Re: [Declude.JunkMail] New XBL from Spamhaus
Reply to: Keith Johnson Re: [Declude.JunkMail] New XBL from Spamhaus on Sunday 11:32:26 AM http://www.spamhaus.org/xbl/index.lasso -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K> I read the following on the Register. Does anyone know if we K> can include this into Declude? Thanks for the aid: K> Clip taken from: K> http://www.theregister.co.uk/content/55/34690.html K> However, Spamhaus plans to fight back. Yesterday, it released K> its Exploits Block List (XBL), a real-time DNS-based database of IP K> addresses of illegal 3rd party exploits, including open proxies, K> worms/viruses with built-in spam engines, and other types of K> trojan-horse exploits utilized by spammers. This list is designed K> to sit alongside the Spamhaus Block List (SBL), which blocks K> incoming spam from direct spam sources. The combination of SBL and K> XBL enables ISPs to safely reject a high volume of incoming spam K> outright, Spamhaus says. K> Keith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] X-Declude-Date in Header
Reply to: John Tolmachoff (Lists) Re: [Declude.JunkMail] X-Declude-Date in Header on Friday 7:18:53 PM Thanks. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J> It is a temporary insertion by Declude for troubling shooting. It will be J> taken out in public release versions. This is per a answer by Scott earlier. J> John Tolmachoff J> Engineer/Consultant/Owner J> eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] X-Declude-Date in Header
We are seeing an intermittent Declude header added to our messages without us using a variable for it, e.g. : X-Declude-Date: 12/26/2003 23:11:23 [106] Is there a reason causing this to appear? This is the interm version.. and I know it warns of 'unusual logging', but we were surprised that this is making an appearance with no variable indicated. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Filter Actions - WHITELIST?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Filter Actions - WHITELIST? on Tuesday 4:04:36 PM Thanks! This will relieve the limit on the Global file as well... If these filters could be processed first, it might give back a lot of processor if all other actions were performed afterwards, but only if the whitelist filters did not engage... ;) -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Filter actions have so many nice basic functions, IGNORE, WARN, >>DELETE, HOLD etc. >> >>Looking at new filters today and observing logs, it just seems >>one of these actions naturally should be WHITELIST. >> >>Does this make sense? R> We are planning on adding a WHITELIST action. :) R> -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter Actions - WHITELIST?
Filter actions have so many nice basic functions, IGNORE, WARN, DELETE, HOLD etc. Looking at new filters today and observing logs, it just seems one of these actions naturally should be WHITELIST. Does this make sense? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Null Sender Spam for Valid Accounts
Reply to: John Tolmachoff (Lists) Re: [Declude.JunkMail] Null Sender Spam for Valid Accounts on Thursday 11:15:50 AM This is what I was doing but Spam Review might have 2000-10,000 of bounced mails... too much to do in deleting them... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J> You could put in a temporary rule that holds or routes all message with a J> blank or <> as sender, that way the end user will not see them, but you will J> still be complying with the requirements. J> John Tolmachoff MCSE CSSA J> Engineer/Consultant J> eServices For You J> www.eservicesforyou.com >> -Original Message- >> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- >> [EMAIL PROTECTED] On Behalf Of Roger Heath >> Sent: Thursday, October 16, 2003 1:53 AM >> To: R. Scott Perry >> Subject: [Declude.JunkMail] Null Sender Spam for Valid Accounts >> >> Looking at Scott's response below, I'd like to have the Refuse Null >> Sender switch off, but we have a situation where spammers are forging >> valid e-mail addresses. We have thousands of bounces showing up for >> messages never sent from valid accounts here. For example, >> [EMAIL PROTECTED] may be a valid account but he is not a >> spammer. But a spammer uses [EMAIL PROTECTED] forges tens of >> thousands of messages with this as the 'reply to' account in headers. >> Since the spammer has many unvalid accounts in his spamming, >> [EMAIL PROTECTED] is swamped with thousands of bounced mails for >> mails that he did not even send... This is now happening to hundreds >> of accounts here because it looks like the spammer's software is >> randomly selecting them from a spam list. >> >> I have re-enabled 'Refuse Null Senders' to relieve this problem, but >> would like to find a more compliant solution. Does any one know how to >> attack this issue in another way? >> >> -- >> Roger Heath >> [EMAIL PROTECTED] >> www.rleeheath.com >> >> R> Well, the real question is why do you think that you are safer by >> R> rejecting those E-mails? I'm not aware of any safety issues. The >> R> only issue I am aware of is that a small percentage of spammers >> R> send their spam that way. >> R> >> R> The NULL <> sender has been used for over 20 years for bounce >> R> messages and other automated messages (such as vacation messages, >> R> and those awful spam confirmation E-mails, and Delivery Status >> R> Notifications). >> R> >> R> So the choices are : >> R> >> R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked >> R> setting). Pros: Your mailserver will act as expected. Cons: As very >> R> small percentage of spam is sent this way, but it can be detected >> R> using standard spam control. >> R> >> R> [2] Refuse NULL <> senders. Pros: You'll have that "safe" feeling. >> R> Cons: You won't receive all your E-mail, because you're blocking >> R> someofit,andbecauseyou'llgetlisted at >> R> http://www.rfc-ignorant.org . >> R> >> R> -Scott >> >> >> >> >> >> -- >> ActivatorMail(tm) ver.01010031 Scanned for all viruses by >> www.activatormail.com intelligent anti-virus anti-spam service >> >> --- >> [This E-mail was scanned for viruses by Declude Virus J> (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". The archives can be found J> at http://www.mail-archive.com. J> -- J> ActivatorMail(tm) ver.01010031 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Null Sender Spam for Valid Accounts
Looking at Scott's response below, I'd like to have the Refuse Null Sender switch off, but we have a situation where spammers are forging valid e-mail addresses. We have thousands of bounces showing up for messages never sent from valid accounts here. For example, [EMAIL PROTECTED] may be a valid account but he is not a spammer. But a spammer uses [EMAIL PROTECTED] forges tens of thousands of messages with this as the 'reply to' account in headers. Since the spammer has many unvalid accounts in his spamming, [EMAIL PROTECTED] is swamped with thousands of bounced mails for mails that he did not even send... This is now happening to hundreds of accounts here because it looks like the spammer's software is randomly selecting them from a spam list. I have re-enabled 'Refuse Null Senders' to relieve this problem, but would like to find a more compliant solution. Does any one know how to attack this issue in another way? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com R> Well, the real question is why do you think that you are safer by R> rejecting those E-mails? I'm not aware of any safety issues. The R> only issue I am aware of is that a small percentage of spammers R> send their spam that way. R> R> The NULL <> sender has been used for over 20 years for bounce R> messages and other automated messages (such as vacation messages, R> and those awful spam confirmation E-mails, and Delivery Status R> Notifications). R> R> So the choices are : R> R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked R> setting). Pros: Your mailserver will act as expected. Cons: As very R> small percentage of spam is sent this way, but it can be detected R> using standard spam control. R> R> [2] Refuse NULL <> senders. Pros: You'll have that "safe" feeling. R> Cons: You won't receive all your E-mail, because you're blocking R> someofit,andbecauseyou'llgetlisted at R> http://www.rfc-ignorant.org . R> R> -Scott -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Null Sender
Reply to: R. Scott Perry Re: [Declude.JunkMail] Null Sender on Friday 8:03:42 AM Ah, thanks! -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Would this work if it is '<>' as it most commonly is? Then it is >>truly not blank... I think Block Null Sender covers this instance. >>It would be nice to have an alternative that was RFC compliant. R> It would probably be best to use both: R> MAILFROM 2 ISBLANK R> and R> MAILFROM 2 IS <> R> That way, whichever format IMail may choose to use will be caught. R> -Scott -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Null Sender
Reply to: R. Scott Perry Re: [Declude.JunkMail] Null Sender on Friday 7:16:33 AM Would this work if it is '<>' as it most commonly is? Then it is truly not blank... I think Block Null Sender covers this instance. It would be nice to have an alternative that was RFC compliant. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Is there anyway to assign points to a null sender? Most null sender >>emails I get are spam and was wondering if I could assign a point value to >>null sender? R> I believe you could set up a filter, and add this line to the filter file: R> MAILFROM 2 ISBLANK R> -Scott R> --- R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. R> Declude Virus: Catches known viruses and is the leader in mailserver R> vulnerability detection. R> Find out what you've been missing: Ask about our free 30-day evaluation. R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.00922031 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam assassin .exe as external filter
Reply to: Adrian Hauri Re: [Declude.JunkMail] Spam assassin .exe as external filter on Wednesday 7:46:06 PM I would also like to see how this would work. It is free and looks like it has a big following: http://spamassassin.taint.org/index.html -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - A> I was just wondering if anyone A> has implemented spamassassin with declude(as external filter) A> ? A> A> There is an easy to use .exe version available A> fromhttp://www.drbig.co.uk/modules/mydownloads/ . A> At the moment I use SAproxy which filters a lot A> with its Bayesian classifier etc. A> But I would like to implement it directly on A> the server with declude because some filters are really great. A> A> If someone has done the A> implementation already please let me know. A> A> Cheers A> A> Adrian -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Foreign Characters and Declude
Reply to: Matthew Bramble Re: [Declude.JunkMail] Foreign Characters and Declude on Saturday 2:01:01 PM No, most of these are not encoded, thanks. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - M> And something else that formerly confused me and you pointed out...Roger M> should make sure that the subject line wasn't base64 encoded by checking M> out the source of the E-mail since the subject (and the rest of the M> headers) isn't decoded for filtering.. M> Matt M> R. Scott Perry wrote: >> >>> R> You should be able to filter on those words, if you include the >>> foreign >>> R> characters in your filter file (assuming you are running 1.75 or >>> later -- >>> R> some previous versions wouldn't work with foreign characters in >>> the filter >>> R> files). >> >> >>> It doesn't. I have had messages passing right through on very >>> simple word formats like: >>> >>> SUBJECT 13 CONTAINS yöur >> >> >> I just tested a filter with this line in it (with 1.76i4, although >> 1.75 and 1.76 should work the same), and it worked. Are you sure >> there are no spaces/tabs at the end of the line? Are other lines in >> the filter working (if not, the test may not be set up correctly)? >> >>-Scott M> --- M> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] M> --- M> This E-mail came from the Declude.JunkMail mailing list. To M> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and M> type "unsubscribe Declude.JunkMail". The archives can be found M> at http://www.mail-archive.com. M> -- M> ActivatorMail(tm) ver.00922031 Scanned for all viruses by M> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] Foreign Characters and Declude
Reply to: R. Scott Perry Re: [Declude.JunkMail] Foreign Characters and Declude on Saturday 7:09:47 AM It doesn't. I have had messages passing right through on very simple word formats like: SUBJECT 13 CONTAINS yöur SUBJECT 600 CONTAINS Löw SUBJECT 600 CONTAINS äpproved SUBJECT 600 CONTAINS Räte SUBJECT 600 CONTAINS Evëry SUBJECT 600 CONTAINS Herë -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>I want to enable foreign characters but filter on their >>exact words. It sounds like these character sets are not >>'viewed' and filtered in Declude? R> You should be able to filter on those words, if you include the foreign R> characters in your filter file (assuming you are running 1.75 or later -- R> some previous versions wouldn't work with foreign characters in the filter R> files). -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Foreign Characters and Declude
Reply to: R. Scott Perry Re: [Declude.JunkMail] Foreign Characters and Declude on Friday 7:40:45 PM I want to enable foreign characters but filter on their exact words. It sounds like these character sets are not 'viewed' and filtered in Declude? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Don't know if any one asked this, but we are seeing a flurry of >>omlauted characters used in Subject fields: >> >>RE: üS Döctor appröved RX Prëscríptíon >> >>We are ring to filter on these, but Declude doesn't see to >>recognize them? R> That should trigger the NONENGLISH test (if you are using it). R> -Scott R> --- R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. R> Declude Virus: Catches known viruses and is the leader in mailserver R> vulnerability detection. R> Find out what you've been missing: Ask about our free 30-day evaluation. R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.00922031 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Foreign Characters and Declude
Don't know if any one asked this, but we are seeing a flurry of omlauted characters used in Subject fields: RE: üS Döctor appröved RX Prëscríptíon We are ring to filter on these, but Declude doesn't see to recognize them? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [SPAM-BADHEADERS][Declude.JunkMail] Five Ten List
Reply to: Keith Anderson Re: [SPAM-BADHEADERS][Declude.JunkMail] Five Ten List on Thursday 9:14:19 AM We used to be on Qwest and had the same problem. Outgoing was not a problem, but incoming was. The worst we saw of an RBL blocking whole providers was BLARS which appears to block whole providers except .NL Watch out for this one...too. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K> One of our upstream providers is Qwest, and we have the same problem. K> However, everyone seems to be aware of the SPAM-SUPPORT flaw because it has K> never prevented us from getting mail to anyone. >> My server is blocked by five-ten because the author doesn't >> like Broadwing? I am immediately going to quit using the >> five-ten lists because I don't know who else this gentleman >> doesn't like. >> >> The response is: >> >> IP address 67.99.44.6 is listed here as broadwing.net >> spam-support. Please note that the following comments apply K> --- K> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K> --- K> This E-mail came from the Declude.JunkMail mailing list. To K> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K> type "unsubscribe Declude.JunkMail". The archives can be found K> at http://www.mail-archive.com. K> -- K> ActivatorMail(tm) ver.00922031 Scanned for all viruses by K> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filtering 0.0.0.0 ??
In Deccon I see relay IP 0.0.0.0 from time to time. What is the best way to filter, ban, or configure for this IP showing up? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HiJack CIDR?
Searching the archives, I could not find out if Hijack accepts CIDR format for ALLOW IP? Does any one here know if it does? The documentation does not indicate this. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] spamdomains list
Reply to: R. Scott Perry Re: [Declude.JunkMail] spamdomains list on Friday 10:25:16 AM Thanks! -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Wait a second? When I requested this, was this format put in Declude? >> >>earthlink.com earthlink.net >>earthlink.net earthlink.com >>email.itwebmessenger.it >>excite.com excitenetwork.com >> >>If so, I did not see this indicated in any messages I have read. R> This was added to v1.70 -- you can either have one entry on a line (where R> the reverse DNS must contain that entry, if the return address contains R> it), or you can have two (in which case the reverse DNS entry must contain R> *either* of the two entries, if the *first* entry appears in the return R> address). R> -Scott R> --- R> Declude JunkMail: The advanced anti-spam solution for IMail mailservers. R> Declude Virus: Catches known viruses and is the leader in mailserver R> vulnerability detection. R> Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Reply to: Bill B. Re: [Declude.JunkMail] spamdomains list on Friday 9:20:04 AM Wait a second? When I requested this, was this format put in Declude? earthlink.com earthlink.net earthlink.net earthlink.com email.itwebmessenger.it excite.com excitenetwork.com If so, I did not see this indicated in any messages I have read. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - B> Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? B> Bill -- ActivatorMail(tm) ver.0518031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] IMail v8.0 and Declude Jinkmail??
You are right $6500 is absolutely rediculous. Nothing like paying thousands more for many less features... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - D> Scott, D> A couple of notes... D> 1.) We started with IMail Antivirus and next week it looks like we will D> be adding another imail server purchasing Declude AntiVirus for it and D> another license for our existing server. My main problem is that to D> continue to run Imail AV it costs about $6,500 for a 1 year D> subscription(unlimited users). To me that price is ridiculous. Also, D> it lacks many features like suppress virus notifications for certain D> viruses and the ability to block certain file attachments. -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitlist Compiler
http://www.internetwk.com/breakingNews/showArticle.jhtml?articleID=6512003 "IronMail compiles whitelists by looking at the recipient addresses of outgoing mail, on the assumption that frequently used addresses are those of people that an enterprise has a partnership with, and who should be allowed to send e-mail into the enterprise." Would be a nice feature in Declude... This appliance costs $27,000 each.. geesh.. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >> Does Declude realize it is a store and forward scenario, thus it >> processes the mail and then places it back in the spool directory for >> delievery? R> Yes, it does. We have quite a few customers who are set up like this. R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Reject Msg based on Size
Reply to: Andy Schmidt Re: [Declude.JunkMail] Reject Msg based on Size on Monday 8:07:22 AM This is not in my earlier version of Imail... Does this do this on an account basis or domain basis? It must be in later versions unless I am missing something. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - A> Why not control the message size in Imail - you can set it per domain and, I A> believe, per user. A> If the message exceeds the max message size, Imail will reject it - and it A> will result in a bounce from the SENDING server. A> In fact, Imail's ESMTP will announce the max message size to the sending A> server so that it can be rejected BEFORE it is transmitted (at EHLO time!) A> Best Regards A> Andy A> --- A> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] A> --- A> This E-mail came from the Declude.JunkMail mailing list. To A> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and A> type "unsubscribe Declude.JunkMail". The archives can be found A> at http://www.mail-archive.com. A> -- A> ActivatorMail(tm) ver.122102 Scanned for all viruses by A> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Reject Msg based on Size
Reply to: R. Scott Perry Re: [Declude.JunkMail] Reject Msg based on Size on Monday 7:12:40 AM He has a dialup modem and wants to limit per message size.. It would save processor, if a partial message was returned to each the sender and the original message if not delivered might save 1/2 bandwidth.. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Scott, I just had an MIT engineer/user suggest a feature to reject >>messages based on their size. I found this fascinating personally. >> >>You could look at the size and bounce, e.g. >> >>SIZE 10MB BOUNCE >> >>Might be a server saver also... especially if it bounced a >>partial response smaller message. R> It is an interesting idea. R> One problem, though, is that it wouldn't save any bandwidth (as the E-mail R> would have to be received before bouncing it). Is this something that R> others might find useful? R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reject Msg based on Size
Scott, I just had an MIT engineer/user suggest a feature to reject messages based on their size. I found this fascinating personally. You could look at the size and bounce, e.g. SIZE 10MB BOUNCE Might be a server saver also... especially if it bounced a partial response smaller message. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude in PCMag
Congratulations, Scott. Declude is mentioned in PCMag, latest February 25th Issue, page 95. Sniffer is also in the same listing. Suppose we'll see price increases now. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] OT: Dictionary Attacks
Reply to: Don Schreiner Re: [Declude.JunkMail] OT: Dictionary Attacks on Thursday 11:51:25 AM >From an earlier msg: Our servers are very stable with this firewall. It does not autoblock these but you can manually block them. I noticed that they do not show up in the log any more, so it appears to work fine. I know you can set to autoblock select events by editing the blackice.ini can be edited for example: http.urllimit.count=60 http.urllimit.interval=50 will temporarily block too many URL requests, like web site copying... These are the settings to block dictionary attacks. It detects too many errors brought on by many failed logins... [Settings] smtp.error.count=10 ;total errors within smtp.error.interval=120 ;this amount of time(sec)then blocked -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - D> Bill, D> Also running BI as of few weeks ago and tinkering with firewal.ini. D> Would you mind sharing the .ini changes you made. You can e-mail me off D> list. Thanks. D> Sincerely, D> Don Schreiner D> CompBiz, Inc. D> www.compbiz.net D> 407-322-8654 D> 800-408-3688 D> -Original Message- D> From: [EMAIL PROTECTED] D> [mailto:[EMAIL PROTECTED]] On Behalf Of Bill B. D> Sent: Thursday, January 23, 2003 12:16 PM D> To: [EMAIL PROTECTED] D> Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks D> We started running BlackICE last month and it has been working nice for D> us. It requires a few config changes to get it to auto-block IPs that D> send you dictionary attacks, but it is definitely a good solution. D> Bill D> -Original Message- D> From: "R. Scott Perry" D> Sent: Thu, 23 Jan 2003 10:58:09 -0500 D> Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks >>It seems this morning that we have several dictionary attacks happening >>on one of Imail servers. Is there an easy to stop the person doing >>this? I have looked through the log files and cannot easily spot the >>person(s) doing this. >> >>Is there software that will prevent people from performing Dictionary >>Attacks in the future? >> >>The POP3 and Delcude processes are using like 50-09% of the CPU. >> >>Let me know if there is anything I can do... D> Are you sure that it is a dictionary attack? If the POP3 process has D> higher usage than normal, then E-mails are being sent to your users D> (which D> would mean that it either isn't a dictionary attack, or a hybrid attack D> where they send spam as part of the dictionary attack). D> You might want to check the archives of the IMail Forum for ideas on how D> to D> stop a dictionary attack. Some tricks are using a "nobody" alias (which D> I D> believe you are), or using a product like BlackIce Server to stop it. D> Unfortunately, Declude can't stop these, because it doesn't have access D> to D> the TCP/IP connection (which is where it would need to be stopped). D> -Scott D> --- D> [This E-mail was scanned for viruses by Declude Virus D> (http://www.declude.com)] D> --- D> This E-mail came from the Declude.JunkMail mailing list. To D> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type D> "unsubscribe Declude.JunkMail". The archives can be found at D> http://www.mail-archive.com. D> --- D> [This E-mail was scanned for viruses by Declude Virus D> (http://www.declude.com)] D> --- D> This E-mail came from the Declude.JunkMail mailing list. To D> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type D> "unsubscribe Declude.JunkMail". The archives can be found at D> http://www.mail-archive.com. D> -- D> Scanned by CompBiz for Viruses http://www.CompBiz.Net. D> Save 15 Percent on Virus Software by visiting D> http://www.compbiz.net/software_mcafee.cfm for details! D> --- D> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] D> --- D> This E-mail came from the Declude.JunkMail mailing list. To D> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and D> type "unsubscribe Declude.JunkMail". The archives can be found D> at http://www.mail-archive.com. D> -- D> ActivatorMail(tm) ver.122102 Scanned for all viruses by D> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: John Tolmachoff Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 3:40:53 PM Is there a URL for this. Sorry if I don't have it, but I am on many lists and sometimes I delete something that maybe I should not have. Thanks again, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >> I have many domains and users on my system. Not all want this feature >> so I need it as a Pro (per domain per user) feature... and as I >> mentioned earlier, there should be notification to the user of >> attempted delivery mailfroms... so he or she can add these to their >> addressbook if desired. This is what I was looking to accomplish so I >> can tell the CNET editor this feature is working in a viable >> marketable way... J> Rodger, the NoXMail add on to Declude would provide the functions I think J> you are looking for. J> John Tolmachoff MCSE, CSSA J> IT Manager, Network Engineer J> RelianceSoft, Inc. J> Fullerton, CA 92835 J> www.reliancesoft.com J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". The archives can be found J> at http://www.mail-archive.com. J> -- J> ActivatorMail(tm) ver.122102 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 2:58:10 PM I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Scott, do you know when these features might be in beta, including the >>notification? We cannot use a global setup or most of our users would >>not get mail. We are anxious to see this work. R> I'm not sure specifically which feature(s) you are referring to? R> The AUTOWHITELIST option is available as an interim release now, and should R> be available as a beta within a week or so. R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 8:57:29 PM Scott, do you know when these features might be in beta, including the notification? We cannot use a global setup or most of our users would not get mail. We are anxious to see this work. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>How would this be implemented on a user or domain basis? R> The AUTOWHITELIST option is a global option, and can not be done on a R> per-user or per-domain basis. >>I'm assuming this auto detects the right path >>regardless of the drive the account resides on? R> That is correct. >>This is a very interesting feature. R> I think so too. :) R> -Scott -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 6:46:34 PM Also, I presume there is no notification system for the users account yet with a bounce message? Forgot to ask that one. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>This is something that we are also giving some serious thought to (perhaps >>an "AUTOWHITELIST ON" option that if enabled would let Declude JunkMail >>know to check for address books, and if present, would whitelist any >>address in them). R> This will be in the next beta, and is now available as an interim release ( R> http://www.declude.com/release/166i/declude.exe ), for those that want to R> test it out immediately. R> To use it, you simply add a line "AUTOWHITELIST ON" in the R> \IMail\Declude\global.cfg file. Then, for incoming E-mail, Declude R> JunkMail will check to see if the user has an address book set up in web R> messaging, and if so, will whitelist any E-mail addresses listed in it. R>-Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 6:46:34 PM Wow, that was fast! Thanks Scott. as usual you are very responsive to these kind of requests... How would this be implemented on a user or domain basis? This is likely in your 'Pro' version documentation, but could you summarize this simply for me. I'm assuming this auto detects the right path regardless of the drive the account resides on? This is a very interesting feature. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>This is something that we are also giving some serious thought to (perhaps >>an "AUTOWHITELIST ON" option that if enabled would let Declude JunkMail >>know to check for address books, and if present, would whitelist any >>address in them). R> This will be in the next beta, and is now available as an interim release ( R> http://www.declude.com/release/166i/declude.exe ), for those that want to R> test it out immediately. R> To use it, you simply add a line "AUTOWHITELIST ON" in the R> \IMail\Declude\global.cfg file. Then, for incoming E-mail, Declude R> JunkMail will check to see if the user has an address book set up in web R> messaging, and if so, will whitelist any E-mail addresses listed in it. R>-Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: Charles Frolick Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 11:05:37 AM That's why I was making the inquiry earlier about using weights. The whole weights model is easier to abide by and set upper and lower parameters or limits for almost everything... This would be a very nice 'Declude Pro' feature when scaled on unique domains and users. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - C> That makes sense, a mixture of the two. In that case you would not want C> to use CATCHALLMAILS, but use the "border line" weights to notify, and C> let the customer decide to allow. C> Thanks, C> Chuck Frolick C> ArgoNet, Inc. C> -Original Message- C> From: [EMAIL PROTECTED] C> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath C> Sent: Friday, January 17, 2003 10:51 AM C> To: Charles Frolick C> Subject: Re[4]: [Declude.JunkMail] WhiteList Per User or Domain? C> Reply to: Charles Frolick C> Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday C> 9:35:39 AM C> We already capture most spam and virus using weights in Declude, C> so the user would only be hit with border line emails. I see this C> as an ideal scenario for those that would want such a feature. C> -- C> Roger Heath C> [EMAIL PROTECTED] C> www.rleeheath.com C> --- C> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] C> --- C> This E-mail came from the Declude.JunkMail mailing list. To C> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and C> type "unsubscribe Declude.JunkMail". The archives can be found C> at http://www.mail-archive.com. C> -- C> ActivatorMail(tm) ver.122102 Scanned for all viruses by C> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: Charles Frolick Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 9:35:39 AM We already capture most spam and virus using weights in Declude, so the user would only be hit with border line emails. I see this as an ideal scenario for those that would want such a feature. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - C> One problem with held or bounced mail that notifies the intended C> recipient that it was blocked, is, you did not elimiate the spam, only C> change it's contents to hundreds of notifications of unwanted mail. C> This will get very old, very fast, and lead to the blacklists you are C> trying to avoid. Intelligent spam filters, combined with reasonably C> reliable black lists and weighting are much more customizable, and can C> be set up to allow customers to choose what to hold, what to delete, and C> what to deliver. Several members of this list have created such apps C> using various methods. Before I set mine up I would receive between 50 C> and 100 spams a day, all where caught by Declude, but had low weights C> (as an ISP I have to be somewhat cosevative in my weighting). After C> setting up a system that lets the individuals decide, I used very C> aggressive setting and now only get 5-10 a day tops, many days I get C> none. I never miss any wanted email, I have an allowed senders list and C> a blocked senders list, and since it uses Imail rules, I can override C> the hold and delete settings for the rare occasion, such as the poorly C> built mailer on my statistics program, that always fails BADHEADERS and C> SPAMHEADERS, and I cant't allow the sender because that's one of the C> broken headers. C> Sorry to ramble, just felt I needed to put my two cents in. C> Thanks, C> Chuck Frolick C> ArgoNet, Inc. C> -Original Message- C> From: [EMAIL PROTECTED] C> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath C> Sent: Thursday, January 16, 2003 3:24 PM C> To: R. Scott Perry C> Subject: Re[2]: [Declude.JunkMail] WhiteList Per User or Domain? C> Reply to: R. Scott Perry C> Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday C> 3:13:03 PM C> Thanks. But a catchall is exactly what I don't want. What I want is a C> bounce so the sender knows his mail was not accepted... maybe a C> catchall if cannot deliver to sender... There are whitelist email C> providers showing up and usually the sender gets sent a message that C> his mail was not delivered. Usually there is a process to inform the C> destination user if he wants to add the sender to his or her C> whitelist. Maybe this is not feasible with Declude, but it would be C> most certainly nice to have. The lead ZDNet editor David Berlind and I C> have a dialog going and he is really down on blacklists and more or C> less endorsing the whitelist concept. So I am shooting for a way to C> manage this in Declude. I was thinking I could put high weights on all C> other emails with a bounce by default but give a white list negative C> counter-weights to let those through. Not sure his would work? C> -- C> Roger Heath C> [EMAIL PROTECTED] C> www.rleeheath.com C> - Copy of Original Message(s): - >>>Is it possible to make a Declude domain or user setting that enables a >>>whitelist of email sender addresses in the Pro version whereby all >>>emails are rejected or bounced accept a whitelist of senders? In other >>>words reject or bounce all senders accept those that the user wishes >>>to communicate with. Could this be done with weights...sending an eml >>>to bounced mails? This way the Global.Cfg would not be used with its >>>limitations. R>> This isn't currently possible as a designed feature, but you should C> be able R>> to accomplish it with the next release. To do so, you would set up a R>> per-domain or per-user configuration of "CATCHALLMAILS HOLD" or C> something R>> similar, and then have a whitelist file for that user with all the R>> addresses that should be accepted. R>>-Scott R>> --- R>> [This E-mail was scanned for viruses by Declude Virus C> (http://www.declude.com)] R>> --- R>> This E-mail came from the Declude.JunkMail mailing list. To R>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R>> type "unsubscribe Declude.JunkMail". The archives can be found R>> at http://www.mail-archive.com. R>> -- R>> ActivatorMail(tm) ver.122102 Scanned for all viruses by R>> www.activatormail.com intelligent anti-virus anti-spam service C> -- C> ActivatorMail(tm) v
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 5:57:27 PM Scott, the only thing that would concern me is that I use multiple disk drives for my users accounts, for example: activatormail.com d:\actmail techknow.com c:\Imail\techknow wyndows.comc:\Imail\wyndows If you do such a feature I would need to be able to point to an exact path for each domain... I think this would be a great feature for Declude and I hope you do it. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>I think I mentioned this to you >>earlier, Scott; If you could have the user edit their addressbook in >>Imail web mail as a whitelist, and Declude used this, then the user >>could manage their own whitelist. R> This is something that we are also giving some serious thought to (perhaps R> an "AUTOWHITELIST ON" option that if enabled would let Declude JunkMail R> know to check for address books, and if present, would whitelist any R> address in them). R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 3:33:30 PM Thanks, all. This is something that would be a wonderful feature in Declude. If the %MAILFROM% was sent to the destination user and he or she could add this address to their whitelist of senders, this might be an extremely big feature indeed. Not sure how all this fits together, but I might experiment with the catchall and/or weights to see how far I can go with this. I think I mentioned this to you earlier, Scott; If you could have the user edit their addressbook in Imail web mail as a whitelist, and Declude used this, then the user could manage their own whitelist. Then if a mail is turned away they could just add this email address to their addressbook in web mail to turn on the receiving of mails from that user in the future. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Thanks. But a catchall is exactly what I don't want. What I want is a >>bounce so the sender knows his mail was not accepted... R> Actually, I believe the CATCHALLMAILS test will do what you want. However, R> in this case, you would use "CATCHALLMAILS BOUNCE" instead of R> "CATCHALLMAILS HOLD". R> With "CATCHALLMAILS BOUNCE", all E-mails will be bounced -- except if you R> whitelist the sender. >>Usually there is a process to inform the >>destination user if he wants to add the sender to his or her >>whitelist. R> That's an interesting idea. I'll have to see if it is possible to combine R> the ALERT action (which would behave in this case just about the same as R> the BOUNCE action) with the ATTACH action, which would allow you to send a R> bounce message and have an E-mail go to the recipient explaining that an R> E-mail from %MAILFROM% was blocked. >>The lead ZDNet editor David Berlind and I >>have a dialog going and he is really down on blacklists and more or >>less endorsing the whitelist concept. So I am shooting for a way to >>manage this in Declude. I was thinking I could put high weights on all >>other emails with a bounce by default but give a white list negative >>counter-weights to let those through. Not sure his would work? R> I'm guessing the "CATCHALLMAILS BOUNCE" combined with a whitelist would R> work best. However, you could likely accomplish the same thing with the R> weighting system. R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 3:13:03 PM Thanks. But a catchall is exactly what I don't want. What I want is a bounce so the sender knows his mail was not accepted... maybe a catchall if cannot deliver to sender... There are whitelist email providers showing up and usually the sender gets sent a message that his mail was not delivered. Usually there is a process to inform the destination user if he wants to add the sender to his or her whitelist. Maybe this is not feasible with Declude, but it would be most certainly nice to have. The lead ZDNet editor David Berlind and I have a dialog going and he is really down on blacklists and more or less endorsing the whitelist concept. So I am shooting for a way to manage this in Declude. I was thinking I could put high weights on all other emails with a bounce by default but give a white list negative counter-weights to let those through. Not sure his would work? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Is it possible to make a Declude domain or user setting that enables a >>whitelist of email sender addresses in the Pro version whereby all >>emails are rejected or bounced accept a whitelist of senders? In other >>words reject or bounce all senders accept those that the user wishes >>to communicate with. Could this be done with weights...sending an eml >>to bounced mails? This way the Global.Cfg would not be used with its >>limitations. R> This isn't currently possible as a designed feature, but you should be able R> to accomplish it with the next release. To do so, you would set up a R> per-domain or per-user configuration of "CATCHALLMAILS HOLD" or something R> similar, and then have a whitelist file for that user with all the R> addresses that should be accepted. R>-Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.122102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WhiteList Per User or Domain?
I know this question must have been asked about Declude, but thought I'd ask again anyway as I do not recall if there is a method possible. Is it possible to make a Declude domain or user setting that enables a whitelist of email sender addresses in the Pro version whereby all emails are rejected or bounced accept a whitelist of senders? In other words reject or bounce all senders accept those that the user wishes to communicate with. Could this be done with weights...sending an eml to bounced mails? This way the Global.Cfg would not be used with its limitations. Thanks, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview Black-listing White-listing Possible Feature
Ok, I am now both black-listing and white-listing using a single filter file in Declude. For example if a source is blacklisted this can take the form of the following methods or commands examples: MAILFROM 60 ENDSWITH greatdeal.net HEADERS 60 CONTAINS somebaby.com BODY 60 CONTAINS basherman The weights are so high each mail gets deleted. Now I white-list using 'counter-weights': REVDNS -100 ENDSWITH sportico.com MAILFROM -100 ENDSWITH [EMAIL PROTECTED] HEADERS -100 CONTAINS Yahoo! Alerts SUBJECT -100 CONTAINS ActivatorMail Sign-up To manage the above I have a WEIGHT 35 that DELETES 'black-listed' weights... Now that I know I can edit just one simple file, I am wishing SpamReview could do this for me. I am not sure just how to pursue this but for mailfrom info could be used initially. This means there would be four buttons, for example: Que and White-list Domain = adds MAILFROM -100 ENDSWITH @domain.com Que and White-list Sender = adds MAILFROM -100 ENDSWITH [EMAIL PROTECTED] Delete and Black-List Domain = adds MAILFROM 100 ENDSWITH @domain.com Delete and Black-List Sender = adds MAILFROM 100 ENDSWITH [EMAIL PROTECTED] Maybe Scott can recommend how to do this to be most efficient with Declude testing of emails. Maybe a pull down menu would be good rather than buttons, then many more parameters could exist in addition to above four examples above? For example another method would be: Delete Black-list REVDNS Domain = adds REVDNS 100 ENDSWITH domain.com Delete White-list REBDNS Domain = adds REVDNS -100 ENDSWITH domain.com I would find all this quite useful and I am wondering what others might think. SpamReview could be pointed at a single filter.txt file to edit then edit it... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] An optional web interface for Declude JunkMail?
Reply to: [EMAIL PROTECTED] Re: [Declude.JunkMail] An optional web interface for Declude JunkMail? on Monday 8:34:08 PM Yes this would be valuable. It could be launched into IIS from an actual link in the Imail web templates going to an alternate port, so it would not seem so seemless. The second password system would be good because access to spam filter management would exist as a privilege independently. Sounds very interesting to me, especially if it enabled me to managed captured or HOLD mails remotely. I saw the utility uploaded to this list for this purpose, but I have not tried it and would be curious if any one has? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - H> Count me in! H> Mike H> - Original Message - H> From: "R. Scott Perry" <[EMAIL PROTECTED]> H> To: <[EMAIL PROTECTED]> H> Sent: Monday, December 16, 2002 7:49 PM H> Subject: [Declude.JunkMail] An optional web interface for Declude JunkMail? >> A lot of our customers seem to want a web interface to Declude JunkMail, >> mostly so that customers can turn their spam settings on or off. >> >> We haven't come up with something in the past, because it is very >> complicated without a hook into web messaging, and it doesn't look like >> Ipswitch is planning to add an interface to web messaging any time soon. >> >> However, we are at the point where we are considering a web interface. If >> we do it, it would probably need to be done as an addon to Declude >> JunkMail, mainly because the development and support costs would be fairly >> high. It would also have some drawbacks, being separate from web >> messaging. For example, it would require installing a separate service, >> using a different port than 80 or 8383 for web access (which may cause >> firewall problems), and having users enter their username/password a H> second >> time (if they are already using web messaging). >> >> Is this something that is important enough that it would be worthwhile? >> -Scott >> >> --- >> [This E-mail was scanned for viruses by Declude Virus H> (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> H> --- H> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] H> --- H> This E-mail came from the Declude.JunkMail mailing list. To H> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and H> type "unsubscribe Declude.JunkMail". The archives can be found H> at http://www.mail-archive.com. H> -- H> ActivatorMail(tm) ver.122102 Scanned for all viruses by H> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 'Counter-weighing' With One File
We recently took the que in earlier discussions here to begin utilizing negative weights in the filter file we had already constructed to make counter-weighing work. We are very pleased with the results. First we have just one file to edit that weighs possible spam by rating MAILFROM, BODY, etc. but then we added to the same file -100 or -60 counter-weights for versions of these that are really legitimate sources. The whole operation is simple as it is based strictly on weight and editing Declude rules to balance against black lists that are trapping legitimate emails.. works super and is very easy to manage. You also do not have the limitations of total whitelisting entries associated with the global.cfg. Spam weights, for example, look like: MAILFROM 13 CONTAINS opt-in MAILFROM 13 CONTAINS optitarget MAILFROM 13 CONTAINS promo Spam 'counterweights' look like: MAILFROM -100 CONTAINS .classmates.com MAILFROM -100 CONTAINS .rnc.org MAILFROM -100 CONTAINS pcclub.com -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >> One problem I see (Sandy and others, please jump in) is that whitelisting J> is J> easy to mess up, and a crack that the "law of unintended consequences" will J> exploit. Two examples: the example in Scott's manual that says whitelisting J> mail.com is probably a bad idea, and whitelisting J> postmaster@[yourdomainhere.tld] gives a free ride to any spam that sends to J> postmaster while cc'ing everybody else at your domain. J> I agree. The battle goes on. J> John Tolmachoff MCSE, CSSA J> IT Manager, Network Engineer J> RelianceSoft, Inc. J> Fullerton, CA 92835 J> www.reliancesoft.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Wired: Archive: Fresh Spam for Everyone
http://www.wired.com/news/technology/0,1282,56624,00.html http://www.spamarchive.org/ Good place to soon begin building super Declude filters? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SEC and Spammer margaret_thomas
Just a quick note that we just received a call and a supoena from the SEC Enforcement Division in Washington and they are actively going after a spammer we had sign up here but Declude Hijack quickly halted. The spammer is well known and commonly uses an account name margaret_thomas. If any here have traceable information they'd like to volunteer please forward it privately to my personal address below and I will forward it to the investigator at the SEC. We have actually abandoned Human Kind signup because we could not establish a confirmation style signup system. Has any one developed such a system? Since we manage this manually now we have not had a spammer as we carefully screen each who signs up... but I would be curious if such a system has been developed and is commercially available? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] whitelisting
Reply to: John Tolmachoff Re: [Declude.JunkMail] whitelisting on Thursday 5:02:56 PM I'd like to do this. Will negative weights work for this list? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J> One thing I am considering is using a greylist, where known solid domains J> that need it will go on a weighted whitelist of say -100 and the weighted J> greylist will get say -15, and I would put those domains they needed the J> help but not wanting to actually whitelist. J> John Tolmachoff MCSE, CSSA J> IT Manager, Network Engineer J> RelianceSoft, Inc. J> Fullerton, CA 92835 J> www.reliancesoft.com J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". The archives can be found J> at http://www.mail-archive.com. J> -- J> ActivatorMail(tm) ver.082302 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] More on: %COUNTRYCHAIN%
Reply to: R. Scott Perry Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% on Tuesday 10:17:21 AM This updated dat file fixed it, thanks. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>I have yet to see any countries shown... it is always: >> >> [Unknown]->[APNIC Unlisted]->[ARIN Unlisted]->destination R> Do you have the \IMail\Declude\all_list.dat file? R> -Scott -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] More on: %COUNTRYCHAIN%
Reply to: Kami Razvan Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% on Tuesday 9:57:48 AM I have yet to see any countries shown... it is always: [Unknown]->[APNIC Unlisted]->[ARIN Unlisted]->destination -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K> Hi; K> I have: K> COUNTRYCHAINX-Country-Chain: %COUNTRYCHAIN% K> In the Global.cfg. K> Am I to expect the country chain in all eMail headers? If yes.. Then I K> am not getting it. K> I have downloaded the K> file:http://www.declude.com/release/162/all_list.dat and put it in the K> declude folder. K> Missing something? K> Regards, K> Kami K> --- K> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K> --- K> This E-mail came from the Declude.JunkMail mailing list. To K> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K> type "unsubscribe Declude.JunkMail". The archives can be found K> at http://www.mail-archive.com. K> -- K> ActivatorMail(tm) ver.082302 Scanned for all viruses by K> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.62 (beta) released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude JunkMail v1.62 (beta) released on Monday 1:16:28 PM Not seeing %COUNTRYCHAIN% working in inheader here. Should I be using %COUNTRIES% instead or does a line have to be added to the Global file? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - R> We have just released Declude v1.62 (beta). See R> http://www.declude.com/junkmail/manual.htm . Changes include: R>o Will now handle multiple return codes in ip4r tests. R>o Will now record the action for each test that fails. R>o Changes handling of invalid "[?.?.?.?]". R>o External tests can now have variables in their definitions. R>o Adds a failsafe for invalid CIDR ranges in IP blacklists. R>o Adds COUNTRY (of remote mailserver) and COUNTRIES (of any mailservers R> in chain) to filter. R>o Adds %COUNTRYCHAIN% variable. R>o Adds "ipnotinmx" test, which catches E-mail sent from an IP not in the R> MX records of sending domain. R>o HABEAS whitelist type, for whitelisting E-mails with Habeas headers R> ("WHITELIST HABEAS"). R>o New "habeas" test type, to allow for negative weighting of E-mails R> with Habeas headers. R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.082302 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] question for all...
Reply to: Sanford Whiteman Re: [Declude.JunkMail] question for all... on Saturday 3:54:30 PM Thanks, Sandy. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >> How do you setup a domain to spool only then forward to another >> Exchange server? S> Search IMail KB for "store and forward." S> -Sandy -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] question for all...
Reply to: Bill Beach Re: [Declude.JunkMail] question for all... on Friday 8:44:17 AM How do you setup a domain to spool only then forward to another Exchange server? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Has anybody done this? B> I just set this up this week for another organization on-site here. I used B> to host their e-mail on my IMail server but they are moving to a new B> location (none too soon I might add) and want to use Exchange. So currently B> their mail comes to my IMail server running Declude AV and JunkMail which B> then forwards it to their Exchange box. No problems to report. As far as the B> licenses go, my thinking is that if you're only spooling mail and not B> hosting any user boxes, you should be able to get by with the mininum user B> license. B> -B -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] SpamReview Request - Delete All
Reply to: Darrell L. Re: [Declude.JunkMail] SpamReview Request - Delete All on Wednesday 7:42:30 AM I know... This is what I do now. One click would still be nicer and faster... been using Windows since version 1. Thanks, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>>Delete All - Deletes all entries. D> >>>Delete All and Exit - Deletes all entries then exits (deleting >>>deleted if switch is 'on') D> D> Darrell -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] SpamReview Request - Delete All
Reply to: Tom Schwarz Re: [Declude.JunkMail] SpamReview Request - Delete All on Wednesday 5:57:17 AM I would like the buttons actually... I am using the keyboard commands but I'd like to make these one clicks.. Particularly the delete all and exit..then this would delete all displayed entries and all deleted entries in one click. Perahps the other should be delete all then reload any new entries.. No highlighting would be required at all. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T> Roger, T> Using standard windows select capibilities you may select multiple entries T> with the Shift and Ctrl keys or select all entries using Ctrl-A. T> After selecting multiple entries you can use all the normal functions such T> as Delete or Move just like you would use them on one selected entry. T> Will this take care of your request or would the buttons be better? T> Tom T> -Original Message- T> From: [EMAIL PROTECTED] T> [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath T> Sent: Tuesday, September 24, 2002 9:19 PM T> To: Tom T> Subject: [Declude.JunkMail] SpamReview Request - Delete All T> Importance: Low T> Ok, SpamReview mailFrom is working great for me with the proper T> string detect...!!! T> Now for another request. two more buttons: T> Delete All - Deletes all entries. T> Delete All and Exit - Deletes all entries then exits (deleting T> deleted if switch is 'on') T> This is really want is needed. This way one may inspect select T> messages and manage them then delete the rest in one blow. This T> will save me even more time from an already great time saving T> program. T> -- T> Roger Heath T> [EMAIL PROTECTED] T> www.rleeheath.com T> -- T> ActivatorMail(tm) ver.082302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service T> --- T> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". The archives can be found T> at http://www.mail-archive.com. T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". The archives can be found T> at http://www.mail-archive.com. T> -- T> ActivatorMail(tm) ver.082302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview Request - Delete All
Ok, SpamReview mailFrom is working great for me with the proper string detect...!!! Now for another request. two more buttons: Delete All - Deletes all entries. Delete All and Exit - Deletes all entries then exits (deleting deleted if switch is 'on') This is really want is needed. This way one may inspect select messages and manage them then delete the rest in one blow. This will save me even more time from an already great time saving program. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamReview Update and "From" EMail Discussion
Reply to: Tom Schwarz Re: [Declude.JunkMail] SpamReview Update and "From" EMail Discussion on Wednesday 3:00:02 PM This feature to add to kill still fails here. In place of X-Declude-Sender: I put X-Note-Real-Mail-From: Wondering what I might be doing wrong? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T> To SpamReview Users, T> v1.0.47 is now available. If you are already using v1.0.45 just click on T> File/Check for Program Updates to download the new version. T> Changes in this version. T> SpamReview now extracts the "From" email address for the list from the "Q" T> file if you have the"Show Subject in List" option selected in the Settings. T> Added a new field in the Settings so you can configure a string to use when T> trying to locate the "From" email address in the settings file. By default T> "X-Declude-Sender:" is used since Declude already includes this in the T> message if you have "XSENDER ON" set in the global.cfg file. T> No changes were made to the "Add to Kill" except to use the new string to T> locate the "From" email address. T> -- T> I hope this helps resolve some of the problems, questions, and confusion. T> -- T> A few weeks ago I started to update the web page. You can find help here. T> http://www.slsoft.com/spamreviewhelp.htm T> You can also find some of the following discussion regarding the "From" T> EMail address in the Q&A section. Here it is in text form. T> Q. Where does SpamReview get the "From" EMail address from? T> A. The "From" EMail Address can come from a couple of different places T> depending on how SpamReview is configured in the Settings. If you have T> selected the "Show Subject in List" option then the "From" EMail Address T> comes from the "Q" file using the Locate "From" EMail Address String: value T> in the Settings. If the "Show Subject in List" option is not selected the T> "From" EMail Address comes from the "D" file. In this case it may not be T> right but it's the best we have since we have not read the "Q" file yet. T> The Default Value for Locate "From" EMail Address String: is T> "X-Declude-Sender:". You must have "XSENDER ON" in the global.cfg file for T> this to work. If you have setup your own custom method for doing this just T> make sure the resulting string has one and only one space between your text T> and the start of the email address. ex. MyFromEMailAddress: T> [EMAIL PROTECTED] T> Important Note: Regardless of the Settings, the "From" EMail address located T> by using the Locate "From" EMail Address String: is used when adding to the T> kill.lst file. There are no exceptions to this. If you have not properly T> matched the SpamReview Settings with the Declude JunkMail settings you will T> get a blank entry in the kill.lst file. T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". The archives can be found T> at http://www.mail-archive.com. T> -- T> ActivatorMail(tm) ver.082302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] Address Book Only in Declude?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 10:19:03 AM The only problem I see with this is whitelisting... perhaps it should even disregard the whitelist too? Looks like a bounce would be preferable on a feature like this. It would be a great feature. If a user wants to receive e-mails from a select source he or she could just log into web mail and enter the address. It would be nice if they could make a 'CONTAINS' rule by say entering an address like [EMAIL PROTECTED], Then if internet.com was in the HEADERS, it would pass the mail.. Others have suggested making whitelists into separate lists so you can per user or per domain them. Perhaps if you do this all these things can be 'matched up'? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Personally we'd like to have this as an add-on and not a standard >>feature. So we'd like only administrator control over this. It >>could be easily misunderstood by users as well. The ability to >>set a whole domain or individual users, like the Pro version of >>Declude is what we really need. R> If something like this does get added, it would likely best fit into R> Declude JunkMail as a test and an action (such as a test "NOTINADDRESSBOOK" R> with an action of BOUNCE or HOLD). That way, it could be applied R> per-domain or per-user, and end users wouldn't have any direct control over it. R>-Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". The archives can be found R> at http://www.mail-archive.com. R> -- R> ActivatorMail(tm) ver.082302 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Address Book Only in Declude?
Reply to: John Tolmachoff Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 9:53:27 AM Not to be sarcastic, but how? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J> Not to be sarcastic, but wouldn't that be done in a rules.ima file that J> is configurable by the user? J> John Tolmachoff J> IT Manager, Network Engineer J> RelianceSoft, Inc. J> Fullerton, CA 92835 J> www.reliancesoft.com J> -Original Message- J> From: [EMAIL PROTECTED] J> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath J> Sent: Thursday, August 29, 2002 7:32 AM J> To: R. Scott Perry J> Subject: [Declude.JunkMail] Address Book Only in Declude? J> I just got the following request from one of my users: R>> How do I arrange to receive only emails from members of my address J> book? J> In my opinion this could be the biggest feature added to Declude J> at this time. Here's how I'd like it to work: J> Declude looks at a text cfg file to see if this feature is turned J> on for a select domain or e-mail account... for example, J> if in ADDR.CFG email address or domain wyndows.com or J> [EMAIL PROTECTED] then J> Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists J> then pass the e-mail to this account, else delete...or return J> e-mail as rejected.. J> How soon can I get this, Scott? J> -- J> Roger Heath J> [EMAIL PROTECTED] J> www.rleeheath.com J> -- J> ActivatorMail(tm) ver.082302 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service J> --- J> [This E-mail was scanned for viruses by Declude Virus J> (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". The archives can be found J> at http://www.mail-archive.com. J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". The archives can be found J> at http://www.mail-archive.com. J> -- J> ActivatorMail(tm) ver.082302 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Address Book Only in Declude?
Reply to: Kami Razvan Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 9:48:16 AM Personally we'd like to have this as an add-on and not a standard feature. So we'd like only administrator control over this. It could be easily misunderstood by users as well. The ability to set a whole domain or individual users, like the Pro version of Declude is what we really need. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K> Hi; K> The idea is a good one but I think it truly belongs at the IMail level. K> This way, using the web manager, every user can decide what level of K> mail they want to accept. K> It is sort of like what the JunkMail setting is with Hotmail. Strict, K> allowing only those in the address book to send, or Loose so anyone can K> send. K> If Declude adds this then it is up to the Admin to add this for every K> user upon request. This is a lot of work! K> Just a thought. K> Kami K> -Original Message- K> From: [EMAIL PROTECTED] K> [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath K> Sent: Thursday, August 29, 2002 10:32 AM K> To: R. Scott Perry K> Subject: [Declude.JunkMail] Address Book Only in Declude? K> I just got the following request from one of my users: R>> How do I arrange to receive only emails from members of my address R>> book? K> In my opinion this could be the biggest feature added to Declude at K> this time. Here's how I'd like it to work: K> Declude looks at a text cfg file to see if this feature is turned on for K> a select domain or e-mail account... for example, K> if in ADDR.CFG email address or domain wyndows.com or K> [EMAIL PROTECTED] then K> Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then K> pass the e-mail to this account, else delete...or return e-mail as K> rejected.. K> How soon can I get this, Scott? K> -- K> Roger Heath K> [EMAIL PROTECTED] K> www.rleeheath.com K> --- K> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K> --- K> This E-mail came from the Declude.JunkMail mailing list. To K> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K> type "unsubscribe Declude.JunkMail". The archives can be found K> at http://www.mail-archive.com. K> -- K> ActivatorMail(tm) ver.082302 Scanned for all viruses by K> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Address Book Only in Declude?
I just got the following request from one of my users: R> How do I arrange to receive only emails from members of my address book? In my opinion this could be the biggest feature added to Declude at this time. Here's how I'd like it to work: Declude looks at a text cfg file to see if this feature is turned on for a select domain or e-mail account... for example, if in ADDR.CFG email address or domain wyndows.com or [EMAIL PROTECTED] then Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then pass the e-mail to this account, else delete...or return e-mail as rejected.. How soon can I get this, Scott? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Optimizing Declude Filters
I am wondering if there is a particular order to Declude filters that will cause them to be more efficient? In this light do they add up weights till the violate a threshold then process? I was just thinking if the program could DELETE at WEIGHT 35, for example, as opposed to doing all these tests.. would this not speed up the whole process substantially if I put my worst tests first. Scott, maybe you can see where I'm headed. I am always afraid of my rules getting so long that they delay mail, especially in the BODY filters. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re[2]: BLARSBL:Re[2]: [Declude.JunkMail] Kill File list update for 07/31/02
Reply to: Tom Re: BLARSBL:Re[2]: [Declude.JunkMail] Kill File list update for 07/31/02 on Wednesday 5:39:02 PM Ah. Thanks. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >> I asked earlier about using the '.' as a leading character in >> kill.lst for example: >> >> .bluehornet.com ID-07312002-000 >> .e-dialog.com ID-07312002-001 >> .moveon.org ID-07312002-002 T> This kill list was meant for Declude not Imail. T> I'm not sure if the "." would be a problem or T> not with Imail. However, with Declude's kill T> list it seems to work fine for me and if you T> were to check out our previous messages you T> would find that this subject has come up many T> times on this list. If you go to the following T> site http://www.mail-archive.com you will be able T> to read all about it. T> Below is a link to the reply message you inquired about: T> http://www.mail-archive.com/declude.junkmail%40declude.com/msg03399.html T> Regards, T> Tom T> Image`fx T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.061902 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] Kill File list update for 07/31/02
Reply to: Tom Re: [Declude.JunkMail] Kill File list update for 07/31/02 on Wednesday 4:25:41 PM I asked earlier about using the '.' as a leading character in kill.lst for example: .bluehornet.com ID-07312002-000 .e-dialog.com ID-07312002-001 .moveon.org ID-07312002-002 No one has shown me this works and it caused domains not to be killed here earlier... Is there any documentation on this? Does this actually work for you? If so, what version of Imail are you using? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T> Here is the latest update for the Declude T> Kill file. We made some changes to the T> ID as you may have noticed. This change T> was done for a program we are developing T> to help us keep track of this kill list T> and make a comparison to the Declude log T> file. In any-case the entire list can T> be downloaded from the following URL: T> http://www.imagefxonline.net/apps/delog/fromfile.txt T> As usual I have to stress the following: T> Each item on the list was checked, however, T> we will not guarantee anything. So, with that said->> Use it at your own risk! T> Regards, T> Tom T> Image`fx T> - T> .bluehornet.com ID-07312002-000 T> .e-dialog.com ID-07312002-001 T> .moveon.org ID-07312002-002 T> .VALOFFERS.COM ID-07312002-003 T> .pch.comID-07312002-004 T> .mx0.netID-07312002-005 T> .omahasteaks.comID-07312002-006 T> .investorreview.com ID-07312002-007 T> .emarketers.com ID-07312002-008 T> .colonize.com ID-07312002-009 T> .funsleuthmail.com ID-07312002-010 T> .fye.comID-07312002-011 T> space-offers.comID-07312002-012 T> @BodyEq.com ID-07312002-013 T> @default.comID-07312002-014 T> @gamers.com ID-07312002-015 T> @gocolchester.com ID-07312002-016 T> @heapbuilders.com ID-07312002-017 T> @imarketmedia.com ID-07312002-018 T> @industryemail.com ID-07312002-019 T> @inmaronlinenetwork.com ID-07312002-020 T> @lotsofhelp.com ID-07312002-021 T> @marca.es ID-07312002-022 T> @mycoupons.com ID-07312002-023 T> @netmailservices.comID-07312002-024 T> @prophetfinance.com ID-07312002-025 T> @rt.nl ID-07312002-026 T> @sdilabs1w.com ID-07312002-027 T> @stylustech.com ID-07312002-028 T> @161.58.185.26 ID-07312002-029 T> @surg.co.uk ID-07312002-030 T> .CUSTOMOFFERSMAIL.COM ID-07312002-031 T> .directabout.comID-07312002-032 T> .EDIETS.COM ID-07312002-033 T> .hmdelivery.com ID-07312002-034 T> .keywordgold.comID-07312002-035 T> .quris.net ID-07312002-036 T> .securesite8.comID-07312002-037 T> .shutterfly.com ID-07312002-038 T> .superstorespecials.com ID-07312002-039 T> .tatarstan.ru ID-07312002-040 T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.061902 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] Spam Review kill.lst problem question
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review kill.lst problem question on Wednesday 9:17:17 AM This would explain our problem. I guess if you do not want Declude name in your header, you are outta luck on this issue... We chose to use only the name of our own services only in header inserts. We also do not do reverse lookups for headers any more because this slows mail delivery time. We would rather you use the mailfrom actually, but I do not know how you would integrate this. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T> Please reply to [EMAIL PROTECTED] T> If you are having problems with adding to kill.lst please review the T> following and let me know if this is or is not your problem. T> Per Scott Perry's Instructions, I look for "X-Declude-Sender:" to locate the T> Sender of the email. The only way this will be included in the files I am T> looking at is if you have this option set in Declude: "XSENDER ON" T> If this option is missing or set to OFF in Declude you will have have a T> "X-Declude-Sender:" entry in your email files and the Add to Kill will not T> work. T> My question to you is: How is your XSENDER option set? T> Note From Scott: T> If the "XSENDER ON" option is used. Without that, there is no way of T> knowing for sure what the return address is without looking at the IMail log T> files for the "MAIL FROM:" line. T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.061902 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 10:17:30 AM Yes. I thought it might be adding whitelist entries automatically if emails passed all spam tests. If it is just a log entry.. no pbm, but I don't want to have tons of automatic white list entries. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - >>Scott, I am seeing 'whitelisted automatically' ??? How does his work? R> Do you mean that you are seeing a log file entry "This E-mail was R> whitelisted - automatically passing all spam tests"? R> We added that log file entry because SO many people have complained about R> E-mail not getting caught, only to find out that it had been whitelisted. R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". You can E-mail R> [EMAIL PROTECTED] for assistance. You can visit our web R> site at http://www.declude.com . R> -- R> ActivatorMail(tm) ver.061902 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 9:44:55 AM Scott, I am seeing 'whitelisted automatically' ??? How does his work? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - R> We have just released Declude JunkMail v1.57 (beta). Changes include: R> o HELOBOGUS will now only be tested on non-local senders. R> o HELO detection wasn't using correct hop; fixed. R> o An issue STARTSWITH in filter was fixed. R> o ROUTETO/COPYTO can now use variables (IE "spam@%LOCALHOST%"). R> o Fixes an issue where starting external programs could fail (0xC142 R> error without a .DLL listed). R> o Takes care of possible whitelist corruption when certain Received: R> headers were processed. R> o IS filter type added. R> o ENDSWITH filter type added. R> o HEADERS filter location added. R> o Added REDIRECT option in config files to allow configuration "groups". R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". You can E-mail R> [EMAIL PROTECTED] for assistance. You can visit our web R> site at http://www.declude.com . R> -- R> ActivatorMail(tm) ver.061902 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] Declude and Sniffer
Reply to: Jeff Kratka Re: [Declude.JunkMail] Declude and Sniffer on Friday 3:08:26 PM You will like Sniffer. Not only is it great at spam detection but it is substantially faster than text based rules. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J> Just curious. How many people are using both Declude Junk Mail and the J> sniffer add-on and has it made a difference if yes. I have been completely J> pummeled with Spam and am looking for more options. J> Thanks. J> Jeff J> * J> TymeWyse Internet J> P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 J> tel/fax: (541) 839-6027 - [EMAIL PROTECTED] J> * J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". You can E-mail J> [EMAIL PROTECTED] for assistance. You can visit our web J> site at http://www.declude.com . J> -- J> ActivatorMail(tm) ver.061902 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software
Reply to: Eddie Cornejo Re: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software on Wednesday 6:01:50 PM I have furnished some files to him to fix this and got fixes the same day. It is an indispensable piece of sofware. Don't know what I would do without it. Hope to see fixes on the kill.lst That is the only problem I am experiencing at this time. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - E> Roger, E> I've come to the conclusion that the spamreview software is choking on my E> spool files. E> I installed the software on three different machines with the same results E> (2k server, 2k pro, and win98). E> I am sending the author a sample of my spool files for testing. E> If anyone on this list wants to give it a try, please email me directly. E> mailto:[EMAIL PROTECTED] E> Eddie Cornejo, Sys Admin E> Tom Rowe & Associates E> 956-412-6600 Ext.10 E> Toll Free USA 888-866-7693 E> Toll Free Canada 877-866-7693 E> http://www.tomrowe.com E> -Original Message- E> From: [EMAIL PROTECTED] E> [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath E> Sent: Wednesday, July 24, 2002 5:10 PM E> To: Eddie Cornejo E> Subject: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software E> Reply to: Eddie Cornejo E> Re: [Declude.JunkMail] problem with spamreview software on Wednesday E> 4:05:03 PM E> We have reported this for several months now and it has never E> been fixed because it is working for the author. We know the E> paths are correct as we can load the kill.lst from the menu. It E> keeps putting carriage returns at the end of the file but no E> addresses or domains... NT4SP6A. You are not alone. E> -- E> Roger Heath E> [EMAIL PROTECTED] E> www.rleeheath.com E> - Copy of Original Message(s): - E>> Is anyone having a problem with the latest version (1.0.39) of spamreview E>> not writing to the kill.lst file? E>> Tried local and mapped drives, file permissions etc. without success. E>> I have an older version (1.0.12) that does write to the kill.lst file. E>> I've also emailed the author of the program. E>> Thanks, E>> Eddie Cornejo, Sys Admin E>> Tom Rowe & Associates E>> 956-412-6600 Ext.10 E>> Toll Free USA 888-866-7693 E>> Toll Free Canada 877-866-7693 E>> http://www.tomrowe.com E>> --- E>> [This E-mail was scanned for viruses by Declude Virus E> (http://www.declude.com)] E>> --- E>> This E-mail came from the Declude.JunkMail mailing list. To E>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E>> type "unsubscribe Declude.JunkMail". You can E-mail E>> [EMAIL PROTECTED] for assistance. You can visit our web E>> site at http://www.declude.com . E>> -- E>> ActivatorMail(tm) ver.061902 Scanned for all viruses by E>> www.activatormail.com intelligent anti-virus anti-spam service E> -- E> ActivatorMail(tm) ver.061902 Scanned for all viruses by E> www.activatormail.com intelligent anti-virus anti-spam service E> --- E> [This E-mail was scanned for viruses by Declude Virus E> (http://www.declude.com)] E> --- E> This E-mail came from the Declude.JunkMail mailing list. To E> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E> type "unsubscribe Declude.JunkMail". You can E-mail E> [EMAIL PROTECTED] for assistance. You can visit our web E> site at http://www.declude.com . E> --- E> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] E> --- E> This E-mail came from the Declude.JunkMail mailing list. To E> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E> type "unsubscribe Declude.JunkMail". You can E-mail E> [EMAIL PROTECTED] for assistance. You can visit our web E> site at http://www.declude.com . E> -- E> ActivatorMail(tm) ver.061902 Scanned for all viruses by E> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] problem with spamreview software
Reply to: Eddie Cornejo Re: [Declude.JunkMail] problem with spamreview software on Wednesday 4:05:03 PM We have reported this for several months now and it has never been fixed because it is working for the author. We know the paths are correct as we can load the kill.lst from the menu. It keeps putting carriage returns at the end of the file but no addresses or domains... NT4SP6A. You are not alone. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - E> Is anyone having a problem with the latest version (1.0.39) of spamreview E> not writing to the kill.lst file? E> Tried local and mapped drives, file permissions etc. without success. E> I have an older version (1.0.12) that does write to the kill.lst file. E> I've also emailed the author of the program. E> Thanks, E> Eddie Cornejo, Sys Admin E> Tom Rowe & Associates E> 956-412-6600 Ext.10 E> Toll Free USA 888-866-7693 E> Toll Free Canada 877-866-7693 E> http://www.tomrowe.com E> --- E> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] E> --- E> This E-mail came from the Declude.JunkMail mailing list. To E> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E> type "unsubscribe Declude.JunkMail". You can E-mail E> [EMAIL PROTECTED] for assistance. You can visit our web E> site at http://www.declude.com . E> -- E> ActivatorMail(tm) ver.061902 Scanned for all viruses by E> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] BLARSBL:Declude Keyword Filters
Are key word filters case sensitive? We see some filters not working on subject fields, for example, unless they match exactly the case of the filter... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] Whitelist stopped working, REVDNS lookup fails
Reply to: Andy Schmidt Re: [Declude.JunkMail] Whitelist stopped working, REVDNS lookup fails on Sunday 10:22:57 AM Scott, could you list the limits of the whitelist again? It is limited to 100 entries? Is this a total of ANYWHERE and FROM, etc.? And I have another question. Are there limits to the new filtering or blacklists. I am transforming my filters from Imail to Declude and finding Declude substantially faster, but I am concerned about limitations... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - A> Hi Scott: >>> Am I right you have the HOP value set to 0? Do you have the HOPHIGH A> value set? << A> Here the first few lines of my Global.CFG (Hop=0, Hophigh=undefined): A> LOGFILE D:\imail\spool\dec.log A> LOGLEVELMID A> LOG_OK NONE A> HOP 0 A> CONSOLE OFF A> XINHEADER X-Declude: Version %VERSION%; %QUEUENAME% from %REVDNS% A> [%REMOTEIP%] A> XINHEADER Return-Path: <%MAILFROM%> A> XOUTHEADER X-Note: Report any abuse to [EMAIL PROTECTED] A> IPBYPASS63.107.174.32 A> IPBYPASS65.86.89.162 A> XSENDER OFF A> XSPOOLNAME OFF A> SWITCHRECIP ON A> # A> # White Lists A> # A> WHITELIST IP 63.107.174. A> WHITELIST IP 65.86.89.162 >>> It seems that for some reason 1.55i may not be able to pick up the A> correct IP from the headers, or it may be getting corrupted. << A> Well - it seems to get corrupted - because, remember, my XINHEADER always A> REPORTS the correct IP Address. But, when it tries to do the reverse A> lookup - it "lost" that knowledge. Because the Declude log file entry for A> REVDNS just displays a "space" where the IP address should be. A> I can definitely narrow this down for you, with respect to which application A> AND which version broke it: A> The RevDNS problem seems to be consistently happening with emails created by A> the AOL7 mailer. Something in their headers tripps up the latest 1.55i A> versions. It apparently was fine with 1.55 (since I never heard of A> complaints with the original beta. I have a few people who regularily email A> me from AOL several times at night). Emailing worked fine until the Friday A> night after I installed the latest 1.55i from Friday lunch time. Then they A> started getting my REVDNS alerts for each message they sent. A> However the problem is not EXLUSIVE to AOL. The log shows a high number of A> other senders with bogus REVDNS errors - where the IP is blank. But, there A> are also a large number of emails which correctly identify the IP address in A> the log (at least apparently so). A> Best Regards A> Andy Schmidt A> H&M Systems Software, Inc. A> 600 East Crescent Avenue A> Suite 203 A> Upper Saddle River, NJ 07458-1846 A> Phone: +1 201 934-3414 x20 (Business) A> Fax:+1 201 934-9206 A> http://www.hm-software.com/ A> --- A> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] A> --- A> This E-mail came from the Declude.JunkMail mailing list. To A> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and A> type "unsubscribe Declude.JunkMail". You can E-mail A> [EMAIL PROTECTED] for assistance. You can visit our web A> site at http://www.declude.com . A> -- A> ActivatorMail(tm) ver.061902 Scanned for all viruses by A> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] About Addresses
I tried it and it does not work here. For example where I had @bounce.azoogle.com I used in the kill.lst .azoogle.com and it did not work. What was blocked before was not blocked afterwards. Are you referring to the kill.lst or the Declude blacklist feature? I was looking for use in the kill.lst but it looks like this is for the blacklist feature... -- Roger Heath - Copy of Original Message(s): - >> Is there documentation on kill.lst and use of the proceeding '.' >> dot? I could not find this... The Infobase says use @ in each >> example... Is this for use in Declude blacklist or kill.lst? T> I don't know if there is any documentation on it other than what T> I got from this list. To the best of my knowledge you are allowed T> to use any part of an address. T> For example: T> [EMAIL PROTECTED] T> you can use .someplace.com or someplace.com T> However, you must very careful using a short name, because T> you can catch another domain by accident. That is if you T> had the address place.com, you would also catch someplace.com T> That is why it suggested that you use the @ or . character. T> Keep in mind, with a longer name, you can get away without T> using these characters. However, you might want to consider T> the following information from Netsol. T> Quoted from the NETSOL.COM web site T> --- T> Letters and numbers are always valid characters. T> Hyphens may also be used in but may not begin nor end your domain name. T> Spaces and special characters are never permitted. The special characters T> include, but are not limited to, these special characters: T> ! @ # $ % ^ & * ( ) ? " T> You can use up to 67 characters in your domain name, including the T> extension .COM, .NET, or .ORG. You've got lots of options for T> establishing your Internet identity! T> "www." and http://www. are not considered part of your domain name and T> therefore don't count towards the 67 character total. T> An example of a valid domain name is: T> 67-character-web-addresses-are-available-from-networksolutions.com T> --- T> end of quote T> Regards, T> Tom T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.061902 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] More Spam Addresses
Reply to: Tom Re: [Declude.JunkMail] More Spam Addresses on Saturday 9:09:17 PM Is there documentation on kill.lst and use of the proceeding '.' dot? I could not find this... The Infobase says use @ in each example... Is this for use in Declude blacklist or kill.lst? -- Roger Heath - Copy of Original Message(s): - T> Here are a few more spam addresses that were checked. T> "like always, use them at your own risk." -TJ T> .adult-mailer.com T> .almus.com T> .asseenontw.com T> .clubshop.com T> .emailfactory.com T> .emazing.com T> .infogeneratorpro.com T> .intimail.com T> .masterbatesknows.com T> .optinmailing.com T> .sandbox.com T> .temd.net T> .tradersunite.com T> .wippit.com T> @Yokoz.com T> @befree.com T> @c-h-o.com T> @cadvision.com T> @df.lth.se T> @discounts.com.ar T> @doe.com T> @doge.it T> @free-inter.net T> @gz-5.com T> @hanson.com T> @informaticien.org T> @intenseschool.com T> @jyrki.com T> @kali.com.cn T> @motorcycle.com T> @msgserv.com T> @optinstar.com T> @pediatrician.com T> @rapidimpactonline.net T> @salliemaemail.com T> @sgleb.com.lb T> @spermfun.com T> @spray.no T> @surfacemail.com T> @thenetdeals.com T> @total.net T> @two-river.com T> @uptilt.com T> @w2knews.com T> @xidserv.com T> @xynergy.org T> @yeah.net T> @zbzoom.net T> armstrongonewire.com T> businessopp2002.com T> theadmanager.com T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.061902 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] BLARSBL:Time Msg Processed : ms ?? (like DEBUG log)
I have seen others ask about this here and I am curious if any such feature was done..??? where %TIMEINOUT% or some variable that is the milliseconds of Declude processing time, normally seen in the DEBUG logging mode. This would be a nice quality control feature for JunkMail if it can be done... so it can be placed in headers even temporarily to view how well mail is being processed. -- Roger Heath -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[5]: [Declude.JunkMail] BLARSBL:DBSL
Reply to: Bill Landry Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 11:18:07 AM Thanks, I will try these. Actually Scott has : #DSBLALLip4runconfirmed.dsbl.org* 4 0 Maybe this was the source of the pbm? -- Roger Heath - Copy of Original Message(s): - B> I'm not sure if you mean BLARSBL or DSBL, but I have been using both, and B> DSBL-MULTI as well, for several months without issue. In fact, they have B> worked quite well for me, so I've given each of them a weight of 6, with my B> hold weight being 10. B> BLARSBL ip4rblock.blars.org * 6 0 B> DSBLip4rlist.dsbl.org * 6 0 B> DSBL-MULTI ip4rmultihop.dsbl.org * 6 B> 0 B> Bill B> -----Original Message- B> From: Roger Heath [mailto:[EMAIL PROTECTED]] B> Sent: Thursday, June 13, 2002 9:03 AM B> To: R. Scott Perry B> Subject: Re[3]: [Declude.JunkMail] BLARSBL:DBSL B> Reply to: R. Scott Perry B> Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 10:18:20 AM B> Thanks. I had to drop this almost as soon as I started it. It B> seemed to work but then I began getting almost all mail trapped B> with a weight 10 appearing from nowhere. Even the tests list did B> not list a weight 10 rule violation. I commented out the DBSL and B> now am back to normal. B> -- B> Roger Heath B> - Copy of Original Message(s): - >>>No, but I will try it. It seems to be working good. Scott had >>>this under subscription based services in his sample global file, >>>so I was a bit confused. R>> FYI, that section is for services that require a subscription *or* are B> not R>> commonly used. The only ones that require a subscription are the MAPS R>> tests (RBL, RSS, DUL) and the SNIFFER and POSTFIXGATE tests. >>>Are there others? Does any one here have >>>a complete list of the free ones available? R>> You can go to http://www.declude.com/junkmail/support/ip4r.htm for a list R>> of all the known DNS-based spam tests. Except for the ones listed above, R>> they are all free. R>> -Scott R>> --- R>> [This E-mail was scanned for viruses by Declude Virus B> (http://www.declude.com)] R>> --- R>> This E-mail came from the Declude.JunkMail mailing list. To R>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R>> type "unsubscribe Declude.JunkMail". You can E-mail R>> [EMAIL PROTECTED] for assistance. You can visit our web R>> site at http://www.declude.com . R>> -- R>> ActivatorMail(tm) ver.061102 Scanned for all viruses by R>> www.activatormail.com intelligent anti-virus anti-spam service B> -- B> ActivatorMail(tm) ver.061102 Scanned for all viruses by B> www.activatormail.com intelligent anti-virus anti-spam service B> --- B> [This E-mail was scanned for viruses by Declude Virus B> (http://www.declude.com)] B> --- B> This E-mail came from the Declude.JunkMail mailing list. To B> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and B> type "unsubscribe Declude.JunkMail". You can E-mail B> [EMAIL PROTECTED] for assistance. You can visit our web B> site at http://www.declude.com . B> --- B> [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] B> --- B> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] B> --- B> This E-mail came from the Declude.JunkMail mailing list. To B> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and B> type "unsubscribe Declude.JunkMail". You can E-mail B> [EMAIL PROTECTED] for assistance. You can visit our web B> site at http://www.declude.com . B> -- B> ActivatorMail(tm) ver.061102 Scanned for all viruses by B> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[3]: [Declude.JunkMail] BLARSBL:DBSL
Reply to: R. Scott Perry Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 10:18:20 AM Thanks. I had to drop this almost as soon as I started it. It seemed to work but then I began getting almost all mail trapped with a weight 10 appearing from nowhere. Even the tests list did not list a weight 10 rule violation. I commented out the DBSL and now am back to normal. -- Roger Heath - Copy of Original Message(s): - >>No, but I will try it. It seems to be working good. Scott had >>this under subscription based services in his sample global file, >>so I was a bit confused. R> FYI, that section is for services that require a subscription *or* are not R> commonly used. The only ones that require a subscription are the MAPS R> tests (RBL, RSS, DUL) and the SNIFFER and POSTFIXGATE tests. >>Are there others? Does any one here have >>a complete list of the free ones available? R> You can go to http://www.declude.com/junkmail/support/ip4r.htm for a list R> of all the known DNS-based spam tests. Except for the ones listed above, R> they are all free. R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". You can E-mail R> [EMAIL PROTECTED] for assistance. You can visit our web R> site at http://www.declude.com . R> -- R> ActivatorMail(tm) ver.061102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] BLARSBL:DBSL
Reply to: Intelliware Administrator Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 9:38:20 AM No, but I will try it. It seems to be working good. Scott had this under subscription based services in his sample global file, so I was a bit confused. Are there others? Does any one here have a complete list of the free ones available? -- Roger Heath - Copy of Original Message(s): - I> Did you also uncomment DSBLALL ? I> Kevin M. Donovan, MCSE I> Network Support Specialist I> IntelliWare Systems, Inc. I> Phone (817) 277-0800 x228 I> - Original Message ----- I> From: "Roger Heath" <[EMAIL PROTECTED]> I> To: "Roger Heath" <[EMAIL PROTECTED]> I> Sent: Thursday, June 13, 2002 9:04 AM I> Subject: Re: [Declude.JunkMail] BLARSBL:DBSL >> Reply to: Roger Heath >> Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 8:49:08 AM >> >> Should be DSBL... and it appears to be working here after turning >> it on.. >> >> -- >> Roger Heath >> >> - Copy of Original Message(s): - >> >> R> I> http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/art I> icles/op/xml/02/05/20/020520opestrat.xml&dctag=security >> >> R> Is DBSL a free blacklist? It seems so in the above article... >> >> R> If so, do I just uncomment the line in the Global.Cfg to make it >> R> active? >> >> R> -- >> R> Roger Heath >> >> R> -- >> R> ActivatorMail(tm) ver.061102 Scanned for all viruses by >> R> www.activatormail.com intelligent anti-virus anti-spam service >> >> R> --- >> R> [This E-mail was scanned for viruses by Declude Virus I> (http://www.declude.com)] >> >> R> --- >> >> R> This E-mail came from the Declude.JunkMail mailing list. To >> R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> R> type "unsubscribe Declude.JunkMail". You can E-mail >> R> [EMAIL PROTECTED] for assistance. You can visit our web >> R> site at http://www.declude.com . >> R> -- >> R> ActivatorMail(tm) ver.061102 Scanned for all viruses by >> R> www.activatormail.com intelligent anti-virus anti-spam service >> >> -- >> ActivatorMail(tm) ver.061102 Scanned for all viruses by >> www.activatormail.com intelligent anti-virus anti-spam service >> >> --- >> [This E-mail was scanned for viruses by Declude Virus I> (http://www.declude.com)] >> >> --- >> >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". You can E-mail >> [EMAIL PROTECTED] for assistance. You can visit our web >> site at http://www.declude.com . >> I> --- I> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] I> --- I> This E-mail came from the Declude.JunkMail mailing list. To I> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and I> type "unsubscribe Declude.JunkMail". You can E-mail I> [EMAIL PROTECTED] for assistance. You can visit our web I> site at http://www.declude.com . I> -- I> ActivatorMail(tm) ver.061102 Scanned for all viruses by I> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] BLARSBL:DBSL
Reply to: Roger Heath Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 8:49:08 AM Should be DSBL... and it appears to be working here after turning it on.. -- Roger Heath - Copy of Original Message(s): - R> http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/articles/op/xml/02/05/20/020520opestrat.xml&dctag=security R> Is DBSL a free blacklist? It seems so in the above article... R> If so, do I just uncomment the line in the Global.Cfg to make it R> active? R> -- R> Roger Heath R> -- R> ActivatorMail(tm) ver.061102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". You can E-mail R> [EMAIL PROTECTED] for assistance. You can visit our web R> site at http://www.declude.com . R> -- R> ActivatorMail(tm) ver.061102 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] BLARSBL:DBSL
http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/articles/op/xml/02/05/20/020520opestrat.xml&dctag=security Is DBSL a free blacklist? It seems so in the above article... If so, do I just uncomment the line in the Global.Cfg to make it active? -- Roger Heath -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting -- Does BlackIce help?
Reply to: Jim Jones, Jr. Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting -- Does BlackIce help? on Tuesday 7:46:02 AM Our servers are very stable with this firewall. It does not autoblock these but you can manually block them. I noticed that they do not show up in the log any more, so it appears to work fine. I know you can set to autoblock select events by editing the blackice.ini can be edited for example: http.urllimit.count=60 http.urllimit.interval=50 will temporarily block too many URL requests, like web site copying... I do not know the settings for too many SMTP requests, but it must exist if you research or call support. Let me know if you find this out. I can't imagine running Imail without this firewall as I have EZSignup and IIS on the same setup and it autoblocks Code Red and numerous illegal requests in IIS automatically.. -- Roger Heath - Copy of Original Message(s): - J> we put that on after having over 100,000 connections to our server in one J> day for harvesting purposes. We noticed that it was seeing these attacks, J> but couldn't tell if it was blocking them or not. I wonder if there is a J> way to configure blackice to automatically block someone that is doing this J> for one day? J> also, how has your server been, stability wise, after installing blackice? J> ours seems to have held up pretty well. J> thanks, J> jim J> - Original Message - J> From: "Roger Heath" <[EMAIL PROTECTED]> J> To: "Jesus Alvarez" <[EMAIL PROTECTED]> J> Sent: Monday, April 29, 2002 5:16 PM J> Subject: BLARSBL:Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail J> Harvesting >> Reply to: Jesus Alvarez >> Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail J> Harvesting on Monday 4:26:37 PM >> >> The Server version of NetworkIce Black Ice detects these as >> 'SMTP- too many errors'. When we see this, we set that IP to be >> blocked for a day or a week if they are persistent. It >> essentially shuts off their attack for a set time period... You >> can purchase this Server Firewall at www.networkice.com >> >> -- >> Roger Heath >> >> >> >> - Copy of Original Message(s): - >> >> J> Can Declude Hijack help with dictionary attacks and >> J> other attacks that attempt at mail harvesting ? >> >> J> We had a case recently where someone tried over 5 >> J> email addresses on a domain before we were able to stop >> J> him. Since we have an Imgate front end, the bounce messages >> J> increased our queues and delivery times quite a bit. His >> J> ISP was notified and their account cancelled but that does >> J> not prevent this from happening again. We currently run >> J> Declude Hijack but it normally catches attempts at >> J> massive outgoing deliveries, not cases like this. >> >> J> Else, how do other Imail & Declude users protect themselves >> J> in these cases ? >> >> J> Thanks. >> >> J> --- >> J> [This E-mail was scanned for viruses by Declude Virus J> (http://www.declude.com)] >> >> J> --- >> >> J> This E-mail came from the Declude.JunkMail mailing list. To >> J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> J> type "unsubscribe Declude.JunkMail". You can E-mail >> J> [EMAIL PROTECTED] for assistance. You can visit our web >> J> site at http://www.declude.com . >> J> -- >> J> ActivatorMail(tm) ver.041902 Scanned for all viruses by >> J> www.activatormail.com intelligent anti-virus anti-spam service >> >> -- >> ActivatorMail(tm) ver.041902 Scanned for all viruses by >> www.activatormail.com intelligent anti-virus anti-spam service >> >> --- >> [This E-mail was scanned for viruses by Declude Virus J> (http://www.declude.com)] >> >> --- >> >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". You can E-mail >> [EMAIL PROTECTED] for assistance. You can visit our web >> site at http://www.declude.com . >> J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". You can E-mail J> [EMAIL PROTECTED] for assistance. You can visit our web J> site at http:/
BLARSBL:Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting
Reply to: Jesus Alvarez Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting on Monday 4:26:37 PM The Server version of NetworkIce Black Ice detects these as 'SMTP- too many errors'. When we see this, we set that IP to be blocked for a day or a week if they are persistent. It essentially shuts off their attack for a set time period... You can purchase this Server Firewall at www.networkice.com -- Roger Heath - Copy of Original Message(s): - J> Can Declude Hijack help with dictionary attacks and J> other attacks that attempt at mail harvesting ? J> We had a case recently where someone tried over 5 J> email addresses on a domain before we were able to stop J> him. Since we have an Imgate front end, the bounce messages J> increased our queues and delivery times quite a bit. His J> ISP was notified and their account cancelled but that does J> not prevent this from happening again. We currently run J> Declude Hijack but it normally catches attempts at J> massive outgoing deliveries, not cases like this. J> Else, how do other Imail & Declude users protect themselves J> in these cases ? J> Thanks. J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". You can E-mail J> [EMAIL PROTECTED] for assistance. You can visit our web J> site at http://www.declude.com . J> -- J> ActivatorMail(tm) ver.041902 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] 1.49 list problem
Reply to: Jack Taugher Re: [Declude.JunkMail] 1.49 list problem on Friday 1:50:18 PM Using Declude 1.5 and still see this problem. I have a local list of 1800 I send out and it is now over four hours later and it is still delivering this in about 8 LST files. I have exhausted trying to find out why 1800 and all local accounts would take this amount of time or longer. Am I missing a setting somewhere? I have never seen it take so long to deliver local emails. Otherwise regular emails are passing very fast. -- Roger Heath - Copy of Original Message(s): - J> I wonder if that was our problem yesterday. J> We had a few messages sent to our a list of 800 and a list of 1200. I J> didn't recall seeing any .LST files, however it took more than 2 hours to J> send out the message -- whereas in the past those two lists seemed to send J> everything within 5 minutes. J> - Original Message - J> From: "R. Scott Perry" <[EMAIL PROTECTED]> J> To: <[EMAIL PROTECTED]> J> Sent: Friday, April 26, 2002 10:17 AM J> Subject: Re: [Declude.JunkMail] 1.49 list problem >> >> >Does this mean that if I send something to a list it will not go out J> right >> >now? >> >> That depends on your queue timer settings. However, if you need to send >> something out immediately, you can go to the IMail Administrator, go to >> View Queue, find the .LST file(s) and click the "Send One" button to send >> them out immediately. >> -Scott >> >> --- >> [This E-mail was scanned for viruses by Declude Virus J> (http://www.declude.com)] >> >> --- >> >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". You can E-mail >> [EMAIL PROTECTED] for assistance. You can visit our web >> site at http://www.declude.com . >> J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". You can E-mail J> [EMAIL PROTECTED] for assistance. You can visit our web J> site at http://www.declude.com . J> -- J> ActivatorMail(tm) ver.041902 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] 1.49 list problem
Reply to: John Shacklett Re: [Declude.JunkMail] 1.49 list problem on Friday 8:38:25 AM We have been witnessing this for a while... as well. It seems like list mail just sits there forever unless is is manually pushed.. This seems to be the only way it gets delivered. -- Roger Heath - Copy of Original Message(s): - J> Since downloading the 1.49 beta on Wednesday [was it Wednesday? seems like J> it was; everything is a blur lately], my mailserver seems to have developed J> a problem with List delivery. The List submissions are accepted, scanned, J> and dumped into the spool directory as nice tidy .LST files, and then they J> just sit there. Very well done indeed. Seems like we had a problem similar J> to this a couple of dozen versions ago? Anyway, I've been pushing these J> critters out manually, but I'll let the next one sit and see if it J> eventually goes out on its own. Maybe on the next queue run? J> -- J> John Shacklett J> www.continentaloffice.com J> [EMAIL PROTECTED] J> [EMAIL PROTECTED] J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". You can E-mail J> [EMAIL PROTECTED] for assistance. You can visit our web J> site at http://www.declude.com . J> -- J> ActivatorMail(tm) ver.041902 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARS:Re[4]: [Declude.JunkMail] Spam Review and Kill File
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:56:42 PM This is a followup on this thread because I'd sure like to see two things added added to Spam Review. First, I'd like to be able to set a switch to delete Deleted Spam and Virus messages upon exiting the program. It is really burdensome to have to use those menus over and over and it would really speed things up to have these deleted automatically at exit. Second, and perhaps more important, I'd love to see Spam Review made into a full Spool manager. The fact is that Ipswitch has very limited capabilities in its administrator program. One cannot view and manipulate spool files, whereas Spam Review has most of this already in place and it even works over my subnet. So why not apply these capabilities to the Spool, then one can get rid of Spool files that are corrupt, or simply are not deliverable.. This would be an invaluable tool for me here. As far as I know, no such Spool utility exists now. -- Roger Heath -- ActivatorMail(tm) ver.030302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Fwd: Re: [Declude.JunkMail] Question
This is a forwarded message From: R. Scott Perry <[EMAIL PROTECTED]> To: Roger Heath <[EMAIL PROTECTED]> Thought others here might find this interesting as I did. -- Roger Heath =Original message text=== >My mail server and Declude is really being tested today. >I think I got a concerted attack by several people at once >to try and crash the server. I have a free email signup >system (EZSignUp) and they signup then start sending libraries >of email addresses through the server. Since these are from >spammers and they violate SpamCop and other blacklists Declude >was capturing thousands of emails. What is puzzling to me is >that the spammers were sending to their own email address. Actually, they aren't amateurs. They very much want those E-mail that they are getting. These are the guys that go hunting for open relays. They find lots of mail servers and try sending an E-mail through to a free mail account that they have; if it goes through, they know they found an open relay. >I figure they must not know what is happening. True -- they probably don't know that their mail is getting caught. >It looks like they are amateurs. These are actually the experts (or at least the most dedicated spammers). >In SMTP I use 'Relay for Local Users Only'. Note that this will allow spammers to send mail through your server to other servers, if they use a valid return address on one of your domains. Most spammers won't go to that trouble, but they could. >Here is an actual emails from the Spam directory: > >Received: from resystems.com [208.1.108.105] by activatormail.com with ESMTP > (SMTPD32-5.05) id AF4421E00DE; Mon, 04 Feb 2002 17:54:44 -0600 This is the open relay that they found. >Received: from mx3.yahoo.com (host22.tracersinfo.com [216.242.132.22] (may >be forged)) > by resystems.com (8.9.3/8.9.3) with SMTP id CAA32528 > for <[EMAIL PROTECTED]>; Tue, 5 Feb 2002 02:25:56 -0500 And the open relay got it from 216.242.132.22, which is on the tracersinfo.com domain. Most likely, the spammer hacked into the server, and isn't connect to it. That's the server they are running their open relay tester software on. >From: [EMAIL PROTECTED] >Message-ID: <[EMAIL PROTECTED]> Forged headers. >To: <[EMAIL PROTECTED]> This is the free account on your server. >Subject: testmail In most cases, they use a subject with a seemingly innocent header, in case the E-mail gets caught on the open relay and an admin finds it (subjects such as "I'll see you Tuesday" are common). >0500490540460500520500460490510500460500500581041511605005004611611409709910111411510511010211104609909058055048049058053048058089101115 Here's the proof that it's a spammer. This is their encoded data. If you decode it, you'll see something that includes the IP address of the open relay. To decode it, if you feel like it, take the numbers into groups of three digits (050, 049, 054...), start Notepad, and hold down the ALT key and type the three-digit number, and let go of the ALT key. You'll see "216...", which is the real data the spammer sent. >Received: from riceville.k12.ia.us [207.28.21.3] by activatormail.com with >ESMTP > (SMTPD32-5.05) id AF4110B0084; Mon, 04 Feb 2002 17:54:41 -0600 Here, the nice spammer found an educational mail server he could abuse. -Scott ==End of original message text=== -- ActivatorMail(tm) ver.013102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Update v1.0.7
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Update v1.0.7 on Saturday 10:18:30 AM Seems to me the best way to handle same sender messages is to detect within the program matching senders than ask with a popup 'Delete all instances of this sender?' Yes No. or even have a switch in settings to do this automatically. Then you won't even have to highlight messages to get the same effect faster. Another way to speed review might be for the program to keep a list of previously deleted email addresses then have a switch in settings like 'Delete at boot matched deletes?' Yes No... Then, as the program loads, it would automatically delete previously deleted sender messages. One could purge this list to start over again using this method. You would only be dealing with 'new senders' at that point. I don't know how much time Tom has. I do appreciate very much the program that exists. -- Roger Heath - Copy of Original Message(s): - T> Power is back and life is getting back to normal so I thought I would post T> an update. The last update I posted the first person that downloaded it T> found a major problem. I hope that is not the case this time. -- ActivatorMail(tm) ver.013102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Am I blacklisting correctly?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Am I blacklisting correctly? on Thursday 2:52:03 PM This would explain my %testsfailed% experiences. I even tried putting the WARNs 'above' the HOLDs but this made no difference, just so ya know. -- Roger Heath - Copy of Original Message(s): - R> Yes. We are currently investigating a problem reported with v1.35a that R> may cause the WARN action not to be used when the HOLD action is used. If R> you are running 1.35a, that could be why this is happening. R> -Scott -- ActivatorMail(tm) ver.013102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] header confusion
Reply to: John Shacklett Re: [Declude.JunkMail] header confusion on Thursday 7:20:44 AM I tried several times yesterday to get %testsfailed% working but it seemed to shut off weighing all together. When we dropped this variable everything returned to normal. We never saw tests listed here but had a blank line as well. We are not using this variable now. I was waiting for someone else to say something here. If you remove the %testsfailed% perhaps you will see the blank lines disappear too? -- Roger Heath - Copy of Original Message(s): - J> Good morning, all. J> I have a sequence of XINHEADER lines defined in my global.cfg, many based on J> suggestions from Roger Heath and others. They look something like: J> XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. J> XINHEADER X-Note: QueInControl: %QUEUENAME% (%NRECIPS%) J> XINHEADER X-Note: Tests failed: %testsfailed% J> XINHEADER X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%] J> XINHEADER X-Note: SMTP Real From: %MAILFROM% J> XINHEADER X-Note: SMTP Real To: %ALLRECIPS% J> In addition, I have several tests defined that use the WARN action and they J> have $default$.junkmail lines such as: J> SPAMCOP header X-RBL-Warning: SPAMCOP J> ADULT header X-RBL-Warning: Possible ADULT Content J> What I'm seeing in actual message Dxxx.SMD files is a blank line between J> the X-Notes and the X-RBL-Warnings, so that the X-RBL-Warnings are showing J> up as visible in the delivered messages. Is this a glitch, or have I done J> something incorrect in my setups? J> -- J> John Shacklett J> www.continentaloffice.com J> [EMAIL PROTECTED] J> [EMAIL PROTECTED] J> --- J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J> --- J> This E-mail came from the Declude.JunkMail mailing list. To J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J> type "unsubscribe Declude.JunkMail". You can E-mail J> [EMAIL PROTECTED] for assistance. You can visit our web J> site at http://www.declude.com . J> -- J> ActivatorMail(tm) ver.013002 Scanned for all viruses by J> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.013002 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[4]: [Declude.JunkMail] Spam Review and Kill File
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:56:42 PM I always thought you must recycle the SMTP for any change in Imail, rules.ima, kill.lst, etc. I think this may be because some of these settings are held in memory for speed. http://support.ipswitch.com/kb/IM-19990624-DM02.htm shows the requirement for kill.lst -- Roger Heath - Copy of Original Message(s): - T> I don't find in the IMail documentation that you have to recycle the SMTP T> service. Can you confirm this please? -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review and Kill File
Reply to: Chuck Schick Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:30:12 PM Suppose you could have a setting that would allow you to use a Declude blacklist rather than the kill.lst, seeing how this might be more effective and this is dynamic, not requiring a SMTP service recycle to be effective... Here is how it would work. 1. click on 'Blacklist' Button 2. Up pops a dialog with the MAILFROM string 3. Edit the string to be used then click OK In the settings you have a path and name to the Blacklist file to be used. This could default to c:\Imail\kill.lst but could be edited to say, c:\Imail\Declude\Blacklist.txt Looking at how Scott commented today on the more effective blacklist functions by Declude it might work better where kill.lst may save processor use. The only other thing about the Declude Blackilist is that it may require a 'description'? I do not know if this is required. Like in manual: [EMAIL PROTECTED] This guy was mailbombing us -- Roger Heath advanced internet desktop: www.activatordesk.com antivirus antispam email : www.activatormail.com master internet index: www.infogrid.com - Copy of Original Message(s): - C> Tom: C> I think a button option would be fine. Here is my reasoning - many of the C> from addresses are bogus anyway so I do not bother with putting many of them C> on the kill.lst very often. I have put from addresses on the kill list only C> to see the spammer change his from address within the hour. I go through C> 1000 messages on some days in the spam folder and if I had to hit another C> confirmation button it would just slow me down. C> Thanks for all the hard work. C> Chuck Schick C> Warp 8, Inc. C> www.warp8.com C> 303-421-5140 C> - Original Message - C> From: "Tom Schwarz" <[EMAIL PROTECTED]> C> To: <[EMAIL PROTECTED]> C> Sent: Wednesday, January 30, 2002 5:15 PM C> Subject: [Declude.JunkMail] Spam Review and Kill File C> : Let's talk about the IMail "kill.lst" file for just a minute. C> : C> : Some of you suggested that you wanted to add "from" email addresses to the C> : "kill.lst" file from SpamReview. I like this idea and am working on it. C> : C> : My question is... C> : C> : How do you want it to work? C> : C> : Do you want a button to do it? C> : C> : Do you want an option in Settings for adding it whenever you click on C> "Move C> : To Deleted"? C> : C> : Other? C> : C> : Tom C> : C> : --- C> : [This E-mail was scanned for viruses by Declude Virus C> (http://www.declude.com)] C> : C> : --- C> : C> : This E-mail came from the Declude.JunkMail mailing list. To C> : unsubscribe, just send an E-mail to [EMAIL PROTECTED], and C> : type "unsubscribe Declude.JunkMail". You can E-mail C> : [EMAIL PROTECTED] for assistance. You can visit our web C> : site at http://www.declude.com . C> : C> --- C> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] C> --- C> This E-mail came from the Declude.JunkMail mailing list. To C> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and C> type "unsubscribe Declude.JunkMail". You can E-mail C> [EMAIL PROTECTED] for assistance. You can visit our web C> site at http://www.declude.com . C> -- C> ActivatorMail(tm) ver.012602 Scanned for all viruses by C> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review and Kill File
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:15:27 PM A button would be great. The problem as I see it is making sure it was the real SMTP %MailFrom% variable. I use: XINHEADER X-Note: SMTP Real-From: %MAILFROM% But maybe the best way for you to do this is take into consideration the 'D' file that is being viewed than take the value rom the 'Q' file of the same name, e.g. line with : S<[EMAIL PROTECTED]> Sometimes you could, I suppose, make it for the whole address or a whole domain.. or simply popup a dialog so the string could be edited before saving to kill.lst. -- Roger Heath - Copy of Original Message(s): - T> Let's talk about the IMail "kill.lst" file for just a minute. T> Some of you suggested that you wanted to add "from" email addresses to the T> "kill.lst" file from SpamReview. I like this idea and am working on it. T> My question is... T> How do you want it to work? T> Do you want a button to do it? T> Do you want an option in Settings for adding it whenever you click on "Move T> To Deleted"? T> Other? T> Tom T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012602 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[5]: [Declude.JunkMail] Declude v1.35 released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 12:35:49 PM Thanks, I keep forgetting this. -- Roger Heath - Copy of Original Message(s): - R> If this is in the $default$.JunkMail file, are you seeing any warning R> headers, and if so, what shows up in them? R> -Scott -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[4]: [Declude.JunkMail] Declude v1.35 released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 12:25:37 PM Hmmm. I updated my Global.Cfg and I think there is a bug. I still don't have weight notices in my headers. I have: WEIGHT10HOLD WEIGHT20HOLD WEIGHT25HOLD WEIGHT30HOLD WEIGHT10WARNX-RBL-Warning: %TESTSFAILED%. WEIGHT20WARNX-RBL-Warning: %TESTSFAILED%. WEIGHT25WARNX-RBL-Warning: %TESTSFAILED%. WEIGHT30WARNX-RBL-Warning: %TESTSFAILED%. I know I have 1.35a verified via -diag. -- Roger Heath - Copy of Original Message(s): - >>I am running Declude JunkMail 1.35.. Installed it yesterday... need to get >>the 1.35a :) R> You can type "Declude -diag" from a command prompt; the first line will R> display the version number, to make sure that you actually have 1.35. >>and here is what i have typed >> >>WEIGHT10WARNX-RBL-Warning: This E-mail failed the following >>tests: %TESTSFAILED%. R> That does look correct; my guess is that you actually have 1.34. R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". You can E-mail R> [EMAIL PROTECTED] for assistance. You can visit our web R> site at http://www.declude.com . R> -- R> ActivatorMail(tm) ver.012602 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Declude v1.35 released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 10:41:02 AM WEIGHT10HOLDX-RBL-Warning: %TESTSFAILED%. We've never seen the WEIGHT10 appear in the header, only WEIGHT20, etc. I just realized these are all HOLD, so I guess I need duplicate tests with WARN? It looks like my error in retrospect... -- Roger Heath - Copy of Original Message(s): - >>I have already observed that this does not appear when >>used in XINHEADER. I keep getting weights but no testsfailed.. >>It is blank every time. R> I've just tested it here, and it is working. R> Could you show me the exact line from your \IMail\Declude\global.cfg file? R> -Scott R> --- R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R> --- R> This E-mail came from the Declude.JunkMail mailing list. To R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R> type "unsubscribe Declude.JunkMail". You can E-mail R> [EMAIL PROTECTED] for assistance. You can visit our web R> site at http://www.declude.com . R> -- R> ActivatorMail(tm) ver.012602 Scanned for all viruses by R> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Question
Reply to: Bennie Re: [Declude.JunkMail] Spam Review Question on Wednesday 10:03:36 AM Global.Cfg I add: XINHEADER X-Note: RDNS Real-Origin: %REVDNS% [%REMOTEIP%] XINHEADER X-Note: SMTP Real-From: %MAILFROM% XINHEADER X-Note: SMTP Real-To: (%NRECIPS%) %ALLRECIPS% -- Roger Heath - Copy of Original Message(s): - B> Roger. B> Where do you ad this line? B> Bennie >> >> This line gives me the 'real' sender and I'd love to kill.lst >> some of these if they are clearly doing only spamming...: >> >> XINHEADER X-Note: SMTP Real-From: %MAILFROM% >> >> I do not see an immediate need to notify senders of bad mail. >> >> -- >> Roger Heath >> B> --- B> [This E-mail scanned for viruses by Declude Virus] B> --- B> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] B> --- B> This E-mail came from the Declude.JunkMail mailing list. To B> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and B> type "unsubscribe Declude.JunkMail". You can E-mail B> [EMAIL PROTECTED] for assistance. You can visit our web B> site at http://www.declude.com . B> -- B> ActivatorMail(tm) ver.012602 Scanned for all viruses by B> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Question
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Question on Wednesday 9:38:23 AM Actually, the next most useful feature for me would be to take the real sender and add-to-kill.lst function. Then if you consistently see an abuser, you just add his address to Imails kill file... This also ultimately reduces server load as well, as mail is simply rejected rather than processed... This line gives me the 'real' sender and I'd love to kill.lst some of these if they are clearly doing only spamming...: XINHEADER X-Note: SMTP Real-From: %MAILFROM% I do not see an immediate need to notify senders of bad mail. -- Roger Heath - Copy of Original Message(s): - T> On some of the email I review I would like to click a button and send an T> email back to the sender, based on a template, letting them know that they T> have a problem. It could include all the warnings. Is this a feature that T> others would use if it was available? T> Tom T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012602 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spamreview Update v1.0.4
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spamreview Update v1.0.4 on Wednesday 9:19:03 AM I quite agree with Andy. Let no good deed go unrewarded. This utility is very very good for QC on spam filtering and saves tons of time. -- Roger Heath - Copy of Original Message(s): - T> Thanks Andy. It's always good to hear a good word. T> I make a living writing software but this project is different. May I T> suggest, if you feel guilty, you make your payment in the form of a donation T> to a good cause in either time or money. T> Have a great day, Tom T> -Original Message- T> From: [EMAIL PROTECTED] T> [mailto:[EMAIL PROTECTED]]On Behalf Of andyb@thumpernet T> Sent: Wednesday, January 30, 2002 9:14 AM T> To: Tom Schwarz T> Subject: Re: [Declude.JunkMail] Spamreview Update v1.0.4 T> Hi, T> This little program has saved me so much time over the past few T> days...what used to take an hours now takes minutes...reviewed all the T> spam being held in about 3 minutes this morning... T> This worth paying for. T> Thanks, T> Andy Baldwin T> [EMAIL PROTECTED] T> http://www.thumpernet.com T> 315-282-0020 T> Wednesday, January 30, 2002, 8:58:24 AM, you wrote: TS>> Several New features and fixes. TS>> If you have previously installed all you need is the exe. TS>> http://www.slsoft.com/spamreview.htm TS>> (We are getting rain and ice so if you cannot get to the site the power TS>> lines may be down.) TS>> --- TS>> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] TS>> --- TS>> This E-mail came from the Declude.JunkMail mailing list. To TS>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and TS>> type "unsubscribe Declude.JunkMail". You can E-mail TS>> [EMAIL PROTECTED] for assistance. You can visit our web TS>> site at http://www.declude.com . T> --- T> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012602 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Sunday 4:00:21 PM This is super Tom. You are really saving me one heck of a lot of time. It looks nicer all the time. I like the switch from text to html display. Since you are adding features, figured I'd list a few: Keyboard hooks: 1. Delete key for Move to Delete in addition to button. 2. Insert key to Return to Que in addition to button. 3. F5 to Refresh key in addition to button. Still not displaying Weight here. If you tell me what it is looking for, maybe I can change my header to be recognized? -- Roger Heath - Copy of Original Message(s): - T> Dan, T> v1.0.1 is now available on the web. T> v1.0.1 allows you to shut off the delete confirmation (look in settings). T> v1.0.1 shows the subject. T> Great idea on the Hold button. Will look into this. T> I know I need to work on the sort. I would like to let you sort it multiple T> ways. T> If you resize the form, the message body will resize but resizing all the T> windows is more difficult so that will have to wait for a future version. T> Great idea though. I will add it to the list. T> Keep the great ideas coming. T> Thanks, Tom T> -Original Message- T> From: [EMAIL PROTECTED] T> [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Spangenberg T> Sent: Sunday, January 27, 2002 11:35 AM T> To: [EMAIL PROTECTED] T> Subject: RE: [Declude.JunkMail] Spam Review Program T> Great program? T> Are you ready for some feedback and a few ideas/suggestions? T> I would like a way to shut off the delete confirmation. T> It would be nice to be able to resize the windows. I like to see the subject T> line and it is always down a ways so you have to scroll to see it. T> A button to move to a "hold" directory in addition to the "move to que" and T> "delete" buttons could be useful. T> Also what is the sort order meant to be? Mine doesn't appear to have much T> of a sort order. By date might be good. T> This is a really a great utility and works very well. T> Thanks T> Dan T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012602 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Saturday 6:43:32 PM We have never seen the default message when a weight of 10 occurs. We have seen it when greater than 20 occurs. I thought perhaps you are using a specific format with perhaps a undocumented variable like %TOTALWEIGHT% or something like that. I do not see anything in the latest manuals or cfg files. -- Roger Heath - Copy of Original Message(s): - T> Roger, T> If you have upgraded Declude Junkmail recently you can find out how to use T> this new feature in their online manual. T> If you download their new config files I think, by default, this message T> will appear. T> Tom T> -Original Message- T> From: [EMAIL PROTECTED] T> [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath T> Sent: Saturday, January 26, 2002 6:17 PM T> To: Tom Schwarz T> Subject: Re: [Declude.JunkMail] Spam Review Program T> Reply to: Tom Schwarz T> Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM T> Tom, I am really enjoying the speed of your app. T> You web page mentions that you place a weight message T> in your headers using Declude but does not show how this T> is done. Can you show this here? I'd like to get this working... T> Thanks again, T> -- T> Roger Heath T> - Copy of Original Message(s): - T>> I have received several replies. If it's ok with Declude, I will post T> the T>> download address on this list. If someone from Declude would reply to me T> I T>> would appreciate it. T>> This program will be Freeware (I hate spam) and will only be supported to T>> the extent that I have time to support it (I have a real job). I will be T>> using it on a daily basis so I will be adding features and fixing bugs T> when T>> needed. I will provide the source code to those that want it. Test it T>> carefully yourself. I will not be responsible for problems that may T> occur. T>> Program Notes: T>> This program is written in VB6.0. You give it the path to your IMail T> spool T>> folder and it locates the spam email that is in hold by looking in the T> spam T>> folder under the spool folder. ex. "c:\imail\spool\spam". T>> A list of all the files in the spam hold folder come up in a list box. T> It T>> includes the name of the file, date, from address, to address. T>> Selecting an email in the list displays information in three boxes. The T>> header, the declude warnings, and the body of the message. You can click T> on T>> View HTML and view the body in a browser format. T>> You can click on "Move To Deleted" and the selected email is moved to a T>> deleted folder under the spam folder. The selected email is removed from T>> the spam hold folder. T>> You can click on "Return To Que" and the email will be moved back to the T>> spool folder. The selected email is removed from the spam hold folder. T>> A Refresh button let's you refresh the list. T>> Tom T>> --- T>> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] T>> --- T>> This E-mail came from the Declude.JunkMail mailing list. To T>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T>> type "unsubscribe Declude.JunkMail". You can E-mail T>> [EMAIL PROTECTED] for assistance. You can visit our web T>> site at http://www.declude.com . T>> -- T>> ActivatorMail(tm) ver.012302 Scanned for all viruses by T>> www.activatormail.com intelligent anti-virus anti-spam service T> -- T> ActivatorMail(tm) ver.012302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service T> --- T> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM Tom, I am really enjoying the speed of your app. You web page mentions that you place a weight message in your headers using Declude but does not show how this is done. Can you show this here? I'd like to get this working... Thanks again, -- Roger Heath - Copy of Original Message(s): - T> I have received several replies. If it's ok with Declude, I will post the T> download address on this list. If someone from Declude would reply to me I T> would appreciate it. T> This program will be Freeware (I hate spam) and will only be supported to T> the extent that I have time to support it (I have a real job). I will be T> using it on a daily basis so I will be adding features and fixing bugs when T> needed. I will provide the source code to those that want it. Test it T> carefully yourself. I will not be responsible for problems that may occur. T> Program Notes: T> This program is written in VB6.0. You give it the path to your IMail spool T> folder and it locates the spam email that is in hold by looking in the spam T> folder under the spool folder. ex. "c:\imail\spool\spam". T> A list of all the files in the spam hold folder come up in a list box. It T> includes the name of the file, date, from address, to address. T> Selecting an email in the list displays information in three boxes. The T> header, the declude warnings, and the body of the message. You can click on T> View HTML and view the body in a browser format. T> You can click on "Move To Deleted" and the selected email is moved to a T> deleted folder under the spam folder. The selected email is removed from T> the spam hold folder. T> You can click on "Return To Que" and the email will be moved back to the T> spool folder. The selected email is removed from the spam hold folder. T> A Refresh button let's you refresh the list. T> Tom T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Software
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Software on Saturday 1:28:47 PM Thanks, Tom. It is working nicely here. It is much faster as once you delete and confirm the focus is on the appropriate button, so once it starts you can just keep hitting Enter until you get to something you want to not delete. I hope I get a lot of spam today. This is very useful. -- Roger Heath - Copy of Original Message(s): - T> Either will work. T> \\myserver\imail\spool T> or T> c:\imail\spool T> -Original Message- T> From: [EMAIL PROTECTED] T> [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Jones, Jr. T> Sent: Saturday, January 26, 2002 1:25 PM T> To: [EMAIL PROTECTED] T> Subject: Re: [Declude.JunkMail] Spam Review Software T> can i use a unc to get to the spooled files or does it have to be mapped? T> thanks!! T> Jim T> - Original Message - T> From: "Tom Schwarz" <[EMAIL PROTECTED]> T> To: <[EMAIL PROTECTED]> T> Sent: Saturday, January 26, 2002 12:48 PM T> Subject: [Declude.JunkMail] Spam Review Software >> Exactly 15 hours after I sat down at a computer to write a program to T> review >> spam email I have a first release. I tell you this so you won't yell at T> me >> if you find a bug. Feel free however to report bugs and suggest >> enhancements. >> >> You can locate this software at http://www.slsoft.com/spamreview.htm. >> Please read the page carefully before downloading. >> >> Tom >> >> >> >> --- >> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] >> >> --- >> >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". You can E-mail >> [EMAIL PROTECTED] for assistance. You can visit our web >> site at http://www.declude.com . >> T> --- T> [This E-mail was scanned for viruses by Declude Virus T> (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> --- T> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T> --- T> This E-mail came from the Declude.JunkMail mailing list. To T> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T> type "unsubscribe Declude.JunkMail". You can E-mail T> [EMAIL PROTECTED] for assistance. You can visit our web T> site at http://www.declude.com . T> -- T> ActivatorMail(tm) ver.012302 Scanned for all viruses by T> www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM I appreciate this. It would prove useful if it works well. I manage my files over a network, all but the drive is ok in that path. I'd like a copy, but I am already wondering if I can change the path. I do not have VB. -- Roger Heath - Copy of Original Message(s): - T> This program is written in VB6.0. You give it the path to your IMail spool T> folder and it locates the spam email that is in hold by looking in the spam T> folder under the spool folder. ex. "c:\imail\spool\spam". -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Scanning for false positives
Reply to: Chuck Schick Re: [Declude.JunkMail] Scanning for false positives on Thursday 9:42:24 AM I just view the main 'D' messages with a text editor, To stop having to load the smaller 'Q' you can add these settings to your Global.Cfg to view what contents are in the 'Q' as these reveal the real sender, receiver, etc. XINHEADER X-Note: QueInControl: %QUEUENAME% (%NRECIPS%) XINHEADER X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%] XINHEADER X-Note: SMTP Real From: %MAILFROM% XINHEADER X-Note: SMTP Real To: %ALLRECIPS% This at least speeds up determining the overall message setting and requests. -- Roger Heath - Copy of Original Message(s): - C> Has anyone come up with a good procedure on scanning the spam folder for C> legitimate email. We have just started holding the email that fails the C> spamcop test and I want to check to be sure I am not catching legitimate C> email. C> Chuck Schick C> Warp 8, Inc. C> www.warp8.com C> 303-421-5140 -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Problems with SPAMCOP test in JunkMail standard
Reply to: Michael Ernst Re: [Declude.JunkMail] Problems with SPAMCOP test in JunkMail standard on Monday 2:33:57 PM We make the WEIGHT10 and make SpamCop 9... then give other test weights the ability to 'substantiate' SpamCop or push the value to 10. We have all tests WARN except WEIGHT10 which is HOLD. This enables us to view all failed tests in captured email and see what combinations of tests are working best and tweak them accordingly We had similar results with SpamCop alone, but decided to make that process 'verified' by other tests. I am a little concerned, because if you read SpamCop's web site, they are soon going to be charging for this service on a per setup or per user basis. I hope this is not expensive. -- Roger Heath - Copy of Original Message(s): - M> Hi, I'm using the 1.31 Beta of JunkMail standard and having fairly good luck identifying spam with the WEIGHT tests. I've been expecting to see some results from SPAMCOP as well, but have not M> seen a single positive from SPAMCOP in the logs over a period of three weeks or more, -- ActivatorMail(tm) ver.011402 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .