RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
Why should I need to upgrade when the problem is a bug. I didn't have any problems running the excellent version that I am running at present thank you so should there be a bug fix or do I need to get a service agreement. Let's see :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Ncl Admin Sent: Tuesday, 4 January 2005 02:51 To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch? Importance: High At 07:59 AM 1/2/2005 +1100, you wrote: Great way to increase sales due to the need to update service agreements. Anyone that runs production software without service agreements gets what they deserve. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
Great way to increase sales due to the need to update service agreements. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Sunday, 2 January 2005 04:36 To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch? - Original Message - From: Dave Doherty [EMAIL PROTECTED] I set it to zero weight temporarily. I also sent an email direct to Scott and Barry. Why run the test at all if you're going to set the weight to zero anyway - just comment out the test until it's fixed. I can see this causing some major problems for users that are not subscribers of this list, or who do not actively monitor it. I'm wondering if the only fix for this is a new declude.exe file? If that's the case, CPHZ has got their early New Year's work cut out for them... Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] tools/weights
Have a look in the sniffer log file or RTFM :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bennie Sent: Friday, 24 December 2004 11:36 To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] tools/weights OK... I have downloaded the trail of sniffer and installed per the instructions... added the lines to my Declude.cfg and $default$.junkmail. Now I am getting no warnings in the headers... how can I look to see if the test is running... Bennie - Original Message - From: Bill Landry [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, December 21, 2004 10:53 AM Subject: Re: [Declude.JunkMail] tools/weights - Original Message - From: Richard Lanard [EMAIL PROTECTED] I've been thinking about the Sniffer, but i had a few questions: Do i have to have Pro to run it, i.e. external tests? and How effective is it against Phishing? or would it be better to add Mcafee and Clam for this problem? We currently are limited to phrase filtering in Imail for the Phishing part. Sniffer does well at tagging phishing messages. However, adding ClamAV (clamd) is also a very good addition, both for detecting phish and virus laden messages. You can also use the MailPolice fraud list, which includes phish domains. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] mailpolice
Hi, Is anyone using mailpolice and if so what details are required in the global.cfg file? _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FYI on SKIPIFWEIGHT
Hi, The docs imply that SKIPIFWEIGHT is only usable in the actual filter file. Can it also be used in the global.cfg file? _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, 17 November 2004 10:28 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FYI on SKIPIFWEIGHT I think the question revolves specifically around when the negative weights for Declude's built-in tests and possibly things like fromfiles, spamdomains, and ipfiles are deducted from the weight used to calculate SKIPIFWEIGHT. If these are only deducted after the filters have run, it would be good to know so that we could increase the SKIPIFWEIGHT setting by the amount of such negative weights in order to ensure that filters were not skipped unless a certain level signifying DELETE, HOLD or ROUTETO was reached. The weight of the E-mail is calculated after all tests have been run (except, of course, the weight tests themselves). The SKIPIFWEIGHT option attempts to calculate the weight with the information it has. It will add the weights for any tests that have already been run and failed, but will not consider negative weights. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Latest Spam Tests
Hi, Thanks for this excellent input - much appreciated. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Colbeck, Andrew Sent: Monday, 8 November 2004 17:51 To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Latest Spam Tests Well, Glen, there's a LOT more that you could be doing. I see that you've only put forward the names of built-in tests and IP4R tests. Do you have Declude Junkmail Lite, Standard or Pro? And have you upgraded to the current version of the declude.exe application? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Latest Spam Tests
Hi, I'm about to review/update my spam tests which currently are: BASE64 WARN CBL WARN COMMENTS WARN DSBL WARN MYFILTERS WARN X-Warning: This E-mail failed Spam filters ORDB WARN REYNOLDSRSMT WARN SORBS-NOMAIL WARN SORBS-SMTP WARN SORBS-SPAM WARN SPAMCOP WARN DSN WARN NOABUSE WARN NOPOSTMASTER WARN BADHEADERS WARN HELOBOGUS WARN MAILFROM WARN PERCENT WARN REVDNS WARN ROUTING WARN SPAMHEADERS WARN SPAMDOMAINS WARN SPFPASS WARN SPFFAIL WARN BLACKLIST WARN SNIFFER WARN Can someone be king enough to share their's and/or comment on mine. Thanks, _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF and Remote EMail Users
Hi, I am extremely impressed with SPF and have it working well however I now wish to move to the final step and have Declude JM block email from forged users in my own domains - ie instead of ?all I want to use -all. It has been suggested that I whitelist mail from my own users when using -all however that lets all forged email spam through. It has been suggested that I force all my remote users to use SMTP Auth. This is quite feasible however my own limited testing reveals that IMail v7 does not change the Senders IP address even when using SMTP Auth. Is there some way I can avoid this Catch 22? Thanks. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bigpond
Hi, I suspect they most certainly will - legal action that is. Bigpond is 51% Australian Government owned and the rest is listed on the sharemarket. They are Australia's largest internet provider capturing over 70% of the market. They have a monopoly via Telstra - Australia's largest telephone company. They have a similar attitude to Microsoft - sue first and negotiate later. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Tuesday, 13 January 2004 04:47 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Bigpond I was just going to say, almost all of those IP addresses are from the same ISP in Australia. If we want to play hardball, block all the IPs, and then the ISP will have to take action. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 12, 2004 9:36 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Bigpond Let me correct something. BigPond.com isn't a spam house, they are a DSL provider in Australia. They however have a large number of mail servers that consistently relay spam. It's almost like they are hosting spammers, and have them relay through their own servers instead of direct delivery. There's a ton of it. I'm not sure what to do about this situation. Maybe someone else has some ideas. Matt Matt wrote: John, Looks like a spam house to me. http://www.senderbase.org/search?searchString=bigpond.com Block by IP. Google shows that they've used different domains from these blocks, and the REVDNS entry could be gone tomorrow. Use Scott's CIDR tool if you are uncertain about the ranges. Dig through surrounding blocks with reverse DNS to see if there are even larger blocks present. Lastly, report your findings to the board :) Matt John Tolmachoff (Lists) wrote: Is there legit e-mail that comes from Bigpond mail servers, or can I heavily weight REVDNS ENDSWITH .bigpond.com? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bigpond
ha ha ha send them an email at [EMAIL PROTECTED] and we'll all have a giggle :-) good luck and happy hunting. better still - just blacklist them and you'll wipe out 75% of all emails coming from down under :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Tuesday, 13 January 2004 12:06 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Bigpond Then they better clean up their act and take are hardball stance on all spam flowing through their servers. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Glen Harvy Sent: Monday, January 12, 2004 3:12 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Bigpond Importance: High Hi, I suspect they most certainly will - legal action that is. Bigpond is 51% Australian Government owned and the rest is listed on the sharemarket. They are Australia's largest internet provider capturing over 70% of the market. They have a monopoly via Telstra - Australia's largest telephone company. They have a similar attitude to Microsoft - sue first and negotiate later. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff (Lists) Sent: Tuesday, 13 January 2004 04:47 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Bigpond I was just going to say, almost all of those IP addresses are from the same ISP in Australia. If we want to play hardball, block all the IPs, and then the ISP will have to take action. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, January 12, 2004 9:36 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Bigpond Let me correct something. BigPond.com isn't a spam house, they are a DSL provider in Australia. They however have a large number of mail servers that consistently relay spam. It's almost like they are hosting spammers, and have them relay through their own servers instead of direct delivery. There's a ton of it. I'm not sure what to do about this situation. Maybe someone else has some ideas. Matt Matt wrote: John, Looks like a spam house to me. http://www.senderbase.org/search?searchString=bigpond.com Block by IP. Google shows that they've used different domains from these blocks, and the REVDNS entry could be gone tomorrow. Use Scott's CIDR tool if you are uncertain about the ranges. Dig through surrounding blocks with reverse DNS to see if there are even larger blocks present. Lastly, report your findings to the board :) Matt John Tolmachoff (Lists) wrote: Is there legit e-mail that comes from Bigpond mail servers, or can I heavily weight REVDNS ENDSWITH .bigpond.com? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing
[Declude.JunkMail] SPF Fail Remote EMail clients.
Hi, First of all - Merry Xmas :-) This is slightly off topic however I thought I would raise it here as it affects the actions to be taken when the SPF Fails. I have been using SPF for a few days now and have already detected my own email address being used illegally as well as several of my users. I set the tests to unknown (?all) so there is no problems yet. I can't (nor wish) to stop my users accessing my email servers from other than my IP addresses but I can't see how I can allow this and at the same time fully implement the usefulness of SPF. Has this issue been (or being) addressed? The spf website refers to SSAL and POP-before-SMTP but this doesn't help with IMail and more specifically Declude Junkmail as far as I can see. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF Fail Remote EMail clients.
I can't (nor wish) to stop my users accessing my email servers from other
than my IP addresses but I can't see how I can allow this and at the same
time fully implement the usefulness of SPF.
Ideally, you would have all your users use your mailserver.
How can you force this?
But if that isn't an option for you, +mx ?all is the answer. Anyone
sending mail from your mailserver gets credit (either whitelisted or
their E-mail less likely to be marked as spam),
I was/am thinking not from the point of view of Declude Junkmail rather than
another mail server that utilises SPF - sees that it FAILS and then drops
the connection and refuses to deliver it.
I should think that Whitelisting mail from users that are known to use
remote computing would be quite easy to do as a workaround for local
delivery.
I'm beginning to think that I may not fully appreciate how SPF is supposed
to work.
and anyone not
sending from
your mailserver isn't penalized. If your domain is frequently forged in
spam, you could get creative and do things like add
-ptr:customer.swbell.net -ptr:dsl.earthlink.net
-%{ir4}.bl.spamcop.net to
further restrict how spammers can use your domain (saying that your users
couldn't send mail using your domain if they were coming from a SW Bell
user IP or Earthlink DSL account or any IP listed in Spamcop).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF Fail Remote EMail clients.
Yes - I understand that BUT here's an excerpt from my spf.log: 144.132.220.223 [EMAIL PROTECTED] [home]: UNKNOWN 144.132.220.223 [EMAIL PROTECTED] [home]: UNKNOWN 203.132.253.27 [EMAIL PROTECTED] [manly]: PASS 216.153.219.226 [EMAIL PROTECTED] [front-desk]: UNKNOWN 203.132.253.27 PASSED correctly. 144.132.220.223 are UNKNOWN even though I used SMTP AUTH to send them. 216.153.219.226 is truly UNKNOWN and can be considered forged as far as I'm concerned. If SPF is implemented at the MTA level then the UNKNOWNS would be rejected by the receiving MTA as they would have failed if I had -all implemented. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Andy Schmidt Sent: Friday, 26 December 2003 15:48 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPF Fail Remote EMail clients. No, if all your users use SMTP AUTH to send their email through YOUR mail server, then YOUR mail server will be sending the email to anyone outside your company - which will satisfy the SPF record. Third parties don't care where the email originally came fome - only which mail server was used to deliver it to that third party. You implement authenticated SMTP by specifying it in your Email software (e.g., Outlook Express, Outlook, Eudora, Netscape - take your pick). Look for something like Outgoing Mail Server Requires Authentication). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glen Harvy Sent: Thursday, December 25, 2003 11:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPF Fail Remote EMail clients. Importance: High If you implement SMTP AUTH How do you do that (or confirm you have)? and white list anyone who is using an authenticated connection, then this will override the SPF FAIL - thus leaving only those to truly fail who are not using authenticated SMTP. Whitelisting surely will only affect Declude Junkmail. If another mail server uses SPF then they will receive the FAIL instead of UNKNOWN and legitimate mail will not be delivered. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glen Harvy Sent: Thursday, December 25, 2003 08:27 PM To: Declude Junkmail Subject: [Declude.JunkMail] SPF Fail Remote EMail clients. Importance: High Hi, First of all - Merry Xmas :-) This is slightly off topic however I thought I would raise it here as it affects the actions to be taken when the SPF Fails. I have been using SPF for a few days now and have already detected my own email address being used illegally as well as several of my users. I set the tests to unknown (?all) so there is no problems yet. I can't (nor wish) to stop my users accessing my email servers from other than my IP addresses but I can't see how I can allow this and at the same time fully implement the usefulness of SPF. Has this issue been (or being) addressed? The spf website refers to SSAL and POP-before-SMTP but this doesn't help with IMail and more specifically Declude Junkmail as far as I can see. _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from
RE: [Declude.JunkMail] Server Gone Wild
Give him a ring and tell him to uninstall declude. Only takes a second or two. I'd ring him but it would be a very very expensive call :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Richard Farris Sent: Wednesday, 3 December 2003 17:06 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Server Gone Wild A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What test?
Hi, Is there a test I can implement that will pick this up . X-Note: This E-mail was sent from (timeout) ([68.37.149.251]) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: SNIFFER Trial
Hi, Sorry for the OT post BUT how do you get the trial version of SNIFFER to actually work if you don't have an authentication code to put into global.cfg? I keep getting code 65 errors for every SNIFFER test. TIA, _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OSRELAY etc
Hi, Is relays.osirusoft.com permanently offline? _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SORBS-SPAM
Who's Cox? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Smart Business Lists Sent: Tuesday, 2 September 2003 07:57 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SORBS-SPAM Careful on SORBS-SPAM - blocking some large providers - Cox for one. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Customising User Interface
Right now, there aren't any per-user/per-domain blacklists. The only way to do that right now would be to add a new blacklist for each user/domain. If that was done for hundreds/thousands of users, it could use up a lot of resources. I appreciate the overload however how do you create the blacklist specific to each user. I can see how it applies to a domain but not a user. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Customising User Interface
Hi, I am in the process of creating a web based user interface allowing users to customise the actions that Junkmail will do when an email fails certain weightings. The only problem I am having is creating individual cfg files that they can create for their own blacklists or filters. The Global cfg file defines the test however I can't see how I can personalize the filters. Any ideas? _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] domain alias checking
Thanks for clarifying that for me. At 00:42 9/09/2002, you wrote: To summarise, if a user [EMAIL PROTECTED] has an alias [EMAIL PROTECTED] and my Imail is setup with mail.domain.com as an alias (which I guess is pretty common) then to catch all possible viruse sources that the user can use I need [EMAIL PROTECTED] ON [EMAIL PROTECTED]ON [EMAIL PROTECTED] ON [EMAIL PROTECTED] ON This is not really a problem for me but I can see a lot of overhead here. Yes, it is a lot of overhead. But when you give a user 2 addresses, and allow them to use 2 variations of each, well... they now have 4 addresses. :) DECLUDE JUNKMAIL As a catch all (as I really have no control over what address the user advertises) then I presume the same rules as for virus will apply. That means 4 individual junkmail files probably containing identical data. There's actually a bit less overhead for Declude JunkMail -- Declude JunkMail uses the final address that IMail determines, which would be either [EMAIL PROTECTED] or [EMAIL PROTECTED] (or both). [EMAIL PROTECTED] and [EMAIL PROTECTED] will both get translated to [EMAIL PROTECTED] (if the host name is example.com, even if mail.example.com is an alias), so just one config file is necessary there. [EMAIL PROTECTED] and [EMAIL PROTECTED] will get translated to whatever you entered as the destination address. So if you entered [EMAIL PROTECTED] as the destination, IMail will translate both [EMAIL PROTECTED] and [EMAIL PROTECTED] to [EMAIL PROTECTED] In this case, one config file would cover all 4 variations. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glen. AQUARIUS Communications for all your Internet needs voice(02)9977-3788 fax(02)9977-3844 http://www.aquarius.com.au mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] domain alias checking
Hi and thanks for your reply. DECLUDE VIRUS: As I have no control over how people address their mail then I presume I must (to be safe) include the domain alias. Similarly, if mail is addressed to an alias (either user or domain) then I need to specify four others. To summarise, if a user [EMAIL PROTECTED] has an alias [EMAIL PROTECTED] and my Imail is setup with mail.domain.com as an alias (which I guess is pretty common) then to catch all possible viruse sources that the user can use I need [EMAIL PROTECTED] ON [EMAIL PROTECTED]ON [EMAIL PROTECTED] ON [EMAIL PROTECTED] ON This is not really a problem for me but I can see a lot of overhead here. DECLUDE JUNKMAIL As a catch all (as I really have no control over what address the user advertises) then I presume the same rules as for virus will apply. That means 4 individual junkmail files probably containing identical data. I know you can use DEFAULT ON/OF or WHITELISTS to perhaps minimise individual entires/files however if my above logic is correct can I ask for some sort of default checking option be introduced in a later version. Thanks. At 22:19 6/09/2002, you wrote: In both JunkMail and AntiVirus is it necessary to configure the alias address as well as the main in the various global, domain and user specific config files? For example: Domain config file: DEFAULT OFF User specific file: [EMAIL PROTECTED] ON [EMAIL PROTECTED]ON For Declude Virus, you only need to enter addresses that will actually be sent mail (for example, you would only need to enter [EMAIL PROTECTED] if people on the Internet would send mail to [EMAIL PROTECTED]). For Declude JunkMail, it's based on whatever IMail translates the address to, which depends on how your domain aliases and user aliases are set up. If you have a user alias set up, that will take priority; otherwise, the domain alias will take priority. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glen. AQUARIUS Communications for all your Internet needs voice(02)9977-3788 fax(02)9977-3844 http://www.aquarius.com.au mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] domain alias checking
Hi, In both JunkMail and AntiVirus is it necessary to configure the alias address as well as the main in the various global, domain and user specific config files? For example: Domain config file: DEFAULT OFF User specific file: [EMAIL PROTECTED] ON [EMAIL PROTECTED]ON TIA Glen. AQUARIUS Communications for all your Internet needs voice(02)9977-3788 fax(02)9977-3844 http://www.aquarius.com.au mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] per domain config file priority
Hi, If there is a $default$.junkmail file in the declude directory and a specific one in a domain directory, which one is used? Glen. AQUARIUS Communications for all your Internet needs voice(02)9977-3788 fax(02)9977-3844 http://www.aquarius.com.au mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Attach eml file
Hi, What variables, if any, can be used in the spamattach.eml file? %SUBJECT% and %FULLMSG% appear not to work. Also, can the HEADER action be read from a text file or can the HEADER be formatted as well as include variables. I'm looking to advise recipients of what tests they failed and to advise me if they don't want to receive any more email from that spam source. ATTACH would appear to me the best option as I read somewhere that HEADER won't be seen in a HTML formatted email. I'm sure this has all been done before. TIA Glen. AQUARIUS Communications for all your Internet needs voice(02)9977-3788 fax(02)9977-3844 http://www.aquarius.com.au mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Wordfilter?
Hi, I'm brand new to this proggy and list. Is there any documentation available as to what Wordfilter is/does ? TIA. Glen. AQUARIUS Communications for all your Internet needs voice(02)9977-3788 fax(02)9977-3844 http://www.aquarius.com.au mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
