Re: [Declude.JunkMail] This one got through.....

2004-10-06 Thread R. Scott Perry

Any idea why this message (here's the header) was delivered to the 
user.   I have WEIGHT10  WEIGHT20 set to HOLD and it
seems to be working great otherwise.
The reason is:
X-RBL-Warning: WEIGHT10: Weight of 28 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT20: Weight of 28 reaches or exceeds the limit of 20.
You have WEIGHT10 and WEIGHT20 set to WARN.
I'm guessing that this is an outgoing E-mail (IMail counts gateway E-mail 
as outgoing E-mail), in which case the outgoing actions are used (from the 
\IMail\Declude\global.cfg file).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] This one got through.....

2004-10-06 Thread Gary Brumm
Scott,
This was an incoming message and you are absolutely correct.  I rechecked 
their config file.
I had them set up with a per domain configuration and I missed changing 
WARN to HOLD on this one.  I now have
a template for the new domain specific configurations so I don't make this 
mistake again.  When I asked this domains
users how the spam was yesterday this was the only message they sent to me 
so I assumed it had slipped through.

Thanks,
Gary
At 03:47 AM 10/6/2004, you wrote:
Any idea why this message (here's the header) was delivered to the 
user.   I have WEIGHT10  WEIGHT20 set to HOLD and it
seems to be working great otherwise.
The reason is:
X-RBL-Warning: WEIGHT10: Weight of 28 reaches or exceeds the limit of 10.
X-RBL-Warning: WEIGHT20: Weight of 28 reaches or exceeds the limit of 20.
You have WEIGHT10 and WEIGHT20 set to WARN.
I'm guessing that this is an outgoing E-mail (IMail counts gateway E-mail 
as outgoing E-mail), in which case the outgoing actions are used (from the 
\IMail\Declude\global.cfg file).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
ComsecNet
Dedicated Data Services
Stockton, CA
Phone:(209) 463-2809
Fax:(209) 938-0481
Email: [EMAIL PROTECTED]
Web: www.comsec.net
This message is intended for the use of the individual or entity to which 
it is addressed and may contain information that is privileged, 
confidential, and exempt from disclosure under applicable law. If the 
reader of this message is not the intended recipient or an employee or 
agent responsible for delivering to the intended recipient, you are hereby 
notified that any dissemination, distribution or copying of this 
communication is strictly prohibited. If you have received this 
communication in error please destroy this message and notify the sender by 
reply email.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] This one got through.....

2004-10-05 Thread Gary Brumm
Thanks for the help Kevin,  The logs would normally be the first place I 
would have looked but
I inadvertently deleted the JM log from earlier today.  I have just started 
using JM and I am going through a bit of
a learning curve (I have been a Declude Virus customer for a little over a 
year).  So far the results have been
amazing.  Thanks again for your help, Gary

At 08:50 PM 10/5/2004, you wrote:
This question crops up from time to time and I origionall had issues like
this. I would start with changing your weight to weightranges
For example
SPAM-LOWweightrange x   x   8   13
SPAM-MEDweightrange x   x   14  24
SPAM-HIGH   weight  x   x   25  0
This way you know what action is happening to your message without a doubt.
You should look at all the actions for each test
DSBL, SORBS-WEB, NOABUSE, NOPOSTMASTER, CMDSPACE, REVDNS, ROUTING, WEIGHT10,
WEIGHT20
To see why it got through.
And lastly what many other posters are going to ask is What do your logs
say
Kevin Bilbee


 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Gary Brumm
 Sent: Tuesday, October 05, 2004 8:36 PM
 To: [EMAIL PROTECTED]
 Subject: [Declude.JunkMail] This one got through.


 Any idea why this message (here's the header) was delivered to the
 user.   I have WEIGHT10  WEIGHT20 set to HOLD and it
 seems to be working great otherwise.

 Thanks,

 Gary


 X-Message-Info: WJJZnOB93zJJi/xUvVMjoSwJwigkBr9B
 From: Collin Kiser [EMAIL PROTECTED]
 To: [EMAIL PROTECTED]
 
 Subject: 5.jpg
 Date: Wed, 06 Oct 2004 04:01:11 +0200 EST
 X-RBL-Warning: DSBL: http://dsbl.org/listing?220.69.120.64;
 X-RBL-Warning: SORBS-WEB: Exploitable Server See:
 http://www.dnsbl.sorbs.net/lookup.shtml?220.69.120.64;
 X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
 X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED]
 X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA
 220.69.120.64
 with no reverse DNS entry.
 X-RBL-Warning: ROUTING: This E-mail was routed in a poor
 manner consistent
 with spam [210f].
 X-RBL-Warning: WEIGHT10: Weight of 28 reaches or exceeds the
 limit of 10.
 X-RBL-Warning: WEIGHT20: Weight of 28 reaches or exceeds the
 limit of 20.
 X-Declude-Sender: [EMAIL PROTECTED] [220.69.120.64]
 X-Note: Scanned by Declude JunkMail
 X-Note: Total spam weight of this E-mail is 28.
 X-Spam-Tests-Failed: DSBL, SORBS-WEB, NOABUSE, NOPOSTMASTER,
 CMDSPACE,
 REVDNS, ROUTING, WEIGHT10, WEIGHT20 [28]
 X-Note: This E-mail was sent from [No Reverse DNS] ([220.69.120.64]).
 X-IMAIL-SPAM-STATISTICS: (459e151c013e5a51, 0.9972)
 X-RCPT-TO: [EMAIL PROTECTED]
 
 Content-Type: text/html;


 ComsecNet
 Dedicated Data Services
 Stockton, CA
 Phone:(209) 463-2809
 Fax:(209) 938-0481
 Email: [EMAIL PROTECTED]
 Web: www.comsec.net

 This message is intended for the use of the individual or
 entity to which
 it is addressed and may contain information that is privileged,
 confidential, and exempt from disclosure under applicable law. If the
 reader of this message is not the intended recipient or an
 employee or
 agent responsible for delivering to the intended recipient,
 you are hereby
 notified that any dissemination, distribution or copying of this
 communication is strictly prohibited. If you have received this
 communication in error please destroy this message and notify
 the sender by
 reply email.




 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be
 found at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
ComsecNet
Dedicated Data Services
Stockton, CA
Phone:(209) 463-2809
Fax:(209) 938-0481
Email: [EMAIL PROTECTED]
Web: www.comsec.net
This message is intended for the use of the individual or entity to which 
it is addressed and may contain information that is privileged, 
confidential, and exempt from disclosure under applicable law. If the 
reader of this message is not the intended recipient or an employee or 
agent responsible for delivering to the intended recipient, you are hereby 
notified that any dissemination, distribution or copying of this 
communication is strictly prohibited. If you have received this 
communication in error please destroy this message and notify the sender by 
reply email.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list