[Declude.JunkMail] TextFilter file, how many entries ?
Hi, I have create a text file with many BODY 0 CONTAINS TextToFilter... My question is, How many entries can I put in the file before Declude slow down ? Thanks in advance Piero Italy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] TextFilter file, how many entries ?
My question is, How many entries can I put in the file before Declude slow down ? I think this depends on -what HW-ressources you have in use (CPU, storage,...) -how much mail traffic you have during peak times I've had a problem some days ago by adding two filter files having both around 140 kB (one for body one for header filtering) At midnight all worked fine but next morning at around 9:00 AM it was almost not more possible to logon to the server. Ping whas ok, but it has taken over a minute to display the Terminal services login screen. After logging on I've had to wait for over 5 Minutes to see the desktop. Other 2 Minutes to open the taskmanager and see that there was a lot of declude.exe's having CPU-times of over 60 seconds and consuming all disponible CPU-resources. We've running Imail v7.15 on a Intel P4 2,6 GHz and IDE Raid mirroring Declude Junkmail and Virus with 2 scan engines. First I've tried to disable the second AV engine without a result. After removing the two filter files all become normal. We process around 4000 msgs/day. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] TextFilter file, how many entries ?
I posted a question two weeks ago asking if anyone knew a way to calculate the amount of time it takes for individual messages to clear the entire receive/virusscan/junkmailscan/deliver process, and this exactly why I asked. My system doesn't have any filters quite as large as 140kb, or even 70k, but I keep adding steadily to them and it feels like things are somewhat slower. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Thursday, 30 October 2003 3:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] TextFilter file, how many entries ? My question is, How many entries can I put in the file before Declude slow down ? I think this depends on -what HW-ressources you have in use (CPU, storage,...) -how much mail traffic you have during peak times I've had a problem some days ago by adding two filter files having both around 140 kB (one for body one for header filtering) At midnight all worked fine but next morning at around 9:00 AM it was almost not more possible to logon to the server. Ping whas ok, but it has taken over a minute to display the Terminal services login screen. After logging on I've had to wait for over 5 Minutes to see the desktop. Other 2 Minutes to open the taskmanager and see that there was a lot of declude.exe's having CPU-times of over 60 seconds and consuming all disponible CPU-resources. We've running Imail v7.15 on a Intel P4 2,6 GHz and IDE Raid mirroring Declude Junkmail and Virus with 2 scan engines. First I've tried to disable the second AV engine without a result. After removing the two filter files all become normal. We process around 4000 msgs/day. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT Outlook Express problem
Another thing to try, is delete the e-mail account on the client completely. Restart the computer. Recreate the e-mail account. Thanks John, I'll give that one a shot as well. I tried adding a return address, but that didn't seem to work... Thanks to all who have offered suggestions! Out of all our users, just 4 or 5 are having this problem very odd indeed. Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] TextFilter file, how many entries ?
I posted a question two weeks ago asking if anyone knew a way to calculate the amount of time it takes for individual messages to clear the entire receive/virusscan/junkmailscan/deliver process, and this exactly why I asked. My system doesn't have any filters quite as large as 140kb, or even 70k, but I keep adding steadily to them and it feels like things are somewhat slower. I suggest to simply try it out. Create a large filter list (definitively larger than you expect to use in future) and assign to all (random) keywords a weight of 0 and no additional action. This should create the same resource usage as with points. Now set up something to send a little bit more mails then your average mail processing rate (for example a Script sending out 20 messages as fast as possible) You can send it all to the same recipient. Imail/Decludes architecture will not process it faster because the messages are all the same. Put some tipical content (1 to 30 kB of text) in the message body. Watch the cpu usage during normal processing and the simulated mail bombardement. If you want you can also set a line PIDDEBUG ON In your global.cfg file This will write a .PID file for every declude process in you spool folder. Note: it's deleted after the process has finished his task so you have to open it during processing (not easy) In this PID file you can read in milliseconds how long any step takes to finish. All your results are something that can be interesting for multiple users on this list but keep in mind to indicate also what CPU, storage system, ... you've in use. Whats the average/peak message processing rate on your server, ... -- About CPU usage: I've had an idea some months ago and still search someone who can help. The problem: certain spam-tests can be very CPU-intensive. This will prevent us to keep filter files and programming logic as simple as possible. (For example long text filter files, regular expressions) The real problem: Any mailserver running a lot of tests before store or forward the message to the final destination is much more vulnerable for peak usage or also simple mailbomb attacks then a MTA configured to simple deliver any message as fast and efficient as possible. The idea: If declude (or our external spamchk test) could determine an average CPU usage value before start all tests it should be possible to dinamicaly exclude certain resource intensive tests if the CPU average is to high. For example: In the global.cfg file a test could be configured like %75 MYFILTER filter d:\imail\declude\large_bodyfilter.txt x 5 0 This test would run only if declude has determined an average cpu usage below 75% Another problem: declude is called as needed for any single message. It's not a service running around the clock and so it's not able to determine and provide a reliable CPU average value. The solution: A small windows service that calculate and serves the 1, 5 or 10 minute CPU average value. Declude could connect over DCOM or a certain TCP/UDP port to this service before run all other tests. If the average is to high this will comment out automatically the big tests. Such a solution will not decrease the detection rate because certain tests will not run sometimes, but will increase the detection rate because this new tests now can run everytime when it's possible. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] PLEASE CONTACT ME OFFLIST
I would like to contract someone to help with a problem my mail server. We have been wrestling with a problem now for several days which came on quite suddenly and I would like to get it resolved. My queue is accumulating huge amounts of files very quickly... MY processors (2) are at almost 100% all of the time.. Mail is being lost.. This came on suddenly,without adding new loads to the server.. Please contact me offlist. Feel free to call Ed McNichols, MCP CEO Archiventure, Inc. [EMAIL PROTECTED] http://www.archiventure.net Tel. 570.253.1986 Fax. 570.253.4343 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Thursday, October 30, 2003 8:04 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] TextFilter file, how many entries ? I posted a question two weeks ago asking if anyone knew a way to calculate the amount of time it takes for individual messages to clear the entire receive/virusscan/junkmailscan/deliver process, and this exactly why I asked. My system doesn't have any filters quite as large as 140kb, or even 70k, but I keep adding steadily to them and it feels like things are somewhat slower. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Thursday, 30 October 2003 3:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] TextFilter file, how many entries ? My question is, How many entries can I put in the file before Declude slow down ? I think this depends on -what HW-ressources you have in use (CPU, storage,...) -how much mail traffic you have during peak times I've had a problem some days ago by adding two filter files having both around 140 kB (one for body one for header filtering) At midnight all worked fine but next morning at around 9:00 AM it was almost not more possible to logon to the server. Ping whas ok, but it has taken over a minute to display the Terminal services login screen. After logging on I've had to wait for over 5 Minutes to see the desktop. Other 2 Minutes to open the taskmanager and see that there was a lot of declude.exe's having CPU-times of over 60 seconds and consuming all disponible CPU-resources. We've running Imail v7.15 on a Intel P4 2,6 GHz and IDE Raid mirroring Declude Junkmail and Virus with 2 scan engines. First I've tried to disable the second AV engine without a result. After removing the two filter files all become normal. We process around 4000 msgs/day. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by ezaccess.net] --- [This E-mail scanned for viruses by ezaccess.net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] TextFilter file, how many entries ?
Could Declude be run as a Service? - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 30, 2003 9:59 AM Subject: RE: [Declude.JunkMail] TextFilter file, how many entries ? I posted a question two weeks ago asking if anyone knew a way to calculate the amount of time it takes for individual messages to clear the entire receive/virusscan/junkmailscan/deliver process, and this exactly why I asked. My system doesn't have any filters quite as large as 140kb, or even 70k, but I keep adding steadily to them and it feels like things are somewhat slower. I suggest to simply try it out. Create a large filter list (definitively larger than you expect to use in future) and assign to all (random) keywords a weight of 0 and no additional action. This should create the same resource usage as with points. Now set up something to send a little bit more mails then your average mail processing rate (for example a Script sending out 20 messages as fast as possible) You can send it all to the same recipient. Imail/Decludes architecture will not process it faster because the messages are all the same. Put some tipical content (1 to 30 kB of text) in the message body. Watch the cpu usage during normal processing and the simulated mail bombardement. If you want you can also set a line PIDDEBUG ON In your global.cfg file This will write a .PID file for every declude process in you spool folder. Note: it's deleted after the process has finished his task so you have to open it during processing (not easy) In this PID file you can read in milliseconds how long any step takes to finish. All your results are something that can be interesting for multiple users on this list but keep in mind to indicate also what CPU, storage system, ... you've in use. Whats the average/peak message processing rate on your server, ... -- About CPU usage: I've had an idea some months ago and still search someone who can help. The problem: certain spam-tests can be very CPU-intensive. This will prevent us to keep filter files and programming logic as simple as possible. (For example long text filter files, regular expressions) The real problem: Any mailserver running a lot of tests before store or forward the message to the final destination is much more vulnerable for peak usage or also simple mailbomb attacks then a MTA configured to simple deliver any message as fast and efficient as possible. The idea: If declude (or our external spamchk test) could determine an average CPU usage value before start all tests it should be possible to dinamicaly exclude certain resource intensive tests if the CPU average is to high. For example: In the global.cfg file a test could be configured like %75 MYFILTER filter d:\imail\declude\large_bodyfilter.txt x 5 0 This test would run only if declude has determined an average cpu usage below 75% Another problem: declude is called as needed for any single message. It's not a service running around the clock and so it's not able to determine and provide a reliable CPU average value. The solution: A small windows service that calculate and serves the 1, 5 or 10 minute CPU average value. Declude could connect over DCOM or a certain TCP/UDP port to this service before run all other tests. If the average is to high this will comment out automatically the big tests. Such a solution will not decrease the detection rate because certain tests will not run sometimes, but will increase the detection rate because this new tests now can run everytime when it's possible. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] TextFilter file, how many entries ?
Could Declude be run as a Service? No. Declude.exe is called from Imail'S SMTP-Service for every single incoming message. Declude.exe is called in place of or before Imails original exe-file and terminate after the message is delivered socessfully to the destination. The idea is to run a simple service (completely independent from imail or declude) that calculates the average cpu usage value. This can be done be asking the current CPU-usage every one second. (for example) Sec.Cur%. 10s Avg%. 1 0 0 2 20 10 3 20 13 4 20 15 5 0 12 6 90 25 7 90 34 8 95 41 9 100 48 10 100 54 11 100 64 12 100 72 13 100 82 - don't start more resource intensive tests (RIT) 14 100 91 15 80 96 16 50 91 17 30 85 18 30 78 19 0 68 - begin starting RIT 20 10 59 21 ... Maybe the 10 seconds average are not the definitively right time range and maybe it's also necessary to define a trigger-on and trigger-off treshold as used also in common tecnic regluation processes to guarantee a well balanced regulation of the cpu-usage. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] TextFilter file, how many entries ?
I have two virus scanners with JunkMail Pro fully enabled plus 160 KB of active filters (~10 KB in comments) on a dual 1 Ghz PIII/1 Ghz memory/RAID 5/Win2k server also running a bunch of other Web services, and it takes maybe 5-7 seconds for me to send a very short message to myself and have it come back. If I sent a large executable file though, it would take my server 20 seconds or so to get it back to me, probably mostly because of the virus scanning (Declude only scans the first 32K of the message with text filters). Currently we handle just over 3,000 messages a day, and the processors normally don't go over the 15%-20% range. Without the second scanner and all the custom filters, that was more like 5%-7% as a peak. I certainly expect the server to handle much more than 6 times the current traffic. I'll probably be looking to optimize a bit more at that point though. Matt John Shacklett wrote: I posted a question two weeks ago asking if anyone knew a way to calculate the amount of time it takes for individual messages to clear the entire receive/virusscan/junkmailscan/deliver process, and this exactly why I asked. My system doesn't have any filters quite as large as 140kb, or even 70k, but I keep adding steadily to them and it "feels" like things are somewhat slower. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Markus Gufler Sent: Thursday, 30 October 2003 3:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] TextFilter file, how many entries ? My question is, How many entries can I put in the file before Declude slow down ? I think this depends on -what HW-ressources you have in use (CPU, storage,...) -how much mail traffic you have during peak times I've had a problem some days ago by adding two filter files having both around 140 kB (one for body one for header filtering) At midnight all worked fine but next morning at around 9:00 AM it was almost not more possible to logon to the server. Ping whas ok, but it has taken over a minute to display the Terminal services login screen. After logging on I've had to wait for over 5 Minutes to see the desktop. Other 2 Minutes to open the taskmanager and see that there was a lot of declude.exe's having CPU-times of over 60 seconds and consuming all disponible CPU-resources. We've running Imail v7.15 on a Intel P4 2,6 GHz and IDE Raid mirroring Declude Junkmail and Virus with 2 scan engines. First I've tried to disable the second AV engine without a result. After removing the two filter files all become normal. We process around 4000 msgs/day. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Earthlink, AOL, HOTMAIL
Is anybody else having trouble with mail being returned from these domains. The returned email shows no consistent errors and well over half the time only reports that mail was undeliverable. It's not consistent, and does not affect all addresses, but it is wide spread. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Earthlink, AOL, HOTMAIL
The question is what do the Imail logs say? Is the mail being bounced because you can't make a connection? We have not seen any problem with bounces. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Terry Parks Sent: Thursday, October 30, 2003 10:09 AM To: Declude. JunkMail Subject: [Declude.JunkMail] Earthlink, AOL, HOTMAIL Is anybody else having trouble with mail being returned from these domains. The returned email shows no consistent errors and well over half the time only reports that mail was undeliverable. It's not consistent, and does not affect all addresses, but it is wide spread. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filters
Group, Anyone have a good generic myfilter.txt they could send my way? I'd like do more screening based on content. If so, please email it over. Thanks in advance! Best Regards, mri_sr.consultant / Phillip B. Holmes Media Resolutions Inc. [EMAIL PROTECTED] Macromedia Alliance Partner http://www.mediares.com 1-888-395-4678 |Ext. 101 972-889-0201 |Ext. 101 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] '+' Character in DJM Test Names
Hello, All, Is it legit to use a '+' character in your DJM test names, e.g. WEIGHTRANGE10+ ? I just want to make sure it won't break anything. Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Sender blacklists
Can sender blacklists support wildcards? ie. @*.abcdef.com Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Terry Parks Sent: Thursday, October 30, 2003 9:09 AM To: Declude. JunkMail Subject: [Declude.JunkMail] Earthlink, AOL, HOTMAIL Is anybody else having trouble with mail being returned from these domains. The returned email shows no consistent errors and well over half the time only reports that mail was undeliverable. It's not consistent, and does not affect all addresses, but it is wide spread. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] '+' Character in DJM Test Names
Is it legit to use a '+' character in your DJM test names, e.g. WEIGHTRANGE10+ ? I just want to make sure it won't break anything. Yes, that will work fine. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Sender blacklists
Can sender blacklists support wildcards? ie. @*.abcdef.com From Tuesday: I don't believe any files (IMail Kill List or Declude JunkMail blacklists) allow for wildcards. In a Declude JunkMail sender blacklist, you can use .ps01.net to catch @*.ps0.net. In response, though, IMail v8's SMTP Kill File can use wildcards. Instead, you should use: .abcdef.com which will work exactly the same as what you show above. Or, you can use: .abcdef.com @abcdef.com which will catch anything from the abcdef.com domain. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Earthlink, AOL, HOTMAIL
I've looked in the logs and found the following error reported: DNS Server (gives the IP) returned a SERVER FAILURE error for MX or A for (gives the domain). It's actually the IMail SMTP log file entries (SMTP or SMTP-) that you want to look at for problems delivering mail to remote mailservers. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sender blacklists
@abcdef.com will catch @.abcdef.com? It would seem to imply a wildcard between the @ and the rest of the domain name. Is that true? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, October 30, 2003 10:46 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Sender blacklists Can sender blacklists support wildcards? ie. @*.abcdef.com From Tuesday: I don't believe any files (IMail Kill List or Declude JunkMail blacklists) allow for wildcards. In a Declude JunkMail sender blacklist, you can use .ps01.net to catch @*.ps0.net. In response, though, IMail v8's SMTP Kill File can use wildcards. Instead, you should use: .abcdef.com which will work exactly the same as what you show above. Or, you can use: .abcdef.com @abcdef.com which will catch anything from the abcdef.com domain. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sender blacklists
@abcdef.com will catch @.abcdef.com? No. It will only catch E-mail with @abcdef.com in the return address, so it will not catch @.abcdef.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sender blacklists
Thanks for the info. I think we will be upgrading to 8.x to take advantage of the wildcarded kill.lst. Thanks to everyone for their input. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, October 30, 2003 11:12 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Sender blacklists @abcdef.com will catch @.abcdef.com? No. It will only catch E-mail with @abcdef.com in the return address, so it will not catch @.abcdef.com. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMCOP Account
Hello, All, I signed up for a free Spamcop account a few weeks ago and I've been using it to submit spam via their web-based form. In addition to allowing spam submittal via a web-based form they also give you a unique e-mail address which you can forward spam to. I was thinking about setting up Declude JunkMail to send all the mail which I would normally just DELETE because of High weight to this unique e-mail address. Before I do this I had a few questions... 1) Does anyone else do what I am describing? If so, does it work well? 2) If I want to forward all mail above a certain weight, say a weight of 45, would the ROUTETO action be the correct action to use. I don't want to keep a copy of the e-mail in my HOLD directory. 3) If ROUTETO is the correct action, when the message is sent to Spamcop what will the FROM address be? Will it be the original sender's e-mail address or a special e-mail address which DJM assigns to itself? I think that's all for now. Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMCOP Account
Dan.. BE VERY CAREFUL IF YOU DO THIS... We were doing this and once someone from the list sent me an email with bunch of keywords in it.. The system automatically forwarded it to the SPAMCop account. If you do this make sure you review every spam that goes into your account and approve them knowing it is a spam and not someone that just happen to send you bunch of words in your filter file. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Thursday, October 30, 2003 4:53 PM To: Declude JunkMail Subject: [Declude.JunkMail] SPAMCOP Account Hello, All, I signed up for a free Spamcop account a few weeks ago and I've been using it to submit spam via their web-based form. In addition to allowing spam submittal via a web-based form they also give you a unique e-mail address which you can forward spam to. I was thinking about setting up Declude JunkMail to send all the mail which I would normally just DELETE because of High weight to this unique e-mail address. Before I do this I had a few questions... 1) Does anyone else do what I am describing? If so, does it work well? 2) If I want to forward all mail above a certain weight, say a weight of 45, would the ROUTETO action be the correct action to use. I don't want to keep a copy of the e-mail in my HOLD directory. 3) If ROUTETO is the correct action, when the message is sent to Spamcop what will the FROM address be? Will it be the original sender's e-mail address or a special e-mail address which DJM assigns to itself? I think that's all for now. Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMCOP Account
Typically I only send SPAMCOP e-mails that pass through our Declude filters. The theory being that now SPAMCOP will know about that address, list it, and it won't clear Declude again. I don't see the reasoning behind sending SPAMCOP thousands of e-mails per day that are already stopped by your system. The benefit of manually sending is exactly what Kami noted below. You won't inadvertently submit good guys. Also, if you poke around SPAMCOPS site, there is a program you can get called SpamSource that plugs into Outlook. Once installed/configured, all I have to do to report spam is click on the SpamSource button, and it submits to SPAMCOP. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Thursday, October 30, 2003 4:00 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPAMCOP Account Dan.. BE VERY CAREFUL IF YOU DO THIS... We were doing this and once someone from the list sent me an email with bunch of keywords in it.. The system automatically forwarded it to the SPAMCop account. If you do this make sure you review every spam that goes into your account and approve them knowing it is a spam and not someone that just happen to send you bunch of words in your filter file. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Thursday, October 30, 2003 4:53 PM To: Declude JunkMail Subject: [Declude.JunkMail] SPAMCOP Account Hello, All, I signed up for a free Spamcop account a few weeks ago and I've been using it to submit spam via their web-based form. In addition to allowing spam submittal via a web-based form they also give you a unique e-mail address which you can forward spam to. I was thinking about setting up Declude JunkMail to send all the mail which I would normally just DELETE because of High weight to this unique e-mail address. Before I do this I had a few questions... 1) Does anyone else do what I am describing? If so, does it work well? 2) If I want to forward all mail above a certain weight, say a weight of 45, would the ROUTETO action be the correct action to use. I don't want to keep a copy of the e-mail in my HOLD directory. 3) If ROUTETO is the correct action, when the message is sent to Spamcop what will the FROM address be? Will it be the original sender's e-mail address or a special e-mail address which DJM assigns to itself? I think that's all for now. Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMCOP Account
I understand what you are saying here. If there's any chance whatsoever that I would send a legit e-mail to Spamcop as spam then I won't set it up. I think the real problem is that the idea behind Spamcop is people reporting unsolicted E-mail. The failure of enough Declude tests *should* indicate that an E-mail is spam. However, that isn't guaranteed. A good case in point is that Ipswitch made it into a spam database today simply because an E-mail they sent failed too many spam tests. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMCOP Account
Jason, From what I can see on the Spamcop web site the way they decide whether a message should be blacklisted is not solely based on one report. Instead it is based on how many different people submit it, among other things. As long as I'm only submitting unique messages that I am 100% sure are spam then I think I would be helping to enforce the algorithm that Spamcop uses to decide whether messages which are being submitted are spam or not. I'm not talking about submitting thousands of e-mails a day. I think I my current setup deletes about 1200 messages a week. Any feedback on my other 2 questions? Thanks, Dan - Original Message - From: Jason Newland [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 30, 2003 5:17 PM Subject: RE: [Declude.JunkMail] SPAMCOP Account Typically I only send SPAMCOP e-mails that pass through our Declude filters. The theory being that now SPAMCOP will know about that address, list it, and it won't clear Declude again. I don't see the reasoning behind sending SPAMCOP thousands of e-mails per day that are already stopped by your system. The benefit of manually sending is exactly what Kami noted below. You won't inadvertently submit good guys. Also, if you poke around SPAMCOPS site, there is a program you can get called SpamSource that plugs into Outlook. Once installed/configured, all I have to do to report spam is click on the SpamSource button, and it submits to SPAMCOP. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Thursday, October 30, 2003 4:00 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPAMCOP Account Dan.. BE VERY CAREFUL IF YOU DO THIS... We were doing this and once someone from the list sent me an email with bunch of keywords in it.. The system automatically forwarded it to the SPAMCop account. If you do this make sure you review every spam that goes into your account and approve them knowing it is a spam and not someone that just happen to send you bunch of words in your filter file. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Thursday, October 30, 2003 4:53 PM To: Declude JunkMail Subject: [Declude.JunkMail] SPAMCOP Account Hello, All, I signed up for a free Spamcop account a few weeks ago and I've been using it to submit spam via their web-based form. In addition to allowing spam submittal via a web-based form they also give you a unique e-mail address which you can forward spam to. I was thinking about setting up Declude JunkMail to send all the mail which I would normally just DELETE because of High weight to this unique e-mail address. Before I do this I had a few questions... 1) Does anyone else do what I am describing? If so, does it work well? 2) If I want to forward all mail above a certain weight, say a weight of 45, would the ROUTETO action be the correct action to use. I don't want to keep a copy of the e-mail in my HOLD directory. 3) If ROUTETO is the correct action, when the message is sent to Spamcop what will the FROM address be? Will it be the original sender's e-mail address or a special e-mail address which DJM assigns to itself? I think that's all for now. Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the
Re: [Declude.JunkMail] SPAMCOP Account
Scott, I understand what you are saying. But I am only going to be forwarding High Weight spam to SPAMCOP. This is just the spam that I would normally delete. I'm talking about mail that is scored like 55 or higher in my current setup. A message which scores 55 typically has to fail 7 or 8 tests. In the case of Ipswitch, they might have got on a Blacklist but there's no way in my system that they would've failed enough other tests to be flagged as a high weight spam message. Any feedback on my other 2 questions? Thanks, Dan - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 30, 2003 5:36 PM Subject: Re: [Declude.JunkMail] SPAMCOP Account I understand what you are saying here. If there's any chance whatsoever that I would send a legit e-mail to Spamcop as spam then I won't set it up. I think the real problem is that the idea behind Spamcop is people reporting unsolicted E-mail. The failure of enough Declude tests *should* indicate that an E-mail is spam. However, that isn't guaranteed. A good case in point is that Ipswitch made it into a spam database today simply because an E-mail they sent failed too many spam tests. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] JM log entry missing
Using LogLevel=MID, should there be at least one entry for each message that is received (except IMail killed messages)? If not, what would be the conditions to cause no entry in the log file for a particular message? Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] JM log entry missing
Using LogLevel=MID, should there be at least one entry for each message that is received (except IMail killed messages)? Yes, there should (unless Declude Virus or Declude Hijack blocks the E-mail). If you see an SMTP or SMTP- line in the IMail log file, you should definitely see at least one entry in the Declude JunkMail log file (at LOGLEVEL LOW or higher, unless you use LOG_OK NONE). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
