Admonishment to myself for not saving the headers.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Friday, November 21, 2003 11:08 AM
To: [EMAIL
Capital One server.
4. Tells you to add the from address to a white list.
A financial institution should be doing everything it can to be clean.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
Sorry, not my account.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Todd Holt
Sent: Friday, November 21, 2003 12:31 PM
To: [EMAIL PROTECTED]
Subject: RE
Well hello Jim. I thought the Diesel got to you. Haven't heard from you in
awhile.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jim Rooth
Sent: Friday, November 21
You got that right. At least with driving, we didn't have to worry about the
rules changing all the time. Here, we are always one step behind the
spammers it seems.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED
The problem with body filters is the big performance hit the server takes in
high volumes setups.
Comments?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew
Any progress/word on when certain tests can be excluded from this variable?
By default, any test with WEIGHT in the name should be excluded, plus
something like this in the Global.Cfg file:
EXCLUDETESTSFAILED FILTER1
EXCLUDETESTSFAILED FILTER2
John Tolmachoff
Engineer/Consultant/Owner
eServices
have to list each test exactly, or a partial name match? E.g. will
have to list WEIGHTRANGE10-14 WEIGHTRANGE15-19 and so forth, or can we just
list WEIGHT and it will hide any test with the word weight in the name?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail
Sandy, tis 3:30 AM there. Go to sleep.
;)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Sanford Whiteman
Sent: Tuesday, November 18, 2003 12:26 AM
To: [EMAIL PROTECTED
Can you post a Q file that is sitting there?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Timm Jasper
Sent: Thursday, November 13, 2003 6:45 AM
To: [EMAIL PROTECTED
Number is a Sprint PCS cell phone in Boston.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jeff Kratka
Sent: Wednesday, November 12, 2003 12:56 PM
To: [EMAIL PROTECTED
You would probably need to analyze the logs for those days to see for sure.
What are the total number of messages for those days?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
What kind of files are they?
D***.SMD
Q***.SMD
~***.~MD
A***.SMD
T***.SMD
Q.GSE
D.GSE
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
Title: Message
Correct.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Danny Klopfer
Sent: Sunday,
November 09, 2003 5:27 PM
To: [EMAIL PROTECTED]
Subject: RE: [0] RE
header
Imail Rules
I believe if the recipient has forwarding set, that forwarding addresses is
used in the Q file and all tests use that.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
That is working the same way as if I addressed an evelope to you and also
put your name and address in the return address space.
They can put anything they want.
That's why there are tests like HELO and such.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message
Saw that. Scott says it can be ignored and will be out in the next update.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Friday, November 07
Probably best to put the JM log into DEBUG for a bit and post or attach.
How do you know they are not terminating? Open task manager, Processes,
highlight a spamchk or Declude process and then see if that process goes
away after a minute or so.
What is your message volume?
John Tolmachoff
I have added the following to both GibberishSUB and AntiGibberishSUB files:
SUBJECT 0 CONTAINS asr#
This has shown up in a few messages going to a financial company.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http
Some of those are going to have a large FP
rate.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Gable
Sent: Thursday,
November 06, 2003 1:53 PM
To: Declude (E-mail 2
Title: Message
SpamCheck already does that.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
Sent: Thursday,
November 06, 2003 2:28 PM
To: [EMAIL PROTECTED
Wouldn't it be better to use ENDSWITH rather than IS?
Example, if the office domain is mail.123domain.com, IS would not catch a
HELO of 123domain.com.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
I just implemented a new configuration for a client and am seeing that line
for each message in the JM log.
I have not seen that one before. Log is in MID.
Correct actions are being taken.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses
At what log level does Declude record the total processing time?
Or how can I otherwise find out the processing time per message?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
Look at last action, Ignore. Is there a White list anywhere that could
affect that?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matt Robertson
Sent: Wednesday
before.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Filter file.
MAILFROM(weighttoadd) STARTSWITH b.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Wednesday, November 05, 2003 2:53 PM
in the filter file.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Wednesday, November 05, 2003 4:00 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] one
that is because for the MYFILTER test,
c:\Imail\declude\myfilter.txt is used in place of the first x?
Yes.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Wednesday
I have seen that before. I have x-transfer-number: and X-transfer-stamp: in
by header greyfilter.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
3D5H7C
Content-Type: image/gif; name=pic.gif
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=pic.gif
Content-ID: pic.gif
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
you log into HIGH so you can see which .junkmail file is being
used.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matt Robertson
Sent: Tuesday, November 04, 2003 2:10 PM
accounts.
Comments?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type
This has been asked and it was being thought about.
What is the possibility of not including the WEIGHT and WEIGHTRANGE tests in
the %TESTFAILED% variable, therefore only showing the actual tests that
failed?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail
will not responder to repeated requests for contact
to fix this, and the recipient is a good client of mine that is only worried
about receiving his files.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
X-Spam-Checked: This message is probably not SPAM.
X-Spam-Score: -98.364, Required: 4
X-Spam
I need to update my list, and will post later on.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support
Sent: Monday, November 03, 2003 12:14 PM
To: [EMAIL
by spammers being that it is a popular app (unlike the OWA
headers).
FYI Matthew, the list I have is an Anti to BASE64 when concerning mail sent
using OWA, so I need to review this post again, as it is not a OWA issue.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail
That would also work for NOLEGITCONTENT and IPNOTINMX.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Monday, November 03, 2003 12:35 PM
To: [EMAIL
the body, either with Declude or with
a add-on like Sniffer or other?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send
Thanks.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Monday, November 03, 2003 3:39 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Broken
Pete, I may want to discuss this more, as I am helping some one whose Imail
server is loaded. Today's JM log is over 350MB in MID with a couple hours to
go yet to give you an idea of the load.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL
Another thing to try, is delete the e-mail account on the client completely.
Restart the computer. Recreate the e-mail account.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf
that does not fail GIBBERISH but
includes the work part will fail ANTIGIBBERISH and have weight subtracted.
Do not want to do that, so the same safe word part goes into the GIBBERISH.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED
After making config changes, how can a message that you have both the D and
Q file be rescanned manually, say from the command line? The purpose would
be to test the config changes.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude
if the DELETE action is used?
If the -diag appears on the command line, no action is taken, nothing is
added to the headers, only output via the command line unless redirected to
a txt file.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses
Create a folder for that domain.
In the folder, have a $default$.junkmail file, but leave it blank.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Fritz Squib
Sent
Is it possible or practical to create a test that will check to see if the
body is only HTML, and if so, if the amount of total characters is small,
fail?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http
If a test is configured to HOLD, does Declude also add the test name if
%TESTSFAILED% is used?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing
What I am more looking for is to catch those messages that are only HTML
body and are very short, with maybe 5 links and some comments.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
Yes, it has been talked about. Hopefully,
it can go further than talk.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Monday, October 27, 2003 1:36 PM
(the server room of a client) and no
phone number was left.
If this is you, please resend the fax and/or call my voice mail again with a
call back phone number.
Thank you.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
[EMAIL PROTECTED]
626-737-6003
Fax 626-737-6004
You could put in a temporary rule that holds or routes all message with a
blank or as sender, that way the end user will not see them, but you will
still be complying with the requirements.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original
(initially, I held from 20-44) and made adjustments
while looking for patterns and FP.
Hope that helps, although maybe not exactly the answer you wanted.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED
I thought I fixed that.
Any, no, you do not want to put HOPHIGH at zero, because then Declude will
only process the IP the message came from. It is suggested to have HOPHIGH
at 1 or 2, but no more than 2.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
Bill, wrong on a technicality. What I meant to say was the last IP that
the message come from.
It has been too long of a day. I am still have 45 minutes to go on a problem
I am fighting right now on a server.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
Newsletter+ACY-nbsp+ADsAPA-BR+AD4-
+ADw-BR+AD4-
+ADw-BR+AD4-
qudhrfg+AF4-dhrfg-pbzc(pbz+ADw-BR+AD4-
+ADw-BR+AD4-
+ADw-BR+AD4-
+ADw-/FONT+AD4-
+ADw-/P+AD4-
+ADw-/BODY+AD4-
+ADw-/HTML+AD4-
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail
What might be nice would be a test that would count how many times each
HTML feature was used -- for example, if it saw that nbsp; appeared 50
times in an E-mail, it could trigger the test.
That would be nice. Can SpamCheck, Alligate or Sniffer do this?
John Tolmachoff MCSE CSSA
Engineer
You can also use IPBYPASS in the Global.cfg. If I am correct, DNS tests are
not run against those IP addresses.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
After reading all of VeriSlimes response,
it proves how far out of touch they are with the majority of Internet users.
They are basing all of their data probably on their own AOL users, which by
definition are for the most part not Internet savvy.
John Tolmachoff MCSE CSSA
Engineer
Does this work if the use has their mail client configured with a different
from and reply to address than that which they authenticate with?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http
Thanks.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, October 09, 2003 4:00 PM
To: [EMAIL PROTECTED]
Subject
Does Prodigy use yahoo.com mail servers?
If so, does any one know what would need to be added to spam domains?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
the Q_S_ (-)9000 automotive certification.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just
for mail clients that
might send out such a string that isn't marked as base64.
Thanks for maintaining this. Looking forward to it.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http
back to
bite you when you least expect it.
BTW, why do you have a private IP and a public IP on the same server? 2
NICS? Asking for more problems?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus
for variations.
That's just it, there is no universal way. Sometimes they are in a list,
something on a single line and so forth. The body in all the cases I have
seen had the word part in it, although come to think of it you might want to
include the word item as well.
John Tolmachoff MCSE CSSA
Engineer
What spam from MS Customer Assistance? Can you post the headers?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Bridges, Samantha
Sent
Samantha, if you look at the Declude Sender header, you will see this is not
from Microsoft, but rather a virus. (Or corrupt version of.)
There have been some posts here and on the Virus list of filters to use to
trap these.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
Could you have base.net whitelisted in
the Global.cfg file?
Or how about part of the IP address?
What is the ID?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday, October 07, 2003 7:59 AM
To: [EMAIL PROTECTED]
Subject: Re
adjust the actions
for a couple of days to make sure the changes I make do not cause problems.
This way also, I force higher weights and higher allowances for FP.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL
: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.
This is a multi-part message in MIME format.
_
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
stock or quote.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
626-737-6003
[EMAIL PROTECTED]
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe
what I gather from your confusing tests, what you want is the
following:
WEIGHT6
WEIGHT7
WEIGHT8
WEIGHT9
WEIGHT10
WEIGHTRANGE11-39
WEIGHTRANGE40-49
7 replacing 16, each message only triggering one test.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
Right click the .eml file and chose Open with... and chose Notepad.
As far as the pdf issue, have you sent Scott a D file caught?
If you want, you can send to me zipped off list along with the virus.cfg
file.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
from your Exchange to an account on Imail, you
should open the log file and search for either the from address or to
address.
How is Imail SMTP service logging? Go to the Imail Admin and go to SMTP
service and what is it configured for in logging?
John Tolmachoff MCSE CSSA
Engineer/Consultant
[EMAIL PROTECTED]
You could also add in your spamdomains file the following (I think)
mindspring. extremehosting.com
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
Between this problem and those noted on the Imail forum, including the DNS
issue with W2K3, seems there are some serious issues with Imail 8.0x.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED
Title: Message
Tis the standard e-Bay auto reply. They
really care. ;)
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent
All messages are scanned. Whitelisting prevents any action.
As for Alligate, the list has been taken down do to some problems.
Have you checked the Alligate log?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL
.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support
Sent: Monday, September 29, 2003 5:23 PM
To: [EMAIL PROTECTED]
Subject: Re
Maybe this is a clue?
http://www.dnsstuff.com/tools/ptr.ch?ip=216.22.16.66
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent
the ability to log by hour?
Right now, the log file is configured as \junkmail where the 4 # signs
are replaced with the current day and month. Adding the ability to go hourly
would help in cases of large log files. Some thing like \junk## would
do.
John Tolmachoff MCSE CSSA
Engineer/Consultant
In the Global.cfg file, add the
following line:
XINHEADER X-RBL-Warning: Total
weight: %WEIGHT%
XOUTHEADER X-RBL-Warning: Total weight:
%WEIGHT%
Put that above all other header lines.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
Scott, any more thought of adding the option to logging to a syslog?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
, irregardless of how many recipients.
That has been discussed before.
Again, the issue is caused by the SMTP service on all e-mail servers. Now,
there is consideration on how this can be handled in either Declude or
otherwise.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
HELO 7 ENDSWITH cust-host.com
HELO 7 ENDSWITH cust-host.net
# Other includes
HELO 7 IS 127.0.0.1
HELO 7 STARTSWITH [
REVDNS 7 ENDSWITH .in-addr.arpa
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus
On that same subject, I wonder if the same computers affected with Sobig are
the ones sending out Swen?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
the overall
weight given is zero?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail
127.0.0.3
10 0
DNSILLEGAL rhsbl in.dnsbl.org127.0.0.5
10 0
DNSPROMOrhsbl in.dnsbl.org127.0.0.4
10 0
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail
IS?
Your way, if a message HELO was fkdhoosl.example.com, it would not be
caught, but if using ENDSWITH it would be.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
Can't the HELO contain both a FQDN and IP address?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
In this filter test, will using HELO be the same if sending server uses
EHLO, or would we need a line EHLO also?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
But then that would cause a problem as I
believe Karen had pointed out of when you have a backup MX that sends to the
primary.
Then again, 7 is only about 1/3 of my
hold weight.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
use IPBYPASS and the HOP settings. But that does not
effect the HELO anyways.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
weight items go into
greyfilter tests. This way I can always tell whether it got a negative or
positive weight from a test.
(This is in concern to those that may have everything in one filter test.)
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E
The IPBYPASS and HOP settings are for the DNS based tests, not for filters.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent
impacting your
customers or your e-mail flow.
That is provided you have the time to review the logs. ;-)
Which brings me to my quest in search of a log analyzer that can be
configured to create a report on AND. Example, Find all that fail test1 AND
test2. Show subject line, from and to.
John Tolmachoff
This comes up every few months. For some reason, it appears SpamCop goes
through a mean period and starts listing servers quickly.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail
Outlook Express 6.00.2800.1158
X-MimeOLE:
Produced By Microsoft MimeOLE V6.00.2800.1165
Are you sure that
is the full headers?
Also, why is it
showing a line calling an Exchange event sink?
It is possible
that the sender purposely or otherwise caused it to become encoded.
John
701 - 800 of 1386 matches
Mail list logo
