RE: Message Filtering
Maybe it's just late but I don't understand how @ew01.com would also block the subdomains of that domain. -Ben- Ben M. Schorr Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 06:45 To: Exchange Discussions Subject: RE: Message Filtering Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject:RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent
RE: Message Filtering
That was my point as well - but apparently that's the way the functionality works. I'd call that a bug, but as Ex5.5 is close to end of life, I highly doubt its gonna get fixed. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Ben Schorr [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:04 AM To: Exchange Discussions Subject: RE: Message Filtering Maybe it's just late but I don't understand how @ew01.com would also block the subdomains of that domain. -Ben- Ben M. Schorr Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 06:45 To: Exchange Discussions Subject: RE: Message Filtering Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject: RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject: RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original
RE: Message Filtering
Ben / Roger, I can only take a guess that they set the logic up so that the entry @domainname.com would by default block that domain and every subdomain below it. If you wanted to let subdomains through, you would have to explicitly block the ones you don't want through. For example: 1. There is 1 primary domain and 4 subdomains: domain.com, sub1.domain.com, sub2.domain.com, sub3.domain.com, sub4.domain.com 2. You are getting spam from the primary domain and subdomains 2 and 4. 3. So in your block list, you would have: [EMAIL PROTECTED] @sub2.domain.com @sub4.domain.com 4. It will now block those three domain names and let sub1.domain.com and sub3.domain.com through. ~Jim -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:29 AM To: Exchange Discussions Subject: RE: Message Filtering That was my point as well - but apparently that's the way the functionality works. I'd call that a bug, but as Ex5.5 is close to end of life, I highly doubt its gonna get fixed. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Ben Schorr [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:04 AM To: Exchange Discussions Subject: RE: Message Filtering Maybe it's just late but I don't understand how @ew01.com would also block the subdomains of that domain. -Ben- Ben M. Schorr Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 06:45 To: Exchange Discussions Subject: RE: Message Filtering Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject: RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc
RE: Message Filtering
I guess I look at it from the Unix side of things[1], in which blocking @domain.com doesn't block anything but @domain.com - @mail.domain.com would still work. In order to subdomain block, it's a simple matter of adding a wildcard - @*.domain.com That's the way Sendmail, smtpd and postfix all seem to work, from what I've seen. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. [1] I'm predominantly an MS admin, but we use Unix stuff for most mail relays outside of Exchange -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 12:50 PM To: Exchange Discussions Subject: RE: Message Filtering Ben / Roger, I can only take a guess that they set the logic up so that the entry @domainname.com would by default block that domain and every subdomain below it. If you wanted to let subdomains through, you would have to explicitly block the ones you don't want through. For example: 1. There is 1 primary domain and 4 subdomains: domain.com, sub1.domain.com, sub2.domain.com, sub3.domain.com, sub4.domain.com 2. You are getting spam from the primary domain and subdomains 2 and 4. 3. So in your block list, you would have: [EMAIL PROTECTED] @sub2.domain.com @sub4.domain.com 4. It will now block those three domain names and let sub1.domain.com and sub3.domain.com through. ~Jim -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:29 AM To: Exchange Discussions Subject: RE: Message Filtering That was my point as well - but apparently that's the way the functionality works. I'd call that a bug, but as Ex5.5 is close to end of life, I highly doubt its gonna get fixed. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Ben Schorr [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:04 AM To: Exchange Discussions Subject: RE: Message Filtering Maybe it's just late but I don't understand how @ew01.com would also block the subdomains of that domain. -Ben- Ben M. Schorr Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 06:45 To: Exchange Discussions Subject: RE: Message Filtering Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain
RE: Message Filtering
When I first started using that feature, the wildcard syntax is the way I expected it to work at first as well. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 10:01 AM To: Exchange Discussions Subject: RE: Message Filtering I guess I look at it from the Unix side of things[1], in which blocking @domain.com doesn't block anything but @domain.com - @mail.domain.com would still work. In order to subdomain block, it's a simple matter of adding a wildcard - @*.domain.com That's the way Sendmail, smtpd and postfix all seem to work, from what I've seen. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. [1] I'm predominantly an MS admin, but we use Unix stuff for most mail relays outside of Exchange -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 12:50 PM To: Exchange Discussions Subject: RE: Message Filtering Ben / Roger, I can only take a guess that they set the logic up so that the entry @domainname.com would by default block that domain and every subdomain below it. If you wanted to let subdomains through, you would have to explicitly block the ones you don't want through. For example: 1. There is 1 primary domain and 4 subdomains: domain.com, sub1.domain.com, sub2.domain.com, sub3.domain.com, sub4.domain.com 2. You are getting spam from the primary domain and subdomains 2 and 4. 3. So in your block list, you would have: [EMAIL PROTECTED] @sub2.domain.com @sub4.domain.com 4. It will now block those three domain names and let sub1.domain.com and sub3.domain.com through. ~Jim -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:29 AM To: Exchange Discussions Subject: RE: Message Filtering That was my point as well - but apparently that's the way the functionality works. I'd call that a bug, but as Ex5.5 is close to end of life, I highly doubt its gonna get fixed. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Ben Schorr [mailto:[EMAIL PROTECTED] Sent: Thursday, August 28, 2003 4:04 AM To: Exchange Discussions Subject: RE: Message Filtering Maybe it's just late but I don't understand how @ew01.com would also block the subdomains of that domain. -Ben- Ben M. Schorr Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 06:45 To: Exchange Discussions Subject: RE: Message Filtering Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday
RE: Message Filtering
Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject:RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using
RE: Message Filtering
Guessing by those rules, @ew01.com -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 10:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject: RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject: RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com
RE: Message Filtering
Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject:RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks
RE: Message Filtering
Jim, Send them to me so I can block also.. Please!!! So I want to block @ew01.com Okay I will try that. Thanks. Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 11:45 AM To: Exchange Discussions Subject: RE: Message Filtering Mike, I have blocked that EXACT domain already by using: @ew01.com ~Jim P.S. - I only have about 3,000 domain names in our company block list. Every one of them *verified* spammers. ;0) -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 7:05 AM To: Exchange Discussions Subject: RE: Message Filtering Jim, Thanks for the book reference. I will run out and get it. I was trying to block Neena [EMAIL PROTECTED], and I used ew01.com and that didn't block it. According to the rules, how would you have blocked this junk mail? Thanks, Mike -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 11:37 AM To: Exchange Discussions Subject: RE: Message Filtering Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject:RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering
RE: Message Filtering
My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject: Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject:Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl? enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchanget ext_mode= lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject: RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject: Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl? enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchanget ext_mode= lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=la ng =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=la ng =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED
RE: Message Filtering
Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject:Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl? enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchanget ext_mode= lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchanget ext_mode= lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List
RE: Message Filtering
Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject:RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject:Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike
RE: Message Filtering
Roger, I posted this earlier in the thread...maybe you missed it: Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So Nate's response was spot on. Jim Blunt E-mail Admin Network Infrastructure Group Bechtel Hanford, Inc. -Original Message- From: Roger Seielstad [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 8:07 AM To: Exchange Discussions Subject: RE: Message Filtering Hmm - I have no problem with you saying it works that way (haven't been able to try it) but that's not the way I would expect it to work - I would expect it to be more restrictive in how it blocks, so @ivy.com only blocks @ivy.com. That's pretty standard practice in other MTA's I've used over the years, which is why it seems a little out of whack. -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:43 AM To: Exchange Discussions Subject: RE: Message Filtering Then can you explain why I can enter @fr or @biz and the server blocks anything that ends with .fr or .biz. Doesn't this qualify as blocking any domain or subdomain that ends with these? It seems to me that it does. -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 9:34 AM To: Exchange Discussions Subject:RE: Message Filtering Actually, that doesn't support what you're saying. To prevent all users in a specific domain from delivering messages to your site, type the domain name in the following format: @domainname.com Ivy.com and mail.ivy.com are two, distinct domains, and therefore blocking @ivy.com should not implicitly block @mail.ivy.com. I'd be interested to know that it blocks subdomains that it is not explicitly told to block, though. That's quite a bug. Roger -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:14 AM To: Exchange Discussions Subject: RE: Message Filtering Check out Q245465 for Exchange 5.5. It backs up what I said earlier. I have used this successfully on the Exchange 5.5 setups I have managed. Nate Couch EDS messaging -- From: Roger Seielstad Reply To: Exchange Discussions Sent: Tuesday, August 26, 2003 6:14 AM To: Exchange Discussions Subject:RE: Message Filtering You'd have to block it as 'ivy.net', not '@ivy.net' -- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 7:31 PM To: Exchange Discussions Subject: RE: Message Filtering My understanding of reading through the help file is that if you block @ivy.net all of the subdomains are blocked as well. -Original Message- From: Fyodorov, Andrey [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 3:35 PM To: Exchange Discussions Subject: RE: Message Filtering Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions
RE: Message Filtering
You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject: Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject: Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Two stars (**) would be an overkill -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 4:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject: Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Mike, Get a good Exchange book and read it. Paul Robichaux's Managing MS Exchange Server, Chapter 8, pg 294, bottom of the page: @foe.com - reject mail from foe.com or any subdomain [EMAIL PROTECTED] - reject mail from foe.com, but not a.foe.com So...Nate's response was right on the money. -Original Message- From: Mitchell Mike [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 1:24 PM To: Exchange Discussions Subject: RE: Message Filtering Nate, I don't understand what you are saying? I know I can block full domains (@yahoo.com) but what I want is to block @**.ivy.net for @01.ivy.net and @02.ivy.net You see the suffix is .ivy.net but the prefix is 01 and 02... Thanks, Mike -Original Message- From: Couch, Nate [mailto:[EMAIL PROTECTED] Sent: Monday, August 25, 2003 2:18 PM To: Exchange Discussions Subject: RE: Message Filtering You can wildcard your filters for domains. On the IMS under Message Filtering you can enter domains using the @domain.com (.net, etc.) You can filter a whole country in a similar fashion by using @fr (for France) For example. Regards. Nate Couch EDS Messaging -- From: Mitchell Mike Reply To: Exchange Discussions Sent: Monday, August 25, 2003 1:50 PM To: Exchange Discussions Subject: Message Filtering Greetings, Outlook 98 Exchange 5.5 Windows 2000 Is there any way to use a wildcard when doing messaging filtering on Exchange 5.5 Admin? (Connections, IMS, Connections, message filtering) We are trying to filter eMAIL using this feature and there are several domains that are the same except for a few characters. What is the limit of number of sites you can block? Thanks, Mike Mitchell Systems email Administrator Alverno Information Services * [EMAIL PROTECTED] *:(317) 783-9341 EXT. 6211 Education is when you read the fine print, experience is what you get when you don't! - Pete Seeger _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode =la ng=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
Re: Message filtering
I would say with a third party application. - Original Message - From: Diop [EMAIL PROTECTED] To: Exchange Discussions [EMAIL PROTECTED] Sent: Wednesday, June 04, 2003 8:27 AM Subject: Message filtering I´m runnning Exchange 5.5 How to prevent all uusers in specific domain from delivering message to my site BUT allow only 2 users from that domain. Thank _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchangetext_mode=lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Dont worry .. I worked it out for myself ! (Restart the IS if anyones interested !) -Original Message- From: Darren Ash [SMTP:[EMAIL PROTECTED]] Sent: 16 July 2002 08:50 To: Exchange Discussions Subject: Message Filtering Ex 5.5 SP4 NT4 SP6a I had message filtering blocking all incoming mail from blueyonder.co.uk I have now removed this filter and restarted to IMS but messages sent from blueyonder are still being thrown in the turf dir. Any ideas anyone Coolchain LtdCoolchain Ltd London Road Henley Road Teynham Paddock Wood Kent Kent ME9 9PR TN12 6DN Tel: 01795 523200Tel: 01892 831400 Fax: 01795 523241Fax: 01892 831451 All business is conducted in accordance with the company's terms and conditions, a copy of which is available on request. For the avoidance of doubt, all orders initiated by ourselves must be signed by an authorised signatory of this company. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] Coolchain LtdCoolchain Ltd London Road Henley Road Teynham Paddock Wood Kent Kent ME9 9PR TN12 6DN Tel: 01795 523200Tel: 01892 831400 Fax: 01795 523241Fax: 01892 831451 All business is conducted in accordance with the company's terms and conditions, a copy of which is available on request. For the avoidance of doubt, all orders initiated by ourselves must be signed by an authorised signatory of this company. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Hey, only his *very* close friends get to call AB Martini! -Original Message- From: Tim Tullis [mailto:[EMAIL PROTECTED]] Sent: 09 July 2002 20:17 To: Exchange Discussions Subject: RE: Message filtering Very Good! Martini's @ Milliways after work? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 2:16 PM To: Exchange Discussions Subject: RE: Message filtering 42 -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:13 AM To: Exchange Discussions Subject: RE: Message filtering 203.199.81.81 -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 12:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.373 / Virus Database: 208 - Release Date: 7/1/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.373 / Virus Database: 208 - Release Date: 7/1/2002 _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] This e-mail has been scanned for all viruses by Star Internet. The information in this communication and any attachments is confidential and may be legally privileged. It is intended solely for the addressee. If you are not the intended recipient any use, review, dissemination, distribution or copying of this information is strictly prohibited. If you have received
RE: Message filtering
Yes you can, at least up to a limit. I usually go to http://www.arin.net/whois/ first, although you might skip this step since you already probably know they are in Asia. You could skip straight to http://www.apnic.net/ and go into their Whois feature to look up the owner of the IP address 203.199.81.81. That will tell you that the message is definitely coming from vsnl.net. Beyond that, you will have to contact vsnl's admins and ask them which user has that IP address. -- be - MOS Academy: A modern school where football is taught. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Thank you all for your contribution. Certainly helps... -Original Message- From: East, Bill [mailto:[EMAIL PROTECTED]] Sent: Wednesday, July 10, 2002 9:51 AM To: Exchange Discussions Subject: RE: Message filtering Yes you can, at least up to a limit. I usually go to http://www.arin.net/whois/ first, although you might skip this step since you already probably know they are in Asia. You could skip straight to http://www.apnic.net/ and go into their Whois feature to look up the owner of the IP address 203.199.81.81. That will tell you that the message is definitely coming from vsnl.net. Beyond that, you will have to contact vsnl's admins and ask them which user has that IP address. -- be - MOS Academy: A modern school where football is taught. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
I have used message filtering to filter out the domains from where the spam is originating. I have read about the TURF directory and have implemented the registry settings to C:\Exchsrvr\Imcdata\Turfdir But do I need to create this folder first or does Exchange automatically create the folder the first time a mail message matching the filtered list comes in. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Wednesday, July 10, 2002 2:02 PM To: Exchange Discussions Subject: RE: Message filtering Thank you all for your contribution. Certainly helps... -Original Message- From: East, Bill [mailto:[EMAIL PROTECTED]] Sent: Wednesday, July 10, 2002 9:51 AM To: Exchange Discussions Subject: RE: Message filtering Yes you can, at least up to a limit. I usually go to http://www.arin.net/whois/ first, although you might skip this step since you already probably know they are in Asia. You could skip straight to http://www.apnic.net/ and go into their Whois feature to look up the owner of the IP address 203.199.81.81. That will tell you that the message is definitely coming from vsnl.net. Beyond that, you will have to contact vsnl's admins and ask them which user has that IP address. -- be - MOS Academy: A modern school where football is taught. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Put it in as @vsnl.net That will chop everything from vsnl.net and any subdomains it might have. Note: One thing I have found that appears to work like a champ is if you want to kill all email from a country you can enter @ru and kill all email from Russia. Make sure that you don't have a real need for receiving email from said country. Nate Couch EDS Messaging -- From: RBHATIA Reply To: [EMAIL PROTECTED] Sent: Tuesday, July 9, 2002 11:28 To: [EMAIL PROTECTED] Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Maybe I'm missing something here, but if there are people in that domain who work closely with your company, how can you possibly get away with blocking the entire domain? -Peter -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 9:28 To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] __ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Which AV package are you using? Perhaps it can be persuaded to stop the entire message, rather than just the attachment. -Peter -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 10:28 To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] __ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
203.199.81.81 -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 12:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
42 -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:13 AM To: Exchange Discussions Subject: RE: Message filtering 203.199.81.81 -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 12:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
That might be the answer, but what is the question -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: 09 July 2002 19:16 To: Exchange Discussions Subject: RE: Message filtering 42 -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:13 AM To: Exchange Discussions Subject: RE: Message filtering 203.199.81.81 -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 12:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Very Good! Martini's @ Milliways after work? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 2:16 PM To: Exchange Discussions Subject: RE: Message filtering 42 -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:13 AM To: Exchange Discussions Subject: RE: Message filtering 203.199.81.81 -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 12:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.373 / Virus Database: 208 - Release Date: 7/1/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.373 / Virus Database: 208 - Release Date: 7/1/2002 _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message filtering
Bombay sapphire anyone? -Original Message- From: Tim Tullis [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 3:17 PM To: Exchange Discussions Subject: RE: Message filtering Very Good! Martini's @ Milliways after work? -Original Message- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 2:16 PM To: Exchange Discussions Subject: RE: Message filtering 42 -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:13 AM To: Exchange Discussions Subject: RE: Message filtering 203.199.81.81 -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 12:28 PM To: Exchange Discussions Subject: RE: Message filtering I do have anti-virus software and it is trapping and quarantining the messages. But that doesn't stop the spoofed email from coming in. I would like to find out the source of the infection - who is the user who has been infected. Can I tell from the message header attached below ? -Original Message- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 1:25 PM To: Exchange Discussions Subject: RE: Message filtering First I'd change my DL SMTP addresses to something non-obvious. Then I'd implement an antivirus solution which could be configured to drop worms. -Original Message- From: RBHATIA [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 09, 2002 11:28 AM To: Exchange Discussions Subject: Message filtering We're being hit big time by the KLEZ virus. Here is one of the messages that was sent. I've checked everyone's machines and everyone seems clear. So I'm guessing it's someone who works closely with our company as we have emails floating back and forth between staff who claim they never sent each other email. What if I set up the message filtering option on the Internet Mail Connector to block the domain smtp02.vsnl.net and smtp03.vsnl.net since those seem to be the 2 main sources from where the emails are originating. Also, how do I insert the entry ? Do I enter it as @smtp02.vsnl.net ? Received: from smtp02.vsnl.net ([203.197.12.8]) by myserver.mycompany.com with SMTP (Microsoft Exchange ) id 31VYJYRC; Mon, 8 Jul 2002 04:14:50 -0400 Received: from Qrvlyi ([203.199.81.81]) by smtp02.vsnl.net (Netscape Messaging Server 4.15) with SMTP id GYX8GJ00.Z9D for [EMAIL PROTECTED]; Mon, 8 Jul 2002 13:49:31 +0530 From: staff [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: . _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.373 / Virus Database: 208 - Release Date: 7/1/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.373 / Virus Database: 208 - Release Date: 7/1/2002 _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Its still not going to work. That particular filter only works on the From header entry, which is not the problem. You're trying to filter a relay machine using from address. Same place in the IMC, but rather than using Message Filter, select Specify By Host and add that IP address, then set it to reject connections. Probably have to bounce the IMC afterwords. Roger -- Roger D. Seielstad - MCSE Sr. Systems Administrator Peregrine Systems Atlanta, GA -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 6:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- -- -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == == == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ
RE: Message Filtering
I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
RE: Message Filtering
Something like Bad Spammy go bye bye Why that not work? -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
RE: Message Filtering
Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you
RE: Message Filtering
How about just the IP address w/o the @ or perhaps in brackets? [ ] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 6:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy
RE: Message Filtering
I'll give it a try. -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:29 PM To: Exchange Discussions Subject: RE: Message Filtering How about just the IP address w/o the @ or perhaps in brackets? [ ] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 6:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use
RE: Message Filtering
If that doesnt work, Doug will buy you a beer. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 7:40 PM To: Exchange Discussions Subject: RE: Message Filtering I'll give it a try. -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:29 PM To: Exchange Discussions Subject: RE: Message Filtering How about just the IP address w/o the @ or perhaps in brackets? [ ] -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 6:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List
RE: Message Filtering
I think your problem is that the block by domains is looking at the FROM address (the probably forged hotmail.com in this case) and not at the host that actually sent you the e-mail message. What you probably want to do is click the Specify By Host button (instead of Message Filtering) and put that IP address in there as a host you're going to reject mail from. Better be sure you don't get any legitimate mail from that host, of course. :) Aloha, -Ben- Ben M. Schorr, MVP-Outlook, CNA, MCPx3 Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 1:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- -- -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == == == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED
RE: Message Filtering
hmmm. I hadnt thought of that. Not a bad idea. Wonder if anyone will notice if I put AOL's mail servers in there. :) I'm still curious however if you can use the IP address instead of the domain name. -Original Message- From: Ben Schorr [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 7:48 PM To: Exchange Discussions Subject: RE: Message Filtering I think your problem is that the block by domains is looking at the FROM address (the probably forged hotmail.com in this case) and not at the host that actually sent you the e-mail message. What you probably want to do is click the Specify By Host button (instead of Message Filtering) and put that IP address in there as a host you're going to reject mail from. Better be sure you don't get any legitimate mail from that host, of course. :) Aloha, -Ben- Ben M. Schorr, MVP-Outlook, CNA, MCPx3 Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 1:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] -- -- -- The information contained in this email message is privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copy of this message is strictly prohibited. If you have received this email in error, please immediately notify Veronis Suhler Stevenson by telephone (212)935-4990, fax (212)381-8168, or email ([EMAIL PROTECTED]) and delete the message. Thank you. == == == _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe
RE: Message Filtering
I'm curious too - but I think that will only work if the IP address is used in the FROM address; for example: [EMAIL PROTECTED] Or MAYBE if the host name resolves to that IP address. In this case the FROM address was supposedly a Hotmail.com address but I suspect that the IP address he's trying to block isn't a Hotmail IP. I don't think Exchange is going to bother doing any name resolution, though, so I doubt that would work. It's been a long day so I may be off-track here, but that's my recollection of how message filtering and specify by host works. grin Aloha, -Ben- Ben M. Schorr, MVP-Outlook, CNA, MCPx3 Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:14 PM To: Exchange Discussions Subject: RE: Message Filtering hmmm. I hadnt thought of that. Not a bad idea. Wonder if anyone will notice if I put AOL's mail servers in there. :) I'm still curious however if you can use the IP address instead of the domain name. -Original Message- From: Ben Schorr [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 7:48 PM To: Exchange Discussions Subject: RE: Message Filtering I think your problem is that the block by domains is looking at the FROM address (the probably forged hotmail.com in this case) and not at the host that actually sent you the e-mail message. What you probably want to do is click the Specify By Host button (instead of Message Filtering) and put that IP address in there as a host you're going to reject mail from. Better be sure you don't get any legitimate mail from that host, of course. :) Aloha, -Ben- Ben M. Schorr, MVP-Outlook, CNA, MCPx3 Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 1:59 PM To: Exchange Discussions Subject: RE: Message Filtering Andy, Based on one of the headers in a previous spam, I typed in @210.73.88.134 (without the quotes of course) and stopped/started my IMS. I received another one on Thursday morning. Below is the partial header...this is the first received line in the header: Received: from zhongxin (210.73.88.134 [210.73.88.134]) by calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 Reply-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 3:33 PM To: Exchange Discussions Subject: RE: Message Filtering Just curious, what exactly did you type in? -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 25, 2002 4:59 PM To: Exchange Discussions Subject: RE: Message Filtering I told you I would let you know if this works or not...looks like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A couple of days ago, I saw another spam roll through that had this same originating IP in the Internet Headers section...and yes, I stopped/started the IMS after making the change. Jim Blunt -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:59 AM To: Exchange Discussions Subject: RE: Message Filtering Cool...thanks Andy. I figured it probably would, but I wasn't sure. I will let you know in the next couple of days if it actually works. Jim -Original Message- From: Andy David [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 9:47 AM To: Exchange Discussions Subject: RE: Message Filtering Havent done it, but I would say yes. -Original Message- From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] Sent: Monday, February 11, 2002 12:46 PM To: Exchange Discussions Subject: Message Filtering Ok...this is kind of a screwy question, but I'm going to ask it anyway. In the Exchange Admin under Site - Configuration - Connections - IMS - Connections Tab - Message Filtering... 1.) You can block e-mail from individuals by adding their e-mail address to this list and stopping/starting the IMS. 2.) You can block e-mail from entire domains by adding @domain.com to the list and stopping/starting the IMS. Q: Can you also block e-mail from an IP address by adding @xxx.xxx.xxx.xxx? TIA, Jim Blunt _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe
RE: Message Filtering Q
There's something fishy about those addresses... But, to answer the question, you should only need @relayerone.com, not the subdomains. -Peter -Original Message- From: Bollhofer, Mary I. [mailto:[EMAIL PROTECTED]] Sent: Monday, August 27, 2001 14:36 To: Exchange Discussions Subject: Message Filtering Q Exchange 5.5 sp4. I want to prevent the following domain from delivering messages to my site. The spammer used the following domain name relayerone.com. Do I also need to add any other sub-domain that the spammer has used in the past to send us mail. These sub-domains have been: hammerhead.relayerone.com mackerel.relayerone.com etc Thanks ___ This e-mail, including any attachments, may contain information that is protected by law as privileged and confidential, and is transmitted for the sole use of the intended recipient. If you are not the intended recipient, you are hereby notified that any use, dissemination, copying or retention of this e-mail or the information contained herein is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender by telephone or reply e-mail, and permanently delete this e-mail from your computer system. Thank you. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] __ This message is private or privileged. If you are not the person for whom this message is intended, please delete it and notify me immediately, and please do not copy or send this message to anyone else. _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
