[Declude.JunkMail] can this be done?
Hi, Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] can this be done?
Hi Andy: We do this by using weightrange. We simply add a weight that is way out of the range of other tests, e.g. 1000 Then we bracket the tests and apply different actions on different ranges. When you use this type of weighing.. For example every test is 1 or 2 or 20.. The collection of all tests can never get to 1000 - so a single test can be gated and picked up using weight range easily.. This is an example of what we have in the global.cfg. WEIGHT15-19sweightrange x x 15 19 WEIGHT15-19cweightrange x x 15 19 WEIGHT20s weight x x 20 0 WEIGHT20r weight x x 20 0 WEIGHT60-999weightrange x x 60 999 WEIGHTIMGFXsweight x x 10000 WEIGHTIMGFXrweight x x 10000 WEIGHT1100-1500 weightrange x x 11001500 Then in the default$ we take action on each of these ranges separately. Please note: s suffix is for adding to the subject a note and the r is for other actions. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Sunday, November 30, 2003 9:09 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] can this be done? Hi, Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FABELSOURCES service dropped
I don't know whether this is news to anyone here, but I found this during my research for a replacement for EasyNet and thought I'd pass it along because it is still listed as active in the Declude DNS Database list. http://www.fabel.dk/relay/test/ Actually, it appears that the DEVNULL test died, not FABELSOURCES. http://www.fabel.dk/relay/test/ isn't clear exactly what happened -- they say that their tester is offline, but doesn't specify that any of their spam tests died. They do say that dev.null.dk (DEVNULL) is now empty, but that it may be back, and they don't say anything about FABELSOURCES (spamsources.fabel.dk). Worse, both tests have the test entry 127.0.0.2 -- so both look like they are live. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] X-Header filter weight reporting
Scott, would it make sense to report in the X-RBL-Warning filter headers the weights as defined by MAXWEIGHT in the filter file whenever the total filter score is more than what is defined by the MAXWEIGHT setting? That way when you visually add up all of the X-Header weights, the score will match that shown in the X-Note: Total spam test weight: %WEIGHT% header. Good idea -- this will be changed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IPBYPASS limitations
I understand - I think - about IPBYPASS but HOPHIGH is another story.. HOPHIGH, if used, will cause Declude JunkMail to scan extra hops. For example, if I was to set up our mailserver to send this E-mail through our ISP's mailserver, Declude JunkMail would normally just scan the IP of our ISP's mailserver. But with HOPHIGH 1, the IPs of both the ISP's mailserver and ours would be scanned. This is useful to catch spam that is forwarded from an account on another server to an account on yours. It was also useful in the old days before open proxies, where a spammer might find an IP that wasn't listed in any spam databases, and he would relay through it -- but the IP the spammer was sending to the open relay from was listed in spam databases. I am interested because often times mail is forwarded to my server and as such some tests are not as effective. As an example sombody@example.com send an email to a server that in turn forwards the email to one of my users. Spamdomains fails because the connecting server to me was not example.com but foo.com Would hophigh help me out with this - see who originally sent the email? Yes, it would. What is the downside to HOPHIGH=1 other than more dns work and if that is the case is it negligible? What is its real purpose? It does involve extra DNS usage, and delays the E-mail from being delivered for slightly longer in waiting for the results. But that is about it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Simple logic..
Any thoughts on adding some logic to Declude.. Simple logic.. Like: Actions that set the result immediately in the filter. (e.g. ENDALLTests or Delete) This is something that we will be looking into. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] can this be done?
Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Yes. If you use the default configuration, you can just use SPAMCOP HOLD, and it will do what you want. The default configuration includes a weight for each test. The weight tests then work exactly like other tests -- you can have an action for any of them. So you could have WEIGHT20 DELETE and SPAMCOP HOLD. In this case, any E-mail failing the SPAMCOP test will be held, and E-mail failing the WEIGHT20 test will be deleted. Any E-mail failing both SPAMCOP and WEIGHT20 will be deleted (since DELETE takes priority over hold). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] can this be done?
Kami, That's way too complicated for my simple mind. I have no idea what is happening in the example. Simple is way better and fits my less than genius IQ. If that's the only way, I'll just make SPAMCOP have a weight of 10, then it will HOLD. I was hoping I could do it by putting a HOLD action on SPAMCOP, but it could be added to the WEIGHT tests also. Thanks, Andy - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, November 30, 2003 10:17 AM Subject: RE: [Declude.JunkMail] can this be done? Hi Andy: We do this by using weightrange. We simply add a weight that is way out of the range of other tests, e.g. 1000 Then we bracket the tests and apply different actions on different ranges. When you use this type of weighing.. For example every test is 1 or 2 or 20.. The collection of all tests can never get to 1000 - so a single test can be gated and picked up using weight range easily.. This is an example of what we have in the global.cfg. WEIGHT15-19s weightrange x x 15 19 WEIGHT15-19c weightrange x x 15 19 WEIGHT20s weight x x 20 0 WEIGHT20r weight x x 20 0 WEIGHT60-999 weightrange x x 60 999 WEIGHTIMGFXs weight x x 1000 0 WEIGHTIMGFXr weight x x 1000 0 WEIGHT1100-1500 weightrange x x 1100 1500 Then in the default$ we take action on each of these ranges separately. Please note: s suffix is for adding to the subject a note and the r is for other actions. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Sunday, November 30, 2003 9:09 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] can this be done? Hi, Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] can this be done?
Of course you have seen Scott's response. That is really what you need. Our system does a little more gating.. Just to give you an example.. We use IMAGEFX's blacklist. But we do not want that list to be used for regular weight since we always block the emails blacklisted by that list and then add it to our blacklist- this way our blacklist is added to Imail's blocked email which saves us a lot of processing. So to make sure IMageFX does not add to the weights and is treated separately we make it a 1000 in weight. This way no entry in that list is ever deleted. We hold on 20 and delete on 60. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Sunday, November 30, 2003 11:01 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] can this be done? Kami, That's way too complicated for my simple mind. I have no idea what is happening in the example. Simple is way better and fits my less than genius IQ. If that's the only way, I'll just make SPAMCOP have a weight of 10, then it will HOLD. I was hoping I could do it by putting a HOLD action on SPAMCOP, but it could be added to the WEIGHT tests also. Thanks, Andy - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, November 30, 2003 10:17 AM Subject: RE: [Declude.JunkMail] can this be done? Hi Andy: We do this by using weightrange. We simply add a weight that is way out of the range of other tests, e.g. 1000 Then we bracket the tests and apply different actions on different ranges. When you use this type of weighing.. For example every test is 1 or 2 or 20.. The collection of all tests can never get to 1000 - so a single test can be gated and picked up using weight range easily.. This is an example of what we have in the global.cfg. WEIGHT15-19s weightrange x x 15 19 WEIGHT15-19c weightrange x x 15 19 WEIGHT20s weight x x 20 0 WEIGHT20r weight x x 20 0 WEIGHT60-999 weightrange x x 60 999 WEIGHTIMGFXs weight x x 1000 0 WEIGHTIMGFXr weight x x 1000 0 WEIGHT1100-1500 weightrange x x 1100 1500 Then in the default$ we take action on each of these ranges separately. Please note: s suffix is for adding to the subject a note and the r is for other actions. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Sunday, November 30, 2003 9:09 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] can this be done? Hi, Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude Pro v1.76i28 - Bounce is not an Action Error Warning
The following is from the log, in debug. The entries in global and junkmail look o.k. I'll send them, if you want them. 11/30/2003 10:18:22 Q182808dd00fa1619 Using [incoming] CFG file D:\IMail\Declude\xxxCHANGEDxxx.com\$default$.junkmail. 11/30/2003 10:18:22 Q182808dd00fa1619 Warning: misconfiguration in following line in configuration file (BOUNCE is not an ACTION). May be a duplicate test definition? 11/30/2003 10:18:22 Q182808dd00fa1619 Warning: misconfiguration in following line in configuration file (BOUNCE is not an ACTION). May be a duplicate test definition? 11/30/2003 10:18:22.546 Q182808dd00fa1619 ...X.X.X..X..X..X.XX.XX.X...X 11/30/2003 10:18:22.546 Q182808dd00fa1619 Test #19 [CBL weight=10] triggered; action = 0 [Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=211.40.36.37] Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Pro v1.76i28 - Bounce is not an Action Error Warning an Action Error Warning
11/30/2003 10:18:22 Q182808dd00fa1619 Warning: misconfiguration in following line in configuration file (BOUNCE is not an ACTION). The latest interim release requires the name of the action to be changed to BOUNCEONLYIFYOUMUST, because it seems that a very large number of our customers are using the BOUNCE action thinking that the spammer will receive the bounce message, and not realizing that they will be spamming themselves. Fortunately, most people on this list realize that it should only be used in cases where the E-mail is very likely to be legitimate, and the sender must know that the E-mail was not delivered. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering on Imail spam tests
Matt, As soon as I can afford it I'm buying Message Sniffer. Running it as a trial, it proved itself to be an obvious winner. Have you tried SPAMCHK? It takes some configging but for me at least it does a great job - and its free. http://www.spamchk.com -Nick Hayer --Matt Robertson-- MSB Designs, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IPBYPASS limitations
Thanks! -Nick -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Sun, 30 Nov 2003 08:26:59 -0500 I understand - I think - about IPBYPASS but HOPHIGH is another story.. HOPHIGH, if used, will cause Declude JunkMail to scan extra hops. For example, if I was to set up our mailserver to send this E-mail through our ISP's mailserver, Declude JunkMail would normally just scan the IP of our ISP's mailserver. But with HOPHIGH 1, the IPs of both the ISP's mailserver and ours would be scanned. This is useful to catch spam that is forwarded from an account on another server to an account on yours. It was also useful in the old days before open proxies, where a spammer might find an IP that wasn't listed in any spam databases, and he would relay through it -- but the IP the spammer was sending to the open relay from was listed in spam databases. I am interested because often times mail is forwarded to my server and as such some tests are not as effective. As an example sombody@example.com send an email to a server that in turn forwards the email to one of my users. Spamdomains fails because the connecting server to me was not example.com but foo.com Would hophigh help me out with this - see who originally sent the email? Yes, it would. What is the downside to HOPHIGH=1 other than more dns work and if that is the case is it negligible? What is its real purpose? It does involve extra DNS usage, and delays the E-mail from being delivered for slightly longer in waiting for the results. But that is about it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering on Imail spam tests
Nick wrote: Have you tried SPAMCHK? It takes some configging but for me at least it does a great job - and its free. http://www.spamchk.com Never heard of it, but you can bet I'm going to look it over very closely. Thanks for the tip! Cool site banner. --Matt-- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] CATCHALLMAILS
Does anyone know why I am getting this in the Declude log file. 11/30/2003 23:27:44 Warning: misconfiguration in following line in configuration file (catchallmails is not an ACTION). May be a duplicate test definition? 11/30/2003 23:27:44 catchallmails x x 0 0 Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] CATCHALLMAILS
Belay my last. I had a duplicate entry. Thanks. Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] CATCHALLMAILS
Does anyone know why I am getting this in the Declude log file. 'catchallmails' is a test type; it needs a test name as well to function. -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
