[Declude.JunkMail] SMTP Service
If you are running Imail should you ever see the stmp32.exe process ever come up? I know youll see SMTPd32.exe Occasionally I will see the smtp32.exe process come up, but none of that is enabled and I was wondering if I have been Hi-jacked or something. This morning I had a very heavy load as users got into work and I was seeing stmp32.exe and stmpd32.exe at about the same rate. For the past 2 weeks I have noticed the SMTPd32.exe process getting up to 2.32 Gig and staying there normally it is about 7 Mb in the task manager. I had a problem about 3 months ago with the spool filling up but that was do to a memory leak in 2003 DNS and I put that hot fix on and it has been working fine until 2 weeks. The only weird thing about 3 weeks ago when I looked into my network connections I had a RAC connection setup and it was connected and I have never seen that before. I also have a RAC VNC Service under services now. I did read something about Dell having RAC VNC Service, but unless it installed it on its own I have never seen it. I have turned it all off and It hasnt affected anything on my end so I dont know what it is. Kyle 2003 Windows Server Imail 8.15 Declude 2.05 Junkmail/Antivirus Sniffer F-Prot 3.16a
[Declude.JunkMail] SpamCop listing AOL webmail servers
http://www.spamcop.net/bl.shtml?205.188.139.132 WHY? (grumble mumble grumble ^%^$^*(^%^%^^) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamCop listing AOL webmail servers
Well, John. I'm sure that's a rhetorical question, but I'm feeling a little chatty while I listen to hold music. SpamCop and pretty well every other blacklisting service make no allowance for how much good mail is coming from an IP address. They only do blacklisting. The funny thing is that since IronPort now owns SpamCop.net, you'd think that they could use the statistics that they expose at SenderBase.org to adjust the weighting mechanism that SpamCop uses. I'm sure that a) AOL isn't perfect, and spam does come from some accounts, b) Automated (and semi-automated) listing mechanisms like SpamCop will impede traffic c) AOL is the ISP that everyone loves to hate. SpamCop users may well go ahead and and report suspicious emails. d) Spam and virus blowblack needs to be carefully weeded out by ISPs so that they don't get listed by sending unexpected responses to forged addresses. It's been said by wiser heads, but I'll say it again for folks without John's depth of experience: Don't weigh individual tests high enough to be caught by a single false positive. That likely means that you will get some spam in, but that's preferable to blocking mail that you shouldn't. I've been burned by multiple ip4r tests blocking ISPs, and have counterweighted those mail servers accordingly. That also means that I'm more likely to get spam. I'll also add that false positives in blacklisting has made content inspection much more important to me. Mail Sniffer from SortMonster.com helps me out a huge amount, and has taken away much of my burden for maintaining my own filter text files. A SURBL lookup like invIURIBL from invariantsystems.com or via spamassassin would certainly help out too (but I'm not there yet). Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, February 28, 2005 7:10 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] SpamCop listing AOL webmail servers http://www.spamcop.net/bl.shtml?205.188.139.132 WHY? (grumble mumble grumble ^%^$^*(^%^%^^) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Sure thing, Dan. IMail always retries at 10 minute intervals, so you set the duration of the retries by multiplying out the value at: localhost, Services, SMTP, x tried before returning to sender. If you want more flexibility, invest the time to implement Microsoft Windows Server IIS SMTP for your outbound mail. Lots of options there. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, February 28, 2005 9:10 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AOL header tags
Hello - I am seeing these tags in AOL bounces - X-AOL-IP: 213.226.82.229 X-AOL-SCOLL-SCORE: 0:2:169167590:15837691 X-AOL-SCOLL-URL_COUNT: 0 Does anyone know what they represent? The first I believe is the original sender ip; since these are coming to me mainly as a result of joejobs I'm looking for a way to penalize these type bounces - Thanks -Nick --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Dan, Yes, you can adjust the retry times on the SMTP process tries before returning to sender and on the Queue Manager process retry time. Tries before returning to sender * retry = length of time you will attempt delivery of the mail. Hope that helps, Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamCop listing AOL webmail servers
Indeed. Hypothetically, of course, one could do add these lines to a filter: #Sep-12-2003 AC The ISP everyone loves to hate, always has a weight of 8 due to NOABUSE:3 NOPOSTMASTER:3 IPNOTINMX:2 #Sep-23-2003And is always on someone's shit list; added another 10 to the counterweight #Feb-28-2005 AC Updated the list of CIDR blocks via SenderBase.org and split the weight between revdns and remoteip REVDNS-9 ENDSWITH .mx.aol.com REVDNS-9 ENDSWITH .webmail.aol.com REMOTEIP -9 CIDR 152.163.225.0/24 REMOTEIP -9 CIDR 205.188.139.0/24 REMOTEIP -9 CIDR 205.188.144.0/24 REMOTEIP -9 CIDR 205.188.155.0/24 REMOTEIP -9 CIDR 205.188.156.0/24 REMOTEIP -9 CIDR 205.188.158.0/24 REMOTEIP -9 CIDR 205.188.159.0/24 REMOTEIP -9 CIDR 64.12.136.0/24 REMOTEIP -9 CIDR 64.12.137.0/24 REMOTEIP -9 CIDR 64.12.138.0/24 Of course, hypothetically speaking, one could also contrive a Scott Fisher-esque TRUE-AOL test based entirely on his technique for his TRUE-TLD tests, thus only rewarding messages with a negative weight if the mailfrom and the revdns are both aol.com ... Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 11:02 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SpamCop listing AOL webmail servers SpamCop and pretty well every other blacklisting service make no allowance for how much good mail is coming from an IP address. They only do blacklisting. I am not sure how many people actually do this, but I give a small weight back to the message if it was truely sent from an AOL MX. This helps when specific AOL servers get listed in Spamcop. To be honest I see very little spam sent directly from AOL servers. So this method of credit I have been doing has never been a real problem. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamCop listing AOL webmail servers
I also should have expounded more on my post. The MX servers are not listed, rather the webmail servers are. Since I scan 2 hops, it is the 2nd hop that is getting hit on. What I have done for that is the following filter: MAILFROM END NOTENDSWITH @aol.com TESTSFAILED END NOTCONTAINS SPAMCOP REVDNS -15 ENDSWITH .mx.aol.com The -15 is counter weight for SPAMCOP which I only weigh at 15. (Hold at 25 delete at 35) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, February 28, 2005 9:37 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SpamCop listing AOL webmail servers Well, John. I'm sure that's a rhetorical question, but I'm feeling a little chatty while I listen to hold music. SpamCop and pretty well every other blacklisting service make no allowance for how much good mail is coming from an IP address. They only do blacklisting. The funny thing is that since IronPort now owns SpamCop.net, you'd think that they could use the statistics that they expose at SenderBase.org to adjust the weighting mechanism that SpamCop uses. I'm sure that a) AOL isn't perfect, and spam does come from some accounts, b) Automated (and semi-automated) listing mechanisms like SpamCop will impede traffic c) AOL is the ISP that everyone loves to hate. SpamCop users may well go ahead and and report suspicious emails. d) Spam and virus blowblack needs to be carefully weeded out by ISPs so that they don't get listed by sending unexpected responses to forged addresses. It's been said by wiser heads, but I'll say it again for folks without John's depth of experience: Don't weigh individual tests high enough to be caught by a single false positive. That likely means that you will get some spam in, but that's preferable to blocking mail that you shouldn't. I've been burned by multiple ip4r tests blocking ISPs, and have counterweighted those mail servers accordingly. That also means that I'm more likely to get spam. I'll also add that false positives in blacklisting has made content inspection much more important to me. Mail Sniffer from SortMonster.com helps me out a huge amount, and has taken away much of my burden for maintaining my own filter text files. A SURBL lookup like invIURIBL from invariantsystems.com or via spamassassin would certainly help out too (but I'm not there yet). Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, February 28, 2005 7:10 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] SpamCop listing AOL webmail servers http://www.spamcop.net/bl.shtml?205.188.139.132 WHY? (grumble mumble grumble ^%^$^*(^%^%^^) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamCop listing AOL webmail servers
I do the same. -d - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 28, 2005 2:02 PM Subject: Re: [Declude.JunkMail] SpamCop listing AOL webmail servers SpamCop and pretty well every other blacklisting service make no allowance for how much good mail is coming from an IP address. They only do blacklisting. I am not sure how many people actually do this, but I give a small weight back to the message if it was truely sent from an AOL MX. This helps when specific AOL servers get listed in Spamcop. To be honest I see very little spam sent directly from AOL servers. So this method of credit I have been doing has never been a real problem. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Junkmail Syntax
In the Junkmail file you have DELETE, HOLD, WARN, IGNORE. What does IGNORE actually do? Kyle
RE: [Declude.JunkMail] Junkmail Syntax
Looking at the log it doesn't seem that way. If you look at the header it shows the same. 02/28/2005 15:00:19 Q865e00e001301b5a nIPNOTINMX:-3 nNOLEGITCONTENT:-5 . Total weight = -8. 02/28/2005 15:00:19 Q865e00e001301b5a L1 Message OK 02/28/2005 15:00:19 Q865e00e001301b5a Subject: Read: [Fwd: FW: Applebees - don't delete - enjoy] 02/28/2005 15:00:19 Q865e00e001301b5a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 209.34.96.3 ID: 02/28/2005 15:00:19 Q865e00e001301b5a Tests failed [weight=-8]: CATCHALLMAILS=IGNORE 02/28/2005 15:00:19 Q865e00e001301b5a Last action = IGNORE. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 3:20 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Junkmail Syntax It will do nothing other than log an entry to your log. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Kyle Fisher writes: In the Junkmail file you have DELETE, HOLD, WARN, IGNORE. What does IGNORE actually do? Kyle --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Hi, I know that all the retry info is in the Q*.SMD file. Can someone answer a couple of things QC:\IMail\spool\Da13385c70072c6c1.SMD Hmail1.gonetworks.net Ia13385c70072c6c1 T34 E0, S[EMAIL PROTECTED] X1 V0 NRCPT TO: [EMAIL PROTECTED] R[EMAIL PROTECTED] I have figured out some of it but what is T34, E0, X1 and V0. From what I can see T34 is the retry number. Also how does IMail know when to rety the message? I have turned off Failed Domain Skipping. Where is the next retry time info kept? Is there a document that describes all this? Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Dan, Yes, you can adjust the retry times on the SMTP process tries before returning to sender and on the Queue Manager process retry time. Tries before returning to sender * retry = length of time you will attempt delivery of the mail. Hope that helps, Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Junkmail Syntax
The message's last action is IGNORE which means it will be delivered. What are the actions set on the two tests it hit on? If they are WARN then they will show in the headers. Darrell Kyle Fisher writes: Looking at the log it doesn't seem that way. If you look at the header it shows the same. 02/28/2005 15:00:19 Q865e00e001301b5a nIPNOTINMX:-3 nNOLEGITCONTENT:-5 . Total weight = -8. 02/28/2005 15:00:19 Q865e00e001301b5a L1 Message OK 02/28/2005 15:00:19 Q865e00e001301b5a Subject: Read: [Fwd: FW: Applebees - don't delete - enjoy] 02/28/2005 15:00:19 Q865e00e001301b5a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 209.34.96.3 ID: 02/28/2005 15:00:19 Q865e00e001301b5a Tests failed [weight=-8]: CATCHALLMAILS=IGNORE 02/28/2005 15:00:19 Q865e00e001301b5a Last action = IGNORE. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 3:20 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Junkmail Syntax It will do nothing other than log an entry to your log. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Kyle Fisher writes: In the Junkmail file you have DELETE, HOLD, WARN, IGNORE. What does IGNORE actually do? Kyle --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Here is a KB article that covers them http://support.ipswitch.com/kb/IM-20030324-DM01.htm Darrell Goran Jovanovic writes: Hi, I know that all the retry info is in the Q*.SMD file. Can someone answer a couple of things QC:\IMail\spool\Da13385c70072c6c1.SMD Hmail1.gonetworks.net Ia13385c70072c6c1 T34 E0, S[EMAIL PROTECTED] X1 V0 NRCPT TO: [EMAIL PROTECTED] R[EMAIL PROTECTED] I have figured out some of it but what is T34, E0, X1 and V0. From what I can see T34 is the retry number. Also how does IMail know when to rety the message? I have turned off Failed Domain Skipping. Where is the next retry time info kept? Is there a document that describes all this? Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Dan, Yes, you can adjust the retry times on the SMTP process tries before returning to sender and on the Queue Manager process retry time. Tries before returning to sender * retry = length of time you will attempt delivery of the mail. Hope that helps, Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Junkmail Syntax
Right now I am not hiding any tests. I have IPNOTINMX -3 and NOLEGITCONTENT -5 set to ignore (default when I purchased Declude). In the sample below you can see where it has a negative weight of 8 and the header shows the same, but they are set to ignore. I have more samples where it might have only failed sniffer (weight 8) and in the header it shows total weight 5 but you will see nolegitcontent in the header too. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 3:35 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Junkmail Syntax The message's last action is IGNORE which means it will be delivered. What are the actions set on the two tests it hit on? If they are WARN then they will show in the headers. Darrell Kyle Fisher writes: Looking at the log it doesn't seem that way. If you look at the header it shows the same. 02/28/2005 15:00:19 Q865e00e001301b5a nIPNOTINMX:-3 nNOLEGITCONTENT:-5 . Total weight = -8. 02/28/2005 15:00:19 Q865e00e001301b5a L1 Message OK 02/28/2005 15:00:19 Q865e00e001301b5a Subject: Read: [Fwd: FW: Applebees - don't delete - enjoy] 02/28/2005 15:00:19 Q865e00e001301b5a From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 209.34.96.3 ID: 02/28/2005 15:00:19 Q865e00e001301b5a Tests failed [weight=-8]: CATCHALLMAILS=IGNORE 02/28/2005 15:00:19 Q865e00e001301b5a Last action = IGNORE. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 3:20 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Junkmail Syntax It will do nothing other than log an entry to your log. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Kyle Fisher writes: In the Junkmail file you have DELETE, HOLD, WARN, IGNORE. What does IGNORE actually do? Kyle --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Thanx Darrell, The document does not cover how IMail knows when to retry, when does the 30 minute (or whatever) retry counter run out. Do you know where that info is? Does not seem to be in the Q file Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 4:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Here is a KB article that covers them http://support.ipswitch.com/kb/IM-20030324-DM01.htm Darrell Goran Jovanovic writes: Hi, I know that all the retry info is in the Q*.SMD file. Can someone answer a couple of things QC:\IMail\spool\Da13385c70072c6c1.SMD Hmail1.gonetworks.net Ia13385c70072c6c1 T34 E0, S[EMAIL PROTECTED] X1 V0 NRCPT TO: [EMAIL PROTECTED] R[EMAIL PROTECTED] I have figured out some of it but what is T34, E0, X1 and V0. From what I can see T34 is the retry number. Also how does IMail know when to rety the message? I have turned off Failed Domain Skipping. Where is the next retry time info kept? Is there a document that describes all this? Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Dan, Yes, you can adjust the retry times on the SMTP process tries before returning to sender and on the Queue Manager process retry time. Tries before returning to sender * retry = length of time you will attempt delivery of the mail. Hope that helps, Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
I believe that Imail doesn't keep a retry timer per message, but instead simply attempts to process every message in the queue at each queue run, which is every 30 min by default. If the T line equals the retry limit it creates a postmaster message and deletes the message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Monday, February 28, 2005 4:58 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Thanx Darrell, The document does not cover how IMail knows when to retry, when does the 30 minute (or whatever) retry counter run out. Do you know where that info is? Does not seem to be in the Q file Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 4:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Here is a KB article that covers them http://support.ipswitch.com/kb/IM-20030324-DM01.htm Darrell Goran Jovanovic writes: Hi, I know that all the retry info is in the Q*.SMD file. Can someone answer a couple of things QC:\IMail\spool\Da13385c70072c6c1.SMD Hmail1.gonetworks.net Ia13385c70072c6c1 T34 E0, S[EMAIL PROTECTED] X1 V0 NRCPT TO: [EMAIL PROTECTED] R[EMAIL PROTECTED] I have figured out some of it but what is T34, E0, X1 and V0. From what I can see T34 is the retry number. Also how does IMail know when to rety the message? I have turned off Failed Domain Skipping. Where is the next retry time info kept? Is there a document that describes all this? Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Dan, Yes, you can adjust the retry times on the SMTP process tries before returning to sender and on the Queue Manager process retry time. Tries before returning to sender * retry = length of time you will attempt delivery of the mail. Hope that helps, Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---
[Declude.JunkMail] May be forged in the headers??
Hi, I got this in a header and I do not understand what it means Received: from tdwems02.thindata.net [64.34.54.13] by mail1.gonetworks.net with ESMTP (SMTPD32-8.13) id A66F76C90074; Mon, 28 Feb 2005 16:00:31 -0500 Received: from TDWCON01 (tdwcon01.thindata.net [64.34.54.8] (may be forged)) by tdwems02.thindata.net (8.12.8/8.12.8) with ESMTP id j1SKxErl024527 for [EMAIL PROTECTED]; Mon, 28 Feb 2005 16:00:30 -0500 What does the (may be forged) mean? If I look up the REVDNS record I get this Answer: 64.34.54.8 PTR record: tdwcon01.thindata.net. [TTL 14400s] [A=64.34.54.8] This is the same as what is reported. Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry
Ahh so every Q*.SMD is attempted to be reprocessed at the Queue run time. Well that makes it easier on the programming. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Monday, February 28, 2005 5:08 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry I believe that Imail doesn't keep a retry timer per message, but instead simply attempts to process every message in the queue at each queue run, which is every 30 min by default. If the T line equals the retry limit it creates a postmaster message and deletes the message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Monday, February 28, 2005 4:58 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Thanx Darrell, The document does not cover how IMail knows when to retry, when does the 30 minute (or whatever) retry counter run out. Do you know where that info is? Does not seem to be in the Q file Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 4:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Here is a KB article that covers them http://support.ipswitch.com/kb/IM-20030324-DM01.htm Darrell Goran Jovanovic writes: Hi, I know that all the retry info is in the Q*.SMD file. Can someone answer a couple of things QC:\IMail\spool\Da13385c70072c6c1.SMD Hmail1.gonetworks.net Ia13385c70072c6c1 T34 E0, S[EMAIL PROTECTED] X1 V0 NRCPT TO: [EMAIL PROTECTED] R[EMAIL PROTECTED] I have figured out some of it but what is T34, E0, X1 and V0. From what I can see T34 is the retry number. Also how does IMail know when to rety the message? I have turned off Failed Domain Skipping. Where is the next retry time info kept? Is there a document that describes all this? Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Monday, February 28, 2005 1:29 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Lengthening Time for Store and Forward Retry Dan, Yes, you can adjust the retry times on the SMTP process tries before returning to sender and on the Queue Manager process retry time. Tries before returning to sender * retry = length of time you will attempt delivery of the mail. Hope that helps, Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I had a question about IMail. We do store and forward spam filtering for a lot of customers. If a customer's incoming SMTP server is down, e.g. because of a power outage, IMail will only try 20 times before returning the messages to the sender. This equates to about 10 hours. Is there any way to lengthen the amount of time or number of retries that IMail will attempt to resend Store and Forwarded e-mail? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at
