Re[2]: [Declude.JunkMail] Interesting tactic..

[Sanford Whiteman]

> As  far  as I am concerned, if the From Address domain is not coming
> from  the  MX  for  that  domain, I don't want the mail.

Really? So you HOLD a message on IPNOTINMX? I doubt it.

MXs  are  _inbound_  mail  exchangers.  It's  absurd  to  require that
outbound  mail  come from MXs. Any mail architect knows that you scale
outbound and inbound mail separately as necessary.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  
http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/
  
http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Forwarding and Hosting on IMail vs. SmarterMail

[Dave Doherty]

Hi Goran-
I am running a SmartHost testbed setup using a SmarterMail package as a 
cache server. It's handling about 150,000 mesages a day and seems to be 
holding up fine witrh very low proceessor usage. Of course, in this mode 
without mailboxes, the operation is quite a bit simpler than a mailbox 
server. The web interface is a little slow to get started, but once it's up 
it seems fine.

So far, the only major drawback I've seen is the lack of communications 
between mailbox servers and "SmartHost" cache servers. There is, apparently, 
no way to notify a SmarterMail SmartHost server as to what users are 
acceptable. They are therefore subject to dictionary attacks. I created a 
little VB routine that runs every two minutes and deletes commonly formatted 
NDRs. I have the delicvery delay set to 3 minutes, so every message in the 
spool is scanned at least once and many NDRs are deleted this way.

I like the management features, too.
-d

- Original Message - 
From: "Goran Jovanovic" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 8:23 PM
Subject: RE: [Declude.JunkMail] Forwarding and Hosting on IMail vs. 
SmarterMail

Thank you all who have commented. Based on my previous experience and
not wanting to jump in too fast I am going to split my scanning and
hosting servers.
Kevin - some neat things that I noticed when I put up the free version
is some very simply yet informative graphs. Disk space by domain, Disk
space by user within a domain. Also there is bandwidth charts who is
sending how much etc.

Goran Jovanovic
The LAN Shoppe

-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, January 10, 2005 11:18 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Forwarding and Hosting on IMail vs.
SmarterMail
> There are some things missing, but there are also a lot of
> small neat features that make you say 'what a neat idea'...
>
Could you elaborate on what is missing and what is neat?
Kevin Bilbee
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Forwarding and Hosting on IMail vs. SmarterMail

[Goran Jovanovic]

Thank you all who have commented. Based on my previous experience and
not wanting to jump in too fast I am going to split my scanning and
hosting servers.

Kevin - some neat things that I noticed when I put up the free version
is some very simply yet informative graphs. Disk space by domain, Disk
space by user within a domain. Also there is bandwidth charts who is
sending how much etc.
 
 
 
 Goran Jovanovic
 The LAN Shoppe

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Kevin Bilbee
> Sent: Monday, January 10, 2005 11:18 PM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] Forwarding and Hosting on IMail vs.
> SmarterMail
> 
> > There are some things missing, but there are also a lot of
> > small neat features that make you say 'what a neat idea'...
> >
> 
> Could you elaborate on what is missing and what is neat?
> 
> Kevin Bilbee
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Matt]

Title: Message




Andy,

Yes, there are many different laws that spammers break, most of which
are not covered under CAN-SPAM.  CAN-SPAM does though preempt many
state anti-spam laws, or at least parts of them.  The courts are
working out what is and is not preempted.  For better or worse, some of
these state convictions might be overturned based on jurisdiction as
things progress through the appeal's system.  Having spammers held to
50 different standards for conduct without a good method of identifying
who is where is a bit unfair, kind of like expecting an ecommerce site
to collect taxes according to every county tax rate in the country.  It
all depends on who they are going after of course.  The groups that are
dictionary attacking servers all over the place with as many as 3
million random addresses per day are clearly going beyond simple
spamming, and other things like fraud and false advertising also extend
beyond CAN-SPAM, though have been specified in parts of state anti-spam
laws.  CAN-SPAM's state law preemption reads as follows:
"This Act supersedes any statute, regulation, or rule of a
State or political
subdivision of a State that expressly regulates the use of electronic
mail to send
commercial messages, except to the extent that any such statute,
regulation, or
rule prohibits falsity or deception in any portion of a commercial
electronic mail
message or information attached thereto."

The North Carolina residents that were prosecuted under Virginia's spam
laws recently were primarily flagged for fraud.  They were advertising
scams promoting $75/hour FedEx refund processor software, and received
about $400,000 in orders for it.  To quote one Web source, "VA
authorities were able to assert long-arm jurisdiction over them
since they derived economic benefit and caused tortious harm to
Virginia residents as well as Virginia equipment."  (of course I can't
vouch for the accuracy of that statement)

I personally would like to see clear as day laws governing spam so that
authorities wouldn't be apprehensive to go after these people, or
turned off by the never-ending appeal process as the vaguest parts of
the laws are tested.  Maybe they aren't prosecuting these people for
other reasons such as a lack of focus on the problem.  Neither Bill
Clinton nor George Bush had an appreciation for E-mail.  I think that
Bill Clinton was only known to have sent a single E-mail while in
office.  I doubt that most of those in Congress read their own E-mail,
and they aren't likely exposed to the people blocking the spam for them
(why else would they have legalized half of it with a preemptive law?).

I don't believe marketing a legitimate product or service from one's
own servers would constitute a violation of either law.  The trouble
with doing it that way is that anything that is static and comes with
significant volume is generally widely blacklisted within the first
week of activity, often the first 24 hours.  It makes being a static
spammer kind of tough.  I've noted more and more that static spammers
are moving their hosting to other countries and service providers that
don't sub-delegate IP space, and don't require or oversee the reverse
DNS information.  Some even set themselves up as fake hosting
operations and then jump around their IP space with spam blocks
pretending to not be directly associated with the activity.  None of
this seems to constitute breaking the law, though I'm sure that almost
all of them are in other ways (like not honoring opt-outs, subject
tagging themselves, etc.).

Matt



Andy Schmidt wrote:

  
  
  
  The motivation for cleaning was not
black-listing, it was AOLs aggressive pursuit of Spammers supported by
VA state law that is one of the (if not "the") toughest with regards to
computer abuse (including SPAM).  Since many Spammers DO operate out of
the U.S. and/or market goods that are delivered from the U.S., it
doesn't matter much if they were trying to hide behind a China server.
   
  Abusing a computer system in VA is subject to VA
law - even if the other party sits in another state. Has nothing to do
with Interstate commerce.
   
  Heck, I have to file sales tax returns in many
states that I've never set foot in - just as long as THEIR state law
finds some way to define "nexus". 
  
  Best Regards
  Andy Schmidt
  
  H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846
  
  Phone:  +1 201 934-3414
x20 (Business)
Fax:    +1 201 934-9206
  
  http://www.HM-Software.com/
  
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Tuesday, January 11, 2005 04:42 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Interesting tactic..


Anyone can spam legally under CAN-SPAM, however almost no one follows
the exact letter of the law (for instance adding "ADV" to subject
lines).  I'm not sure where federal and state law intersect on this
one, 

RE: [Declude.JunkMail] Interesting tactic..

[Andy Schmidt]

Title: Message



The 
motivation for cleaning was not black-listing, it was AOLs aggressive pursuit of 
Spammers supported by VA state law that is one of the (if not "the") toughest 
with regards to computer abuse (including SPAM).  Since many Spammers DO 
operate out of the U.S. and/or market goods that are delivered from the U.S., it 
doesn't matter much if they were trying to hide behind a China 
server.
 
Abusing a computer system in VA is subject to VA law - even if the other 
party sits in another state. Has nothing to do with Interstate 
commerce.
 
Heck, 
I have to file sales tax returns in many states that I've never set foot 
in - just as long as THEIR state law finds some way to define "nexus". 

Best 
RegardsAndy SchmidtH&M Systems Software, Inc.600 East Crescent 
Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone:  +1 201 934-3414 x20 
(Business)Fax:    +1 201 934-9206http://www.HM-Software.com/ 

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of MattSent: Tuesday, January 11, 2005 04:42 
  PMTo: Declude.JunkMail@declude.comSubject: Re: 
  [Declude.JunkMail] Interesting tactic..Anyone can spam 
  legally under CAN-SPAM, however almost no one follows the exact letter of the 
  law (for instance adding "ADV" to subject lines).  I'm not sure where 
  federal and state law intersect on this one, but it would seem to be primarily 
  a federal issue since it generally involves interstate commerce.My own 
  personal experience is that the clearly illegal stuff (forging/zombie spam) 
  that CAN-SPAM definitely targets has grown immensely in the last year, and 
  their tactics have become effectively DDOS attacks on mail servers (violating 
  yet other laws).  Spamhaus has pictures of some of these guy's houses 
  even (tape recordings of threats too), yet all we hear about are these 
  occasional civil lawsuits, and a smattering of criminal actions while they 
  keep going with impunity.  The RIAA has been more effective at stopping 
  file sharing than the government has been in stopping spam, and that's not 
  saying much.  In fact the most remarkable thing that the government has 
  done is cave into industry and draft a law called CAN-SPAM that legalizes half 
  of it, and supersedes many state laws that went further.I don't doubt 
  that you were told this however.  Spamming AOL without some form of 
  obfuscation is pretty much going to be useless because they will get 
  blacklisted rather quickly otherwise.MattAndy Schmidt 
  wrote: 
  

Well, I CAN tell you that I have personal contacts with Spammers (who 
keep wanting me to take their business) - and from casual conversations 
about the "industry" I know that several DO clean any AOL 
mailboxes from their lists before doing campaigns out of fear of litigation 
based on VA law. 
Best RegardsAndy SchmidtH&M Systems Software, Inc.600 East 
Crescent Avenue, Suite 203Upper Saddle River, NJ 
07458-1846Phone:  +1 
201 934-3414 x20 (Business)Fax:    +1 201 
934-9206http://www.HM-Software.com/ 

  -Original Message-From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]] 
  On Behalf Of MattSent: Tuesday, January 11, 2005 04:10 
  PMTo: Declude.JunkMail@declude.comSubject: 
  Re: [Declude.JunkMail] Interesting tactic..This 
  sounds like an urban legend to me.  Keep in mind that there was some 
  news release a few weeks ago that indicated AOL was seeing dramatically 
  less spam traffic.  I think it is likely that AOL has succeeded in 
  blocking more spam, and the article was rehashed by someone that didn't 
  understand the topic and assumed that this meant a drop in spam.  
  This used to happen all the time, even in industry mags, back when the 
  Internet was becoming a big deal.  Same thing with spam now.  
  I'm sure that they mess up articles about medicine, astronomy, etc., and 
  we just don't know enough to see through the 
  mistakes.MattDan Geiser wrote: 
  I don't get this article at all.  How is this any different then sending
e-mails with using domains that you have no intention of ever using?  Why
would you want to register the domain name and then associated yourself with
a domain used in a spam mailing?  And from a technical standpoint why would
a distributed DNS system be overloaded by trying to lookup bogus domain
names?

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 2:50 PM
Subject: [Declude.JunkMail] Interesting tactic..


  

http://www.eweek.com/article2/0,1759,1749328,00.asp\

"One troublesome technique finding favor with spammers involves sending
mass
  
mailings in the middle of the night from a domain that has not yet been
registered. After the mailings go out, the spammer registers the domain
early the next morning."

H

Kami



--

Re: [Declude.JunkMail] Google and/or Earthlink failing subjectchars

[smb]

Du..

Thanks Bill. 
I now even remember making a note of this which in probably in the middle of
Christmas Bills. 

Major brain fade today... 

My apologies and thanks to all

Stu





At 10:09 AM 1/11/2005 -0800, you wrote:
>- Original Message - 
>From: <[EMAIL PROTECTED]>
>
>> Is any one seeing Google and or Earthlink failing the subjectchars test on
>> blank subject lines or even if there is a subject typed in ?
>>
>> Any one know of a reason for this.
>
>This was a know bug that I think has been fixed with the latest release.
>See:
>
>http://www.mail-archive.com/declude.junkmail@declude.com/msg21811.html
>
>and related tread for more info.
>
>Bill
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Matt]

Title: Message




Anyone can spam legally under CAN-SPAM, however almost no one follows
the exact letter of the law (for instance adding "ADV" to subject
lines).  I'm not sure where federal and state law intersect on this
one, but it would seem to be primarily a federal issue since it
generally involves interstate commerce.

My own personal experience is that the clearly illegal stuff
(forging/zombie spam) that CAN-SPAM definitely targets has grown
immensely in the last year, and their tactics have become effectively
DDOS attacks on mail servers (violating yet other laws).  Spamhaus has
pictures of some of these guy's houses even (tape recordings of threats
too), yet all we hear about are these occasional civil lawsuits, and a
smattering of criminal actions while they keep going with impunity. 
The RIAA has been more effective at stopping file sharing than the
government has been in stopping spam, and that's not saying much.  In
fact the most remarkable thing that the government has done is cave
into industry and draft a law called CAN-SPAM that legalizes half of
it, and supersedes many state laws that went further.

I don't doubt that you were told this however.  Spamming AOL without
some form of obfuscation is pretty much going to be useless because
they will get blacklisted rather quickly otherwise.

Matt



Andy Schmidt wrote:

  
  
  
  Well, I CAN tell you that I have personal
contacts with Spammers (who keep wanting me to take their business) -
and from casual conversations about the "industry" I know
that several DO clean any AOL mailboxes from their lists before doing
campaigns out of fear of litigation based on VA law. 
  
  Best Regards
  Andy Schmidt
  
  H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846
  
  Phone:  +1 201 934-3414
x20 (Business)
Fax:    +1 201 934-9206
  
  http://www.HM-Software.com/
  
  
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Tuesday, January 11, 2005 04:10 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Interesting tactic..


This sounds like an urban legend to me.  Keep in mind that there was
some news release a few weeks ago that indicated AOL was seeing
dramatically less spam traffic.  I think it is likely that AOL has
succeeded in blocking more spam, and the article was rehashed by
someone that didn't understand the topic and assumed that this meant a
drop in spam.  This used to happen all the time, even in industry mags,
back when the Internet was becoming a big deal.  Same thing with spam
now.  I'm sure that they mess up articles about medicine, astronomy,
etc., and we just don't know enough to see through the mistakes.

Matt



Dan Geiser wrote:

  I don't get this article at all.  How is this any different then sending
e-mails with using domains that you have no intention of ever using?  Why
would you want to register the domain name and then associated yourself with
a domain used in a spam mailing?  And from a technical standpoint why would
a distributed DNS system be overloaded by trying to lookup bogus domain
names?

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 2:50 PM
Subject: [Declude.JunkMail] Interesting tactic..


  
  

http://www.eweek.com/article2/0,1759,1749328,00.asp\

"One troublesome technique finding favor with spammers involves sending

  
  mass
  
  
mailings in the middle of the night from a domain that has not yet been
registered. After the mailings go out, the spammer registers the domain
early the next morning."

H

Kami


  
  

---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Interesting tactic..

[William Stillwell]

Like a US law is gonna stop a spammer located in Hong Kong or
Nigeria..
As far as I am concerned, if the From Address domain is not
coming from the MX for that domain, I don't want the mail. However
not everyone uses there MX for sending out the mail., this was
the whole reason for SPF, but nobody has even set that up.
If the domain doesn't exist, or does exists, dns servers are
taxed probably the same amount.. regardless of domain
existance.


- Original Message - 
From: "Dan Geiser" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 4:24 PM
Subject: Re: [Declude.JunkMail] Interesting tactic..


Yes, but Dennis Fisher is a senior editor at eWeek.  Don't they have 
someone
give these article the once over before printing them?

- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 4:09 PM
Subject: Re: [Declude.JunkMail] Interesting tactic..


This sounds like an urban legend to me.  Keep in mind that there was
some news release a few weeks ago that indicated AOL was seeing
dramatically less spam traffic.  I think it is likely that AOL has
succeeded in blocking more spam, and the article was rehashed by someone
that didn't understand the topic and assumed that this meant a drop in
spam.  This used to happen all the time, even in industry mags, back
when the Internet was becoming a big deal.  Same thing with spam now.
I'm sure that they mess up articles about medicine, astronomy, etc., and
we just don't know enough to see through the mistakes.
Matt

Dan Geiser wrote:
>I don't get this article at all.  How is this any different then sending
>e-mails with using domains that you have no intention of ever using? 
>Why
>would you want to register the domain name and then associated yourself
with
>a domain used in a spam mailing?  And from a technical standpoint why
would
>a distributed DNS system be overloaded by trying to lookup bogus domain
>names?
>
>- Original Message - 
>From: "Kami Razvan" <[EMAIL PROTECTED]>
>To: 
>Sent: Tuesday, January 11, 2005 2:50 PM
>Subject: [Declude.JunkMail] Interesting tactic..
>
>
>
>
>>
>>http://www.eweek.com/article2/0,1759,1749328,00.asp\
>>
>>"One troublesome technique finding favor with spammers involves sending
>>
>>
>mass
>
>
>>mailings in the middle of the night from a domain that has not yet been
>>registered. After the mailings go out, the spammer registers the domain
>>early the next morning."
>>
>>H
>>
>>Kami
>>
>>
>>
>
>
>---
>E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)
>
>---
>[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>
>
--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
This email has been scanned for possible viruses by Declude Antivirus.
For more information on Declude Antivirus, Visit www.declude.com

---
This email has been scanned for possible viruses by Declude Antivirus.
For more information on Declude Antivirus, Visit www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Mike Nice]

   The spammer sends out realistic messages that contain a URL flogging the
P I L L S site of the day.   Upon delivery, SpamAssassin etc. check the URL
in the message.  Not finding the URL in and RHSBL, and not able to get any
DNS info (such as DNS hosted by China), SpamAssassin has no information that
would flag the URL as bad.SpamTraps and manual spam reports are the only
thing that can flag this type of URL as spam, but since it is hard to
automatically tag as a spam URL it will likely escape.

  This spam technique makes the assumption that most people get up / into
work the next day and check their messages first thing.  At 6:00 AM the
spammer registers the domains and voila!  A valid web site in China to click
on.

   While I wouldn't necessarily want to associate myself with the spam a
spammer sends out, I can use the same sleazy techniques, minus the stolen
credit card: register with a registrar known to be soft on spam, provide
false contact information, and host it in China.  Put up a web page saying
"do not buy from E-mail ads", etc.   When the spammer goes to register it
the next morning, he will be unable to activate the domain and out of
customers for that spam run.   Long term the spammer still can win that
battle, but this is a great way to irritate someone on the other end for
once.

- Original Message - 
From: "Dan Geiser" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 3:59 PM
Subject: Re: [Declude.JunkMail] Interesting tactic..


> I don't get this article at all.  How is this any different then sending
> e-mails with using domains that you have no intention of ever using?  Why
> would you want to register the domain name and then associated yourself
with
> a domain used in a spam mailing?  And from a technical standpoint why
would
> a distributed DNS system be overloaded by trying to lookup bogus domain
> names?

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Mike Nice]

One area I have seen this used are the 'spamvertized domains' in the body of
the message which would require a SURBL style test on the URL in the message
body.  Message headers, delivery, and MAILFROM are otherwise as valid as any
other spam; sometimes quite authentic.

- Original Message - 
> The problem, though, is that any anti-spam program that does RHSBL tests
> probably does MAILFROM tests as well.  So while the domain won't be listed
> in any RHSBLs yet, it will fail the MAILFROM test, which is likely to be
> weighted higher.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Dan Geiser]

Yes, but Dennis Fisher is a senior editor at eWeek.  Don't they have someone
give these article the once over before printing them?

- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 4:09 PM
Subject: Re: [Declude.JunkMail] Interesting tactic..


> This sounds like an urban legend to me.  Keep in mind that there was
> some news release a few weeks ago that indicated AOL was seeing
> dramatically less spam traffic.  I think it is likely that AOL has
> succeeded in blocking more spam, and the article was rehashed by someone
> that didn't understand the topic and assumed that this meant a drop in
> spam.  This used to happen all the time, even in industry mags, back
> when the Internet was becoming a big deal.  Same thing with spam now.
> I'm sure that they mess up articles about medicine, astronomy, etc., and
> we just don't know enough to see through the mistakes.
>
> Matt
>
>
>
> Dan Geiser wrote:
>
> >I don't get this article at all.  How is this any different then sending
> >e-mails with using domains that you have no intention of ever using?  Why
> >would you want to register the domain name and then associated yourself
with
> >a domain used in a spam mailing?  And from a technical standpoint why
would
> >a distributed DNS system be overloaded by trying to lookup bogus domain
> >names?
> >
> >- Original Message - 
> >From: "Kami Razvan" <[EMAIL PROTECTED]>
> >To: 
> >Sent: Tuesday, January 11, 2005 2:50 PM
> >Subject: [Declude.JunkMail] Interesting tactic..
> >
> >
> >
> >
> >>
> >>http://www.eweek.com/article2/0,1759,1749328,00.asp\
> >>
> >>"One troublesome technique finding favor with spammers involves sending
> >>
> >>
> >mass
> >
> >
> >>mailings in the middle of the night from a domain that has not yet been
> >>registered. After the mailings go out, the spammer registers the domain
> >>early the next morning."
> >>
> >>H
> >>
> >>Kami
> >>
> >>
> >>
> >
> >
> >---
> >E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> >
> >---
> >This E-mail came from the Declude.JunkMail mailing list.  To
> >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >type "unsubscribe Declude.JunkMail".  The archives can be found
> >at http://www.mail-archive.com.
> >
> >
> >
> >
>
> -- 
> =
> MailPure custom filters for Declude JunkMail Pro.
> http://www.mailpure.com/software/
> =
>
>


---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Interesting tactic..

[Andy Schmidt]

Title: Message



Well, 
I CAN tell you that I have personal contacts with Spammers (who keep wanting me 
to take their business) - and from casual conversations about the "industry" I 
know that several DO clean any AOL mailboxes from their lists before 
doing campaigns out of fear of litigation based on VA 
law. 
Best 
RegardsAndy SchmidtH&M Systems Software, Inc.600 East Crescent 
Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone:  +1 201 934-3414 x20 
(Business)Fax:    +1 201 934-9206http://www.HM-Software.com/ 

  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of MattSent: Tuesday, January 11, 2005 04:10 
  PMTo: Declude.JunkMail@declude.comSubject: Re: 
  [Declude.JunkMail] Interesting tactic..This sounds like 
  an urban legend to me.  Keep in mind that there was some news release a 
  few weeks ago that indicated AOL was seeing dramatically less spam 
  traffic.  I think it is likely that AOL has succeeded in blocking more 
  spam, and the article was rehashed by someone that didn't understand the topic 
  and assumed that this meant a drop in spam.  This used to happen all the 
  time, even in industry mags, back when the Internet was becoming a big 
  deal.  Same thing with spam now.  I'm sure that they mess up 
  articles about medicine, astronomy, etc., and we just don't know enough to see 
  through the mistakes.MattDan Geiser wrote: 
  I don't get this article at all.  How is this any different then sending
e-mails with using domains that you have no intention of ever using?  Why
would you want to register the domain name and then associated yourself with
a domain used in a spam mailing?  And from a technical standpoint why would
a distributed DNS system be overloaded by trying to lookup bogus domain
names?

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 2:50 PM
Subject: [Declude.JunkMail] Interesting tactic..


  

http://www.eweek.com/article2/0,1759,1749328,00.asp\

"One troublesome technique finding favor with spammers involves sending
mass
  
mailings in the middle of the night from a domain that has not yet been
registered. After the mailings go out, the spammer registers the domain
early the next morning."

H

Kami



---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Interesting tactic..

[Matt]

This sounds like an urban legend to me.  Keep in mind that there was
some news release a few weeks ago that indicated AOL was seeing
dramatically less spam traffic.  I think it is likely that AOL has
succeeded in blocking more spam, and the article was rehashed by
someone that didn't understand the topic and assumed that this meant a
drop in spam.  This used to happen all the time, even in industry mags,
back when the Internet was becoming a big deal.  Same thing with spam
now.  I'm sure that they mess up articles about medicine, astronomy,
etc., and we just don't know enough to see through the mistakes.

Matt



Dan Geiser wrote:

  I don't get this article at all.  How is this any different then sending
e-mails with using domains that you have no intention of ever using?  Why
would you want to register the domain name and then associated yourself with
a domain used in a spam mailing?  And from a technical standpoint why would
a distributed DNS system be overloaded by trying to lookup bogus domain
names?

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 2:50 PM
Subject: [Declude.JunkMail] Interesting tactic..


  
  

http://www.eweek.com/article2/0,1759,1749328,00.asp\

"One troublesome technique finding favor with spammers involves sending

  
  mass
  
  
mailings in the middle of the night from a domain that has not yet been
registered. After the mailings go out, the spammer registers the domain
early the next morning."

H

Kami


  
  

---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Interesting tactic..

[Dan Geiser]

I don't get this article at all.  How is this any different then sending
e-mails with using domains that you have no intention of ever using?  Why
would you want to register the domain name and then associated yourself with
a domain used in a spam mailing?  And from a technical standpoint why would
a distributed DNS system be overloaded by trying to lookup bogus domain
names?

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 2:50 PM
Subject: [Declude.JunkMail] Interesting tactic..


> 
> http://www.eweek.com/article2/0,1759,1749328,00.asp\
>
> "One troublesome technique finding favor with spammers involves sending
mass
> mailings in the middle of the night from a domain that has not yet been
> registered. After the mailings go out, the spammer registers the domain
> early the next morning."
>
> H
>
> Kami
>


---
E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan)

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[R. Scott Perry]

> As far as the technique is concerned, it really seems silly -- I can't
> see what benefit a spammer would have from doing this.
I have never heard of this before but one would suppose the logic is
the domains will not be listed anywhere - yet. So the mail
 gets delivered and then the domains go live.
The problem, though, is that any anti-spam program that does RHSBL tests 
probably does MAILFROM tests as well.  So while the domain won't be listed 
in any RHSBLs yet, it will fail the MAILFROM test, which is likely to be 
weighted higher.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Mike Nice]

>"One troublesome technique finding favor with
>spammers involves sending mass mailings in the
>middle of the night from a domain that has not
>yet been registered. After the mailings go out,
>the spammer registers the domain early the
>next morning."
>
>H

   Want to tick off some spammers?  Register some of those domains out from
under their noses!!

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: Re[2]: [Declude.JunkMail] external program with quotes.... topic change

[Nick]

On 11 Jan 2005 at 15:17, Sanford Whiteman wrote:

> SPAMC32  has  _far_  more  options  than  SPAMC that make it ideal for
> integration  with  Declude and which will cut down on your CPU use vs.
> SPAMC.
No arguments here. It works extremely well.

  Example: skip-if weight (-sw switch) will not scan the message
> if the current Declude weight is already above a set threshold.
I believe the line below  will do the same for any external test:
d:\windows\system32\cmd.exe /c if %WEIGHT% LSS 36 
once agin I think from Sandy? - regardless it was off this list.

-Nick


> 
> --Sandy
> 
> 
> 
> Sanford Whiteman, Chief Technologist
> Broadleaf Systems, a division of
> Cypress Integrated Systems, Inc.
> e-mail: [EMAIL PROTECTED]
> 
> SpamAssassin plugs into Declude!
>   http://www.mailmage.com/products/software/freeutils/SPAMC32/download
>   /release/
> 
> Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
> Aliases!
>   http://www.mailmage.com/products/software/freeutils/exchange2aliases
>   /download/release/
>   http://www.mailmage.com/products/software/freeutils/ldap2aliases/dow
>   nload/release/
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[Nick]

On 11 Jan 2005 at 15:15, R. Scott Perry wrote:

> As far as the technique is concerned, it really seems silly -- I can't
> see what benefit a spammer would have from doing this.
I have never heard of this before but one would suppose the logic is 
the domains will not be listed anywhere - yet. So the mail 
 gets delivered and then the domains go live.

-Nick


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Interesting tactic..

[R. Scott Perry]

http://www.eweek.com/article2/0,1759,1749328,00.asp\
"One troublesome technique finding favor with spammers involves sending 
mass mailings in the middle of the night from a domain that has not yet 
been registered. After the mailings go out, the spammer registers the 
domain early the next morning."
Interestingly, the main point of the article (that this technique wreaks 
havoc on DNS) is complete hogwash.  I've informed the author of the 
article, and hope he posts a retraction.

As far as the technique is concerned, it really seems silly -- I can't see 
what benefit a spammer would have from doing this.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re[2]: [Declude.JunkMail] external program with quotes.... topic change

[Sanford Whiteman]

> I  was  unaware  that someone else had ported SPAMC.

Yep.

SPAMC32  has  _far_  more  options  than  SPAMC that make it ideal for
integration  with  Declude and which will cut down on your CPU use vs.
SPAMC.  Example: skip-if weight (-sw switch) will not scan the message
if the current Declude weight is already above a set threshold.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  
http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/
  
http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Interesting tactic..

[Kami Razvan]

http://www.eweek.com/article2/0,1759,1749328,00.asp\
 
"One troublesome technique finding favor with 
spammers involves sending mass mailings in the middle of the night from a domain 
that has not yet been registered. After the mailings go out, the spammer 
registers the domain early the next 
morning."
 
H
 
Kami

RE: [Declude.JunkMail] external program with quotes.... topic change

[Chase Seibert]

I was unaware that someone else had ported SPAMC. I just compiled SPAMD/C using ActivePerl's perl -> exe tools and cygwin. Then I wrote executPipe.exe in C#, which just reads a file and passes it into the stdin of SPAMC. Works great. SPAMD is about 3-4 times faster than the straight non-daemonized version. However, I actually don't use it anymore. Even with those speed increases, it takes 25% of the processor on my dual 3Ghz servers under moderate load (100,000 msgs/day). 
 
I plan to offload SPAMD onto another machine at some point in the future, and resume using spamassassin. It's a pretty good filter, and customers love hearing we use it.
 

 -Chase
Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc  |  617.464.2440 x119  |  www.bullhorn.com
 
-Original Message-From:Nick [EMAIL PROTECTED] To: "Declude.JunkMail@declude.com" ;Sent: Jan 11, 2005 10:45:42 AMSubject: RE: [DecludeJunkMail] external program with quotes topic changeOn 11 Jan 2005 at 10:09, Chase Seibert wrote: Hi Chase - Would you elaborate on spamassassin.exe? I use Sandy's SPAMC32.exe utility to run Spamassassin - I am not familiar with the port you appear to be using however - Thanks! -Nick From: Chase Seibert <[EMAIL PROTECTED]>To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] external program with quotes Date sent: 11 Jan 2005 10:09:28 -0500 Send reply to: Declude.JunkMail@declude.com > > > Here is the exact rule I have: > > SPAMASSASSIN external nonzero > "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c > C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 > > This executes executePipe.exe with the argument -a "-e -L" correctly. > > > > -Chase > > Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | > 617.464.2440 x119 | www.bullhorn.com > > > > -Original Message- > From:Matt [EMAIL PROTECTED] > To: "Declude.JunkMail@declude.com" ; > Sent: Jan 11, 2005 10:04:03 AM > Subject: Re: [Declude.JunkMail] external program with quotes... > My experience was that Declude uses the first two sets of quotes, > regardless of switches. There is no special handling for such things. > > Matt > > > > Chase Seibert wrote: > > >Try: > > > > > > > >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe > >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 > >REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 > > > > > >I believe I have a rule that uses \", and it works. > > > > > > > > -Chase > > > >Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | > >617.464.2440 x119 | www.bullhorn.com > > > > > > > >-Original Message- > >From:Scott Fisher [EMAIL PROTECTED] > >To: "Declude.JunkMail@declude.com" ; > >Sent: Jan 11, 2005 09:34:47 AM > >Subject: Re: [Declude.JunkMail] external program with quotes... > > > > > >I agree. But the %REVDNS% variable may contain [No Reverse DNS] which > >contains spaces... > > > >- Original Message - > >From: Kevin Bilbee > >To: Declude.JunkMail@declude.com > >Sent: Monday, January 10, 2005 10:19 PM > >Subject: RE: [Declude.JunkMail] external program with quotes > > > > > > > > > >Reverse dns should never have spaces in it. > > > > > > > >-Original Message- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher > > Sent: Monday, January 10, 2005 7:22 PM To: > >Declude.JunkMail@declude.com Subject: [Declude.JunkMail] external > >program with quotes > > > > > > > >I'm writing my own external program to compare domain names. > > > >I need to pass the %REVDNS% parameter with quotes around it due to > >possible spaces in it. > > > >Is this possible? > > > > > > > > > > > >Will this work? > > > > > >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe > >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 > >REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 > > > > > > > > -- > = > MailPure custom filters for Declude JunkMail Pro. > http://www.mailpure.com/software/ > = > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. 

Re: [Declude.JunkMail] Google and/or Earthlink failing subjectchars

[R. Scott Perry]

Just commenting about the semantics of what constitutes a "release".  I'm 
not sure that 1.82 fixes this since it was targeted at the SPAMDOMAINS 
issue (could have, but it isn't documented), but the latest beta release 
was definitely reported to have fixed it.
Correct.
1.82 is just 1.81 with a patch that fixes the SPAMHEADERS issue.
   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Google and/or Earthlink failing subjectchars

[Matt]

Just commenting about the semantics of what constitutes a "release". 
I'm not sure that 1.82 fixes this since it was targeted at the
SPAMDOMAINS issue (could have, but it isn't documented), but the latest
beta release was definitely reported to have fixed it.

Matt



Bill Landry wrote:

  - Original Message - 
From: <[EMAIL PROTECTED]>

  
  
Is any one seeing Google and or Earthlink failing the subjectchars test on
blank subject lines or even if there is a subject typed in ?

Any one know of a reason for this.

  
  
This was a know bug that I think has been fixed with the latest release.
See:

http://www.mail-archive.com/declude.junkmail@declude.com/msg21811.html

and related tread for more info.

Bill

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] Google and/or Earthlink failing subjectchars

[Bill Landry]

- Original Message - 
From: <[EMAIL PROTECTED]>

> Is any one seeing Google and or Earthlink failing the subjectchars test on
> blank subject lines or even if there is a subject typed in ?
>
> Any one know of a reason for this.

This was a know bug that I think has been fixed with the latest release.
See:

http://www.mail-archive.com/declude.junkmail@declude.com/msg21811.html

and related tread for more info.

Bill

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Google and/or Earthlink failing subjectchars

[smb]

Is any one seeing Google and or Earthlink failing the subjectchars test on
blank subject lines or even if there is a subject typed in ?

Any one know of a reason for this.

Thanks

Stu




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[R. Scott Perry]

Has there been a change in the cfg files lately, or something?
I've seen a few domains/IPs that Spamcop does have listed,
yet, they don't appear to have failed the spamcop test.
This is the line I have in my cfg file:
SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0

Is there something I should notice so that I can see
why this test isn't being run?  (I used to see it all the time too.)
Are any E-mails failing the SPAMCOP test?  If not, then there is probably a 
DNS or configuration issue.

If some E-mails are failing the SPAMCOP test, the problem may just be that 
you are receiving the E-mail before the IP gets listed in the SPAMCOP 
database.  Unfortunately, the company that now runs SPAMCOP no longer lets 
you see when the IP was added, so it is impossible to know for certain 
whether or not that is the case.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SpamCop not testing?

[Ernesto Nieto]

Has there been a change in the cfg files lately, or something?
I've seen a few domains/IPs that Spamcop does have listed,
yet, they don't appear to have failed the spamcop test.
This is the line I have in my cfg file:

SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0



Is there something I should notice so that I can see

why this test isn't being run?  (I used to see it all the time too.)

Thanks






---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] external program with quotes....

[Matt]

Another note...my issue was with CScript being used to call VBS files
and trying to insert quotes.  I'm not sure if I tried this, but I gave
up after a few hours and worked around the issue by coding something in
the script to handle it.  I don't know if this is unique to the CScript
environment when called from Declude, or if I even tried that
particular method.  I'm not sure that CScript allows for switches of
this variety.  I think that Scott does mostly VB executables, so I'm
guessing that his options and capabilities are different than mine in
this regard, and maybe even different from yours.  I'm not sure what
determines how to parse the arguments out of such things, whether it is
executable specific, or something in the environment.  That would be
nice to know if anyone does in fact know.

Thanks again,

Matt



Matt wrote:

  
If it works for you, then it should work for all.  Thanks for sharing.
  
Matt
  
  
  
Chase Seibert wrote:
  
Here is the exact rule I have:
 
SPAMASSASSIN  external nonzero "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 
 
This executes executePipe.exe with the argument -a "-e -L" correctly.

 

 -Chase

Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc.  |  617.464.2440 x119  |  www.bullhorn.com


 
-Original Message-
From:Matt [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ;
Sent: Jan 11, 2005 10:04:03 AM
Subject: Re: [Declude.JunkMail] external program with quotes
My experience was that Declude uses the first two sets of quotes, 
regardless of switches. There is no special handling for such things. 

Matt 



Chase Seibert wrote: 

  

  Try: 



MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 


I believe I have a rule that uses \", and it works. 



-Chase 

Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com 



-Original Message- 
From:Scott Fisher [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ; 
Sent: Jan 11, 2005 09:34:47 AM 
Subject: Re: [Declude.JunkMail] external program with quotes 


I agree. But the %REVDNS% variable may contain [No Reverse DNS] which contains spaces... 

- Original Message - 
From: Kevin Bilbee 
To: Declude.JunkMail@declude.com 
Sent: Monday, January 10, 2005 10:19 PM 
Subject: RE: [Declude.JunkMail] external program with quotes 




Reverse dns should never have spaces in it. 



-Original Message- 
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher 
Sent: Monday, January 10, 2005 7:22 PM 
To: Declude.JunkMail@declude.com 
Subject: [Declude.JunkMail] external program with quotes 



I'm writing my own external program to compare domain names. 

I need to pass the %REVDNS% parameter with quotes around it due to possible spaces in it. 

Is this possible? 





Will this work? 


MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 






  
  
  
  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] external program with quotes....

[Matt]

If it works for you, then it should work for all.  Thanks for sharing.

Matt



Chase Seibert wrote:

  
Here is the exact rule I have:
 
SPAMASSASSIN  external nonzero "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 
 
This executes executePipe.exe with the argument -a "-e -L" correctly.

 

 -Chase

Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc.  |  617.464.2440 x119  |  www.bullhorn.com


 
-Original Message-
From:Matt [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ;
Sent: Jan 11, 2005 10:04:03 AM
Subject: Re: [Declude.JunkMail] external program with quotes
My experience was that Declude uses the first two sets of quotes, 
regardless of switches. There is no special handling for such things. 

Matt 



Chase Seibert wrote: 

  
  
Try: 



MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 


I believe I have a rule that uses \", and it works. 



-Chase 

Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 x119 | www.bullhorn.com 



-Original Message- 
From:Scott Fisher [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ; 
Sent: Jan 11, 2005 09:34:47 AM 
Subject: Re: [Declude.JunkMail] external program with quotes 


I agree. But the %REVDNS% variable may contain [No Reverse DNS] which contains spaces... 

- Original Message - 
From: Kevin Bilbee 
To: Declude.JunkMail@declude.com 
Sent: Monday, January 10, 2005 10:19 PM 
Subject: RE: [Declude.JunkMail] external program with quotes 




Reverse dns should never have spaces in it. 



-Original Message- 
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher 
Sent: Monday, January 10, 2005 7:22 PM 
To: Declude.JunkMail@declude.com 
Subject: [Declude.JunkMail] external program with quotes 



I'm writing my own external program to compare domain names. 

I need to pass the %REVDNS% parameter with quotes around it due to possible spaces in it. 

Is this possible? 





Will this work? 


MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 




  
  
  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] external program with quotes.... topic change

[Nick]

On 11 Jan 2005 at 10:09, Chase Seibert wrote:

Hi Chase - 

Would you elaborate on spamassassin.exe?

I use Sandy's SPAMC32.exe utility to run Spamassassin - I am not 
familiar with the port you appear to be using however - 

Thanks!

-Nick


From:   Chase Seibert <[EMAIL PROTECTED]>
To: Declude.JunkMail@declude.com
Subject:RE: [Declude.JunkMail] external program with quotes
Date sent:  11 Jan 2005 10:09:28 -0500
Send reply to:  Declude.JunkMail@declude.com

> 
> 
> Here is the exact rule I have:
> 
> SPAMASSASSIN  external nonzero
> "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c
> C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 
> 
> This executes executePipe.exe with the argument -a "-e -L" correctly.
> 
> 
> 
>  -Chase
> 
> Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc.  | 
> 617.464.2440 x119  |  www.bullhorn.com
> 
> 
> 
> -Original Message-
> From:Matt [EMAIL PROTECTED] 
> To: "Declude.JunkMail@declude.com" ;
> Sent: Jan 11, 2005 10:04:03 AM
> Subject: Re: [Declude.JunkMail] external program with quotes
> My experience was that Declude uses the first two sets of quotes,
> regardless of switches. There is no special handling for such things. 
> 
> Matt 
> 
> 
> 
> Chase Seibert wrote: 
> 
> >Try: 
> > 
> > 
> > 
> >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe
> >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440
> >REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 
> > 
> > 
> >I believe I have a rule that uses \", and it works. 
> > 
> > 
> > 
> > -Chase 
> > 
> >Chase Seibert | Network and Systems Engineer | Bullhorn Inc. |
> >617.464.2440 x119 | www.bullhorn.com 
> > 
> > 
> > 
> >-Original Message- 
> >From:Scott Fisher [EMAIL PROTECTED] 
> >To: "Declude.JunkMail@declude.com" ; 
> >Sent: Jan 11, 2005 09:34:47 AM 
> >Subject: Re: [Declude.JunkMail] external program with quotes 
> > 
> > 
> >I agree. But the %REVDNS% variable may contain [No Reverse DNS] which
> >contains spaces... 
> > 
> >- Original Message - 
> >From: Kevin Bilbee 
> >To: Declude.JunkMail@declude.com 
> >Sent: Monday, January 10, 2005 10:19 PM 
> >Subject: RE: [Declude.JunkMail] external program with quotes 
> > 
> > 
> > 
> > 
> >Reverse dns should never have spaces in it. 
> > 
> > 
> > 
> >-Original Message- 
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
> > Sent: Monday, January 10, 2005 7:22 PM To:
> >Declude.JunkMail@declude.com Subject: [Declude.JunkMail] external
> >program with quotes 
> > 
> > 
> > 
> >I'm writing my own external program to compare domain names. 
> > 
> >I need to pass the %REVDNS% parameter with quotes around it due to
> >possible spaces in it. 
> > 
> >Is this possible? 
> > 
> > 
> > 
> > 
> > 
> >Will this work? 
> > 
> > 
> >MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe
> >PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440
> >REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 
> > 
> > 
> > 
> 
> -- 
> = 
> MailPure custom filters for Declude JunkMail Pro. 
> http://www.mailpure.com/software/ 
> = 
> 
> --- 
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)] 
> 
> --- 
> This E-mail came from the Declude.JunkMail mailing list. To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail". The archives can be found 
> at http://www.mail-archive.com. 
> 
> 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] external program with quotes....

[Chase Seibert]

Here is the exact rule I have:
 
SPAMASSASSIN  external nonzero "C:\Apps\CheckSpamAssassin\executePipe.exe -e -c 
C:\Apps\CheckSpamAssassin\spamassassin.exe -a \"-e -L\" -f " 7 0 
 
This executes executePipe.exe with the argument -a "-e -L" correctly.

 

 -Chase

Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc.  |  617.464.2440 
x119  |  www.bullhorn.com


 
-Original Message-
From:Matt [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ;
Sent: Jan 11, 2005 10:04:03 AM
Subject: Re: [Declude.JunkMail] external program with quotes
My experience was that Declude uses the first two sets of quotes, 
regardless of switches. There is no special handling for such things. 

Matt 



Chase Seibert wrote: 

>Try: 
> 
> 
> 
>MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
>PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 
>REVDNS=\"%REVDNS%\" FROM=%MAILFROM%" 0 0 
> 
> 
>I believe I have a rule that uses \", and it works. 
> 
> 
> 
> -Chase 
> 
>Chase Seibert | Network and Systems Engineer | Bullhorn Inc. | 617.464.2440 
>x119 | www.bullhorn.com 
> 
> 
> 
>-Original Message- 
>From:Scott Fisher [EMAIL PROTECTED] 
>To: "Declude.JunkMail@declude.com" ; 
>Sent: Jan 11, 2005 09:34:47 AM 
>Subject: Re: [Declude.JunkMail] external program with quotes 
> 
> 
>I agree. But the %REVDNS% variable may contain [No Reverse DNS] which contains 
>spaces... 
> 
>- Original Message - 
>From: Kevin Bilbee 
>To: Declude.JunkMail@declude.com 
>Sent: Monday, January 10, 2005 10:19 PM 
>Subject: RE: [Declude.JunkMail] external program with quotes 
> 
> 
> 
> 
>Reverse dns should never have spaces in it. 
> 
> 
> 
>-Original Message- 
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher 
>Sent: Monday, January 10, 2005 7:22 PM 
>To: Declude.JunkMail@declude.com 
>Subject: [Declude.JunkMail] external program with quotes 
> 
> 
> 
>I'm writing my own external program to compare domain names. 
> 
>I need to pass the %REVDNS% parameter with quotes around it due to possible 
>spaces in it. 
> 
>Is this possible? 
> 
> 
> 
> 
> 
>Will this work? 
> 
> 
>MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
>PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 
>REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0 
> 
> 
> 

-- 
= 
MailPure custom filters for Declude JunkMail Pro. 
http://www.mailpure.com/software/ 
= 

--- 
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

--- 
This E-mail came from the Declude.JunkMail mailing list. To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
type "unsubscribe Declude.JunkMail". The archives can be found 
at http://www.mail-archive.com. 

Re: [Declude.JunkMail] external program with quotes....

[Matt]

My experience was that Declude uses the first two sets of quotes, 
regardless of switches.  There is no special handling for such things.

Matt

Chase Seibert wrote:
Try:

MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=\"%REVDNS%\" 
FROM=%MAILFROM%" 0 0
I believe I have a rule that uses \", and it works.

-Chase
Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc.  |  617.464.2440 
x119  |  www.bullhorn.com

-Original Message-
From:Scott Fisher [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ;
Sent: Jan 11, 2005 09:34:47 AM
Subject: Re: [Declude.JunkMail] external program with quotes

I agree. But the %REVDNS% variable may contain [No Reverse DNS] which 
contains spaces...
- Original Message - 
From: Kevin Bilbee 
To: Declude.JunkMail@declude.com 
Sent: Monday, January 10, 2005 10:19 PM
Subject: RE: [Declude.JunkMail] external program with quotes


Reverse dns should never have spaces in it.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Monday, January 10, 2005 7:22 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] external program with quotes

I'm writing my own external program to compare domain names.
I need to pass the %REVDNS% parameter with quotes around it due to possible 
spaces in it.
Is this possible?


Will this work?
MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe PATH=d:\IMail\declude\FPFilters 
LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] external program with quotes....

[Chase Seibert]

Try:
 


MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=\"%REVDNS%\" 
FROM=%MAILFROM%" 0 0


I believe I have a rule that uses \", and it works.



 -Chase

Chase Seibert |  Network and Systems Engineer |  Bullhorn Inc.  |  617.464.2440 
x119  |  www.bullhorn.com


 
-Original Message-
From:Scott Fisher [EMAIL PROTECTED] 
To: "Declude.JunkMail@declude.com" ;
Sent: Jan 11, 2005 09:34:47 AM
Subject: Re: [Declude.JunkMail] external program with quotes


I agree. But the %REVDNS% variable may contain [No Reverse DNS] which contains 
spaces...

- Original Message - 
From: Kevin Bilbee 
To: Declude.JunkMail@declude.com 
Sent: Monday, January 10, 2005 10:19 PM
Subject: RE: [Declude.JunkMail] external program with quotes




Reverse dns should never have spaces in it.



-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Monday, January 10, 2005 7:22 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] external program with quotes



I'm writing my own external program to compare domain names.

I need to pass the %REVDNS% parameter with quotes around it due to possible 
spaces in it.

Is this possible?

 



Will this work?


MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 REVDNS=""%REVDNS%"" 
FROM=%MAILFROM%" 0 0

Re: [Declude.JunkMail] external program with quotes....

[Matt]

Title: Message




Declude substitutes values for invalid lookups in the %REVDNS% variable
that can contain spaces.

Matt



Andy Schmidt wrote:

  
  
  
  Hi Scott:
   
  Assuming you have a good reason to expect
spaces in the RDNS (if one managed to squeeze a space into their DNS
server somehow, it would be invalid anyway!) - why not use a different
delimiter?  You can use single quote or any delimiting character that
is NOT a valid character for FQDNs?
  
  Best Regards
  Andy Schmidt
  
  Phone:  +1 201 934-3414 x20
(Business)
Fax:    +1 201 934-9206 
   
Scott Fisher wrote:

  
  
  I'm writing my own external
program to compare domain names.
  I need to pass the %REVDNS%
parameter with quotes around it due to possible spaces in it.
  Is this possible?
   
  
  Will this work?
  MR-MATCHING external 11
"D:\IMail\Declude\FPFilters\vbs\FRDNS.exe
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440
REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0
  

  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] external program with quotes....

[Scott Fisher]

Title: Message



I agree. But the %REVDNS% variable may contain [No 
Reverse DNS] which contains spaces...

  - Original Message - 
  From: 
  Kevin Bilbee 
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, January 10, 2005 10:19 
  PM
  Subject: RE: [Declude.JunkMail] external 
  program with quotes
  
  Reverse dns should never have spaces in it.
  

-Original Message-From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of Scott 
FisherSent: Monday, January 10, 2005 7:22 PMTo: Declude.JunkMail@declude.comSubject: 
[Declude.JunkMail] external program with quotes
I'm writing my own external program to compare 
domain names.
I need to pass the %REVDNS% parameter with 
quotes around it due to possible spaces in it.
Is this possible?
 

Will this work?
MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 
REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 
0

RE: [Declude.JunkMail] external program with quotes....

[Andy Schmidt]

Title: Message



Hi 
Scott:
 
Assuming you have a good reason to expect spaces in the 
RDNS (if one managed to squeeze a space into their DNS server 
somehow, it would be invalid anyway!) - why not use a different delimiter?  
You can use single quote or any delimiting character that is NOT a valid 
character for FQDNs?
Best 
RegardsAndy SchmidtPhone:  +1 201 934-3414 x20 
(Business)Fax:    +1 201 934-9206 

  Scott Fisher 
  wrote: 
  



I'm writing my own external program to compare 
domain names.
I need to pass the %REVDNS% parameter with 
quotes around it due to possible spaces in it.
Is this possible?
 

Will this work?
MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe 
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440 
REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 
0

Re: [Declude.JunkMail] external program with quotes....

[Matt]

Scott,

Quotes won't work because Declude will use them instead of passing them
to the script (quite unfortunate).

You need to come up with a difference delimiter if you do this,
something like single quotes.  Then construct a loop to keep adding
values from the space delimited Arguments until it reaches a string
with an ending quote.

Matt



Scott Fisher wrote:

  
  
  
  I'm writing my own external program
to compare domain names.
  I need to pass the %REVDNS%
parameter with quotes around it due to possible spaces in it.
  Is this possible?
   
  
  Will this work?
  MR-MATCHING external 11 "D:\IMail\Declude\FPFilters\vbs\FRDNS.exe
PATH=d:\IMail\declude\FPFilters LOG=HIGH CW=%WEIGHT% SW=440
REVDNS=""%REVDNS%"" FROM=%MAILFROM%" 0 0
  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] external program with quotes....

[R. Scott Perry]

I'm writing my own external program to compare domain names.
I need to pass the %REVDNS% parameter with quotes around it due to 
possible spaces in it.
Is this possible?
No, it is not possible, since the entire command line needs to be quoted.
However, as Kevin pointed out, reverse DNS entries should never have a 
space in them.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.