Re: [Declude.JunkMail] Cosmetic Bug or Buffer Overrun?
Andy, OK. First, Sandy corrected me that the Return-Path is added by the mail server, not the mail client. Since this is being added by you through the use of the %MAILFROM% variable, I have to look into the sources. I am sure that there are limits to the length of string variables, but I do not know what they are. I am out of the office until 3 January, but I will try to look into this within the next day or two. David Franco-Rocha - Original Message - From: Andy Schmidt To: 'David Franco-Rocha' Sent: Thursday, December 21, 2006 9:49 AM Subject: RE: [Declude.JunkMail] Cosmetic Bug or Buffer Overrun? Hi David, The Return-Path is not added by Declude I'm sorry - I should have been clearer. Imail does not add the missing Return-Path when it processes the MAIL FROM string - but it is GOOD information to have to see who the actual sender was. That's why I use the following global.cfg to add the header through Declude: XINHEADER X-Declude: Version %VERSION%; Code 0x%HEADERCODE% from %REVDNS% [%REMOTEIP%] XINHEADER X-Declude: Triggered [%WEIGHT%] %TESTSFAILED% XINHEADER X-Countries: %COUNTRYCHAIN% XINHEADER Return-Path: %MAILFROM% As you can see, Declude truncates the MAIL FROM - at least when resolving the %MAILFROM% variable. I don't know if this is intentional (result of a proper boundary check) - or if it's an indication that some internal buffer overflows. It is added by the email client that receives the email How would the POP3 or IMAP4 email client do it - the client has no knowledge what the SMTP MAIL FROM was? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Franco-Rocha Sent: Thursday, December 21, 2006 12:05 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Cosmetic Bug or Buffer Overrun? Andy, The Return-Path is not added by Declude. It is added by the email client that receives the email. David Franco-Rocha - Original Message - From: Andy Schmidt To: declude.junkmail@declude.com Sent: Wednesday, December 20, 2006 1:50 PM Subject: [Declude.JunkMail] Cosmetic Bug or Buffer Overrun? Hi, this doesn't seem to impact function - but note how the Declude-inserted Return-Path header arbitrarily truncates the MAIL FROM information (of course, I'm hoping that this is not an indication of some buffer-overrun vulnerability in the current code): 12:20 13:30 SMTPD(813901dbdae6) [63.107.174.78] connect 81.200.33.58 port 57625 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] EHLO NS02.xsalto.net 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] MAIL FROM:[EMAIL PROTECTED] 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] RCPT TO:[EMAIL PROTECTED] ORCPT=rfc822;[EMAIL PROTECTED] 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] D:\IMail\spool\D813901dbdae6.SMD 3451 Received: from NS02.xsalto.net [81.200.33.58] by hm-software.com with ESMTP (SMTPD-9.10) id A1393D48C; Wed, 20 Dec 2006 13:30:17 -0500 Received: from localhost.localdomain (web02.xsalto.net [81.200.33.35]) by NS02.xsalto.net (Postfix) with ESMTP id E6873233D35 for [EMAIL PROTECTED]; Wed, 20 Dec 2006 19:01:05 +0100 (CET) Date: Wed, 20 Dec 2006 19:01:05 +0100 To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] Reply-to: [EMAIL PROTECTED] Subject: consommables Message-ID: [EMAIL PROTECTED] X-Priority: 3 X-Mailer: PHPMailer [version 1.73] X-MLID: aab3238922bcc25a6f606eb525ffdc56 X-Mailer: XSALTO-Mailer MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=b1_85fec80bd8a90a94cc2ae0882e4d0fcc X-Declude-RefID: X-Declude: Version 4.3.23; Code 0xf from mailing.speedinfo.fr [81.200.33.58] X-Declude: Triggered [0] None X-Countries: FRANCE-destination Return-Path: ml-return+687474703a2f2f7370656564696e666f2e7873616c746f2e636f6d2f2d543030313a327573327968706466673173393434396731727133736f61722 X-RCPT-TO: [EMAIL PROTECTED] Status: X-UIDL: 466622842 X-IMail-ThreadID: 813901dbdae6 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail
Re: [Declude.JunkMail] Cosmetic Bug or Buffer Overrun?
Andy, The Return-Path is not added by Declude. It is added by the email client that receives the email. David Franco-Rocha - Original Message - From: Andy Schmidt To: declude.junkmail@declude.com Sent: Wednesday, December 20, 2006 1:50 PM Subject: [Declude.JunkMail] Cosmetic Bug or Buffer Overrun? Hi, this doesn't seem to impact function - but note how the Declude-inserted Return-Path header arbitrarily truncates the MAIL FROM information (of course, I'm hoping that this is not an indication of some buffer-overrun vulnerability in the current code): 12:20 13:30 SMTPD(813901dbdae6) [63.107.174.78] connect 81.200.33.58 port 57625 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] EHLO NS02.xsalto.net 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] MAIL FROM:[EMAIL PROTECTED] 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] RCPT TO:[EMAIL PROTECTED] ORCPT=rfc822;[EMAIL PROTECTED] 12:20 13:30 SMTPD(813901dbdae6) [81.200.33.58] D:\IMail\spool\D813901dbdae6.SMD 3451 Received: from NS02.xsalto.net [81.200.33.58] by hm-software.com with ESMTP (SMTPD-9.10) id A1393D48C; Wed, 20 Dec 2006 13:30:17 -0500 Received: from localhost.localdomain (web02.xsalto.net [81.200.33.35]) by NS02.xsalto.net (Postfix) with ESMTP id E6873233D35 for [EMAIL PROTECTED]; Wed, 20 Dec 2006 19:01:05 +0100 (CET) Date: Wed, 20 Dec 2006 19:01:05 +0100 To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] Reply-to: [EMAIL PROTECTED] Subject: consommables Message-ID: [EMAIL PROTECTED] X-Priority: 3 X-Mailer: PHPMailer [version 1.73] X-MLID: aab3238922bcc25a6f606eb525ffdc56 X-Mailer: XSALTO-Mailer MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=b1_85fec80bd8a90a94cc2ae0882e4d0fcc X-Declude-RefID: X-Declude: Version 4.3.23; Code 0xf from mailing.speedinfo.fr [81.200.33.58] X-Declude: Triggered [0] None X-Countries: FRANCE-destination Return-Path: ml-return+687474703a2f2f7370656564696e666f2e7873616c746f2e636f6d2f2d543030313a327573327968706466673173393434396731727133736f61722 X-RCPT-TO: [EMAIL PROTECTED] Status: X-UIDL: 466622842 X-IMail-ThreadID: 813901dbdae6 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] CMDSPACE/SmarterMail
Michael, If you have anything being held as spam, that folder will contain the *.hdr ad *.eml files. Look at one of the *.hdr files to see whether it contains a mention of CMDSPACE. That is how SmarterMail has been passing that information to Declude. If it is there, send us a copy of the *.hdr file; if it is not there, SmarterMail is not providing us with that information. David Franco-Rocha - Original Message - From: Michael Jaworski [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, November 10, 2006 10:25 AM Subject: [Declude.JunkMail] CMDSPACE/SmarterMail We just started using CMDSPACE and noticed the test does not appears to be working on SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14. I am not seeing any errors in the debug level logs files. A check of the release logs it appears support for CMDSPACE test in Smartermail was provided in 4.0.9. (Feb 2006) Anyone seeing the same thing? Here are my relevant entries without quotes: Global.cfg - CMDSPACE cmdspace X X 8 0 $default$.junkmail - CMDSPACE WARN Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude not modifying subject line
Kevin, I am very well aware of what byte sequences constitute the end of a line. However, if the problem were this simple it would have been fixed long ago. Contrary to what some have said here, we have seen many instances where IMail likewise appends its headers to the end of the message. The broken line terminators are not necessarily of the same type in a given message. In addition, they are not necessarily adjacent to each other (with leading whitespace or unprintable characters on a line). What may appear obvious to the eye is often not at all what exists behind the scene. You may look at a message and be certain where the headers end and the body begins (the separating blank line). However, that message may not necessarily contain two consecutive EOL sequences of any type anywhere. David Franco-Rocha - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 5:45 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line I do not understand why you need to rewrite the message beyond what you already do? Just determine the end of headers properly then rewrite the message with your headers in the proper location. You already rewrite the message when adding headers so why would it take any longer to properly detect the end of headers. If you have two LF sequences next to each other ignoring the CR then you have the end of headers. For example if you have CRLFCRLF OR LFCRLFCR OR LFLF I have never seen a message use CR alone for an end of line. There are two LF bytes in each sequence ignore the CR bytes. Then when writing out the message with the Declude headers include the original byte sequences for each line. And the Declude lines should have the proper CRLF sequences. My two cents! Kevin Bilbee 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ping
pong - Original Message - From: Shaun Patterson To: declude.junkmail@declude.com Sent: Tuesday, June 13, 2006 4:06 PM Subject: [Declude.JunkMail] ping ping ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted address getting trapped anyway
The WHITELIST FROM directive uses the sender of the message as specified in the message envelope (MAIL FROM:[EMAIL PROTECTED]), which may or may not correspond to the From: line in the headers of the message itself. In this case, it did not. The filters operate on the message file, not on the envelope. That is why you can have different results like in this case. The X-Declude-Sender: x-header is the sender as specified in the envelope. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Thursday, March 16, 2006 12:00 PM Subject: Re: [Declude.JunkMail] Whitelisted address getting trapped anyway You might need WHITELIST from .xx.com (the smtp sender address looks to be in the fromat [EMAIL PROTECTED]) - Original Message - From: Harry Vanderzand To: Declude.JunkMail@declude.com Sent: Saturday, March 18, 2006 10:17 AM Subject: [Declude.JunkMail] Whitelisted address getting trapped anyway have an addres that I have whitelisted WHITELIST FROM @.com in global.cfg Yet somehow it got marked as spam There was a matchin a filter file How is this possible? Should whitelisting not take precedence? See headers below Received: from mailface.roving.com [63.251.135.75] by intown.net with ESMTP (SMTPD-8.22) id A17A068C; Fri, 17 Mar 2006 14:43:54 -0500Received: from ws06 (unknown [10.200.200.61])by mailface.roving.com (Postfix) with ESMTP id 8224448C003for [EMAIL PROTECTED]; Fri, 17 Mar 2006 14:42:37 -0500 (EST)Message-ID: [EMAIL PROTECTED]Date: Fri, 17 Mar 2006 14:43:53 -0500 (EST)From: Ken Weinberg [EMAIL PROTECTED]Reply-To: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: We Need Your InputMIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_Part_13064663_1921543487.1142624633764"X-Roving-Queued: 20060317 02:43:53.764X-Mailer: Roving Constant Contact 0 (http://www.constantcontact.com)X-Return-Path-Hint: [EMAIL PROTECTED]X-Roving-ID: 1101247029557X-Lumos-SenderID: 1011230829116X-Roving-CampaignId: 1101247029557X-Roving-StreamId: 0X-Declude-Sender: [EMAIL PROTECTED] [63.251.135.75]X-Declude-Spoolname: D11790199df6a.smdX-Note: Total spam weight of this E-mail is 22.X-Note: Spam Tests Failed: FIVETEN-BULK [3], MYFILTER [19], WEIGHT10 [10], WEIGHT11 [11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19]X-Note: REMOTEIP: 63.251.135.75X-Note: REVDNS: mailface.roving.comX-Note: FROM: [EMAIL PROTECTED]X-Note: TO: X-Spam-Tests-Failed: FIVETEN-BULK, MYFILTER, WEIGHT10, WEIGHT11, WEIGHT12, WEIGHT15, WEIGHT19 [22]X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 428964605X-IMail-ThreadID: 11790199df6a Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
[Declude.JunkMail] Headers / MIME Attachments
With reference to the problem reported regarding the detection of attachments in email, please be advised that we are looking into this issue today. David Franco-Rocha Declude Technical / Engineering --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AVAFTERJM
When scanning for viruses after JunkMail through use of the above directive, the following rule applies: All email will continue to be scanned for viruses EXCEPT those emails having a final JunkMail action of: HOLD DELETE David Franco-Rocha Declude Technical / Engineering --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamdomains test
Stu, The spamdomains test uses the mailfrom address. Declude derives all its sender and recipient information from the envelope, not the message headers. David Franco-Rocha Declude Technical / Engineering - Original Message - From: [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, January 06, 2006 10:50 AM Subject: [Declude.JunkMail] Spamdomains test Does the Spamdomains tests use the mailfrom or the From: address to compare to the revdns. I'm betting it is the mailfrom address. Thanks Stu --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] V3 updated filter files
Markus, There is currently no need to restart the Decludeproc service when you change a filter or configuration file; files are read for each message processed, just as with the versions of Declude prior to 3.x. This will not always be the case, however, as we continue to streamline and modify the product. If and when it becomes necessary to restart the service after file modification, we will make it clear to our users. You should be aware of the diags.txt file that is created by the Decludeproc service. It is created once, after the service has started and the first email has been processed. It is not created again, unless the service is restarted. So, if you modify your global.cfg while the Decludeproc service is running, the changes will be seen immediately by the system, but the changes will not be reflected in the diags.txt file unless the service is restarted. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, January 05, 2006 7:30 AM Subject: [Declude.JunkMail] V3 updated filter files Question: what files in v3 are read once durring service startup and what files are read for each message. For example what happens if I update certain text filter files but do not restart the decludeproc ? Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hardware Issue
Don, Your license to run the software does not expire. What does expire is your right to download new updates of the software. David Franco-Rocha Declude Technical / Engineering - Original Message - From: [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, December 27, 2005 7:13 PM Subject: Re: [Declude.JunkMail] Hardware Issue David, Thanks for the response but I only understand part of your answer. An expired license agreement is not equal to an expired license to run the software. I know when I have an expired license agreement but when does my license to run the software expire? Don - Original Message - From: David Franco-Rocha [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, December 27, 2005 5:50 AM Subject: Re: [Declude.JunkMail] Hardware Issue An expired license agreement is not equal to an expired license to run the software. It simply does not allow you to update the software, but you can continue to run the version you have been running. David Franco-Rocha Declude Technical / Engineering - Original Message - From: [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, December 27, 2005 1:17 AM Subject: Re: [Declude.JunkMail] Hardware Issue I too have stayed at the 1.82 version while keeping my service contract up to date. I am not ambitious enough to work through all the 2.x and 3.x issues. A heart felt thank you goes out to those of you who are. With the new licensing policy in 3.x, what happens when I decide not to renew the service agreement? Will all the Declude software I have stop working? Am I paying for it's usage only while I have a valid service agreement? It used to be that the service agreement allowed me major version upgrades when they were available without paying an additional fee. Am I now paying for a license to use the software? Don - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 26, 2005 3:03 PM Subject: Re: [Declude.JunkMail] Hardware Issue Bottom line is we were told if the license server was offline we would not be impacted. It is seeming now that that statement was not true, though I should withhold judgement until we hear exactly why this had an impact. Very glad I've stuck with 1.82 at the moment, though we had a service agreement that entitled us to upgrade to 3.x. I would certainly like to know what will be done to the software licensing to make sure this problem does not happen again. Otherwise, since mail is considered a critical system, Declude needs to staff 24/7 to address problems as they arise. Darin. - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 26, 2005 3:50 PM Subject: RE: [Declude.JunkMail] Hardware Issue True, very true. But like Andy or Darrell said, they should have done a test by pulling the plug on their license server during the week when they were watching it to see what would happen. But of course, hind sight is always 20/20 and Monday morning quarterbacking is highly overrated. ;-) John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Don Brown Sent: Monday, December 26, 2005 12:44 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Hardware Issue Software and hardware breaks. Nothing is bulletproof. Some are just better than others. Monday, December 26, 2005, 11:50:20 AM, John T (Lists) [EMAIL PROTECTED] wrote: JTL JTL JTL JTL OUCH! JTL JTL JTL JTL Gee, I thought this is the kind of thing that we were told no way would happen. JTL JTL JTL JTL JTL John T JTL JTL eServices For You JTL JTL JTL JTL JTL JTL -Original Message- JTL From: [EMAIL PROTECTED] JTL [mailto:[EMAIL PROTECTED] On Behalf Of David Franco- Rocha JTL Sent: Monday, December 26, 2005 9:29 AM JTL To: Declude.JunkMail@declude.com JTL Cc: Declude.Virus@declude.com JTL Subject: [Declude.JunkMail] Hardware Issue JTL JTL JTL JTL JTL Due to the long holiday weekend, we have been away from the JTL office for a few days. Unfortunately it has come to our attention JTL that there could be a problem with key validation on the server JTL there. After some testing, we have determined that there is in JTL fact a hardware issue that we expect to have resolved today. JTL JTL JTL JTL JTL JTL JTL JTL We appreciate that you have taken the time to bring this matter JTL to our attention and appreciate your patience while we rectify JTL the situation. We will once again post to this list
Re: [Declude.JunkMail] DEBUG log oddity
Goran, That was something added awhile back. I have it on a list of modifications to delete those header lines from the log files. They destroy the format of the file (such as it is). David Franco-Rocha Declude Technical / Engineering - Original Message - From: Goran Jovanovic [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 26, 2005 11:58 PM Subject: [Declude.JunkMail] DEBUG log oddity I noticed that when I was running declude in debug mode I would periodically get my message headers dumped into the log as well. Not every message but just some of them. This appears to happen only during debug mode. Has anyone else seen this? Does anyone have any idea why some of the headers would be put into the log? Thanks Goran Jovanovic Omega Network Solutions --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hardware Issue
An expired license agreement is not equal to an expired license to run the software. It simply does not allow you to update the software, but you can continue to run the version you have been running. David Franco-Rocha Declude Technical / Engineering - Original Message - From: [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, December 27, 2005 1:17 AM Subject: Re: [Declude.JunkMail] Hardware Issue I too have stayed at the 1.82 version while keeping my service contract up to date. I am not ambitious enough to work through all the 2.x and 3.x issues. A heart felt thank you goes out to those of you who are. With the new licensing policy in 3.x, what happens when I decide not to renew the service agreement? Will all the Declude software I have stop working? Am I paying for it's usage only while I have a valid service agreement? It used to be that the service agreement allowed me major version upgrades when they were available without paying an additional fee. Am I now paying for a license to use the software? Don - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 26, 2005 3:03 PM Subject: Re: [Declude.JunkMail] Hardware Issue Bottom line is we were told if the license server was offline we would not be impacted. It is seeming now that that statement was not true, though I should withhold judgement until we hear exactly why this had an impact. Very glad I've stuck with 1.82 at the moment, though we had a service agreement that entitled us to upgrade to 3.x. I would certainly like to know what will be done to the software licensing to make sure this problem does not happen again. Otherwise, since mail is considered a critical system, Declude needs to staff 24/7 to address problems as they arise. Darin. - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, December 26, 2005 3:50 PM Subject: RE: [Declude.JunkMail] Hardware Issue True, very true. But like Andy or Darrell said, they should have done a test by pulling the plug on their license server during the week when they were watching it to see what would happen. But of course, hind sight is always 20/20 and Monday morning quarterbacking is highly overrated. ;-) John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Don Brown Sent: Monday, December 26, 2005 12:44 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Hardware Issue Software and hardware breaks. Nothing is bulletproof. Some are just better than others. Monday, December 26, 2005, 11:50:20 AM, John T (Lists) [EMAIL PROTECTED] wrote: JTL JTL JTL JTL OUCH! JTL JTL JTL JTL Gee, I thought this is the kind of thing that we were told no way would happen. JTL JTL JTL JTL JTL John T JTL JTL eServices For You JTL JTL JTL JTL JTL JTL -Original Message- JTL From: [EMAIL PROTECTED] JTL [mailto:[EMAIL PROTECTED] On Behalf Of David Franco- Rocha JTL Sent: Monday, December 26, 2005 9:29 AM JTL To: Declude.JunkMail@declude.com JTL Cc: Declude.Virus@declude.com JTL Subject: [Declude.JunkMail] Hardware Issue JTL JTL JTL JTL JTL Due to the long holiday weekend, we have been away from the JTL office for a few days. Unfortunately it has come to our attention JTL that there could be a problem with key validation on the server JTL there. After some testing, we have determined that there is in JTL fact a hardware issue that we expect to have resolved today. JTL JTL JTL JTL JTL JTL JTL JTL We appreciate that you have taken the time to bring this matter JTL to our attention and appreciate your patience while we rectify JTL the situation. We will once again post to this list when the issue has been corrected. JTL JTL JTL JTL JTL JTL JTL JTL Declude Technical / Engineering JTL JTL JTL JTL JTL JTL JTL JTL JTL Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com
[Declude.JunkMail] Hardware Issue
Due to the long holiday weekend, we have been away from the office for a few days. Unfortunately it has come to our attention that there could be a problem with key validation on the server there. After some testing, we have determined that there is in fact a hardware issue that we expect to have resolved today. We appreciate that you have taken the time to bring this matter to our attention and appreciate your patience while we rectify the situation. We will once again post to this list when the issue has been corrected. Declude Technical / Engineering
[Declude.JunkMail] Declude Hardware Issue
Please note that the hardware issue preventing communication with Declude has been resolved. Key authentication has resumed as normal. There appear to be some misconceptions on the lists regarding the key authentication system. In the event that your key cannot be authenticated (either due to communication failure or because the key was never issued): A) Your software will continue to function B) Your software is NEVER downgraded for any reason, either automatically or otherwise We have had a few reports from customers who have licensed versions of Pro, saying that they are receiving messages in their log files that they do not have the Pro version. We will identify the source of that issue tomorrow when the office reopens and will resolve it. It does not have any relation to the key authentication mechanism with the server, since the actual authentication with IMail versions of Declude continues to be via the old codes entered into the configuration files. David Franco-Rocha Declude Technical / Engineering
[Declude.JunkMail] Fixed: SPF False Positives
The issue of false positives with the SPF test, reported by a couple of people, has been fixed. This will be included in the next release of the software (post 3.0.5.18). David Franco-Rocha Declude Technical / Engineering --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Excluding domains form tests
Dean, There is currently no way to exclude emails from being scanned by Declude. All emails are checked; only the actions taken can vary by domain. We may provide finer tuning of that as a future enhancement. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Dean Lawrence To: declude.junkmail@declude.com Sent: Tuesday, November 08, 2005 9:04 AM Subject: [Declude.JunkMail] Excluding domains form tests I thought that I had this working properly, but now I'm not too sure. My setup is to by default not to have mail scanned by Junkmail and to only scan domains that I have set-up per-domain rules. All of my tests are defined in my global.cfg file and all test actions in my master $default$.junkmail are commented out. Then in in each domain directory, I have a separate $default$.junkmail mail which defines the action for each individual domain. What I am seeing in my logs though, is that every message that hits my Imail server (8.21) is being tested. The only difference from the per-domain emails is that the action for all of the tests is IGNORE. Other than whitelisting all of my other domains, is there a way to save on processing by not having these message evaluated? I am running Junkmail 3.05.18. Thanks, Dean-- __Dean Lawrence, CIO/PartnerInternet Data Technology888.GET.IDT1 ext. 701 * fax: 888.438.4381http://www.idatatech.com/Corporate Internet Development and Marketing Specialists
Re: [Declude.JunkMail] testing mailserver
Bonno, The text actually did appear as the body of the email. The problem was that the headers were added after the body, which has been an ongoing problem. Declude was not able to determine where the headers actually ended and the body began, so it only *looks* like the text is not in the body. Please send the actual message file as an attachment to [EMAIL PROTECTED] so that we can look at the raw data format of the message. With regard to these broken emails where headers are placed in the wrong location, we are still doing some testing and expect to have a solution very shortly. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Bonno Bloksma To: Declude.JunkMail@declude.com Sent: Wednesday, November 02, 2005 6:31 AM Subject: [Declude.JunkMail] testing mailserver Hi, I was testing our mailserver by setting up a telnet session on port 25 and then entering the commands. I must have done something realy wrong as my tekst appears in the headers in a way not even Outlook Express can see. ;-0 It will show a blank message. This is wat was delivered to me: Received: from TEST [194.109.165.42] by tio.nl (SMTPD-8.21) id AE3902D0; Wed, 02 Nov 2005 12:08:41 +0100dit is een testX-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c200041].X-Declude-Sender: [EMAIL PROTECTED] [194.109.165.42]X-Declude-Spoolname: D9DFC01B0059C.SMDX-Declude-Note: Scanned at tio.nl by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam.X-Declude-Scan: Score [8] at 12:09:30 on 02 Nov 2005X-Declude-Tests: BADHEADERSX-Country-Chain: NETHERLANDS-destination---[E-mail scanned at tio.nl for viruses by Declude Virus]From: [EMAIL PROTECTED]Date: Wed, 2 Nov 2005 12:09:30 +0100X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 383765952X-IMail-ThreadID: 9dfc01b0059c See the "dit is een test" below the received from line? This is what I did: Start (Windows) telnetset LOCAL_ECHOopen mail.tio.nl 25HELO TESTMAIL FROM:[EMAIL PROTECTED]RCPT TO:[EMAIL PROTECTED]DATAdit is een test.QUIT Did I make a BIG mistake? I know I should have added a msgid somewhere and a date line to have a proper valid message but is that nessecary in order to have the text after the DATA command appear as the body part of a mail? I'm using Declude 2.0.6 Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool toerisme en hospitality julianalaan 9 / 7553 ab hengelo t 074 255 06 10 / f 074 255 06 16 [EMAIL PROTECTED] / www.tio.nl
Re: [Declude.JunkMail] Headers showing up in the body on 3.05.10
Testing thus far has not yet returned any errors in determining the actual end of the headers. The resolution of this issue was not as simple as it may have appeared to some. The search for cr/lf/cr/lf or lf/lf was not sufficient because of the nature of these messages. Some lf sequences, even within the same message, may have been preceded by cr and others not. In addition, only by looking at hexdumps of actual messages did the culprit sequences become clearer. One of the more recent was a cr/lf/space/lf and /cr/lf/tab/lf or a string of invisible characters between the unreliable line terminators. Sometimes there are mixes of spaces and tabs or multiples of each. We anticipate including this fix in the next interim release. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Mark Smith [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, October 28, 2005 7:55 AM Subject: FW: [Declude.JunkMail] Headers showing up in the body on 3.05.10 David, Just for follow-up. As I posted earlier we reverted back to 2.6 from 3.6.11 and 99% of these headers in the body messages are gone. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Smith Sent: Tuesday, October 25, 2005 4:54 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10 David, Thanks for the explanation! However, I have yet to see a message with SMTP headers in the body if I remove Declude and send mail directly into Exchange. Maybe Exchange will just not deliver? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, October 25, 2005 3:27 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Headers showing up in the body on 3.05.10 In every instance that we have observed so far the headers in the body are caused by broken mail clients. This is not only an issue for Declude but for mail servers as well. To illustrates the difficulty coming up with a single algorithm that will detect all instances of these broken emails to prevent headers from appearing at the end of a message or within the body of a message. RFC dictates all lines must end with a CR/LF sequence, with a double sequence CR/LF/CR/LF separating the headers from the body. Technically, that would be a 0D 0A 0D 0A sequence. In the byte sequence below, the sixth line contains: 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 where a single 0A is followed by a space and then the required 0D 0A sequence. When this problem was first reported, changes were made in the source to detect a simple 0A as a line terminator, followed by another line terminator sequence. However, this example would not get detected because they inserted a space, which is invisible, between the two line termination sequences. They could have inserted a tab (09) also, so checking only for a space would not have caught all possibilities. In addition, checking only for spaces at the beginning of a line would not solve the problem because certain header lines can be continued on the next line, which requires spaces and then non-blank characters prior to the next line termination sequence. 30 38 3A 35 37 3A 31 33-20 2D 30 35 30 30 0D 0A 4D 49 4D 45 2D 56 65 72-73 69 6F 6E 3A 20 31 2E 30 0D 0A 43 6F 6E 74 65-6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 70 6C-61 69 6E 3B 0D 0A 09 63 68 61 72 73 65 74 3D 22-75 73 2D 61 73 63 69 69 22 0A 20 0D 0A 49 20 73-74 61 72 74 65 64 20 68 61 76 69 6E 67 20 61 6E-20 61 66 66 61 69 72 20 77 69 74 68 20 61 20 79-6F 75 6E 67 65 72 2C 20 Often from the outset these issues look extremely simple. However, because all eventualities that have to be covered it becomes quite complex. I am providing this example because things are rarely as simple as they may at first appear. With all that said we are looking into providing a solution for this problem. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, October 24, 2005 9:07 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Headers showing up in the body on 3.05.10 This looks like Declude was expecting to see an occurrence of Blank Folding, but it is making the mistake of detecting headers in the MIME segments or the body as a continuation of the real headers, either that or they changed the code that detects where to throw in the Declude generated headers in order to handle Blank Folding. IMO, Declude should just throw the headers just before the location of the first CRLFCRLF or possibly following a mistaken LFLF. I haven't seen any Declude headers in the body using 2.0.6.16 and earlier. Matt Robert Grosshandler wrote: This has been a problem for awhile (happened with the move to the new architecture, but Declude says it's
[Declude.JunkMail] Declude with SmarterMail 3.0
The 3.0 version of SmarterMail, yet to be released, will pass authentication information to Declude. For those of you who have been patiently waiting to implement WHITELIST AUTH with SmarterMail, please be advised that Declude will support that functionality with SmarterMail 3.0. David Franco-Rocha Declude Technical / Engineering --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bug: HOP directive
We have discovered a bug in 3.x if you omit the HOP directive in your global.cfg file. The default value will be invalid if the directive does not appear in your configuration file. Instead of omitting the directive altogether, you must specify HOP 0. This will be corrected in the next interim release to default properly to HOP 0 if the directive is omitted. David Franco-Rocha Declude Technical / Engineering --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Headers in Body or at End of Message
We are preparing to test an algorithm to eliminate the problem whereby headers were inserted into the body of a message or at the end of the message. If you have any examples of emails like these, please send them as attachments to [EMAIL PROTECTED]. We would like to run as many as possible through the test program to check that the start of the body is accurately detected. Thanks. David Franco-Rocha Declude Technical / Engineering
[Declude.JunkMail] Headers in Body or at End of Message
We are preparing to test an algorithm to eliminate the problem whereby headers were inserted into the body of a message or at the end of the message. If you have any examples of emails like these, please send them as attachments to support at declude.com. We would like to run as many as possible through the test program to check that the start of the body is accurately detected. Thanks. David Franco-Rocha Declude Technical / Engineering
Re: [Declude.JunkMail] Server Running at 100%
AVAFTERJM ON must be in the virus.cfg file (if it is used) and it does require the ON parameter. David Franco-Rocha - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, September 08, 2005 9:08 PM Subject: Re: [Declude.JunkMail] Server Running at 100% I'm confused. The page in the Knowledge Base http://support.declude.com/Customer/KBArticle.aspx?articleid=11 Now I am too - I had no idea there was a knowledge base now :) says to put it in the global.cfg file. It also says nothing about adding the ON switch. I even exchanged emails with Declude support back on Aug. 2 stating that I was putting AVAFTERJM in my global.cfg file, and support never mentioned that I should have put it in the virus.cfg file, nor was anything said about PRESCAN. Placing it in your global.cfg is wrong. It needs to be in your virus.cfg. Prescan is a seperate feature that if it basically detects no attachments or harmful code it will skip scanning the message period. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Original Message From: David Barker [EMAIL PROTECTED] Sent: Thursday, September 08, 2005 12:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Server Running at 100% In your virus.cfg file: AVAFTERJM ON Also ensure that you have the directive: PRESCANON David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Thursday, September 08, 2005 11:56 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Server Running at 100% Importance: High I was told to see if using AVAFTERJM would help on resources on my server...right now I almost dead in the water..my server is cralling to send mailhow do I use this command...exactly how does it go into the config.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: Richard Farris mailto:[EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, August 04, 2005 11:21 AM Subject: [Declude.JunkMail] Spam box Is there a box I can put in front of my Imail server that will help take some of the load off of the spam filtering that Declude is doing Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude and IMail 8.2
Todd, The engineering staff here at Declude has no role in the development or maintenance of the web site. Our sole priority in engineering is the maintenance and development of the product. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Todd [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, August 24, 2005 11:27 AM Subject: Re: [Declude.JunkMail] Declude and IMail 8.2 While I don't see the guys at Declude drinking beer, I do see them updating their website and marketing sales. Its a matter or priorities. 3 months may be acceptable for software development, but for a major bug I do not see it as acceptable. And I don't think Scott would have ever let it go this long. IMail has released patches for 8.2 and that may cloud the issue, but that means Declude has to stay focused. It would be better to clearly communicate they have an issue to there client base, which they did not, and then create a fix for a particular version of 8.2, rather than chase IPSwitch and every version they produce over a period of a year. If IPSwitch releases another patch will it delay the Declude fix for several more months while they correct the code for the new version? The people that will have this problem are most likely the ones with current service agreements, at least with IPSwitch, the ones paying money to stay on top of the software. Declude should keep this in mind. - Original Message - From: Michael Jaworski [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, August 23, 2005 9:56 PM Subject: RE: [Declude.JunkMail] Declude and IMail 8.2 Heimir, You may want to consider using this list as your first line of defense. This is the best place to learn of new issues which are brought to everyone's attention by folks who are in the trenches. Keep in mind not everyone here has the latest version and not everyone is using iMail. I would not expect Declude to keep track of what is going on with my particular e-mail servers. I prefer them to spend all resources keeping up with the spammers. A few have made mention of the delay getting out this fix. It hurts when you are the one who is being impacted by an issue. I have been there but in the end I know they will find a fix and get it implemented as soon as possible. I don't see the folks at Declude sitting around drinking beer and working issues when they feel like it. From my experience in the software developing cycle 3 months for a major change is fast. Keep in mind they need to test and retest all those features we have requested over the years. Add the issue of iMail changing their software and then balance it out with what we pay for maintenance ... I am happy they are still in business constantly working and listening to us to update their product(s). Best to not play victim but actively monitor this anti-spam community created by Scott and driven by a lot of knowledgable, talented and hard working customers. And maintain your maintenance agreement. Small price to pay for what the product does for my customers. Michael Jaworski Puget Sound Network, Inc. (206) 217-0400 (800) 599-9485 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir Eidskrem Sent: Tuesday, August 23, 2005 5:43 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude and IMail 8.2 Thank you for the update. It concern me that I can't find the email notifying your customer about this bug. Could you tell me when it was sent so I can find it and make sure I am not holding this type of emails. They are critical to us so I will put some effort in making sure I get them. Its been over 2.5 months. The fix will not be available for some time according your email. This is a very long time and frankly I think it makes Declude look very bad. I think there have been plenty of complaints about Declude lately. It seems that your reputation is getting a little tarnished. [EMAIL PROTECTED] wrote: Thank you for you posts. We understand your frustration; here are the facts so there is no confusion. 1. This is NOT a bug in Declude. Ipswitch made changes to their IMail architecture, making it incompatible with Declude and this requires a fundamental re-write of Declude not a 10 minute fix. 2. As soon as we were aware of these changes we began development to modify Declude to work with IMail 8.2. 3. It has been our priority and focus since we first identified the problem. 4. In order to deliver a quality product, sufficient testing needs to be done to ensure customer satisfaction. Since identification of the issue additional patches have been released by Ipswitch meaning additional testing and development has been required. 5. This is not an issue of interim releases as Declude product architecture has had to change making it very different from earlier versions of Declude. 6. This is not an issue of having Scott
Re: [Declude.JunkMail] Whitelisting
Richard, The problem here is, first of all, that Declude does not look at the cc: or bcc: in the headers. It deals with recipients of the email solely on the basis of what is in the message envelope (q*.smd file), which is discarded by IMail after processing; all you eventually see is the contents of the message itself (the d*.smd file). Whitelisting ensures that the email will pass all tests. Under optimal circumstances, if an email source or destination is whitelisted, all tests should be skipped. If there are two recipients and only one were whitelisted, the headers of te email would have to indicate a whitelisted weight of 0 for one recipient and the actual weight for the other (non-whitelisted) recipient. That would necessitate two different sets of headers, which would require two separate message files and therefore two separate envelopes: If the non-whitelisted weight exceeded the HOLD threshold, one copy of the email would be placed into the HOLD folder with the envelope modified for that single recipient; the other would be whitelisted and the held recipient would be deleted from that envelope. In other words, Declude would have to generate multiple emails from a single email, which is not practical. How would Declude assign a new queue number to the duplicate email? If one recipient were whitelisted and the other had a weight of 5 (to be delivered), there would be different sets of headers and therefore different emails. They could not both have the same queue number because they could no be placed into the spool at the same time (one would overwrite the other). The email server generates a separate copy of the email for each recipient after processing by Declude. However, there is no practical way for Declude to create multiple emails from a single message. David Franco-Rocha Declude Technical Support - Original Message - From: Richard Farris To: Declude.JunkMail@declude.com Sent: Monday, July 25, 2005 4:24 PM Subject: [Declude.JunkMail] Whitelisting I just took out all the email addresses I had whitelisted in my Global file last week because I thought this would helpstop more spam getting thruand of course folks are now emailing me saying they are missing mail..newsletters and such... My question is "Why is it not possible with Declude to whitelist an email address and it only applies to that email address and not any others that might be in CC or BCC"? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Monday, July 25, 2005 1:47 PM Subject: Re: [Declude.JunkMail] Filter not triggering Kevin,Just a thought if you wanted to confirm this as a bug, maybe try a filter for this same message, but match a full word to see if it triggers. I did decode this segment and there is no additional encoding or other tricks that would cause a filter to not hit.IMO, knowing about bugs like this would be very helpful at times, especially considering the time that it would take each one of us that was affected by it to figure it out on our own. Maybe if Declude doesn't want to post this information on their site, we could take it upon ourselves to share such information with the list when it is discovered. This is for the most part how the list used to function in the old days, though most of us seemed to desire a page dedicated to the topic regardless.MattKevin Bilbee wrote: Well that would explain why many of my filters are not as effective as they used to be. Has Declude announced when the fix will be available Kevin Bilbee -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John CarterSent: Monday, July 25, 2005 8:05 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Filter not triggering I have reported to Declude a problem with the "CONTAINS" statement. Prior to 2.0.6 (or somewhere around there)it worked oncharacter match, but after an upgrade to Declude it only works on a word match. (In other words you could not longer match on a string of characters within a word.) This would affect your situation. I believe the fix is caught up in the wait for the newest version (the one they are testing now.) John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin BilbeeSent: Monday, July 25, 2005 9:10 AMTo: JunkMail DecludeSubject: [Declude.JunkMail] Filter not triggering The attache
Re: [Declude.JunkMail] custom delivery executable?
Darrell, This would not work with Declude because Declude uses imail1.exe to send out the notification messages for viruses. All such notifications, instead of going to the intended recipient, would likewise go to this text file. There may be other ways in which it might interfere with Declude, but this struck me as the most obvious. David Franco-Rocha Declude Technical Support - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, June 23, 2005 11:44 AM Subject: Re: [Declude.JunkMail] custom delivery executable? Or another thought to try is renaming your custom delivery app to imail1.exe and replacing theirs. Althought I am not sure what else this would break. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Darin Cox writes: You could change all email addresses to be program aliases. The batch file run by the program alias could then dump the message into a text file, or even post the message straight into your database. Darin. - Original Message - From: Chase Seibert To: Declude.JunkMail@declude.com Sent: Thursday, June 23, 2005 9:53 AM Subject: [Declude.JunkMail] custom delivery executable? Hey guys, We have a very non-standard iMail/Declude install. Basically, we only us the system for the SMTP protocol, as well as virus and spam filtering. Once a message has passed through those systems, it's delivered to a mailbox as normal. However, we don't allow POP or IMAP access to our systems. Instead, we parse the mailboxes when they change, pull out new mail and insert it into a SQL Server database for access in our web-based CRM. Messed up, huh? We are looking to skip the whole step of delivering the mail to a mailbox and then chunking it out. It's not a speed problem, but rather a reliability concern. Our current solution has about a .1% failure rate, meaning that some messages are not delivered until the next message comes along into that folder to knock it out. Ok, here is my question. I am wondering if there is some way to setup iMail/Declude so that it delivers a message right to a stand alone file, as apposed to a mailbox. Qmail, for example, can do this. I doubt there is any out of the box support for this, so I started investigating using a custom Declude filter for this. From the manual: For more flexibility, you can have Declude JunkMail pass parameters to your program, using variables. For example, you can set up the test as 'TESTNAME external returnvalue filename %INOROUT%', which would send the %INOROUT% variable as a parameter to your program (which would be incoming for an incoming E-mail, or outgoing for an outgoing E-mail). Presumably, we could write a custom executable and define a rule for it in Junkmail. The custom executable would get the entire message body and just pipe it to a stand-alone file. If the message was later also delivered to an iMail mailbox, that's fine. However, I think the issue with that idea is that the filters will not have executed when that custom executable is called. Accoring to the Declude manaul, the order of execution is: 1. IMail's Control Access file (to block IPs) 2. IMail's Kill List (to block return addresses) 3. IMail v8 anti-spam (most tests) 4. Declude Virus 5. Declude Hijack 6. Declude JunkMail 7. IMail's filters and extra IMail v8 anti-spam tests *we want to insert a custom exectuable here Is this even possible, or should I just start looking as Linux mail systems? -Chase Chase Seibert | Network and Systems Engineer | Bullhorn Inc | 617.464.2440 x119 | www.bullhorn.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Log file errors
David, I will get back to you (and the list) on this by Monday. I have to scan the entire Declude source tree for these types of messages and will let you know. David Franco-Rocha Declude Technical Support - Original Message - From: David Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, June 24, 2005 10:13 AM Subject: Re[2]: [Declude.JunkMail] Log file errors Hello Dan, Friday, June 24, 2005, 9:50:10 AM, you wrote: DH SERVFAIL means that the domain does exist and the root name servers have DH information on this domain, but that the authoritative name servers are DH not answering queries for this domain. Great, thanks Dan. Now, Declude...are there any other conditions whereby Declude puts a Warning in the log file that is related to the functioning of the actual Declude software? We monitor log files for the words ERROR or WARNING. In this case, this warning is fairly normal operation of Declude. If software related issues are only logged under ERROR then we'll drop the WARNING monitoring. DS 06/22/2005 00:39:15 Qeb72438900c4923f WARNING: DNS server DS 66.179.12.115 returned a SERVER FAILURE error for MX or A for DS fadmail.com. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST LOCAL v2.0.6.12
I expect to have the fix for this issue available tomorrow. David Franco-Rocha Declude Technical Support - Original Message - From: Shayne Embry [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, May 11, 2005 4:14 PM Subject: RE: [Declude.JunkMail] WHITELIST LOCAL v2.0.6.12 We had the same problem with v2.0.6.10. Contacted support about it, but haven't gotten a firm answer. Shayne -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Brown Sent: Wednesday, May 11, 2005 2:59 PM To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] WHITELIST LOCAL v2.0.6.12 I added WHITELIST LOCAL to the Global.cfg and all (and I mean ALL) inbound e-mail to local users was whitelisted. My read was that this would whitelist e-mail from local users to other local users. Is that not correct? Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Split headers
John, This problem was reported previously to us and has been corrected in the latest interim release. It is caused by broken mail clients that do not terminate header lines with the required cr/lf sequence. David Franco-Rocha Declude Technical Support - Original Message - From: John Carter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 09, 2005 9:08 AM Subject: [Declude.JunkMail] Split headers While reviewing some held emails, I have seen messages with what I'll call split headers -- as in the normal header lines are at the beginning of the msg file and the Declude headers are the end of the msg file with the msg body in between. My question is will this mess up any test results, esp. using filters with MAILFROM, etc.? John --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT - headers script for Outlook or Express
Not sure about Outlook. Outlook Express cuts off most headers if you use the Forward icon. Instead, select Message from the top-level menu and then select Forward As Attachment. The forwarded email will have all the headers intact. David Franco-Rocha Declude Technical Support - Original Message - From: Fritz Squib [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, May 06, 2005 1:09 PM Subject: RE: [Declude.JunkMail] OT - headers script for Outlook or Express Try http://www.xintercept.com/pkpeek.htm, only works with Oultook though. I've posted the link here a couple of times before. Fritz Frederick P. Squib, Jr. Network Operations Citizens Telephone Company of Kecksburg http://www.wpa.net () ascii ribbon campaign - against html email /\- against microsoft attachments -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Friday, May 06, 2005 12:46 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT - headers script for Outlook or Express Anyone have any ideas how to give challenged users a really easy way to get the headers out of Outlook or Outlook express and forward them to my spam account? As soon as I start talking to most of them about right clicking, copying, pasting etc they get this strange blank look on their face... Also I thought a report spam button on the IMAIL web interface that would copy the full headers, and forward them and the e-mail to a pre-determined address wouldn't be to hard, anyone have anything like this? Or any suggestions on how to get the headers from spam that gets through the all the filters? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- [This E-mail scanned by Citizens Internet Services with Declude Virus.] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[6]: [Declude.JunkMail] Imail 8.2 / smartermail
Dave, This was a problem when we first implemented Declude with SmarterMail. The spool manager would show files in the spool, even after we had deleted them. The only way to get rid of them was to bring down the SM services and then restart them. Then the files no longer appeared in the spool. I believe that SmarterTools has now rectified that. - Original Message - From: Dave Doherty [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 02, 2005 6:08 PM Subject: Re: Re[6]: [Declude.JunkMail] Imail 8.2 / smartermail However, the contents of the HDR file are retained in memory by SmarterMail. That sounds like it could lead to a memory leak. I tried SM as a SmartHost caching server and deleted all returns beforee SM could send them. About once a week I had to reboot the machine. Now I think I know why. -d - Original Message - From: David Franco-Rocha [ Declude ] [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 02, 2005 8:27 AM Subject: Re: Re[6]: [Declude.JunkMail] Imail 8.2 / smartermail See below. David Franco-Rocha - Original Message - From: David Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 29, 2005 5:28 PM Subject: Re[6]: [Declude.JunkMail] Imail 8.2 / smartermail Hello David, Friday, April 29, 2005, 4:55:53 PM, you wrote: DFRD No, there is not an inherent delay in the delivery of all messages. If DFRD Declude does not complete processing within a specified time period, DFRD SmarterMail tries to take the file. However, if Declude finishes processing So, does this mean that SM could process a file that Declude did NOT scan? That should not happen, since the message is passed to Declude by SmarterMail. Or, are you saying this moving the file in a different folder process prevents SM from EVER processing a file that Declude hasn't finished? No, I am not saying that at all. There are some unique aspects regarding the way SmarterMail processes messages that necessitate equally unique behavior on the part of Declude (unfortunately). When the incoming SMTP dialogue has been completed, SmarterMail creates the envelope file (HDR) and the message data file (EML). However, the contents of the HDR file are retained in memory by SmarterMail. The most significant negative effect of this behavior is that changes made by Declude to the envelope (re-routing a recipient, deleting a recipient, etc.) are not seen by SmarterMail; when SmarterMail regains control of the message it uses the envelope in memory and completely disregards any changes made to the envelope. To circumvent this behavior, Declude renames the HDR and EML files after processing by prepending X to the spool name prior to moving the message back to the SmarterMail spool. This causes SmarterMail to see this as a new message and reads a new envelope into memory. It eventually realizes that, in a sense, the old message has been deleted. Since this is seen as a new message by SmarterMail, it tries to pass it once again to Declude. However, Declude ignores all messages whose names begin with X because it knows they have already been processed. DF -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[6]: [Declude.JunkMail] Imail 8.2 / smartermail
See below. David Franco-Rocha - Original Message - From: David Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 29, 2005 5:28 PM Subject: Re[6]: [Declude.JunkMail] Imail 8.2 / smartermail Hello David, Friday, April 29, 2005, 4:55:53 PM, you wrote: DFRD No, there is not an inherent delay in the delivery of all messages. If DFRD Declude does not complete processing within a specified time period, DFRD SmarterMail tries to take the file. However, if Declude finishes processing So, does this mean that SM could process a file that Declude did NOT scan? That should not happen, since the message is passed to Declude by SmarterMail. Or, are you saying this moving the file in a different folder process prevents SM from EVER processing a file that Declude hasn't finished? No, I am not saying that at all. There are some unique aspects regarding the way SmarterMail processes messages that necessitate equally unique behavior on the part of Declude (unfortunately). When the incoming SMTP dialogue has been completed, SmarterMail creates the envelope file (HDR) and the message data file (EML). However, the contents of the HDR file are retained in memory by SmarterMail. The most significant negative effect of this behavior is that changes made by Declude to the envelope (re-routing a recipient, deleting a recipient, etc.) are not seen by SmarterMail; when SmarterMail regains control of the message it uses the envelope in memory and completely disregards any changes made to the envelope. To circumvent this behavior, Declude renames the HDR and EML files after processing by prepending X to the spool name prior to moving the message back to the SmarterMail spool. This causes SmarterMail to see this as a new message and reads a new envelope into memory. It eventually realizes that, in a sense, the old message has been deleted. Since this is seen as a new message by SmarterMail, it tries to pass it once again to Declude. However, Declude ignores all messages whose names begin with X because it knows they have already been processed. DF -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 8.2 / smartermail
Declude does not currently plug directly into SmarterMail's spam tools. They are completely separate. The MAILBOX directive used by Declude with IMail, whereby an email is moved to a specific user folder, is not available on the SmarterMail platform. When I have discussed this with SmarterMail, they have said that the recipient can move it himself to a particular folder on the basis of headers added to the message by Declude. David Franco-Rocha - Original Message - From: Jonathan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, April 28, 2005 10:57 PM Subject: Re: [Declude.JunkMail] Imail 8.2 / smartermail Darrell ([EMAIL PROTECTED]) wrote: Sidenote, I assume SmarterMail can act as a domain filtering gateway with Declude, right? Pretty sure I saw some marketing spam saying it could .. Yes, that is absolutly correct - Declude will work on Smartermail. So I was just playing with the SM web interface -- does Declude plug directly into SM's spam tools? If so, that looks pretty slick compared to hacked up scripts shuffling stuff into the right folders .. :) Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Imail 8.2 / smartermail
There is a very specific reason for this process. Unlike IMail, which provides for a daisy-chain mechanism whereby Declude gets the msg for processing and hands it back to smtp32 for delivery, SmarterMail passes the msg to Declude and, after a set period of time, tries to deliver it. Taking it out of the spool prevents SmarterMail from grabbing the file until Declude has finished with it. David Franco-Rocha - Original Message - From: David Sullivan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 29, 2005 3:42 PM Subject: Re[2]: [Declude.JunkMail] Imail 8.2 / smartermail I downloaded the SM/Declude demo, thinking of moving from Imail. One thing I noticed is that for each message, SM appeared to move it's version of the D/Q files from spool, to a processing folder and then process it. This seems like twice the necessary disk activity over just processing it from the /spool folder. Has anybody seen any SM performance hits vs. Declude because of this on a system handling 30k msgs/hr? (Assuming use of standard Imail best practices for disk utilization) -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[4]: [Declude.JunkMail] Imail 8.2 / smartermail
No, there is not an inherent delay in the delivery of all messages. If Declude does not complete processing within a specified time period, SmarterMail tries to take the file. However, if Declude finishes processing sooner, SmarterMail knows that the Declude process has terminated and delivers the email immediately. - Original Message - From: David Sullivan [EMAIL PROTECTED] To: David Franco-Rocha [ Declude ] Declude.JunkMail@declude.com Sent: Friday, April 29, 2005 4:34 PM Subject: Re[4]: [Declude.JunkMail] Imail 8.2 / smartermail Hello David, Friday, April 29, 2005, 4:27:38 PM, you wrote: DFRD msg to Declude and, after a set period of time, tries to deliver it. Taking DFRD it out of the spool prevents SmarterMail from grabbing the file until DFRD Declude has finished with it. So there is an inherent delay in the delivery of all messages? How long? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 8.20
Scott, No, Declude has not yet been tested with Imail 8.2, although we expect to begin some testing very shortly. We have been in the process of resolving some outstanding issues and preparing to do an interim release. It would have been counter-productive to introduce a new IMail platform in the midst of all of this. We are aware of a problem with one customer who has tried to use Declude with the beta of IMail 8.2 (attachment corruption). This customer also had problems with smtpd32 repeatedly going down, although this is not likely related to Declude. As soon as we have started testing and have any feedback regarding the results, we will post them for you. If any of you have any feedback you would like to provide to us, we would appreciate your letting us know about it. Thanks. David Franco-Rocha - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Thursday, April 28, 2005 7:51 AM Subject: [Declude.JunkMail] Imail 8.20 A question for Declude... Has Declude been tested with Imail 8.20?
Re: [Declude.JunkMail] Imail 8.20
These types of errors are not related to Declude. Authentication is handled directly with IMail during the SMTP dialogue. This issue has already surfaced in the IMail forum. David Franco-Rocha - Original Message - From: William Stillwell To: Declude.JunkMail@declude.com Sent: Thursday, April 28, 2005 10:28 AM Subject: Re: [Declude.JunkMail] Imail 8.20 I just upgraded.. NOT WORKING.. I am getting AUTH errors on sending to local users, and 550 Errors.. - Original Message - From: Jeff Frantz To: Declude.JunkMail@declude.com Sent: Thursday, April 28, 2005 9:37 AM Subject: RE: [Declude.JunkMail] Imail 8.20 I upgraded to v8.2 this morning and have had no issues. Im running Declude Virus and Junkmail v2.0.6. -Jeff From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan HorneSent: Thursday, April 28, 2005 9:07 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Imail 8.20 I upgraded yesterday to Imail 8.2 and so far the phones aren't ringing off the hooks. No reported problems from any of our users. I've tailed the logs and they all seem normal. I am running Declude Junkmail Pro/Virus Standard/Hijack 2.0.6. Dan Horne From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Franco-Rocha [ Declude ]Sent: Thursday, April 28, 2005 8:39 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Imail 8.20 Scott, No, Declude has not yet been tested with Imail 8.2, although we expect to begin some testing very shortly. We have been in the process of resolving some outstanding issues and preparing to do an interim release. It would have been counter-productive to introduce a new IMail platform in the midst of all of this. We are aware of a problem with one customer who has tried to use Declude with the beta of IMail 8.2 (attachment corruption). This customer also had problems with smtpd32 repeatedly going down, although this is not likely related to Declude. As soon as we have started testing and have any feedback regarding the results, we will post them for you. If any of you have any feedback you would like to provide to us, we would appreciate your letting us know about it. Thanks. David Franco-Rocha - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Thursday, April 28, 2005 7:51 AM Subject: [Declude.JunkMail] Imail 8.20 A question for Declude... Has Declude been tested with Imail 8.20?
Re: [Declude.JunkMail] Imail 8.20
There is really no problem posting this to the
JunkMail list. But, since it is specifically an IMail problem, make sure it is
at least cross-posted to the IMail list also.
David Franco-Rocha
- Original Message -
From:
William Stillwell
To: Declude.JunkMail@declude.com
Sent: Thursday, April 28, 2005 11:47
AM
Subject: Re: [Declude.JunkMail] Imail
8.20
I wasn't reffering to declude not working, There
is an issue with the odbc with
an external database, I was just informing people
there is a "Slight" issue with it.
I have posted the resolution for those that are
not aware.
Other than that, declude appears to be working
fine here.
- Original Message -
From:
David
Franco-Rocha [ Declude ]
To: Declude.JunkMail@declude.com
Sent: Thursday, April 28, 2005 10:44
AM
Subject: Re: [Declude.JunkMail] Imail
8.20
These types of errors are not related to
Declude. Authentication is handled directly with IMail during the SMTP
dialogue. This issue has already surfaced in the IMail forum.
David Franco-Rocha
- Original Message -
From:
William Stillwell
To: Declude.JunkMail@declude.com
Sent: Thursday, April 28, 2005 10:28
AM
Subject: Re: [Declude.JunkMail] Imail
8.20
I just upgraded.. NOT WORKING..
I am getting AUTH errors on sending to local
users, and 550 Errors..
- Original Message -
From:
Jeff Frantz
To: Declude.JunkMail@declude.com
Sent: Thursday, April 28, 2005 9:37
AM
Subject: RE: [Declude.JunkMail]
Imail 8.20
I upgraded to
v8.2 this morning and have had no issues. Im running Declude
Virus and Junkmail v2.0.6.
-Jeff
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan HorneSent: Thursday, April 28, 2005 9:07
AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail]
Imail 8.20
I upgraded
yesterday to Imail 8.2 and so far the phones aren't ringing off the
hooks. No reported problems from any of our users. I've
tailed the logs and they all seem normal. I am running Declude
Junkmail Pro/Virus Standard/Hijack 2.0.6.
Dan
Horne
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Franco-Rocha [
Declude ]Sent:
Thursday, April 28, 2005 8:39 AMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail]
Imail 8.20
Scott,
No, Declude has not yet
been tested with Imail 8.2, although we expect to begin some testing
very shortly. We have been in the process of resolving some
outstanding issues and preparing to do an interim release. It would
have been counter-productive to introduce a new IMail platform in the
midst of all of this. We are aware of a problem with one customer who
has tried to use Declude with the beta of IMail 8.2 (attachment
corruption). This customer also had problems with smtpd32 repeatedly
going down, although this is not likely related to
Declude.
As soon as we have started
testing and have any feedback regarding the results, we will post them
for you. If any of you have any feedback you would like to provide to
us, we would appreciate your letting us know about it.
Thanks.
David
Franco-Rocha
- Original Message
-
From:
Scott Fisher
To:
Declude.JunkMail@declude.com
Sent:
Thursday, April 28, 2005 7:51 AM
Subject:
[Declude.JunkMail] Imail 8.20
A question for
Declude...
Has Declude been tested
with Imail
8.20?
Re: [Declude.JunkMail] Multiple log lines per message
Kris, The R and L represent Remote and Local, respectively. From these log lines, it appears that there are in fact two recipients (maybe one of them is the copyall account). If you set your LOGLEVEL to DEBUG and send a similar message to a single recipient, the log file should then show the precise email addresses of each recipient. David Franco-Rocha - Original Message - From: Kris McElroy [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, April 27, 2005 1:01 PM Subject: [Declude.JunkMail] Multiple log lines per message I am running declude 2.04 and I have noticed that there are 4 log lines for every message? What would cause this? What is R1, L2? How many lines per message should I have? 04/27/2005 10:43:31 Qb31e34670094d8a5 R1 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=IGNORE BASE64=IGNORE HELOBOGUS=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=IGNORE WEIGHT15=IGNORE 04/27/2005 10:43:31 Qb31e34670094d8a5 L2 Message OK 04/27/2005 10:43:31 Qb31e34670094d8a5 Tests failed [weight=16]: GIBBERISH=IGNORE ANTI-GIBBERISH=IGNORE Y!DIRECTED=IGNORE ANTI-Y!DIRECTED=IGNORE COMBO-ZOMBIEISH=WARN BASE64=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE WEIGHT10=WARN WEIGHT15=DELETE Thanks, Kris --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ProcessCounter missing from manual install
Title: Message We discovered that omission this morning and it has been corrected. - Original Message - From: Andy Schmidt To: Declude.JunkMail@declude.com Sent: Tuesday, April 12, 2005 4:00 PM Subject: [Declude.JunkMail] ProcessCounter missing from manual install Hi, I downloaded 2.06, ran the manual install - but ProcessCounter.exe is not included!? Refer to: http://www.declude.com/Articles.asp?ID=122 Best RegardsAndy SchmidtPhone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206
Re: [Declude.JunkMail] Exclude BABEXT Notify for COM
Matt, I have discussed this subject with Scott, who explained a bit about how he developed this. It seems pretty straightforward, although it is a little confusing why some bogus file types do not have the banned notifications sent out and bogus COM files do. In any event, I am looking into the actual code now to determine the precise source of the problem and I should have a fix in the *very* near future. David Franco-Rocha - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 9:58 AM Subject: Re: [Declude.JunkMail] Exclude BABEXT Notify for COM David,I posted some log snippets last week on the Declude Virus list that show what is happening.Yes, the notifications are being sent in error. These COM files are being detected by Declude Virus as "Bogus", and the proper behavior is for the bogus identification to override the banned extension, and disable the sending of the banname.eml file. This is how other bogus files are handled. Essentially bogus file detection should work exactly the same as vulnerabilities and disable such notifications.What is happening currently that has exposed this flaw is one active zombie spammer is randomizing the name of an image attachment using a forged E-mail address, most of which end with COM. Declude sees a COM extension but finds a GIF in the BASE64 code, which is not a COM file and therefore bogus. Due to the volume and the fact that these are tripping the banname.eml file, there is a huge volume of postmaster bounces from undeliverable E-mail (I got over 200 in just 12 hours before applying the workaround). Log Snippet===03/16/2005 00:00:31 Qbd6eb1a701040a54 MIME file: [text/html][quoted-printable; Length=5395 Checksum=490002]03/16/2005 00:00:31 Qbd6eb1a701040a54 MIME file: [EMAIL PROTECTED] [base64; Length=6414 Checksum=850887]03/16/2005 00:00:31 Qbd6eb1a701040a54 Banning file with COM extension [image/gif].03/16/2005 00:00:31 Qbd6eb1a701040a54 Found a bogus .com file03/16/2005 00:00:31 Qbd6eb1a701040a54 Scanned: Banned file extension. [Prescan OK][MIME: 3 12614]03/16/2005 00:00:31 Qbd6eb1a701040a54 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]03/16/2005 00:00:31 Qbd6eb1a701040a54 Subject: denigrate cosmetic scene serge midshipmanMIME Snippet===--=_NextPart_000_00QP_00N2764VQ_00Y.154D01N0Content-Type: image/gif; name="[EMAIL PROTECTED]"Content-Transfer-Encoding: base64Content-ID: [EMAIL PROTECTED]MattDavid Franco-Rocha wrote: Matt, I would like to clarify one issue: Are you saying that the specific issue is that notifications are erroneously being sent for bogus COM files and that the issue is *not* whether bogus COM files are being accurately detected? David Franco-Rocha - Original Message - From: "Matt" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 8:16 AM Subject: Re: [Declude.JunkMail] Exclude BABEXT Notify for COM There seems to be a bug in all versions where a bogus COM file is still bounced as a banned extension (unlike other 'bogus' types that are detected). The workaround is to add "SKIPIFEXT COM" to the top of your bannotify.eml, however this will stop all bounces for COM files regardless of whether or not they are found to be 'bogus'. Matt Don Schreiner wrote: I am getting a lot of postmaster rejects from bad addresses after turning on BANEXT for COM attachments. I would like to exclude notifications on my BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at the top of EML file? I am just guessing based on feature to use SKIPIFVIRUSNAMEHAS VIRUS_NAME. I am still sitting on 1.82 waiting until comfortable with upgrade. I have looked for the Declude Manuals on the site but see no reference other than the install manual? I got to tell you guys the Declude site is a real pain in the rear finding the manuals. I logged on to my account which is no use. It does not have either of my 2 licenses listed. Nor does it have any links to the manual. I even downloaded the most recent release version and I see no readme.txt or manual there either. Ohh well... any assistance on the BANEXT COM and excluding the notify for same on EML file would be most appreciated. Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives ca
Re: [Declude.JunkMail] Exclude BABEXT Notify for COM
Don, The manuals are on the web site. Select Tech Support at the top of the page and you will be taken to links for the manuals. As for the bogus COM file issue, we understand that this is a problem and are looking into ways to resolve it. David Franco-Rocha - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 7:48 AM Subject: [Declude.JunkMail] Exclude BABEXT Notify for COM I am getting a lot of postmaster rejects from bad addresses after turning on BANEXT for COM attachments. I would like to exclude notifications on my BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at the top of EML file? I am just guessing based on feature to use SKIPIFVIRUSNAMEHAS VIRUS_NAME. I am still sitting on 1.82 waiting until comfortable with upgrade. I have looked for the Declude Manuals on the site but see no reference other than the install manual? I got to tell you guys the Declude site is a real pain in the rear finding the manuals. I logged on to my account which is no use. It does not have either of my 2 licenses listed. Nor does it have any links to the manual. I even downloaded the most recent release version and I see no readme.txt or manual there either. Ohh well... any assistance on the BANEXT COM and excluding the notify for same on EML file would be most appreciated. Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Exclude BABEXT Notify for COM
Matt, I would like to clarify one issue: Are you saying that the specific issue is that notifications are erroneously being sent for bogus COM files and that the issue is *not* whether bogus COM files are being accurately detected? David Franco-Rocha - Original Message - From: Matt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 8:16 AM Subject: Re: [Declude.JunkMail] Exclude BABEXT Notify for COM There seems to be a bug in all versions where a bogus COM file is still bounced as a banned extension (unlike other 'bogus' types that are detected). The workaround is to add SKIPIFEXT COM to the top of your bannotify.eml, however this will stop all bounces for COM files regardless of whether or not they are found to be 'bogus'. Matt Don Schreiner wrote: I am getting a lot of postmaster rejects from bad addresses after turning on BANEXT for COM attachments. I would like to exclude notifications on my BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at the top of EML file? I am just guessing based on feature to use SKIPIFVIRUSNAMEHAS VIRUS_NAME. I am still sitting on 1.82 waiting until comfortable with upgrade. I have looked for the Declude Manuals on the site but see no reference other than the install manual? I got to tell you guys the Declude site is a real pain in the rear finding the manuals. I logged on to my account which is no use. It does not have either of my 2 licenses listed. Nor does it have any links to the manual. I even downloaded the most recent release version and I see no readme.txt or manual there either. Ohh well... any assistance on the BANEXT COM and excluding the notify for same on EML file would be most appreciated. Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Possible official host name change
Title: Possible official host name change Sharyn, Send all the details (old hostname and new hostname) to [EMAIL PROTECTED]. David Franco-Rocha - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Cc: Declude.Virus@declude.com Sent: Friday, March 18, 2005 8:39 AM Subject: [Declude.JunkMail] Possible official host name change Declude folks If I change the official host name on my mailserver, I am going to need a new activation key for junkmail and virus (I'm assuming). How do I go about getting this? Thanks, Sharyn
[Declude.JunkMail] Declude 2.x
We wish to let everyone know that through our own testing, support emails and forum responses, we understand that there is some confusion over Version 2.x actions with regard to per-user setting code changes. We are analyzing and evaluating various options and will soon release procedures to deal with this issue. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 2.x
Nick, Prior to 2.0, the DELETE action had the highest priority and affected all recipients of a message. Even with per-user settings, if one user triggered the DELETE action, the email was deleted for everyone. A change was made in 2.0 to allow for deletions to be made on a per-user level: If there are three recipients A, B and C, and at least one of the recipients (B, for example) triggers the DELETE action, the envelope is modified and the new recipients are A and C. That seems to be working fine. The problem arises with DELETE which has been preceded by another action that has already modified the recipient. If my per-user cfg indicates that: WEIGHT10 ROUTETO [EMAIL PROTECTED] WEIGHT15 DELETE I expect to re-route email that fails WEIGHT10 but to simply delete email when it fails the higher weight because the probability of spam there is much higher and I do not want to waste my time checking it. The problem is that the WEIGHT10 ROUTETO action removes me as a recipient and replaces me with [EMAIL PROTECTED]; when the DELETE action is triggered, it tries to delete me as a recipient, but I have already been replaced, so the deletion does not occur. There are several combinations and scenarios that can occur with multiple recipients and multiple actions, and we are studying and testing this very carefully. There may be other facets of your issue that do not apply here, and I will take a very careful look at it. David - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 03, 2005 3:51 PM Subject: Re: [Declude.JunkMail] Declude 2.x On 3 Mar 2005 at 15:06, David Franco-Rocha wrote: Hi David, I am having problem with the DELETE action as well; have sent 2 support requests - would this issue be related to what you describe below as well? Thanks -Nick Hayer We wish to let everyone know that through our own testing, support emails and forum responses, we understand that there is some confusion over Version 2.x actions with regard to per-user setting code changes. We are analyzing and evaluating various options and will soon release procedures to deal with this issue. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 2.x
Kevin, When was the last time someone granted you a request simply because you asked? :-) We are currently making changes to the log whereby the debug mode will show all actions for all users, so that it will be much easier to see exactly what happened to any particular email. David - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 03, 2005 4:51 PM Subject: RE: [Declude.JunkMail] Declude 2.x Would it be possible to change the logging to reflect the final action for each user. This would make since and make it easier to know the final disposition of the email. We use a catchall account on Imail and a message that should have been delete the final disposition showed Last action = IGNORE When it should have been deleted. If the message was processed differently for different accounts then I would expect to see Last action = DELETE - [EMAIL PROTECTED] Last action = IGNORE - [EMAIL PROTECTED] Because in all actuality there were multiple final actions. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Franco-Rocha Sent: Thursday, March 03, 2005 1:19 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Declude 2.x Nick, Prior to 2.0, the DELETE action had the highest priority and affected all recipients of a message. Even with per-user settings, if one user triggered the DELETE action, the email was deleted for everyone. A change was made in 2.0 to allow for deletions to be made on a per-user level: If there are three recipients A, B and C, and at least one of the recipients (B, for example) triggers the DELETE action, the envelope is modified and the new recipients are A and C. That seems to be working fine. The problem arises with DELETE which has been preceded by another action that has already modified the recipient. If my per-user cfg indicates that: WEIGHT10 ROUTETO [EMAIL PROTECTED] WEIGHT15 DELETE I expect to re-route email that fails WEIGHT10 but to simply delete email when it fails the higher weight because the probability of spam there is much higher and I do not want to waste my time checking it. The problem is that the WEIGHT10 ROUTETO action removes me as a recipient and replaces me with [EMAIL PROTECTED]; when the DELETE action is triggered, it tries to delete me as a recipient, but I have already been replaced, so the deletion does not occur. There are several combinations and scenarios that can occur with multiple recipients and multiple actions, and we are studying and testing this very carefully. There may be other facets of your issue that do not apply here, and I will take a very careful look at it. David - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 03, 2005 3:51 PM Subject: Re: [Declude.JunkMail] Declude 2.x On 3 Mar 2005 at 15:06, David Franco-Rocha wrote: Hi David, I am having problem with the DELETE action as well; have sent 2 support requests - would this issue be related to what you describe below as well? Thanks -Nick Hayer We wish to let everyone know that through our own testing, support emails and forum responses, we understand that there is some confusion over Version 2.x actions with regard to per-user setting code changes. We are analyzing and evaluating various options and will soon release procedures to deal with this issue. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 2.0 Issues
No issue reported to us regarding Declude software will ever be considered trivial or unimportant. It is essential that all issues be reported to Declude Support. A number of comments made recently on these lists refer to issues never reported to Declude. It should also be understood that the Declude forums are very informative for finding out from others whether they have experienced similar issues with the software. They are not, however, intended to be a mechanism for reporting problems to us. We have been monitoring the list messages regarding the DELETE action when there is a COPYALL account and we are concerned as to perceptions that there is a problem or issue with the software. There is a difference of opinion on how a COPYALL account should actually function: (a) to receive a copy of every message processed by the mail server, whether legitimate or not; (b) to receive a copy of only those messages for which there is at least one valid delivery. Aside from differing opinions on how the COPYALL account should function, our tests show that individual recipients whose per-user configurations specified DELETE were in fact being deleted from the recipient list and were not receiving the messages. At the same time, however, we discovered that there was information in the log file that would lead one to believe that the recipient was not being deleted. If the last recipient did not have DELETE as the action to take, the last action in the log file would not read DELETE, even if the previous recipient had been deleted. We are making the appropriate changes to the log file to ensure that all actions taken will be accurately recorded. In addition, we are implementing a configurable parameter to allow or disallow actions to apply to the COPYALL account. This release will be available after user testing and acceptance. It is important to know that we respond to each and every issue raised through our support system and also that when making a quote as to what 'Declude' may have said that the correct words are used within the appropriate context. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail Held email recovery
SmarterMail does not use the same delivery mechanism that IMail uses. IMail daisy-chains to smtp32.exe, whereas SmarterMail simply waits for the Declude process to terminate and delivers the message. If you place a *.hdr and its corresponding *.eml file back into the queue, it will be passed to Declude again and be held. When you are using Declude and you wish to re-queue a held message, you must follow this procedure: Prepend an uppercase X to both the *.eml and *.hdr file names (rename them with an uppercase X as the first character) and then place them back into the SmarterMail spool. Declude will immediately exit and will ignore all files passed to it with X as the first character of the file name. David Franco-Rocha - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, February 23, 2005 7:23 PM Subject: [Declude.JunkMail] SmarterMail Held email recovery I am evaluating Declude and SmarterMail and have a question about recovering held messages. How do I do a final delivery of a held message with SmarterMail. I took a held message from the spam folder moved it back to the spool and it was reporcessed by declude and placed back into the spam folder. With IMail I can just move the Q and D files back to the spool for final delivery. The manual has not been updated for SmarterMail and the HOLD action. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Ignore IP4R-Tests for certain countries
Hear ye, hear ye ... Scott is on vacation this week. David Franco-Rocha Declude Technical Support - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, August 19, 2004 15.51 Subject: RE: [Declude.JunkMail] Ignore IP4R-Tests for certain countries From the release notes: COUNTRY (of remote mailserver) and COUNTRIES (of any mailservers in chain) to filter. ITALY-GERMANY-destination My best guesses are: COUNTRY IS DE COUNTRIES CONTAINS IT or DE Maybe you should try this: COUNTRY END IS IT COUNTRIES END STARTSWITH IT I share some of your concerns. I haven't seen a post from Scott Perry for a while on Declude/Imail Mailing Lists for a while. Last time he went away he warned us beforehand. Kinda spooky. I'm just hoping it is vacation season. I think we are also in the longest period without a new Beta release also. I'm being optimistic and hoping that something good is happening and a new release will be around the corner. If this is true it wouldn't hurt to hear some marketing about the upcoming features. [EMAIL PROTECTED] 8/19 6:54a I use the COUNTRY and IS test in my filters: COUNTRY 1 IS US (Since Country refers to the last in the chain it should be only two characters, I think IS would be the best choice, or NOTIS). I agree, but what means first and last? The country-chain value is something like ITALY-GERMANY-destination So what is the corresponding COUNTRY and COUNTRIES value? Below is the next message hold as false positive X-Spam-Tests-Failed: DSBL, NJABLPROXIES, FIVETEN-SRC, ... COMBO-IP4R-ALL, WEIGHT75, WEIGHT100 [107] X-Country-Chain: ITALY-GERMANY-destination The filter file COMBO-IP4R-ALL is starting with the line COUNTRY END STARTSWITH it So how it can be have a positive result? Thanks for all answers - also from the support I'm paying for! Markus PS: (In the case I haven't miss something) As I know the country-test is considered in beta-stadium. But it's in beta stadium for over a year now and we all are waiting for a long time that it finaly becomes released and documented - as many other features! What the hell is going on here? Some months ago we've payed the second SA even if the last release whas several months ago. But now it looks like things are slowing down more and more. The fantastic new MTLDB-test is one of the worst tests in my config file. I already know when I will pay the next SA ! We plan to sell some Declude Junkmail/Virus Pro Gateways in the future. But I'm really confised about statements for future releases and functionality. We practically know nothing and what happens if a certain day www.declude.com says page not found ? Are there any plans for the next release? Tomorrow? Next week, month or at least before 2005? What features will be included from the long suggestion db? What's the current development progress? What's the problem? Looking at http://www.declude.com/Articles.asp?ID=122 the latest release (v 1.75) is from 22 July 2003. So a customer buying the SA at this time has had no following releases for 13 months now. Ok, there was some beta releases and hundreds of interims and last weeks we can see that the website becomes more and more informative and structured. But I must say that I'm anything else then happy with the current information and release strategy. Last weeks I've begun several times to write such a message but decided then to leave and wait. Now I want to know! Thanks Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamCop Listed
Serge, If you want to use the list manually, or from custom software, you should instruct your system to do a dns query for the information. For example, if you want to check if 1.2.3.4 is on the blacklist, you might type this at the command-line: nslookup 4.3.2.1.bl.spamcop.net If you get back an IP address (typically 127.0.0.2), then the IP you asked about is listed. If you get back a non-existant message, then the IP you asked about is not listed. "nslookup" is just the most common method for looking up a hostname. Your system may have another name for it. Other common names are "host" and "dig". Accordingly, if you do nslookup 6.200.154.208.bl.spamcop.net, the lookup returns 127.0.0.2, which means your IP is listed. On the other hand, when you enter your IP in the interactive query on their website, it says that your IP is not listed. That is an issue you will have to address with Spamcop. Declude uses the DNS-type of lookup, and is reporting the result accordingly. David Franco-Rocha Declude Technical Support - Original Message - From: "Serge" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, August 15, 2004 7:53 PM Subject: [Declude.JunkMail] SpamCop Listed Hi all DNSStuff shows my server listed in spamcop: SPAMCOP LISTED (127.0.0.2) TXT= "Blocked - see http://www.spamcop.net/bl.shtml?208.154.200.6" 1745 seconds 0 ms But spamcop.net showing it as not listed: 208.154.200.6 not listed in bl.spamcop.net What is going on ? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamdomains
It sounds like the problem is that Declude JunkMail is scanning the first hop (the forwarding server), which it should not be doing. If that is the case, you should be using the IPBYPASS option to let Declude JunkMail know that the forwarding server is not the true source of the E-mail. David Franco-Rocha Declude Technical Support - Original Message - From: John Olden [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 10, 2004 11:13 AM Subject: [Declude.JunkMail] Spamdomains Is there a way to change the Spamdomains test to test the first rather than last? Our main e-mail address is hosted by another company and automatically forwarded to me and the Spamdomains test is showing the forwarded location. John Olden - Systems Administrator Champaign Park District --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
