RE: [Declude.JunkMail] Filtering E-Greetings
Scott should back me up or correct me on this. I think that you can configure multiple test lines using Message Sniffer where each line looks for a specific return value instead of nonzero. Something like the following... SNIFFERSPAM external 63 SNIFFERSCUM external 62 Note the 63 and 62 take the place of nonzero... That is correct. I think there is also an optimization in there that ensures Message Sniffer is called only once if the same command line is used and that the result code from the single call will be evaluated against the external test lines... Not yet, but it is something that we are planning to do. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How do I know when a message is truly SPAM?
Okay I think that our declude is working great. But from time to time my boss will get a bunch of crap in a day and come to me complaining about it not working. From what I can tell he gives his email address out to anybody or anything that asks for it. Is there any way I can look at headers and say look boss this isn't really spam you signed up for it, or yeah this is REAL spam. Thanks Timothy C. Bohen CMSInter.Net LLC / Crystal MicroSystems LLC === web : www.cmsinter.net email: [EMAIL PROTECTED] phone: 989.235.5100 x222 fax : 989.235.5151 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do I know when a message is truly SPAM?
You're damned if you do and damned if you don't. You're always going to get false positives and false negatives. The objective is to try to come up with a way to reduce the maximum amount of spam without capturing legitimate email. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Timothy C. Bohen Sent: Thursday, December 05, 2002 9:24 AM To: Declude. JunkMail@declude. Com Subject: [Declude.JunkMail] How do I know when a message is truly SPAM? Okay I think that our declude is working great. But from time to time my boss will get a bunch of crap in a day and come to me complaining about it not working. From what I can tell he gives his email address out to anybody or anything that asks for it. Is there any way I can look at headers and say look boss this isn't really spam you signed up for it, or yeah this is REAL spam. Thanks Timothy C. Bohen CMSInter.Net LLC / Crystal MicroSystems LLC === web : www.cmsinter.net email: [EMAIL PROTECTED] phone: 989.235.5100 x222 fax : 989.235.5151 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] change HOLD location
How about trying robocopy.exe from the NT or 2000 resource kit? It has a great MIRROR option that makes a complete copy in the target location (deleting files that are gone, copying new and changed files, ignoring unchanged files). It would probably be much faster. And it also has an exclude feature which you could probably use to exclude the HOLD files. --Todd. - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 04, 2002 2:07 PM Subject: Re: [Declude.JunkMail] change HOLD location That is a bummer, I'm using xcopy to backup files from one computer to another, and the hold directly can have as many as 3000 messages over the weekend (which is big plug for the effectiveness of declude) thanks, andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 04, 2002 11:51 AM Subject: Re: [Declude.JunkMail] change HOLD location Is there a way to change the location of HOLD messages from the default? No, there isn't, but that is something we are planning to change. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IPNOTINMX
Title: Message Hello all ! First time I use Declude.Junkmail... IPNOTINMX can someone tell me what to do with : IPNOTINMX ??? All the incoming messages fail the test ... Can't find the line to edit it in $default$.junkmail . What should I do with it ?
Re: [Declude.JunkMail] IPNOTINMX
IPNOTINMX can someone tell me what to do with : IPNOTINMX ??? All the incoming messages fail the test ... Can't find the line to edit it in $default$.junkmail . What should I do with it ? That is part of the beta version. It is normal for legitimate E-mails to fail that test; you can search the archives of this mailing list for more details about the test. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How do I know when a message is truly SPAM?
Okay I think that our declude is working great. But from time to time my boss will get a bunch of crap in a day and come to me complaining about it not working. From what I can tell he gives his email address out to anybody or anything that asks for it. Is there any way I can look at headers and say look boss this isn't really spam you signed up for it, or yeah this is REAL spam. Thanks Timothy C. Bohen CMSInter.Net LLC / Crystal MicroSystems LLC === web : www.cmsinter.net email: [EMAIL PROTECTED] phone: 989.235.5100 x222 fax : 989.235.5151 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OSRELAY: What a pain
Scott, Thanks for your email. I have been on this mission for the past 48 hours. The IP addresses of the mail server is 12.150.120.228 and 12.150.120.230. The two addresses belong to the same server and I am running Imail 7.13 with Declude. My SMTP security is set at NORELAY. I also emailed [EMAIL PROTECTED] with subject relay:12.150.120.228 and the same for 12.150.120.230 individually. I have done this numerous times and can see the log file showing the emails having been delivered. What else do I need to do to satisfy good for nothing list? Is there anyone out there who could help me on this? Many Thanks Mishi - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 04, 2002 1:05 PM Subject: Re: [Declude.JunkMail] OSRELAY: What a pain So here is the deal: we have an IP address that is list/or reported (who knows) with OSRELAY (http://relays.osirusoft.com/) as an open relay. Me and another engineer have been on site trying to figure out how to de-list this IP address. You can de-list it by making sure that it is no longer an open relay. :) There is no confirmation of a test being successful or failed. There is no telling whatsoever how they determined an open relay. I thought that Osirusoft listed information about open relays. If not, have you checked your IMail log files to see if one of their tests got through? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OSRELAY: What a pain
Thanks for your email. I have been on this mission for the past 48 hours. The IP addresses of the mail server is 12.150.120.228 and 12.150.120.230. The two addresses belong to the same server and I am running Imail 7.13 with Declude. You aren't in the list anymore. Our DNSstuff.com site still has the cached results that show that you were in there, but connecting directly shows that they no longer list either IP. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Hop
We just added another mail server outside of our network in-case of a system outage. The mail server was designed to hold the mail and then forward it once our system is back up and running, however, since it is listed in our DNS MX records some mail is sent to this server thus defeating some of Declude's features. So, I was wondering what would be the best way to resolve this using Declude? HOP and/or HOPHIGH? If not what then what? If so what's the best way to do it? Thanks in advance, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hop
We just added another mail server outside of our network in-case of a system outage. The mail server was designed to hold the mail and then forward it once our system is back up and running, however, since it is listed in our DNS MX records some mail is sent to this server thus defeating some of Declude's features. So, I was wondering what would be the best way to resolve this using Declude? In this case, you can add a line like IPBYPASS 192.0.2.220 to the \IMail\Declude\global.cfg file, to let Declude JunkMail know not to scan E-mail from that IP. You can keep your HOP and HOPHIGH settings as they currently are. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hop
In this case, you can add a line like IPBYPASS 192.0.2.220 to the \IMail\Declude\global.cfg file, to let Declude JunkMail know not to scan E-mail from that IP. You can keep your HOP and HOPHIGH settings as they currently are. Sorry, perhaps I stated it wrong. I want the mail to be scanned, however, I want to make sure my fromfile and HELO lists work. Regards, Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do I know when a message is truly SPAM?
One other thought... Turn off declude for a few days and see how much spam he gets. He'll shut-up. I did it to my VP and it worked like I charm. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Timothy C. Bohen Sent: Thursday, December 05, 2002 2:41 PM To: Declude. JunkMail@declude. Com Subject: [Declude.JunkMail] How do I know when a message is truly SPAM? Okay I think that our declude is working great. But from time to time my boss will get a bunch of crap in a day and come to me complaining about it not working. From what I can tell he gives his email address out to anybody or anything that asks for it. Is there any way I can look at headers and say look boss this isn't really spam you signed up for it, or yeah this is REAL spam. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hop
The IPBYPASS line should do that. If you have IPBYPASS 192.0.2.220, and an E-mail arrives from 192.0.2.220, Declude JunkMail should scan the E-mail based on the IP address that connected to 192.0.2.220, and use the HELO information from the connection to 192.0.2.220. Gotcha. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hop
Scott, is it possible to do that for a range? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Sent: Thursday, December 05, 2002 3:58 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Hop The IPBYPASS line should do that. If you have IPBYPASS 192.0.2.220, and an E-mail arrives from 192.0.2.220, Declude JunkMail should scan the E-mail based on the IP address that connected to 192.0.2.220, and use the HELO information from the connection to 192.0.2.220. Gotcha. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hop
Won't matter if you have defined IPBYPASS for the backup MX's IP address, because once the message is relayed to your IMail server by the backup MX, Declude will then run its tests against the IP address that connected to the backup MX, not the backup MX itself. Bill -Original Message- From: Tom [mailto:[EMAIL PROTECTED]] Sent: Thursday, December 05, 2002 3:32 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Hop We just added another mail server outside of our network in-case of a system outage. The mail server was designed to hold the mail and then forward it once our system is back up and running, however, since it is listed in our DNS MX records some mail is sent to this server thus defeating some of Declude's features. So, I was wondering what would be the best way to resolve this using Declude? HOP and/or HOPHIGH? If not what then what? If so what's the best way to do it? Thanks in advance, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hop
Occasionally people will have mail forwarded from another mailserver that they have an account on, and they use IPBYPASS in that situation, but that isn't common. The situation I am thinking of is a user has a yahoo.com e-mail account that is forward to his account on our server. The messages that are forwarded from yahoo.com appear to be coming from about 10-12 different IP address, but from within a range. (Not sequential) John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
