Title: Why did this fail reverse DNS
Good afternoon,
Something really odd is going on here.
All of a sudden, my own users are failing tests that they were passing last month.
Here is the spam attachment that Declude adds to our emails, if the weight is 10.
You **MAY** have spam!
Title: Why did this fail reverse DNS
Hi Sharyn,
How is DNS configured on your server? Are you
using upstream DNS servers that are suddenly not resolving? We've had that
problem in the past, and resolved it by not using forwarders to provider DNS
servers in our local DNS server on the IMail
Sharyn,
1. What is the test you have defined for 10-REVDNS ?
2. Do you have WHITELIST AUTH enabled in your global.cfg ?
David B
www.declude.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt
Sent: Wednesday, September 07, 2005
Title: Message
Hi
Darin,
Thanks
for the response.
I host
my own primary nameserver here, which is also the same box as my IMAIL server.
There is no upstream DNS server involved. That's what has me so puzzled on
this.
I have
relay set only for IP addresses, my users don't authenticate.
Hi David,
The 10 is a combination of all those failed tests. I have this set up so
even if my users fail tests like cmdspace and those others, they should
still come in under Weight 10. It's the revdns that put this particular user
over the top, and he shouldn't have failed it.
This has been
Title: Message
Can you do a reverse lookup on your domain from the
server?
Instead of WHITELIST AUTH, you might whitelist (or
negative weight) by IP using an ipfile test. That would allow all mail
from your users to go through without filtering.
Darin.
- Original Message -
From:
Title: Message
I like
the whitelist IP idea. Got an example of the syntax?
At the
moment, I have so few addresses whitelisted that I don't use a from file, I just
have them listed straight in the global config. Hmm..can I just do that, by
subnet?
You
know, it just occured to me that
In your global.cfg you can add an entry like
WHITELIST IP 10.0.0.0/27
WHITELIST IP 1.1.1.1
Or you can create a ipfile filter and do negative weight. My personal
preference is to whitelist as a last resort. My preference in order is to
correct the main issue at hand, than reverse weight by
Thanks for your help!
Sharyn
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Agreed. Negative weighting is generally considered better than whitelisting
outright.
In your case it may not matter, but may be subject to spoofing. Also, abuse
by your users that you may want to be aware of could go straight through
with whitelisting, whereas it could still be filtered with a
I really don't want to downgrade imail, but spam and viruses are getting
through. Any hope for having declude working with imail 8.21 any time soon?
Thanks
__ __ __ __
Sent via the CMS Internet Webmail system at mail1.cmsinter.net
Declude Beta 3.0 is available which works with Imail 8.20+ if you have a
valid service agreement this can be downloaded from our website from the My
Account Home Page when you log in.
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf
I gave up and downgraded to 8.15 now I'm getting:
09:07 15:08 SMTPD(CP) error 3 executing c:\imail\Declude.exe
D:\IMAIL\spool\Q3ab90041008c0e76.SM
What should I try? Running Declude 2.0.5
-- Original Message --
From: Timothy Bohen [EMAIL PROTECTED]
We are about to build a new server using Windows 2003. The reason is that
we were apparently attacked through the iMail IMAPI exploit. The last of
whatever got in seems to be running in a very effective stealth mode
because nothing seems to be able to find it and kill it. As a consequence,
Tim,
I have never seen that error, but I would recommend downloading 2.0.16
from their site. It fixes bugs from 2.0.6 and I don't believe that it
introduces any new ones. It might also make sense to check to see that
you have a declude.exe in the IMail directory, and Declude's
configuration
I am running Declude 2.0.14 consistently on my Imail 8.21 server with no
problems that would allow viruses and spam to get through. Granted, my
server only has a volume of about 5K per day.
I am going to being running the betas as soon as I can get to that.
John T
eServices For You
We have been running iMail 7.07 under windows 2000. We had some input
that
there may be some problems in this environment. We are not keen on
upgrading to 8.x since IPSwitch is walking away from iMail the product.
Ipswitch is not walking away from Imail. It is still alive and well, and in
I think that the exploit is in imail 7.07 and not in your server do a
google on
imail 7.07 exploit.
So you most likely would need to upgrade to 8.2 series. Tho the exploit
isn't in 8.15 I don't believe. BTW they do seem to have some interesting
pricing going on if you google imail deals depending
At 01:43 PM 9/7/2005, Ncl Admin wrote:
I think that the exploit is in imail 7.07 and not in your server do a
google on
imail 7.07 exploit.
OK, I see it. The question is how do you KILL the stuff that has gotten
into the server? We shut down the IMAP yesterday primarily because we
really
Start with TCPView From sysinternals to view open ports on the server find
the ports and programs that should not be running and kill then remove them
from the system.
Also use Process Explorer from sysinternals and look at all the running
processes. If you find one that does not belong then kill
I gave up and downgraded to 8.15 now I'm getting:
09:07 15:08 SMTPD(CP) error 3 executing c:\imail\Declude.exe
D:\IMAIL\spool\Q3ab90041008c0e76.SMD
It looks like you set up Declude to run in C:\IMail, but you run IMail
on D:\IMail. :)
-Scott
---
This E-mail came from
I've noticed that on many messages lately, a message's failed tests
weights do not correspond to the weights I have in my global.cfg file.
For example, these are from the X-SPAM-TESTS-FAILED line of four
different messages:
SORBS-DUHL, CMDSPACE [7] - should be 12
CMDSPACE [3] - should be 8
Kevin,
In a standard setup, when you don't see NOLEGITCONTENT or IPNOTINMX in
the failed tests shown in the headers, that means that they did credit
weight. It causes a lot of confusion until people figure this out.
Just convince yourself that this is the case and move forward on that
I've noticed a bunch of spam with SPFPass grades that have negated the
spam databases (I have SPFPass at -5) ... is anyone finding that
SPFPass is working with spammers using legitimate ISP's?
david
-
Internet Dental Forum www.internetdentalforum.org
Dentalcast Podcast
We only use SPFFAIL and add weight. We stay away from negative weighting.
SPFPASS just means that the senderdomain is coming from an approved mail
server.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Dodell
Sent: Wednesday,
25 matches
Mail list logo
