Hi Michael. To answer your questions...
If my BlackFilter.txt file is composed of lines like:
SUBJECT STOPALLTESTS CONTAINS China Business Directory
BODY STOPALLTESTS CONTAINS Evil Spammer
will the test return 500 points on a match and HOLD the email without
further processing of filters or
Move the whitelist setting to a custom filter and place an END on the
filter for the condition that you want to track elsewhere:
MAILFROM END IS [EMAIL PROTECTED]
REMOTEIP WHITELIST IS 12.34.56.78
Have a good evening,
Matt
John T (Lists) wrote:
I
need to create a filter
Thanks Matt.
John T
eServices For You
Seek, and ye shall
find!
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Tuesday, February 14, 2006
3:46 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
Filter
I have my own domain in the spamdomains test and then I have Whitelist Auth
so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't
whitelisted because of authentication it adds quite a bit of weight. The
major down side is that when people send e-mail from websites that have
]
To: Declude.JunkMail@declude.com
Sent: Thursday, February 24, 2005 9:54 AM
Subject: RE: [Declude.JunkMail] Filter question
I have my own domain in the spamdomains test and then I have Whitelist Auth
so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't
whitelisted because
I set up a filter of MAILFROM 0 STARTSWITH [EMAIL PROTECTED] I am only holding right
now.
The following was caught. Notice the coups@ is in the Received: line, not
the From: line. Should this one have been caught or skipped?
It should have been caught. That's because the sender was actually
Hi Doug,
If you look for somethink like this, maybe give a try to SpamChk an external
test for Declude Junkmail.
SpamChk will accumulate the weight for every instance of a certain keyword.
You can define also a max. number of how many instances should be counted,
and the weight for keywords
It will return a weight of 2. The filter will
only flag the first occurrence that it finds, then ignores the
rest.
Bill
- Original Message -
From:
Doug Anderson
To: [EMAIL PROTECTED]
Sent: Tuesday, December 16, 2003 7:32
AM
Subject: [Declude.JunkMail] Filter
This may sound stupid, but if I create a filter searching for a string in
an email...
BODY 2 CONTAINS xyz
and the email contains 4 instances of that string
now is the xyx time for all xyz good men xyz to come to the aid xyz of
their country
does the filter return an internal value of 8 or 2?
For the spam that doesn t contain a URL that I can block in my URL filter,
I have taken to trying to find phrases that I can block in my BODY filter.
My question is
Should I be blocking these phrases using the text in the email that I can
see, or should I be blocking phrases that appear when
]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, October 16, 2003 10:05 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Filter question
For the spam that doesn t contain a URL that I can block in my URL
filter,
I have taken to trying to find phrases that I can block
In this last example that everyone's filter probably caught, the
original email came through unflagged, but when I forwarded it to the
list, the filter caught it.
Remember that failing a test and flagging (or any other action) are very
different. In this case, the original question made it seem
Remember that failing a test and flagging (or any other action) are very
different. In this case, the original question made it seem as though
the
E-mail wasn't failing the test, whereas it may be that the E-mail did
fail
the test but an action other than the one you wanted was used.
The
Here are the message headers:
X-Spam-Tests-Failed: ROUTING
OK, it did not fail the INBODYFILTER test.
Here is the line in the filter itself:
BODY 0 CONTAINS Bachelors and other higher education available in your
fields
And here is the line, copied and pasted directly from the spam email
that
Those do look the same. Did you cut and paste it from what you were
viewing in the E-mail, or from the source?
I cut and pasted it from what I was viewing in the email, NOT from the
source, hence my original question. I did go back and run the -diag and
I am definitely running JM 1.75
Sharyn
I cut and pasted it from what I was viewing in the email, NOT from the
source, hence my original question. I did go back and run the -diag and
I am definitely running JM 1.75
So now I would ask what the source of the E-mail shows?
-Scott
---
So now I would ask what the source of the E-mail shows?
This particular one, came in plain text, I just realized. That is
probably why I didn't use the source to begin with.
When I right click on it, view source is greyed out.
I would be happy to forward the email to the list but I did that
I checked my logs and the REMOTEIP lines are catching the mail but the
subject lines with RE: are not catching the mail. the subject lines
without the RE: are catching the emails.
I have changed the IS in SUBJECT lines to CONTAINS and I get the same
results.
I want these emails because I have
I checked my logs and the REMOTEIP lines are catching the mail but the
subject lines with RE: are not catching the mail. the subject lines
without the RE: are catching the emails.
That is odd. Could there be spaces/tabs at the end of the lines that
aren't working?
If that doesn't explain it,
, 2003 5:45 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Filter question
I checked my logs and the REMOTEIP lines are catching the mail but the
subject lines with RE: are not catching the mail. the subject lines
without the RE: are catching the emails.
That is odd. Could
global.cfg:
[...]
BAD-IP ipfile C:\IMail\Declude\BAD-IP.txt x 5 0
[...]
c:\imail\declude\bad-ip.txt (yes, it's really there ;-)
[...]
217.173.135.114
[...]
This looks good.
Header:
--
Received: from mail3.cytainment.de [217.173.135.114] by siller.de with
I would like to be able to filter on the domain names of mailservers in the
chain. In this case I would like to have an entry such as
WHATEVER CONTAINS .aebolts.com (Where WHATEVER is a valid filter screening
criteria for the mailservers in the chain). I know I can use HEADER for
this but is
the secondary MX's.
George
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Sunday, February 02, 2003 11:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Filter Question
I would like to be able to filter on the domain names
Can Junkmail pro filters (for msg body) use wildcards?
No.
Is there a reference?
The Filtering section of the manual covers the filtering. We do plan to
add a reference section to the manual like for the whitelisting/blacklisting.
I want to create a filter (to hold) msgs that have
One question about filters...
You assign the rule in the Global.cfg file a weight.
You also assign each filter a weight.
Are these two weights added to get the final weight for the message?
For example, if you have:
MYFILTER filter c:\iMail\Declude\myfilter.txt x 5 0
And in
Scott, I guess I could test this, but I'm sure you can tell me off the top
of your head. When using the BODY search in the filter file, does Declude
search just the actual body of the e-mail message or does it search all
attachments, as well?
It searches the entire body of the E-mail, which
How would I go about filtering for this in the header? Is it possible?
To: Undisclosed Recipients
It isn't currently possible in Declude JunkMail. It most likely will be
possible in an upcoming release, though.
However, you should note that Undisclosed Recipients is used by many
legitimate
27 matches
Mail list logo
