RE: [Declude.JunkMail] Feature-itis
test -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, February 23, 2004 5:27 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Feature-itis - Original Message - From: "Markus Gufler" <[EMAIL PROTECTED]> > > However, it may not be very easy to integrate syslogging support > > into Declude. I am curious to know if the majoriety of folks would > > prefer that the focus of the developer(s) be maintained on > > developing new spam features versus re-tooling Declude to work with > > a syslog daemon. Depending on the amount of work my preference (if > > a lot of work was required) would be to spend the time working on > > new spam detection features. > > In my opinion definitely on new or enhanced features. The todo list is long > enough and spammers don't wait until we have solved our logging > problems. > > Maybe it would be the easiest solution change logging like describbed > by Andrew Colbeck: Save all logfile lines into a temporary variable > including cr/lf and write them to the logfile after finishing al > tests. > > We do this in SpamChk and had never had any problem with broken/mixed > log lines. In addition we have all logfile entries for one message in > one block. > So it's easier to read. I agree, Markus, I have never seen any corrupted log entries in SpamChk and all entries for a particular message are always together, never interspersed with other message tests. I would love it if Declude could do this, as well. Oh well, can't have everything, I guess - but it doesn't hurt to dream... ;-) Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Email addresses on a company webpage?
I've been reading the recent threads and someone mentioned it a bad idea to post employee email addresses on their company webpage because of spammers or bots harvesting them. Isn't this a little bit paranoid or am I just naive? Isn't it a pretty common practice for a company to list emails addresses on their webpage, at least for sales and service individuals? I see many smaller companies doing this. Maybe they just take the risk and manage the spam when it comes in, or change specific addresses if the spam gets too bad. Any alternatives to doing this? How do they get the info to their customers if it isn't listed on the webpage? Dan Spangenberg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist own IP or domain
I have our own domain and IP whitelisted and have done so since the installation of declude spam. Is this a bad thing? I am now noticing quite a few spam emails that are obviously not originating from our domain, but show to be. What are my choices to catch those as spam but also to always allow mail that does originate from us to not get caught? Would removing the domain and whitelisting only the IP help? Any other creative options? Dan Spangenberg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of Ethics
My feelings are along this same line. It seems that this questions revolves around what the stated company policy is regarding usage of these company resources. As stated in several emails before, email and internet usage and the computers they are used are are company owned assets and should be managed as such. To me they are no different than any other company owned asset; vehicles, equipment, tools, facilites, telephones etc. There is a perceived idea that these tools are "free." The allowed usage and subsequent penalty for misuse should be covered by an enforceable company policy. If an adequate policy is in place, would it be any different to fire an employee for misuse of a company vehicle (personal deliveries and errands on company time for example) than for downloading porn? I think it is time to examine what the stated policy is on this usage. Does anyone have a company policy for email/internet use that they would be willing to share? I believe ours needs some updating. Dan Spangenberg > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of David Stavert > Sent: Thursday, February 27, 2003 10:50 AM > To: [EMAIL PROTECTED] > Subject: RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of > Ethics > > > In a corporate setting a company may or may not have an > Internet/email/conduct policy. If not, it may be very dificult to fire > someone for conduct that they didn't agree to abide by and if it came to > a lawsuit they would probably loose. In fact the company could loose > twice. Once by someone who was offended by a fellow employees use of > porn at the workplace and second by a wrongful termination suit by the > offender. Many companies just added the Internet and email to the system > without considering the concequences. Time to examine the company > policies. > > David > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Keith Purtell > > Sent: Thursday, February 27, 2003 9:34 AM > > To: [EMAIL PROTECTED] > > Subject: RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A > > Question of Ethics > > > > > > The term "spyware" refers to software whose sole purpose is > > to surreptitiously gather and transmit information about a > > user. A firewall log is a neutral record of general internet > > activity. Any reasonably informed adult who uses the internet > > should understand their actions may be logged, in the same > > way they understand a policeman might be watching them when > > they drive their car down a road. Certain parts of our daily > > activities are observed; that's a facet of urban life. What > > matters is whether the prior intent of the observation is hostile. > > > > Keith Purtell, Web/Network Administrator > > VantageMed Operations (Kansas City) > > Email: [EMAIL PROTECTED] > > > > CONFIDENTIALITY NOTICE: This email message, including any > > attachments, is for the sole use of the intended recipient(s) > > and may contain confidential and privileged information. Any > > unauthorized review, use, disclosure or distribution is > > prohibited. If you are not the intended recipient, please > > contact the sender by reply email and destroy all copies of > > the original message. > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] Behalf Of Darrell L. > > > Sent: Thursday, February 27, 2003 8:33 AM > > > To: [EMAIL PROTECTED] > > > Subject: RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of > > > Ethics > > > > > > > > > I suppose you can say that any monitoring tool or piece of software > > > could be spyware. I know in several instances where > > employee's were > > > let go or suspended due to inappropriate activity were > > based solely on > > > the analysis of firewall logs that record all internet > > activity. In > > > our Computer Security Policy we do not specifically say that the > > > firewall is > > > logging everyone's internet surfing activities. However in > > > the computer > > > security document it is spelled out that they are using company > > > equipment and the company reserves the right to monitor any and all > > > activity. > > > > > > Would you say in this instance that the tools (firewall > > logging) used > > > would be classified as "spyware"? > > > > > > Darrell > > > > > > > > > > > > > > > --- > > [This E-
[Declude.JunkMail] copy all inbound/outbound mail
I know this has been discussed somewhere, either here or in the imail list, but I can't seem to find it. How can I copy all inbound and outbound email for a specific user or users and then possibly for a complete domain? For incoming mail, I know to use the ., in the forward field in imail user admin, but not sure how to accomplish it for outgoing. And not sure how to do it for an entire domain. Our need is to monitor a couple of specific imail users, and secondly we are considering archiving all email for a domain. Is there anything in declude to help me with this? Thanks Dan Spangenberg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Error Code 32?
I was investigating a spam email as to why it got through declude and found that the header clearly shows that it failed sufficient tests to be held, yet it was not. The declude log shows an error: ERROR: Could not move spam to hold! Code: 32 What is Code: 32? I checked my old logs and can only find that error on 3 seperate occasions. I checked disk space, folder names/paths etc...all OK. Is there a reference to these codes where we can identify the cause? I resent the message and this time it was caught. Declude version: 1.66i18 Thanks Dan I have included the message headers and log file. Message Header: Received: from geocities.co.jp [80.32.72.82] by mail.signs.com (SMTPD32-7.13) id ACCE433006E; Tue, 04 Feb 2003 01:41:50 -0700 Message-ID: <000600d5ad64$cdc23363$[EMAIL PROTECTED]> From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: hundreds of FREE thumbnailed XXX pictures updated daily!!! 116-3 Date: Tue, 04 Feb 2003 03:23:39 +0500 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" X-Priority: 1 X-Mailer: Microsoft Outlook Express 5.00.2919.6700 Importance: Normal X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?80.32.72.82 X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. X-Declude-Sender: [EMAIL PROTECTED] [80.32.72.82] X-Declude-Spoolname: D7cce0433006ec083.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, SNIFFER. X-RCPT-TO: <[EMAIL PROTECTED]> Status: R X-UIDL: 334383465 Declude Log: 02/04/2003 01:42:00 Q7cce0433006ec083 SPAMCOP:9 SNIFFER:10 . Total weight = 19 02/04/2003 01:42:00 Q7cce0433006ec083 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?80.32.72.82). Action=WARN. 02/04/2003 01:42:00 Q7cce0433006ec083 Msg failed WEIGHT10 (Weight of 19 reaches or exceeds the limit of 10.). Action=HOLD. 02/04/2003 01:42:00 Q7cce0433006ec083 Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=WARN. 02/04/2003 01:42:00 Q7cce0433006ec083 Subject: hundreds of FREE thumbnailed XXX pictures updated daily!!! 116-3 02/04/2003 01:42:00 Q7cce0433006ec083 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 02/04/2003 01:42:00 Q7cce0433006ec083 ERROR: Could not move spam to hold! Code: 32 F:\IMAIL\spool\D7cce0433006ec083.SMD F:\IMAIL\spool\spam\D7cce0433006ec083.SMD 02/04/2003 01:42:00 Q7cce0433006ec083 ERROR: Could not move spam to hold (2)! Code: 32 F:\IMAIL\spool\D7cce0433006ec083.SMD F:\IMAIL\spool\spam\D7cce0433006ec083.SMD --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail Forum List Problems?
Maybe it is quiet because everyones problems finally got solved. :-) On a more serious note, semi off topic. I've got to upgrade an imail server to version 7.X soon. What issues related to that upgrade and declude should I look for? What is going to break with the upgrade? It is using declude junkmail and virus and also KVM templates. I'd ask the imail list, but... Thanks Dan Spangenberg > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff > Sent: Wednesday, January 15, 2003 1:47 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Imail Forum List Problems? > > > I have noticed the same here. > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Questions/Suggestions
Please post it to the list, I'm sure many of us could use it. I never have the time to tweak my filters > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff > Sent: Tuesday, January 14, 2003 10:03 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions > > > The adult sender's list I have was gathered over time from reports from > users and from ones I have seen in the SPAM folder. > > I would be happy to share it. > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Questions/Suggestions
For us sniffer has proven very effective for spam in general and specifically for adult spam. I find that virtually all adult content is caught by sniffer, well over 90%. Initially I only gave it a weight of 8, thus requiring another test to force it over 10 and trigger a hold. But I found quite a few porn emails only failed sniffer and so were still let through. So after testing a bit, I now give it a weight of 10, forcing a hold even if it only fails sniffer. I review all holds with spamreview and have very few false positives. Yes, it could be argued that it is expensive at $300 per year. But that is less than $1.00 per day (actually only .82 :-) ) which is very cheap when you consider the issues and ramifications of adult spam in the corporate environment or in a family environment. It is also very effective on regular spam. I find I don't have a lot of time to maintain and alter filter lists, so this works well for me. Anyone else find this with sniffer? Dan Spangenberg > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Kris McElroy > Sent: Tuesday, January 14, 2003 7:52 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Filter Questions/Suggestions > > > I have noticed that some people on this list filter emails for p o r n and > things of other nature. I am wanting to start filtering for such things > also. My fear is that I will catch a lot of legitimate emails in the > process. Does anyone have an example filter for this type of > junk? Or any > suggestions of what to use versus what not to use? > > > > Thanks, > > > Kris McElroy > [EMAIL PROTECTED] > > Internet Systems Engineer > Duracom, INC. > www.duracom.net > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Move/copy Lock/unlock errors
good idea. I'll upgrade and keep ou posted if I see them again... Thanks > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Friday, January 03, 2003 11:56 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Move/copy Lock/unlock errors > > > > >I am running version 1.64 > >I do not have an on-access scanner running nor am I running Hijack. > > As 1.64 is a beta version, I would recommend upgrading to 1.65. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Move/copy Lock/unlock errors
I am running version 1.64 I do not have an on-access scanner running nor am I running Hijack. Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Friday, January 03, 2003 11:03 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Move/copy Lock/unlock errors > > > > >I was looking at the header of a suspected spam email, and it didn't have > >any declude headers added. I thought this very strange so I looked at the > >declude spam logs and found that the email had generated this > error. Looks > >like it sailed right through without getting looked at. Any idea why it > >couldn't lock it? I checked the disk, plenty of space, spam folder is OK > >and a lot of other spam is getting caught. > > > >01/03/2003 06:59:27 Q97200fc Could not lock F:\IMAIL\spool\Q97200fc.SMD; > >timed out (j=2). > > This will occur if the Q*.SMD file is missing. This can happen if an > on-access virus scanner deletes the file (which would be unusual for a > Q*.SMD file, though), or it could also happen with some versions > of Declude > JunkMail if Declude Hijack blocked the E-mail. > > >01/03/2003 01:45:56 Q4dc1128 Couldn't move/copy data file [32]. > Priority > >back to 32. > >01/03/2003 01:45:56 Q4dc1128 WARNING: Could not unlock > >F:\IMAIL\spool\_4dc1128.~MD due to error #32. > >01/03/2003 01:45:56 Q4dc1128 ERROR: Could not move spam to hold > >(2)! Code: 2 F:\IMAIL\spool\D4dc1128.SMD > F:\IMAIL\spool\spam\D4dc1128.SMD > > The "error #32" indicates a sharing violation -- meaning that > some program > has the Q*.SMD file locked, even though it should not normally be > accessing > it (it's possible that Declude could be doing that). What version of > Declude are you running (you can type "\IMail\Declude -diag" from > a command > prompt, exactly like shown, to see the version)? > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Move/copy Lock/unlock errors
I was looking at the header of a suspected spam email, and it didn't have any declude headers added. I thought this very strange so I looked at the declude spam logs and found that the email had generated this error. Looks like it sailed right through without getting looked at. Any idea why it couldn't lock it? I checked the disk, plenty of space, spam folder is OK and a lot of other spam is getting caught. 01/03/2003 06:59:27 Q97200fc Could not lock F:\IMAIL\spool\Q97200fc.SMD; timed out (j=2). 01/03/2003 06:59:27 Q97200fc Error: Couldn't lock file F:\IMAIL\spool\Q97200fc.SMD (183) In the same log I also found the following errors. Any ideas on this error #32? 01/03/2003 01:45:56 Q4dc1128 OSSRC:5 SPAMCOP:9 SNIFFER:10 BLACKLIST:5 . Total weight = 29 01/03/2003 01:45:56 Q4dc1128 Msg failed OSSRC ([1] topica, see http://spews.org/ask.cgi?S1522). Action=WARN. 01/03/2003 01:45:56 Q4dc1128 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?66.180.247.74). Action=WARN. 01/03/2003 01:45:56 Q4dc1128 Msg failed WEIGHT10 (Weight of 29 reaches or exceeds the limit of 10.). Action=HOLD. 01/03/2003 01:45:56 Q4dc1128 Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=WARN. 01/03/2003 01:45:56 Q4dc1128 Msg failed BLACKLIST ( ID-20030102-000286). Action=WARN. 01/03/2003 01:45:56 Q4dc1128 Subject: Eat and Be Thin 01/03/2003 01:45:56 Q4dc1128 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 01/03/2003 01:45:56 Q4dc1128 Couldn't move/copy data file [32]. Priority back to 32. 01/03/2003 01:45:56 Q4dc1128 WARNING: Could not unlock F:\IMAIL\spool\_4dc1128.~MD due to error #32. 01/03/2003 01:45:56 Q4dc1128 ERROR: Could not move spam to hold (2)! Code: 2 F:\IMAIL\spool\D4dc1128.SMD F:\IMAIL\spool\spam\D4dc1128.SMD Thanks Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email without any declude headers?
That does make sense. The system that had the trouble was a Skytel account going to a pager enabled messenger watch. You would think that they would be stripping those headers out. I'll do some more testing, maybe it was just a fluke. Thanks Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Tuesday, December 03, 2002 3:11 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Email without any declude headers? > > > > >Is there any way to eliminate the aDditional declude header info on one > >email, but not all? I have a few users that send email to a > pager or phone > >(text messaging) that limits the # of characters, and the entire > message is > >filled up with headers. > > No, the global headers (such as the X-Declude-Sender: and X-Spoolname: > headers) can not be turned off for individual users or domains. > > However, that sounds like a flaw with the page/messaging system -- if it > has limits, it should either only send the headers it thinks should be > sent, or not send the headers at all. Otherwise, recipients will be very > restricted in what they receive (lots of mailservers add 5-10 > headers just > for an abuse@ contact, for example). > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Email without any declude headers?
Is there any way to eliminate the aDditional declude header info on one email, but not all? I have a few users that send email to a pager or phone (text messaging) that limits the # of characters, and the entire message is filled up with headers. Dan Spangenberg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Deleting Mail Inbound Mail
That would be good. Is the issue the same for filtering using a single text file as it is for the per-user configuration? I assume that would change it so that if one recipient on a mutilple recipient email got flagged, you would just remove that one recipient from the header and the email would still get delivered to the others as opposed to deleting the enitre email? Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Tuesday, November 26, 2002 7:32 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Deleting Mail Inbound Mail > > > > >That is a good question. In my initial testing it looks as if > the email is > >deleted and not delivered to either user. > >This is not a real good situation, but I don't think there is > any way around > >it. If I understand correctly, a single email sent to multiple > recipients on > >the same domain is not copied to each recipient until it > actually hits the > >mail server. > > > >Scott, any way to approach this issue? > > I believe this is the first time it has come up, but we are planning to > change this behavior so that if there are multiple recipients, it > will only > get deleted for the one(s) that have their action set to DELETE. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Deleting Mail Inbound Mail
That is a good question. In my initial testing it looks as if the email is deleted and not delivered to either user. This is not a real good situation, but I don't think there is any way around it. If I understand correctly, a single email sent to multiple recipients on the same domain is not copied to each recipient until it actually hits the mail server. Scott, any way to approach this issue? > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Darrell L. > Sent: Tuesday, November 26, 2002 12:49 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Deleting Mail Inbound Mail > > > Dan, > > Thanks I got it up and running with your direction to those threads. > > One question I do have is if mail to more then one recipient and we are > deleting on the allrecips test will the other recipients receive the > mail? > > Darrell > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Spangenberg > Sent: Tuesday, November 26, 2002 2:26 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Deleting Mail Inbound Mail > > That is exactly what I am doing and it works great. The thread was > titled > "Is this possible with the filter function or blacklist?" on 11/11/02. > Also > the thread "allrecips function in ver 1.63" from yesterday > It uses the filter function and a .txt file. > You must have the version 1.63 and it must be the pro version for the > filtering to work. > > Dan > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of Darrell L. > > Sent: Tuesday, November 26, 2002 12:14 PM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] Deleting Mail Inbound Mail > > > > > > I seen a thread very similar to what I need to do awhile back, but I > was > > unable to key on it searching the archives. > > > > We use the "nobody" alias and have had several users leave and their > > mailboxes have been removed. Is there an easy way to bounce the mail > > that is incoming from them with declude? > > > > Thanks > > Darrell > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Deleting Mail Inbound Mail
That is exactly what I am doing and it works great. The thread was titled "Is this possible with the filter function or blacklist?" on 11/11/02. Also the thread "allrecips function in ver 1.63" from yesterday It uses the filter function and a .txt file. You must have the version 1.63 and it must be the pro version for the filtering to work. Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Darrell L. > Sent: Tuesday, November 26, 2002 12:14 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Deleting Mail Inbound Mail > > > I seen a thread very similar to what I need to do awhile back, but I was > unable to key on it searching the archives. > > We use the "nobody" alias and have had several users leave and their > mailboxes have been removed. Is there an easy way to bounce the mail > that is incoming from them with declude? > > Thanks > Darrell > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Getting held mail delivered?
FWIW I have seen them sit in there quite a while when I manually move them also. Doesn't seem to be any rhyme or reason to it thoughwatched pot never boils? > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Smart Business > Lists > Sent: Monday, November 25, 2002 5:14 PM > To: Marc Catuogno > Subject: Re: [Declude.JunkMail] Getting held mail delivered? > > > Marc, > > Monday, November 25, 2002 you wrote: > MC> I copied both D4a4405430076c191.SMD and Q4a4405430076c191.SMD back > MC> to the spool directory and they have been sitting there for an > MC> hour. I found the Imail "send one" and "send all" commands and the > MC> messages were delivered. Would these ever get sent with out manual > MC> intervention? An hour seems a bit long... > > Normally the spool timer is 30 minutes but that can be changed so you > may have a longer time. So when you put a message back then it should > send the next time the queue is polled which normally would be up to > the spool timer amount. However, I've seen messages sit there longer > although I have no real explanation. I monitor our spool with our > review program so if I see something sitting in there too long I do > just what you did. > > > > Terry Fritts > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] allrecips function in ver 1.63
and also I have this in $default$.junkmail WEIGHT100 HOLD > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Spangenberg > Sent: Monday, November 25, 2002 3:06 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] allrecips function in ver 1.63 > > > Wouldn't you know it Scott, you no sooner release a new beta > version and now > you have to support it... :-) > > I can't seem to get the filter function to work. This is what I > have in my > global.cfg > > WEIGHT10 weight x x 10 0 > WEIGHT20 weight x x 20 0 > WEIGHT100 weight x x 100 0 > SNIFFER external nonzero "f:\imail\sniffer\sniffer.exe " 10 0 > BLACKLIST fromfile f:\IMail\kill\fromfile.txt x 5 0 > OLDEMPLOYEE filter f:\IMail\Declude\oldemployee.txt x 100 0 > # CATCHALLMAILS catchallmails x x 0 0 > > and this is the contents of f:\IMail\Declude\oldemployee.txt > > ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] > > Any mail addressed to [EMAIL PROTECTED] is getting through. > According to > the declude log and the received message headers it isn't failing > any tests > and weight is 0. > > Any ideas on what I have set wrong? > > Dan > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] allrecips function in ver 1.63
Wouldn't you know it Scott, you no sooner release a new beta version and now you have to support it... :-) I can't seem to get the filter function to work. This is what I have in my global.cfg WEIGHT10weight x x 10 0 WEIGHT20weight x x 20 0 WEIGHT100 weight x x 100 0 SNIFFER external nonzero "f:\imail\sniffer\sniffer.exe " 10 0 BLACKLIST fromfile f:\IMail\kill\fromfile.txt x 5 0 OLDEMPLOYEE filter f:\IMail\Declude\oldemployee.txt x 100 0 # CATCHALLMAILS catchallmails x x 0 0 and this is the contents of f:\IMail\Declude\oldemployee.txt ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] Any mail addressed to [EMAIL PROTECTED] is getting through. According to the declude log and the received message headers it isn't failing any tests and weight is 0. Any ideas on what I have set wrong? Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] beta version 1.63
So I shouldn't d/l it and try it? Oops...I already did. Guess I'll test it now and let you know how it goes. Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Monday, November 25, 2002 1:18 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] beta version 1.63 > > > > >I see that beta version 1.63 is posted, but I don't see any relase notes > >pertaining to 1.63. > > It's just about to be released. :) > > >Has the the ALLRECIPS filter option been modified to work on both the > >intended recipient and actual recipients in this version? > > Yes, it has. :) > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] beta version 1.63
Scott, I see that beta version 1.63 is posted, but I don't see any relase notes pertaining to 1.63. Has the the ALLRECIPS filter option been modified to work on both the intended recipient and actual recipients in this version? Thanks, just anxious to get this running... Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Spangenberg > Sent: Wednesday, November 13, 2002 12:26 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Declude gone whacky? > > > Great! Do you think you can get it to work on aliases rather than just > intended recipients like you mentioned? > > Dan > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > > Sent: Tuesday, November 12, 2002 6:15 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Declude gone whacky? > > > > > > > > >>The test email that I sent only had one recipient. The problem > > started when > > >>I sent the test message to [EMAIL PROTECTED] to test the > > filter setup. > > >>There was not a valid imail account or alias for muji. I waited > > a minute for > > >>it to process and then checked the declude logs to see what had > > occurred. > > >>That is when I noticed that the server was acting loaded. I > checked the > > >>mailboxes where the muji message would have gone and it wasn't > > there yet, so > > >>it was still processing. > > > > We've found the cause for this; there is a bug in the handling > of the new > > ALLRECIP filter option that is causing this. It will be fixed in > > the next > > release. > > -Scott > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
Are the messages from this particular thread getting caught by sniffer for everyone else? How does sniffer work and why is it catching this email? Something with the wide variety of domains listed? > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Keith Johnson > Sent: Wednesday, November 13, 2002 10:08 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx > > > Tom, > I wanted to thank you for your time and effort that you have put > into posting and keeping up to date a file that I can use to help guard > against spam. I know how busy life and work can be and wanted to thank > you for your diligence in providing a service (free) to me as well as > this forum. > > Keith Johnson > > -Original Message- > From: Tom [mailto:tom@;imagefxonline.net] > Sent: Tuesday, November 12, 2002 9:02 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx > > > 50% effective > > List of spammers caught by the Fromfile: > --- snipped... --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
Great! Do you think you can get it to work on aliases rather than just intended recipients like you mentioned? Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry > Sent: Tuesday, November 12, 2002 6:15 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Declude gone whacky? > > > > >>The test email that I sent only had one recipient. The problem > started when > >>I sent the test message to [EMAIL PROTECTED] to test the > filter setup. > >>There was not a valid imail account or alias for muji. I waited > a minute for > >>it to process and then checked the declude logs to see what had > occurred. > >>That is when I noticed that the server was acting loaded. I checked the > >>mailboxes where the muji message would have gone and it wasn't > there yet, so > >>it was still processing. > > We've found the cause for this; there is a bug in the handling of the new > ALLRECIP filter option that is causing this. It will be fixed in > the next > release. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
> >I resent an email and declude has now gone somewhat wacky. The > imail server > >was acting loaded, so I checked the task man and there are 6 or > 8 instances > >of declude running - taking up all of the cpu cycles. Ther are > also about > >15-20 .~md and .smd files in the spool dir and three or 4 .vir > directories. > >It is busy doing something! > > > >Any ideas what happened? > > It looks like there was a problem with the code that could have > potentially > caused this, if there were large numbers of recipients for the > E-mail. This will be fixed in the next release. > > However, with the 4 .vir directories as well (which are from Declude > Virus), it may just be that you had a large amount of incoming traffic, > that was being scanned normally. The test email that I sent only had one recipient. The problem started when I sent the test message to [EMAIL PROTECTED] to test the filter setup. There was not a valid imail account or alias for muji. I waited a minute for it to process and then checked the declude logs to see what had occurred. That is when I noticed that the server was acting loaded. I checked the mailboxes where the muji message would have gone and it wasn't there yet, so it was still processing. At this point I don't think there was any .vir directories. I waited 2-3 minutes and started to see multiple instances of declude.exe in taskman/processes. These were no doubt additional messages that were coming in while the test message was still processing. I waited another few minutes but none of the declude processes would ever finish and nothing was getting written to the logs. So that is when I killed it with a rename of global.cfg and a reboot. I believe it somehow chocked on the test message and the filter, possibly because there wasn't a valid imail account. I tried this two times with basically the same results. I will try it again but with a valid user account. > > >Does declude normally run multiple instances? > > Yes -- the IMail architecture will have either one Declude.exe process or > one SMTP32.exe process for each E-mail that is being processed > (after it is > received by the SMTPD32.exe process). > > >So it obviously doesn't like something with the filter. I did not create > >those accounts; muji and ddd. I was hoping the filters would > work without a > >valid account as that was my inital goal. I have now > deactivated the filter > >test line and all is running well. Tomorrow I'll try it with > valid accounts, > >althought that doesn't do me much good, even if it works. > > I'll see if we can get the ALLRECIPS filter option to work with > aliases as > well. Although the aliases in IMail are very useful, they do come with > their drawbacks. How do you mean "to work with aliases as well"? Are you referring to the imail aliases? I guess it would be OK to still have an alias for old users, but where would it point to? I would like it just be able to delete a user when they are gone, aliases and all and then put their name in another file to have all their future mail dumped. It just makes imail more confusing to manage when there are many old unused users that should have been just deleted. I appreciate your help in figuring out a way to do this. Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
Sorry, yes a typo. The filename did match the global.cfg line. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Bill Landry Sent: Monday, November 11, 2002 6:57 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Declude gone whacky? > OLDEMPLOYEE filter f:\IMail\Declude\oldemployee1.txt x 100 0 > >and this is the content of the employee1.txt file: This may be a typo, but it does not appear here that the actual file name "employee1.txt" and the config option in the Global.cfg "oldemployee1.txt" are the same. Just something to look at... Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
It doesn't look like you got the earlier message. Here it is: I was in the middle of testing the filters, and initially go a couple of errors in the log that said it could not open my filter file. I rechecked the configuration for a typo and everything looked OK. I sent a couple more emails and nothing showed in the log that it was even looking at the filter file. So, I created a new filter file with a new name and renamed it in the global.cfg. I resent an email and declude has now gone somewhat wacky. The imail server was acting loaded, so I checked the task man and there are 6 or 8 instances of declude running - taking up all of the cpu cycles. Ther are also about 15-20 .~md and .smd files in the spool dir and three or 4 .vir directories. It is busy doing something! Any ideas what happened? Does declude normally run multiple instances? I am going to rename the global.cfg and try a reboot. It won't let me kill any of the declude processes. So it obviously doesn't like something with the filter. I did not create those accounts; muji and ddd. I was hoping the filters would work without a valid account as that was my inital goal. I have now deactivated the filter test line and all is running well. Tomorrow I'll try it with valid accounts, althought that doesn't do me much good, even if it works. I am on version 1.62 Thanks Dan -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry Sent: Monday, November 11, 2002 6:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude gone whacky? >I renamed global.cfg go global.bak and rebooted. Everything started OK, so I >renamed it bak to global.cfg and now declude is doing the same thing. What exactly is happening? >WEIGHT100 weight x x 100 0 >OLDEMPLOYEE filter f:\IMail\Declude\oldemployee1.txt x 100 0 That's good. >and this is the content of the employee1.txt file: > >ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] >ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] That's good (assuming that you are running v1.62 or higher, which is needed for the ALLRECIPS option). >The junkmail file only has: > >WEIGHT100 HOLD And that looks good too. Did you add the [EMAIL PROTECTED] and [EMAIL PROTECTED] accounts? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
I renamed global.cfg go global.bak and rebooted. Everything started OK, so I renamed it bak to global.cfg and now declude is doing the same thing. It clearly doesn't like something with the filters. Here is what I have in the global.cfg WEIGHT10weight x x 10 0 WEIGHT20weight x x 20 0 WEIGHT100 weight x x 100 0 SNIFFER external nonzero "f:\imail\sniffer\sniffer.exe " 10 0 BLACKLIST fromfile f:\IMail\kill\fromfile.txt x 5 0 CATCHALLMAILS catchallmails x x 0 0 OLDEMPLOYEE filter f:\IMail\Declude\oldemployee1.txt x 100 0 and this is the content of the employee1.txt file: ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] ALLRECIPS 0 CONTAINS [EMAIL PROTECTED] The junkmail file only has: WEIGHT100 HOLD Any ideas? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is this possible with the filter function or blacklist?
Scott, I am trying out the per user config and trying the catchallmails function. I can only get it to work if there is a valid imail user. If there is no imail user then the email is still getting routed to my root directory where the misaddressed mail goes. I was hoping to be able to have it work without a valid imail user. Will the filters work the same way? Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is this possible with the filter function or blacklist?
So there is two ways to do this, filters and per user config? If I used a Filter file like this: ALLRECIPS 0 IS [EMAIL PROTECTED] ALLRECIPS 0 IS [EMAIL PROTECTED] Would I need to put the entire email addy? And is it only going to look at the entire thing or will it find "user" or "r2" out of the above examples? Wouldn't the "IS" be better than the contains? Am I better off to list the weight as 100 in the filter file, or on the filter line that is added to the global.cfg file; OLDUSERFILTER filter C:\IMail\Declude\oldusers.txt x 100 0. Not sure I understand why there is two places to put the weight when using filters. I would then define a weight100 and then do a delete on it..right? One question on the per user config. Does the olduser.junkmail file only have to have that one line in it - "CATCHALLMAILS DELETE"? Sorry if I am a bit dense on these things. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of R. Scott Perry Sent: Monday, November 11, 2002 12:16 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Is this possible with the filter function or blacklist? >Scott, any chance of doing this with the existing filters or adding a >location - To: for the filter to look? Or possibly getting a blacklist To: >function? There is actually a ALLRECIPS filter option in v1.62 that now allows you to filter based on recipients. One option (with Declude JunkMail Pro) would be to set up per-user configuration files for the users that no longer exist, with a single line "CATCHALLMAILS DELETE" (a *VERY* dangerous line to use under most circumstance, as it will delete all mail to the user(s) with that line in their configuration file). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is this possible with the filter function or blacklist?
Well that sounds like it could work, but might be tough for me. The only perl I know is in a strand in my wife's jewlery box. :-) I don't know any programming, guess I should learn sometime except there is never any time. You are only using the perl script to look at the to: address and then compare it with an external list and then pass or fail..right? Scott, any chance of doing this with the existing filters or adding a location - To: for the filter to look? Or possibly getting a blacklist To: function? I would like to keep this as simple as possible. Thanks Dan -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Smart Business Lists Sent: Monday, November 11, 2002 11:44 AM To: Dan Spangenberg Subject: Re: [Declude.JunkMail] Is this possible with the filter function or blacklist? Dan, Monday, November 11, 2002 you wrote: DS> I want to either delete or send to a specified mailbox all mail DS> for a list of recipients. DS> Is this possible using declude filters? Yes, but I believe it would require a custom external test. As far as I know there is no declude test that traps on TO address. I have something along your idea working like this: 1) in .CFG file I define my test as a perl program: MyTest external nonzero "C:\perl\bin\perl.exe C:\MyTest.pl" -1000 0 The -1000 is used to prevent the WEIGHT test from being triggered. 2) in .junkmail file I define my action which is ROUTETO but could be DELETE if you wanted. MyTest ROUTETO [EMAIL PROTECTED] 3) My Perl program checks the TO address and fails if it is not in a list. In your case you would want to fail if it was in a list I believe. Now when I deployed my test I could not pass parameters to the external test so I had to read the ENVELOPE file for the recipient TO address. In version 1.62 the ability to send parameters was added so now you could pass %ALLRECIPS% to the program and avoid reading the ENVELOPE. DS> What about a blacklist recipient function? Again as far as I know that is not possible. It is possible to whitelist a recipient. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is this possible with the filter function or blacklist?
I want to either delete or send to a specified mailbox all mail for a list of recipients. I manage about 250 users between 2 different domains, and because we are a wholesale salesman based company we have chosen to use the nobody alias so all misaddressed mail is routed to one mailbox. We get quite a bit of misaddressed yet legitimate mail so this works fine except for old employees. I have to leave their accounts on the system, and I set their mailbox size to 0 and all messages are bounced with a notice. But because declude does its tests first, any virus or spam for these users gets caught, rather than bounced. I have quite a few of these accounts now and I would like to be able to delete their mailboxes off of the system, still leave the nobody alias on, and enter their names into a list and have all mail deleted so I never see it or any virus or spam warnings. Is this possible using declude filters? After reading about them it appears so, but I may need a little help on configuring them properly. What about a blacklist recipient function? Unless someone is using the nobody alias, this is not usually a problem, the mail is rejected because the account doesn't exist. Also Imail's rules.ima are processed after declude so they don't help any. Ideas anyone? Dan Spangenberg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Message Sniffer Confidence
I've been playing with sniffer a bit, and one thing I have noticed is that it will catch many adult emails that do not fail any other declude tests and that have been getting through my current setup. The problem is that if I want to catch them, I have rely only on sniffer and put sniffer at a weight 10 (and hold at 10) and not rely on another test to trigger the hold. Is there any other way around this or another way I can set it up? Also, how can I really tell if sniffer is catching any more than my current setup? (other than these adult emails) I see that it is triggered on many emails in addition other tests, but don't see too many outside of these adult emails where it is the only test being triggered. Dan -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Bill B Sent: Friday, November 08, 2002 2:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Message Sniffer Confidence We weight sniffer as a 12 and block at 15. This works very well for us. Bill -Original Message- From: "Trent M. Davenport" Sent: Fri, 8 Nov 2002 10:24:28 -0800 Subject: [Declude.JunkMail] Message Sniffer Confidence So, after seeing the last 2 months that message sniffer is around 90% accurate, what confidence has everyone put in it? We offer our clients 2 levels of SPAM blocking. Regular (using a WEIGHT20) and Aggressive (using a WEIGHT10). Because we're an ISP, we have to be really careful about deleting legitimate email. We purchased Message Sniffer and implemented it and it is catching a bunch of messages, but the default weight is 7. With the percentage as high as it is, I'd like to give it a 17 so that if a message fails it plus 1 other test, it'll fail the regular test. Need I be that cautious? Just looking for feedback from other users of Sniffer. Trent --- Trent M. Davenport - Systems Administrator Northern Television Systems Ltd - WHTV 203-4103 4th Avenue, Whitehorse, YT Y1A 1H6 (867) 393-2225 X204, (867) 393-2224 FAX www.whtvcable.com ( [EMAIL PROTECTED] ) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude and order of things?
I know this item has been mentioned before, I just can seem to find it. In terms of rules and processing, where does declude sit in the order? Do any of the rules take place before declude processes the message? What I want to do is this; We are a small sales oriented compnay with around 100 imail users. Becuase we are very customer oriented I want to leave the nobody alias on to manually forward obviously misaddressed mail. If a user leaves the company I still keep their account, with access disabled and mailbox size set to 1. This bounces all messages to this user. If an existing user had too much spam, we just give them a new account and let the old account remain to bounce the spam. This scenario worked well until I started to use Declude spam and the wonderful spamreview program. Now I get the spam for all users, active or not. Is there a way to have the nobody alias on and yet still bounce messages for a specific user? Kind of like the kill.lst except for recipients instead of senders? Maybe there isn't any other way to do this. I may be at the point at which I turn off the nobody user. Given the great success of Declude Spam, I am not ready to go back to the spam infested pre-declude days. :-) Any ideas welcome. Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spam Review Program
Great program? Are you ready for some feedback and a few ideas/suggestions? I would like a way to shut off the delete confirmation. It would be nice to be able to resize the windows. I like to see the subject line and it is always down a ways so you have to scroll to see it. A button to move to a "hold" directory in addition to the "move to que" and "delete" buttons could be useful. Also what is the sort order meant to be? Mine doesn't appear to have much of a sort order. By date might be good. This is a really a great utility and works very well. Thanks Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz > Sent: Saturday, January 26, 2002 3:03 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Spam Review Program > > > > Yes http://www.slsoft.com/spamreview.htm > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of andyb@thumpernet > Sent: Saturday, January 26, 2002 4:00 PM > To: Tom Schwarz > Subject: Re: [Declude.JunkMail] Spam Review Program > > > Hi, > > Has it been posted anywhere yet? > > Thanks, > Andy Baldwin > > [EMAIL PROTECTED] > http://www.thumpernet.com > 315-282-0020 > > Saturday, January 26, 2002, 11:28:46 AM, you wrote: > > TS> I have received several replies. If it's ok with Declude, I will post > the > TS> download address on this list. If someone from Declude would reply to > me I > TS> would appreciate it. > > TS> This program will be Freeware (I hate spam) and will only be supported > to > TS> the extent that I have time to support it (I have a real job). I will > be > TS> using it on a daily basis so I will be adding features and fixing bugs > when > TS> needed. I will provide the source code to those that want > it. Test it > TS> carefully yourself. I will not be responsible for problems that may > occur. > > > TS> Program Notes: > > TS> This program is written in VB6.0. You give it the path to your IMail > spool > TS> folder and it locates the spam email that is in hold by looking in the > spam > TS> folder under the spool folder. ex. "c:\imail\spool\spam". > > TS> A list of all the files in the spam hold folder come up in a list box. > It > TS> includes the name of the file, date, from address, to address. > > TS> Selecting an email in the list displays information in three > boxes. The > TS> header, the declude warnings, and the body of the message. You can > click on > TS> View HTML and view the body in a browser format. > > TS> You can click on "Move To Deleted" and the selected email is > moved to a > TS> deleted folder under the spam folder. The selected email is removed > from > TS> the spam hold folder. > > TS> You can click on "Return To Que" and the email will be moved > back to the > TS> spool folder. The selected email is removed from the spam > hold folder. > > TS> A Refresh button let's you refresh the list. > > TS> Tom > > TS> --- > TS> [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > TS> --- > > TS> This E-mail came from the Declude.JunkMail mailing list. To > TS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > TS> type "unsubscribe Declude.JunkMail". You can E-mail > TS> [EMAIL PROTECTED] for assistance. You can visit our web > TS> site at http://www.declude.com . > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] adult content test?
Wow...read my mind. That is exactly what I was thinking this morning. I turned up several of the filters, so I have been focussing on the spam hold folder thinking about the best way to look at all these held emails. Redirecting would be a very easy way to manage it. Can we see that as part of beta 1.35...say may be tomorrow? :-) Thanks Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of David Stavert > Sent: Monday, January 21, 2002 12:20 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] adult content test? > > > Scott > If HOLD were a "forward to mailbox" then it would be easy to scan through. > In fact that would add really fine control for filtering mail based on > content, from, to, etc. and could, to some degree reinject mail back into > the stream automatically. > > > David > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > > Sent: Monday, January 21, 2002 7:46 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] adult content test? > > > > > > > > >I suppose that if the spam tests are configured and tested > > properly, then it > > >isn't expected that one would go through each held > > messageCorrect? > > > > That's correct. Many of our customers have too much spam, > > and they can't > > go through it all. Some people use the HOLD action just so > > that they will > > have a copy of the E-mail "just in case". > > -Scott > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". You can E-mail > > [EMAIL PROTECTED] for assistance. You can visit our web > > site at http://www.declude.com . > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] adult content test?
Seems like there should be someway to view these held files in an interface
much like outlook, with each message on a line. If I could see to, from and
the subjct, I could determine validity much quicker than opening each
individual file.
I suppose that if the spam tests are configured and tested properly, then it
isn't expected that one would go through each held messageCorrect?
Thanks
Dan
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
> Sent: Sunday, January 20, 2002 5:45 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] adult content test?
>
>
>
> >Where would we put ADULT, in both global.cfg file and the
> $default$.junkmail
> >file or just the latter?
>
> You would need to define it in the global.cfg file ("ADULT adult"), and
> list the action in the $default$.JunkMail file ("ADULT WARN").
>
> >One other item. I am slowly trying a few of the junkmail tests
> set to hold.
> >What is the best method for sorting through those held messages?
> Is it just
> >best to use explorer and view each one of them?
>
> Yes, that seems like the easiest way.
>
> >If they are good, where do I put them to go ahead and be
> processed without
> >being held again?
>
> You need to move the pair of files ("D" and "Q") back to the \IMail\spool
> directory, and IMail will send them out on the next queue run (Declude
> won't scan them again).
> -Scott
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
>
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". You can E-mail
> [EMAIL PROTECTED] for assistance. You can visit our web
> site at http://www.declude.com .
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
RE: [Declude.JunkMail] adult content test?
Where would we put ADULT, in both global.cfg file and the $default$.junkmail file or just the latter? One other item. I am slowly trying a few of the junkmail tests set to hold. What is the best method for sorting through those held messages? Is it just best to use explorer and view each one of them? If they are good, where do I put them to go ahead and be processed without being held again? Is there any other tools or ways to automate this process? Thanks Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Saturday, January 19, 2002 7:03 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] adult content test? > > > > >Is there a test that filters for adult content? I have a few > customers that > >requested it. > > There is an undocumented "adult" test type that could be used. > However, it > can't catch all adult content, and it could catch some false positives > (such as legitimate mail with adult content). > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". You can E-mail > [EMAIL PROTECTED] for assistance. You can visit our web > site at http://www.declude.com . > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
