RE: Re[6]: [Declude.JunkMail] DNS Changes
Sandy, I agree with you. While recommending OpenDNS is certainly painless and easy for the support desk, it is certainly not the best solution for an "in-house" mail server - especially those running anti-spam products. Just my .02 ~Patrick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Thursday, October 09, 2008 4:52 AM To: Linda Pagillo Subject: Re[6]: [Declude.JunkMail] DNS Changes > In a perfect world this would be correct, but as you already know from > working in the IT profession, no server, DNS or otherwise has an > uptime of 100%. A single physical "DNS server" may go down, sure, whatever. The DNS config (redundant DNS servers or load-balanced on a virtual IP) used by a mail infrastructure _must_ be 100% as available as the mailservers themselves. I'm certain that everybody on this list who runs a hosting provider or supports a large company completely agrees and has built their infrastructure accordingly. My clients always have DNS resolution -- yes, _100% of the time that they are connected to the internet_ -- as is commonplace in enterprise-class IT (if not in all "enterprise" IT). It is not so in SMB IT, to be sure, but for your (presumably) SMB clients, we are likelytalkingaboutmakingDNS _as available as a single-point-of-failure MX_. That can mean running caching DNS on the same box. If an admin can't keep a modern DNS daemon running on the mailserver, then their mail should be outsourced. Period. > Yes, things may be slowed down a bit by using a DNS server over a > WAN, Will certainly be slowed down, no "may", let's please be clear about this. > but in my experience, it's more reliable to use the OpenDNS servers > with Declude because they are configured properly for use of the RBL > tests. An OpenDNS server is not "more reliable" for RBL lookups than local recursive DNS servers. It is "more reliable" than overloaded ISP DNS servers. That is not the same statement. > You'd be suprised how many people i talk to in a week who have very > little understanding about the role DNS plays in having these tests > work properly. I wouldn't be surprised at all... and I wouldn't be surprised if, nnn months after they magically switch to OpenDNS, they _still_ have very little understanding of DNS and how to troubleshoot SMTP sending and receiving problems. Because you've patched the problem, but you haven't educated them one bit by telling them that DNS -- rather than being the mail-critical, distributed, scaleable, high-performance, learnable, fairly brilliant protocol that it is -- is something they should get from a free provider over the WAN. By the way, I completely support shops that outsource their anti-spam/anti-virus + their mailboxes (and just about everything else) using OpenDNS for web browsing, since otherwise they would have to support their first reliable, recursive DNS server(s). But if you are capable of supporting your own anti-abuse and mailbox servers, _you are capable of supporting a recursive DNS server_. Or you lied about the first part. > I don't consider the questions that are asked by our customers as > "stupid stuff that is not our fault", especially the questions about > how DNS plays an important role in our product. But you know very well what I mean by "stupid stuff...". These are the issues you have to deal with that cause collateral damage to the reputation of your product or service, even though you have no direct control over the problem area. In my password example, people with bad memories or unstuck post-it notes are not your fault. But you don't yell at them, and you don't tell them to rely on somebody else's account. You do the smart thing and reset their password. Likewise for people that can't open their corporate e-mail account because they forgot to plug in their LAN cable when they came back from a trip. You don't hang up on them, and you don't tell to go down to the local coffee shop and use their GMail account. You tell them how to deal with the problem, not how to avoid it. > When a customer comes to me in a panic about their mail backing up > and causing delays, they are quite happy when we diagnose, fix and > educate them about the issue, DNS related or otherwise. I do not see > that as "bad" service. We provide some of the best support > available. If you would like to see the thank you letters and cards > that i receive each year, i will gladly show them to you. I'm not debating whether people are pleased with your service. I am sure they are pleased as punch to have avoided learning something new and nonetheless brought their mailserver back to life (albeit at lower performance). That does not change the fact that by suggesting that the "right" thing to do for DNS is use a
RE: [Declude.JunkMail] OT: DNS / Web help
When I try to ping sales.jvcdiscusa.com it returns an IP of 65.144.173.133. (Instead of 65.244.173.133) You might want to check your DNS. HTH, Patrick From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Cris PorterSent: Monday, June 06, 2005 10:35 AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] OT: DNS / Web help Question for the Declude collective, this is driving me crazy. I've got a website - http://sales.jvcdiscusa.com running on 65.244.173.133 I've got an A record in my DNS for the website but... I can't open the site using the name but I can using the IP address. If I ping the name, I get a DNS lookup for the IP. The only thing different about this site is that it uses Windows authentication to force a login. Any ideas? Cris Porter JVC America
RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps
>I suggest "Management by Walking Around". > >Software isn't the solution. People can goof off in all kinds >of ways, not just from IM, email, or websurfing. > >Andrew 8) I'll leave the walking around to the project managers. I only have to worry about IM, email and websurfing. ;-) Thanks for the recommendations everyone! ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps
Sorry for the OT but... It seems we have a lot of goofing off during the work day around here! Therefore, I am looking for recommendations for software (or hardware) based solutions for internet monitoring/filtering in a corporate setting of less than 150 users. Any suggestions? Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[5]: [Declude.JunkMail] Determining a BCC Recipient
> Point is, an existing mechanism can be extended to satisfy > multiple needs. For example, SOX is not the only reason a > company might want to dig into it's email archive --- there > are lots of reasons both good and bad. I like the idea. I > will extend the spec to accommodate hooks for the new features. > > _M Excellent... ~Patrick --- [This E-mail scanned for viruses at HGBD by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[3]: [Declude.JunkMail] Determining a BCC Recipient
> All of this makes me wonder if our pattern matching engine > and a simple archive of messages might be a useful product in > this case. > > Picture if you will an MTA with Message Sniffer installed > where an archive is generated automatically using a > compressed format. Perhaps one file per day. > > If such a request were to come in then a rulebase would be > generated to match the search phrases and then the sniffer > engine would scan through the messages in the archives and > deliver those that matched to a specified email address along > with a list of the patterns that were found... that is, the > matching message as an attachment to a report message that > describes the original envelope and the list of matching patterns. > > Might this be a useful product do you think? > > The thing is - this is probably a fairly simple augmentation > to the hold/release mechanism I'm working on for Message > Sniffer - so I'm curious to know if the enhanced capability > is "worth the trip". My gut tells me it is. > > _M > Hi Pete, I think your gut is right. I'm pretty sure that I have 2 clients that would be quite interested in "SOXsniffer". ~Patrick --- [This E-mail scanned for viruses at HGBD by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IPSwitch ICS
Perhaps the time has arrived for the folks at Computerized Horizons to release their own full blown MTA... Respectfully Wishing, ~Patrick --- [This E-mail scanned for viruses at HGBD by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bogus Date header
>-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of David Fletcher >Sent: Wednesday, July 28, 2004 3:01 PM >To: [EMAIL PROTECTED] >Subject: [Declude.JunkMail] Bogus Date header > > >I am trying to help out the admin of another server by showing >him results from Declude here on our server. I am unclear as >to what's wrong with the Date: header below. > >I suspect that it was added by Imail. The bad header lookup at >Declude.com lists it as a bogus Date: header. If Imail added >it shouldn't it be listed as a missing Date: header instead of >a bogus one? > >What am I missing? > >(XXX's added by me) > >Received: from by firstcoastmail.com >with ESMTP > (SMTPD32-7.13) id A1825C6E0102; Wed, 28 Jul 2004 12:17:06 -0400 >Received: from XXX by X via >csmap id fb66b594_e0b1_11d8_8648_00304824a5c7_16592; >Wed, 28 Jul 2004 11:20:04 -0500 (CDT) >Received: from XXX by >with SMTP (Microsoft Exchange Internet Mail Service Version >5.5.2657.72) id NM2L8MRV; Wed, 28 Jul 2004 11:17:04 -0500 >Received: from XXX by X (IBM MVS SMTP CS V1R2) with >BSMTP id 7868; > Wed, 28 Jul 04 11:17:51 CDT Just a thought, Could it be the IBM MVS SMTP product needs to use a 4-digit year? ~Patrick --- [This E-mail scanned for viruses at HGBD by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Report System
> If you would like to try it out let me know and I will make > it available.. I would like to give it a try! Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail + Declude in Windows 2003
Terry, Like others have stated, I don't know exactly what you mean by stable. But, I notice you still have your PIX's "SMTP fixup protocol" enabled. You *will* have e-mail problems with this enabled. :-) You should turn this off. According to the archives, this was recommended to you back on the 26th of last month. This is the command: no fixup protocol smtp 25 HTH, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AOL
> > Yah.. Something is wack with your mail server... > > > telnet exmail.macombisd.org 25 > Trying 64.88.82.249... > Connected to exmail.macombisd.org. > Escape character is '^]'. > 220 > ** > ** > 2* > You need to turn off "SMTP fixup protocol" on your Cisco PIX firewall. ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IPNOTINMX
> Why didn't negative weight get added for this piece of mail I > received from the IPNOTINMX Test. > > Global.cfg > IPNOTINMX ipnotinmx x x 0 -3 > > Default.junkmail file > IPNOTINMX IGNORE Because you set the action to "IGNORE". Change it to "WARN" and it should work. :) ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
Thanks John! ~Patrick > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of John > Tolmachoff > Sent: Friday, February 28, 2003 7:47 PM > To: [EMAIL PROTECTED] > Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler > > > Yes it will by setting it up per the Declude configuration in > the documentation. > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Patrick Childers > > Sent: Friday, February 28, 2003 4:41 PM > > To: [EMAIL PROTECTED] > > Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler > > > > > There is a Declude specific version of SpamManager now available > > > that does not have all the bells and whistles and simply returns > > > result codes for Declude JunkMail. > > > > Hey Scott/Bryan, > > > > For the Declude specific version of SpamManager, will the > result codes > > distinguish the difference between adult content and > regular spam? I > > used SpamManager as an external test during it's beta > testing and was > > quite impressed with it's performance! :-) > > > > Thanks, > > > > ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
> There is a Declude specific version of SpamManager now > available that does not have all the bells and whistles and > simply returns result codes for Declude JunkMail. Hey Scott/Bryan, For the Declude specific version of SpamManager, will the result codes distinguish the difference between adult content and regular spam? I used SpamManager as an external test during it's beta testing and was quite impressed with it's performance! :-) Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Correct CONTAINS Syntax
> I'm a bit confused. Which one is the correct syntax? They both are. :-) > SUBJECT 3 CONTAINSYou're a WINNER This will filter on: You're a WINNER > SUBJECT 3 CONTAINS"You're a WINNER" This will filter on: "You're a WINNER" (The filter is looking for the quotes also.) So, if you used: SUBJECT3 CONTAINS"You're a WINNER" You're a WINNER Would NOT be caught "You're a WINNER" Would be caught --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: The Spam Battle 2002: A Tactical Update
An excellent article for mail admins... http://rr.sans.org/email/spam_battle.php --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] false positives
> I route e-mail which fail my several tests to another mailbox using the > ROUTETO command in the $default$.junkmail file. I have been > sifting through > these messages looking for false positives and I would like to know the > easiest way (or preferred method) of sending the false positives to the > intended recipient. Any recommendations? I second John's suggestion. Spam Review works great! -Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Changes to Global.cfg
> Do you have to restart either Declude.exe or the SMTP service when changes > are made to the global.cfg file or the $default$.junkmail files? No, that is not necessary. -Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisting
> The only other option I can think of is once you hit the > whitelist limit of > 200, you create a test using the FROMFILE and use a negative > weight of like > 100. This would kind of do the same thing of the whitelisting, > just a little > hokey That is kind of the way I do it. I use the WHITELIST FROM in the global.cfg for domains (@example.com). For individual users ([EMAIL PROTECTED]), I have set up a "whitelist fromfile" with a huge negative weight. -Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BANEXT
> We are using Declude Standard on IMAIL 7.X. Using BANEXT but it > doesn't stop > any of the banned extensions from being received. BANEXT is not a Declude Junkmail feature, it is a Declude Virus feature. Do you have Declude Virus? -Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist not working as expected
> So I suppose since the "from" > and or "reply to" addresses are often going to be different than the > X-declude sender (which I don't see in the e-mail headers? I'd have to dig > through the I-mail logs to find this?) >From the Declude Junkmail Manual: "If you want to record the name of the sender (according to the SMTP Envelope) in the E-mail headers, you can use the XSENDER configuration option. To do this, add a line to the \IMail\Declude\global.cfg file that says "XSENDER ON"." -Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Unknown virus
>Customer is getting virus notifications but the virus is listed as unknown. >Is this a known issue and how do I turn of notification for unknown virus. >He is clean. >H. This question really belongs on the declude.virus list. :-) >From the Declude Virus Manual: "Declude Virus (v1.53 and higher) can be set up not to send out E-mail notifications for specific viruses. This is useful for viruses that forge the return address (in which case a "You have a virus" notification would get sent to someone without a virus). To prevent a notification from getting sent out, you can add a line "SKIPIFVIRUSNAMEHAS Virusname" to the beginning (before the first blank line) of any of the \IMail\Declude\*.eml files (typically just the sender.eml and otherpostmaster.eml files). "Virusname" should be replaced with a string that always appears in the name of the virus and any variants; for example "SKIPIFVIRUSNAMEHAS Klez". Note that there can only be one space (or tab) between "SKIPIFVIRUSNAMEHAS" and the virus name. To prevent the notifications from being sent for multiple viruses, you need to have a SKIPIFVIRUSNAMEHAS line for each virus." If you are referring to "vunerabilities" see the link below and follow the thread. http://www.mail-archive.com/declude.virus@declude.com/msg04005.html -Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mail held when customer is cc'ed
I'm sure Scott will correct me if I'm wrong, but I believe you need to set everything to "Ignore" for her "customer.junkmail" file. -Patrick > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Lenny Bauman > Sent: Monday, November 18, 2002 4:28 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] mail held when customer is cc'ed > > > Ok Lets try it again on the right list > > Scott, > >I have a customer that does not want her mail scanned for spam. > Therefore I have set her setting in the customer.junkmail file to > WARN. I > got a call from the customer that she is not getting her sisters e-mail. > Her > sister sent her an e-mail message to her Juno address and CC her at our > domain.I check the log files and saw that the message was received. I > then checked the declude log file and saw that it failed NOABUSE, > NOPOSTMASTER, REVDNS, and WEIGHT14 I then checked the spam directory and > saw that the was indeed held.My question is why was the message held > when the customer is set for WARN only in the customer.junkmail > file.The > header of the held message is listed below > > > > Lenny Bauman > > > > > Received: from mail.hemc.net [63.69.63.49] by lrbcg.com with ESMTP > (SMTPD32-7.06) id AC44C99018A; Fri, 15 Nov 2002 20:15:48 -0500 > Received: from D336D211 (unverified [63.85.143.230]) by mail.hemc.net > (Vircom SMTPRS 4.5.186) with SMTP id <[EMAIL PROTECTED]>; > Fri, 15 Nov 2002 20:23:40 -0500 > Message-ID: <001f01c28d0c$da3b2b70$a398@D336D211> > From: "Sisters Email" <[EMAIL PROTECTED]> > To: "Customer at juno" <[EMAIL PROTECTED]> > Cc: "customer at our domail" <[EMAIL PROTECTED]> > Subject: checking in > Date: Fri, 15 Nov 2002 20:09:38 -0500 > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="=_NextPart_000_001C_01C28CE2.EDB4ECB0" > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2600. > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. > X-RBL-Warning: NOABUSE: Not supporting abuse@domain > X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain > X-RBL-Warning: REVDNS: This E-mail was sent from a mail server 63.69.63.49 > with no reverse DNS entry. > X-RBL-Warning: WEIGHT14: Weight of 14 reaches or exceeds the limit of 14. > X-Declude-Sender: [EMAIL PROTECTED] [63.69.63.49] > X-Note: This E-mail was scanned by LRBCG.COM, Inc. for spam. > X-Note: Total spam weight of this E-mail is 14. > > > > --- > [This E-mail scanned for viruses by LRBCG.COM, Inc.] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
I would just like to say that I use Tom's list (Delog too!). His time and effort keeping his list/tools updated is truly appreciated. I thank you Tom! :-) Like others on this mail list, there are a few domains on Imagefx's "fromfile" that I need to receive. So, I created another "fromfile" with the exact NEGATIVE weight that I assigned to Imagefx's "fromfile". I enter those "needed" domains/addresses in that list so the weights are cancelled out. Works well for me. I think Craig may have saw this post on the 13th and was "taking you up" on the offer. >>On 11-13-02 Tom said, >"Although I am blocking it, does not mean you have to. >I don't remember every reason for each site added to >the list, however, more than likely they were sending >us junk mail without permission. If you feel that for >some reason I am wrong for placing them into the list >then I would like to here it. I am only human and >un-like a computer I do make mistakes and unlike a >computer I try to rectify them." >(from: http://www.mail-archive.com/declude.junkmail@;declude.com/msg05218.html ) I am not trying to "start" anything - maybe just clarifying something. Regards, Patrick > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Craig Gittens > Sent: Friday, November 15, 2002 9:17 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx > > > I don't know what to say I'm sorry? I was just curious. I wasn't > ridiculing you or your list. > > Craig. > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Tom > Sent: Thursday, November 14, 2002 9:08 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Fromfile Status 11/12/02- Image`fx > Importance: High > > > > Well I just wanted to see what the reason was. I assumed since > > all the entries have a catalogue number that the reason was > > recorded. In addition I do believe outpost does have removal > > instructions at the bottom of the emails. > > Our List: > > Our list is a private list, however, we do share it with the > Declude community. Image`fx is not in the business to stop > spam, we are a local ISP/Developer not SpamCop. We don't have > the time and/or resources to become one. The idea behind the > list was suppose to be for all of us to share or contribute to. > Not many people have contributed to our list, but that's ok, > we don't need the extra work. We have also indicated to those > who use the list to use it at their own risk and to consider > using it with a weight value. > > > IDs: > > The ID's were added to work with our program ReadID to help > identify the address inside Declude's log file without using > a separate database. The ID's contain a date and unique > number as a description. This description only works with > Declude's fromfile not Imail's kill list. This unique ID > will indicate to ReadID the last time of usage so it can > clean out addresses that spammers no longer use after X > number of days. > > Removal: > > While this may be true for most services I don't feel that > we should have to do this, we did not sign up for it, so > why the heck should we sign out from it. Why would I or > you want to tell them that we actually exist? Why should > I have to tell them I don't want their stupid little news > letters or pornographic garbage? I did not ask for it in > the first place, not only that, it's MY server that they > are using to advertise from. Well, guess what, they can > kiss my royal spam a$$. They did not pay for my system. > I did, my blood, my sweat, my hard earned money. What > right do they have? A loop whole the law? Either way > I don't care. > > > > The problem with those so called removal options is that > you never know what their intentions actually are. I > did try this method and guess what, I got even MORE SPAM. > So a word to the wise, don't believe everything you see. > > It's just as bad a an ANTI SPAM company sending us spam > to stop their spam, what the heck do they think they > sent us in the first place? > > Best Regard, > Tom > Image`fx Productions, Inc. > Provider of ExecNet Internet Services --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Newbie Whitelist / PERCENT questions
Are you running v1.62? I believe the HABEAS test requires that version of Declude. PERCENT Test: (taken from the Declude manual) "This test will catch all mail with "To:" addresses that contain a percent sign. The percent sign indicates an outdated routing method that can be used by spammers to bypass closed relays. IMail does normally check for this, but there is a report of it not catching this type of mail under certain circumstances." > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Diarmaid Mac > Aonghusa > Sent: Friday, November 15, 2002 5:34 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Newbie Whitelist / PERCENT questions > > > Hi > > I've just installed 'JunkMail' and in the log file I get the line... > > 11/15/2002 10:16:05 Invalid WHITELIST type: HABEAS > > every time it does a check. > > I have not made any change to the whitelist settings so why am I getting > this error? Should I just reomve the reference to 'HABEAS' from > the config > file? > > Also, in the $default$.junkmail file, there is a setting for PERCENT > What test is this referring to? I can't seem to find a reference to it. > > Thanks > > Diarmaid --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
Brian, I would like to test it as well! Patrick Childers Network Administrator Hussey, Gay, Bell & DeYoung Inc. 329 Commercial Drive Savannah, GA 31406 [EMAIL PROTECTED] > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Brian Milburn > Sent: Tuesday, November 12, 2002 12:31 PM > To: [EMAIL PROTECTED] > Subject: DSN:Re: [Declude.JunkMail] Adultery > > > > Hi John, > > We do not have the docs finished yet, but the program is available if you > would care to test it. There is a 'Declude style' configuration > file and it is > completely commented so it is easy to use without the docs. > > At this point we are still open to suggestions and comments. We > hope to begin > the Linux translation by Dec 1, so the feature set and program > defaults are > not locked down as yet. > > Let me know and I will send you the files and a license key. > > Brian > > > > > On 11/08/02 1:45pm you wrote... > >Great. Please keep us posted on the progress. > > > >John Tolmachoff MCSE, CSSA > >IT Manager, Network Engineer > >RelianceSoft, Inc. > >Fullerton, CA 92835 > >www.reliancesoft.com > > > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] My Black list
< $default@ file < MYBLACKLIST DELETE looks good... < global file < MYBLACKLIST fromfile c:\imail\declude\mylist.txt x 5 0 looks good... < MYLIST.TXT Doesn't need to be listed in global.cfg ( Text file should be in c:\imail\declude\ ) ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More on: %COUNTRYCHAIN%
Working fine now! ~Patrick > It turns out that the file got corrupted somehow during the > upload. It has > been fixed, so if you download it again ( > http://www.declude.com/release/162/all_list.dat ), it should work. > -Scott --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More on: %COUNTRYCHAIN%
>> [Unknown]->[APNIC Unlisted]->[ARIN Unlisted]->destination That is what I see in my headers as well... ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SMTP Slowdown
Make sure the indexing service is disabled. It is a resource hog. M$ has a bad habit of re-enabling services after service packs etc. -Patrick > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Bill Kaylor, > Domain Mail Administrator > Sent: Wednesday, October 23, 2002 9:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] SMTP Slowdown > > > 1, with cpu load running between 25-35%, usually around 65-70%, with no > issues. > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Mark Smith > Sent: Wednesday, October 23, 2002 9:22 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] SMTP Slowdown > > > Sounds like a SMTP loop or something. > > How many instances of SMTPD32.exe are running? > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:Declude.JunkMail-owner@;declude.com] On Behalf Of Bill > > Kaylor, Domain Mail Administrator > > Sent: Wednesday, October 23, 2002 9:14 AM > > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] SMTP Slowdown > > > > > > Hello, > > My apologies in advance for the length of this, but I > > want to be as through as possible the first time. > > > > The background: > > Dell Poweredge 6400, > > Imail 6.06 > > Windows 2000 Server, SP2 > > Quad Xeon 733 mhz > > Declude 1.60, running Virus and Junkmail > > McAfee 4.1.60, Dat file 4229 > > 4GB Ram > > All drives ultra scsi, lvd, 10, rpm or better > > C: 2-18 gb, hardware raid 1, OS drive > > E: 18 gb Imail and Spool drive > > F: 2-36 gb hardware raid 1 for the main domain, +\- 15,000 accounts > > G: 2-18 gb hardware raid 1 for the hosted domains, +\- 100 > > domains, +\- 500 accounts total 375,000-400,000 messages per day > > > > On Friday last week, we installed SP3 and let Microsoft (from > > windowsupdates.microsoft.com) perform the > > required/recommended hot patches. Since that time, our > > customer base has been seeing an increasing number of smtp > > connect failures. We are seeing the same thing on our > > internal lan as well. Sometimes, it will fail in less than a > > second with Outlook/Outlook Express/Eudora reporting that the > > tcp/ip connection was unexpectedly terminated by the server. > > Other times, it will take 45-60 seconds for the error to > > occur. One time out of 5, it will send the message, but only > > after a 45-60 second wait. > > > > So far, we have: > > Reinstalled 2000, sp2, Imail, McAfee and Declude from fresh > > files, onto formatted drives, effectively undoing all of the > > changes that were made Friday. Changed from Intel Pro 100+ to > > Allied Telesyn Nics, and back Updated Nic drivers for the > > intels Stopped Declude totally Added MaxQueProc=30 Verified > > not a DOS attack Virus Scanned the entire system Changed > > network cables Changed ports on the switch > > Moved/Increased/Decreased the pagefile > > > > We have been though the Imail Knowledge base, the Declude > > list archives, and the Imail list archives. It seems that > > SMTPD32.exe is the issue, but we are not sure. Any > > assistance/advice will be greatly appreciated > > > > Thank you in advance for any assistance > > > > Bill > > Domain Mail Administrator > > > > > > > > > > > > > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the > > Declude.JunkMail mailing list. To unsubscribe, just send an > > E-mail to [EMAIL PROTECTED], and type "unsubscribe > > Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > --- > > [This E-mail scanned for > > viruses by F-Proto Virus Scanner] > > > > > > --- > [This E-mail scanned for viruses by F-Proto Virus Scanner] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus/McAfee NetShield] > > --- [This E-mail scanned for viruses by Declude Virus/McAfee NetShield] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
