[Declude.JunkMail] MailFrom issues

2004-12-08 Thread Panda Consulting S.A. Luis Alberto Arango


Panda Consulting S.A.
Luis Alberto Arango E.

Hi. Yesterday (Wednesday)afternoon, I had some false positives from users
that I usually receive mail from, after failing mainly the MailFrom test

Reason:
Domain "name of the domain here" has no MX or A records

Domains are working fine and they have MXs. Even one of the domains is in my
Imail Server (where declude runs).

How does Declude perform the MailFrom test? What DNS does it use? Is it a
problem with the DNS's configured in the IMAIL box?

Thanks in advance for your comments.

-Luis Arango


__
[Email scanned for viruses by Panda Consulting -www.pandacons.com-]
[Email escaneado contra virus por Panda Consulting -www.pandacons.com-]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Dan Horne



LOL

  
  
  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of 
  MattSent: Wednesday, December 08, 2004 4:01 PMTo: 
  [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] OT: 
  Declude Config Files...anyone in the holiday giving mood?
  D    N     
  JO    T 
  U G 
  SY    - TO    
  HU    O 
  C S 
  HM    T EE    
  I CA    N 
  KN    G 
  I . 
  N C G  
     O       
  M:)Dan Geiser wrote: 
  No, that is not the domain name that I am referring to.  If you look at my
>From Address you will see it as N T G - H O S T I N G. C O M.

- Original Message - 
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:34 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


  
Dan, I know I am not THAT obtuse. Isn't your domain...
n  e  x  u  s  t  e  c  h  g  r  o  u  p  --  d  o  t  --  c  o  m  ???

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:23 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


Che,
NOT the address that I typed in my e-mail.  Look at my From Address in my
original post.

Thanks,
Dan

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:19 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?



  Dan...I am not having any luck. Am I doing something wrong?
I replace the last five chars of your domain.
http://declude.nexustech?.com/

Regards, Che

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:12 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


Che,
You can see everything that I am currently doing here...

http://declude./

Replace  with the domain that I use to post to the list.

Please let me know if you have any questions.

Thanks,
Dan Geiser
[EMAIL PROTECTED]

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 12:32 PM
Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the
  holiday

  giving mood?


  
I hope I am posting this in the right place...

Hello all. I've asked this before and had no takers.
I'd like to see some real working examples of how Declude
users have set up their respective config files with weights,
rules, etc.

I'd like to tighten up my Declude settings, but unfortunately
I am not an experienced declude user/network admin like many
of you are. Can anyone help? Is this wrong of me to even ask for?

Thanks in advance!
~Che
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---

  
Sign up for virus-free and spam-free e-mail with Nexus Technology
Group
  

  
http://www.nexustechgroup.com/mailscan


---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
  (http://www.declude.com)]

  ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan


  ---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at htt

RE: [Declude.JunkMail] OT - RevDNS lookups by range

2004-12-08 Thread Kevin Bilbee



I 
created a tool to do just this. Break it for me and I will fix 
it.
 
http://www.ssc-isp.net/HoldAnalyzer/rdnsclassclookup.aspx
 
Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of 
  MattSent: Wednesday, December 08, 2004 12:18 PMTo: 
  [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] OT - 
  RevDNS lookups by rangeScott,I've been using a 
  tool called Angry IP Scanner.  It sometimes dies on bad data being 
  returned, but otherwise it is a good tool for querrying large blocks of IP's 
  for reverse DNS entries.  I would strongly suggest that you turn off the 
  port detection since it really doesn't give reliable results (based on how the 
  servers are configured).MattScott Fisher wrote: 
  



I like to research a range of Reverse DNS 
entries before potentially blocking a IP range.
 
I'm looking tool (an online one would be 
fantastic) where I could type in a range say 209.200.18.0 (today's culprit) 
and it would provide a list of Reverse DNS entries for 209.200.18.0 through 
209.200.18.255.
This would be a time saver in creating my own 
IP blacklists.
 
Any suggestions?
 
 
 
 -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


Re: [Declude.JunkMail] WAY OT: Syslog entries from Cisco ACL question

2004-12-08 Thread DLAnalyzer Support
Rick, 

My understanding is if the packet is rejected or allowed before the port 
information is needed for comparison Cisco IOS will log it as port 0. 

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log 
Parsers. 

Rick Davidson writes: 

Does anyone know what traffic uses a destination and source port of 0? Or 
what else I should look for? This is a Novell/windows network 

I have something odd going on at a large branch office so I added an acl 
to log the inbound and outbound traffic 

permit ip any any log 

permitted tcp 10.10.0.72(0) -> 10.10.9.18(0), 1 packet
permitted udp 10.10.0.98(0) -> 10.10.9.10(0), 1 packet 

I have ALOT of lines with many source and destination addresses, the IPs 
are valid for the network 

Thanks for any help 

Rick Davidson
National Systems Manager
North American Title Group
-  

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Matt






D    N     J
O    T U
 G S
Y    - T
O    H
U    O C
 S H
M    T E
E    I C
A    N K
N    G I
 . N
 C G
     O      
 M

:)





Dan Geiser wrote:

  No, that is not the domain name that I am referring to.  If you look at my
>From Address you will see it as N T G - H O S T I N G. C O M.

- Original Message - 
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:34 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


  
  
Dan, I know I am not THAT obtuse. Isn't your domain...
n  e  x  u  s  t  e  c  h  g  r  o  u  p  --  d  o  t  --  c  o  m  ???

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:23 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


Che,
NOT the address that I typed in my e-mail.  Look at my From Address in my
original post.

Thanks,
Dan

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:19 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?




  Dan...I am not having any luck. Am I doing something wrong?
I replace the last five chars of your domain.
http://declude.nexustech?.com/

Regards, Che

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:12 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


Che,
You can see everything that I am currently doing here...

http://declude./

Replace  with the domain that I use to post to the list.

Please let me know if you have any questions.

Thanks,
Dan Geiser
[EMAIL PROTECTED]

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 12:32 PM
Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the
  

holiday


  giving mood?


  
  
I hope I am posting this in the right place...

Hello all. I've asked this before and had no takers.
I'd like to see some real working examples of how Declude
users have set up their respective config files with weights,
rules, etc.

I'd like to tighten up my Declude settings, but unfortunately
I am not an experienced declude user/network admin like many
of you are. Can anyone help? Is this wrong of me to even ask for?

Thanks in advance!
~Che
---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

  

---


  
Sign up for virus-free and spam-free e-mail with Nexus Technology

  

  
  Group
  
  

  
http://www.nexustechgroup.com/mailscan



  
  ---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
  

(http://www.declude.com)]


  ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan


  

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
  

RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Che Vilnonis
my apologies...i did not see that anywhere. thank you for all of your help.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:46 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


No, that is not the domain name that I am referring to.  If you look at my
>From Address you will see it as N T G - H O S T I N G. C O M.

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:34 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


> Dan, I know I am not THAT obtuse. Isn't your domain...
> n  e  x  u  s  t  e  c  h  g  r  o  u  p  --  d  o  t  --  c  o  m  ???
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
> Sent: Wednesday, December 08, 2004 3:23 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday giving mood?
>
>
> Che,
> NOT the address that I typed in my e-mail.  Look at my From Address in my
> original post.
>
> Thanks,
> Dan
>
> - Original Message -
> From: "Che Vilnonis" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, December 08, 2004 3:19 PM
> Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday giving mood?
>
>
> > Dan...I am not having any luck. Am I doing something wrong?
> > I replace the last five chars of your domain.
> > http://declude.nexustech?.com/
> >
> > Regards, Che
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
> > Sent: Wednesday, December 08, 2004 3:12 PM
> > To: [EMAIL PROTECTED]
> > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> > holiday giving mood?
> >
> >
> > Che,
> > You can see everything that I am currently doing here...
> >
> > http://declude./
> >
> > Replace  with the domain that I use to post to the list.
> >
> > Please let me know if you have any questions.
> >
> > Thanks,
> > Dan Geiser
> > [EMAIL PROTECTED]
> >
> > - Original Message -
> > From: "Che Vilnonis" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Wednesday, December 08, 2004 12:32 PM
> > Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday
> > giving mood?
> >
> >
> > > I hope I am posting this in the right place...
> > >
> > > Hello all. I've asked this before and had no takers.
> > > I'd like to see some real working examples of how Declude
> > > users have set up their respective config files with weights,
> > > rules, etc.
> > >
> > > I'd like to tighten up my Declude settings, but unfortunately
> > > I am not an experienced declude user/network admin like many
> > > of you are. Can anyone help? Is this wrong of me to even ask for?
> > >
> > > Thanks in advance!
> > > ~Che
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> >
> ---
> > > Sign up for virus-free and spam-free e-mail with Nexus Technology
Group
> > > http://www.nexustechgroup.com/mailscan
> > >
> > >
> >
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> >
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkM

Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Dan Geiser
No, that is not the domain name that I am referring to.  If you look at my
>From Address you will see it as N T G - H O S T I N G. C O M.

- Original Message - 
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:34 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


> Dan, I know I am not THAT obtuse. Isn't your domain...
> n  e  x  u  s  t  e  c  h  g  r  o  u  p  --  d  o  t  --  c  o  m  ???
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
> Sent: Wednesday, December 08, 2004 3:23 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday giving mood?
>
>
> Che,
> NOT the address that I typed in my e-mail.  Look at my From Address in my
> original post.
>
> Thanks,
> Dan
>
> - Original Message -
> From: "Che Vilnonis" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, December 08, 2004 3:19 PM
> Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday giving mood?
>
>
> > Dan...I am not having any luck. Am I doing something wrong?
> > I replace the last five chars of your domain.
> > http://declude.nexustech?.com/
> >
> > Regards, Che
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
> > Sent: Wednesday, December 08, 2004 3:12 PM
> > To: [EMAIL PROTECTED]
> > Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> > holiday giving mood?
> >
> >
> > Che,
> > You can see everything that I am currently doing here...
> >
> > http://declude./
> >
> > Replace  with the domain that I use to post to the list.
> >
> > Please let me know if you have any questions.
> >
> > Thanks,
> > Dan Geiser
> > [EMAIL PROTECTED]
> >
> > - Original Message -
> > From: "Che Vilnonis" <[EMAIL PROTECTED]>
> > To: <[EMAIL PROTECTED]>
> > Sent: Wednesday, December 08, 2004 12:32 PM
> > Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday
> > giving mood?
> >
> >
> > > I hope I am posting this in the right place...
> > >
> > > Hello all. I've asked this before and had no takers.
> > > I'd like to see some real working examples of how Declude
> > > users have set up their respective config files with weights,
> > > rules, etc.
> > >
> > > I'd like to tighten up my Declude settings, but unfortunately
> > > I am not an experienced declude user/network admin like many
> > > of you are. Can anyone help? Is this wrong of me to even ask for?
> > >
> > > Thanks in advance!
> > > ~Che
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> >
> ---
> > > Sign up for virus-free and spam-free e-mail with Nexus Technology
Group
> > > http://www.nexustechgroup.com/mailscan
> > >
> > >
> >
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> >
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing l

Re: [Declude.JunkMail] OT - RevDNS lookups by range

2004-12-08 Thread Scott Fisher



Well, I do like the name. I'll give it a 
shot.
Finding the ranges in dnsstuff.com is too much of a 
chore.

  - Original Message - 
  From: 
  Matt 
  To: [EMAIL PROTECTED] 
  
  Sent: Wednesday, December 08, 2004 2:18 
  PM
  Subject: Re: [Declude.JunkMail] OT - 
  RevDNS lookups by range
  Scott,I've been using a tool called Angry IP 
  Scanner.  It sometimes dies on bad data being returned, but otherwise it 
  is a good tool for querrying large blocks of IP's for reverse DNS 
  entries.  I would strongly suggest that you turn off the port detection 
  since it really doesn't give reliable results (based on how the servers are 
  configured).MattScott Fisher wrote: 
  



I like to research a range of Reverse DNS 
entries before potentially blocking a IP range.
 
I'm looking tool (an online one would be 
fantastic) where I could type in a range say 209.200.18.0 (today's culprit) 
and it would provide a list of Reverse DNS entries for 209.200.18.0 through 
209.200.18.255.
This would be a time saver in creating my own 
IP blacklists.
 
Any suggestions?
 
 
 
 -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Che Vilnonis
Dan, I know I am not THAT obtuse. Isn't your domain...
n  e  x  u  s  t  e  c  h  g  r  o  u  p  --  d  o  t  --  c  o  m  ???

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:23 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


Che,
NOT the address that I typed in my e-mail.  Look at my From Address in my
original post.

Thanks,
Dan

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:19 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


> Dan...I am not having any luck. Am I doing something wrong?
> I replace the last five chars of your domain.
> http://declude.nexustech?.com/
>
> Regards, Che
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
> Sent: Wednesday, December 08, 2004 3:12 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday giving mood?
>
>
> Che,
> You can see everything that I am currently doing here...
>
> http://declude./
>
> Replace  with the domain that I use to post to the list.
>
> Please let me know if you have any questions.
>
> Thanks,
> Dan Geiser
> [EMAIL PROTECTED]
>
> - Original Message -
> From: "Che Vilnonis" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, December 08, 2004 12:32 PM
> Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday
> giving mood?
>
>
> > I hope I am posting this in the right place...
> >
> > Hello all. I've asked this before and had no takers.
> > I'd like to see some real working examples of how Declude
> > users have set up their respective config files with weights,
> > rules, etc.
> >
> > I'd like to tighten up my Declude settings, but unfortunately
> > I am not an experienced declude user/network admin like many
> > of you are. Can anyone help? Is this wrong of me to even ask for?
> >
> > Thanks in advance!
> > ~Che
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> >
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Dan Geiser
Che,
NOT the address that I typed in my e-mail.  Look at my From Address in my
original post.

Thanks,
Dan

- Original Message - 
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 3:19 PM
Subject: RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


> Dan...I am not having any luck. Am I doing something wrong?
> I replace the last five chars of your domain.
> http://declude.nexustech?.com/
>
> Regards, Che
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
> Sent: Wednesday, December 08, 2004 3:12 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
> holiday giving mood?
>
>
> Che,
> You can see everything that I am currently doing here...
>
> http://declude./
>
> Replace  with the domain that I use to post to the list.
>
> Please let me know if you have any questions.
>
> Thanks,
> Dan Geiser
> [EMAIL PROTECTED]
>
> - Original Message -
> From: "Che Vilnonis" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, December 08, 2004 12:32 PM
> Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday
> giving mood?
>
>
> > I hope I am posting this in the right place...
> >
> > Hello all. I've asked this before and had no takers.
> > I'd like to see some real working examples of how Declude
> > users have set up their respective config files with weights,
> > rules, etc.
> >
> > I'd like to tighten up my Declude settings, but unfortunately
> > I am not an experienced declude user/network admin like many
> > of you are. Can anyone help? Is this wrong of me to even ask for?
> >
> > Thanks in advance!
> > ~Che
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> >
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Che Vilnonis
Dan...I am not having any luck. Am I doing something wrong?
I replace the last five chars of your domain.
http://declude.nexustech?.com/

Regards, Che

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser
Sent: Wednesday, December 08, 2004 3:12 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the
holiday giving mood?


Che,
You can see everything that I am currently doing here...

http://declude./

Replace  with the domain that I use to post to the list.

Please let me know if you have any questions.

Thanks,
Dan Geiser
[EMAIL PROTECTED]

- Original Message -
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 12:32 PM
Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday
giving mood?


> I hope I am posting this in the right place...
>
> Hello all. I've asked this before and had no takers.
> I'd like to see some real working examples of how Declude
> users have set up their respective config files with weights,
> rules, etc.
>
> I'd like to tighten up my Declude settings, but unfortunately
> I am not an experienced declude user/network admin like many
> of you are. Can anyone help? Is this wrong of me to even ask for?
>
> Thanks in advance!
> ~Che
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] WAY OT: Syslog entries from Cisco ACL question

2004-12-08 Thread Rick Davidson
Does anyone know what traffic uses a destination and source port of 0? Or 
what else I should look for? This is a Novell/windows network

I have something odd going on at a large branch office so I added an acl to 
log the inbound and outbound traffic

permit ip any any log
permitted tcp 10.10.0.72(0) -> 10.10.9.18(0), 1 packet
permitted udp 10.10.0.98(0) -> 10.10.9.10(0), 1 packet
I have ALOT of lines with many source and destination addresses, the IPs are 
valid for the network

Thanks for any help
Rick Davidson
National Systems Manager
North American Title Group
- 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT - RevDNS lookups by range

2004-12-08 Thread Matt




Scott,

I've been using a tool called Angry IP Scanner.  It sometimes dies on
bad data being returned, but otherwise it is a good tool for querrying
large blocks of IP's for reverse DNS entries.  I would strongly suggest
that you turn off the port detection since it really doesn't give
reliable results (based on how the servers are configured).

Matt



Scott Fisher wrote:

  
  
  
  I like to research a range of
Reverse DNS entries before potentially blocking a IP range.
   
  I'm looking tool (an online one
would be fantastic) where I could type in a range say 209.200.18.0
(today's culprit) and it would provide a list of Reverse DNS entries
for 209.200.18.0 through 209.200.18.255.
  This would be a time saver in
creating my own IP blacklists.
   
  Any suggestions?
   
   
   
   


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=




Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Dan Geiser
Che,
You can see everything that I am currently doing here...

http://declude./

Replace  with the domain that I use to post to the list.

Please let me know if you have any questions.

Thanks,
Dan Geiser
[EMAIL PROTECTED]

- Original Message - 
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 12:32 PM
Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday
giving mood?


> I hope I am posting this in the right place...
>
> Hello all. I've asked this before and had no takers.
> I'd like to see some real working examples of how Declude
> users have set up their respective config files with weights,
> rules, etc.
>
> I'd like to tighten up my Declude settings, but unfortunately
> I am not an experienced declude user/network admin like many
> of you are. Can anyone help? Is this wrong of me to even ask for?
>
> Thanks in advance!
> ~Che
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Log file locking

2004-12-08 Thread R. Scott Perry

IF the log file is locked and declude tried to write to it, what happens if
declude can't?
The log file entry won't be saved.  Declude will continue to function as it 
normally would, except with one (or more) less log file entries.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Scott Fisher
Some people do share, other's may not.
I've found specific questions are always better responded to than general
questions.

It all depends on the time you want to spend. Spam chasing can be a time
blackhole, especially if you have perfectionist traits.

1.  If you don't want to spend lots of time. Message Sniffer. Less than a
buck a day. Catches about 95%+ of all the spam. With about .2% false
positives here.
2. If you have JunkMail Pro which allows filters, Matt at Mailpure has some
filters that are a good starting place.
The filters are very good at pairing with Sniffer. A reliable IP4R hit and a
sniffer hit is almost certainly spam.
3. Marcus has spamtest quality reports on his website.
http://www2.spamchk.com/public.html
This tells you common tests (Declude, spamdomains, IP4R, RHSBL) and how many
spam vs. ham hits there are for each test. For instance CBL, 53k hits out of
113k mails with 144 misses. Pretty reliable and you should make well
weighted.

- Original Message - 
From: "Che Vilnonis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 11:32 AM
Subject: [Declude.JunkMail] OT: Declude Config Files...anyone in the holiday
giving mood?


> I hope I am posting this in the right place...
>
> Hello all. I've asked this before and had no takers.
> I'd like to see some real working examples of how Declude
> users have set up their respective config files with weights,
> rules, etc.
>
> I'd like to tighten up my Declude settings, but unfortunately
> I am not an experienced declude user/network admin like many
> of you are. Can anyone help? Is this wrong of me to even ask for?
>
> Thanks in advance!
> ~Che
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Log file locking

2004-12-08 Thread Mark E. Smith
I have 3 inbound relayers running declude and I want to consolidate the log
files to a single system.
I'm planning on using Microsoft's robocopy utility to copy the log files.
I'm not sure if robocopy locks the source file during the copy or not so
here's my question..

IF the log file is locked and declude tried to write to it, what happens if
declude can't?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?

2004-12-08 Thread Mark E. Smith
Ok so this is really working how I'd like it to

The rule is defined with a global.cfg weight of -1000
If the domain is whitelisted then the -1000 is applied to any non-filter
type tests and NO other filters are run.

In essence the domain is whitelisted because all of the other non-filter
tests I have don't add up to 1000.

Sound right?

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of R.
> Scott Perry
> Sent: Wednesday, December 08, 2004 12:39 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Does STOPALLTESTS really stop
> all tests?
>
>
> >I've got a whitelist filter file where I use the action
> "STOPALLTESTS":
> >
> >MAILFROMSTOPALLTESTSCONTAINS@netrends.com
> >
> >This rule is defined as the first rule in my global.cfg
> (above all of
> >the IP4r, Catchall, externals, etc.) If it trips the
> WHITELIST filter,
> >why do the other tests (see declog below) register?
>
> That's because it is only designed to stop tests that occur
> *after* this one.  So any non-filter tests will still run,
> and any filter tests that are defined before this test will run.
>
> STOPALLTESTS was designed to minimize CPU usage.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail
> mailservers since 2000.
> Declude Virus: Ultra reliable virus detection and the leader
> in mailserver vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
>
> 
> This outgoing message is guaranteed to be authentic by
> Message Level users.
> Guarantee the authenticity of your email @
> http://www.messagelevel.com.
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be
> found at http://www.mail-archive.com.
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?

2004-12-08 Thread R. Scott Perry

I've got a whitelist filter file where I use the action "STOPALLTESTS":
MAILFROMSTOPALLTESTSCONTAINS@netrends.com
This rule is defined as the first rule in my global.cfg (above all of the
IP4r, Catchall, externals, etc.)
If it trips the WHITELIST filter, why do the other tests (see declog below)
register?
That's because it is only designed to stop tests that occur *after* this 
one.  So any non-filter tests will still run, and any filter tests that are 
defined before this test will run.

STOPALLTESTS was designed to minimize CPU usage.
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?

2004-12-08 Thread Scott Fisher
Filters are run last.

- Original Message - 
From: "Mark E. Smith" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 11:26 AM
Subject: [Declude.JunkMail] Does STOPALLTESTS really stop all tests?


> I've got a whitelist filter file where I use the action "STOPALLTESTS":
>
> MAILFROM STOPALLTESTS CONTAINS @netrends.com
>
> This rule is defined as the first rule in my global.cfg (above all of the
> IP4r, Catchall, externals, etc.)
> If it trips the WHITELIST filter, why do the other tests (see declog
below)
> register?
>
> -0-
>
> 12/08/2004 12:00:35 Q3330261c009c1d52 Filter: Set min weight to -1000.
> 12/08/2004 12:00:35 Q3330261c009c1d52 Triggered MAILFROM CONTAINS filter
> WHITELISTFILTER on @netrends.com [weight->0; @netrends.com].
> 12/08/2004 12:00:35 Q3330261c009c1d52 nIPNOTINMX:-30 nNOLEGITCONTENT:-50 .
> Total weight = -80.
> 12/08/2004 12:00:35 Q3330261c009c1d52 Using [outgoing] CFG file
global.cfg.
> 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed CATCHALLMAILS ().
> Action=WARN.
> 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed SIZE-XS (Message failed
> SIZE-XS: 12.). Action=WARN.
> 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed MS-WHITE (Message failed
> MS-WHITE: 0.). Action=WARN.
> 12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed WEIGHTLEGIT (Total weight
> between -5000 and 119.). Action=WARN.
> 12/08/2004 12:00:35 Q3330261c009c1d52 R1 Message OK
> 12/08/2004 12:00:35 Q3330261c009c1d52 Subject: testing
> 12/08/2004 12:00:35 Q3330261c009c1d52 From: [EMAIL PROTECTED] To:
> [EMAIL PROTECTED] IP: 65.196.89.161 ID:
> 12/08/2004 12:00:35 Q3330261c009c1d52 Tests failed [weight=-80]:
> CATCHALLMAILS=WARN SIZE-XS=WARN MS-WHITE=WARN WEIGHTLEGIT=WARN
> 12/08/2004 12:00:35 Q3330261c009c1d52 Last action = IGNORE.
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] OT: Declude Config Files...anyone in the holiday giving mood?

2004-12-08 Thread Che Vilnonis
I hope I am posting this in the right place...

Hello all. I've asked this before and had no takers.
I'd like to see some real working examples of how Declude
users have set up their respective config files with weights,
rules, etc.

I'd like to tighten up my Declude settings, but unfortunately
I am not an experienced declude user/network admin like many
of you are. Can anyone help? Is this wrong of me to even ask for?

Thanks in advance!
~Che
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Does STOPALLTESTS really stop all tests?

2004-12-08 Thread Mark E. Smith
I've got a whitelist filter file where I use the action "STOPALLTESTS":

MAILFROMSTOPALLTESTSCONTAINS@netrends.com

This rule is defined as the first rule in my global.cfg (above all of the
IP4r, Catchall, externals, etc.)
If it trips the WHITELIST filter, why do the other tests (see declog below)
register?

-0-

12/08/2004 12:00:35 Q3330261c009c1d52 Filter: Set min weight to -1000.
12/08/2004 12:00:35 Q3330261c009c1d52 Triggered MAILFROM CONTAINS filter
WHITELISTFILTER on @netrends.com [weight->0; @netrends.com].
12/08/2004 12:00:35 Q3330261c009c1d52 nIPNOTINMX:-30 nNOLEGITCONTENT:-50 .
Total weight = -80.
12/08/2004 12:00:35 Q3330261c009c1d52 Using [outgoing] CFG file global.cfg.
12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed CATCHALLMAILS ().
Action=WARN.
12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed SIZE-XS (Message failed
SIZE-XS: 12.). Action=WARN.
12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed MS-WHITE (Message failed
MS-WHITE: 0.). Action=WARN.
12/08/2004 12:00:35 Q3330261c009c1d52 Msg failed WEIGHTLEGIT (Total weight
between -5000 and 119.). Action=WARN.
12/08/2004 12:00:35 Q3330261c009c1d52 R1 Message OK
12/08/2004 12:00:35 Q3330261c009c1d52 Subject: testing
12/08/2004 12:00:35 Q3330261c009c1d52 From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED] IP: 65.196.89.161 ID:
12/08/2004 12:00:35 Q3330261c009c1d52 Tests failed [weight=-80]:
CATCHALLMAILS=WARN SIZE-XS=WARN MS-WHITE=WARN WEIGHTLEGIT=WARN
12/08/2004 12:00:35 Q3330261c009c1d52 Last action = IGNORE.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] DomainKeys ?

2004-12-08 Thread Agid, Corby
Yes, I have seen more DomainKeys DNS entries lately and DomainKeys
information in headers from Spam. 

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of R. 
> Scott Perry
> Sent: Wednesday, December 08, 2004 4:15 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] DomainKeys ?
> 
> 
> >Does Declude support Domain Keys or is there a DomainKeys 
> external test 
> >available?
> 
> No, it does not.
> 
> When we last researched Domain Keys, it appeared to be quite 
> complex, and not very popular.  It does seem to be gaining 
> some popularity, so we may do some more research about it in 
> the near future.
> 
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail 
> mailservers since 2000.
> Declude Virus: Ultra reliable virus detection and the leader 
> in mailserver vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
> 
> 
> 
> This outgoing message is guaranteed to be authentic by 
> Message Level users.
> Guarantee the authenticity of your email @ 
> http://www.messagelevel.com.
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] OT - RevDNS lookups by range

2004-12-08 Thread Scott Fisher



I like to research a range of Reverse DNS entries 
before potentially blocking a IP range.
 
I'm looking tool (an online one would be fantastic) 
where I could type in a range say 209.200.18.0 (today's culprit) and it would 
provide a list of Reverse DNS entries for 209.200.18.0 through 
209.200.18.255.
This would be a time saver in creating my own IP 
blacklists.
 
Any suggestions?
 
 
 
 


Re: [Declude.JunkMail] ZIP files

2004-12-08 Thread Darin Cox
If you just want to turn off virus filtering for a domain, you can do so in
the virus_domains.txt file.

Darin.


- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, December 07, 2004 11:06 PM
Subject: Re: [Declude.JunkMail] ZIP files


You need Declude Virus Pro, and if you have this, search the manual for
"per-user" and it will show you how it is done (you need both the
virus_domains.txt and virus_users.txt files to be present).

Matt


Richard Farris wrote:

> How do you exclude an address from being filtered from viruses..
>
> Richard Farris
> Ethixs Online
> 1.270.247. Office
> 1.800.548.3877 Tech Support
> "Crossroads to a Cleaner Internet"
>
> - Original Message - From: "Matt" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Tuesday, December 07, 2004 12:40 PM
> Subject: Re: [Declude.JunkMail] ZIP files
>
>
>> Richard,
>>
>> With Declude Virus Pro, you can exclude individual addresses or
>> domains from all virus scanning.  Needless to say, better granularity
>> in Declude Virus is widely sought after in this sense, and it will
>> come I'm sure if people keep asking for it.
>>
>> BTW, I'm personally not a proponent of blocking zip files and we do
>> not have hardly any issues as a result.  Since almost all viruses are
>> sent from DUL space, and also have numerous technical issues, our
>> spam blocking will generally tag the viruses that pass through
>> scanning in the early hours of a new outbreak.  You can also get more
>> serious by creating a set of filters in Declude JunkMail Pro that
>> targets zip file attachments of a certain size range, and tags them
>> with a fair amount of weight, but generally won't push them over the
>> top on their own.  I'm planning on doing this in my own system, but
>> it isn't a priority in comparison to other things since the things
>> that pass through are very few in number, and zip viruses are
>> somewhat ineffective since they can't auto-execute and need to be
>> unzipped.
>>
>> Matt
>>
>>
>>
>>
>>
>>
>> Richard Farris wrote:
>>
>>> I am blocking zip files in the virus filterbut I have one
>>> customer who really needs to use them without renaming files...is
>>> there a way to have one customers not looked at for a particular
>>> virus or all viruses..or is there a way that zip files can be
>>> filtered with a spam rule...
>>>
>>> Richard Farris
>>> Ethixs Online
>>> 1.270.247. Office
>>> 1.800.548.3877 Tech Support
>>> "Crossroads to a Cleaner Internet"
>>>
>>> ---
>>> [This E-mail was scanned for viruses by Declude Virus
>>> (http://www.declude.com)]
>>>
>>> ---
>>> This E-mail came from the Declude.JunkMail mailing list.  To
>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>>> type "unsubscribe Declude.JunkMail".  The archives can be found
>>> at http://www.mail-archive.com.
>>>
>>>
>>
>> -- 
>> =
>> MailPure custom filters for Declude JunkMail Pro.
>> http://www.mailpure.com/software/
>> =
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
>> (http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
>>
>>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] DomainKeys ?

2004-12-08 Thread R. Scott Perry

Does Declude support Domain Keys or is there a DomainKeys external test 
available?
No, it does not.
When we last researched Domain Keys, it appeared to be quite complex, and 
not very popular.  It does seem to be gaining some popularity, so we may do 
some more research about it in the near future.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.