[Declude.JunkMail] What Action Do you take?
I am sure most people use the weighting system. For the most part you have certain weights were you know that 99% of the mail triggering that weight is spam. Do you BOUNCE, HOLD, Or DELETE? Right now I am using HOLD, but was considering switching that to BOUNCE. There are defiantly some pro's and con's to both. Any thoughts. Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What Action Do you take?
If you are 99% certain that an E-mail is spam, the BOUNCE action usually has a major con: 99% of spammers use a fake return address, so you will be doing a huge amount of work (re-trying tons of bounce messages, and sending lots of bounces to innocent people) for a small benefit (alerting those 1% that their mail was blocked). And I am about to move WEIGHT15 to Delete instead of BOUNCE because of the flood of bounce messages. The ones that come back with: 553 sorry, that domain isn't in my list of allowed rcpthosts or just Connection refused I am blacklisting completely. But the hundreds of postmaster messages from bad domains is getting real old real fast... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DORKZTL:RE: [Declude.JunkMail] What Action Do you take?
One of the neat things about Declude is it doesn't let the idiot on the other end know you deleted his spam. If he did, there are those who sit up until the wee hours trying to get around a program just cuz he can. I personally have a huge myfilter.txt file (over 1800 entries) and I have anything set to 35 or higher is lost in the cyber world. Anything over 25 but less than 34 is set to WARN and anything less is sent without recourse. Because of the file I have, I get some Weight values over 100! And I have yet to see one of them over forty that doesn't look like spam. I am sure I am losing a few but I know I am stopping a bunch. The numbers a few minutes ago were 33010 emails and 24783 spam. This is not a large amount of emails seeing as how I have not reset for 8 days. If anyone wants a copy of the myfilter.txt that I use, I would be glad to share. I would warn all first though...there are things I look for that may not be prudent for your clients. The myfilter.txt file has to be set for each individual server. I have found that it is a lot easier removing things that are not germane that gong through tons of spam and trying to find things that are. My file has been compiled from several other's list. Oh yes, it also makes my dec.log bigger. I run around a 2.5 to 3 meg file a day. After reading every post for a month I have tried to incorporate other's ideas into my global.cfg and myfilter.txt. Hope this helps and doe not confuse. Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L. Sent: Friday, August 02, 2002 2:51 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] What Action Do you take? I am sure most people use the weighting system. For the most part you have certain weights were you know that 99% of the mail triggering that weight is spam. Do you BOUNCE, HOLD, Or DELETE? Right now I am using HOLD, but was considering switching that to BOUNCE. There are defiantly some pro's and con's to both. Any thoughts. Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What Action Do you take?
I used bounce but got so many return bounces due to the poor bouncing option Imail offer Declude. We block a good 3-5k messages each day out of 8-10k total. So many spammers use fake addresses or get their service disconnected/discontinued or simply get their mailboxes full that there will be a LOT of bounces for your postmaster acct. Depending on your total mail volume and volume of spam out of it it might or might not be ok for you. Can only say test and see but if you have a LOT of mail getting delivered be ready to switch from bounce to hold very quickly. / Eje Friday, August 2, 2002, 2:50:56 PM, you wrote: DL I am sure most people use the weighting system. For the most part you DL have certain weights were you know that 99% of the mail triggering that DL weight is spam. DL Do you BOUNCE, HOLD, Or DELETE? Right now I am using HOLD, but was DL considering switching that to BOUNCE. There are defiantly some pro's DL and con's to both. DL Any thoughts. DL Darrell DL --- DL [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] DL --- DL This E-mail came from the Declude.JunkMail mailing list. To DL unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DL type unsubscribe Declude.JunkMail. The archives can be found DL at http://www.mail-archive.com. DL --- DL [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What Action Do you take?
I used bounce but got so many return bounces due to the poor bouncing option Imail offer Declude. FWIW, the reason that the double bounces occur isn't because of a poor bouncing option -- it's because the bounce can't occur during the SMTP transaction (IMail doesn't allow programs to intercept the SMTP transaction). If that were possible, IMail wouldn't actually generate a bounce; the remote server would. Therefore, the bounce would never be seen on the IMail server. The remote server would try delivering it, and if it could not, would send the double bounce to the local postmaster. Note that this is exactly the same thing that would happen if you ran a gateway in front of IMail (it would accept all mail, not knowing whether it should bounce or not, and then when IMail bounced the E-mail, the gateway would have to deal with double bounces). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What Action Do you take?
Hi Scott: FWIW, the reason that the double bounces occur isn't because of a poor bouncing option well - the ONE pending enhancement is that we can use a BETTER mailer than imail1.exe that would permit us to send from - as it should be. THEN we would not SEE any bounces. IMail doesn't allow programs to intercept the SMTP transaction Unless you add a pass through proxy that PREpends the Imail SMTP. It would monitor port 25, pass through any traffic to Imail on an alternate port - but do the DNS based lookups on the mailfrom and the helo BEFORE Imail gets control. The other option would be to hack into the Virus Gateway interface that they are using to call the Symantec AV DLLs. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What Action Do you take?
FWIW, the reason that the double bounces occur isn't because of a poor bouncing option well - the ONE pending enhancement is that we can use a BETTER mailer than imail1.exe that would permit us to send from - as it should be. THEN we would not SEE any bounces. Good point, I hadn't taken that into account. That would work better (although still send bounces to innocent victims, in the case of spam that used a forged return address). IMail doesn't allow programs to intercept the SMTP transaction Unless you add a pass through proxy that PREpends the Imail SMTP. It would monitor port 25, pass through any traffic to Imail on an alternate port - but do the DNS based lookups on the mailfrom and the helo BEFORE Imail gets control. True. That's something that we have given some though to (especially so that we can have Declude work with other mailservers). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
