[Declude.JunkMail] ComCast delivery failure?
Anyone having problems sending to ComCast? We have a customer and in past week unable to get mail forwarded to their ComCast address. No changes on our end, not in any Spam DB.s, DNS report checks out for their domain, etc. Log snippet below of error. Any help appreciated. 20080208 093247 127.0.0.1 SMTP (67320b10193c) MAIL FROM:[EMAIL PROTECTED] 20080208 093248 127.0.0.1 SMTP (67690b10f043) 452 4.1.0 ... temporary failure 20080208 093248 127.0.0.1 SMTP (67690b10f043) SMTP_DELIV_FAILED 20080208 093248 127.0.0.1 SMTP (67690b10f043) QUIT 20080208 093248 127.0.0.1 SMTP (67690b10f043) 221 2.0.0 IMTA05.westchester.pa.mail.comcast.net comcast closing connection. Don Schreiner CompBiz, Inc. 407-322-8654 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[4]: [Declude.JunkMail] Blackice Server EndOfLife - need replacement
I placed on a test machine and then trial on a production IMail server. I really want this thing to work, but as I train and set-up, found that the SMTP service stops and will not restart and getting a cannot find DLL and SMTP. Sandy - have you experienced anything along this line? -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Saturday, January 05, 2008 2:46 PM To: Craig Edmonds Subject: Re[4]: [Declude.JunkMail] Blackice Server EndOfLife - need replacement Can you use eEye's Blink on a mail server? O'course. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blackice Server EndOfLife - need replacement
We too use Black Ice with great success (except Windows 2003R2 will not install and run). The replacement is IMP Proventia and very expensive at about $700 per server. We are also looking for a more cost-effective replacement. -Don From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Sent: Friday, January 04, 2008 3:47 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Blackice Server EndOfLife - need replacement The best part of Black Ice is it's easy to read interface to see what hitting the server. I will continue to use it just for that purpose, with an ACL in the router ahead of the server to do the heavy lifting of access control. It is an effective blocker for UDP port probes, when used in conjunction with an ACL which blocks the TCP and IP port probes, so an outsider cannot execute anything. On the other side, I would never use a software application on the server as the primary defense...been there, done that years ago when the Witty.A virus struck. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, January 04, 2008 12:21 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Blackice Server EndOfLife - need replacement I'm sure that there are many opinions around here, but I don't think that servers should be the place where you enforce security with a software firewall. Although you might like some of what it tells you, I would think that a firewall and AV software would do the trick perfectly fine. Of course you can tune your firewall to your heart's content, and do things like limit outgoing ports, run IDS, etc. If you have enough servers, you might also want to set up off-site vulnerability scanning on a scheduled basis. If you are worried about inside your network you should set up VLANs. As we saw a couple of years ago with Blackice, and then again last year with Symantec Corporate, software that intercepts packets from the network are themselves vulnerable to exploitation, and this is a good reason to use a hardware firewall as at least a first level of defense, and only allow in what is necessary. Matt Howard Smith (N.O.R.A.D.) wrote: To replace blackice functions as to load on a server and monitor and block what applications sends out on individual ports . I have an offending app or task that trying to send out on random ports , I am trying to find it and block it Howard Smith N.O.R.A.D. Inc. P.O. Box 680116 Miami, Florida 33168 www.norad.com www.securetrek.com www.siteshuttle.com www.audiovideotrek.com [EMAIL PROTECTED] Office - (305) NETWORK (638-9675) Sales - (786) 206-0045 Fax 1 - (305) 359-5144 Confidentiality Notice: This email message, including any Attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact [EMAIL PROTECTED] by email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, January 04, 2008 2:25 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Blackice Server Settings In relation to spam or in relation to security? My answers would be Alligate (on a separate server) and a firewall, respectively. Matt Howard Smith (N.O.R.A.D.) wrote: ISS no longer supports blackice and it is no longer in production , what are users replacing it with ? Howard Smith . -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Wednesday, September 27, 2006 5:58 PM To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Blackice Server Settings I've gotten some requests to post the information on how to use Blackice Server to block email harvesting attacks. So here it is! Before you install Blackice Server you must turn Data Execution Prevention OFF on your server. Blackice and DEP will not coexist. On your server right click on MY COMPUTER then go to properties and then go to advanced. Under performance, select the SETTINGS button and then click on the Data Execution Prevention tab. If DEP is listed as enabled for anything, remove it for the listed services. Next, you can install Blackice. When you install Blackice server you should install it with the trusting mode enabled to allow all inbound traffic. I believe it asks you what you want when you install Blackice. I don't recall for sure if it does or not because it has been several years since I installed it. If it doesn't ask you the protection level that you want, after you install blackice you can go into the GUI and go to the firewall tab and under protection level you can select trusting: allow all inbound
RE: [Declude.JunkMail] AntiVirus Recommendations
I tried the Clam AV less than 1 year ago and it seemed to use more resources than the F-Prot. However, since my original post asking about this I discussed with Declude support and they helped me with trouble shooting the high CPU. By increasing threads in declude.cfg and turning on AVAFTERJM and PRESCAN in my virus.cfg went a long way. Thanks for reply. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Thursday, July 12, 2007 11:00 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations How long ago did you try the Clan AV? I know they released a newer version a while back that was supposed to run more efficiently under windows and reduce resource utilization. I am old school about AV, I think multiple virus scanners are a must. But then I have run multiple scanners for years and I always find virus detected by the second scanner that shouldn't have gotten past the first. Its kind of enlightening when you think you are covered and then you add a second scanner and see its catch things that should be there. Todd Hunter Progressive Systems -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Thursday, July 05, 2007 8:23 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] AntiVirus Recommendations We have been using F-Prot for several years with great success. Their new mail server licensing change is too expensive. We tried the free Clam AV, but with heavy volume CPU was reaching 100%. I know Declude has built-in Virus Scanner, but we have always run F-Prot in addition. It seems necessary for extra protection, but perhaps now overkill? What are others using or recommend? What is best Virus scanner to keep the CPU cycles reasonable? We are running IMail 8.22, Declude 4.X, Message Sniffer, and invURI. Thanks. -Don Sent via CompBiz.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AntiVirus Recommendations
We have been using F-Prot for several years with great success. Their new mail server licensing change is too expensive. We tried the free Clam AV, but with heavy volume CPU was reaching 100%. I know Declude has built-in Virus Scanner, but we have always run F-Prot in addition. It seems necessary for extra protection, but perhaps now overkill? What are others using or recommend? What is best Virus scanner to keep the CPU cycles reasonable? We are running IMail 8.22, Declude 4.X, Message Sniffer, and invURI. Thanks. -Don Sent via CompBiz.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Stopping Unwanted Virus Notifications
I am looking for the best approach to stop notifications to both sender and recipients of virus detection (to reduce what I call back scatter). However, if one of our own customers sends an e-mail and whereas a virus is detected, I certainly want them to receive a notification about same so they can check their computer. What is the best way to set this up in Declude 4.0+? Reviewing the Declude Manual for 4.08 (while it does not specifically state this), if you remove the Recipient.eml and the Postmaster.eml, this would be one method to stop the notifications, but I am unsure what other wanted notification functions this would break? Another approach I used prior to upgrade was to modify the EML files with the following. I am not sure this is still the best approach? Is there a more up-to-date list of Virus' that forge the sender address? SKIPIFVIRUSNAMEHAS Magistr SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS Klez SKIPIFVIRUSNAMEHAS Bugbear SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED] SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED] Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Stopping Unwanted Virus Notifications
Thanks for reply and helping me decide best to remove these notifications all together. It seems the Declude manual would warn against same. -Don _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, January 03, 2007 8:03 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Stopping Unwanted Virus Notifications Don, More than 99% of viruses forge the sender, so therefore there is no utility in notifying anyone since 99% of it would be misplaced. The only non-forging viruses that you are likely to see are macro viruses and they are quite rare these days. The only notifications that I send out are from bannotify.eml which is for banned extensions. These will only be triggered when a banned extension is seen and a virus is not detected. I also skip sending these for encrypted archives using the following in my bannotify.eml file: SKIPIFEXT ZIP-EXE SKIPIFEXT ZIP-SCR SKIPIFEXT ZIP-PIF SKIPIFEXT ZIP-COM SKIPIFEXT RAR-EXE SKIPIFEXT RAR-SCR SKIPIFEXT RAR-PIF SKIPIFEXT RAR-COM You should also add a SKIPIFEXT line for every BANNAME entry in your virus.cfg file. Still with this config, during an outbreak like the one last week where my scanners lagged detection by one to two days, I was creating a ton of backscatter. This can be improved by running JunkMail before Virus and applying an action of either HOLD or DELETE on certain weights so that such messages if scored high enough, will not need to be bounced. If you use ROUTETO and have only one domain that you capture spam in, then you should also add to your bannnotify.eml file a line that has SKIPIFRECIP @your-capture-domain.com so that things that are captured as spam, but not deleted, will not generate bannotify.eml bounces. During any given time my system receives between 5% an 10% of all connection traffic from backscatter, virtually all of it to invalid addresses on the domains that I protect. This volume is so tremendous that it out paces legitimate E-mail by as much as three times. I would implore everyone here to stop using postmaster.eml, sender.eml and recipient.eml bounces entirely even if they take care to try to keep up with forging virus names. When over 99% of it is forging, it makes no sense to be bouncing any of it when it is detected as a virus. Matt Don Schreiner wrote: I am looking for the best approach to stop notifications to both sender and recipients of virus detection (to reduce what I call back scatter). However, if one of our own customers sends an e-mail and whereas a virus is detected, I certainly want them to receive a notification about same so they can check their computer. What is the best way to set this up in Declude 4.0+? Reviewing the Declude Manual for 4.08 (while it does not specifically state this), if you remove the Recipient.eml and the Postmaster.eml, this would be one method to stop the notifications, but I am unsure what other wanted notification functions this would break? Another approach I used prior to upgrade was to modify the EML files with the following. I am not sure this is still the best approach? Is there a more up-to-date list of Virus' that forge the sender address? SKIPIFVIRUSNAMEHAS Magistr SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS Klez SKIPIFVIRUSNAMEHAS Bugbear SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED] SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED] Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Seeking IMail Expert and Consultant for Hire - Follow Up
Remember this post I made back on November 10, 2006 (see below)? A lot of list members have since e-mailed asking if I ever found someone and how it was coming along. In follow-up to those same folks on the list we finally completed upgrade to our Declude installs from 1.82 to 4.3.23. Once again (since Scott left) I am comfortable with controlling Spam using Declude. We remain at IMail 8.22 until such time I feel comfortable their Web Mail and other Web based security/functionality issues get resolved. I want to thank those who specifically responded offering help (Darrell with Invariant, Dave Doherty, and Matt with Mail Pure), and also all the folks on this list who have provided help to me over the years. All of you are the best in the business and I would never have remained a Declude client for the last 5 years without same. Folks like Sandy, John, Len, Doug, Andy, Darin (and may others) who make posts make it possible to keep learning moving forward. Darrell with Invariant (http://www.invariantsystems.com) was the first to respond and offered his help free of charge. I was not looking for free help, but a consultant to work with. Regardless, I decided to take him up on his offer and insisted to compensate something for his time. He never did give me a fee or schedule, so I came up with one on my own and he was worth every penny and more!!! One of my major concerns was losing the ability reviewing False Positives (as I was using the old Spam Review). That came to rest when I discovered his Invariant False Positive Review software product. It is the best tool I have ever used and loaded with all kinds of features like on-the-fly reporting to Sniffer, Filter file updating, DNS lookups, and a lot more. If anyone needs a cool tool to review your held Spam and built-in tools to manage same, I highly recommend this FP Review product. Invariant also has several other good products I strongly recommend including invURIBL which is also helping us tag Spam. Darrell never really pushed his products on us, but rather kept to helping me better understand our E-mail System, how best to use and configure Declude, Sniffer, Filters, Weighting, and more. I made the decision to purchase his products without pressure. In summary, based on number of servers, accounts, and volume, it was not cost-effective for us to farm out our Spam filtering. I strongly considered doing this and it may be the most appropriate for other companies with different circumstances. I needed to learn how to manage on our own with what limited resources we had in place. Darrell was very sensitive to this, our CPU usage, and other items. As we grow, we may need to implement a Gateway server like IMGate, Alligate, ASSP, etc.(all of which I am studying) , but for now we are hanging in there (about 60K messages daily on one server, 40K on another, across multiple domains, about 3500 users). I am also open to other products like MX Guard, but we have invested so much in Declude it is difficult to switch at this point. We are stopping lots more Spam thanks to Darrell's assistance and strongly recommend him to anyone needing an E-mail server consultant. Anyone interested in details, please e-mail me off-list and be glad to share. Seasons greetings and peace to all! Thanks. -Don CompBiz.Inc. 407-322-8654 - Original Message - From: Don mailto:[EMAIL PROTECTED] Schreiner To: declude.junkmail@declude.com Sent: Friday, November 10, 2006 6:36 AM Subject: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire Dear Declude List, I am seeking an IMail/Declude/Sniffer, etc. expert for consultation and hire via telephone, e-mail, and remote Terminal Server. Please contact me off list if interested in helping teach this old dog new tricks. Below is some info about our situation. With ongoing issues, bugs, and version changes (both IMail and Declude), we need help with not only decision making moving forward, but the best configurations for our clients filtering Spam and Virus'. All our licenses and SA's are up-to-date, but we remain at IMail 8.22 and Declude 1.82. Our license renewal dates are forthcoming for IMail in December, and Declude next year. Product knowledge with great results of other technologies like MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are certainly would consider if better alternatives can be proven. I recently tried implementing MXGuard and invURIBL with limited success and reverted back to our original set-up, as it seemed to be catching more Spam. Not sure it was these products fault, but perhaps myself in the set-up? We have been using IMail/Declude since early version 4.0 days and with mostly acceptable filtering results until these last few years, and growing worse in recent months with .gif and stock spams. I currently need some concentrated help with set-up, upgrades, and guidance. While we are a small hosting and Coldfusion Dev firm
[Declude.JunkMail] Seeking IMail Expert and Consultant for Hire
Dear Declude List, I am seeking an IMail/Declude/Sniffer, etc. expert for consultation and hire via telephone, e-mail, and remote Terminal Server. Please contact me off list if interested in helping teach this old dog new tricks. Below is some info about our situation. With ongoing issues, bugs, and version changes (both IMail and Declude), we need help with not only decision making moving forward, but the best configurations for our clients filtering Spam and Virus. All our licenses and SAs are up-to-date, but we remain at IMail 8.22 and Declude 1.82. Our license renewal dates are forthcoming for IMail in December, and Declude next year. Product knowledge with great results of other technologies like MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are certainly would consider if better alternatives can be proven. I recently tried implementing MXGuard and invURIBL with limited success and reverted back to our original set-up, as it seemed to be catching more Spam. Not sure it was these products fault, but perhaps myself in the set-up? We have been using IMail/Declude since early version 4.0 days and with mostly acceptable filtering results until these last few years, and growing worse in recent months with .gif and stock spams. I currently need some concentrated help with set-up, upgrades, and guidance. While we are a small hosting and Coldfusion Dev firm (about 100 hosting clients since the early 90s), we also work with a lot of churches and the recent Spam getting through is not acceptable. Our current issues are not with performance/volume of e-mail as we only process about 30-40k messages in/out daily. We want to upgrade to our licensed latest version of IMail (and Declude), but any existing IMail and Web Mail issues would not be acceptable to our clients (i.e. slowness, miscalculated bytes, etc.) Our current set-up and tools are as follows: -Windows 2000 Advanced Server -IMail 8.22 / Declude 1.82 / Sniffer -SQL 7 Database (separate server and do not use IMail registry) -F-Prot -BlackIce (use for intrusion detection and tar-pitting dictionary attacks) -The old Spam Review to ID False Positives I hope some folks here are interested and no problem reimbursing for same. Again, please contact me off list if interested. Thanks. -Don Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire
Hi Jay and thanks for reply. Yes we seriously considered SmarterMail, but need IMail ODBC due to a Coldfusion application we wrote and requires database backend. Rewriting all the code over to XML that SmarterMail uses, proved too resource intensive and costly. Yes we agree about message Sniffer and have been using for years and continue to do so. I believe it is the one thing that has allowed us to hang in there this long. I received some good replies from folks off list and going to help us out. Thanks. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Friday, November 10, 2006 1:26 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire Hi Don - Have you considered moving away from iMail? SmarterMail is a great value and it sounds like things are only going to continue to improve with SmarterMail 4.0, which is due early next year. Also, have you looked at Message Sniffer (www.armresearch.com)? It's about $450/yr, but worth every penny. - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Friday, November 10, 2006 6:37 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Seeking IMail Expert and Consultant for Hire Dear Declude List, I am seeking an IMail/Declude/Sniffer, etc. expert for consultation and hire via telephone, e-mail, and remote Terminal Server. Please contact me off list if interested in helping teach this old dog new tricks. Below is some info about our situation. With ongoing issues, bugs, and version changes (both IMail and Declude), we need help with not only decision making moving forward, but the best configurations for our clients filtering Spam and Virus'. All our licenses and SA's are up-to-date, but we remain at IMail 8.22 and Declude 1.82. Our license renewal dates are forthcoming for IMail in December, and Declude next year. Product knowledge with great results of other technologies like MXGuard, invURIBl, ASSP, ClamAV, Log Analyzers, etc. is desired, as we are certainly would consider if better alternatives can be proven. I recently tried implementing MXGuard and invURIBL with limited success and reverted back to our original set-up, as it seemed to be catching more Spam. Not sure it was these products fault, but perhaps myself in the set-up? We have been using IMail/Declude since early version 4.0 days and with mostly acceptable filtering results until these last few years, and growing worse in recent months with .gif and stock spams. I currently need some concentrated help with set-up, upgrades, and guidance. While we are a small hosting and Coldfusion Dev firm (about 100 hosting clients since the early 90's), we also work with a lot of churches and the recent Spam getting through is not acceptable. Our current issues are not with performance/volume of e-mail as we only process about 30-40k messages in/out daily. We want to upgrade to our licensed latest version of IMail (and Declude), but any existing IMail and Web Mail issues would not be acceptable to our clients (i.e. slowness, miscalculated bytes, etc.) Our current set-up and tools are as follows: -Windows 2000 Advanced Server -IMail 8.22 / Declude 1.82 / Sniffer -SQL 7 Database (separate server and do not use IMail registry) -F-Prot -BlackIce (use for intrusion detection and tar-pitting dictionary attacks) -The old Spam Review to ID False Positives I hope some folks here are interested and no problem reimbursing for same. Again, please contact me off list if interested. Thanks. -Don Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Email Servers and Declude
Does anyone know if Declude has been configured to work with other E-mail Servers other than IMail and SmarterMail? I thought to remember someone discussing this after Scott left and the new ownership was ramping up. Perhaps I am thinking of Message Sniffer? We are not comfortable renewing our 2 upcoming IMail SAs. We remain at 8.22 and customer since version 4.0 days. We cannot risk installing 2006 with the existing Web Mail bugs (our clients use heavily) and other 2006 server engine issues. We cannot switch to Smarter Mail because they lack SQL ODBC required for our Community software. Converting to XML is too great a cost right now. I am even questioning our 2 Declude SAs upcoming this year. We remain at 1.82 and still uncomfortable with upgrading. I want to keep Declude/Message Sniffer, as it has served us well over the years and why I remain renewing each year. Anyone have suggestions given our situation needing ODBC Mail Server, Declude / Message Sniffer? Please feel free to reply off list if desired. Thanks. -Don Don S CompBiz, Inc. www.CompBiz.net 407-322-8654 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Email Servers and Declude
Not familiar with the Gateway yet and thanks for info. Anyone running on same server? Our volume not at point to justify separate gateway server. -Don From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, October 26, 2006 9:43 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Email Servers and Declude That would be Declude's gateway product. Since it works as a gateway, it's not tied to any one mail server. Darin. - Original Message - From: Don Schreiner To: declude.junkmail@declude.com Sent: Thursday, October 26, 2006 8:40 AM Subject: [Declude.JunkMail] Email Servers and Declude Does anyone know if Declude has been configured to work with other E-mail Servers other than IMail and SmarterMail? I thought to remember someone discussing this after Scott left and the new ownership was ramping up. Perhaps I am thinking of Message Sniffer? We are not comfortable renewing our 2 upcoming IMail SAs. We remain at 8.22 and customer since version 4.0 days. We cannot risk installing 2006 with the existing Web Mail bugs (our clients use heavily) and other 2006 server engine issues. We cannot switch to Smarter Mail because they lack SQL ODBC required for our Community software. Converting to XML is too great a cost right now. I am even questioning our 2 Declude SAs upcoming this year. We remain at 1.82 and still uncomfortable with upgrading. I want to keep Declude/Message Sniffer, as it has served us well over the years and why I remain renewing each year. Anyone have suggestions given our situation needing ODBC Mail Server, Declude / Message Sniffer? Please feel free to reply off list if desired. Thanks. -Don Don S CompBiz, Inc. www.CompBiz.net 407-322-8654 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] Yahoo.com Resources temporarily unavailable
We handle some small bulk mails for our clients on occasion. Has anyone seen the following response from Yahoo before and know what may be the cause? We are receiving thee back on what appear to be legitimate yahoo.com e-mail addresses. Running IMAIL 8.22 and Declude 1.82. Thanks. -Don From: Postmaster [EMAIL PROTECTED] To : [EMAIL PROTECTED] CC : Date : Mon, 7 Aug 2006 13:07:24 -0400 Subject : Undeliverable Mail Delivery failed 8 attempts: [EMAIL PROTECTED] Body of message generated response: 451 mta331.mail.re4.yahoo.com Resources temporarily unavailable. Please try again later.[#4.16.4:190]. Original message follows. Received: from dev [65.57.241.194] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A9115A80012C; Mon, 07 Aug 2006 10:07:13 -0400 Organization: Holistic Moms Network Reply-To: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] From: Holistic Moms News [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: =?windows-1252?Q?Don't_Miss_2006!!?= Date: Mon, 7 Aug 2006 09:59:19 -0400 MIME-Version: 1.0 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable X-Declude-Sender: [EMAIL PROTECTED] [65.57.241.194] X-Declude-Spoolname: D49115a80012c6c22.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: Whitelisted [0] Organization: Abuse reports to [EMAIL PROTECTED] Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable
Found my own answer here at http://help.yahoo.com/help/us/mail/defer/defer-03.html. Unfortunately, I have seen this Yahoo.com resources unavailable before which accounts for hundreds of undeliverable on a bulk mail list of a few thousand. Thanks. -Don From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Tuesday, August 08, 2006 6:27 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable We handle some small bulk mails for our clients on occasion. Has anyone seen the following response from Yahoo before and know what may be the cause? We are receiving thee back on what appear to be legitimate yahoo.com e-mail addresses. Running IMAIL 8.22 and Declude 1.82. Thanks. -Don From: Postmaster [EMAIL PROTECTED] To : [EMAIL PROTECTED] CC : Date : Mon, 7 Aug 2006 13:07:24 -0400 Subject : Undeliverable Mail Delivery failed 8 attempts: [EMAIL PROTECTED] Body of message generated response: 451 mta331.mail.re4.yahoo.com Resources temporarily unavailable. Please try again later.[#4.16.4:190]. Original message follows. Received: from dev [65.57.241.194] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A9115A80012C; Mon, 07 Aug 2006 10:07:13 -0400 Organization: Holistic Moms Network Reply-To: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] From: Holistic Moms News [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: =?windows-1252?Q?Don't_Miss_2006!!?= Date: Mon, 7 Aug 2006 09:59:19 -0400 MIME-Version: 1.0 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable X-Declude-Sender: [EMAIL PROTECTED] [65.57.241.194] X-Declude-Spoolname: D49115a80012c6c22.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: Whitelisted [0] Organization: Abuse reports to [EMAIL PROTECTED] Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable
I was wondering the same thing about the reverse DNS. We have the customer (holisticmoms.org) set-up as a Virtual Domain under IMail. The DNS for their MX record we have set-up pointing to our e-mail server IP number which is 65.57.241.194 (our mail server name = sneezy.xerocom.net, however our router at the data center replies vacant.compbiz.net. According to DNSReport.com, the reverse DNS passes. Does anyone know if our set-up for this customer should be changed in anyway to avoid these types of issues? Thanks. -Don Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Tuesday, August 08, 2006 8:43 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable Importance: High I used to have these problems too on a mass scale. I have my server set to try every 30 minutes for a 48 hour period to delievr email. There is no way their resources are busy for that long. When I got my reverse dns sorted out properly on all my servers sending cdonts emails, coincidentality the bounces stopped. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Shayne Embry Sent: Tuesday, August 08, 2006 2:29 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable We see this happening frequently on very small lists. On a 1,400 user mailing last week, 272 out of 280 Yahoo addresses bounced. We tried the next day with the same results. According to their site, the resources temporarily unavailable message is a 421, yet these are all returned with a 451 code. This does make it difficult to pinpoint the problem, even though we all know the problem is Yahoo. Put them right up there with AOL in terms of stupidity and arrogance. Shayne Original Message From: Don Schreiner [EMAIL PROTECTED] Sent: Tuesday, August 08, 2006 6:02 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable Found my own answer here at http://help.yahoo.com/help/us/mail/defer/defer-03.html. Unfortunately, I have seen this Yahoo.com resources unavailable before which accounts for hundreds of undeliverable on a bulk mail list of a few thousand. Thanks. -Don _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Don Schreiner Sent: Tuesday, August 08, 2006 6:27 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable We handle some small bulk mails for our clients on occasion. Has anyone seen the following response from Yahoo before and know what may be the cause? We are receiving thee back on what appear to be legitimate yahoo.com e-mail addresses. Running IMAIL 8.22 and Declude 1.82. Thanks. -Don From: Postmaster http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Main[EMAIL PROTECTED] cmoms.org [EMAIL PROTECTED] To : [EMAIL PROTECTED] CC : Date : Mon, 7 Aug 2006 13:07:24 -0400 Subject : Undeliverable Mail Delivery failed 8 attempts: [EMAIL PROTECTED] Body of message generated response: 451 mta331.mail.re4.yahoo.com Resources temporarily unavailable. Please try again later.[#4.16.4:190]. Original message follows. Received: from dev [65.57.241.194] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A9115A80012C; Mon, 07 Aug 2006 10:07:13 -0400 Organization: Holistic Moms Network Reply-To: [EMAIL PROTECTED] Message-ID: http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Mainto=2db97484b9f7 93d51a [EMAIL PROTECTED] [EMAIL PROTECTED] From: Holistic Moms News http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Main[EMAIL PROTECTED]. org [EMAIL PROTECTED] To: http://mail.holisticmoms.org:8383/newmsg.cgi?mbx=Mainto=RACHELWEISSM [EMAIL PROTECTED] HOO.COM [EMAIL PROTECTED] Subject: =?windows-1252?Q?Don't_Miss_2006!!?= Date: Mon, 7 Aug 2006 09:59:19 -0400 MIME-Version: 1.0 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable X-Declude-Sender: [EMAIL PROTECTED] [65.57.241.194] X-Declude-Spoolname: D49115a80012c6c22.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: Whitelisted [0] Organization: Abuse reports to [EMAIL PROTECTED]. Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 --- This E-mail came from the Declude.JunkMail mailing list.To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail.The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The ar
RE: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable
Thanks to all for the replies. I use Enom registrar for customer domains and their DNS tools. Instead of DNS MX setting to the simple IP (65.57.241.194) of the email server, if I change to the MX to the hostname of the server (sneezy.xerocom.net) would this solve this roundtrip failure issue and still using Virtual domain name for holisticmoms.org under IMail? Thanks. -Don Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Tuesday, August 08, 2006 1:33 PM To: William Stillwell Subject: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable Set the MX to point to the server reported by the HELO statement Holisticmoms.org MX sneezy.xerocom.net That doesn't solve the roundtrip failure. If the receiving server checks the roundtrip, it needs an IP-PTR-HELO-A sync. It doesn't care what the MX is for the purposes of that test. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable
SpiderHost is our Data Center co-locator (Level3 facility). Below is beyond my DNS expertise. What would I have them do? Thanks. -Don Don Schreiner CompBiz, Inc. www.CompBiz.net 407-322-8654 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Stillwell Sent: Tuesday, August 08, 2006 2:50 PM To: declude.junkmail@declude.com Subject: RE: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable Ahh, I see your problem now.. Asking d.root-servers.net for 194.241.57.65.in-addr.arpa PTR record: d.root-servers.net says to go to indigo.arin.net. (zone: 65.in-addr.arpa.) Asking indigo.arin.net. for 194.241.57.65.in-addr.arpa PTR record: indigo.arin.net [192.31.80.32] says to go to NS1.LEVEL3.NET. (zone: 57.65.in-addr.arpa.) Asking NS1.LEVEL3.NET. for 194.241.57.65.in-addr.arpa PTR record: ns1.level3.net [209.244.0.1] says to go to ns2.spiderhost.com. (zone: 241.57.65.in-addr.arpa.) Asking ns2.spiderhost.com. for 194.241.57.65.in-addr.arpa PTR record: Reports vacant.compbiz.net. [from 66.192.101.2] Who is SpriderHost ? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Tuesday, August 08, 2006 1:33 PM To: William Stillwell Subject: Re[4]: [Declude.JunkMail] Yahoo.com Resources temporarily unavailable Set the MX to point to the server reported by the HELO statement Holisticmoms.org MX sneezy.xerocom.net That doesn't solve the roundtrip failure. If the receiving server checks the roundtrip, it needs an IP-PTR-HELO-A sync. It doesn't care what the MX is for the purposes of that test. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Deleting emails based solely on Sniffer?
If you delete, you should delete based on achieving a minimum weight accumulated. Sniffer on occasion may detect something as a false positive. For example, it may misinterpret a legitimate e-mail as Spam with an attachment based on conversion of the attachment to characters and a series triggering something in Sniffer rules. I have seen this on occasion. In our scenario, we hold on a certain weight range for review, and higher weight range we auto-delete. We also will hold if failing Sniffer alone and no other tests. HTH's -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joey Proulx Sent: Thursday, April 14, 2005 8:50 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Deleting emails based solely on Sniffer? Can someone please explain to me why, if an email is flagged as spam by Sniffer, I shouldn't just delete it outright? Are there instances where Sniffer is wrong? Or is this the way you all use it already? Reason I ask is that I have Sniffer setup with a weight of 10...and I hold messages with a weight of 10-14. This morning I got a Nigerian-type scam that sniffer flagged, but it only scored a total weight of 5. I'll have to check through my global.cfg when I get back from my 9am meeting, but something added a weight of -5 somewhere, meaning the email got through. If I had deleted all Sniffer-found spam outright, this would not have happened. Thoughts? _ Joey Proulx SAU #21 Technology Support Staff 2 Alumni Drive Hampton, NH 03842 (603) 926-8992, ext 115 [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] filter files
I also strongly recommend Sniffer. We have used for a couple of years. As spam patterns and variants change daily, it's rule base also changes and is updated. It significantly reduced the time we spent managing Spam. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, March 22, 2005 10:36 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] filter files I would definitely recommend message sniffer. Stu At 07:54 PM 3/21/2005 -0600, you wrote: Thanks to both of you. I am looking to get mostly obscene stuff, but the medical stuff would be very good to catch also. I will start with this and then adventure out on my own:D On a side note has anyone used Message Sniffer, and would it help with this type of stuff or am i looking in the wrong direction? Thanks again, Joe -- Original Message -- From: David Barker [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Mon, 21 Mar 2005 16:04:55 -0500 Joe here is a very basic filter but hopefully will help get you started: SKIPIFWEIGHT 16 MINWEIGHTTOFAIL 3 MAXWEIGHT 12 #Subject SUBJECT 3 CONTAINS Online Pharmacy #Words BODY 5 CONTAINS Meds BODY 2 CONTAINS cheap Perscriptions BODY 2 CONTAINS No prescription required BODY 2 CONTAINS No Doctor Visits #Medication BODY 2 CONTAINS codiene BODY 2 CONTAINS Codeine BODY 2 CONTAINS vicodin BODY 2 CONTAINS viagra BODY 2 CONTAINS Cialis #URBL BODY 12 CONTAINS fopq.org BODY 12 CONTAINS awayhowbad.com BODY 12 CONTAINS royalmeds.info BODY 12 CONTAINS uncompromisingmind.com BODY 12 CONTAINS simply-meds.com BODY 12 CONTAINS ritheworldofall.com BODY 12 CONTAINS medberthgood.com #Spam Indicators BODY 12 CONTAINS Cia|is BODY 12 CONTAINS Cialls Here are some good links too: http://www.mailpure.com/software/decludefilters/ http://it.farmprogress.com/declude/declude.htm http://www.declude.com/Articles.asp?ID=100 David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Raykiewicz Sent: Monday, March 21, 2005 3:44 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] filter files I am currently thinking about using a filter file to filter out some unwanted messages. Does anyone have some sample filter files that I could use as a starting point? I sure would appreciate some help getting started on this. Joe __ NOD32 1.1030 (20050319) Information __ This message was checked by NOD32 antivirus system. http://www.nod32.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Webmail delivered by Microlandcomputers.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Reverse DNS and 554 Denied
Thanks for reply. I am still unsure what to do. The IP ending .196 is our IIS server and with the news. Web site. All domains on server are virtual and use host headers. The vacant.compbiz.net is also used and set-up by our data center router. I thought the issue might have been via our Mail server ending .197 and our office IP I saw being insrted in the headers. -Don - Original Message - From: Dave Doherty [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 10:43 PM Subject: Re: [Declude.JunkMail] OT: Reverse DNS and 554 Denied Hi, Don- news.holisticmoms.org reports its IP address as 65.57.241.196 65.57.241.196 reports its name as vacant.compbiz.net. You should have your provider set up a reverse lookup (pointer) record for 65.57.241.196 that points to news.holisticmoms.org instead of vacant.compbiz.net -d - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 10:02 PM Subject: [Declude.JunkMail] OT: Reverse DNS and 554 Denied While the AOL filter is fixed, I am now getting 554 Denied on some servers (see below). I am also getting unsolicited bulk mail undeliverable. I am using Group Mail in our office on dedicated IP authenticating SMTP to their virtual domain on our IMail server. Do I need to make an additional DNS entry of our office IP for their domain and what would I do? Again, the e-mail we are sending is here at http://news.holisticmoms.org/index_email.htm. Body of message generated response: 554 5.7.1 This message appears to be unsolicited bulk mail...reverse DNS problem with 65.57.241.197...Try plain text Original message follows. Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A27353BE00EE; Mon, 21 Mar 2005 21:26:59 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 21:25:53 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_30681132292922553481 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: D827353be00eedffd.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] From: Postmaster [EMAIL PROTECTED] Save Address | Headers To : [EMAIL PROTECTED] CC : Date : Mon, 21 Mar 2005 21:28:52 -0500 Subject : Undeliverable Mail undeliverable to [EMAIL PROTECTED] Body of message generated response: 554 Denied undeliverable to [EMAIL PROTECTED] Body of message generated response: 554 Denied Original message follows. Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A286418D00F0; Mon, 21 Mar 2005 21:27:18 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 21:26:00 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_1949814226871226091 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: D8285418d00f0e016.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Exclude BABEXT Notify for COM
I am getting a lot of postmaster rejects from bad addresses after turning on BANEXT for COM attachments. I would like to exclude notifications on my BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at the top of EML file? I am just guessing based on feature to use SKIPIFVIRUSNAMEHAS VIRUS_NAME. I am still sitting on 1.82 waiting until comfortable with upgrade. I have looked for the Declude Manuals on the site but see no reference other than the install manual? I got to tell you guys the Declude site is a real pain in the rear finding the manuals. I logged on to my account which is no use. It does not have either of my 2 licenses listed. Nor does it have any links to the manual. I even downloaded the most recent release version and I see no readme.txt or manual there either. Ohh well... any assistance on the BANEXT COM and excluding the notify for same on EML file would be most appreciated. Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Exclude BABEXT Notify for COM
Matt, This will work for the meantime and thank you very much! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, March 21, 2005 8:17 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Exclude BABEXT Notify for COM There seems to be a bug in all versions where a bogus COM file is still bounced as a banned extension (unlike other 'bogus' types that are detected). The workaround is to add SKIPIFEXT COM to the top of your bannotify.eml, however this will stop all bounces for COM files regardless of whether or not they are found to be 'bogus'. Matt Don Schreiner wrote: I am getting a lot of postmaster rejects from bad addresses after turning on BANEXT for COM attachments. I would like to exclude notifications on my BANnotify.EML file. Can I do this by inserting SKIPIFBANEXTNAMEHAS COM at the top of EML file? I am just guessing based on feature to use SKIPIFVIRUSNAMEHAS VIRUS_NAME. I am still sitting on 1.82 waiting until comfortable with upgrade. I have looked for the Declude Manuals on the site but see no reference other than the install manual? I got to tell you guys the Declude site is a real pain in the rear finding the manuals. I logged on to my account which is no use. It does not have either of my 2 licenses listed. Nor does it have any links to the manual. I even downloaded the most recent release version and I see no readme.txt or manual there either. Ohh well... any assistance on the BANEXT COM and excluding the notify for same on EML file would be most appreciated. Thanks. -Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client
We sent a bulk mailing this morning for a client to 532 addresses. We use Group Mail and authenticate from our office dedicated IP to our IMAIL server via the clients account virtual domain. However, the e-mail was rejected to any AOL address stating that URLs are improperly formatted. We have verified all formatting of the URL's. Below is what we get back from AOL. Body of message generated response: 554-: (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html 554 TRANSACTION FAILED Below is the URL of the actual e-mail/file itself we sent. The only thing I can think of is they do not like the sub-domain we are using news.holisticmoms.org which is what we directed for the plain text folks. The actual e-mail itself can be viewed at http://news.holisticmoms.org/index_email.htm. Also, perhaps they do not like our dedicated office IP number even though we are sending via our IMail server and authenticated via their virtual domain account. Does anyone have any clues about this or the errors of my ways? Thanks. -Don Also, below is the undeliverable return header they provided: Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 08:23:59 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_8310132123562132359893 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: Dcb3237eb002a698e.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client
Darin/Andrew, I do not know anyone or have an AOL account to test. Anyone have one by chance? I checked left NAV and all links look valid, however I am a little suspect of the Bee Well Therapy Advertiser link with no www and going to change. Where did you see a bad link in the left NAV? Also the link Andrew found with the space I am going to look at changing. Thanks guys for looking! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, March 21, 2005 5:43 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Check your left-hand nav...you have some bad links there... Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 5:29 PM Subject: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client We sent a bulk mailing this morning for a client to 532 addresses. We use Group Mail and authenticate from our office dedicated IP to our IMAIL server via the clients account virtual domain. However, the e-mail was rejected to any AOL address stating that URLs are improperly formatted. We have verified all formatting of the URL's. Below is what we get back from AOL. Body of message generated response: 554-: (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html 554 TRANSACTION FAILED Below is the URL of the actual e-mail/file itself we sent. The only thing I can think of is they do not like the sub-domain we are using news.holisticmoms.org which is what we directed for the plain text folks. The actual e-mail itself can be viewed at http://news.holisticmoms.org/index_email.htm. Also, perhaps they do not like our dedicated office IP number even though we are sending via our IMail server and authenticated via their virtual domain account. Does anyone have any clues about this or the errors of my ways? Thanks. -Don Also, below is the undeliverable return header they provided: Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 08:23:59 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_8310132123562132359893 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: Dcb3237eb002a698e.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client
Darin, Got it now. The link is valid to the directory not ending with the index file which is as follows for example: http://www.holisticmoms.org/index.cfm/about but you are saying AOL wants to see full path... http://www.holisticmoms.org/index.cfm/about/index.cfm. Will let you know if it works. Thanks. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, March 21, 2005 6:22 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Look at the About HMN link, for example... http://www.holisticmoms.org/index.cfm/about See what I mean? There are three links like this in the nav that AOL is complaining about since they don't end with the filename...the path keeps going. Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 6:15 PM Subject: RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Darin/Andrew, I do not know anyone or have an AOL account to test. Anyone have one by chance? I checked left NAV and all links look valid, however I am a little suspect of the Bee Well Therapy Advertiser link with no www and going to change. Where did you see a bad link in the left NAV? Also the link Andrew found with the space I am going to look at changing. Thanks guys for looking! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, March 21, 2005 5:43 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Check your left-hand nav...you have some bad links there... Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 5:29 PM Subject: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client We sent a bulk mailing this morning for a client to 532 addresses. We use Group Mail and authenticate from our office dedicated IP to our IMAIL server via the clients account virtual domain. However, the e-mail was rejected to any AOL address stating that URLs are improperly formatted. We have verified all formatting of the URL's. Below is what we get back from AOL. Body of message generated response: 554-: (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html 554 TRANSACTION FAILED Below is the URL of the actual e-mail/file itself we sent. The only thing I can think of is they do not like the sub-domain we are using news.holisticmoms.org which is what we directed for the plain text folks. The actual e-mail itself can be viewed at http://news.holisticmoms.org/index_email.htm. Also, perhaps they do not like our dedicated office IP number even though we are sending via our IMail server and authenticated via their virtual domain account. Does anyone have any clues about this or the errors of my ways? Thanks. -Don Also, below is the undeliverable return header they provided: Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 08:23:59 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_8310132123562132359893 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: Dcb3237eb002a698e.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail
RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client
Darin, The entire problem here is the page is dynamically generated via CF and database and the correct page will not come up any other way, only the home page of the site. This code has been in use about 6 years this way and would be a major deal to change all. Found an AOL test subject and going to try Johns suggestion on ending with /. Let you know what happens. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, March 21, 2005 6:47 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Nope...I'm saying it should either end at http://www.holisticmoms.org/index.cfm Or be reparsed as something like http://www.holisticmoms.org/index.cfm?about Basically there shouldn't be any more to the path after index.cfm. Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 6:33 PM Subject: RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Darin, Got it now. The link is valid to the directory not ending with the index file which is as follows for example: http://www.holisticmoms.org/index.cfm/about but you are saying AOL wants to see full path... http://www.holisticmoms.org/index.cfm/about/index.cfm. Will let you know if it works. Thanks. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, March 21, 2005 6:22 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Look at the About HMN link, for example... http://www.holisticmoms.org/index.cfm/about See what I mean? There are three links like this in the nav that AOL is complaining about since they don't end with the filename...the path keeps going. Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 6:15 PM Subject: RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Darin/Andrew, I do not know anyone or have an AOL account to test. Anyone have one by chance? I checked left NAV and all links look valid, however I am a little suspect of the Bee Well Therapy Advertiser link with no www and going to change. Where did you see a bad link in the left NAV? Also the link Andrew found with the space I am going to look at changing. Thanks guys for looking! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, March 21, 2005 5:43 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client Check your left-hand nav...you have some bad links there... Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, March 21, 2005 5:29 PM Subject: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client We sent a bulk mailing this morning for a client to 532 addresses. We use Group Mail and authenticate from our office dedicated IP to our IMAIL server via the clients account virtual domain. However, the e-mail was rejected to any AOL address stating that URLs are improperly formatted. We have verified all formatting of the URL's. Below is what we get back from AOL. Body of message generated response: 554-: (HVU:NR) http://postmaster.info.aol.com/errors/554hvunr.html 554 TRANSACTION FAILED Below is the URL of the actual e-mail/file itself we sent. The only thing I can think of is they do not like the sub-domain we are using news.holisticmoms.org which is what we directed for the plain text folks. The actual e-mail itself can be viewed at http://news.holisticmoms.org/index_email.htm. Also, perhaps they do not like our dedicated office IP number even though we are sending via our IMail server and authenticated via their virtual domain account. Does anyone have any clues about this or the errors of my ways? Thanks. -Don Also, below is the undeliverable return header they provided: Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id AB3337EB002A; Mon, 21 Mar 2005 08:25:07 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 08:23:59 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_8310132123562132359893 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: Dcb3237eb002a698e.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
RE: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client
Matt/Darin/John/Andrew, Inserting the trailing / on the URLs ending with a directory - did the trick and passed the AOL filter. I learned something again today. Thanks for your help! This list is the best! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Monday, March 21, 2005 6:59 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client What Don is doing is something thats been around for quite a while, and not just in ColdFusion. In CF its commonly called a FakeURL and the intent of it is to make a url search engine safe by removing the ?'s and 's and replacing them with slashes. Its been around for years. I've never heard of anything like what AOL is doing. If they're serious about blacklisting this sort of thing then it would break zillions of web sites, or more accurately any email pointing to them. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Reverse DNS and 554 Denied
While the AOL filter is fixed, I am now getting 554 Denied on some servers (see below). I am also getting unsolicited bulk mail undeliverable. I am using Group Mail in our office on dedicated IP authenticating SMTP to their virtual domain on our IMail server. Do I need to make an additional DNS entry of our office IP for their domain and what would I do? Again, the e-mail we are sending is here at http://news.holisticmoms.org/index_email.htm. Body of message generated response: 554 5.7.1 This message appears to be unsolicited bulk mail...reverse DNS problem with 65.57.241.197...Try plain text Original message follows. Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A27353BE00EE; Mon, 21 Mar 2005 21:26:59 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 21:25:53 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_30681132292922553481 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: D827353be00eedffd.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] From: Postmaster [EMAIL PROTECTED] Save Address | Headers To : [EMAIL PROTECTED] CC : Date : Mon, 21 Mar 2005 21:28:52 -0500 Subject : Undeliverable Mail undeliverable to [EMAIL PROTECTED] Body of message generated response: 554 Denied undeliverable to [EMAIL PROTECTED] Body of message generated response: 554 Denied Original message follows. Received: from holisticmoms.org [68.209.181.166] by holisticmoms.org with ESMTP (SMTPD32-8.12) id A286418D00F0; Mon, 21 Mar 2005 21:27:18 -0500 Message-ID: [EMAIL PROTECTED] To: HMN Members [EMAIL PROTECTED] Organization: Holistic Moms Network From: Holistic Moms News [EMAIL PROTECTED] Subject: Holistic Moms Network News March 2005 Date: Mon, 21 Mar 2005 21:26:00 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_1949814226871226091 X-Declude-Sender: [EMAIL PROTECTED] [68.209.181.166] X-Declude-Spoolname: D8285418d00f0e016.SMD X-Note: CompBiz scanned with Declude JunkMail X-Spam-Tests-Failed: None [-5] Organization: Abuse reports to [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ETA for SPAMHEADERS glitch
Well I just made a post, and this is the post I was expecting/looking for. Thanks Scott! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, January 03, 2005 3:34 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] ETA for SPAMHEADERS glitch Just to let everyone know, we have identified the issue with the SPAMHEADERS test. As most people realized, most E-mails sent with a date involving a year after 2004 were failing the SPAMHEADERS test. For those that are interested in the details, if the SPAMHEADERS code matches the bitmask 0x4800, it means that an invalid year was detected for the SPAMHEADERS test. Normally, a code such as 0x4802 would be seen, but others such as 0xC0001802 could also be seen. And I feel that it is only fair for me to point out that this glitch was in code that I wrote (several years ago, actually). We expect to have a v1.82 ready by tomorrow morning that takes care of this issue. Part of the reason for the delay (aside from it first being reported on a holiday during a weekend) was that the fix involves changing old source code, which is something that has never been done with Declude before. In the past, when issues such as this were detected, a change would be made to the latest code (v2.0b in this case). However, management made the decision that it would be in the best interest for everyone to make the change to the 1.81 as well, which requires a more complicated procedure for implementing the change. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
We are up-to-date with our support agreements way into 2005 and I am awaiting a fix. I am not sure I understand the talk here about forced license upgrade unless a customer support agreement has expired? I also agree it would have been nice to have a warning announcement about the Spam Header test being broken officially from Declude, more timely, and along with advice what to do in the interim. This is not the same Declude operation to me as in years past! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Imail Admin Sent: Monday, January 03, 2005 3:20 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch? I think Jerry has this right. Both our Declude and IMail support agreements are currently lapsed. We were planning on renewing both in early 2005 when Ipswitch had their big fiasco over discontinuing IMail as a stand-alone program. So we plan on dropping IMail and we postponed renewing the Declude support contract. I'm sure that if we switch to SmarterMail that we'll renew the Declude contract, but that could be months out. In the meanwhile, we were happy with our current version of Declude until this bug popped up. Since this is a major bug, I consider Declude responsible. I'll be interested to see what they do. Actually, I could think of one compromise solution: release an update/fixed version, require a support contract for the download, but offer (for a limited time) a substantial discount on the support contract. Or, if you don't like that, then offer a short-term support contract (three months for one quarter of the usual price). I really am a big fan of Declude; I just don't like being forced into an upgrade. Ben BC Web - Original Message - From: Jerry Murdock [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 03, 2005 8:22 AM Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch? I don't think that's fair for a bug like this. Declude has never been presented as being a time sensitive licensed product. I know some of my old installs are still probably using older versions without other issues. I've made my successors aware of this and it's up to them now. There are a lot of folks out there that will be looking for an iMail replacement, and may consider Smartermail/Declude, but won't if they feel CPHZ is not doing right. CPHZ should release a 1.82 or a 1.8101 and make it available for all licensed users. They would then get a phone home version out to more users, and generate good will instead of ill will. I'm surprised the conspiracy theorists haven't chimed in already that this is just a way to force an upgrade. I don't believe that, but some will be thinking it. Jerry - Original Message - From: Ncl Admin [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 03, 2005 10:51 AM Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch? At 07:59 AM 1/2/2005 +1100, you wrote: Great way to increase sales due to the need to update service agreements. Anyone that runs production software without service agreements gets what they deserve. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
It did affect us throwing weight higher on emails that would not have otherwise failed the Spam Header Filter. We hold on a relatively low weight of 13 compared to other configs I have seen posted with weights of 100, 200, etc. The bottom line is if I did not stroll in here on New Years and catch the posts about the bug, there would have been a lot more of my customer e-mails not getting through due to this. It was not that big a deal for us, and yes I took action and commented out, and now more Spam possibly getting through not reaching same weight we would hold or delete upon. So now I have to possibly adjust another test I guess to make up for it, until the fix? I am monitoring and hoping Sniffer will fill the gap if any. If I had not seen the posts, would the affect for us and our clients have been detrimental? Not really because most of my customers away for holidays too and we are not a huge firm with huge commercial clients. But... if I did have a huge commercial client base - the point of sharing the info and a little advise as a result does seem very prudent. It's not the product, it is communication to me the customer with better warning like if this bug affects you, do the following until we get it fixed. I guess I am making a mountain out of a mole hill spoiled with great support and communication in the past. But remember this is a primary reason I have always went out of my way to praise Declude too! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, January 03, 2005 5:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch? 1. An acknowledgement on the list from someone that they knew about the problem - it WAS a holiday and I think people should have lives - but just a hey we know within 24 hours would've been nice. Yes, that would have been nice. It did take a bit more than 24 hours for an official response on the list. 2. A simple e-mail note to all customers ASAP stating The spamheaders test has a bug causing it to catch and add weight to every e-mail sent in 2005. It is suggested that you comment it out or reduce (or remove) its weight to avoid false positives. We are working on a fix and will post it to the website as soon as possible The main reason this wasn't done was because it wasn't clear that this was going to be as big an issue for our customers as it turned out to be. The thought was that since this is normally a relatively minor test, anyone that it does affect adversely would just comment out the test. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Smarter Mail and ODBC
We have to determine if worth changing over the email account portion of our apps to XML and writing/running scripts on the database for conversion. A difficult decision. Thanks all for their feedback. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Saturday, December 25, 2004 11:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Smarter Mail and ODBC Hi Don- From what I read in the IMail converter wizard docs, SM keeps all data in an XML file, and does not appear to support ODBC: Every SmarterMail server has a domainList.xml file that tells SmarterMail what domains it controls and where the root directory to each domain can be found. This file is found in the Service directory in the SmarterMail installation directory. By default this is found at c:\program files\smartertools\smartermail\service\domainList.xml. ...and... The conversion wizard will not convert the following: * Shared Address Book * Content Filtering * Users in domains configured in LDAP or ODBC data source. Only IMail Database domains are currently supported -d - Original Message - From: Don Schreiner [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: Declude.JunkMail@declude.com mailto:Declude.JunkMail@declude.com Sent: Friday, December 24, 2004 7:01 AM Subject: [Declude.JunkMail] Smarter Mail and ODBC I cannot find where Smarter Mail supports ODBC? Our IMail set-up is with SQL database for usernames and passwords integrated with our Cold Fusion applications. Does anyone know if Smarter Mail will work with database? Thanks. -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com http://www.declude.com )] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] , and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com http://www.mail-archive.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Smarter Mail and ODBC
I cannot find where Smarter Mail supports ODBC? Our IMail set-up is with SQL database for usernames and passwords integrated with our Cold Fusion applications. Does anyone know if Smarter Mail will work with database? Thanks. -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email being released today - Advance Notice
Barry, I hate to disagree with you! See below email. I am also working on finding in my archive another email between Scott and self clarifying Service Agreements this same topic. -Don -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 14, 2003 2:41 PM To: [EMAIL PROTECTED] Subject: Declude Service Agreement Thank you for your order for a Service Agreement. This E-mail confirms the purchase of your 1 Year Service Agreement, which will be good through January 31, 2004. The Service Agreement entitles you to free upgrades and support during the term of the service agreement. The Service Agreement covers all Declude programs that you have purchased in the past. You do not need a new activation code; your current activation code will continue to work. Please note that we now have a special E-mail address for urgent support issues ([EMAIL PROTECTED]). Standard support questions can be sent to [EMAIL PROTECTED] If you have any questions, please let me know. Thanks. -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Wednesday, December 01, 2004 11:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Email being released today - Advance Notice Explanation of Service Agreements 1. Service Agreements have always been Per Server, that is to say that if you own JunkMail on Two Servers then you should have paid two service agreements. In the past this would have cost you $295 * 2 - $590. Today it will be $132 * 2 = $264. A significant saving. 2. The rules on upgrades have always been that an upgrade between product levels e.g. Lite to Standard, does NOT include any extension in Service Agreement. Both these rules have been set by Scott years ago. - Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Wednesday, December 01, 2004 10:58 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Email being released today - Advance Notice That is how I recall it too, but not sure based on the sites verbiage. We have license for Declude Pro AV/JM on one server and separate license for Declude Standard AV/JM at another server/location. Does the $264 JM/AV Service Agreement option cover both these licenses as in the past? -Don - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 01, 2004 10:34 AM Subject: Re: [Declude.JunkMail] Email being released today - Advance Notice Sounds like some good changes. How does upgrading one or more products affect service agreements? For example, if we have JM and AV standard, and upgrade one to Pro, what service agreement would we end up with? I believe in the old model, upgrading one would effectively result in a year support for both, but I may be incorrect. Darin. - Original Message - From: Barry Simpson To: [EMAIL PROTECTED] Sent: Wednesday, December 01, 2004 10:10 AM Subject: [Declude.JunkMail] Email being released today - Advance Notice This is a preview of an email being shortly released by Declude and being sent to all customers. _ We recently promised you information about our plans as and when it became available. Here are two pieces of news: A Beta release of Declude 2.0 will be available on or around December 16th that will include new functionality and also support for an additional windows based mail server as an affordable alternative to IMail. This opens up the options for a reasonably priced, fully functional gateway. In order to provide more equitable pricing on Service Agreements we will introduce a new mechanism which will be available immediately. There will be server/product based support agreements rather than a blanket cost which penalizes the smaller user. Please visit our Service Agreements page to see more details. On a less positive note we have been monitoring downloads and activations of Declude software and have discovered that there are a significant number of non licensed copies being used. These include customers downloading the latest release without a valid Service Agreement and others who have installed multiple copies of unlicensed software. We encourage all customers who are participating in these activities to regularize their legal position by December 31st, 2004. If you have any questions as to the validity of your installation please email us at [EMAIL PROTECTED] or call us at (866) 332-5833 between 8.00 am and 5 pm Eastern Time, Monday thru Friday. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list
RE: [Declude.JunkMail] Email being released today - Advance Notice
Barry, Please see below email. I am also working on finding in my archive another email between Scott and self clarifying Service Agreements this same topic. Apparently you are saying SA has changed and does not cover all products purchased in past? -Don -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 14, 2003 2:41 PM To: [EMAIL PROTECTED] Subject: Declude Service Agreement Thank you for your order for a Service Agreement. This E-mail confirms the purchase of your 1 Year Service Agreement, which will be good through January 31, 2004. The Service Agreement entitles you to free upgrades and support during the term of the service agreement. The Service Agreement covers all Declude programs that you have purchased in the past. You do not need a new activation code; your current activation code will continue to work. Please note that we now have a special E-mail address for urgent support issues ([EMAIL PROTECTED]). Standard support questions can be sent to [EMAIL PROTECTED] If you have any questions, please let me know. Thanks. -Scott -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Wednesday, December 01, 2004 11:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Email being released today - Advance Notice Explanation of Service Agreements 1. Service Agreements have always been Per Server, that is to say that if you own JunkMail on Two Servers then you should have paid two service agreements. In the past this would have cost you $295 * 2 - $590. Today it will be $132 * 2 = $264. A significant saving. 2. The rules on upgrades have always been that an upgrade between product levels e.g. Lite to Standard, does NOT include any extension in Service Agreement. Both these rules have been set by Scott years ago. - Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Wednesday, December 01, 2004 10:58 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Email being released today - Advance Notice That is how I recall it too, but not sure based on the sites verbiage. We have license for Declude Pro AV/JM on one server and separate license for Declude Standard AV/JM at another server/location. Does the $264 JM/AV Service Agreement option cover both these licenses as in the past? -Don - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 01, 2004 10:34 AM Subject: Re: [Declude.JunkMail] Email being released today - Advance Notice Sounds like some good changes. How does upgrading one or more products affect service agreements? For example, if we have JM and AV standard, and upgrade one to Pro, what service agreement would we end up with? I believe in the old model, upgrading one would effectively result in a year support for both, but I may be incorrect. Darin. - Original Message - From: Barry Simpson To: [EMAIL PROTECTED] Sent: Wednesday, December 01, 2004 10:10 AM Subject: [Declude.JunkMail] Email being released today - Advance Notice This is a preview of an email being shortly released by Declude and being sent to all customers. _ We recently promised you information about our plans as and when it became available. Here are two pieces of news: A Beta release of Declude 2.0 will be available on or around December 16th that will include new functionality and also support for an additional windows based mail server as an affordable alternative to IMail. This opens up the options for a reasonably priced, fully functional gateway. In order to provide more equitable pricing on Service Agreements we will introduce a new mechanism which will be available immediately. There will be server/product based support agreements rather than a blanket cost which penalizes the smaller user. Please visit our Service Agreements page to see more details. On a less positive note we have been monitoring downloads and activations of Declude software and have discovered that there are a significant number of non licensed copies being used. These include customers downloading the latest release without a valid Service Agreement and others who have installed multiple copies of unlicensed software. We encourage all customers who are participating in these activities to regularize their legal position by December 31st, 2004. If you have any questions as to the validity of your installation please email us at [EMAIL PROTECTED] or call us at (866) 332-5833 between 8.00 am and 5 pm Eastern Time, Monday thru Friday. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
RE: [Declude.JunkMail] Service Agreements
So $264 for Declude AV/JM regardless if Pro or Standard, or multiple SA's? -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, December 01, 2004 12:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Service Agreements I seem to recall that the license code is based on the fqdn of the mail server. Wouldn't that mean that an individual license would be required for each server it is installed on in order to function? That is correct. The Declude software is licensed per-server, so if you have multiple servers, you need multiple copies of Declude (just as you would need multiple copies of Windows and IMail). Even if the hostnames are the same, multiple licenses are necessary. I also think that the updates covered by the service agreement are for all products anyway since there is only one codebase for all products but individual config file for each product. That would mean that if you had just JM, the updates also includes the code for AV and HJ as well. Correct. The activation codes determine which products are being run; the declude.exe file contains the code for all of them, so upgrading one upgrades them all. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blocking Dictionary Attacks
Are there any new strategies for blocking dictionary attacks with Declude? Our log files are growing and mostly due to the following stacking up it seems a zillion times over... ERR MAIL.DOMAIN.NET invalid user We have used BlackIce for years and helps a lot for those that try X number SMTP fails in X seconds, but does not handle all these invalid user attempts. I searched archives and found good thread back in March this year How do they do it? and Scott replied a Declude solution may be possibly forthcoming. We only handle about 15k messages a day and small shop. Len's IMgate or another Postfix gateway solution I know would be best - but not affordable for us right now installing and managing a separate Linux box. It is difficult for me to keep up-to-date with daily posts, so wondering if any new strategies I might have missed. Thanks! -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe
I posted this to Declude.Virus, but apparently no longer subscribed and wanted to give folks a heads up here. Yesterday upgraded to most recent version of F-Prot Windows (fp-win_316_m) and this morning by chance I checked my declude virus log and noticed a bunch of Your virus scanner DOES NOT EXIST ... entries. Sure enough was missing F-Prot.exe file. I rolled back to version fp-win_315b_m and all back to normal including install of F-Prot.exe. Wish the folks at F-Prot let us know about this! Performing full scan now to see what may have slipped through last 36 hours. -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe
According to Declude Virus manual states f-prot.exe in their example. I did not know or see that recommendation? -Don - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 9:00 AM Subject: Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe Don't you want to be using fpcmd anyway? That's the recommended scanner to use with Declude. Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 8:49 AM Subject: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe I posted this to Declude.Virus, but apparently no longer subscribed and wanted to give folks a heads up here. Yesterday upgraded to most recent version of F-Prot Windows (fp-win_316_m) and this morning by chance I checked my declude virus log and noticed a bunch of Your virus scanner DOES NOT EXIST ... entries. Sure enough was missing F-Prot.exe file. I rolled back to version fp-win_315b_m and all back to normal including install of F-Prot.exe. Wish the folks at F-Prot let us know about this! Performing full scan now to see what may have slipped through last 36 hours. -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking Dictionary Attacks
Thanks for reply. One thing I found this morning on IMail list recent post was BlackIce settings whereas will auto-block IP for 3 failed non-existent user attempts within 30 seconds. The BlackIce documentation is poor on this subject and never figured it out myself over the years we have been using, but an IMail poster posted good instructions from a fellow who wrote the manual on Blackice apparently. Anyhoo... I set-up this morning and have been monitoring. It is working well so far and at least I am only seeing only 3 log entries now in Imail logs on non-existent users vs. hundreds per IP. I am still very concerned that I may end up blocking legitimate IP's via zombies and going to watch closely for awhile. The other trade off is BlackIce may be working harder now and seeing 4-6% on CPU, but think this was typical anyway. BlackIce also does a decent job on other things like infected Zip signatures and attached exe's etc. I feel comfortable with it as another security layer. For example on our SQL server, we use it to block the hundreds probing our port 1433 daily. We handle light email volume in comparison to others here and I am sure if someone out there floods us hard, the IMail box and BlackIce would not hold up. But on limited volume and budget this may be the ticket for us now. I know the gateway is the best way to go. Thanks for the feedback - most appreciated and always learning here. -Don - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 8:59 AM Subject: Re: [Declude.JunkMail] Blocking Dictionary Attacks A gateway is the only solution I know of for distributed dictionary attacks. Since the attacks are coming from all over the place, there's no IP to block. All the gateway does is move the brunt of the attack off of the primary mail server to the gateway server. The gateway server should then become your primary MX record, replacing your existing server, and the real primary should be locked down to only receive SMTP traffic from your gateway. That way attackers who cache your MX records won't be able to continue to hit it. Darin. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 5:20 AM Subject: [Declude.JunkMail] Blocking Dictionary Attacks Are there any new strategies for blocking dictionary attacks with Declude? Our log files are growing and mostly due to the following stacking up it seems a zillion times over... ERR MAIL.DOMAIN.NET invalid user We have used BlackIce for years and helps a lot for those that try X number SMTP fails in X seconds, but does not handle all these invalid user attempts. I searched archives and found good thread back in March this year How do they do it? and Scott replied a Declude solution may be possibly forthcoming. We only handle about 15k messages a day and small shop. Len's IMgate or another Postfix gateway solution I know would be best - but not affordable for us right now installing and managing a separate Linux box. It is difficult for me to keep up-to-date with daily posts, so wondering if any new strategies I might have missed. Thanks! -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe
I missed that in the release notes - ouch! So... the fpcmd.exe should be used as Darin stated. I did not notice in the Declude Virus manual when reviewing this morning, just double checked and sure is there as one of the 2 choices depending on version. All back to normal and thanks guys. -Don - Original Message - From: Jeff Pereira [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 8:57 AM Subject: Re: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe They certainly could have made it more noticeable, but From the Release Notes: The DOS scanner is now no longer installed on NT/2000/XP/2003. If version 3.16 is installed as an upgrade then the previous DOS version is removed. The DOS scanner is not suitable for use on the NTFS file system, now more popular as the result of increased use of Windows XP. The Command-Line Scanner (fpcmd.exe) should be used instead of the DOS scanner. - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 23, 2004 8:49 AM Subject: [Declude.JunkMail] F-Prot Windows 3.16 Update Missing F-Prot.exe I posted this to Declude.Virus, but apparently no longer subscribed and wanted to give folks a heads up here. Yesterday upgraded to most recent version of F-Prot Windows (fp-win_316_m) and this morning by chance I checked my declude virus log and noticed a bunch of Your virus scanner DOES NOT EXIST ... entries. Sure enough was missing F-Prot.exe file. I rolled back to version fp-win_315b_m and all back to normal including install of F-Prot.exe. Wish the folks at F-Prot let us know about this! Performing full scan now to see what may have slipped through last 36 hours. -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Declude/Smartermail
We are probably leaning this way too but still unsure because of sign-up applications we run require we store email account user info into SQL. -Don - Original Message - From: David Sullivan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 08, 2004 11:38 AM Subject: Re[2]: [Declude.JunkMail] Declude/Smartermail We're moving our installs to SM as well, hoping to see Declude support for it ): J Ditto! One more vote for SM. Looks like we're going that route as well with our 2 (soon to be 3) installations. Really hope to be able to take Declude with us. If not, will probably migrate to MXGuard. -David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Declude/Smartermail
Holding off on SmarterMail here too and again need SQL DB with email account info for our integrated member applications. Do you have a link to MailMax? I am just as upset as others about IMail recent policies and been using since version 4.0. Today I saw a post you can renew unlimted version SA for $310 through a reseller. For some reason over the years never thought to price out with a reseller. I want a SA with whatever email server we go forward with. Whether it be short or long term. I feel at that reseller price we can handle for awhile longer until something else comes along we are comfortable (being ODBC/Declude/Sniffer/Good Web Mail). Seems to me with the talent at CH could handle with proper funding - but again probably a huge task to undertake full blown MTA with comparable IMail functionality/features. -Don - Original Message - From: Wolf Tombe [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 08, 2004 7:32 PM Subject: RE: Re[2]: [Declude.JunkMail] Declude/Smartermail Has anyone load tested Smartermail? It looks pretty good, but being rather new on the market and only showing smaller clients as their customers I'm wondering how many domains and users they can really scale to. This is the one major concern I have with them (and also the primary reason I've been looking at MailMax as a potential iMail replacement). - Wolf -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Monday, November 08, 2004 9:56 AM To: [EMAIL PROTECTED] Subject: Re[2]: [Declude.JunkMail] Declude/Smartermail Hello Eric, Monday, November 8, 2004, 9:30:42 AM, you wrote: EK What about SQL support in another product? I'd look at EK switching but the db storage is key to me. I rebuilt a machine EK after a crash and had imail back running with 100+ domains and EK 2000 users quickly with all the account info coming from their. That's probably biggest drawback for us as well. We have about 50 domains on SQL2k BUT would be willing to rewrite our app to support Smartermail's file system/xml storage that's manageable completely by web service. No registry to deal with, makes backup/restore a complete dream. -David -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Client TOS Notifications from AOL
Declude Folks, I need some help figuring out why we are receiving e-mails from [EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To address is [EMAIL PROTECTED] I am not sure if these are coming back to me in our abuse or postmaster account? There is nothing in the body of the e-mail, only an attachment of e-mail apparently getting rejected. Anyone else seeing these? The client we host forwards his e-mail automatically to his AOL account. For example, below is the header of an e-mail that was attached whereas a spam e-amail appears to have been sent to our client (lamphier.com) hosted on our IMail server (sneezy.xerocom.net - vacant.spiderhost.com is router) which was forwarded to his AOL account. Unfortunately it did not weight enough under our Declude config, nor Sniffer to get held as Spam. Any ideas what AOL is doing or what I should do to eliminate these most appreciated. Worried about getting on the wrong side of AOL. Thanks. -Don Return-Path: [EMAIL PROTECTED] Received: from rly-xa05.mx.aol.com (rly-xa05.mail.aol.com [172.20.64.41]) by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id MAILINXA31-7341621d0d322; Tue, 05 Oct 2004 00:03:36 -0400 Received: from SNEEZY.XEROCOM.NET (vacant.spiderhost.com [65.57.241.197]) by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400 Received: from SMTP32-FWD by lamphier.com (SMTP32) id A1BF42BA100B8F0C3; Mon, 4 Oct 2004 23:58:48 Received: from pelxavirus3.terra.com.pe [200.48.36.5] by SNEEZY.XEROCOM.NET with ESMTP (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400 Received: from anamaria (unknown [200.106.79.108]) by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4; Mon, 4 Oct 2004 23:07:07 -0500 (PET) Message-ID: [EMAIL PROTECTED] To: Undisclosed Recipients From: Anni [EMAIL PROTECTED] Subject: Proposal Date: Mon, 4 Oct 2004 23:03:21 -0500 MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain pelxavirus3.terra.com.pe has no MX or A records [0301]. X-RBL-Warning: WEIGHT1-9: Total weight between 1 and 9. X-Declude-Sender: [EMAIL PROTECTED] [200.48.36.5] X-Declude-Spoolname: D1bf42ba100b8f0c3.SMD X-Note: CompBiz scanned with Declude JunkMail. X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, WEIGHT1-9 [7]. X-Note: This E-mail was sent from smtp7.terra.com.pe ([200.48.36.5]). X-Sender: Sender of E-mail: [EMAIL PROTECTED] X-Note: RevDNS Remote Server smtp7.terra.com.pe ([200.48.36.5]). X-AOL-IP: 65.57.241.197 X-Mailer: Unknown (No Version) Dear Customer, =20 Be the very first listing in the top search engines immediately. =20 Our company will now place any business with a qualified website permanently= at the top of the major search engines guaranteed never to move. This prom= otion includes unlimited traffic and is not going to last long. If you are=20= interested in being guaranteed first position in the top search engines at a= promotional fee, please contact us promptly to find out if you qualify via=20= email at [EMAIL PROTECTED] AND INCLUDE THE URL(s) YOUR ARE INTERESTED I= N PLACING. This is not pay per click.=20 The following are examples on Yahoo!, MSN and Alta Vista: =20 Company: Oahu Dive Center URL: http://oahudivecenter.com keyword: oahu scuba diving =20 Company: California Moves.com URL: http://steph.cbsocal.com keyword: find a home southern california =20 Sincerely, =20 IGN The Search Engine Promotional Consultants --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Client TOS Notifications from AOL
Kami John, Thanks a ton guys! That was me that registered on the AOL feedback loop using our abuse addy, but going back months ago and did not realize. So much to keep up with battling Spam! Just a few more points on my Declude weight and would not have made it to AOL - ohhh well - will keep tweaking our config. -Don - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 06, 2004 10:31 AM Subject: RE: [Declude.JunkMail] Client TOS Notifications from AOL Some one at your company signed up and registered to receive these feedback loop messages. http://postmaster.info.aol.com/tools/fbl.html John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Wednesday, October 06, 2004 7:09 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Client TOS Notifications from AOL Declude Folks, I need some help figuring out why we are receiving e-mails from [EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To address is [EMAIL PROTECTED] I am not sure if these are coming back to me in our abuse or postmaster account? There is nothing in the body of the e-mail, only an attachment of e-mail apparently getting rejected. Anyone else seeing these? The client we host forwards his e-mail automatically to his AOL account. For example, below is the header of an e-mail that was attached whereas a spam e-amail appears to have been sent to our client (lamphier.com) hosted on our IMail server (sneezy.xerocom.net - vacant.spiderhost.com is router) which was forwarded to his AOL account. Unfortunately it did not weight enough under our Declude config, nor Sniffer to get held as Spam. Any ideas what AOL is doing or what I should do to eliminate these most appreciated. Worried about getting on the wrong side of AOL. Thanks. -Don Return-Path: [EMAIL PROTECTED] Received: from rly-xa05.mx.aol.com (rly-xa05.mail.aol.com [172.20.64.41]) by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id MAILINXA31-7341621d0d322; Tue, 05 Oct 2004 00:03:36 -0400 Received: from SNEEZY.XEROCOM.NET (vacant.spiderhost.com [65.57.241.197]) by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400 Received: from SMTP32-FWD by lamphier.com (SMTP32) id A1BF42BA100B8F0C3; Mon, 4 Oct 2004 23:58:48 Received: from pelxavirus3.terra.com.pe [200.48.36.5] by SNEEZY.XEROCOM.NET with ESMTP (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400 Received: from anamaria (unknown [200.106.79.108]) by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4; Mon, 4 Oct 2004 23:07:07 -0500 (PET) Message-ID: [EMAIL PROTECTED] To: Undisclosed Recipients From: Anni [EMAIL PROTECTED] Subject: Proposal Date: Mon, 4 Oct 2004 23:03:21 -0500 MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain pelxavirus3.terra.com.pe has no MX or A records [0301]. X-RBL-Warning: WEIGHT1-9: Total weight between 1 and 9. X-Declude-Sender: [EMAIL PROTECTED] [200.48.36.5] X-Declude-Spoolname: D1bf42ba100b8f0c3.SMD X-Note: CompBiz scanned with Declude JunkMail. X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, WEIGHT1-9 [7]. X-Note: This E-mail was sent from smtp7.terra.com.pe ([200.48.36.5]). X-Sender: Sender of E-mail: [EMAIL PROTECTED] X-Note: RevDNS Remote Server smtp7.terra.com.pe ([200.48.36.5]). X-AOL-IP: 65.57.241.197 X-Mailer: Unknown (No Version) Dear Customer, =20 Be the very first listing in the top search engines immediately. =20 Our company will now place any business with a qualified website permanently= at the top of the major search engines guaranteed never to move. This prom= otion includes unlimited traffic and is not going to last long. If you are=20= interested in being guaranteed first position in the top search engines at a= promotional fee, please contact us promptly to find out if you qualify via=20= email at [EMAIL PROTECTED] AND INCLUDE THE URL(s) YOUR ARE INTERESTED I= N PLACING. This is not pay per click.=20 The following are examples on Yahoo!, MSN and Alta Vista: =20 Company: Oahu Dive Center URL: http://oahudivecenter.com keyword: oahu scuba diving =20 Company: California Moves.com URL: http://steph.cbsocal.com keyword: find a home southern california =20 Sincerely, =20 IGN The Search Engine Promotional Consultants --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives
RE: [Declude.JunkMail] Client TOS Notifications from AOL
Good question and I am curious too. We actually have a no-forwarding e-mail policy and not just to AOL. But... sometimes the customer dictates what they want or will go elsewhere and we then allow on a case-by-case basis. If we allowed for every customer I bet we would be blacklisted already. I am still fearful AOL may blacklist on what little traffic we do have getting forwarded. Thanks. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Flook Sent: Wednesday, October 06, 2004 12:43 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Client TOS Notifications from AOL On this note, what are other's policy on forwarding client's addresses to AOL accounts? We signed up with this feedback loop program quite some time and realized that 95% of the reported spam's where coming from forwarded messages to AOL accounts. In the event of forwarded messages, our IMail box takes the blame instead of the original MTA. I have considered creating a policy of not allowing mail forwarding to AOL accounts for fear of getting blacklisted from AOL. Steve -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Wednesday, October 06, 2004 11:37 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Client TOS Notifications from AOL Kami John, Thanks a ton guys! That was me that registered on the AOL feedback loop using our abuse addy, but going back months ago and did not realize. So much to keep up with battling Spam! Just a few more points on my Declude weight and would not have made it to AOL - ohhh well - will keep tweaking our config. -Don - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 06, 2004 10:31 AM Subject: RE: [Declude.JunkMail] Client TOS Notifications from AOL Some one at your company signed up and registered to receive these feedback loop messages. http://postmaster.info.aol.com/tools/fbl.html John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Don Schreiner Sent: Wednesday, October 06, 2004 7:09 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Client TOS Notifications from AOL Declude Folks, I need some help figuring out why we are receiving e-mails from [EMAIL PROTECTED] Subject Line: Client TOS Notification, and the Sent To address is [EMAIL PROTECTED] I am not sure if these are coming back to me in our abuse or postmaster account? There is nothing in the body of the e-mail, only an attachment of e-mail apparently getting rejected. Anyone else seeing these? The client we host forwards his e-mail automatically to his AOL account. For example, below is the header of an e-mail that was attached whereas a spam e-amail appears to have been sent to our client (lamphier.com) hosted on our IMail server (sneezy.xerocom.net - vacant.spiderhost.com is router) which was forwarded to his AOL account. Unfortunately it did not weight enough under our Declude config, nor Sniffer to get held as Spam. Any ideas what AOL is doing or what I should do to eliminate these most appreciated. Worried about getting on the wrong side of AOL. Thanks. -Don Return-Path: [EMAIL PROTECTED] Received: from rly-xa05.mx.aol.com (rly-xa05.mail.aol.com [172.20.64.41]) by air-xa03.mail.aol.com (v101_r1.4) with ESMTP id MAILINXA31-7341621d0d322; Tue, 05 Oct 2004 00:03:36 -0400 Received: from SNEEZY.XEROCOM.NET (vacant.spiderhost.com [65.57.241.197]) by rly-xa05.mx.aol.com (v101_r1.5) with ESMTP id MAILRELAYINXA55-7341621d0d322; Tue, 05 Oct 2004 00:03:25 -0400 Received: from SMTP32-FWD by lamphier.com (SMTP32) id A1BF42BA100B8F0C3; Mon, 4 Oct 2004 23:58:48 Received: from pelxavirus3.terra.com.pe [200.48.36.5] by SNEEZY.XEROCOM.NET with ESMTP (SMTPD32-8.12) id ABF42BA100B8; Mon, 04 Oct 2004 23:58:44 -0400 Received: from anamaria (unknown [200.106.79.108]) by pelxavirus3.terra.com.pe (Postfix) with ESMTP id 295EDB7CA4; Mon, 4 Oct 2004 23:07:07 -0500 (PET) Message-ID: [EMAIL PROTECTED] To: Undisclosed Recipients From: Anni [EMAIL PROTECTED] Subject: Proposal Date: Mon, 4 Oct 2004 23:03:21 -0500 MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain pelxavirus3.terra.com.pe has no MX or A records [0301]. X-RBL-Warning: WEIGHT1-9: Total weight between 1 and 9. X-Declude-Sender: [EMAIL PROTECTED] [200.48.36.5] X-Declude-Spoolname: D1bf42ba100b8f0c3.SMD X-Note: CompBiz scanned with Declude JunkMail. X-Spam-Tests-Failed: NOABUSE, HELOBOGUS, WEIGHT1-9 [7]. X-Note: This E-mail was sent from smtp7.terra.com.pe
Re: [Declude.JunkMail] SPF Text Record Help Needed
Weird posting to yourself but figured it may be good for the archives for anyone in the same boat. I never did get a response from anyone on the list and frankly knew was asking a lot for folks to digest on a busy Monday morning. Anyway, I got all the SPF set-up and the wizard figured out for our different client situations. If you have something similar and need help, hit me and be glad to share. Thanks. -Don - Original Message - From: Don Schreiner [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 19, 2004 9:10 AM Subject: [Declude.JunkMail] SPF Text Record Help Needed I need help understanding the correct SPF text record for a customer domain . I have read the archives, been to the pobox site and read and still not absolutely certain. We allow some customers to SMTP relay from their dedicated IP and also from their e-mail Contact Form via their web site - we also host on a separate server and within the same network Workgroup. Our Workgroup of servers communicate to each other via private IP addresses. Thanks in advance to anyone who has the time. -Don Our set-up is IMail (8.12) and Declude (1.79). Customer domain is configured as a virtual host on the IMail server. a) Sample customer dedicated IP is (64.x.x.123) and allowed to SMTP relay from their office via IMail. b) Sample IMail server Public Host IP is (imail.hosting.com 209.x.x.567) c) Sample Web server Private IP is (webA 192.x.x.10) where their Contact Form e-mail orginates. *Note the pobox wixard finds 2 MX records for this sample customers domain, the first being as on IMail their MX (mail.customerdomain.com) and the second being our colo router (vacant.colodomain.com). The POBOX Wizard Questions and My Question below... -- 1) Let's set up SPF records for mail.customerdomain.com. mail.customerdomain.com's IP address is 209.x.x.567. Does that server send mail from mail.customerdomain.com? yes no My Question: Do I answer yes or no? The domain is configured as (customerdomain.com) and alias of (mail.customerdomain.com) as a virtual host in Imail. They send email from their office dedicated IP of (64.x.x.123) and via WebMail for the IMail server public and virtual domain IP (209.x.x.567), and also originating from the Web server IP (webA 192.x.x.10) to the Imail server. -- 2) This wizard found 2 names for mail.customerdomain.com's MX servers. MX servers receive mail for mail.customerdomain.com. Do they also send mail from mail.customerdomain.com? yes no My Question: Do I answer yes or no? In addition to the above info for the first question, our DNS only has one primary MX record entered for the (customerdomain.com) (209.x.x.567), but apparently it is also picking up our colo router name too (vacant.colodomain.com) with the same IP number (209.x.x.567). -- 3) Do you want to just approve any host whose name ends in mail.customerdomain.com? yes no My Question: Do I answer yes or no? I feel I should answer No, again not sure and concerned with this question as mail typically identified from this domain as customerdomain.com and not mail.customerdomain.com which is the alias configured in Imail. -- 4) Do any other servers send mail from mail.customerdomain.com? My Questions: Here they provide 3 fields to list other servers with regular hostnames, MX servers, and IP addresses. A) For the Host names field, do I also list the Web server private Web server name (web)? This is where some e-mail is originating from the customers Web site contact form. Do I also list our IMail server hostname (imail.hosting.com) since the mail.customerdomain.com is virtual? Do I enter the colo router hostname too (vacant.colodomain.com) being identified by the wizard with our IMail host IP? B) For the MX servers field, I am assuming to enter only the customer MX (mail.customerdomain.com) or should I also enter the IMail server primary hostname (imail.hosting.com)? C) For the IP addresses field, do I enter the IP's for the IMail server which is the same for the customers virtual domain? Should I also enter the Web server private IP (192.x.x.10) to cover their contact form on the Web server? -- 5) Could mail from mail.customerdomain.com originate through servers belonging to some other domain? If you send mail through your ISP's servers, name the ISP here. My Question: This is not the case for this customer who only sends from a dedicated IP at their office. Wondering however what you would enter if we also allowed SMTP auth and they had several employees in the field with different IPS connects? -- 6) Do the above lines describe all the hosts that send mail from mail.customerdomain.com? yes no My Questions: For this customer I would assume answering yes
[Declude.JunkMail] SPF Text Record Help Needed
I need help understanding the correct SPF text record for a customer domain . I have read the archives, been to the pobox site and read and still not absolutely certain. We allow some customers to SMTP relay from their dedicated IP and also from their e-mail Contact Form via their web site - we also host on a separate server and within the same network Workgroup. Our Workgroup of servers communicate to each other via private IP addresses. Thanks in advance to anyone who has the time. -Don Our set-up is IMail (8.12) and Declude (1.79). Customer domain is configured as a virtual host on the IMail server. a) Sample customer dedicated IP is (64.x.x.123) and allowed to SMTP relay from their office via IMail. b) Sample IMail server Public Host IP is (imail.hosting.com 209.x.x.567) c) Sample Web server Private IP is (webA 192.x.x.10) where their Contact Form e-mail orginates. *Note the pobox wixard finds 2 MX records for this sample customers domain, the first being as on IMail their MX (mail.customerdomain.com) and the second being our colo router (vacant.colodomain.com). The POBOX Wizard Questions and My Question below... -- 1) Let's set up SPF records for mail.customerdomain.com. mail.customerdomain.com's IP address is 209.x.x.567. Does that server send mail from mail.customerdomain.com? yes no My Question: Do I answer yes or no? The domain is configured as (customerdomain.com) and alias of (mail.customerdomain.com) as a virtual host in Imail. They send email from their office dedicated IP of (64.x.x.123) and via WebMail for the IMail server public and virtual domain IP (209.x.x.567), and also originating from the Web server IP (webA 192.x.x.10) to the Imail server. -- 2) This wizard found 2 names for mail.customerdomain.com's MX servers. MX servers receive mail for mail.customerdomain.com. Do they also send mail from mail.customerdomain.com? yes no My Question: Do I answer yes or no? In addition to the above info for the first question, our DNS only has one primary MX record entered for the (customerdomain.com) (209.x.x.567), but apparently it is also picking up our colo router name too (vacant.colodomain.com) with the same IP number (209.x.x.567). -- 3) Do you want to just approve any host whose name ends in mail.customerdomain.com? yes no My Question: Do I answer yes or no? I feel I should answer No, again not sure and concerned with this question as mail typically identified from this domain as customerdomain.com and not mail.customerdomain.com which is the alias configured in Imail. -- 4) Do any other servers send mail from mail.customerdomain.com? My Questions: Here they provide 3 fields to list other servers with regular hostnames, MX servers, and IP addresses. A) For the Host names field, do I also list the Web server private Web server name (web)? This is where some e-mail is originating from the customers Web site contact form. Do I also list our IMail server hostname (imail.hosting.com) since the mail.customerdomain.com is virtual? Do I enter the colo router hostname too (vacant.colodomain.com) being identified by the wizard with our IMail host IP? B) For the MX servers field, I am assuming to enter only the customer MX (mail.customerdomain.com) or should I also enter the IMail server primary hostname (imail.hosting.com)? C) For the IP addresses field, do I enter the IP's for the IMail server which is the same for the customers virtual domain? Should I also enter the Web server private IP (192.x.x.10) to cover their contact form on the Web server? -- 5) Could mail from mail.customerdomain.com originate through servers belonging to some other domain? If you send mail through your ISP's servers, name the ISP here. My Question: This is not the case for this customer who only sends from a dedicated IP at their office. Wondering however what you would enter if we also allowed SMTP auth and they had several employees in the field with different IPS connects? -- 6) Do the above lines describe all the hosts that send mail from mail.customerdomain.com? yes no My Questions: For this customer I would assume answering yes, but hate to assume. Would answering yes be the correct answer? I see the ~all if you answer no, and the -all if you answer yes and read about Scott's suggestion of ?all being more appropriate in cases where there is no way to tell the originating SMTP IP address. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail
Scott et al, Standing by the sidelines here trying to keep up with this interesting thread and actually have some extra time to chime in. I am very concerned about installing this upgrade with the false positives being reported, dlls and uninstall bug reported, etc. Will Declude be addressing these issues and providing more information, what the install specifically does, suggested configurations concerning false postitives, warnings, ? I do believe this can be a valuable feature of Declude and like the concept. We do something similar via BlackIce firewall we have used for years as an extra layer of security. Over the last year we modifying the issue list file relating to virus signatures blocking IP's for 24 hours when detected. When the 24 hour block expires and upon the next connect from the IP with no virus signature detected the IP is no longer blocked. You can also manually unblock if a customer requests after verifying their work station is clean of virus'. Doing so has created a little extra end user support for us from time-to-time. However, customers love us afterwards because we helped them identify their workstation was infected by a virus unbeknownst to them. Something similar to this automation with Declude would seem helpful. Thanks. -Don Don Schreiner CompBiz, Inc. www.compbiz.net 407-322-8654 - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, July 10, 2004 8:08 AM Subject: Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail An I missing something? When I try to resolve mtldb.declude.com I get; tracert mtldb.declude.com Unable to resolve target system name mtldb.declude.com. That is by design -- mtldb.declude.com should not be resolvable. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] MTLD test -- Relationship between Viruses and Spam
Are these zombie machines also not trying to spread the same virus allowing them to exploit smtp to other machines? This was my understanding this occurred and my previous reference to using similar strategy with BlackIce blocking IP's for 24 hours with detected signatures. Thus also blocking Spam outgoing from these same machines. -Don - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, July 10, 2004 8:16 PM Subject: Re: [Declude.JunkMail] MTLD test -- Relationship between Viruses and Spam Forgive me, but I don't really see the rationale that because an IP address has been flagged as sending viruses that it is also sending out SPAM. Can someone enlighten me on this ? Most reports are that more than 50% of all spam is now coming from zombies, which typically are home computers that were infected by a virus that installs a trojan horse that the spammer has control over. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- CompBiz.Net scanned for Virus' --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Ignoring Negative Weights
If I end up with a negative wait, how do I configure to ignore and pass e-mail along. Is the following correct? Global.cfg NEGWEIGHT weightrange x x 0 -100 Default.JunkMail NEGWEIGHT IGNORE Thanks. -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Ignoring Negative Weights
Thanks for reply and yes this is how I use weights, but what I failed to mention is that I end up with a negative value often (i.e. -7, -1, etc.) depending on certain mail and it gets held. You are saying it should not get held. OK I must have a hold on a certain test that is failing even though ends up with negative weight too. For example I hold all that fail sniffer and are below weight of 14. Think I figured it out. Thanks! -Don -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 16 Jun 2003 10:57:11 -0400 If I end up with a negative wait, how do I configure to ignore and pass e-mail along. You don't need to do anything. The way the weighting system works, you decide what weight ranges to use to detect spam. For example, some people have it set up to HOLD E-mail based on the WEIGHT10 test (a weight of 10 or higher), and DELETE E-mail that fails the WEIGHT20 test (with a weight of 20 or higher). In this case, if you have a test that uses negative weights, the total weight of the E-mail will be reduced. For example, the weight of the E-mail may end up being -6. In this case, the E-mail would not fail the WEIGHT10 or WEIGHT20 tests. Is the following correct? Global.cfg NEGWEIGHT weightrange x x 0 -100 Default.JunkMail NEGWEIGHT IGNORE There's no need to do this, as the IGNORE action does nothing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - Scanned for Virus' by CompBiz.Net Sent via CompBiz.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Dictionary Attacks
Bill, Also running BI as of few weeks ago and tinkering with firewal.ini. Would you mind sharing the .ini changes you made. You can e-mail me off list. Thanks. Sincerely, Don Schreiner CompBiz, Inc. www.compbiz.net 407-322-8654 800-408-3688 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill B. Sent: Thursday, January 23, 2003 12:16 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks We started running BlackICE last month and it has been working nice for us. It requires a few config changes to get it to auto-block IPs that send you dictionary attacks, but it is definitely a good solution. Bill -Original Message- From: R. Scott Perry Sent: Thu, 23 Jan 2003 10:58:09 -0500 Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks It seems this morning that we have several dictionary attacks happening on one of Imail servers. Is there an easy to stop the person doing this? I have looked through the log files and cannot easily spot the person(s) doing this. Is there software that will prevent people from performing Dictionary Attacks in the future? The POP3 and Delcude processes are using like 50-09% of the CPU. Let me know if there is anything I can do... Are you sure that it is a dictionary attack? If the POP3 process has higher usage than normal, then E-mails are being sent to your users (which would mean that it either isn't a dictionary attack, or a hybrid attack where they send spam as part of the dictionary attack). You might want to check the archives of the IMail Forum for ideas on how to stop a dictionary attack. Some tricks are using a nobody alias (which I believe you are), or using a product like BlackIce Server to stop it. Unfortunately, Declude can't stop these, because it doesn't have access to the TCP/IP connection (which is where it would need to be stopped). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scanned by CompBiz for Viruses http://www.CompBiz.Net. Save 15 Percent on Virus Software by visiting http://www.compbiz.net/software_mcafee.cfm for details! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Our filter fromfiles.
Title: Message This is great for sharing and thank you.Is anyoneinterested in sharingtheir global.cfgand white/black list files and strategies that are working well for them. I feel overwhelmed these days keeping up the spam battle as mail server admin and all the other daily chores I am responsible. We handle a lot of religious and family oriented sites and cannot slack on our Spam control. A few days ago, I finally bit the bullet and subscribed to sortmonster's sniffer. Hoping the$300/yr will decrease my Spam review time spent each day. I thought I was doing a pretty good job of eliminating spam - until I put a hold for reviewon all caught bythe sniffer filter.Basically Idiscovered thatwe are onlystopping about1/2 of the Spam hitting our server.Some confirmed Spam I reviewed failed no other tests other than sniffer. Now I am trying to figure outhow to revise my weighting so I do not have so much to review in the hold folder.We have weight of 20 for hold and 30 for delete. We run about 18 filters all weighted. I want more deletes and less to review in the hold folder daily! Sniffer is picking up a lot of false positives too and I know I need to get reporting with them and taking advantage of their custom config files for my license. I use Tom's updated list ongoing for our blacklist from file and it is a big help. Is anyone willing to share their global.cfg who areusing sniffer, weighting, and their effective black and white lists that is workingout well for them? You can e-mail me off list [EMAIL PROTECTED]. Thanks. Don SchreinerCompBiz, Inc.www.compbiz.net407-322-8654800-408-3688 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami RazvanSent: Tuesday, January 21, 2003 6:47 PMTo: JunkMail ListSubject: [Declude.JunkMail] Our filter fromfiles. Hi; In case you are interested, we have created a simple Access database that contains all of our entries in for our fromfile and filter files. Since it is all in the database we thought we can simply replicate it with the web site and provide it to all to use or consider. You may want to visit: http://www.ClickandPledge.com/Support/Mail The categories are all separated since we have a different file for each filter type. Just for the records: We hold on weight 20 so all weights are based on this weight. FreeeMail list - should not be used as a blacklist but a weight list. We add 5 to this list. This list does not contain Hotmail.com or Yahoo.com. It has other (Yahoo.com.tw) domains. Hope it helps... Regards, Kami
RE: [Declude.JunkMail] Filter Questions/Suggestions
Kami, Very nice and thanks for sharing. We also use Tom's list - but I see how this can really augment what we are doing with our declude from file rules. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan Sent: Tuesday, January 14, 2003 4:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions Hi; [sorry for the long note] These files are changing everyday... Sure.. I hope the list does not mind. I have asked so we put a link on a location on our site and keep these files up to date. Similar to what Tom has done which has helped us quite a lot. Here is the legend to the files that are zipped. Please note: We hold on weight of 20. Some of these could be considered aggressive but believe me we may catch a positive 1 time a week. * Filter_Body.txt [filter]: This file is the words that we search for in the body. * Filter_BodyURL.txt [filter]: The URL's found in the body. * Filter_Header.txt [filter]: At times we have noticed that there are some servers that consistently show up in the connections that show up in our headers. Ex. Webhostingtotalk.com. So we added this to the header. We have our HOPHIGH set to 3. * Filter_MailFrom.txt [filter]: This is the mailfrom filter and certain characteristics are listed. If mailfrom email has these words in them. * Filter_Subject.txt [filter]: The subject words. Does subject include these. * JMFreeEmails.txt [fromfile]: This file is a list of all free email services we have found. This does not include hotmail.com or Yahoo.com but includes everything else. This list receives a weight of 5 regardless of what email. We have given BASE64 test a weight of 15. So if an email comes from a free email and is BASE64 is automatically held. * JMMailinglist.txt[fromfile]: This is the mailing lists that people subscribe to, e.g. CNN, etc. If these lists are caught then we add them to the list. This list receives -100 weight (negative 100). * JMBlacklistWgt.txt [fromfile]: comes from http://www.imagefxonline.net/apps/delog/fromfile.txt [any listing here is weight 20 - automatic hold] * JMBlacklist.txt [fromfile]: Our blacklist- We have a database and we run a unique on the list and export it to text. * JMPorn.txt [fromfile]: Recently separated from blacklist- emails from this list are deleted automatically. * JMSpammers.txt [fromfile]: Recently separated from blacklist- emails from this list are automatically deleted. * JMWatchList.txt [fromfile]: If we find an address that we are not sure we add them to the database. If additional occurances happen they will be moved to blacklist. If interested in knowing the syntax then it is the following: FILTER-HEADER filter d:\IMail\Declude\filter_header.txt x 0 0 FILTER-MAILFROM filter d:\IMail\Declude\filter_mailfrom.txt x 0 0 FILTER-SUBJECT filter d:\IMail\Declude\filter_subject.txt x 0 0 FILTER-BODY filter d:\IMail\Declude\filter_body.txt x 0 0 FILTER-BODYURL filter d:\IMail\Declude\filter_bodyurl.txt x 0 0 BLACKLIST fromfileD:\IMail\Declude\JMBlacklist.txt x 20 0 WATCHLIST fromfileD:\IMail\Declude\JMWatchlist.txt x 20 0 SPAMMERSfromfileD:\IMail\Declude\JMSpammers.txt x 20 0 PORNfromfileD:\IMail\Declude\JMPorn.txt x 20 0 BLACKLISTWRNfromfileD:\IMail\Declude\JMBlacklistWgt.txt x 20 0 FREEEMAILS fromfile D:\IMail\Declude\JMFreeEmails.txt x 5 0 # Negative Lists MAILINGLISTSfromfile D:\IMail\Declude\JMMailingLists.txt x -1000 I hope this helps. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Tuesday, January 14, 2003 3:48 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions So we have an active URL list that if found in the body of emails it will weigh them quite high. These URL's are real consistent and in combination of subject filters we have blocked pretty much all of them. Kami, that is a great idea. Would you be willing to share the list? Feel free to e-mail me off list if you like. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To
RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?
Scott, In response to additional info and questions please see below. When could we anticipate an ETA? Snippet Is this something that others would find useful? It definitely would be easier for us to implement. ***Regarding end user spam control via e-mail subscribe method. This would be a nice option, but I would prefer Web interface for our customers and ability to modify that page with instructions, graphics, support info, etc. I know a lot of pros, cons, opinions here from others, but I am customer driven. How about the option of both methods? Snippet First, if we do this, it would initially be for the per-user settings, with two options: either a Basic configuration that would let people choose between several options (such as No spam control, Conservative spam control, Aggressive spam control), or an Advanced configuration that would let people fine-tune their settings (such as using specific spam tests, and whitelisting/blacklisting). Later, we would probably add a way to access held E-mail, and possibly per-domain and global settings. ***This would be great for us and our customers! Snippet What we would most likely not do is use a database..., use IIS, or any special technologies (such as dot NET, ASP, CF, etc.)... ***This also would be good for us even though we are a CF/SQL shop. We run IIS anyway on our mail servers to redirect older mail clients. -Don S. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scanned by CompBiz for Viruses http://www.CompBiz.Net. Save 15 Percent on Virus Software by visiting http://www.compbiz.net/software_mcafee.cfm for details! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Shared Kill File Stats
Wow Fritz that's impressive! Good job and Tom thanks for the info on the upgrade. -Don S -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Frederick P. Squib, Jr. Sent: Monday, December 16, 2002 9:12 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Shared Kill File Stats Hi all, Since we're bragging about our killfie usage... Sunday was a bit slow, we've been averaging 55,000 messages per day since the beginning of December. Declude Log file information: --- Total amount of unique messages found in log: 36292 Total amount of fromfile IDs found in log: 361 Total amount of fromfile ID failures found in log: 18406 Total Percentage of fromfile effectiveness: 51% --- Fromfile and Merge file Information: --- Total amount of addresses in the original fromfile: 857 Total amount of addresses updated from usage: 361 Total amount of addresses added from merge: 6 Total amount of addresses that were removed: 11 Total amount of addresses in the merge file: 7 Total amount of duplicate addresses in merge file: 1 Total amount of addresses now in the fromfile: 852 Total percentage of the fromfiles actual usage: 42% --- I generally post the results on our webpage for our users to see, just so they know what we're doing and what we're up against. Feel free to check it out and as always use my entries at your own risk, they work well for me and my customers with almost no complaints. The link is about the middle of our homepage under Current SPAM filter stats. Thanks again for the great add-on program Tom! Fritz Frederick P. Squib, Jr. Network Administrator Citizens Internet Services http://www.wpa.net --- [This E-mail scanned for viruses by Citizens Internet Services with Declude Virus v 1.65] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scanned by CompBiz for Viruses http://www.CompBiz.Net. Save 15 Percent on Virus Software by visiting http://www.compbiz.net/software_mcafee.cfm for details! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?
Scott, I vote yes. Our users would love it! If you or another does not create it - we would eventually work on something for our customers based on repeat requests. It's either I pay my guys, another, or you. Several months ago another Decluder here shared files they developed of end user filter tools working with Declude. It was simple for the end user and well thought out. If I remember correctly there were limits or you had to go the long way around because of some JM per user/per domain issues. I was going to try and work on it some more and use, and then share back, but other more pressing dev came up for us and not had a chance to revisit. I will look through my files and try and get you a name. He is a user here and it fitted the bill nicely. Hopefully he will see my post and reply. It was basically select your Spam settings High / Low (predefined filters) or configure yourself from a list. What would you write it in? Keep us informed of your plans. Sounds great and I really like the idea of it being developed by your team to work directly with Declude JM! Even something very simple to turn on/off certain filters or groups of filters (i.e. high/low) to start would be nice. I would want to be able to define a default when setting up new accounts. -Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, December 16, 2002 7:50 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] An optional web interface for Declude JunkMail? A lot of our customers seem to want a web interface to Declude JunkMail, mostly so that customers can turn their spam settings on or off. We haven't come up with something in the past, because it is very complicated without a hook into web messaging, and it doesn't look like Ipswitch is planning to add an interface to web messaging any time soon. However, we are at the point where we are considering a web interface. If we do it, it would probably need to be done as an addon to Declude JunkMail, mainly because the development and support costs would be fairly high. It would also have some drawbacks, being separate from web messaging. For example, it would require installing a separate service, using a different port than 80 or 8383 for web access (which may cause firewall problems), and having users enter their username/password a second time (if they are already using web messaging). Is this something that is important enough that it would be worthwhile? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scanned by CompBiz for Viruses http://www.CompBiz.Net. Save 15 Percent on Virus Software by visiting http://www.compbiz.net/software_mcafee.cfm for details! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] An optional web interface for Declude JunkMail?
I agree with what you are saying and especially no need for GUI for Declude administrator. Not sure I read Scott's original post correctly? I was thinking he meant end user on/off/select/remove filters tool. Filters set-up, defined, and made available for selection by the Declude administrator. Simple non-admin level type on/off Spam control tools to end users (simplicity similar to Hotmail and Yahoo) would be well received by my customers anyway. It would actually help me feel better to put the on/off part in the end users hands in response to the previous poster (Joe) who described being uneasy filtering Spam. -Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Patnode Sent: Tuesday, December 17, 2002 12:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] An optional web interface for Declude JunkMail? Scott, I've spent thousands of hours (as many of us have) perfecting a universally applicable configuration (as diverse as my client base allows). On the server side, when there's a flaw in the system revealed by an FP, changing the entire system means all other clients benefit from the change. Creating an individual exception (like a whiltelist entry) is a last resort used only when fixing the system would weaken it to much. If users are making their own changes and not reporting problems, no one else is benefiting. On the client side, every time users get ahold of anti spam systems, they invariably over use them, marking as spam even a newsletter they no longer want. A user customizable system then, would need to be more focused than domain specific, it would need to be user specific. In my store forward configuration, that would mean tracking which aliases belong to which user, lest they make a change on account A1 and not have it affect A2. My itself, this one issue may take more time than this solutions aims to solve. Whatever you do, don't make an admin GUI for Declude. Nothing ruins an infinitely customizable (and useful) program faster than a limiting interface. Others may be facing a gauntlet of user requests that this would remedy, but IMHO, technical improvements that give more tools to stop spam are more useful and should have greater priority. Dan On Monday, December 16, 2002 16:49, R. Scott Perry [EMAIL PROTECTED] wrote: A lot of our customers seem to want a web interface to Declude JunkMail, mostly so that customers can turn their spam settings on or off. We haven't come up with something in the past, because it is very complicated without a hook into web messaging, and it doesn't look like Ipswitch is planning to add an interface to web messaging any time soon. However, we are at the point where we are considering a web interface. If we do it, it would probably need to be done as an addon to Declude JunkMail, mainly because the development and support costs would be fairly high. It would also have some drawbacks, being separate from web messaging. For example, it would require installing a separate service, using a different port than 80 or 8383 for web access (which may cause firewall problems), and having users enter their username/password a second time (if they are already using web messaging). Is this something that is important enough that it would be worthwhile? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scanned by CompBiz for Viruses http://www.CompBiz.Net. Save 15 Percent on Virus Software by visiting http://www.compbiz.net/software_mcafee.cfm for details! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Shared Kill File Stats
Tom and other Kill List folks. Thought I would share as I usually do not get to run stats at end of day before clock strikes 12am. Amazing that at least 58% of email processed for the day was garbage. If I were to include the manual deletes and emails that got through our lenient filters, it would probably be something more like 75%. Report ID Version 1.04b Detailed Report for: 12/16/2002 00:07:48 Declude Log file information: --- Total amount of unique messages found in log: 1570 Total amount of fromfile IDs found in log: 190 Total amount of fromfile ID failures found in log: 915 Total Percentage of fromfile effectiveness: 58% --- Fromfile and Merge file Information: --- Total amount of addresses in the original fromfile: 2309 Total amount of addresses updated from usage: 190 Total amount of addresses added from merge: 56 Total amount of addresses that were removed: 0 Total amount of addresses in the merge file: 57 Total amount of duplicate addresses in merge file: 1 Total amount of addresses now in the fromfile: 2365 Total percentage of the fromfiles actual usage: 8% --- -Don S --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
Errr I second that response as I spend my daily morning hour cleaning Spam from the servers. Tom has a great service with his list and while an occasional address mistakenly listed - it is incredible how the addresses are near the same as the addresses we add to our list when running Read ID and it checks for duplicates. -Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Tom Sent: Thursday, November 14, 2002 8:08 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx Importance: High Well I just wanted to see what the reason was. I assumed since all the entries have a catalogue number that the reason was recorded. In addition I do believe outpost does have removal instructions at the bottom of the emails. Our List: Our list is a private list, however, we do share it with the Declude community. Image`fx is not in the business to stop spam, we are a local ISP/Developer not SpamCop. We don't have the time and/or resources to become one. The idea behind the list was suppose to be for all of us to share or contribute to. Not many people have contributed to our list, but that's ok, we don't need the extra work. We have also indicated to those who use the list to use it at their own risk and to consider using it with a weight value. IDs: The ID's were added to work with our program ReadID to help identify the address inside Declude's log file without using a separate database. The ID's contain a date and unique number as a description. This description only works with Declude's fromfile not Imail's kill list. This unique ID will indicate to ReadID the last time of usage so it can clean out addresses that spammers no longer use after X number of days. Removal: While this may be true for most services I don't feel that we should have to do this, we did not sign up for it, so why the heck should we sign out from it. Why would I or you want to tell them that we actually exist? Why should I have to tell them I don't want their stupid little news letters or pornographic garbage? I did not ask for it in the first place, not only that, it's MY server that they are using to advertise from. Well, guess what, they can kiss my royal spam a$$. They did not pay for my system. I did, my blood, my sweat, my hard earned money. What right do they have? A loop whole the law? Either way I don't care. ok I will calm down now The problem with those so called removal options is that you never know what their intentions actually are. I did try this method and guess what, I got even MORE SPAM. So a word to the wise, don't believe everything you see. It's just as bad a an ANTI SPAM company sending us spam to stop their spam, what the heck do they think they sent us in the first place? Best Regard, Tom Image`fx Productions, Inc. Provider of ExecNet Internet Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scanned by CompBiz for Viruses http://www.CompBiz.Net. Save 15 Percent on Virus Software by visiting http://www.compbiz.net/software_mcafee.cfm for details! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Helo Bogus Question
Received: from w0.xxxletter.com [208.202.133.101] by email.catholicweb.com with ESMTP (SMTPD32-6.06) id AFB03E4600B8; Thu, 05 Sep 2002 15:33:52 -0500 This one failed the HELOBOGUS test because the remote mailserver identified itself as w0.xxxletter.com, but that host doesn't exist (if you try ping w0.xxxletter.com, you'll see Unknown host or something similar). Thanks so far on the answers. OK, but it did not fail the HELOBOGUS test in the sample e-mail I posted the header is the point I was making. Well at least Declude did not tell me that it failed it - like I have seen on others we are catching. I think my HELOBOGUS is set-up correctly because on other e-mails I do see it failing. However, this one like many others Declude does not indicate it failed HELOBOGUS. Does that make sense? I have got to run to a meeting - but will be back soon. Again thanks. -Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Friday, September 06, 2002 8:17 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Helo Bogus Question I am seeing a lot of these (see header below) whereas the From address is the same as the To address of one of our domains (is this spoofing the domain?). I am catching them (barely in this case) based on weight of other tests, but not sure I understand why these are not failing the HELO BOGUS test too. The HELOBOGUS test looks for HELO/EHLO data (where the remote mailserver identifies itself). It is required to identify itself with a valid host name. I am seeing the HELO BOGUS fail on some of the other Spam e-mails, however not always on those like the sample below. I must not be fully understanding the HELO BOGUS test. Is it because the Received domain and the IP match up - and only the From address is being forged? No. It just checks to see if the host name is valid. When the From Address is being forged like this, what is my best defense? I would prefer to just have these auto-deleted when this type of forging occurs, as it seems to me - these would 100% of the time always be Spam. Or is that incorrect thinking? The problem is that there are some people out there (in most cases, it's The Boss) who always Cc: themselves. And some people send themselves test messages. So you need to be careful if you look for a To: and From: that match. Received: from w0.xxxletter.com [208.202.133.101] by email.catholicweb.com with ESMTP (SMTPD32-6.06) id AFB03E4600B8; Thu, 05 Sep 2002 15:33:52 -0500 This one failed the HELOBOGUS test because the remote mailserver identified itself as w0.xxxletter.com, but that host doesn't exist (if you try ping w0.xxxletter.com, you'll see Unknown host or something similar). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Helo Bogus Question
Hello fellow Decluder's, I am seeing a lot of these (see header below) whereas the From address is the same as the To address of one of our domains (is this spoofing the domain?). I am catching them (barely in this case) based on weight of other tests, but not sure I understand why these are not failing the HELO BOGUS test too. I am seeing the HELO BOGUS fail on some of the other Spam e-mails, however not always on those like the sample below. I must not be fully understanding the HELO BOGUS test. Is it because the Received domain and the IP match up - and only the From address is being forged? When the From Address is being forged like this, what is my best defense? I would prefer to just have these auto-deleted when this type of forging occurs, as it seems to me - these would 100% of the time always be Spam. Or is that incorrect thinking? Still not comfortable enough to just delete on any specific test for forging like this. Thanks in advance on feedback. -Don S. Received: from w0.xxxletter.com [208.202.133.101] by email.catholicweb.com with ESMTP (SMTPD32-6.06) id AFB03E4600B8; Thu, 05 Sep 2002 15:33:52 -0500 Received: (from root@localhost) by w0.xxxletter.com (8.11.4/8.11.4) id g85Kk8w17854 for [EMAIL PROTECTED]; Thu, 5 Sep 2002 16:46:08 -0400 (EDT) Date: Thu, 5 Sep 2002 16:46:08 -0400 (EDT) Message-Id: [EMAIL PROTECTED] Mime-Version: 1.0 To: [EMAIL PROTECTED] Subject: Acess the #1 xxx site with no credit card! Content-type: text/html; From: [EMAIL PROTECTED] X-RBL-Warning: OSSRC: [1] hostitwithusa, see http://spews.org/ask.cgi?S1886 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 208.202.133.101 with no reverse DNS entry. X-Declude-Sender: [EMAIL PROTECTED] [208.202.133.101] X-Declude-Spoolname: Dbfb00b8.SMD X-Note: CompBiz.Net/CatholicWeb.Org scanned for spam with Declude JunkMail. X-Note: Failed Tests: OSSRC, SPAMCOP, REVDNS, WEIGHT20-29 [20]. X-Note: Total spam weight of this E-mail is 20. X-Sender: Sender of E-mail: [EMAIL PROTECTED] X-Note: RevDNS Remote Server [No Reverse DNS] ([208.202.133.101]). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spammer tools - why do these sites exist
Got to love this right off their site... In order to stay within federal laws so that you are bulk emailing and not spamming you must; 1.) Use a Valid Return Address 2.) Offer and Honor a means of removal from your mailings. 3.) Make no attempts to forge or remove the headers from your emails. Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of decjunkmail Sent: Monday, September 02, 2002 4:14 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spammer tools - why do these sites exist I just stumbled onto: www.marketmenow.com My question is, where are they being hosted and what ISP/internet connection are they using that allows them to keep this site online selling all kinds of obvious spammer tools without violating somebody's AUP. most intriguing -- a $150/month subscription that sends by email a list of open relays three times a week. Wondering why folks haven't surreptiously subscribed to this and then posted the listed systems back into the DNSRBL lists (although who wants to put $150 a month into these slimeballs pockets?) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Address Book Only in Declude?
Tom et al, I really like this approach on the rules.ima. Also been trying to spec out a way to give the end user some control over some simple Spam management. It would be great if a host administrator (and even the end user) could determine which Declude Spam tests we make available from a list they would like to use, as well as the ability to add/edit/delete their own Declude Kill list addresses. However, requires unique global.cfg for each which is not currently possible and sure there are a lot of issues involving same to to this. But it sure would be nice! Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith Inc Sent: Thursday, August 29, 2002 12:36 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? The same obstacle I have not quite overcome as of yet. We use a size restriction to keep mailbox's from filling up the entire mail server HD (10MB per user). And to ensure their SPAM box does not stop incoming mail if the user is not erasing it we have this little disclaimer... Note: All mailbox's have a 10 megabyte limit, and due to restrictions of our mail server we cannot automatically purge SPAM after a certain amount of time, to ensure your SPAM folder does not fill up your mailbox, if your SPAM folder ever reaches 3 megabytes, it will automatically be completely erased. And to enforce it, I run a nightly search on the entire mail dir D:\mail\*\spam.mbx (recursive serch) Where size 3084kb And erase any spam.mbx's that I find I'm working on a more creative solution. -Original Message- From: Charles Frolick [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 11:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Address Book Only in Declude? I do have one question, how do you manage the size of the spam folder when they use that option? I would love to use the MAILBOX action, but have no way of cleaning out the spam folder without affecting the other folders, including inbox, as well. We currently do not use aging as a restriction for those who use webmail exclusively, we opted for size limits instead. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Baker | Netsmith Inc Sent: Thursday, August 29, 2002 11:09 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Ok, I will stop posting on this thread after this. For a working-example on how I have achieved this with imail and cold fusion I have setup a test account. Login = [EMAIL PROTECTED] Pass = declude Manager: http://users.bsc.net/ WebMail: http://mail.bsc.net/ From the manager you can *import* an Outlook Express address book, Or build your own, you can adjust the filter levels, and block individual users. These features just manage the rules.ima, which you can watch by going to the web-mail Interface and clicking Change Processing Rules Anyone on this list is welcome to upload dummy address book's and play with this account I just wanted to demonstrate to others how I have creatively achieved this with IMAIL 6 / Cold Fusion. * note: I built this interface before I became aware of the power of WEIGHT, changing the filter-definitions to work with weights instead of individual headers is on my to-do list, so if anyone actually does look at this please don't flame me on how I could improve that. I am already aware :) -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:44 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Excuse the typo everyone, I meant to put a not (!) in that long string H!~THIS... -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:41 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Oh, for an address book only You must also add one last entry at the bottom of rules.ima H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL That will force anything not matched in the above of rules.ima to be deleted Ex: --rules.ima-- H~[EMAIL PROTECTED]:main F~declude.com:main F~[EMAIL PROTECTED]:main H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL --/rules.ima-- Anything that does not match the first 3 lines will be deleted -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:38 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Yes, this is how I already accomplished this for my users. I have a cold fusion interface which verified login/password, then manages their rules.ima Anyone they want to allow it writes at the top of the rules.ima... F~[EMAIL PROTECTED]:MAIN Any junk-mail they want to block it sends to SPAM folder
[Declude.JunkMail] DORKZTL:DNS Report Down?
Can anyone bring up DNSReport.com and DNSStuff.com? Are they down? Anyone experiencing regional connectivity errors? -Don S. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
DORKZTL:RE: [Declude.JunkMail] ORBZ - More info
Anyone have a link or information on the most recent news about ORBZ and Battle Creek? I see on some of the posts at the Battle Creek guest book that apparently the charges may have been dropped. The most I have enjoyed reading such a poorly written guest book application in ages. Some of the posts are too funny... http://216.117.150.42/battlecreekmichcom/cgi-bin/battlecreek/guestbook.c gi#sign Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Todd Holt Sent: Friday, March 22, 2002 10:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ORBZ - More info I'm not sure either, however, Spam is like a virus and it takes away from other legitimate businesses that want to tell you about their services and/or sales. I have consulted with allot of my clients, most of them just hit delete when they don't know where the e-mail came from. So what's the point of these guys sending this mail if no one reads it? That's why I say it's like a virus that spread under are skins and threatens our servers for no good reason. The point is that a number of people DO read this stuff and want SPAM sent to them as much as some people DO want to receive telemarketing phone calls which most of us don't answer or hang up on. These are just lonely people that feel needed when someone contacts them. But the difference is who pays the cost! In telemarketing and junk mail, the sender pays the cost. In SPAM, the receiver (or more precisely, the receiver's mail host) pays the cost. If business' are forced to upgrade their systems to handle 20% more mail and 20% of their mail is received, then discarded as SPAM, that company paid for an upgrade they didn't need to handle their business. Its like the junk mailers sending stuff COD that you can't refuse, or the telemarketer calling collect and you can't refuse! Todd --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ORBZ - More info
I followed suit and also sent a copy of my post on their guestbook to him, as well as, the city commissioners over there. They probably don't even understand what the hell is going on. Anyway, their e-mails can all be found at http://ci.battle-creek.mi.us/Government/High/Biographies.htm#Squires. I think it is a matter of educating them the errors of their ways. The Hale storm person who apparently reported to the police department appears to HAVE NOT educated anyone regarding what and why their server crashed and what ORBZ does and that they should be considered the good guys! [EMAIL PROTECTED],[EMAIL PROTECTED], [EMAIL PROTECTED],[EMAIL PROTECTED],[EMAIL PROTECTED],santana@ vivaward3.com,[EMAIL PROTECTED], [EMAIL PROTECTED] Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Robertson Sent: Thursday, March 21, 2002 5:26 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ORBZ - More info I sent this email to the CIO of Battle Creek (found him thru a Wired link): Mr. Lee, As you are no doubt aware the news was broken today that actions taken by your department are responsible for the demise of the ORBZ anti-spam notification system. This strikes me as a dereliction of your server administrator's responsibility and nothing else. Any competent individual responsible for web-based systems is well aware that security and update patches must be maintained or dire consequences can result. Lotus released a security patch that would have cured the subject problem on its Domino product in September 2001. That was seven months ago. Rather than prosecuting a good citizen providing a beneficent service to a grateful world (who now think of you and the competence of your department in much less than flattering terms), you should look to your own systems to see what else hasn't been kept updated. As a systems administrator myself, I do not appreciate the penalty I and legions of other internet users are now paying for such ignorance, neglect and misplaced blame. Sincerely, --- Matt Robertson[EMAIL PROTECTED] MSB Designs, Inc., www.mysecretbase.com --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ORBZ - More info
I am posting the following reply here to an active thread in the regular IMail Discussion list (Scott I hope you don't mind), because for whatever reason my posts there do not get distributed?? (I have finally asked IPSwitch to investigate because I cannot post nor do I ever receive original posts there). Start of my post in response to Joe the Lawyer This is what gets me on this entire blocking issue and the Joe the Lawyer positions... We support and maintain several online family-oriented and religious oriented portal communities and their companion e-mail services. We have all the appropriate legal Usage Agreements, Policies, etc. They basically state if something goes wrong it is not our fault, usage of services is AS-IS, and if you don't like, then don't use our services, or if we don't like you - we will terminate your usage with us exercising our right to do so. So I am pretty sure our lawyers have us well covered regarding a law suit that we block SPAM? But what really gets to me from the Joe the Lawyer guys, is that a significant number of the Spam's we block are from PORN outfits targeted to our innocent and very often young community members. I say the hell to the free speech Spammer guys that are wanting to send my customers, clients, and community members PORN solicitations. I would rather defend myself to the Judge trying to protect the proliferation of PORN to children, than defend myself from blocking somebody's supposed right to send unsolicited e-mail. Ahh... my 2 cents anyway. I just feel no one has the right to send me crap I did not ask for, especially PORN solicitations into my children's e-mail box. Perhaps I am wrong legally as it relates to free rights and e-mail solicitations, but the PORN solicitation alone is enough to keep me fighting for my rights to block SPAM. Anyone know of a good legal resource on this issue and where I can reference for comparison some Usage Agreements and online Policies that have held up against these morons out there? I would like to have our lawyer's double check our usage agreements and policies on Spam filtering. Thanks. Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, March 21, 2002 4:50 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] ORBZ shut down That should be a major wake up call for any of you blocking messages! Another interesting point where Joe the lawyer's argument backfires: Blacklisting could actually help PREVENT a similar lawsuit! Anyone who is adding the town of Battle Creek, Michigan (and other buggy mail servers) to their blacklists will minimize mail to these mail servers, which will in turn minimize the chances that they will get sent to jail for sending mail to those servers. -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, March 21, 2002 4:02 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ORBZ - More info I told Kellogg's I wouldn't buy their cereal anymore: http://www.kelloggs.com/contact/index.html I called Kellogg's too, to complain: 1-800-962-1413 (8 AM to 8 PM ET Weekdays) Battle Creek, a town of 54,000 best known as the headquarters of the Kellogg's cereal company [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ORBZ - More info
Another way to look at things would be to check out the court cases where Corporations have sued their employees for misuse of e-mail. Do you know where there are any of these cases that I can review online? If not, thanks anyway. I will try and free up some time to perform some research and will share my findings if I come across anything. I hate all this legal stuff and would rather devote the time to new technologies, working projects, etc., but legalities an unnecessary evil in my position. This Joe the Lawyer guy has got my blood boiling a little bit along with the Battle Creek ORBZ action. I don't know who Joe the Lawyer is and give him the benefit of doubt having our best intentions in mind from a legal standpoint. Where is his reply supplying us legal references to the legalities of filtering or blocking Junk Mail? He apparently does not agree with filtering e-mail for Spam. Does he agree that it is right for un-solicited Porn to be received by children or anyone for that matter? If he does agree, then how is this different from un-solicited e-mail for Time-Share travel, Life Insurance, and the next get rich quick scam? As a business owner, I am all about Free Enterprise. But I do not hi-jack other folks servers or conduct dictionary attacks to e-mail servers that I do not own to solicit my goods/services. I think we all agree if an e-mail address is published on a public site it is fair game, otherwise leave me alone unless I ask. I know this may perhaps be hedging OT, but what happened to ORBZ this week could happen to any of using a Kill file, Processing Rules, or Declude as Joe the Lawyer points out. Even if we feel he and Battle Creek are wrong, we can be forced in fear to shut down just like ORBZ did and defending lawsuits that are frivolous and without foundation. Can Ian Gulliver at ORBZ afford to defend himself alone? Can any of us alone? I guess the whole thing just pisses me off. I know that morally it is wrong for individuals and entities to send most of the unsolicited and trickery Spam that is being blocked by reputable firms. However, legally I am not so sure until such time I can reference a federal or international ruling/law. I feel I need something to back me up and in our usage agreement and defend our customer policies. Sorry to be so verbose, but it just ticks me off what I am seeing happening and those who are responsible sending Spam and then actually believing they should have the given right to do so. Don S. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Tom Sent: Thursday, March 21, 2002 7:59 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ORBZ - More info Ahh... my 2 cents anyway. I just feel no one has the right to send me crap I did not ask for, especially PORN solicitations into my children's e-mail box. Perhaps I am wrong legally as it relates to free rights and e-mail solicitations, but the PORN solicitation alone is enough to keep me fighting for my rights to block SPAM. Another way to look at things would be to check out the court cases where Corporations have sued their employees for misuse of e-mail. In any case if it is your system you can do whatever you want with it. If the customers don't like it, too bad! You own it, you paid for it, and you maintain it. It's that simple! What does this mean? If you write an e-mail to a friend your BOSS, the or ISP (owner of the equipment) has the right to view it. Just like the FBI and CIA. This is why we stress the use of PGP! Anyway, just my 2 cents! PS: Don't reply to me if you want to argue, I just wanted to give another view point. Regards, Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Delog update
Hey Tom, Good job! I set CPU to med3 on the same machine I referenced previous and now down from 99% to average 45% CPU usage. Process took about 3 minutes vs. 1-2 minutes on 1349 message count. For the larger volume guys (I know we are small fry), if you inserted the total time to process in the report, this might help them determine what setting to use in sacrifice of time vs. CPU setting. On another mail server we manage with a lot more horsepower (I think we have 800mhz on that machine?), full throttle it only used about 45% CPU. Set to med3 it dropped to 15% CPU and again only took a few minutes to process a 1727 message count. Will let you know how the 11:59 scheduler option goes. Of course the best option would be the ability to specify the time. But 11:59pm is probably good for admins similar to us. Hey - how about turning on the mailer option for us demo guys. Guess I wouldn't need a license then ;0) -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Sent: Wednesday, February 20, 2002 10:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Delog update For those of you using Delog with Declude for Imail, you can now get the updated beta version 1.04b from the web site. This version allows you to enable an internal timer and set maximum cpu cycles Delog is allowed to take. If anyone encounters any problems please feel free to contact us. http://www.imagefxonline.net/apps/delog/delog.zip Please refer to the web site for additional help. http://www.imagefxonline.net/apps/delog Thanks, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Delog update
Love having the statistics on the failed Spam tests. Great idea and very helpful! Couple of comments: 1. Definitely CPU intensive. Had our server (600mhz Intel) pegged 99% while running. Our server usually idles around 2-3%. My typical log file scanned contains 1300+ messages each, and my declude log setting is at medium on those scanned. Took about 1.0 - 1.5 minutes to complete the scan. So the CPU was not pegged for very long anyway. 2. Feature to combine report stats weekly / monthly would be very useful vs. combining all declude logs and then running a report based on the amount of resources required and length of time. 3. I like the interactive feature to pick and choose a log. I guess an option to pick multiple logs vs. a single log file would be useful too, but again probably not for the faint hearted server. 4. I know you state to use the Windows task scheduler. Integrated would be good for those not familiar with Task Scheduler. Great work and look forward to using! -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Sent: Monday, February 18, 2002 9:42 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Delog update Could I solve the multi-day problem by concatenating the logs together, then running Delog? I don't see any reason why you couldn't. Let me know how it works out. Here is a sample batch file to combine the Declude log files into one: -- @echo off C: CD\IMAIL\SPOOL copy DEC*.LOG TOTAL.LOG EXIT -- Run Delog on the total log file, it may take a while. What I can do is add a feature to the configuration file to tell Delog to look for a specific weekly log file. This would override the default daily log. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Problems with SpamReview Software
I am not sure that is related to the issue I was having? Your issue might be as simple as setting the file size in the Settings to read first 5000 bytes when previewing. Otherwise very large e-mails take a while to process before displaying for preview. This is included in the latest release of SPAM review which can be downloaded from his site. I got my issue worked out that was related to a bug with the fromfile test in declude. Scott is already working on a fix. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist Sent: Friday, February 08, 2002 8:02 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Problems with SpamReview Software I've had some similar problems so I quit using it. The problem seems to be related to the amount of content in the folder. I have a lot of captured spam. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of Don Schreiner | Sent: Thursday, February 07, 2002 8:51 PM | To: Declude List | Subject: [Declude.JunkMail] Problems with SpamReview Software | | | Is anyone having problems with Tom's newly released Spam Review | software? It was working fantastic until yesterday when it started to | hang up on launch and spikes the CPU 99%. I have to kill it with my Task | Manager. I have the latest version installed, checked all the settings, | only set to read 4000 bytes, and I even performed a re-install and | cannot get it to launch correctly when there are more than 3-4 e-mails | in the hold folder. | | If I clear my SPAM Hold folder it launches and works just fine, until it | starts filling up again. I have SPAm Review running on 2 separate | machines, 2 separate locations (all Win2k Dells w/ all the bells and | whistles), and then today suddenly on our other e-mail server, the same | thing is happening there now. Totally puzzled? Tom said he was going | to be out of town for a few days and not sure if he is back. Anyone have | a clue what could be causing it to hang like this? | | -Don | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and | type unsubscribe Declude.JunkMail. You can E-mail | [EMAIL PROTECTED] for assistance. You can visit our web | site at http://www.declude.com . | | --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] MISSING_REVERSE_DNS:FREEMAIL test
I must have missed this in the documentation? Where can I learn more about the FREEMAIL test and freemail.lst? -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Shacklett Sent: Wednesday, February 06, 2002 4:23 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] MISSING_REVERSE_DNS:FREEMAIL test Scott helped me sort out what was exactly the same problem with my YAHOO test in my global.cfg last week. This isn't exactly a me too though; since fixing the glitch, all of my previously reported WEIGHT inconsistencies seems to be gone as well. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, February 06, 2002 4:11 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] MISSING_REVERSE_DNS:FREEMAIL test My FREEMAIL test doesn't seem to work. I want to add 5 points to any emails form designated Free Email systems (because they shouldn't show up as broken mail clients, black-holed, etc. and I want to bounce them if they do). I have C:\IMail\Declude\FreeMail.lst which contains one line: @hotmail.com So far so good. In my Global.cfg file I have: FREEMAILfromfileC:\IMail\Declude\freemail.lst x x 5 0 Note that this should be: FREEMAILfromfileC:\IMail\Declude\freemail.lst x 5 0 Otherwise, you're giving it a weight of x (which is invalid), and giving ALL E-mail from non-Hotmail accounts a weight of 5. To find out exactly what is happening, you can use the debug mode. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, when an E-mail has arrived from a Hotmail account, you can switch back to LOGLEVEL LOW (the debug mode adds huge amounts of information to the log file). You can then E-mail me the \IMail\Declude\dec.log file (as an attachment), and I can take a look at it to see what is happening. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] OT: Link to Govt SPAM list
Does anyone have the link to the Article about reporting SPAM to the government? -Don --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Spam did not get blocked after failing several tests?
I am trying to figure out why this SPAM (see below) and just this morning several similar SPAM's got through our Declude JunkMail??? Failed every test in the book it seems. We have a weight of 10 to warn and a weight of 20 to Hold. Below is the header from one of the SPAM's which is representative of the others coming though, and our $JunkMail$ configuration below that. Anyone have an idea what is happening and why? Thanks. -Don CompBiz, Inc. Here is the e-mail... Received: from SMTP32-FWD by CompBiz.net (SMTP32) id A0694; Fri, 1 Feb 2002 07:09:14 -0500 Received: from iisweb.iissys.com [12.47.76.58] by SNEEZY.XEROCOM.NET with ESMTP (SMTPD32-6.00) id A3B3625000A6; Thu, 31 Jan 2002 19:39:15 -0500 Received: from aaddn.com ([4.4.48.73]) by iisweb.iissys.com with Microsoft SMTPSVC(5.0.2195.2966); Thu, 31 Jan 2002 19:38:41 -0500 Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Priority: 3 (Normal) MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_22458882 Importance: Normal Reply-To: [EMAIL PROTECTED] Date: Thu, 31 Jan 2002 19:33:25 -0500 X-MSMail-Priority: Normal Subject: Email Marketing From: [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 01 Feb 2002 00:38:43.0396 (UTC) FILETIME=[CD0CD840:01C1AAB8] X-RBL-Warning: Open relay. Please see http://orbz.org/?12.47.76.58 X-RBL-Warning: Open relay. Please see http://orbz.org/?12.47.76.58 X-RBL-Warning: Weight of 25 exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [12.47.76.58] X-Declude-Spoolname: De3b30a6.SMD X-Note: CompBiz.Net scanned e-mail for spam with Declude JunkMail. X-Note: Failed Tests: ORBZIN, ORBZOUT, ORDB, SPAMCOP, WEIGHT10, WEIGHT20 X-Sender: Mail From: [EMAIL PROTECTED] X-Note: This E-mail was sent from 58.76.47.12.in-addr.arpa. ([12.47.76.58]). X-UIDL: 307438799 Status: U Here are our settings... ORBZIN WARN ORBZOUT WARN ORDBHOLD OSDUL HOLD OSFORM WARN OSLIST WARN OSRELAY WARN OSSMART WARN OSSOFT HOLD OSSRC HOLD SPAMCOP HOLD DSN WARN NOABUSE WARN NOPOSTMASTERWARN BADHEADERS WARN MAILFROMHOLD PERCENT HOLD REVDNS WARN ROUTING WARN SPAMHEADERS WARN #SNIFFERWARN WEIGHT10WARN WEIGHT20HOLD --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spamreview Update v1.0.4
Is Spam Review updated since last night when I downloaded?? -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Schwarz Sent: Wednesday, January 30, 2002 9:18 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamreview Update v1.0.4 Hold on just a minute. I forgot to do something. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz Sent: Wednesday, January 30, 2002 7:58 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamreview Update v1.0.4 Several New features and fixes. If you have previously installed all you need is the exe. http://www.slsoft.com/spamreview.htm (We are getting rain and ice so if you cannot get to the site the power lines may be down.) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spam Review Question
I second this requested feature about adding to the Kill List. Great Idea! Also, I like the idea of sending to Spam Cop vs. the sender because will surely have a lot of bounces. Also, I think this is great you wrote the app and will not mind sending a donation to you. Keep up the great job. Love the app so far. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Wednesday, January 30, 2002 10:47 AM To: Tom Schwarz Subject: Re: [Declude.JunkMail] Spam Review Question Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Question on Wednesday 9:38:23 AM Actually, the next most useful feature for me would be to take the real sender and add-to-kill.lst function. Then if you consistently see an abuser, you just add his address to Imails kill file... This also ultimately reduces server load as well, as mail is simply rejected rather than processed... This line gives me the 'real' sender and I'd love to kill.lst some of these if they are clearly doing only spamming...: XINHEADER X-Note: SMTP Real-From: %MAILFROM% I do not see an immediate need to notify senders of bad mail. -- Roger Heath - Copy of Original Message(s): - T On some of the email I review I would like to click a button and send an T email back to the sender, based on a template, letting them know that they T have a problem. It could include all the warnings. Is this a feature that T others would use if it was available? T Tom T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012602 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spam Review and Kill File
Tom, I would want 2 separate button options. 1. Button to the delete Kill list. 2. Button to the Delete folder only. Not 100% for sure but a warning in the documentation about having the %MAILFROM% variable in your header as Scott was stating in a previous post. Does this address the issue of identifying the real from address that we would want to add to the Kill list? I like the idea of the Kill list vs. Declude Blacklist if it saves on the CPU. However, I would want to be more certain it was a real from address and not a bogus one. Like the earlier post... most of those from addresses are bogus. -Don -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Schwarz Sent: Wednesday, January 30, 2002 7:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam Review and Kill File Let's talk about the IMail kill.lst file for just a minute. Some of you suggested that you wanted to add from email addresses to the kill.lst file from SpamReview. I like this idea and am working on it. My question is... How do you want it to work? Do you want a button to do it? Do you want an option in Settings for adding it whenever you click on Move To Deleted? Other? Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . -- [This e-mail scanned by CompBiz for Viruses. http://www.CompBiz.Net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
