Re: [Declude.Virus] Whitelist
I have a filter I use for a whitelist which I give a negative weight to for certain e-mail addresses. Is there a limit of the amount of addresses that can be put into a whitelist? There is a limit of 200 WHITELIST entries in the global.cfg file for Declude JunkMail, but the filters can have an unlimited number of lines. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] WHITELIST ANYWHERE not working?
I believe this is a JunkMail question. :)) Kidding aside, I think the ANYWHERE is only good in the filter files. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.Virus- [EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Friday, September 19, 2003 12:04 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] WHITELIST ANYWHERE not working? Hi Scott: I had defined WHITELIST ANYWHERE [EMAIL PROTECTED] Yet, that only seems to whitelist messages coming FROM [EMAIL PROTECTED] - all messages sent TO [EMAIL PROTECTED] are not whitelisted: 09/19/2003 12:54:59 Q34e0014201a66fbf HELOBOGUS:3 HEUR10:4 WEIGHTFILTER:3 . Total weight = 10 09/19/2003 12:54:59 Q34e0014201a66fbf Msg failed HELOBOGUS (Domain webmail18.nyc.untd.com has no MX or A records.). Action=WARN. 09/19/2003 12:54:59 Q34e0014201a66fbf Msg failed HEUR10 (Heuristic spam detection level 10 [1.00]). Action=IGNORE. 09/19/2003 12:54:59 Q34e0014201a66fbf Msg failed WEIGHTFILTER (Message failed WEIGHTFILTER test (35)). Action=IGNORE. 09/19/2003 12:54:59 Q34e0014201a66fbf Msg failed WEIGHT10 (Total weight between 10 and 19.). Action=BOUNCE. 09/19/2003 12:54:59 Q34e0014201a66fbf Subject: MATURED BUSINESS 09/19/2003 12:54:59 Q34e0014201a66fbf From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 64.136.21.170 ID: JAF3E9X4 Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] WHITELIST ANYWHERE not working?
I had defined WHITELIST ANYWHERE [EMAIL PROTECTED] Yet, that only seems to whitelist messages coming FROM [EMAIL PROTECTED] - all messages sent TO [EMAIL PROTECTED] are not whitelisted: Does [EMAIL PROTECTED] appear in the headers or body of the E-mail? Are there any spaces/tabs after .net on the line? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] WHITELIST ANYWHERE not working?
Don't have the headers... However it is entirely possible, that the mail [EMAIL PROTECTED] only appeared in the SMTP RCPT TO: and was not contained anywhere in the headers oder the content. I changed it to WHITELIST TO, since this was what the test was doing effectively anyway - and is probably what it should have been from the start. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, September 19, 2003 03:54 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] WHITELIST ANYWHERE not working? I had defined WHITELIST ANYWHERE [EMAIL PROTECTED] Yet, that only seems to whitelist messages coming FROM [EMAIL PROTECTED] - all messages sent TO [EMAIL PROTECTED] are not whitelisted: Does [EMAIL PROTECTED] appear in the headers or body of the E-mail? Are there any spaces/tabs after .net on the line? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] WHITELIST IP address
We have SMTP mailers from our web servers that send contact forms, etc. to our mail server to send out. So, I've WHITELISTED all the IP addresses within our network. Are you referring to Declude JunkMail (Declude Virus doesn't allow whitelisting)? Today, I received an e-mail from a client that was pron spam (which they don't appreciate). Looking at the internet headers it appears as though the message was sent from our secondary mail server. It was probably queued when I rebooted the server yesterday and then when it came back, the secondary sent it to the primary and because the IP address of the secondary is WHITELISTED, it went through. With Declude JunkMail, if you use IPBYPASS 192.0.2.25 (where 192.0.2.25 is the IP address of the backup mailserver), it should take care of this situation. However, it would be better not to whitelist the backup mailserver (since that isn't what you want -- if it is whitelisted, you are saying that you want all mail from it to pass all the spam tests), to make sure that there won't be any issues in the future if anything changes in Declude JunkMail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] WHITELIST IP address
Jeff, We actually add a small weigting to all emails that pass through our backup mail server. Because 99% of everything that passes through it is Spam. And if our primary were to ever go down, it is only a small weighting that gets added to these emails, so it won't have much affect on legit mail. Bill -Original Message- From: R. Scott Perry Sent: Fri, 14 Feb 2003 08:04:42 -0500 Subject: Re: [Declude.Virus] WHITELIST IP address We have SMTP mailers from our web servers that send contact forms, etc. to our mail server to send out. So, I've WHITELISTED all the IP addresses within our network. Are you referring to Declude JunkMail (Declude Virus doesn't allow whitelisting)? Today, I received an e-mail from a client that was pron spam (which they don't appreciate). Looking at the internet headers it appears as though the message was sent from our secondary mail server. It was probably queued when I rebooted the server yesterday and then when it came back, the secondary sent it to the primary and because the IP address of the secondary is WHITELISTED, it went through. With Declude JunkMail, if you use IPBYPASS 192.0.2.25 (where 192.0.2.25 is the IP address of the backup mailserver), it should take care of this situation. However, it would be better not to whitelist the backup mailserver (since that isn't what you want -- if it is whitelisted, you are saying that you want all mail from it to pass all the spam tests), to make sure that there won't be any issues in the future if anything changes in Declude JunkMail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] WHITELIST IP address
So with IPBYPASS xxx.xxx.xxx.xxx in the Global.Cfg, it will tell Declude Junkmail that even though this IP is whitelisted, still run the spam tests on any message from it. Also, is there a Declude Junkmail list? I'm sorry if there is and I posted this on the Virus mailer.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Friday, February 14, 2003 8:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] WHITELIST IP address We have SMTP mailers from our web servers that send contact forms, etc. to our mail server to send out. So, I've WHITELISTED all the IP addresses within our network. Are you referring to Declude JunkMail (Declude Virus doesn't allow whitelisting)? Today, I received an e-mail from a client that was pron spam (which they don't appreciate). Looking at the internet headers it appears as though the message was sent from our secondary mail server. It was probably queued when I rebooted the server yesterday and then when it came back, the secondary sent it to the primary and because the IP address of the secondary is WHITELISTED, it went through. With Declude JunkMail, if you use IPBYPASS 192.0.2.25 (where 192.0.2.25 is the IP address of the backup mailserver), it should take care of this situation. However, it would be better not to whitelist the backup mailserver (since that isn't what you want -- if it is whitelisted, you are saying that you want all mail from it to pass all the spam tests), to make sure that there won't be any issues in the future if anything changes in Declude JunkMail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] WHITELIST IP address
So with IPBYPASS xxx.xxx.xxx.xxx in the Global.Cfg, it will tell Declude Junkmail that even though this IP is whitelisted, still run the spam tests on any message from it. No. The IPBYPASS just tells Declude JunkMail to bypass that IP, and instead scan the next IP address. So if you use IPBYPASS with the IP of your backup mailserver, Declude JunkMail will scan E-mail based on the IP address of the mailserver that sent the mail to your backup mailserver. The IPBYPASS option has nothing to do with whitelisting. But, it should have the side effect of counteracting the whitelisting of the IP address of the backup mailserver (which is only there for convenience). Also, is there a Declude Junkmail list? I'm sorry if there is and I posted this on the Virus mailer.. Yes -- you can send an E-mail to [EMAIL PROTECTED] with subscribe declude.junkmail your name in the body. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
Re: [Declude.Virus] Whitelist single IP
If I remember correctly on 1/6/03 8:54 AM Jeff Maze - Hostmaster wrote: I was wondering how exactly I can whitelist a single IP address. I tried adding it to the conf file, but it not working. I'm running declude v1.65 How did you add it? In the Global.cfg file I have successfully added several Ips to be ignored. Syntax is: whitelist IP 123.456.789 Regards, -Don Affirmation of Arrogance -- There is no I in team... but there is in WIN, CHAMPION, and RING === Don Wolff- Technology Coordinator Phoenix-Talent School District #4 mailto:[EMAIL PROTECTED] Office- 541-535-0200 Mobile- 541-621-4717 FAX-541-535-7552 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
RE: [Declude.Virus] Whitelist single IP
Hmm.. Ok, that's what I thought I added.. Changed it again, rebooted, now just waiting to see if the problem occurs again.. Thanks.. Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Don Wolff Sent: Monday, January 06, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Whitelist single IP If I remember correctly on 1/6/03 8:54 AM Jeff Maze - Hostmaster wrote: I was wondering how exactly I can whitelist a single IP address. I tried adding it to the conf file, but it not working. I'm running declude v1.65 How did you add it? In the Global.cfg file I have successfully added several Ips to be ignored. Syntax is: whitelist IP 123.456.789 Regards, -Don Affirmation of Arrogance -- There is no I in team... but there is in WIN, CHAMPION, and RING === Don Wolff- Technology Coordinator Phoenix-Talent School District #4 mailto:[EMAIL PROTECTED] Office- 541-535-0200 Mobile- 541-621-4717 FAX-541-535-7552 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.Virus.The archives can be found at http://www.mail-archive.com.
