But VeriSign does not even have the authority nor
control over any other TLDs except .com and .net, so it doesn't make sense that
you are having the name resolution issues you are experiencing.
Bill
- Original Message -
From:
Matthew Bramble
To: [EMAIL PROTECTED]
S
- Original Message -
From: Matthew Bramble
> Thanks for the link to the GNU stuff. I might be asking for some help
> writing useful strings of pipes in the future :)
No problem, I have several scripts I run to generate differnt kinds of
reports.
[snip]
> I think you might have overlook
For those interested in following the VeriSign saga...
http://www.icann.org/announcements/advisory-19sep03.htm
http://www.iab.org/documents/docs/2003-09-20-dns-wildcards.html
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the De
Hmmm, I cannot reproduce any of your findings below. Each link below that I
clicked on returned:
"The page cannot be displayed"
in the browser, which is what I would expect. Nor have I read anything that
states VeriSign is doing what you are claiming.
Bill
- Original Message -
Fro
A couple of weeks ago I post a strange anomaly where log entries show up in
the JunkMail log but the no Declude headers show up in the actual message.
Now I have the opposite effect where Declude headers will show up in the
message but nothing is entered into the JunkMail log.
Here is the scenario
- Original Message -
From: Matthew Bramble
> Let's keep in mind that the discussion has changed from the original topic
of MAILFROM Forged to VERP > + Forged.
Yep, my bad.
> Is that a fair enough presentation?
Yes, very nice analysis! Based on this conversation I have modified my
rule
Not if they both fail the same IP4R or RHSBL test,
but yes if the hops fail different IP4R or RHSBL tests. See, for example,
the following two relevant message headers and log file entries:
=
* Message headers:Received: from
mail-03.cdsnet.net (mail-03.cdsnet.net [63.163.68.113]) by
g
Scott, is this list moderated? I sent a
response to the list regarding this thread on Friday and it has not shown up on
the list. This has happened to me at least three times over the past month
or so.
Matt, the addresses you are referring to below are
not bounce messages, they are Varia
We whitelist the IP address of any system we permit
to relay through our IMail server, and all of our customer either use SMTP Auth
or we whitelist their IP address space. So the only time we have see a
problem is with some mailing lists and e-card services, which we accommodate via
filteri
- Original Message -
From: Matthew Bramble
> I highly recommend not filtering the fake MAILFROM for your local domains.
Why not? I don't actually do this, rather I use SPAMDOMAIN instead. But I
don't see a problem doing it with MAILFROM in a filter file either.
Bill
---
[This E-mail
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, September 18, 2003 11:53 AM
Subject: RE: [IMail Forum] thank you, thank you, Verisign!! and BIND9 Veri
sign-rape patch
> If you are using Declude JunkMail, you can either add similar t
Title: Message
Kami, I don't think you can use variables in filter
files. This would only flag literal %REMOTE% if found in the message
body, not the remote IP address. I'm sure Scott will correct me if I am
wrong...
Bill
- Original Message -
From:
Kami
Razvan
To: [
Shouldn't find FPs in any of the examples you
posed, since a query should only be done on a mail-from domain name, and
VeriScam would only respond to a query with the 64.94.110.11 IP address if the
domain name ends in .net or .com.
Bill
- Original Message -
From:
Matthew Br
- Original Message -
From: "EN" <[EMAIL PROTECTED]>
> The firewall does NAT to hide all our machines behind one IP which is
> designated on the firewall.
> When a user sends email while using the web interface of Imail, all is
well.
> When a user sends an email using Outlook Express, the
Yes, there is a neat little decode app from Funduc Software that supports
decoding of several encoding types, and it integrates nicely into the
Windows Explorer right-click feature (so if you right-click on a file, one
of your options is "Decode"). You can find it at www.funduc.com under the
"Free
Yep, that's correct, and probably not a good thing. I have been using an
rhsbl test, and it appears to be doing what it should--that is, query DNS
with the return address and if it comes back with 64.94.110.11, add weight
to the message. Here is what I am using:
VERISCAMrhsbl.64.
That's what I mistakenly thought, at first. However, nothing will ever
connect to your server with the IP address of 64.94.110.11, so you should
never have the opportunity to resolve the IP to a name. Rather, they will
connect with a bogus hostname or mail domain, and the forward lookup ("A"
reco
signand don't forget
obfuscation...BODY
100 CONTAINS v-e-r-i-s-i-g-nBODY
100 CONTAINS
v.e.r.i.s.i.g.nBODY
100 CONTAINS vérisignBODY
100 CONTAINS verlslgnMatt
:)Bill Landry wrote:
Oops, never mind, that's not
verisignand
don't forget obfuscation...BODY
100 CONTAINS v-e-r-i-s-i-g-nBODY
100 CONTAINS
v.e.r.i.s.i.g.nBODY
100 CONTAINS vérisignBODY
100 CONTAINS verlslgnMatt
:)Bill Landry wrote:
Oops, never mind, that's not goi
Oops, never mind, that's not going to work. Hmmm, back to the drawing board
on this one...
Bill
- Original Message -
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, September 15, 2003 7:18 PM
Subject: Re: [Declude.JunkMail] A
For now I've added:
REVDNS 10 ENDSWITH sitefinder-idn.verisign.com
to at least be able to add some weight to e-mail messages that use bogus
domain names and resolve RDNS for 64.94.110.11 to
sitefinder-idn.verisign.com.
Bill
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
- Original Message -
From: "Kevin" <[EMAIL PROTECTED]>
> Hi,
>
> Is it ok to do this:
>
> REVDNS -35 ENDSWITH .ebay.
>
> and it'll pick up ebay.com, ebay.ca and etc?
No, in this case it will only match if the end of the line is a period "."
I think what you want to do is:
REVDNS -
- Original Message -
From: "Matthew Bramble" <[EMAIL PROTECTED]>
> None of this stuff is a big secret, and besides, pretending to come from
> a domain like AOL or Amazon has resulted in spammers being sued
> successfully. Clearly they already know the tactics and have used them.
And th
- Original Message -
From: "Matthew Bramble" <[EMAIL PROTECTED]>
> >Still does not make it wise to share whitelists on a public forum.
However,
> >if you are promoting a whitelist exchange on this list, so be it;
however,
> >it's not a practice I plan to participate in.
> >
>
> I have les
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
> Not only do you need your own nameservers, but you also need your upstream
> to delegate authority for the reverse DNS entries to you. So any open
> relays or open proxies will not have forged reverse DNS. Then, there are
Yes, but since I run my own name servers, I could easily setup the IP
address of my mail server to respond to a reverse query with one of the
domains listed in his whitelist. Granted, RDNS is more difficult to forge
then say HELO or MAILFROM, but is still fairly trivial if you run your own
name se
Kami, I hope there are no spammers monitoring this list since now they know
how to easily spam your e-mail domains. It is never a good idea to share
your whitelists in a public forum.
Bill
- Original Message -
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday,
Darryl, probably the best place to start learning how the filtering process
works in Declude is by reviewing the JunkMail manual. Check it out at:
www.declude.com/junkmail/manual.htm
If you still have questions after reviewing the filter section, please post
them to the list and I'm sure
r whitelist as REVDNS.
>
> WHITELIST REVDNS .paypal.com
>
> Paypal has been there for ages, same with eBay, IBM, Oracle, etc. The
> REVDNS is almost foolproof way of letting paypal come through without
> worrying about anything.
>
> Regards,
> Kami
>
> -Original Mes
It appears that VOX died sometime early on Friday morning:
=
m:\imail\spool\spam\log\dec0831.log:2862
m:\imail\spool\spam\log\dec0901.log:3167
m:\imail\spool\spam\log\dec0902.log:3735
m:\imail\spool\spam\log\dec0903.log:4322
m:\imail\spool\spam\log\dec0904.log:4555
m:\imail\spool\spam\log\dec0
Good point, and yes it was the:
BODY 0
CONTAINS http://%
entry that flagged the PayPal message.
Bill
- Original Message -
From:
Matthew Bramble
To: [EMAIL PROTECTED]
Sent: Sunday, September 14, 2003 1:17
PM
Subject: Re: [Declude.JunkMail]
O
He did share it with the list--possibly your filters blocked the message.
If you are not automatically deleting messages, check you hold queue, you
may find it there.
Bill
- Original Message -
From: "Frederick Samarelli" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, September
Just an FYI, I've added:
MAILFROM -7 ENDSWITH paypal.com
to the "Test Exclusions", as it was flagged by the Obfuscation test.
Bill
- Original Message -
From: "Matthew Bramble" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, September 14, 2003 12:27 PM
Subject: Re: [Declude.Jun
Very nice work, Matt! And thanks a bunch for sharing your efforts with the
list!
Bill
- Original Message -
From: "Matthew Bramble" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, September 14, 2003 10:14 AM
Subject: Re: [Declude.JunkMail] OBFUSCATION filter - attachment -
repla
Hmmm, have you checked out http://unxutils.sourceforge.net/ yet. All of the
UNIX tools there are command line versions written for Win32 and work great,
no different than we find on our Linux servers.
Bill
- Original Message -
From: "DLAnalyzer Support" <[EMAIL PROTECTED]>
To: <[EMAIL PR
Check out http://unxutils.sourceforge.net/ for all of the latest UNIX
utilities for Win32, including tail.
Bill
- Original Message -
From: "Darryl Koster" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, September 13, 2003 8:37 AM
Subject: [Declude.JunkMail] tailing a log file
Scott, I deleted the other message, but I forwarded you a copy of another
message from the same poster, as an attachment (so the entire message,
including headers, are intact), to your personal e-mail address in case you
wanted to review it.
Bill
- Original Message -
From: "R. Scott Perry
No, Postfix sits in front of the IMail server. I see the Declude headers on
all other messages, and most other messages to the SpamAssassin list,
although I did just find another on from a different poster to the list that
also did not have any Declude headers.
For example, here are the headers f
I cannot figure out why messages from this particular participant on the
SpamAssassin e-mail distribution list does not show any Declude JunkMail
header entries. Here is the log info and headers for one of these messages:
==
IMail receive log entry:
M:\>grep 04FF0068 i
Oops, I was looking at the wrong column for the
weight.
Bill
- Original Message -
From:
Matthew Bramble
To: [EMAIL PROTECTED]
Sent: Wednesday, September 10, 2003 5:22
AM
Subject: Re: [Declude.JunkMail]
SUBJECTSPACES test
No, that column of numbers relates
Matt, with this configuration, if a message has 5 or more BCC addresses
listed, won't the message fail all three BCC tests and accumulate a total
BCC weight of 9 points?
Also, if a message contains 100 or more comments, won't it will fail all
nine of your comments test and accumulate a total comme
Title: Message
Hmmm, how is it possible for Declude JunkMail to
track the statistical filtering header when statistical filtering does not
happen until after Declude has finished its message processing and handed the
message back to IMail for delivery?
Search the archives, there was a discu
http://www.cox.com/
Bill
- Original Message -
From: "Glen Harvy" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, September 01, 2003 3:12 PM
Subject: RE: [Declude.JunkMail] SORBS-SPAM
> Who's Cox?
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL P
What do you base your claim on that Osirusoft will be back? Even Joe Jared
himself said he was permanently shutting down Osirusoft. I would certainly
like to see them come back, but it doesn't look promising, at this
point--unless you have new information in this regard...
Bill
- Original Me
Markus, just a couple of things I noticed about your config file:
- SPAMHAUS is both listed and commented:
SPAMHAUS ip4r sbl.spamhaus.org * 20 0
#SBL ip4r sbl.spamhaus.org 127.0.0.2 30 0
- SORBS tests are regular IP4R tests, not RHSBL tests:
SORBS-BADCONF rhsbldnsbl.sorbs.net 127.0.0.
The latest news in the Osirusoft saga:
http://slashdot.org/article.pl?sid=03/08/27/0214238&mode=nested&tid=111&tid=126
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send
I would go with option B and comment them out.
Bill
- Original Message -
From: "Robert Grosshandler" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 26, 2003 5:55 PM
Subject: RE: [Declude.JunkMail] OSRELAY question.
> I'm feeling dumb this evening, so I'll share my dum
Yes, because if you do not disable the Osirusoft tests, it will only cause
unnecessary mail processing delays, as your queries wait for a response and
eventually time-out (approx 10 seconds), since the rbl is no longer
responding to queries, or is returning bogus responses. In either case, not
a g
FYI, looks like Joe Jared (of Osirusoft) is finally hanging it up.
Bill
- Original Message -
From: "James Miller" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 26, 2003 4:07 PM
Subject: RE: [SAtalk] OSIRUSOFT -- should they be used any more?
> Update OSIRUSOFT issue:
If you are current using any of the osirusoft tests with Declude JunkMail,
you may want to disable them until the problems they are experiencing get
resolved. I'm seeing the same issues discussed on several lists. For more
info, see:
http://www.google.com/groups?as_umsgid=bill-CB3DC2.13252820082
Title: Message
As long as you have your DNS setup correctly for
your domains, you can always use the SPAMDOMAINS test since e-mail that claims
to be from [EMAIL PROTECTED],
that is sent from any other mail server but your own, will fail the RDNS
lookup.
Bill
- Original Message -
Check-out this obfuscation technique: ;-)
-E---y---P---G
-n---o---e---u
-l---u---n---a
-a---r---i---r
-r---s---a
-g---n
-e---t
-e
-e
-d
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-ma
Even though the replies come back with 127.0.0.5, I had to change my
global.cfg entry to:
SECURITYSAGE rhsbl blackhole.securitysage.com * 2 0
in order for it to work correctly.
Bill
- Original Message -
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMA
>
> Erik
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry
> > Sent: Tuesday, August 19, 2003 12:28
> > To: [EMAIL PROTECTED]
> > Subject: Re: [Declude.JunkMail] sure to be silly question
> &
Another way to scale the weight of this test is to use:
COMMENTS comments weight x 5 0
where the test will accumulate the total number of obfuscation comments it
finds and add 5 to that number and apply that to the weight result for the
test. I don't see the comments test documented on t
We are evaluating this new RHSBL site that SecuritySage is hosting, and it
appears to be working well thus far. Info can be found at:
http://www.securitysage.com/guides/postfix_uce_rhsbl.html
The entry we are using in our global.cfg file is:
SECURITYSAGE rhsbl blackhole.securitysage.c
What do the corresponding entries in your global.cfg file look like?
Bill
- Original Message -
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, August 17, 2003 7:17 PM
Subject: [Declude.JunkMail] ROUTETO Peculiarity
> In my $default$.junkmail file I have the following se
JunkMail is not really geared to do this. However, if you are running
Declude virus, you can use the BANEXT feature to quarantine e-mail messages
that contain defined attachment extensions. I don't know if the BANEXT
feature supports a wildcard entry that will let you ban all e-mail messages
with
Jeff, this test adds all spaces found in the subject together (including
single spaces between words), not just contiguous spaces.
Bill
- Original Message -
From: "Jeff Kratka" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, August 02, 2003 12:48 PM
Subject: [Declude.JunkMail]
Actually, it would be better to setup IMail not to receive mail for
non-existent e-mail addresses. In fact, that is the default. IMail will
only accept e-mail for non-existent e-mail addresses if you have setup a
"nobody" alias within your domains. I would suggest removing the "nobody"
aliases i
In global.cfg, add:
BCC bcc 5 x 3 0
NONENGLISH nonenglish x x 5 0
Bill
- Original Message -
From: "Mark [Support]" <[EMAIL PROTECTED]>
To: "Declude Junkmail" <[EMAIL PROTECTED]>
Sent: Thursday, July 31, 2003 2:35 PM
Subject: [Declude.JunkMail] Tests Setup
> Hello. I just upgraded to
I've been trying to figure out who to go after next, are you
volunteering...?
- Original Message -
From: "John Shacklett" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, July 31, 2003 9:45 AM
Subject: RE: [Declude.JunkMail] If a tree falls in the woods [was Is the
list down?]
Jose, is there any reason not to whitelist the IP addresses of your own
servers, since they are in your control anyway? That way Declude will not
block messages delivered to IMail, or through IMail, from your servers.
Bill
- Original Message -
From: "Jose Gosende" <[EMAIL PROTECTED]>
To
Apologies to the list for the noise, my bad!
Bill
- Original Message -
From: "Joshua Levitsky" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, July 29, 2003 6:28 AM
Subject: Re: [Declude.JunkMail] New spamcop style RBL..
>
>
>
> All I have to say is things have a way of comin
Thank you for the heads-up, that's great news! And I'm sure it will be much
appreciated by everyone. :-)
Bill
- Original Message -
From: "Joshua Levitsky" <[EMAIL PROTECTED]>
To: "Bill Landry" <[EMAIL PROTECTED]>
Sent: Monday, July 28, 2003 3
- Original Message -
From: "Kevin Bilbee" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 28, 2003 12:24 PM
Subject: RE: [Declude.JunkMail] Filter processing
> I would realy like to have a filter that stops on first match. This is the
> line from my log analyzer
> for the
- Original Message -
From: "Kevin Bilbee" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 28, 2003 11:55 AM
Subject: RE: [Declude.JunkMail] Filter processing
>> Just curious why your own IP
> > addresses or FQHNs would be listed in your HELO filter file?
>
> We block on ave
Hey Matt, thanks for the Trustic update and config info, this is very
helpful!
Bill
- Original Message -
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 28, 2003 9:32 AM
Subject: RE: [Declude.JunkMail] New spamcop style RBL..
> I do a ROUTETO with n
If I recall, this is something Scott said they were working on--it will
certainly be a welcome feature. It sounds like you are spam filtering your
outbound mail? If that's the case, for now you could always create a
subject filter entry (if you are running the Pro version) that applies
enough of
I have not noticed an increase this weekend, myself, but maybe others have.
Is it mainly your DNS based tests that are failing or is it pretty much all
tests across the board? If it's your DNS tests that are failing, check to
see if the DNS server that IMail is configured to use is working and
res
As was stated in an earlier post, this is a technical discussion list which
has no place for posts like this. So please quit your whining and
confrontational comments and try to keep it professional. Otherwise, take
it off list.
Bill
- Original Message -
From: "Joshua Levitsky" <[EMAIL
- Original Message -
From: "Kevin Bilbee" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, July 27, 2003 1:03 AM
Subject: [Declude.JunkMail] Filter processing
> When there is a hit in a filter file does declude continue to procees the
> filer or stop?
I continues through the en
Title: Message
That would not be a good idea, especially since
this is a public list and if he did that anyone could spam his users by setting
their return address to [EMAIL PROTECTED].
I think people are missing the point here. We
are not talking about blacklisting anyone with multiple da
> >From: Mike Moloney
[mailto:[EMAIL PROTECTED]
>
> Kami will want to take note of this domain. :)
Yep, but I would still have to agree with Kami. In my review there are very
few legitimate domains that use more than on dash "-" symbol for their
e-mail domains, and never two dashes "--" together
Title: Message
Kami, I totally agree, I think this would be a very
good test.
Bill
- Original Message -
From:
Kami
Razvan
To: [EMAIL PROTECTED]
Sent: Thursday, July 24, 2003 6:15
AM
Subject: [Declude.JunkMail] dashes in
domains
Hi;
It seems like
ot;Kevin Bilbee" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, July 23, 2003 2:39 PM
Subject: RE: [Declude.JunkMail] re: RBL's
> Bill it is comments like these that help no one.
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
>
Sure, don't use those particular RBLs.
Bill
- Original Message -
From: "Kevin Bilbee" <[EMAIL PROTECTED]>
To: "JunkMail Declude" <[EMAIL PROTECTED]>
Sent: Wednesday, July 23, 2003 9:29 AM
Subject: [Declude.JunkMail] re: RBL's
> What good is it to have a weighting system when RBL's do lo
Scott, does this mean that this test will not work for gateway messages
(relayed, non-local e-mails)?
Bill
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, July 22, 2003 2:10 PM
Subject: Re: [Declude.JunkMail] bcc?
>
> >What is the u
Ah shucks, I was looking forward to the new spam test that you had been
evaluating that would add a header to messages like the following:
X-Spam-Prob: 0.29
Has that test been abandoned?
Bill
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Instead of whitelisting your domain, whitelist your IMail server's IP
address (or IP addresses), it's much harder to spoof those:
WHITELIST IP xxx.xxx.xxx.xxx
or
WHITELIST IP xxx.xxx.xxx.0/24
Also, I don't think that the "WHITELIST REVDNS kendra.com" is your problem
here, since th
Don, I think that would be a great idea and hopefully Scott will bless the
effort.
Bill
- Original Message -
From: "Dan Geiser" <[EMAIL PROTECTED]>
To: "Declude JunkMail" <[EMAIL PROTECTED]>
Sent: Monday, July 21, 2003 1:19 PM
Subject: [Declude.JunkMail] Declude JunkMail FAQ or Knowledge
03 10:08 AM
Subject: Re: [Declude.JunkMail] Legitimate email syntax?
> sorry for the dumb question ...being kinda new at this... how would i
> implement this filter??
>
> thanks
>
> Sheldon
> - Original Message -
> From: "Bill Landry" <[EMAIL PROTECTED]
Yep, this is what I have in my mailfrom filter file:
MAILFROM 10 CONTAINS `
MAILFROM 10 CONTAINS ~
MAILFROM 10 CONTAINS !
MAILFROM 10 CONTAINS #
MAILFROM 10 CONTAINS $
MAILFROM 10 CONTAINS %
MAILFROM 10 CONTAINS ^
MAILFROM 10 CONTAINS &
MAILFROM 10 CONTAINS *
MAILFROM 10 CONTAINS (
MAILFROM 10 CON
This should be posted to the Declude JunkMail
list. You should not enter your own domains in the SpamDomain.txt file
that you are referencing.
Bill
- Original Message -
From:
Jeff
Pereira
To: [EMAIL PROTECTED]
Sent: Monday, July 14, 2003 1:00 PM
Subject: [Declude
Since we are on feature requests, I too would like to request a new DJM
feature. I'm wondering if it would be feasable for Declude to pass on
decoded messages to the third-party apps (Sniffer, Alligate, SpamChk)
instead of the original mail files, that way each third-party apps would not
have to a
- Original Message -
From: "Karen D. Oland" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 12:28 PM
Subject: RE: [Declude.JunkMail] Lost One Account - Help Please
> I've seen connects that used our IP address as their HELO/EHLO strings.
> Same for using our domai
Oops, remove the minus "-" from all of these (that's what happens when you
copy and paste from the wrong line).
Bill
- Original Message -----
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 11:23 AM
Subject: Re
- Original Message -
From: "Karen D. Oland" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 9:12 AM
Subject: RE: [Declude.JunkMail] Lost One Account - Help Please
> Make sure you DO NOT whitelist your own domain, ip address, the postmaster
I agree with everything
It does not, it is an IMail exclusive. :-(
Bill
- Original Message -
From: "Terry Parks" <[EMAIL PROTECTED]>
To: "'Declude. JunkMail" <[EMAIL PROTECTED]>
Sent: Thursday, July 10, 2003 9:28 AM
Subject: [Declude.JunkMail] Compatability
> Does anyone know if Declude works with other email
The Alligate test applied 30 points to the total
message weight, 20 points for failing AlligateSpam1 and 10 points for failing
AlligateSpam2. The weight that Alligate returns to Declude is how Declude
determines what Alligate tests, if any, were failed and what weight to apply to
failed tes
so I had to block their IP.
Dan
On Sunday, July 6, 2003 8:34, Bill Landry <[EMAIL PROTECTED]> wrote:
>Try: http://www.dnsreport.com/
>
>Run the DNS Report against a domain hosted by the mail server. In the mail
>section you should see the following if they are not an op
Try: http://www.dnsreport.com/
Run the DNS Report against a domain hosted by the mail server. In the mail
section you should see the following if they are not an open relay:
PASS Open relay test OK: All of your mailservers appear to be closed to
relaying.
gw2.pointshare.com OK: 550 : Relay acces
Scott, shouldn't this line in the JM manual actually read JM before Virus?:
If using the AVAFTERJM option in Declude Virus, Declude Virus will run
before Declude JunkMail.
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Decl
Title: Nachricht
Markus, in the sample two headers you posted here,
you could whitelist buongiorno.com (not that I would recommend doing so,
however). What Declude JM looks at is the "X-Declude-Sender" address, and
in this case both examples you posted end with buongiorno.com.
What I would
eply email and destroy all copies of the original
> message.
> - Original Message -
> From: "Bill Landry" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Thursday, July 03, 2003 12:08 PM
> Subject: Re: [Declude.JunkMail] Imail Stops Delivering M
I've heard that some people have had to disable "DNS Cache" to resolve
problems like this. You might try unchecking this on the Queue Manager tab
and see if that resolves the problem for you.
Good luck,
Bill
- Original Message -
From: "Webmaster" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTE
The settings of the tests are really a personal
preference, and you will need to tune them over time to meet your specific needs
and requirements. The default settings are conservative and safe, so you
can certainly start using Declude with these settings. You should only
enable the Sniffe
> So you are saying that if I have the following line
>
> gmx.at
>
> the message would have failed spam doamins? But if I say have the
following
> line
>
> gmx.at verizon.net
>
> it would have passed spam domains and also no entry would pass all mail
from
> sender gmx.at.
Correct, the SD filte
Message -
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, July 01, 2003 5:15 PM
Subject: Re: [Declude.JunkMail] Spam domains
> Why would you expect this line in your SD file to flag this message? The
> X-Declude-Sender is [EMAIL P
Why would you expect this line in your SD file to flag this message? The
X-Declude-Sender is [EMAIL PROTECTED] SD looks at the X-Declude-Sender
domain and does are RDNS query on it to see if the response has a matching
domain, or one that is listed as an alternative on the same line in your SD
fi
501 - 600 of 789 matches
Mail list logo
