RE: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Hi, Imail will call Declude AFTER it has completely received the message. That means you're stuck with all these junk messages. The best you can do is DELETE or HOLD them, but only AFTER you scanned them all. So with Imail+Declude you are only saving the time it takes to deliver the message into a mailbox. But, that's probably not a net saving in processor time, because I would guess it takes AT LEAST at much time to scan a message and perform all these tests that it would have taken to move the message into a mailbox. Declude is not meant to save processing cycles, it's meant to reduce work hours spent by end users reading/handling spam message. If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of netsolution webmaster Sent: Tuesday, November 14, 2006 10:49 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config Hello Thanks for your answer. So I understand it can not be done to reject invalid senders simply by using Declude/Imail? I really need another product? Also another question: I use per domain configuration for Junkmail - can it be configured so that it only performs the tests on mails that go to a domain that has been set up with a configuration folder? It seems like declude is doing the tests on all mails which uses more ressources than doing the tests only when required (as defined in per domain config) Thanks Andy Schmidt schrieb: Hi, Basically, you should put a mail gateway in front of your mail server that can integrate your list of valid email recipients and that can refuse most of your messages based on your anti-spam and anti-virus policies. One option would be to run Declude's own gateway product. However, to me a crucial element of a gateway is that it MUST reject messages DURING the SMTP envelope (e.g., after the data is received but before the receipt is confirmed with a 2xx.). This way, the gateway can refuse unwanted messages with a 5xx (or 4xx) return code and the SENDING SMTP server will inform its user. It is an absolute must in case of the occasional false positive. At least a good sender will be notified that there's a problem with their email. If a gateway first accepts messages and THEN scans them, it would need to generate bounce messages AFTER the fact. The result is a very high likelihood that your system will be spamming innocent email users whose address had been faked. I simply can't consider any gateway product that doesn't do spam/virus rejection DURING the SMTP envelope! One alternative could be to set up IIS SMTP on one of your machines, point your MX there, purchase ORF and then integrate it with Sniffer so that it can reject the vast majority of your spam. If you also bring your list of valid email recipients over to that IIS/ORF/Sniffer gateway, then you can reject invalid recipients (e.g., dictionary attacks) at that machine, instead of tying up Imail with that. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of netsolution webmaster Sent: Tuesday, November 14, 2006 09:59 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] delete mails before processing / 100% CPU With the massive amount of spam mail our server has difficulties to process everything in time, since two days we are on 100% CPU and customers have difficulties with pop/imap speed (before everything was ok). What ways are there to - refuse mails that have no valid recipient on the mailserver (not bounce, just refuse/drop) so they need no more processing? - refuse/drop mails that don't pass certain tests (eg. spamcop or sniffer)? OR what other methods could speed up things? We have older versions of declude /imail server (8.15) Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
In addition to the other good suggestions here, check to be sure you do not have a nobody alias anywhere on your system. Just one nobody alias on a domain that is being attacked can kill the whole server. If you find any, delete them. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Unfortunately not. Any test that is defined in your global.cfg file will be run against all message recieved. Your $default.junkmail file simply tells Declude what to do with the message based upon the results of those tests. Dean On 11/14/06, netsolution webmaster [EMAIL PROTECTED] wrote: Hello Thanks for your answer. So I understand it can not be done to reject invalid senders simply by using Declude/Imail? I really need another product? Also another question: I use per domain configuration for Junkmail - can it be configured so that it only performs the tests on mails that go to a domain that has been set up with a configuration folder? It seems like declude is doing the tests on all mails which uses more ressources than doing the tests only when required (as defined in per domain config) Thanks Andy Schmidt schrieb: Hi, Basically, you should put a mail gateway in front of your mail server that can integrate your list of valid email recipients and that can refuse most of your messages based on your anti-spam and anti-virus policies. One option would be to run Declude's own gateway product. However, to me a crucial element of a gateway is that it MUST reject messages DURING the SMTP envelope (e.g., after the data is received but before the receipt is confirmed with a 2xx.). This way, the gateway can refuse unwanted messages with a 5xx (or 4xx) return code and the SENDING SMTP server will inform its user. It is an absolute must in case of the occasional false positive. At least a good sender will be notified that there's a problem with their email. If a gateway first accepts messages and THEN scans them, it would need to generate bounce messages AFTER the fact. The result is a very high likelihood that your system will be spamming innocent email users whose address had been faked. I simply can't consider any gateway product that doesn't do spam/virus rejection DURING the SMTP envelope! One alternative could be to set up IIS SMTP on one of your machines, point your MX there, purchase ORF and then integrate it with Sniffer so that it can reject the vast majority of your spam. If you also bring your list of valid email recipients over to that IIS/ORF/Sniffer gateway, then you can reject invalid recipients (e.g., dictionary attacks) at that machine, instead of tying up Imail with that. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of netsolution webmaster Sent: Tuesday, November 14, 2006 09:59 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] delete mails before processing / 100% CPU With the massive amount of spam mail our server has difficulties to process everything in time, since two days we are on 100% CPU and customers have difficulties with pop/imap speed (before everything was ok). What ways are there to - refuse mails that have no valid recipient on the mailserver (not bounce, just refuse/drop) so they need no more processing? - refuse/drop mails that don't pass certain tests (eg. spamcop or sniffer)? OR what other methods could speed up things? We have older versions of declude /imail server (8.15) Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Hello Thanks for your answer. So I understand it can not be done to reject invalid senders simply by using Declude/Imail? I really need another product? Also another question: I use per domain configuration for Junkmail - can it be configured so that it only performs the tests on mails that go to a domain that has been set up with a configuration folder? It seems like declude is doing the tests on all mails which uses more ressources than doing the tests only when required (as defined in per domain config) Thanks Andy Schmidt schrieb: Hi, Basically, you should put a mail gateway in front of your mail server that can integrate your list of valid email recipients and that can refuse most of your messages based on your anti-spam and anti-virus policies. One option would be to run Declude's own gateway product. However, to me a crucial element of a gateway is that it MUST reject messages DURING the SMTP envelope (e.g., after the data is received but before the receipt is confirmed with a 2xx.). This way, the gateway can refuse unwanted messages with a 5xx (or 4xx) return code and the SENDING SMTP server will inform its user. It is an absolute must in case of the occasional false positive. At least a good sender will be notified that there's a problem with their email. If a gateway first accepts messages and THEN scans them, it would need to generate bounce messages AFTER the fact. The result is a very high likelihood that your system will be spamming innocent email users whose address had been faked. I simply can't consider any gateway product that doesn't do spam/virus rejection DURING the SMTP envelope! One alternative could be to set up IIS SMTP on one of your machines, point your MX there, purchase ORF and then integrate it with Sniffer so that it can reject the vast majority of your spam. If you also bring your list of valid email recipients over to that IIS/ORF/Sniffer gateway, then you can reject invalid recipients (e.g., dictionary attacks) at that machine, instead of tying up Imail with that. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of netsolution webmaster Sent: Tuesday, November 14, 2006 09:59 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] delete mails before processing / 100% CPU With the massive amount of spam mail our server has difficulties to process everything in time, since two days we are on 100% CPU and customers have difficulties with pop/imap speed (before everything was ok). What ways are there to - refuse mails that have no valid recipient on the mailserver (not bounce, just refuse/drop) so they need no more processing? - refuse/drop mails that don't pass certain tests (eg. spamcop or sniffer)? OR what other methods could speed up things? We have older versions of declude /imail server (8.15) Thanks --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. ASSP is a great addition to an overworked Imail/Declude server and will reduce the amount of email that server has to cope with. It is free and will run on the same server as Imail/Declude or on another spare box under Windows or Linux. It will do envelope rejection of invalid recipients, invalid senders, invalid HELO, etc. It is very configurable, and will even do automatic blacklisting of IP's that misbehave. It also has an active development group. see: http://assp.sourceforge.net/ http://www.asspsmtp.org/wiki/Welcome http://en.wikipedia.org/wiki/Anti-Spam_SMTP_Proxy Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Does anyone know if it works with smartermail? It is not listed on the site, but says other standard smtp servers Herb Doug Traylor wrote: If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. ASSP is a great addition to an overworked Imail/Declude server and will reduce the amount of email that server has to cope with. It is free and will run on the same server as Imail/Declude or on another spare box under Windows or Linux. It will do envelope rejection of invalid recipients, invalid senders, invalid HELO, etc. It is very configurable, and will even do automatic blacklisting of IP's that misbehave. It also has an active development group. see: http://assp.sourceforge.net/ http://www.asspsmtp.org/wiki/Welcome http://en.wikipedia.org/wiki/Anti-Spam_SMTP_Proxy Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Actually it would work with smartermail according to smartermail forum messages, but some of the comments on the smartermail forum state that folks had stability problems with it. The posts are 1 - 2 years old so may be better now. Herb Doug Traylor wrote: If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. ASSP is a great addition to an overworked Imail/Declude server and will reduce the amount of email that server has to cope with. It is free and will run on the same server as Imail/Declude or on another spare box under Windows or Linux. It will do envelope rejection of invalid recipients, invalid senders, invalid HELO, etc. It is very configurable, and will even do automatic blacklisting of IP's that misbehave. It also has an active development group. see: http://assp.sourceforge.net/ http://www.asspsmtp.org/wiki/Welcome http://en.wikipedia.org/wiki/Anti-Spam_SMTP_Proxy Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Sounds good - do you have more details (short instructions) on how to set that up combined with declude/imail? Thanks! Doug Traylor schrieb: If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. ASSP is a great addition to an overworked Imail/Declude server and will reduce the amount of email that server has to cope with. It is free and will run on the same server as Imail/Declude or on another spare box under Windows or Linux. It will do envelope rejection of invalid recipients, invalid senders, invalid HELO, etc. It is very configurable, and will even do automatic blacklisting of IP's that misbehave. It also has an active development group. see: http://assp.sourceforge.net/ http://www.asspsmtp.org/wiki/Welcome http://en.wikipedia.org/wiki/Anti-Spam_SMTP_Proxy Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
On 11/14/06, Herb Guenther [EMAIL PROTECTED] wrote: Actually it would work with smartermail according to smartermail forum messages, but some of the comments on the smartermail forum state that folks had stability problems with it. The posts are 1 - 2 years old so may be better now. ASSP is a proxy. It sits in front of _any_ SMTP server service. It does _not_ do store and forward and is therefore not a gateway. It can work in concert with another SMTP server service to perform gateway service to an existing Imail site. I am using ASSP feeding hMailserver which then hands off to a couple of Imail servers. hMailserver is functioning as one of my SMTP antivirus scanners in that it integrates with SOSDG Clam AV clamd service and is very fast and does not have any domains defined in it except in the routing section. hMailserver then routes the email to one of my Imail servers based on recipient domain. In my experience, ASSP, hMailserver, and Imail together are completely stable and I have been using them for years. ASSP does not currently support SSL/TLS but will work with standard SMTP auth and can listen on multiple ports. Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
On 11/14/06, netsolution webmaster [EMAIL PROTECTED] wrote: Sounds good - do you have more details (short instructions) on how to set that up combined with declude/imail? Hah! Me? Short instructions? I can't give short instructions on how to tie a shoe! :o) Setting up ASSP/hMailserver/ClamAV/Imail/Declude will be a fairly long process with the good news that not much has to change for your Imail/Declude setup except the listen port and the SMTP delivery gateway:port. If you add hMailserver as a gateway and use Declude Junkmail to do connection based analysis (spf, rbl, helo, etc.) using the sending IP, you will be disappointed to find the the sending IP will now be your own server and unless you have the premium version of Declude Junkmail it will no longer be useful to compare the sending IP. I believe the premium version of Declude will look at all the IP's in the path and potentially exclude your servers. Not sure about that one. The good news is that with ASSP in front, you may not miss it. Using ASSP alone in front of Imail/Declude should allow Declude connection tests to continue to work. Since this is a Declude list I will spare the other members the horror of reading about another product's installation steps and send you a synopsis directly to your list address if that is OK. For those interested, I say check out the links in my earlier post for ASSP, www.hmailserver.com for that and http://www.sosdg.org/clamav-win32/ for ClamAV on Windows. and once installed, to integrate clamav with hmailserver; http://www.hmailserver.com/forum/viewtopic.php?t=2139 Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Yes, Declude can look at all the IPs in the connecting path. Or it can just skip you IPs and look at the connecting IP so many hops away. Kevin -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug Traylor Sent: Tuesday, November 14, 2006 2:08 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config On 11/14/06, netsolution webmaster [EMAIL PROTECTED] wrote: Sounds good - do you have more details (short instructions) on how to set that up combined with declude/imail? Hah! Me? Short instructions? I can't give short instructions on how to tie a shoe! :o) Setting up ASSP/hMailserver/ClamAV/Imail/Declude will be a fairly long process with the good news that not much has to change for your Imail/Declude setup except the listen port and the SMTP delivery gateway:port. If you add hMailserver as a gateway and use Declude Junkmail to do connection based analysis (spf, rbl, helo, etc.) using the sending IP, you will be disappointed to find the the sending IP will now be your own server and unless you have the premium version of Declude Junkmail it will no longer be useful to compare the sending IP. I believe the premium version of Declude will look at all the IP's in the path and potentially exclude your servers. Not sure about that one. The good news is that with ASSP in front, you may not miss it. Using ASSP alone in front of Imail/Declude should allow Declude connection tests to continue to work. Since this is a Declude list I will spare the other members the horror of reading about another product's installation steps and send you a synopsis directly to your list address if that is OK. For those interested, I say check out the links in my earlier post for ASSP, www.hmailserver.com for that and http://www.sosdg.org/clamav-win32/ for ClamAV on Windows. and once installed, to integrate clamav with hmailserver; http://www.hmailserver.com/forum/viewtopic.php?t=2139 Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
