RE: [Declude.JunkMail] Passing SPAM that should be bounced
Scott, Essentially all I am doing is acting as a gateway for another domain. This way they can utilize the virus scanning and spam detection we have in place. What I am trying to implement is called Acting as a gateway for domains on other servers in the manual. Now from the manual and what you indicated I need to setup per domain configuration for this domain to get around the describe behavior (Declude would treat the mail as outgoing). Now the manual says this under the Acting as a gateway for domains on other servers heading - The only catch as far as Declude JunkMail is concerned is that IMail will treat the E-mail to the gateway domain as outgoing mail, since it is not stored on the IMail server. Therefore, by default, the outgoing actions in the \IMail\Declude\global.cfg file will be used. To get around this, you can set up per-domain configuration files for the gateway domains. However, when looking at the per domain configuration it does not say anything about copying in the global config where the outgoing tests are specified. Can you explain this in a little more depth to me? Also, since you mentioned that Declude will only scan the email once. The behavior I am seeing now is that the message intended for the remote domain is being scanned inbound. Now if I enabled outgoing scanning - would it not process that mail again because it was already scanned inbound? Would it use the information it already gathered from the first scan? To summarize. In addition to scanning all inbound mail for my local domains, I want to filter mail for this domain that I am a gateway for. Scott I hope this makes sense... Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, January 14, 2003 9:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Passing SPAM that should be bounced 1.) Since the mail was already incoming and has gone through all the spam checks inbound is there anyway to override the current behavior of discarding those results and actually have the message react to the incoming spam checks. Declude JunkMail will only scan an E-mail once. E-mail can be very confusing because every E-mail handled by a mailserver is technically incoming E-mail (as in the IMail server receives it from somewhere else), whereas some of those are local deliveries and some are remote deliveries. In any case, an E-mail should only be scanned once by Declude (unless it arrives more than once). 2.) If I can't override the default behavior, can I setup per domain outgoing processing for just this domain - even though this domain does not exist on this mail server? Yes, but not the way I think you want. You can set up per-domain settings for the *recipient* domain. But, you can't set up per-domain settings for the *sender* domain. In this case, I'm guessing you would want the per-user settings for the sender domain, which isn't possible (remember, spammers love to use the same return address as the To: address). 3.) If it is possible to setup per domain filtering for this domain even though it does not exist on this server, Should I whitelist the incoming mail so it doesn't go through all those checks? Or is Whitelisting global in regards that it applies to both incoming and outgoing mail? The whitelisting applies to whatever type of whitelist it is. For example, WHITELIST IP 192.0.2.25 will whitelist E-mail coming from 192.0.2.25, no matter whether it is incoming or outgoing E-mail. Please advise on what you think would be the best course of action here. The ultimate problem seems to be that the backup mailserver isn't really a backup mailserver -- it seems to accept all E-mail, and send it out. If the backup mailserver accepts an E-mail, sends it to the primary mailserver, and then the primary mailserver sends it out to a remote location, you probably have a problem. Unless there is a good reason for this (for example, forwarding on the primary mailserver that is causing the E-mail to be sent to a remote location), you are running an open relay on the backup mailserver. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
Now the manual says this under the Acting as a gateway for domains on other servers heading - The only catch as far as Declude JunkMail is concerned is that IMail will treat the E-mail to the gateway domain as outgoing mail, since it is not stored on the IMail server. Therefore, by default, the outgoing actions in the \IMail\Declude\Global.cfg file will be used. To get around this, you can set up per-domain configuration files for the gateway domains. However, when looking at the per domain configuration it does not say anything about copying in the global config where the outgoing tests are specified. Can you explain this in a little more depth to me? Darrell, if you want the settings for that domain to be different than the test actions in the Global.cfg, you need to follow this section of the manual: ### Per-Domain Configuration The Standard and Pro versions of Declude JunkMail allow you to have different settings for each domain that you have. In order to do this, you first need to create a subdirectory off of the Declude directory, with the same name as the domain you wish to change. For example, to add a per-domain configuration for example.com, you would create the directory \IMail\Declude\example.com. Note that this needs to be the official domain name, not a domain alias (so if you have a domain mail.example.com with example.com as an alias, the directory should be \IMail\Declude\mail.example.com\). The exception is that if you have a user alias, the domain you use in the alias will take priority (for example, if the alias is sales that points to [EMAIL PROTECTED], you would need to use the directory example.com). It may be necessary to use two different directories, if you have users aliases pointing to domain aliases (a quirk in IMail). The next step is to copy the $default$.JunkMail file into that directory. Then, edit that file to reflect the settings you want for that domain. Or, to quickly disable spam control for a specific domain, you can whitelist all mail to the domain by using the WHITELIST TODOMAIN @example.com setting in the Global.cfg file. Note that you should not delete the \IMail\Declude\$default$.JunkMail file. If that file does not exist, there will be no default settings for E-mail addressed to domains that do not have their own per-domain settings. ### John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
Essentially all I am doing is acting as a gateway for another domain. This way they can utilize the virus scanning and spam detection we have in place. Ah, I see now. I had thought that you were acting as a backup mailserver (in case they were down), rather than a gateway (to scan all their E-mail). What I am trying to implement is called Acting as a gateway for domains on other servers in the manual. Now from the manual and what you indicated I need to setup per domain configuration for this domain to get around the describe behavior (Declude would treat the mail as outgoing). That is correct. So if you are a gateway for the example.com domain, then you could set up a file \IMail\Declude\example.com\$default$.JunkMail that would be used for E-mail to @example.com (instead of the outgoing actions from the global.cfg file being used). Now the manual says this under the Acting as a gateway for domains on other servers heading - The only catch as far as Declude JunkMail is concerned is that IMail will treat the E-mail to the gateway domain as outgoing mail, since it is not stored on the IMail server. Therefore, by default, the outgoing actions in the \IMail\Declude\global.cfg file will be used. To get around this, you can set up per-domain configuration files for the gateway domains. However, when looking at the per domain configuration it does not say anything about copying in the global config where the outgoing tests are specified. Can you explain this in a little more depth to me? It's easier to understand if you realize that the global.cfg file serves two purposes: [1] It handles server-wide settings (such as the activation code, X- headers, etc.), and [2] It has the actions that are used for outgoing E-mail (which is handled the same way as the \IMail\Declude\$default$.JunkMail and per-user/per-domain configuration files). If there is a per-user or per-domain configuration file for a user, then Declude JunkMail will use it. Otherwise, Declude JunkMail will use the \Imail\Declude\global.cfg file (if the recipient is not on the local server - outgoing mail), or the \IMail\Declude\$default$.JunkMail file (if the recipient is on the local server - incoming mail). In your case, you can copy the \IMail\Declude\$default$.JunkMail file to \IMail\Declude\example.com\$default$.JunkMail (assuming the domain that you are acting as a gateway for is example.com). If you want, you can change any settings in that file, which will be applied only on mail to the example.com domain. Also, since you mentioned that Declude will only scan the email once. The behavior I am seeing now is that the message intended for the remote domain is being scanned inbound. Now if I enabled outgoing scanning - would it not process that mail again because it was already scanned inbound? It will still only be processed once. When the E-mail arrives, Declude JunkMail will see that it is outgoing E-mail, and either use the actions in the \IMail\Declude\global.cfg file or the per-domain settings (the \IMail\Declude\example.com\$default$.JunkMail file). It will not be scanned as incoming E-mail (even though it is technically incoming, as in it is received by the IMail server, it is not destined to a local user, so it will be scanned as an outgoing E-mail rather than an incoming E-mail). Would it use the information it already gathered from the first scan? It will only get scanned once. Here's an overview of what happens: [1] The remote mailserver connects to IMail, and gives the E-mail to IMail. [2] IMail starts Declude, which scans the E-mail [3] Declude hands the E-mail back to IMail, which delivers it (either to a local user, or via SMTP to a remote recipient). So whether the E-mail is to/from a local user, to/from a remote user, and/or backup/gateway E-mail, it will just get scanned once. The only way it would get scanned more than once is if Step 1 occurred more than once, which shouldn't happen (that could happen if you forward your mail to AOL, and then have the AOL account set to forward it back to you, for example). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
John Thanks for the follow-up. My confusion is in that Declude/Imail treat the domain I am gatewaying for as outgoing mail. Now with per domain settings it only references copying the $default$.JunkMail file to the per domain folder. However, the outgoing tests are defined in the global config. Once I enable the tests in the global config file it appears as if *ALL* outgoing mail will be scanned. This is what I want to avoid. The only outbound mail I want to scan is for the domain I provide the gateway services for. Any thoughts? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Wednesday, January 15, 2003 10:58 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Passing SPAM that should be bounced Now the manual says this under the Acting as a gateway for domains on other servers heading - The only catch as far as Declude JunkMail is concerned is that IMail will treat the E-mail to the gateway domain as outgoing mail, since it is not stored on the IMail server. Therefore, by default, the outgoing actions in the \IMail\Declude\Global.cfg file will be used. To get around this, you can set up per-domain configuration files for the gateway domains. However, when looking at the per domain configuration it does not say anything about copying in the global config where the outgoing tests are specified. Can you explain this in a little more depth to me? Darrell, if you want the settings for that domain to be different than the test actions in the Global.cfg, you need to follow this section of the manual: ### Per-Domain Configuration The Standard and Pro versions of Declude JunkMail allow you to have different settings for each domain that you have. In order to do this, you first need to create a subdirectory off of the Declude directory, with the same name as the domain you wish to change. For example, to add a per-domain configuration for example.com, you would create the directory \IMail\Declude\example.com. Note that this needs to be the official domain name, not a domain alias (so if you have a domain mail.example.com with example.com as an alias, the directory should be \IMail\Declude\mail.example.com\). The exception is that if you have a user alias, the domain you use in the alias will take priority (for example, if the alias is sales that points to [EMAIL PROTECTED], you would need to use the directory example.com). It may be necessary to use two different directories, if you have users aliases pointing to domain aliases (a quirk in IMail). The next step is to copy the $default$.JunkMail file into that directory. Then, edit that file to reflect the settings you want for that domain. Or, to quickly disable spam control for a specific domain, you can whitelist all mail to the domain by using the WHITELIST TODOMAIN @example.com setting in the Global.cfg file. Note that you should not delete the \IMail\Declude\$default$.JunkMail file. If that file does not exist, there will be no default settings for E-mail addressed to domains that do not have their own per-domain settings. ### John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
Scott, Things are starting to come together slowly now :) Correct me if I am wrong. Normally outgoing mail actions are specified in the Global.Config file. However, when using per domain settings it only looks at the actions in the $default$.JunkMail file for that domain. Thanks Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Wednesday, January 15, 2003 11:02 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Passing SPAM that should be bounced Essentially all I am doing is acting as a gateway for another domain. This way they can utilize the virus scanning and spam detection we have in place. Ah, I see now. I had thought that you were acting as a backup mailserver (in case they were down), rather than a gateway (to scan all their E-mail). What I am trying to implement is called Acting as a gateway for domains on other servers in the manual. Now from the manual and what you indicated I need to setup per domain configuration for this domain to get around the describe behavior (Declude would treat the mail as outgoing). That is correct. So if you are a gateway for the example.com domain, then you could set up a file \IMail\Declude\example.com\$default$.JunkMail that would be used for E-mail to @example.com (instead of the outgoing actions from the global.cfg file being used). Now the manual says this under the Acting as a gateway for domains on other servers heading - The only catch as far as Declude JunkMail is concerned is that IMail will treat the E-mail to the gateway domain as outgoing mail, since it is not stored on the IMail server. Therefore, by default, the outgoing actions in the \IMail\Declude\global.cfg file will be used. To get around this, you can set up per-domain configuration files for the gateway domains. However, when looking at the per domain configuration it does not say anything about copying in the global config where the outgoing tests are specified. Can you explain this in a little more depth to me? It's easier to understand if you realize that the global.cfg file serves two purposes: [1] It handles server-wide settings (such as the activation code, X- headers, etc.), and [2] It has the actions that are used for outgoing E-mail (which is handled the same way as the \IMail\Declude\$default$.JunkMail and per-user/per-domain configuration files). If there is a per-user or per-domain configuration file for a user, then Declude JunkMail will use it. Otherwise, Declude JunkMail will use the \Imail\Declude\global.cfg file (if the recipient is not on the local server - outgoing mail), or the \IMail\Declude\$default$.JunkMail file (if the recipient is on the local server - incoming mail). In your case, you can copy the \IMail\Declude\$default$.JunkMail file to \IMail\Declude\example.com\$default$.JunkMail (assuming the domain that you are acting as a gateway for is example.com). If you want, you can change any settings in that file, which will be applied only on mail to the example.com domain. Also, since you mentioned that Declude will only scan the email once. The behavior I am seeing now is that the message intended for the remote domain is being scanned inbound. Now if I enabled outgoing scanning - would it not process that mail again because it was already scanned inbound? It will still only be processed once. When the E-mail arrives, Declude JunkMail will see that it is outgoing E-mail, and either use the actions in the \IMail\Declude\global.cfg file or the per-domain settings (the \IMail\Declude\example.com\$default$.JunkMail file). It will not be scanned as incoming E-mail (even though it is technically incoming, as in it is received by the IMail server, it is not destined to a local user, so it will be scanned as an outgoing E-mail rather than an incoming E-mail). Would it use the information it already gathered from the first scan? It will only get scanned once. Here's an overview of what happens: [1] The remote mailserver connects to IMail, and gives the E-mail to IMail. [2] IMail starts Declude, which scans the E-mail [3] Declude hands the E-mail back to IMail, which delivers it (either to a local user, or via SMTP to a remote recipient). So whether the E-mail is to/from a local user, to/from a remote user, and/or backup/gateway E-mail, it will just get scanned once. The only way it would get scanned more than once is if Step 1 occurred more than once, which shouldn't happen (that could happen if you forward your mail to AOL, and then have the AOL account set to forward it back to you, for example). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail
RE: [Declude.JunkMail] Passing SPAM that should be bounced
Normally outgoing mail actions are specified in the Global.Cfg file. However, when using per domain settings it only looks at the actions in the $default$.JunkMail file for that domain. For a domain not hosted on the Imail server, yes. For a domain hosted on the Imail server, it controls the incoming mail actions only. Technically, yes. Declude JunkMail *always* uses the recipient to determine which configuration file to use. Always. So for domains hosted on the IMail server, you can't have outgoing mail. Outgoing E-mail *from* locally hosted domains will use a configuration file based on who they are sent to. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Passing SPAM that should be bounced
The headers below also came through. @uem-info.com is in my blacklist file. Any ideas? Sheldon Received: from StarGazer.TenForward.com [65.161.10.3] by tenforward.com (SMTPD32-7.13) id A2F84D620126; Wed, 15 Jan 2003 04:24:24 -0800 Received: from data.welchmedia.com (unknown [66.216.98.224]) by StarGazer.TenForward.com (Postfix Relay Hub) with ESMTP id 990F9CC9E for [EMAIL PROTECTED]; Wed, 15 Jan 2003 04:24:22 -0800 (PST) Received: (from apache@localhost) by data.welchmedia.com (8.11.6/8.11.6) id h0FCKQK08979; Wed, 15 Jan 2003 07:20:26 -0500 Date: Wed, 15 Jan 2003 07:20:26 -0500 Message-Id: [EMAIL PROTECTED] Content-type: text/html To: [EMAIL PROTECTED] From: EAM 2003 [EMAIL PROTECTED] Reply-To: EAM 2003 [EMAIL PROTECTED] Subject: Save $100 on Conference, Showcase is FREE X-RBL-Warning: DSN: Not supporting null originator (DSN) X-Note: This E-mail was scanned for spam. X-Note: This E-mail was scanned for Viruses and found clean. X-Spam-Tests-Failed: DSN X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 340686543 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Passing SPAM that should be bounced
The headers below also came through. @uem-info.com is in my blacklist file. The important question here is what the return address is, since it doesn't appear in the headers. Most likely, the return address is not @uem-info.com, but instead something like @mailer1.uem-info.com. You'll need to either use the XSENDER ON option to get the return address to appear in the headers, or look for the MAIL FROM: line in the IMail SMTP log file to find the return address. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Passing SPAM that should be bounced
Isn't there an option now to be able to block an email if the blacklist info is ANYWHERE in the header? With Declude JunkMail Pro, you can use a filter such as: HEADERS 3 CONTAINS@uem-info.com (this would need to go in a file used by a file, not the global.cfg file). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Passing SPAM that should be bounced
The important question here is what the return address is, since it doesn't appear in the headers. Most likely, the return address is not @uem-info.com, but instead something like @mailer1.uem-info.com. You'll need to either use the XSENDER ON option to get the return address to appear in the headers, or look for the MAIL FROM: line in the IMail SMTP log file to find the return address. I turned it on. Isn't there an option now to be able to block an email if the blacklist info is ANYWHERE in the header? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
Declude JunkMail *always* uses the recipient to determine which configuration file to use. Always. So for domains hosted on the IMail server, you can't have outgoing mail. Outgoing E-mail *from* locally hosted domains will use a configuration file based on who they are sent to. Thanks for the exact technical clarification. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Passing SPAM that should be bounced
It appears as if Declude is allowing mail that fails spam tests that have been funneled through our backup mail server to pass. That's because outgoing mail isn't normally scanned (with Declude JunkMail Pro, the outgoing actions in the \IMail\Declude\global.cfg file will be used). Now the Declude Logs 01/14/2003 16:20:25 Q7f136b090098ed15 Msg failed FXBLACKLIST (ID-20021207-000934). Action=IGNORE. 01/14/2003 16:20:25 Q7f136b090098ed15 Msg failed HELOBOGUS (Domain newman has no MX or A records.). Action=IGNORE. 01/14/2003 16:20:25 Q7f136b090098ed15 Msg failed WEIGHT10 (Weight of 12 reaches or exceeds the limit of 10.). Action=IGNORE. 01/14/2003 16:20:25 Q7f136b090098ed15 R1 Message OK In this case, the E-mail is outgoing E-mail, so the actions from the global.cfg file (IGNORE) are used. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
Scott, A couple of questions 1.) Since the mail was already incoming and has gone through all the spam checks inbound is there anyway to override the current behavior of discarding those results and actually have the message react to the incoming spam checks. 2.) If I can't override the default behavior, can I setup per domain outgoing processing for just this domain - even though this domain does not exist on this mail server? 3.) If it is possible to setup per domain filtering for this domain even though it does not exist on this server, Should I whitelist the incoming mail so it doesn't go through all those checks? Or is Whitelisting global in regards that it applies to both incoming and outgoing mail? Please advise on what you think would be the best course of action here. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, January 14, 2003 5:48 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Passing SPAM that should be bounced It appears as if Declude is allowing mail that fails spam tests that have been funneled through our backup mail server to pass. That's because outgoing mail isn't normally scanned (with Declude JunkMail Pro, the outgoing actions in the \IMail\Declude\global.cfg file will be used). Now the Declude Logs 01/14/2003 16:20:25 Q7f136b090098ed15 Msg failed FXBLACKLIST (ID-20021207-000934). Action=IGNORE. 01/14/2003 16:20:25 Q7f136b090098ed15 Msg failed HELOBOGUS (Domain newman has no MX or A records.). Action=IGNORE. 01/14/2003 16:20:25 Q7f136b090098ed15 Msg failed WEIGHT10 (Weight of 12 reaches or exceeds the limit of 10.). Action=IGNORE. 01/14/2003 16:20:25 Q7f136b090098ed15 R1 Message OK In this case, the E-mail is outgoing E-mail, so the actions from the global.cfg file (IGNORE) are used. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Passing SPAM that should be bounced
1.) Since the mail was already incoming and has gone through all the spam checks inbound is there anyway to override the current behavior of discarding those results and actually have the message react to the incoming spam checks. Declude JunkMail will only scan an E-mail once. E-mail can be very confusing because every E-mail handled by a mailserver is technically incoming E-mail (as in the IMail server receives it from somewhere else), whereas some of those are local deliveries and some are remote deliveries. In any case, an E-mail should only be scanned once by Declude (unless it arrives more than once). 2.) If I can't override the default behavior, can I setup per domain outgoing processing for just this domain - even though this domain does not exist on this mail server? Yes, but not the way I think you want. You can set up per-domain settings for the *recipient* domain. But, you can't set up per-domain settings for the *sender* domain. In this case, I'm guessing you would want the per-user settings for the sender domain, which isn't possible (remember, spammers love to use the same return address as the To: address). 3.) If it is possible to setup per domain filtering for this domain even though it does not exist on this server, Should I whitelist the incoming mail so it doesn't go through all those checks? Or is Whitelisting global in regards that it applies to both incoming and outgoing mail? The whitelisting applies to whatever type of whitelist it is. For example, WHITELIST IP 192.0.2.25 will whitelist E-mail coming from 192.0.2.25, no matter whether it is incoming or outgoing E-mail. Please advise on what you think would be the best course of action here. The ultimate problem seems to be that the backup mailserver isn't really a backup mailserver -- it seems to accept all E-mail, and send it out. If the backup mailserver accepts an E-mail, sends it to the primary mailserver, and then the primary mailserver sends it out to a remote location, you probably have a problem. Unless there is a good reason for this (for example, forwarding on the primary mailserver that is causing the E-mail to be sent to a remote location), you are running an open relay on the backup mailserver. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
