[Declude.JunkMail] MailFrom issues
Panda Consulting S.A. Luis Alberto Arango E. Hi. Yesterday (Wednesday)afternoon, I had some false positives from users that I usually receive mail from, after failing mainly the MailFrom test Reason: Domain "name of the domain here" has no MX or A records Domains are working fine and they have MXs. Even one of the domains is in my Imail Server (where declude runs). How does Declude perform the MailFrom test? What DNS does it use? Is it a problem with the DNS's configured in the IMAIL box? Thanks in advance for your comments. -Luis Arango __ [Email scanned for viruses by Panda Consulting -www.pandacons.com-] [Email escaneado contra virus por Panda Consulting -www.pandacons.com-] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
LOL From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Wednesday, December 08, 2004 4:01 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? D N JO T U G SY - TO HU O C S HM T EE I CA N KN G I . N C G O M:)Dan Geiser wrote: No, that is not the domain name that I am referring to. If you look at my >From Address you will see it as N T G - H O S T I N G. C O M. - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:34 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Dan, I know I am not THAT obtuse. Isn't your domain... n e x u s t e c h g r o u p -- d o t -- c o m ??? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Che, NOT the address that I typed in my e-mail. Look at my From Address in my original post. Thanks, Dan - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:19 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Dan...I am not having any luck. Am I doing something wrong? I replace the last five chars of your domain. http://declude.nexustech?.com/ Regards, Che -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:12 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Che, You can see everything that I am currently doing here... http://declude./ Replace with the domain that I use to post to the list. Please let me know if you have any questions. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 12:32 PM Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? I hope I am posting this in the right place... Hello all. I've asked this before and had no takers. I'd like to see some real working examples of how Declude users have set up their respective config files with weights, rules, etc. I'd like to tighten up my Declude settings, but unfortunately I am not an experienced declude user/network admin like many of you are. Can anyone help? Is this wrong of me to even ask for? Thanks in advance! ~Che --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at htt
RE: [Declude.JunkMail] OT - RevDNS lookups by range
I created a tool to do just this. Break it for me and I will fix it. http://www.ssc-isp.net/HoldAnalyzer/rdnsclassclookup.aspx Kevin Bilbee -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of MattSent: Wednesday, December 08, 2004 12:18 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] OT - RevDNS lookups by rangeScott,I've been using a tool called Angry IP Scanner. It sometimes dies on bad data being returned, but otherwise it is a good tool for querrying large blocks of IP's for reverse DNS entries. I would strongly suggest that you turn off the port detection since it really doesn't give reliable results (based on how the servers are configured).MattScott Fisher wrote: I like to research a range of Reverse DNS entries before potentially blocking a IP range. I'm looking tool (an online one would be fantastic) where I could type in a range say 209.200.18.0 (today's culprit) and it would provide a list of Reverse DNS entries for 209.200.18.0 through 209.200.18.255. This would be a time saver in creating my own IP blacklists. Any suggestions? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] WAY OT: Syslog entries from Cisco ACL question
Rick, My understanding is if the packet is rejected or allowed before the port information is needed for comparison Cisco IOS will log it as port 0. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. Rick Davidson writes: Does anyone know what traffic uses a destination and source port of 0? Or what else I should look for? This is a Novell/windows network I have something odd going on at a large branch office so I added an acl to log the inbound and outbound traffic permit ip any any log permitted tcp 10.10.0.72(0) -> 10.10.9.18(0), 1 packet permitted udp 10.10.0.98(0) -> 10.10.9.10(0), 1 packet I have ALOT of lines with many source and destination addresses, the IPs are valid for the network Thanks for any help Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
D N J O T U G S Y - T O H U O C S H M T E E I C A N K N G I . N C G O M :) Dan Geiser wrote: No, that is not the domain name that I am referring to. If you look at my >From Address you will see it as N T G - H O S T I N G. C O M. - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:34 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Dan, I know I am not THAT obtuse. Isn't your domain... n e x u s t e c h g r o u p -- d o t -- c o m ??? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Che, NOT the address that I typed in my e-mail. Look at my From Address in my original post. Thanks, Dan - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:19 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Dan...I am not having any luck. Am I doing something wrong? I replace the last five chars of your domain. http://declude.nexustech?.com/ Regards, Che -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:12 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Che, You can see everything that I am currently doing here... http://declude./ Replace with the domain that I use to post to the list. Please let me know if you have any questions. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 12:32 PM Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? I hope I am posting this in the right place... Hello all. I've asked this before and had no takers. I'd like to see some real working examples of how Declude users have set up their respective config files with weights, rules, etc. I'd like to tighten up my Declude settings, but unfortunately I am not an experienced declude user/network admin like many of you are. Can anyone help? Is this wrong of me to even ask for? Thanks in advance! ~Che --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
my apologies...i did not see that anywhere. thank you for all of your help. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:46 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? No, that is not the domain name that I am referring to. If you look at my >From Address you will see it as N T G - H O S T I N G. C O M. - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:34 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > Dan, I know I am not THAT obtuse. Isn't your domain... > n e x u s t e c h g r o u p -- d o t -- c o m ??? > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > Sent: Wednesday, December 08, 2004 3:23 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday giving mood? > > > Che, > NOT the address that I typed in my e-mail. Look at my From Address in my > original post. > > Thanks, > Dan > > - Original Message - > From: "Che Vilnonis" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 08, 2004 3:19 PM > Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday giving mood? > > > > Dan...I am not having any luck. Am I doing something wrong? > > I replace the last five chars of your domain. > > http://declude.nexustech?.com/ > > > > Regards, Che > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > > Sent: Wednesday, December 08, 2004 3:12 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the > > holiday giving mood? > > > > > > Che, > > You can see everything that I am currently doing here... > > > > http://declude./ > > > > Replace with the domain that I use to post to the list. > > > > Please let me know if you have any questions. > > > > Thanks, > > Dan Geiser > > [EMAIL PROTECTED] > > > > - Original Message - > > From: "Che Vilnonis" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Wednesday, December 08, 2004 12:32 PM > > Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday > > giving mood? > > > > > > > I hope I am posting this in the right place... > > > > > > Hello all. I've asked this before and had no takers. > > > I'd like to see some real working examples of how Declude > > > users have set up their respective config files with weights, > > > rules, etc. > > > > > > I'd like to tighten up my Declude settings, but unfortunately > > > I am not an experienced declude user/network admin like many > > > of you are. Can anyone help? Is this wrong of me to even ask for? > > > > > > Thanks in advance! > > > ~Che > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > --- > > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > > http://www.nexustechgroup.com/mailscan > > > > > > > > > > --- > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > http://www.nexustechgroup.com/mailscan > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > http://www.nexustechgroup.com/mailscan > > > > > > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkM
Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
No, that is not the domain name that I am referring to. If you look at my >From Address you will see it as N T G - H O S T I N G. C O M. - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:34 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > Dan, I know I am not THAT obtuse. Isn't your domain... > n e x u s t e c h g r o u p -- d o t -- c o m ??? > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > Sent: Wednesday, December 08, 2004 3:23 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday giving mood? > > > Che, > NOT the address that I typed in my e-mail. Look at my From Address in my > original post. > > Thanks, > Dan > > - Original Message - > From: "Che Vilnonis" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 08, 2004 3:19 PM > Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday giving mood? > > > > Dan...I am not having any luck. Am I doing something wrong? > > I replace the last five chars of your domain. > > http://declude.nexustech?.com/ > > > > Regards, Che > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > > Sent: Wednesday, December 08, 2004 3:12 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the > > holiday giving mood? > > > > > > Che, > > You can see everything that I am currently doing here... > > > > http://declude./ > > > > Replace with the domain that I use to post to the list. > > > > Please let me know if you have any questions. > > > > Thanks, > > Dan Geiser > > [EMAIL PROTECTED] > > > > - Original Message - > > From: "Che Vilnonis" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Wednesday, December 08, 2004 12:32 PM > > Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday > > giving mood? > > > > > > > I hope I am posting this in the right place... > > > > > > Hello all. I've asked this before and had no takers. > > > I'd like to see some real working examples of how Declude > > > users have set up their respective config files with weights, > > > rules, etc. > > > > > > I'd like to tighten up my Declude settings, but unfortunately > > > I am not an experienced declude user/network admin like many > > > of you are. Can anyone help? Is this wrong of me to even ask for? > > > > > > Thanks in advance! > > > ~Che > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > --- > > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > > http://www.nexustechgroup.com/mailscan > > > > > > > > > > --- > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > http://www.nexustechgroup.com/mailscan > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > http://www.nexustechgroup.com/mailscan > > > > > > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing l
Re: [Declude.JunkMail] OT - RevDNS lookups by range
Well, I do like the name. I'll give it a shot. Finding the ranges in dnsstuff.com is too much of a chore. - Original Message - From: Matt To: [EMAIL PROTECTED] Sent: Wednesday, December 08, 2004 2:18 PM Subject: Re: [Declude.JunkMail] OT - RevDNS lookups by range Scott,I've been using a tool called Angry IP Scanner. It sometimes dies on bad data being returned, but otherwise it is a good tool for querrying large blocks of IP's for reverse DNS entries. I would strongly suggest that you turn off the port detection since it really doesn't give reliable results (based on how the servers are configured).MattScott Fisher wrote: I like to research a range of Reverse DNS entries before potentially blocking a IP range. I'm looking tool (an online one would be fantastic) where I could type in a range say 209.200.18.0 (today's culprit) and it would provide a list of Reverse DNS entries for 209.200.18.0 through 209.200.18.255. This would be a time saver in creating my own IP blacklists. Any suggestions? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
Dan, I know I am not THAT obtuse. Isn't your domain... n e x u s t e c h g r o u p -- d o t -- c o m ??? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Che, NOT the address that I typed in my e-mail. Look at my From Address in my original post. Thanks, Dan - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:19 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > Dan...I am not having any luck. Am I doing something wrong? > I replace the last five chars of your domain. > http://declude.nexustech?.com/ > > Regards, Che > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > Sent: Wednesday, December 08, 2004 3:12 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday giving mood? > > > Che, > You can see everything that I am currently doing here... > > http://declude./ > > Replace with the domain that I use to post to the list. > > Please let me know if you have any questions. > > Thanks, > Dan Geiser > [EMAIL PROTECTED] > > - Original Message - > From: "Che Vilnonis" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 08, 2004 12:32 PM > Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday > giving mood? > > > > I hope I am posting this in the right place... > > > > Hello all. I've asked this before and had no takers. > > I'd like to see some real working examples of how Declude > > users have set up their respective config files with weights, > > rules, etc. > > > > I'd like to tighten up my Declude settings, but unfortunately > > I am not an experienced declude user/network admin like many > > of you are. Can anyone help? Is this wrong of me to even ask for? > > > > Thanks in advance! > > ~Che > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > http://www.nexustechgroup.com/mailscan > > > > > > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
Che, NOT the address that I typed in my e-mail. Look at my From Address in my original post. Thanks, Dan - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 3:19 PM Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > Dan...I am not having any luck. Am I doing something wrong? > I replace the last five chars of your domain. > http://declude.nexustech?.com/ > > Regards, Che > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > Sent: Wednesday, December 08, 2004 3:12 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the > holiday giving mood? > > > Che, > You can see everything that I am currently doing here... > > http://declude./ > > Replace with the domain that I use to post to the list. > > Please let me know if you have any questions. > > Thanks, > Dan Geiser > [EMAIL PROTECTED] > > - Original Message - > From: "Che Vilnonis" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 08, 2004 12:32 PM > Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday > giving mood? > > > > I hope I am posting this in the right place... > > > > Hello all. I've asked this before and had no takers. > > I'd like to see some real working examples of how Declude > > users have set up their respective config files with weights, > > rules, etc. > > > > I'd like to tighten up my Declude settings, but unfortunately > > I am not an experienced declude user/network admin like many > > of you are. Can anyone help? Is this wrong of me to even ask for? > > > > Thanks in advance! > > ~Che > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > > http://www.nexustechgroup.com/mailscan > > > > > > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
Dan...I am not having any luck. Am I doing something wrong? I replace the last five chars of your domain. http://declude.nexustech?.com/ Regards, Che -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser Sent: Wednesday, December 08, 2004 3:12 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? Che, You can see everything that I am currently doing here... http://declude./ Replace with the domain that I use to post to the list. Please let me know if you have any questions. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 12:32 PM Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > I hope I am posting this in the right place... > > Hello all. I've asked this before and had no takers. > I'd like to see some real working examples of how Declude > users have set up their respective config files with weights, > rules, etc. > > I'd like to tighten up my Declude settings, but unfortunately > I am not an experienced declude user/network admin like many > of you are. Can anyone help? Is this wrong of me to even ask for? > > Thanks in advance! > ~Che > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WAY OT: Syslog entries from Cisco ACL question
Does anyone know what traffic uses a destination and source port of 0? Or what else I should look for? This is a Novell/windows network I have something odd going on at a large branch office so I added an acl to log the inbound and outbound traffic permit ip any any log permitted tcp 10.10.0.72(0) -> 10.10.9.18(0), 1 packet permitted udp 10.10.0.98(0) -> 10.10.9.10(0), 1 packet I have ALOT of lines with many source and destination addresses, the IPs are valid for the network Thanks for any help Rick Davidson National Systems Manager North American Title Group - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT - RevDNS lookups by range
Scott, I've been using a tool called Angry IP Scanner. It sometimes dies on bad data being returned, but otherwise it is a good tool for querrying large blocks of IP's for reverse DNS entries. I would strongly suggest that you turn off the port detection since it really doesn't give reliable results (based on how the servers are configured). Matt Scott Fisher wrote: I like to research a range of Reverse DNS entries before potentially blocking a IP range. I'm looking tool (an online one would be fantastic) where I could type in a range say 209.200.18.0 (today's culprit) and it would provide a list of Reverse DNS entries for 209.200.18.0 through 209.200.18.255. This would be a time saver in creating my own IP blacklists. Any suggestions? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
Che, You can see everything that I am currently doing here... http://declude./ Replace with the domain that I use to post to the list. Please let me know if you have any questions. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 12:32 PM Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > I hope I am posting this in the right place... > > Hello all. I've asked this before and had no takers. > I'd like to see some real working examples of how Declude > users have set up their respective config files with weights, > rules, etc. > > I'd like to tighten up my Declude settings, but unfortunately > I am not an experienced declude user/network admin like many > of you are. Can anyone help? Is this wrong of me to even ask for? > > Thanks in advance! > ~Che > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > Sign up for virus-free and spam-free e-mail with Nexus Technology Group > http://www.nexustechgroup.com/mailscan > > --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log file locking
IF the log file is locked and declude tried to write to it, what happens if declude can't? The log file entry won't be saved. Declude will continue to function as it normally would, except with one (or more) less log file entries. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
Some people do share, other's may not. I've found specific questions are always better responded to than general questions. It all depends on the time you want to spend. Spam chasing can be a time blackhole, especially if you have perfectionist traits. 1. If you don't want to spend lots of time. Message Sniffer. Less than a buck a day. Catches about 95%+ of all the spam. With about .2% false positives here. 2. If you have JunkMail Pro which allows filters, Matt at Mailpure has some filters that are a good starting place. The filters are very good at pairing with Sniffer. A reliable IP4R hit and a sniffer hit is almost certainly spam. 3. Marcus has spamtest quality reports on his website. http://www2.spamchk.com/public.html This tells you common tests (Declude, spamdomains, IP4R, RHSBL) and how many spam vs. ham hits there are for each test. For instance CBL, 53k hits out of 113k mails with 144 misses. Pretty reliable and you should make well weighted. - Original Message - From: "Che Vilnonis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 11:32 AM Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood? > I hope I am posting this in the right place... > > Hello all. I've asked this before and had no takers. > I'd like to see some real working examples of how Declude > users have set up their respective config files with weights, > rules, etc. > > I'd like to tighten up my Declude settings, but unfortunately > I am not an experienced declude user/network admin like many > of you are. Can anyone help? Is this wrong of me to even ask for? > > Thanks in advance! > ~Che > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Log file locking
I have 3 inbound relayers running declude and I want to consolidate the log files to a single system. I'm planning on using Microsoft's robocopy utility to copy the log files. I'm not sure if robocopy locks the source file during the copy or not so here's my question.. IF the log file is locked and declude tried to write to it, what happens if declude can't? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?
Ok so this is really working how I'd like it to The rule is defined with a global.cfg weight of -1000 If the domain is whitelisted then the -1000 is applied to any non-filter type tests and NO other filters are run. In essence the domain is whitelisted because all of the other non-filter tests I have don't add up to 1000. Sound right? > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of R. > Scott Perry > Sent: Wednesday, December 08, 2004 12:39 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Does STOPALLTESTS really stop > all tests? > > > >I've got a whitelist filter file where I use the action > "STOPALLTESTS": > > > >MAILFROMSTOPALLTESTSCONTAINS@netrends.com > > > >This rule is defined as the first rule in my global.cfg > (above all of > >the IP4r, Catchall, externals, etc.) If it trips the > WHITELIST filter, > >why do the other tests (see declog below) register? > > That's because it is only designed to stop tests that occur > *after* this one. So any non-filter tests will still run, > and any filter tests that are defined before this test will run. > > STOPALLTESTS was designed to minimize CPU usage. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers since 2000. > Declude Virus: Ultra reliable virus detection and the leader > in mailserver vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > This outgoing message is guaranteed to be authentic by > Message Level users. > Guarantee the authenticity of your email @ > http://www.messagelevel.com. > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?
I've got a whitelist filter file where I use the action "STOPALLTESTS": MAILFROMSTOPALLTESTSCONTAINS@netrends.com This rule is defined as the first rule in my global.cfg (above all of the IP4r, Catchall, externals, etc.) If it trips the WHITELIST filter, why do the other tests (see declog below) register? That's because it is only designed to stop tests that occur *after* this one. So any non-filter tests will still run, and any filter tests that are defined before this test will run. STOPALLTESTS was designed to minimize CPU usage. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?
Filters are run last. - Original Message - From: "Mark E. Smith" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 08, 2004 11:26 AM Subject: [Declude.JunkMail] Does STOPALLTESTS really stop all tests? > I've got a whitelist filter file where I use the action "STOPALLTESTS": > > MAILFROM STOPALLTESTS CONTAINS @netrends.com > > This rule is defined as the first rule in my global.cfg (above all of the > IP4r, Catchall, externals, etc.) > If it trips the WHITELIST filter, why do the other tests (see declog below) > register? > > -0- > > 12/08/2004 12:00:35 Q3330261c009c1d52 Filter: Set min weight to -1000. > 12/08/2004 12:00:35 Q3330261c009c1d52 Triggered MAILFROM CONTAINS filter > WHITELISTFILTER on @netrends.com [weight->0; @netrends.com]. > 12/08/2004 12:00:35 Q3330261c009c1d52 nIPNOTINMX:-30 nNOLEGITCONTENT:-50 . > Total weight = -80. > 12/08/2004 12:00:35 Q3330261c009c1d52 Using [outgoing] CFG file global.cfg. > 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed CATCHALLMAILS (). > Action=WARN. > 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed SIZE-XS (Message failed > SIZE-XS: 12.). Action=WARN. > 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed MS-WHITE (Message failed > MS-WHITE: 0.). Action=WARN. > 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed WEIGHTLEGIT (Total weight > between -5000 and 119.). Action=WARN. > 12/08/2004 12:00:35 Q3330261c009c1d52 R1 Message OK > 12/08/2004 12:00:35 Q3330261c009c1d52 Subject: testing > 12/08/2004 12:00:35 Q3330261c009c1d52 From: [EMAIL PROTECTED] To: > [EMAIL PROTECTED] IP: 65.196.89.161 ID: > 12/08/2004 12:00:35 Q3330261c009c1d52 Tests failed [weight=-80]: > CATCHALLMAILS=WARN SIZE-XS=WARN MS-WHITE=WARN WEIGHTLEGIT=WARN > 12/08/2004 12:00:35 Q3330261c009c1d52 Last action = IGNORE. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?
I hope I am posting this in the right place... Hello all. I've asked this before and had no takers. I'd like to see some real working examples of how Declude users have set up their respective config files with weights, rules, etc. I'd like to tighten up my Declude settings, but unfortunately I am not an experienced declude user/network admin like many of you are. Can anyone help? Is this wrong of me to even ask for? Thanks in advance! ~Che --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Does STOPALLTESTS really stop all tests?
I've got a whitelist filter file where I use the action "STOPALLTESTS": MAILFROMSTOPALLTESTSCONTAINS@netrends.com This rule is defined as the first rule in my global.cfg (above all of the IP4r, Catchall, externals, etc.) If it trips the WHITELIST filter, why do the other tests (see declog below) register? -0- 12/08/2004 12:00:35 Q3330261c009c1d52 Filter: Set min weight to -1000. 12/08/2004 12:00:35 Q3330261c009c1d52 Triggered MAILFROM CONTAINS filter WHITELISTFILTER on @netrends.com [weight->0; @netrends.com]. 12/08/2004 12:00:35 Q3330261c009c1d52 nIPNOTINMX:-30 nNOLEGITCONTENT:-50 . Total weight = -80. 12/08/2004 12:00:35 Q3330261c009c1d52 Using [outgoing] CFG file global.cfg. 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed CATCHALLMAILS (). Action=WARN. 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed SIZE-XS (Message failed SIZE-XS: 12.). Action=WARN. 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed MS-WHITE (Message failed MS-WHITE: 0.). Action=WARN. 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed WEIGHTLEGIT (Total weight between -5000 and 119.). Action=WARN. 12/08/2004 12:00:35 Q3330261c009c1d52 R1 Message OK 12/08/2004 12:00:35 Q3330261c009c1d52 Subject: testing 12/08/2004 12:00:35 Q3330261c009c1d52 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 65.196.89.161 ID: 12/08/2004 12:00:35 Q3330261c009c1d52 Tests failed [weight=-80]: CATCHALLMAILS=WARN SIZE-XS=WARN MS-WHITE=WARN WEIGHTLEGIT=WARN 12/08/2004 12:00:35 Q3330261c009c1d52 Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DomainKeys ?
Yes, I have seen more DomainKeys DNS entries lately and DomainKeys information in headers from Spam. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of R. > Scott Perry > Sent: Wednesday, December 08, 2004 4:15 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] DomainKeys ? > > > >Does Declude support Domain Keys or is there a DomainKeys > external test > >available? > > No, it does not. > > When we last researched Domain Keys, it appeared to be quite > complex, and not very popular. It does seem to be gaining > some popularity, so we may do some more research about it in > the near future. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers since 2000. > Declude Virus: Ultra reliable virus detection and the leader > in mailserver vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > This outgoing message is guaranteed to be authentic by > Message Level users. > Guarantee the authenticity of your email @ > http://www.messagelevel.com. > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT - RevDNS lookups by range
I like to research a range of Reverse DNS entries before potentially blocking a IP range. I'm looking tool (an online one would be fantastic) where I could type in a range say 209.200.18.0 (today's culprit) and it would provide a list of Reverse DNS entries for 209.200.18.0 through 209.200.18.255. This would be a time saver in creating my own IP blacklists. Any suggestions?
Re: [Declude.JunkMail] ZIP files
If you just want to turn off virus filtering for a domain, you can do so in the virus_domains.txt file. Darin. - Original Message - From: "Matt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, December 07, 2004 11:06 PM Subject: Re: [Declude.JunkMail] ZIP files You need Declude Virus Pro, and if you have this, search the manual for "per-user" and it will show you how it is done (you need both the virus_domains.txt and virus_users.txt files to be present). Matt Richard Farris wrote: > How do you exclude an address from being filtered from viruses.. > > Richard Farris > Ethixs Online > 1.270.247. Office > 1.800.548.3877 Tech Support > "Crossroads to a Cleaner Internet" > > - Original Message - From: "Matt" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Tuesday, December 07, 2004 12:40 PM > Subject: Re: [Declude.JunkMail] ZIP files > > >> Richard, >> >> With Declude Virus Pro, you can exclude individual addresses or >> domains from all virus scanning. Needless to say, better granularity >> in Declude Virus is widely sought after in this sense, and it will >> come I'm sure if people keep asking for it. >> >> BTW, I'm personally not a proponent of blocking zip files and we do >> not have hardly any issues as a result. Since almost all viruses are >> sent from DUL space, and also have numerous technical issues, our >> spam blocking will generally tag the viruses that pass through >> scanning in the early hours of a new outbreak. You can also get more >> serious by creating a set of filters in Declude JunkMail Pro that >> targets zip file attachments of a certain size range, and tags them >> with a fair amount of weight, but generally won't push them over the >> top on their own. I'm planning on doing this in my own system, but >> it isn't a priority in comparison to other things since the things >> that pass through are very few in number, and zip viruses are >> somewhat ineffective since they can't auto-execute and need to be >> unzipped. >> >> Matt >> >> >> >> >> >> >> Richard Farris wrote: >> >>> I am blocking zip files in the virus filterbut I have one >>> customer who really needs to use them without renaming files...is >>> there a way to have one customers not looked at for a particular >>> virus or all viruses..or is there a way that zip files can be >>> filtered with a spam rule... >>> >>> Richard Farris >>> Ethixs Online >>> 1.270.247. Office >>> 1.800.548.3877 Tech Support >>> "Crossroads to a Cleaner Internet" >>> >>> --- >>> [This E-mail was scanned for viruses by Declude Virus >>> (http://www.declude.com)] >>> >>> --- >>> This E-mail came from the Declude.JunkMail mailing list. To >>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>> type "unsubscribe Declude.JunkMail". The archives can be found >>> at http://www.mail-archive.com. >>> >>> >> >> -- >> = >> MailPure custom filters for Declude JunkMail Pro. >> http://www.mailpure.com/software/ >> = >> >> --- >> [This E-mail was scanned for viruses by Declude Virus >> (http://www.declude.com)] >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. >> >> > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DomainKeys ?
Does Declude support Domain Keys or is there a DomainKeys external test available? No, it does not. When we last researched Domain Keys, it appeared to be quite complex, and not very popular. It does seem to be gaining some popularity, so we may do some more research about it in the near future. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
