since weightmatch matches exactly that weight. I will recommend using little bit bigger catch boxes though. I think you will get a very good picture by having ranges set up along these lines: WEIGHT00-04 weightrange x x 0 4 WEIGHT05-09 weightrange x x 5 9 WEIGHT10-14 weightrange x x 10 14 WEIGHT15-19 weightrange x x 15 19 WEIGHT20-24 weightrange x x 20 24 WEIGHT25 weight x x 25 0 As long as you still have a line similar to XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] In your global.cfg file you should still be able to see the true weight. Then if you see one range with false positives, you can expand it for more detail. From using the system and reading posts on this list, it appears most admins adjust the weight of the failed test and leave the weight based actions constant, the range could just as easily be between 0 and 200 as 0 and 20, it is all in the value of failed tests. I personally have it between 0 and 30 (some filter test can actually have values in the hundreds). Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 18, 2003 11:59 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Making My Own Tests To that end I have created 25 tests... WEIGHT01 WEIGHT02 ... WEIGHT24 WEIGHT25 which are defined just like WEIGHT10 and WEIGHT20. One catch here is that an E-mail with a total weight of 25 will fail all 25 tests (if they are set up like the WEIGHT10 and WEIGHT20 tests). It might be better to define the tests as: WEIGHT01 weightrange x x 1 1 WEIGHT02 weightrange x x 2 2 This way, an E-mail with a weight of 2 would fail just the WEIGHT02 test, and would not fail the WEIGHT01 test. First of all, will what I outline with my new WEIGHT definitions even work? I've never created my own test before so I don't know if I am doing it right. Yes, it will work the way that you suggest (although depending on your needs, the weightrange way may be better). Secondly, will testing for all of these weights but undue overhead on the processing of e-mail? No. You shouldn't notice the extra load. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New Util
I have made available a new util for all to use. It produces MRTG like graphs of failed Junkmail tests as well as the message count. I have also created a web page for all of my utils to be downloaded. http://spamreview.argolink.net/software/. If you want to see the graphs it can make go to http://mail.argolink.net:2180/spamstats. I also updated an old util to clean out excessive bounce messages, it has been rewritten in Perl and had some functionality added. Comments and suggestions are always welcome. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Util
I forgot to mention that the stats grapher works from log level LOW on up, although I did not test DEBUG, I do not forsee an issue. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Charles Frolick Sent: Friday, February 07, 2003 1:42 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New Util I have made available a new util for all to use. It produces MRTG like graphs of failed Junkmail tests as well as the message count. I have also created a web page for all of my utils to be downloaded. http://spamreview.argolink.net/software/. If you want to see the graphs it can make go to http://mail.argolink.net:2180/spamstats. I also updated an old util to clean out excessive bounce messages, it has been rewritten in Perl and had some functionality added. Comments and suggestions are always welcome. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Log Question
Has anyone else noticed bad log lines in the JM log? I will get a short spurt of partial log entries, usually without a newline to separate them, occasionally just the end of an entry on a line by itself. Never seems to last more than a minute. It can really mess with log analysis. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack Enhancement
Scott, How about a small executable that talks to console the same way Declude.exe does to send a release signal? Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, February 03, 2003 10:03 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Hijack Enhancement It would be nice if there was a way to reset a held IP remotely to allow it through. That is a good idea. However, if your remote access program can't access the Declude Hijack console, it's going to be hard to come up with a way to reset the IPs. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?
One problem with held or bounced mail that notifies the intended recipient that it was blocked, is, you did not elimiate the spam, only change it's contents to hundreds of notifications of unwanted mail. This will get very old, very fast, and lead to the blacklists you are trying to avoid. Intelligent spam filters, combined with reasonably reliable black lists and weighting are much more customizable, and can be set up to allow customers to choose what to hold, what to delete, and what to deliver. Several members of this list have created such apps using various methods. Before I set mine up I would receive between 50 and 100 spams a day, all where caught by Declude, but had low weights (as an ISP I have to be somewhat cosevative in my weighting). After setting up a system that lets the individuals decide, I used very aggressive setting and now only get 5-10 a day tops, many days I get none. I never miss any wanted email, I have an allowed senders list and a blocked senders list, and since it uses Imail rules, I can override the hold and delete settings for the rare occasion, such as the poorly built mailer on my statistics program, that always fails BADHEADERS and SPAMHEADERS, and I cant't allow the sender because that's one of the broken headers. Sorry to ramble, just felt I needed to put my two cents in. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Thursday, January 16, 2003 3:24 PM To: R. Scott Perry Subject: Re[2]: [Declude.JunkMail] WhiteList Per User or Domain? Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 3:13:03 PM Thanks. But a catchall is exactly what I don't want. What I want is a bounce so the sender knows his mail was not accepted... maybe a catchall if cannot deliver to sender... There are whitelist email providers showing up and usually the sender gets sent a message that his mail was not delivered. Usually there is a process to inform the destination user if he wants to add the sender to his or her whitelist. Maybe this is not feasible with Declude, but it would be most certainly nice to have. The lead ZDNet editor David Berlind and I have a dialog going and he is really down on blacklists and more or less endorsing the whitelist concept. So I am shooting for a way to manage this in Declude. I was thinking I could put high weights on all other emails with a bounce by default but give a white list negative counter-weights to let those through. Not sure his would work? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Is it possible to make a Declude domain or user setting that enables a whitelist of email sender addresses in the Pro version whereby all emails are rejected or bounced accept a whitelist of senders? In other words reject or bounce all senders accept those that the user wishes to communicate with. Could this be done with weights...sending an eml to bounced mails? This way the Global.Cfg would not be used with its limitations. R This isn't currently possible as a designed feature, but you should be able R to accomplish it with the next release. To do so, you would set up a R per-domain or per-user configuration of CATCHALLMAILS HOLD or something R similar, and then have a whitelist file for that user with all the R addresses that should be accepted. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
That makes sense, a mixture of the two. In that case you would not want to use CATCHALLMAILS, but use the border line weights to notify, and let the customer decide to allow. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Friday, January 17, 2003 10:51 AM To: Charles Frolick Subject: Re[4]: [Declude.JunkMail] WhiteList Per User or Domain? Reply to: Charles Frolick Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 9:35:39 AM We already capture most spam and virus using weights in Declude, so the user would only be hit with border line emails. I see this as an ideal scenario for those that would want such a feature. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Junkmail and Imail 6.05
This is not an uncommon problem. From what I know, Imail 7.x still has it. In my research, I have not found a tool to clear just one folder in a mailbox based on date, but I did develop an application to manage spam using a combination of weighting, Imail rules, and an external server software to move the contents of the spam folder to another location that could be managed from a web app and delete mail based on age. You can find the app and information about it at http://spamreview.argolink.net/doc. If you have questions let me know. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dustin Freeman Sent: Tuesday, January 14, 2003 11:02 AM To: '[EMAIL PROTECTED]' Subject: [Declude.JunkMail] Junkmail and Imail 6.05 Hey all, I have a thread going on this on the Imail list but I thought I'd check with other Declude-Junkmail users also. We have Declude Junkmail set to flag messages on a weighting system and then we have an Imail rule set to move those flagged messages to a Junkmail folder. What our dilemma has been is that 1) the users didn't read our notification or forget to check their box through the web interface to clean out the junkmail. 2) They don't like the extra step to remove their junkmail through the web interface. So what we are trying to do is to still manage the tons of junkmail but not to burden the end user with extra work. So what happens is the Junkmail folders inevitably fill up their 5mb of space on the server then their mail starts bouncing. They call in and we see that the box is maxed out. So what I am trying to do is to clean out the junkmail folders for all the users to only keep the past 7 days in there (maybe less) So I need to remove messages by date out of the junkmail.mbx files for all the users daily. I have found where we can remove messages by date but it does it for the whole mailbox...all the folders, that won't work for those who are using the web interface as it would clean saved email. Is any one here using a similar solution that could explain how they do it. Or if there is a better way to handle it I'm all ears! Thanks as always Dustin --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] External test question
Scott, If an external test was the last one defined would the following work? MYTEST external nonzero c:\mytest.exe %TESTSFAILED% 0 0 The reason is, I'm thinking about creating an app to plot the hit rate for my tests, but I want to make it a data gatherer rather than a log analyzer (spreads out the processor load, and easier to view changes throughout the day). Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weird issue with an alias.
I have an alias for [EMAIL PROTECTED] that points to several addresses. For some reason the first address never recieves the email, there are no imail rules set up either globally or for the address and the ldeliver line says it is delivered to NUL. The only other odd thing is for some reason in the Declude logs it does not have the weight summary line at log level MID, all other messages around it do. I'm running Imail 6.06. Here is a log snipet: Imail 20021223 215700 127.0.0.1 SMTP (4464) processing D:\spool\Qdb0b1de.SMD 20021223 215700 127.0.0.1 SMTP (4464) ldeliver argolink.net bryan-main (1) [EMAIL PROTECTED] 2626 20021223 215700 127.0.0.1 SMTP (4464) ldeliver argolink.net cmfrolick-main (1) [EMAIL PROTECTED] 2626 20021223 215700 127.0.0.1 SMTP (4464) ldeliver argolink.net mballesteros-main (1) [EMAIL PROTECTED] 2626 20021223 215700 127.0.0.1 SMTP (4464) ldeliver argolink.net szavodny-NUL (1) [EMAIL PROTECTED] 0 20021223 215700 127.0.0.1 SMTP (4464) ldeliver argolink.net ximealfaro-main (1) [EMAIL PROTECTED] 2626 20021223 215700 127.0.0.1 SMTP (4464) finished D:\spool\Qdb0b1de.SMD status=1 Declude 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SUBJCURSE (Message failed SUBJCURSE test (4)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed BODYCURSE (Message failed BODYCURSE test (5)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SPAM-NONE (Total weight between 0 and 4.). 12/23/2002 21:57:00 Qdb0b1de 004720 Subject: Re: Need news server password 12/23/2002 21:57:00 Qdb0b1de 004720 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SUBJCURSE (Message failed SUBJCURSE test (4)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed BODYCURSE (Message failed BODYCURSE test (5)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SPAM-NONE (Total weight between 0 and 4.). 12/23/2002 21:57:00 Qdb0b1de 004720 Subject: Re: Need news server password 12/23/2002 21:57:00 Qdb0b1de 004720 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SUBJCURSE (Message failed SUBJCURSE test (4)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed BODYCURSE (Message failed BODYCURSE test (5)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SPAM-NONE (Total weight between 0 and 4.). 12/23/2002 21:57:00 Qdb0b1de 004720 Subject: Re: Need news server password 12/23/2002 21:57:00 Qdb0b1de 004720 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SUBJCURSE (Message failed SUBJCURSE test (4)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed BODYCURSE (Message failed BODYCURSE test (5)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SPAM-NONE (Total weight between 0 and 4.). 12/23/2002 21:57:00 Qdb0b1de 004720 Subject: Re: Need news server password 12/23/2002 21:57:00 Qdb0b1de 004720 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SUBJCURSE (Message failed SUBJCURSE test (4)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed BODYCURSE (Message failed BODYCURSE test (5)). 12/23/2002 21:57:00 Qdb0b1de 004720 Msg failed SPAM-NONE (Total weight between 0 and 4.). 12/23/2002 21:57:00 Qdb0b1de 004720 Subject: Re: Need news server password 12/23/2002 21:57:00 Qdb0b1de 004720 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Log Levels
Scott, Would it be possible to get a little more info on what is logged at the different levels, ERROR, WARNING, and DEBUG are pretty self explanatory, and probably rarely used, but I'm unclear on the differences between LOW, MID, and HIGH. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Levels
I was really looking for even a basic list of additional lines, but that's ok, I'll just capture logs at the different levels and figure it out the old fashioned way. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, December 23, 2002 11:39 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Log Levels Would it be possible to get a little more info on what is logged at the different levels, ERROR, WARNING, and DEBUG are pretty self explanatory, and probably rarely used, but I'm unclear on the differences between LOW, MID, and HIGH. ERROR, WARNING, and DEBUG are normally not used except in certain situations. LOW is the standard logging level, designed to record important information to the log file, while trying not to be too excessive. This is the default setting. The MID and HIGH logging levels are used to record extra information in the log files. We don't have a list of specifically what each will add to the logs, but typically you would use LOGLEVEL LOW unless there was specific information that you needed at the MID or HIGH settings. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] REDIRECT in $default$.junkmail
Scott, Is the REDIRECT statement processes per domain as well or only on the global $default$.junkmail file? I have redirects for several addresses in our primary domain, but I need to have a different set of actions for all of our hosting accounts, so I have per domain set up for our primary and want to be sure where the REDIRECT statements will come from. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] relays.osiriusoft.com
If you get the right software Win32 DNS doesn't need a lot of machine either. I run win2k on a dual p150 and a ppro200. Both machines only have 128MB RAM, I run Simple DNS Plus by jhsoft.com, no problems, that's with running a small ISP and hosting over 200 domains in DNS. Plus the software is very affordable, $79 for 25 zones, $149 for unlimited. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tony Gray - Network Administrator Sent: Thursday, December 19, 2002 11:01 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] relays.osiriusoft.com My only option to minimize hits on an external server will be direct resolution which slows down some other sites, or being able to become a secondary for relays.osirusoft.com. Your own server should NOT be noticably slower unless it is not configured correctly. Without a forwarder to use, lookups could be slightly slower at first, but once you use it a bit, it will build a decent lookup cache of it's own, then it should be faster than using any external site or forwarder. From Scott's site, it appears that the osirusoft.com sites have a TTL of 43200, so once you do a lookup, all subsequent lookups for that same IP should be served from your local cache (at least for the next 43200 seconds). If you are stuck on win32 platform, you'll need a fairly decent machine to make up for the GUI, but a VERY inexpensive, high performance DNS resolver can be built with FreeBSD/BIND on VERY modest hardware (steal your kids p233, stuff some more RAM in it and go). Our fastest DNS server is a 400Mhz PII, slowest is a 200. We are running 16 IP4 based tests on each email right now. We handle approx 20,000 messages/day. Declude is pointed at a FreeBSD4.7/BIND8 P400 Machine for doing it's DNS test lookups. This machine's average processor use is like 4%. It's hardly breaking a sweat. Unless you are generating some SERIOUS DNS traffic, IMO doing zone transfers is unnecessary extra work. - Tony --- [This E-mail was scanned for viruses by http://www.intouchmi.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: MS update
Great a patch for a very old issue is going to cost me $600 to get a new service agreement for other upgrades I didin't want. (Still running 6.06, patch is for 7.13, funny how ver.7 has had 13 revisions and no where near ver.8, ver.6 only needed 6) Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Frederick Samarelli Sent: Wednesday, December 18, 2002 2:21 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: MS update A Hotfix to the IMail software is available from http://ipswitch.com/Support/IMail/patch-upgrades.html that will correct the display issue. - Original Message - From: John Tolmachoff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 17, 2002 7:54 PM Subject: RE: [Declude.JunkMail] OT: MS update http://support.microsoft.com/default.aspx?scid=kb;[LN];328310 John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith Sent: Tuesday, December 17, 2002 3:33 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: MS update Not me but then again, I'm running 7.13 (or whatever the latest version is). This seems to be more of a screen paint issue than anything else. I can't even find MSKB article Q328310 so I'm not sure what it is. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Michael Lauritzen Sent: Tuesday, December 17, 2002 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT: MS update Has anyone else seen this? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Scott MacLean Sent: Tuesday, December 17, 2002 11:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: MS update Slightly off this topic, but I just learned the hard way that if you have intentions of continuing to use the server-based IMail 6 administration program, do NOT install Microsoft update Q328310. You'll get something like this as a result: http://www.nerosoft.com/Test/IMail.gif At 11:09 AM 12/17/2002, Craig Gittens wrote: --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IBM article about spam and telemarketers
This is a very naive approach. If it deals with billing, it will need lots of legislation, tax law consideration, it will cause the owner of the phone number or email to deal with taxes for the collected income. Not to mention the crack pots that will say it is $10,000 to place an unwanted call or email to them. Plus it will involve a major evolution in call handling software, and header insertion is not a feature of most mail clients, especially web based clients. It's an interesting idea, but not as simple as the author would like you to think. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Keith Purtell Sent: Wednesday, December 11, 2002 12:18 PM To: Declude JunkMail (E-mail) Subject: [Declude.JunkMail] IBM article about spam and telemarketers This link goes to an interesting article about spam and telemarketers ... http://www.research.ibm.com/journal/sj/414/forum.pdf Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blacklisting based on % of bad addresses
Does anyone know if any of the Imail log analyzers reports number of good and bad deliveries by remote servers? I want to look at blacklisting remote addresses that send high percentage of messages to invalid addresses. These are most likely from mailing lists and therefore likely spam. I keep getting bogged down by postmaster errors to invalid return addresses, and it only keeps getting worse. I want to start tracking and blacklisting servers or originating IP's, anything, that causes these problems routinely. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklisting based on % of bad addresses
Actually I am referring to postmaster messages from Imail. I do not use the bounce action in declude because it was such a problem. I would use declude to help control the messages since it appears declude gets them before any attempt at local delivery, existing or not. Probably use the hold action. And by mailing lists I mean they are from spam CD's, most list servers will pull an address after x number of failed attempts, they won't keep banging their heads against the wall. I have single IP's that make 20+ attempts at the same address in one day. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L. Sent: Tuesday, December 03, 2002 12:46 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blacklisting based on % of bad addresses Several people have mentioned about getting bogged down with postmaster errors to return addresses. I assume you mean that you bounce messages from Declude. Is there any reason why people shy away from using bogus address on your system so the undeliverable messages are discarded? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Charles Frolick Sent: Tuesday, December 03, 2002 12:14 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Blacklisting based on % of bad addresses Does anyone know if any of the Imail log analyzers reports number of good and bad deliveries by remote servers? I want to look at blacklisting remote addresses that send high percentage of messages to invalid addresses. These are most likely from mailing lists and therefore likely spam. I keep getting bogged down by postmaster errors to invalid return addresses, and it only keeps getting worse. I want to start tracking and blacklisting servers or originating IP's, anything, that causes these problems routinely. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail Web Based Interface
I just posted asp source to my app which is similar in concept to Tom's, except it also has a spambox to manage held spam for the user. I know some people have looked at it, but I haven't received any feedback yet. It aollows for management of the spam messages separate from Imail's aging since it does not store the messages in Imail. So if you are like me and only have size limitations on your mailboxes, and cannot revert to clearing old messages automatically, the separate spambox can have aged messages, and the size limits on the original mailbox are not affected by spam. Find the app info and download at http://spamreview.argolink.net/doc Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith Inc Sent: Monday, December 02, 2002 7:35 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Imail Web Based Interface I do store all of my user databases in SQL, but it doesn't really matter, the CF side never see's the username/password. It's just a little trick I did to verify the identity of the user. My whitelist/blacklists are so very simple... I'm actually not using declude's whitelists/blacklists... Those work via IMAIL's rules.ima Any approved senders first. [rules.ima] F~[EMAIL PROTECTED]:MAIN ( sends any mail from approved-sender to main mailbox, stop's processing rules on that message ) Then any black lists F~[EMAIL PROTECTED]:NUL ( just deletes mail without any trace ) Then my weight-rule based on what level the client chose (header check) H~X-SpamLevel-Low:SPAM And of course in $default$.junkmail LOW WARN X-SpamLevel-Low: This message triggered the low spam test MEDIUM WARN X-SpamLevel-Medium: This message triggered the medium spam test HIGH WARN X-SpamLevel-High: This message triggered the high spam test And [global.cfg] HIGHweightrange x x 1 15 MEDIUM weightrange x x 16 25 LOW weight x x 26 0 I am actually finishing up a revision that gives my users a way of syncronizing their approved senders lists to their IMAIL address book, and lets them upload/download their IMAIL address book so they can syncronize it with Outlook Express. When I first started this concept I posted my source to the list, but have not updated that source in quite some time. Some of the source is specific to my system (because of the billing system integaration), but most of what you need is contained within just a couple of .cfm's. I will send you them off list this afternoon. -Tom -Original Message- From: Cxan [mailto:[EMAIL PROTECTED]] Sent: Sunday, December 01, 2002 9:49 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail Web Based Interface Tom, This is exactly what I am talking about. I noticed that you used Cold Fusion and that is what our developers use. The idea that I have is extremely close to what you have done. I will search the archive to find your documentation. For the approved and black list did you use a table SQL database. I am assuming that you are not saving your Imail user database in the registry. The reason I ask is I am leaving our Imail user database just as it is (the default) but yet we created a SQL table for whitelist/blacklist information. It is very much a table that holds the rules for per domain or per user email address. This way the users can very much populate this database using interfaces very similar and almost identical to your interface. In addition I wrote a external program in Visual Basic that is call by Declude. queries this table for each incoming email and makes decision and contributes to Decludes weighting system based on the rules stated in the database . That is mainly why I love the design and ideas behind Declude. I was wondering if it is possible to get a copy of your .cfm files and modify them? Best Regards, Mishi - Original Message - From: Tom Baker | Netsmith Inc [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, December 01, 2002 10:23 PM Subject: RE: [Declude.JunkMail] Imail Web Based Interface The session string can be helpful for kicking a user between iwebmsg and your own web server with only a single authentication point. I have already accomplished this with my system, and have integrated my online billing / spam filters with the web templates. You can see an example of what I'm talking about at http://mail.bsc.net/ Email= [EMAIL PROTECTED] Pass = declude Notice whenever your URL begins with http://mail.; you are in IMAIL's Web messeging server, but whenever your URL begins with http://signup.; you have followed a link which kicked you to my other web server, and verified your login information from IMAIL. (preventing you from having to login twice). ( for a specific example, click the spam filters button ) Search the mail archives at
RE: [Declude.JunkMail] SpamReview Web App Released
I caught a bug in rules file processing. It only affected the setRuleFile function for local rules, remote rules (which is how I am set up) has no known issues. The new version has been posted. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Charles Frolick Sent: Wednesday, November 27, 2002 1:25 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SpamReview Web App Released I have posted a copy of my SpamReview web app for download. It is sourceware, modify to your needs. I will provide as much support as I can, but I can't promise a whole lot. It works well from my development and production servers and I have released it for use to my customers. The app can be previewed at http://spamreview.argolink.net, user [EMAIL PROTECTED], and password demo. The documentation and download is at http://spamreview.argolink.net/doc. If you have code or fixes to contribute, or suggestions, send me an email. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Postini type interface for JunkMail?
I am working on an interface to control Imail rules to hold or delete mail based on rankings from weight tests in declude. I have 6 seperate ranks of spam from NONE (which as always can include misses) to VHIGH. It's not very pretty right now, but it is fuctional. I plan on adding fuctionality, such as message sorting, and making it easier to customize and adding style sheets (i.e. make it visually appealing), but I am about to zip up the ASP files and put out documentation on how to set it up. Thanks, Chuck Frolick PS, If you wnat to look at what I have, the info is in the archives: http://www.mail-archive.com/declude.junkmail%40declude.com/ search for SpamReview Web App -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Joe Wolf / CompuService Sent: Friday, November 08, 2002 10:31 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Postini type interface for JunkMail? Has anyone tried to build an interface for JunkMail that allows users or domains to set their own junk mail settings? The Postini interfaces seems easy enough and there should be a way to tranlate that to JunkMail. Just a thought. -Joe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Update on SpamReview Web App
I have an updated, almost ready for beta, version up now. Please have a look and let me know what you think. My next update message should be to notify of a downloadable beta (full source), then hopefully a workable freeware release. Again, the info. http://spamreview.argolink.net user: [EMAIL PROTECTED] pass: demo You can now log in from our webmail at http://mail.argolink.net, then link is in the dropdown menu on the top right. Info page is at http://spamreview.argolink.net/doc Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Update of SpamReview web app (not related to SpamReview hold manager)
Ok, I just uploaded a new revision to my Spambox App. The URL is http://spamreview.argolink.net email is [EMAIL PROTECTED] pass is demo Info at http://spamreview.argolink.net/doc It now has full capability to manage settings per user. A few more issues to resolve and I will look at packaging it for anyone interested. Let me know what you think. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Declude log test analyzer
I'd stay with their current, and you'll either have to build your own filter for Declude logs or ask them to build it for you, they will for registered users without a charge, and if it is a common log format add it to their permanent list. The different levels of info used in the various Declude log levels might throw it a bit, I'm not sure. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Bill B Sent: Tuesday, October 29, 2002 8:53 AM To: [EMAIL PROTECTED] Subject: Re: Re[2]: [Declude.JunkMail] Declude log test analyzer Which version of sawmill are you using? I just tried their current beta (6.4b5) and it crashed hard while processing Imail logs and didn't even recognized the Declude log format. Bill -Original Message- From: sbsi lists Sent: Mon, 28 Oct 2002 16:30:30 -0600 Subject: Re[2]: [Declude.JunkMail] Declude log test analyzer Hi Dan, DC I can also recommend Sawmillyou can configure fairy DC sophisticated filters to slice and dice the logs (and logs of many DC different formats). The support folks there were willing to help DC me get a filter set up and it looks like a worthy product to DC support. http://www.sawmill.net I'd second that -- have used it to read some Imail logs when testing it and he seems to do a really nice job on getting any changes in there that you'd like and/or that make sense. And, it's very affordable ... -jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude log test analyzer
I use Sawmill fro my customers web stats, and for custom stats for internal use, it is an excellent product. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Dan Cummings Sent: Monday, October 28, 2002 4:16 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude log test analyzer I can also recommend Sawmillyou can configure fairy sophisticated filters to slice and dice the logs (and logs of many different formats). The support folks there were willing to help me get a filter set up and it looks like a worthy product to support. http://www.sawmill.net -- Original Message -- From: Jerod M. Bennett [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 28 Oct 2002 11:07:13 -0800 Here is the latest version of that tool. It includes fixes for the first of the month, including leap-year issues. Jerod M. Bennett Director of Media Production Pixelpushers, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of John Higday Sent: Friday, October 25, 2002 4:38 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude log test analyzer I am interested in this program if it will work on Win2000 iMail 7.13 and Declude 1.61 Beta John - Original Message - From: Tom [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, October 25, 2002 4:19 PM Subject: RE: [Declude.JunkMail] Declude log test analyzer I just remembered! There is another Declude log analyzer someone wrote for NT. I have the zip files if anyone needs them or you can look at the mail archives for a download link. Usage version 1.2 By Jeff Pitoniak [ Description: ] The USAGE.CMD NT command script parses the Imail server and Declude log files and generates a daily summary report that is mailed to the email addresses you choose. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] client Question
Ok, Sounds like everyone is building a tool of some sort, might no hurt to get some collaboration going. I recently posted a link to a spam reviewing ASP app, and I am working on a way to modify the users rules files to filter based on a standard declude config. If any ASP developers want a look at my code and what I've done and am working on, for collaboration, or if you'd just like input from an outside source on your app, fell free to drop me a line. The info again: http://spamreview.argolink.net email: [EMAIL PROTECTED] pass: demo Info page http://spamreview.argolink.net/doc Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of David Lewis-Waller Sent: Friday, October 25, 2002 5:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] client Question We're developing an ASP solution for this as well, initially just modifying the users $default$.junkmail file and providing WARN/SUBJECT changes initially, then progressing onto WEIGHT change etc. later. If we offer too much at first otherwise we make a rod for our own back and drown in client support questions. The difficult bit is ensuring it's done in a secure manner. We're toying with a ASP.NET solution using web services. Will keep you informed of progress if interested. David WiSS Limited -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of grb Sent: 25 October 2002 07:21 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] client Question At 08:15 PM 10/24/02, you wrote: Thats correct...It reads it each time a message is received. We plan to work on a similar tool using ASP here in the next month or two. Bill ASP?arg... just kiddin' I'll do the CF thingy sounds like a good test..I like it.(if said correctly, it sounds coo)... --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Catching SPAM when the sender = recipient
The owner of my company also has another company in the office, and they all send out as the group alias and CC the group alias so everyone has a complete copy of communications with customers. No one can say I didn't know what he said to the customer. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Mike Sent: Friday, October 25, 2002 12:09 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Catching SPAM when the sender = recipient himself ALL the time, as well as his wife in the same room. I don't know why people can't look into the sent box. Because if you use IMAP and Outlook express, and send from one machine, the mail won't appear in the sent folder on another machine. Maybe I'm a weirdo or something, but I send myself email all the time. For example, I talk to someone while on one computer away from home, and they give me their phone number, which I will need at home. So, I just email it to myself instead of finding a piece of paper and pencil, then sticking the paper in my pocket where it will get lost. When I get home, it's there waiting for me. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Looking for feedback
I am working on a web based held message review app that allows customers to redeliver false positives or delete the spam on their own. I have a test mailbox set up and a basic info page. The app is at http://spmareview.argolink.net, the test box is [EMAIL PROTECTED], pass is demo. The info page is at http://spamreview.argolink.net/doc. Let me know what you think, it is functional, but still beta, I plan on making it available to all around the time I beta the app to my customers. Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Newbie question about baseline
I wrote a very simple batch file that runs nightly and holds mail for up to 10 days, alternately you could use a program called xxcopy that can delete, copy, or move files based on age. I included the batch file, zipped up. Nothing special, no extra programs needed. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Friday, October 04, 2002 4:27 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Newbie question about baseline I meant having to manually delete. One of these days I would like to set up auto-delete. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist Sent: Friday, October 04, 2002 2:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Newbie question about baseline | | Right now, because I am wearing so many hats, I have not had | a chance to look at and use programs to delete the held | messages after 5 days, which is when I manually delete them. | | I hold all, then after 5 days if no one has complained about | where is my e-mail, I manually delete. Out of sheer volume - we automatically delete after 10 days without a complaint. If we get a complaint or potential false positive we do a search for appropriate keywords and adjust the filters if we find something. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. managehold.zip Description: application/compressed
RE: [Declude.JunkMail] Per User - Alias Account
Have you tried making both of them a group alias, and point them to the same text file? This will make it so you only have to edit the one file and both aliases point to the same mail boxes. It also makes it scriptable for edits, it you really need to go that far. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Todd Ryan Sent: Thursday, October 03, 2002 12:48 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Per User - Alias Account Scott, I had a situation where there was an alias that pointed to another alias. We did this because we wanted two aliases pointing to a group of about 5 addresses. And we did not want or need the overhead of a list. Nor did we want to have to edit both aliases every time the group changed (it changes a lot!). I found that in this case, the junkmail settings for the actual user accounts did not work. My assumption was that JunkMail resolved the first alias and assumed the second one was the name of a user account. And since there was no .junkmail file by that name, it used the default settings. Is this what was going on? We ended up making two duplicate aliases with different names to get the users' junkmail settings to work. But now we have to do frequent updates to both aliases. Is there a better way to do this? Thanks. --Todd. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 02, 2002 4:39 PM Subject: Re: [Declude.JunkMail] Per User - Alias Account I have a client with an alias on 1 virtual domain that points to a mailbox on a second virtual domain. I want to enable SPAM blocking on the alias, but not on the actual mailbox. I tried creating the .junkmail file in the domain folder in which the alias exists, but it is not actually dealing with the tasks as in the .junkmail file Can this be accomplished? No -- the settings for the actual mailbox will be used. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] H:Best Practices for Handling Spam
As far as the clearing the spambox goes, IMail includes a program that can clear old mail, unfortunately it clears all mailboxes found in a directory recursively. I have looked into writing a utility to do the same but be direct able at individual .mbx files, but the problem comes from the two supporting files, .srt and .uid. They both are in a binary format, while the .srt file is very simple, and seems pretty unnecessary unless the box is sorted differently than the default, the .uid file is more complicated. It has a 32 byte header record, and 32 byte records for each message, that appear to be broken into 4 byte fields. I know it stores the message number, the message read bit, and some other indexes that I have yet to find a pattern other than they grow as you go higher in the message count, and the header record hold the highest message number and the next number for some of the indices. IMail will rebuild the whole thing if deleted, but all messages return to unread. The simplest way to truncate is to delete the old messages from the .mbx file, and blow away the .srt and .uid files. If anyone feels like tackling the management of the .srt and .uid files to make a proper aged delete, maybe even with a size or message count limit option, I'm sure others would appreciate it, I just don't have the time to build the needed expertise. VBScript would take way too long to process several thousand mail accounts. Sorry for the long reply. :) Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Burzin Sumariwalla Sent: Tuesday, October 01, 2002 3:29 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] H:Best Practices for Handling Spam Dear List Members, Among many other things, I'm the email administrator for St. Louis County Library. Like many other organizations, spam/UCE is a bane, but as an information agency we're also very sensitive about filtering. I'd like to hear how other folks in information type agencies are handling spam. With Junkmail Pro, I can dump spam into the %imail username%/SPAM.mbx, but is there a way to setup an automated script to clear messages from the spambox that are older than say 30 days? I'd appreciate any thoughts or suggestions. Burzin -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7602 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
