Re: [Declude.JunkMail] This doesnt add up
The gibberish filter has only "body 0" so no weight is posted in the filter. Weight is only assigned by Declude upon failure of the gibberish filter. - Original Message - From: "Scott Fisher" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 1:13 PM Subject: Re: [Declude.JunkMail] This doesnt add up You are assigning 30/40 points for the failure of the gibberish filter. Are you also scoring points within the gibberish filter. a body 15 contains text would score 15 for that line matching plus the 30 for the filter matching. - Original Message - From: "Todd" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:33 PM Subject: Re: [Declude.JunkMail] This doesnt add up I recently changed the Gibberish weight from 30 to 40. SPFPASS spf pass x 0 0 GIBBERISH filter d:\imail\declude\filters\gibberish.txt x 40 0 SPAMCHK external weight "d:\imail\declude\spamchk\spamchk.exe" - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:21 PM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, Can you post your gibberish, spamchk, and spfpass lines from your global.cfg as well. Darrell Todd writes: 04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file d:\imail\declude\filters\navsmtpspam.txt.txt. 04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK 04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN GIBBERISH=WARN CATCHALLMAILS=IGNORE 04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:30 AM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, We would really need to see the Declude log entries for that message to better determine the issue. Can you post that message entry. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type &q
Re: [Declude.JunkMail] This doesnt add up
Anoth - Original Message - From: "IS - Systems Eng. (Karl Drugge)" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 1:02 PM Subject: RE: [Declude.JunkMail] This doesnt add up I've been seeing this for weeks. I reported it, and I believe they are working on a fix. Sometimes Declude doesn't put ANYTHING in the headers. Kind of hard to figure out why something got through in the meantime, though.. Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, April 05, 2006 1:44 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] This doesnt add up Todd, I do not see them in the headers ? X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:56 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] This doesnt add up Thanks David, both of these tests are not hidden and show up in the headers. Todd - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:47 AM Subject: RE: [Declude.JunkMail] This doesnt add up To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, check your global.cfg you should see the -5 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:22 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] This doesnt add up A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- PLEASE NOTE : Florida has a very broad public records law. Most written communications to or from City officials regarding City business are public records available to the public and media upon request. Your E-mail communications may be subject to public disclosure. PLEASE NOTE : Florida has a very broad public records law. Most written communications to or from City officials regarding City business are public records available to the public and media upon request. Your E-mail communications may be subject to public disclosure. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
You are assigning 30/40 points for the failure of the gibberish filter. Are you also scoring points within the gibberish filter. a body 15 contains text would score 15 for that line matching plus the 30 for the filter matching. - Original Message - From: "Todd" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:33 PM Subject: Re: [Declude.JunkMail] This doesnt add up I recently changed the Gibberish weight from 30 to 40. SPFPASS spf pass x 0 0 GIBBERISH filter d:\imail\declude\filters\gibberish.txt x 40 0 SPAMCHK external weight "d:\imail\declude\spamchk\spamchk.exe" - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:21 PM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, Can you post your gibberish, spamchk, and spfpass lines from your global.cfg as well. Darrell Todd writes: 04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file d:\imail\declude\filters\navsmtpspam.txt.txt. 04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK 04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN GIBBERISH=WARN CATCHALLMAILS=IGNORE 04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:30 AM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, We would really need to see the Declude log entries for that message to better determine the issue. Can you post that message entry. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail c
Re: [Declude.JunkMail] This doesnt add up
I should have been clearer. They show up in the headers of the emails where they are triggered. Here is an example that again does not add up (30 + 35 - 15 - 15 + 10 = 45) to the weight of 75 Declude has given it. FIVETENSRC ip4r blackholes.five-ten-sg.com 127.0.0.2 30 0 SORBS-DUL ip4r dnsbl.sorbs.net 127.0.0.10 35 0 NOLEGITCONTENT nolegitcontent x x 0 -15 IPNOTINMX ipnotinmx x x 0 -15 SPFUNKNOWN spf unknown x 0 0 COUNTRYFILTER filter d:\imail\declude\filters\countryfilter.txt x 0 0 ( weight 10 in filter) CATCHALLMAILS catchallmails x x 0 0 -- Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500 Received: from fxi.com ([84.220.55.194]) by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id M2006040314252611030 for ; Mon, 03 Apr 2006 14:25:27 -0500 Message-ID: <[EMAIL PROTECTED]> Reply-To: "Liviu Gaeth" <[EMAIL PROTECTED]> From: "Liviu Gaeth" <[EMAIL PROTECTED]> To: todd Subject: see new Date: Mon, 3 Apr 2006 15:23:36 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_0001_01C65732.93DB6C50" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-mxGuard-Info: Processed by net.smart-mail.net using mxGuard v1.5.0 X-mxGuard-Spool-ID: 767d01e101566616 X-mxGuard-Sender: [EMAIL PROTECTED] X-mxGuard-Spam-Score: 0 X-Note: This message has been scanned for spam and viruses using mxGuard for IMail X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com. X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential spam source listed in SORBS-DUL. X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, weight 10) X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75. X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75] X-Note: Total spam weight of this E-mail is 75 . X-Country-Chain: ITALY->UNITED STATES->destination X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it ([84.220.55.194]). X-RCPT-TO: Status: U X-UIDL: 400264161 -- - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:44 PM Subject: RE: [Declude.JunkMail] This doesnt add up Todd, I do not see them in the headers ? X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:56 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] This doesnt add up Thanks David, both of these tests are not hidden and show up in the headers. Todd - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:47 AM Subject: RE: [Declude.JunkMail] This doesnt add up To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, check your global.cfg you should see the -5 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:22 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] This doesnt add up A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH:
RE: [Declude.JunkMail] This doesnt add up
I've been seeing this for weeks. I reported it, and I believe they are working on a fix. Sometimes Declude doesn't put ANYTHING in the headers. Kind of hard to figure out why something got through in the meantime, though.. Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, April 05, 2006 1:44 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] This doesnt add up Todd, I do not see them in the headers ? X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:56 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] This doesnt add up Thanks David, both of these tests are not hidden and show up in the headers. Todd - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:47 AM Subject: RE: [Declude.JunkMail] This doesnt add up > To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, > check your global.cfg you should see the -5 > > David B > www.declude.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd > Sent: Wednesday, April 05, 2006 12:22 PM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] This doesnt add up > > > A lot of spam has been getting through lately and at first I was thinking > my > Declude needed some tweaking. I am seeing some funny stuff though. I > find > emails where emails contain items that should have triggered filters but > did > not. I am on IMail 8.15 and Declude 2.06. > > Here is a header of an email where the numbers dont add to the score. It > should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 > > My global.cfg has the following entries for the tests that were triggered > > SUBJECTSPACES7 subjectspaces 7 x 5 0 > SUBJECTSPACES10 subjectspaces 10 x 15 0 > SPFPASSspf pass x 0 0 > > > X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. > X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. > X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. > X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight > 30) > X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for > spam. > X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, > GIBBERISH, CATCHALLMAILS [30] > X-Note: Total spam weight of this E-mail is 30 . > X-Country-Chain: UNITED STATES->destination > X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- PLEASE NOTE : Florida has a very broad public records law. Most written communications to or from City officials regarding City business are public records available to the public and media upon request. Your E-mail communications may be subject to public disclosure. PLEASE NOTE : Florida has a very broad public records law. Most written communications to or from City officials regarding City business are public records available to the public and media upon request. Your E-mail communications may be subject to public disclosure. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
Here is another one. Spamcheck reports a weight of 90 but Declude only gives it a weight of 55. This is the same reduction of 35 points as on the other email. I have looked through my global.cfg and all my filters for any line containing a weight of -35 that might cause the reduction but I do not see any. The only tests in my global.cfg with negative weights are BONDEDSENDER -50, IPNOTINMX -15, NOLEGITCONTENT -15, and none of them are triggered here. -- Received: from host167-139.discord.birch.net [192.168.1.19] by net.smart-mail.net (SMTPD32-8.15) id A4BB3D2A00C8; Wed, 15 Mar 2006 11:54:03 -0600 X-Bulk: 100 Received: from blue.dnsireland.com ([207.44.154.5]) by host167-139.discord.birch.net (SMSSMTP 4.0.0.59) with SMTP id M2006031511535223753 for ; Wed, 15 Mar 2006 11:53:53 -0600 Received: from nobody by blue.dnsireland.com with local (Exim 4.52) id 1FJaC1-0002Q5-0t for todd; Wed, 15 Mar 2006 17:53:53 + To: todd Subject: Verify your Chase.com account activity From: Chase Banking <[EMAIL PROTECTED]> Reply-To: MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Message-Id: <[EMAIL PROTECTED]> Date: Wed, 15 Mar 2006 17:53:53 + X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - blue.dnsireland.com X-AntiAbuse: Original Domain - smart-mail.net X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - blue.dnsireland.com X-Source: X-Source-Args: X-Source-Dir: X-mxGuard-Info: Processed by net.smart-mail.net using mxGuard v1.5.0 X-mxGuard-Spool-ID: 54bb3d2a00c86f8f X-mxGuard-Sender: [EMAIL PROTECTED] X-mxGuard-Spam-Score: 0 X-Note: This message has been scanned for spam and viruses using mxGuard for IMail X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 90. X-RBL-Warning: NAVGATEWAYHEADER: Message failed NAVGATEWAYHEADER test (line 1, weight 0) X-Declude-Sender: [EMAIL PROTECTED] [207.44.154.5] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SPFUNKNOWN, SPAMCHK, NAVGATEWAYHEADER, CATCHALLMAILS [55] X-Note: Total spam weight of this E-mail is 55 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from blue.dnsireland.com ([207.44.154.5]). X-RCPT-TO: Status: R X-UIDL: 400263651 - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:21 PM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, Can you post your gibberish, spamchk, and spfpass lines from your global.cfg as well. Darrell Todd writes: 04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file d:\imail\declude\filters\navsmtpspam.txt.txt. 04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK 04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN GIBBERISH=WARN CATCHALLMAILS=IGNORE 04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:30 AM Subject: Re: [Declude.JunkMail] This doesnt add up --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] This doesnt add up
Todd, I do not see them in the headers ? X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:56 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] This doesnt add up Thanks David, both of these tests are not hidden and show up in the headers. Todd - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:47 AM Subject: RE: [Declude.JunkMail] This doesnt add up > To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, > check your global.cfg you should see the -5 > > David B > www.declude.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd > Sent: Wednesday, April 05, 2006 12:22 PM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] This doesnt add up > > > A lot of spam has been getting through lately and at first I was thinking > my > Declude needed some tweaking. I am seeing some funny stuff though. I > find > emails where emails contain items that should have triggered filters but > did > not. I am on IMail 8.15 and Declude 2.06. > > Here is a header of an email where the numbers dont add to the score. It > should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 > > My global.cfg has the following entries for the tests that were triggered > > SUBJECTSPACES7 subjectspaces 7 x 5 0 > SUBJECTSPACES10 subjectspaces 10 x 15 0 > SPFPASSspf pass x 0 0 > > > X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. > X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. > X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. > X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight > 30) > X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for > spam. > X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, > GIBBERISH, CATCHALLMAILS [30] > X-Note: Total spam weight of this E-mail is 30 . > X-Country-Chain: UNITED STATES->destination > X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
I recently changed the Gibberish weight from 30 to 40. SPFPASS spf pass x 0 0 GIBBERISH filter d:\imail\declude\filters\gibberish.txt x 40 0 SPAMCHK external weight "d:\imail\declude\spamchk\spamchk.exe" - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 12:21 PM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, Can you post your gibberish, spamchk, and spfpass lines from your global.cfg as well. Darrell Todd writes: 04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file d:\imail\declude\filters\navsmtpspam.txt.txt. 04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK 04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN GIBBERISH=WARN CATCHALLMAILS=IGNORE 04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:30 AM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, We would really need to see the Declude log entries for that message to better determine the issue. Can you post that message entry. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
Todd, Can you post your gibberish, spamchk, and spfpass lines from your global.cfg as well. Darrell Todd writes: 04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file d:\imail\declude\filters\navsmtpspam.txt.txt. 04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK 04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN GIBBERISH=WARN CATCHALLMAILS=IGNORE 04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:30 AM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, We would really need to see the Declude log entries for that message to better determine the issue. Can you post that message entry. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] This doesnt add up
Todd Check for the possibility of tests that were PASSED, which would also reduce the score. "X-Spam-Tests-Failed" will only show those test FAILED. I went through this some time back and had to run DEBUG mode for a while to understand it. John C -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 11:56 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] This doesnt add up Thanks David, both of these tests are not hidden and show up in the headers. Todd - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:47 AM Subject: RE: [Declude.JunkMail] This doesnt add up > To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, > check your global.cfg you should see the -5 > > David B > www.declude.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd > Sent: Wednesday, April 05, 2006 12:22 PM > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] This doesnt add up > > > A lot of spam has been getting through lately and at first I was thinking > my > Declude needed some tweaking. I am seeing some funny stuff though. I > find > emails where emails contain items that should have triggered filters but > did > not. I am on IMail 8.15 and Declude 2.06. > > Here is a header of an email where the numbers dont add to the score. It > should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 > > My global.cfg has the following entries for the tests that were triggered > > SUBJECTSPACES7 subjectspaces 7 x 5 0 > SUBJECTSPACES10 subjectspaces 10 x 15 0 > SPFPASSspf pass x 0 0 > > > X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. > X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. > X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. > X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight > 30) > X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for > spam. > X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, > GIBBERISH, CATCHALLMAILS [30] > X-Note: Total spam weight of this E-mail is 30 . > X-Country-Chain: UNITED STATES->destination > X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
Thanks David, both of these tests are not hidden and show up in the headers. Todd - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:47 AM Subject: RE: [Declude.JunkMail] This doesnt add up To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, check your global.cfg you should see the -5 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:22 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] This doesnt add up A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
04/01/2006 22:28:20 Q52D60D410090E5F8 Could not load filter file d:\imail\declude\filters\navsmtpspam.txt.txt. 04/01/2006 22:28:20 Q52D60D410090E5F8 L1 Message OK 04/01/2006 22:28:20 Q52D60D410090E5F8 Tests failed [weight=30]: SUBJECTSPACES7=WARN SUBJECTSPACES10=WARN SPFPASS=WARN SPAMCHK=WARN GIBBERISH=WARN CATCHALLMAILS=IGNORE 04/01/2006 22:28:20 Q52D60D410090E5F8 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 04/01/2006 22:28:20 Q52D60D410090E5F8 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] - Original Message - From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 05, 2006 11:30 AM Subject: Re: [Declude.JunkMail] This doesnt add up Todd, We would really need to see the Declude log entries for that message to better determine the issue. Can you post that message entry. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] This doesnt add up
To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests, check your global.cfg you should see the -5 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Wednesday, April 05, 2006 12:22 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] This doesnt add up A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] This doesnt add up
Todd, We would really need to see the Declude log entries for that message to better determine the issue. Can you post that message entry. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] This doesnt add up
A lot of spam has been getting through lately and at first I was thinking my Declude needed some tweaking. I am seeing some funny stuff though. I find emails where emails contain items that should have triggered filters but did not. I am on IMail 8.15 and Declude 2.06. Here is a header of an email where the numbers dont add to the score. It should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30 My global.cfg has the following entries for the tests that were triggered SUBJECTSPACES7 subjectspaces 7 x 5 0 SUBJECTSPACES10 subjectspaces 10 x 15 0 SPFPASSspf pass x 0 0 X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found. X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15. X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight 30) X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK, GIBBERISH, CATCHALLMAILS [30] X-Note: Total spam weight of this E-mail is 30 . X-Country-Chain: UNITED STATES->destination X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]). --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
