[Declude.JunkMail] Why did this fail reverse DNS
Title: Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject: RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is: 10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US] 163.160.73.24.in-addr.arpa mail.cruzaninc.com. Thanks, Sharyn
Re: [Declude.JunkMail] Why did this fail reverse DNS
Title: Why did this fail reverse DNS Hi Sharyn, How is DNS configured on your server? Are you using upstream DNS servers that are suddenly not resolving? We've had that problem in the past, and resolved it by not using forwarders to provider DNS servers in our local DNS server on the IMail server. If you use WHITELIST AUTH in your Global.cfg, you can eliminate a lot of these problems as well, like CMDSPACE that MS mail clients fail. With that setting, all users who authenticate when sending will be whitelisted. Darin. - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:27 PM Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject: RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is:10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US]163.160.73.24.in-addr.arpa mail.cruzaninc.com. Thanks, Sharyn
RE: [Declude.JunkMail] Why did this fail reverse DNS
Sharyn, 1. What is the test you have defined for 10-REVDNS ? 2. Do you have WHITELIST AUTH enabled in your global.cfg ? David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt Sent: Wednesday, September 07, 2005 12:28 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject:RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is: 10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US] 163.160.73.24.in-addr.arpa mail.cruzaninc.com. http://www.dnsstuff.com/tools/ptr.ch?ip=24.73.160.163 Thanks, Sharyn --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Why did this fail reverse DNS
Title: Message Hi Darin, Thanks for the response. I host my own primary nameserver here, which is also the same box as my IMAIL server. There is no upstream DNS server involved. That's what has me so puzzled on this. I have relay set only for IP addresses, my users don't authenticate. In order for them to send mail, they must be VPN'd in and receive an IP address that is reserved for VPN clients only. (Long story on this) In this case, I don't believe Whitelist Auth will work, unless it can be based on IP addresses, rather than user authentication. Sharyn -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Wednesday, September 07, 2005 12:38 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Why did this fail reverse DNS Hi Sharyn, How is DNS configured on your server? Are you using upstream DNS servers that are suddenly not resolving? We've had that problem in the past, and resolved it by not using forwarders to provider DNS servers in our local DNS server on the IMail server. If you use WHITELIST AUTH in your Global.cfg, you can eliminate a lot of these problems as well, like CMDSPACE that MS mail clients fail. With that setting, all users who authenticate when sending will be whitelisted. Darin. - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:27 PM Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject: RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is:10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US]163.160.73.24.in-addr.arpa mail.cruzaninc.com. Thanks, Sharyn
RE: [Declude.JunkMail] Why did this fail reverse DNS
Hi David, The 10 is a combination of all those failed tests. I have this set up so even if my users fail tests like cmdspace and those others, they should still come in under Weight 10. It's the revdns that put this particular user over the top, and he shouldn't have failed it. This has been running fine for a really long time so I'm just puzzled as to what could've changed. My firewall prevents users from authenticating (done purposely, long story)I relay by IP address only. Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, September 07, 2005 12:40 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Why did this fail reverse DNS Sharyn, 1. What is the test you have defined for 10-REVDNS ? 2. Do you have WHITELIST AUTH enabled in your global.cfg ? David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt Sent: Wednesday, September 07, 2005 12:28 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject:RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is: 10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US] 163.160.73.24.in-addr.arpa mail.cruzaninc.com. http://www.dnsstuff.com/tools/ptr.ch?ip=24.73.160.163 Thanks, Sharyn --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why did this fail reverse DNS
Title: Message Can you do a reverse lookup on your domain from the server? Instead of WHITELIST AUTH, you might whitelist (or negative weight) by IP using an ipfile test. That would allow all mail from your users to go through without filtering. Darin. - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:46 PM Subject: RE: [Declude.JunkMail] Why did this fail reverse DNS Hi Darin, Thanks for the response. I host my own primary nameserver here, which is also the same box as my IMAIL server. There is no upstream DNS server involved. That's what has me so puzzled on this. I have relay set only for IP addresses, my users don't authenticate. In order for them to send mail, they must be VPN'd in and receive an IP address that is reserved for VPN clients only. (Long story on this) In this case, I don't believe Whitelist Auth will work, unless it can be based on IP addresses, rather than user authentication. Sharyn -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Wednesday, September 07, 2005 12:38 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Why did this fail reverse DNS Hi Sharyn, How is DNS configured on your server? Are you using upstream DNS servers that are suddenly not resolving? We've had that problem in the past, and resolved it by not using forwarders to provider DNS servers in our local DNS server on the IMail server. If you use WHITELIST AUTH in your Global.cfg, you can eliminate a lot of these problems as well, like CMDSPACE that MS mail clients fail. With that setting, all users who authenticate when sending will be whitelisted. Darin. - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:27 PM Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject: RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is:10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US]163.160.73.24.in-addr.arpa mail.cruzaninc.com. Thanks, Sharyn
RE: [Declude.JunkMail] Why did this fail reverse DNS
Title: Message I like the whitelist IP idea. Got an example of the syntax? At the moment, I have so few addresses whitelisted that I don't use a from file, I just have them listed straight in the global config. Hmm..can I just do that, by subnet? You know, it just occured to me that authority for the reverse zone is hosted on my ISP's nameserver. My server is only authoritative for the forward zone. (like you suggested earlier, been a long week already) An issue on their end would've caused this, correct? Sharyn -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Wednesday, September 07, 2005 12:52 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Why did this fail reverse DNS Can you do a reverse lookup on your domain from the server? Instead of WHITELIST AUTH, you might whitelist (or negative weight) by IP using an ipfile test. That would allow all mail from your users to go through without filtering. Darin. - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:46 PM Subject: RE: [Declude.JunkMail] Why did this fail reverse DNS Hi Darin, Thanks for the response. I host my own primary nameserver here, which is also the same box as my IMAIL server. There is no upstream DNS server involved. That's what has me so puzzled on this. I have relay set only for IP addresses, my users don't authenticate. In order for them to send mail, they must be VPN'd in and receive an IP address that is reserved for VPN clients only. (Long story on this) In this case, I don't believe Whitelist Auth will work, unless it can be based on IP addresses, rather than user authentication. Sharyn -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Wednesday, September 07, 2005 12:38 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Why did this fail reverse DNS Hi Sharyn, How is DNS configured on your server? Are you using upstream DNS servers that are suddenly not resolving? We've had that problem in the past, and resolved it by not using forwarders to provider DNS servers in our local DNS server on the IMail server. If you use WHITELIST AUTH in your Global.cfg, you can eliminate a lot of these problems as well, like CMDSPACE that MS mail clients fail. With that setting, all users who authenticate when sending will be whitelisted. Darin. - Original Message - From: Sharyn Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:27 PM Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject: RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is:10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US]163.160.73.24.in-addr.arpa mail.cruzaninc.com. Thanks, Sharyn
Re: [Declude.JunkMail] Why did this fail reverse DNS
In your global.cfg you can add an entry like WHITELIST IP 10.0.0.0/27 WHITELIST IP 1.1.1.1 Or you can create a ipfile filter and do negative weight. My personal preference is to whitelist as a last resort. My preference in order is to correct the main issue at hand, than reverse weight by dns, than ip, than whitelist. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Sharyn Schmidt writes: I like the whitelist IP idea. Got an example of the syntax? At the moment, I have so few addresses whitelisted that I don't use a from file, I just have them listed straight in the global config. Hmm..can I just do that, by subnet? You know, it just occured to me that authority for the reverse zone is hosted on my ISP's nameserver. My server is only authoritative for the forward zone. (like you suggested earlier, been a long week already) An issue on their end would've caused this, correct? Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, September 07, 2005 12:52 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Why did this fail reverse DNS Can you do a reverse lookup on your domain from the server? Instead of WHITELIST AUTH, you might whitelist (or negative weight) by IP using an ipfile test. That would allow all mail from your users to go through without filtering. Darin. - Original Message - From: Sharyn mailto:[EMAIL PROTECTED] Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:46 PM Subject: RE: [Declude.JunkMail] Why did this fail reverse DNS Hi Darin, Thanks for the response. I host my own primary nameserver here, which is also the same box as my IMAIL server. There is no upstream DNS server involved. That's what has me so puzzled on this. I have relay set only for IP addresses, my users don't authenticate. In order for them to send mail, they must be VPN'd in and receive an IP address that is reserved for VPN clients only. (Long story on this) In this case, I don't believe Whitelist Auth will work, unless it can be based on IP addresses, rather than user authentication. Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, September 07, 2005 12:38 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Why did this fail reverse DNS Hi Sharyn, How is DNS configured on your server? Are you using upstream DNS servers that are suddenly not resolving? We've had that problem in the past, and resolved it by not using forwarders to provider DNS servers in our local DNS server on the IMail server. If you use WHITELIST AUTH in your Global.cfg, you can eliminate a lot of these problems as well, like CMDSPACE that MS mail clients fail. With that setting, all users who authenticate when sending will be whitelisted. Darin. - Original Message - From: Sharyn mailto:[EMAIL PROTECTED] Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:27 PM Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject:RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is: 10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US] 163.160.73.24.in-addr.arpa http://www.dnsstuff.com/tools/ptr.ch?ip=24.73.160.163 mail.cruzaninc.com. Thanks, Sharyn --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Why did this fail reverse DNS
Thanks for your help! Sharyn --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why did this fail reverse DNS
Agreed. Negative weighting is generally considered better than whitelisting outright. In your case it may not matter, but may be subject to spoofing. Also, abuse by your users that you may want to be aware of could go straight through with whitelisting, whereas it could still be filtered with a negative weight scenario instead. Darin. - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 1:12 PM Subject: Re: [Declude.JunkMail] Why did this fail reverse DNS In your global.cfg you can add an entry like WHITELIST IP 10.0.0.0/27 WHITELIST IP 1.1.1.1 Or you can create a ipfile filter and do negative weight. My personal preference is to whitelist as a last resort. My preference in order is to correct the main issue at hand, than reverse weight by dns, than ip, than whitelist. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Sharyn Schmidt writes: I like the whitelist IP idea. Got an example of the syntax? At the moment, I have so few addresses whitelisted that I don't use a from file, I just have them listed straight in the global config. Hmm..can I just do that, by subnet? You know, it just occured to me that authority for the reverse zone is hosted on my ISP's nameserver. My server is only authoritative for the forward zone. (like you suggested earlier, been a long week already) An issue on their end would've caused this, correct? Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, September 07, 2005 12:52 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Why did this fail reverse DNS Can you do a reverse lookup on your domain from the server? Instead of WHITELIST AUTH, you might whitelist (or negative weight) by IP using an ipfile test. That would allow all mail from your users to go through without filtering. Darin. - Original Message - From: Sharyn mailto:[EMAIL PROTECTED] Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:46 PM Subject: RE: [Declude.JunkMail] Why did this fail reverse DNS Hi Darin, Thanks for the response. I host my own primary nameserver here, which is also the same box as my IMAIL server. There is no upstream DNS server involved. That's what has me so puzzled on this. I have relay set only for IP addresses, my users don't authenticate. In order for them to send mail, they must be VPN'd in and receive an IP address that is reserved for VPN clients only. (Long story on this) In this case, I don't believe Whitelist Auth will work, unless it can be based on IP addresses, rather than user authentication. Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, September 07, 2005 12:38 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Why did this fail reverse DNS Hi Sharyn, How is DNS configured on your server? Are you using upstream DNS servers that are suddenly not resolving? We've had that problem in the past, and resolved it by not using forwarders to provider DNS servers in our local DNS server on the IMail server. If you use WHITELIST AUTH in your Global.cfg, you can eliminate a lot of these problems as well, like CMDSPACE that MS mail clients fail. With that setting, all users who authenticate when sending will be whitelisted. Darin. - Original Message - From: Sharyn mailto:[EMAIL PROTECTED] Schmidt To: Declude.JunkMail@declude.com Sent: Wednesday, September 07, 2005 12:27 PM Subject: [Declude.JunkMail] Why did this fail reverse DNS Good afternoon, Something really odd is going on here. All of a sudden, my own users are failing tests that they were passing last month. Here is the spam attachment that Declude adds to our emails, if the weight is 10. You **MAY** have spam! Subject:RE: Shakka Applebees -- Beverage Optimization Initiative -District Test **URGENT MESSAGE** From: [EMAIL PROTECTED] Tests Failed: 10-REVDNS, CMDSPACE, SUBJECTSPACES, SUBJECTCHARS, WEIGHT10-D02010098024AB4E6.SMD [EMAIL PROTECTED] is one of MY users. Why in the world did this fail revdns? According to DNS report: Your 1 MX record is: 10 mail.cruzaninc.com. [TTL=3600] IP=24.73.160.163 [TTL=3600] [US] 163.160.73.24.in-addr.arpa http://www.dnsstuff.com/tools/ptr.ch?ip=24.73.160.163 mail.cruzaninc.com. Thanks, Sharyn --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is there any hope running Declude with imail 8.21???
I really don't want to downgrade imail, but spam and viruses are getting through. Any hope for having declude working with imail 8.21 any time soon? Thanks __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is there any hope running Declude with imail 8.21???
Declude Beta 3.0 is available which works with Imail 8.20+ if you have a valid service agreement this can be downloaded from our website from the My Account Home Page when you log in. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Timothy Bohen Sent: Wednesday, September 07, 2005 2:36 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Is there any hope running Declude with imail 8.21??? I really don't want to downgrade imail, but spam and viruses are getting through. Any hope for having declude working with imail 8.21 any time soon? Thanks __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is there any hope running Declude with imail 8.21???
I gave up and downgraded to 8.15 now I'm getting: 09:07 15:08 SMTPD(CP) error 3 executing c:\imail\Declude.exe D:\IMAIL\spool\Q3ab90041008c0e76.SM What should I try? Running Declude 2.0.5 -- Original Message -- From: Timothy Bohen [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Wed, 7 Sep 2005 14:35:48 -0400 I really don't want to downgrade imail, but spam and viruses are getting through. Any hope for having declude working with imail 8.21 any time soon? Thanks __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT - iMail 7.x and Windows 2003
We are about to build a new server using Windows 2003. The reason is that we were apparently attacked through the iMail IMAPI exploit. The last of whatever got in seems to be running in a very effective stealth mode because nothing seems to be able to find it and kill it. As a consequence, our sever reboots anywhere from every 10 minutes to every 45 minutes. So = new server. We have been running iMail 7.07 under windows 2000. We had some input that there may be some problems in this environment. We are not keen on upgrading to 8.x since IPSwitch is walking away from iMail the product. Can anyone comment on this possible incompatibility? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is there any hope running Declude with imail 8.21???
Tim, I have never seen that error, but I would recommend downloading 2.0.16 from their site. It fixes bugs from 2.0.6 and I don't believe that it introduces any new ones. It might also make sense to check to see that you have a declude.exe in the IMail directory, and Declude's configuration files in a Declude directory below it. Matt Timothy Bohen wrote: I gave up and downgraded to 8.15 now I'm getting: 09:07 15:08 SMTPD(CP) error 3 executing "c:\imail\Declude.exe" "D:\IMAIL\spool\Q3ab90041008c0e76.SM What should I try? Running Declude 2.0.5 -- Original Message -- From: "Timothy Bohen" [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Wed, 7 Sep 2005 14:35:48 -0400 I really don't want to downgrade imail, but spam and viruses are getting through. Any hope for having declude working with imail 8.21 any time soon? Thanks __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Is there any hope running Declude with IMail 8.21???
I am running Declude 2.0.14 consistently on my Imail 8.21 server with no problems that would allow viruses and spam to get through. Granted, my server only has a volume of about 5K per day. I am going to being running the betas as soon as I can get to that. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Timothy Bohen Sent: Wednesday, September 07, 2005 11:36 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Is there any hope running Declude with imail 8.21??? I really don't want to downgrade imail, but spam and viruses are getting through. Any hope for having declude working with imail 8.21 any time soon? Thanks __ __ __ __ Sent via the CMS Internet Webmail system at mail1.cmsinter.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT - iMail 7.x and Windows 2003
We have been running iMail 7.07 under windows 2000. We had some input that there may be some problems in this environment. We are not keen on upgrading to 8.x since IPSwitch is walking away from iMail the product. Ipswitch is not walking away from Imail. It is still alive and well, and in fact continues to be improved and upgraded. The next version is in active beta as we speak. The only thing that has happened is Ipswitch no longer sells Imail as a stand alone product. SA are still available for it. John T eServices For You --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT - iMail 7.x and Windows 2003
I think that the exploit is in imail 7.07 and not in your server do a google on imail 7.07 exploit. So you most likely would need to upgrade to 8.2 series. Tho the exploit isn't in 8.15 I don't believe. BTW they do seem to have some interesting pricing going on if you google imail deals depending on your number of domains and users. At 12:43 PM 9/7/2005 -0700, you wrote: We are about to build a new server using Windows 2003. The reason is that we were apparently attacked through the iMail IMAPI exploit. The last of whatever got in seems to be running in a very effective stealth mode because nothing seems to be able to find it and kill it. As a consequence, our sever reboots anywhere from every 10 minutes to every 45 minutes. So = new server. We have been running iMail 7.07 under windows 2000. We had some input that there may be some problems in this environment. We are not keen on upgrading to 8.x since IPSwitch is walking away from iMail the product. Can anyone comment on this possible incompatibility? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by F-Prot] [This E-mail scanned for viruses by F-Prot] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT - iMail 7.x and Windows 2003
At 01:43 PM 9/7/2005, Ncl Admin wrote: I think that the exploit is in imail 7.07 and not in your server do a google on imail 7.07 exploit. OK, I see it. The question is how do you KILL the stuff that has gotten into the server? We shut down the IMAP yesterday primarily because we really don't have anyone we are aware of who does not use POP3. But the problem persists and seems to avoid every attempt to find it. I see a lot of code on the examples of how they are using the exploit. I am afraid it does not mean a lot to me and my brain is too tired to try to make any sense of this and figure out how to catch it. Surely someone has found a solution. My guess is they have been able to plant something they are now using against us. According to the tech if he disconnects the server from the network, the problem stops. It is only when the cable is hooked up that it starts in again. I suppose if it is coming in on a specific IP address we could disconnect them all and then add them back one at a time until we find the one they are coming in on, but that sounds like a LOT of work. Is there some other way to find this? Right now we have a lot of unhappy clients. So you most likely would need to upgrade to 8.2 series. Tho the exploit isn't in 8.15 I don't believe. BTW they do seem to have some interesting pricing going on if you google imail deals depending on your number of domains and users. At 12:43 PM 9/7/2005 -0700, you wrote: We are about to build a new server using Windows 2003. The reason is that we were apparently attacked through the iMail IMAPI exploit. The last of whatever got in seems to be running in a very effective stealth mode because nothing seems to be able to find it and kill it. As a consequence, our sever reboots anywhere from every 10 minutes to every 45 minutes. So = new server. We have been running iMail 7.07 under windows 2000. We had some input that there may be some problems in this environment. We are not keen on upgrading to 8.x since IPSwitch is walking away from iMail the product. Can anyone comment on this possible incompatibility? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by F-Prot] [This E-mail scanned for viruses by F-Prot] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT - iMail 7.x and Windows 2003
Start with TCPView From sysinternals to view open ports on the server find the ports and programs that should not be running and kill then remove them from the system. Also use Process Explorer from sysinternals and look at all the running processes. If you find one that does not belong then kill and remove it. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Orin Wells Sent: Wednesday, September 07, 2005 3:32 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT - iMail 7.x and Windows 2003 At 01:43 PM 9/7/2005, Ncl Admin wrote: I think that the exploit is in imail 7.07 and not in your server do a google on imail 7.07 exploit. OK, I see it. The question is how do you KILL the stuff that has gotten into the server? We shut down the IMAP yesterday primarily because we really don't have anyone we are aware of who does not use POP3. But the problem persists and seems to avoid every attempt to find it. I see a lot of code on the examples of how they are using the exploit. I am afraid it does not mean a lot to me and my brain is too tired to try to make any sense of this and figure out how to catch it. Surely someone has found a solution. My guess is they have been able to plant something they are now using against us. According to the tech if he disconnects the server from the network, the problem stops. It is only when the cable is hooked up that it starts in again. I suppose if it is coming in on a specific IP address we could disconnect them all and then add them back one at a time until we find the one they are coming in on, but that sounds like a LOT of work. Is there some other way to find this? Right now we have a lot of unhappy clients. So you most likely would need to upgrade to 8.2 series. Tho the exploit isn't in 8.15 I don't believe. BTW they do seem to have some interesting pricing going on if you google imail deals depending on your number of domains and users. At 12:43 PM 9/7/2005 -0700, you wrote: We are about to build a new server using Windows 2003. The reason is that we were apparently attacked through the iMail IMAPI exploit. The last of whatever got in seems to be running in a very effective stealth mode because nothing seems to be able to find it and kill it. As a consequence, our sever reboots anywhere from every 10 minutes to every 45 minutes. So = new server. We have been running iMail 7.07 under windows 2000. We had some input that there may be some problems in this environment. We are not keen on upgrading to 8.x since IPSwitch is walking away from iMail the product. Can anyone comment on this possible incompatibility? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by F-Prot] [This E-mail scanned for viruses by F-Prot] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is there any hope running Declude with imail 8.21???
I gave up and downgraded to 8.15 now I'm getting: 09:07 15:08 SMTPD(CP) error 3 executing c:\imail\Declude.exe D:\IMAIL\spool\Q3ab90041008c0e76.SMD It looks like you set up Declude to run in C:\IMail, but you run IMail on D:\IMail. :) -Scott --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weights not properly adding up?
I've noticed that on many messages lately, a message's failed tests weights do not correspond to the weights I have in my global.cfg file. For example, these are from the X-SPAM-TESTS-FAILED line of four different messages: SORBS-DUHL, CMDSPACE [7] - should be 12 CMDSPACE [3] - should be 8 SNIFFER [9] - should be 12 SPAMCOP, SNIFFER, WEIGHT10 [16] - should be 19 This is from my global.cfg file: SPAMCOPip4rbl.spamcop.net127.0.0.270 SORBS-DUHLip4rdnsbl.sorbs.net127.0.0.1040 CMDSPACEcmdspacexx80 SNIFFERexternalnonzero C:\IMail\Sniffer\xx.exe x120 Any ideas why they aren't adding up? I don't see other tests that can decrease the weight like NOLEGITCONTENT or IPNOTINMX. Thanks --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weights not properly adding up?
Kevin, In a standard setup, when you don't see NOLEGITCONTENT or IPNOTINMX in the failed tests shown in the headers, that means that they did credit weight. It causes a lot of confusion until people figure this out. Just convince yourself that this is the case and move forward on that assumption. You can verify this in your logs. Matt Kevin Rogers wrote: I've noticed that on many messages lately, a message's failed tests weights do not correspond to the weights I have in my global.cfg file. For example, these are from the X-SPAM-TESTS-FAILED line of four different messages: SORBS-DUHL, CMDSPACE [7] - should be 12 CMDSPACE [3] - should be 8 SNIFFER [9] - should be 12 SPAMCOP, SNIFFER, WEIGHT10 [16] - should be 19 This is from my global.cfg file: SPAMCOPip4rbl.spamcop.net127.0.0.270 SORBS-DUHLip4rdnsbl.sorbs.net127.0.0.1040 CMDSPACEcmdspacexx80 SNIFFERexternalnonzero C:\IMail\Sniffer\xx.exe x120 Any ideas why they aren't adding up? I don't see other tests that can decrease the weight like NOLEGITCONTENT or IPNOTINMX. Thanks --- [This E-mail was scanned for viruses.] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPFPass - good or bad?
I've noticed a bunch of spam with SPFPass grades that have negated the spam databases (I have SPFPass at -5) ... is anyone finding that SPFPass is working with spammers using legitimate ISP's? david - Internet Dental Forum www.internetdentalforum.org Dentalcast Podcast www.dentalcast.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPFPass - good or bad?
We only use SPFFAIL and add weight. We stay away from negative weighting. SPFPASS just means that the senderdomain is coming from an approved mail server. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Dodell Sent: Wednesday, September 07, 2005 10:28 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SPFPass - good or bad? I've noticed a bunch of spam with SPFPass grades that have negated the spam databases (I have SPFPass at -5) ... is anyone finding that SPFPass is working with spammers using legitimate ISP's? david - Internet Dental Forum www.internetdentalforum.org Dentalcast Podcast www.dentalcast.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
