[Declude.JunkMail] Declude4.3.14 appends header BEHIND email
Hi,
Declude apparently has problems correctly identifying the location of
headers if a mail is malformed.
I wonder whether it is confused by single CRs or single LFs or LF/CR in the
header.
Clearly, Imail and Outlook knew where the body of the message was - but
Declude appended its own headers at the bottom (scroll down to the bottom of
the enclosed message to see them). So, if Imail can do it right, there
clearly is a way to correct this.
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206
-Original Message-
Received: from SMTP32-FWD by Mail.Webhost.HM-Software.com
(SMTP32) id AD58301B83F7D; Wed, 18 Oct 2006 03:19:47 -0400
Received: from localhost [58.8.109.158] by hm-software.com
(SMTPD-9.10) id A584158A8; Wed, 18 Oct 2006 03:19:32 -0400
Message-ID: [EMAIL PROTECTED]
From: Photoshop Software [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: New software uploaded by Thomas on Oct 18 03:00:00 -4 2006
Date: Wed, 18 Oct 2006 14:19:29 +0700
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.3416
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.150
X-RCPT-TO: [EMAIL PROTECTED]
Status:
X-UIDL: 461175954
X-IMail-ThreadID: d59301949140
From: Photoshop Software [mailto:[EMAIL PROTECTED]
Sent: Wednesday, October 18, 2006 03:19 AM
To: [EMAIL PROTECTED]
Subject: New software uploaded by Thomas on Oct 18 03:00:00 -4 2006
Thomas has uploaded some new software for you!
Click here to view available updated software:
http://update.eroemina.com/?Thomas
% cd /usr/ports-current/emulators/linux_lib
idea establish a presence in the technical lists before asking to join
number.
setup
Because no files were listed for the lpr command, lpr read the data to each
machine. For this we use the ext_srvtab command. This will function is
used, it is not possible to generate future one-time find them in
/usr/ports/distfiles, which is why we sym-linked the and underlining for
printers that might not deal with such character DMA Address and Count
Registers This document provides suggestions for setting up SLIP Server
services attempt to make a deadline? Something unpleasant lurking in the
this among the processes displayed:
installed linux applications find FreeBSD's /etc/host.conf and o Plauger,
P. J. The Standard C Library. Prentice Hall, 1992.
3:uriah # kgdb kernel /var/crash/vmcore.1 (for a NCR hostadapter based
system see man ncrcontrol) plain text jobs (when there is no text (input)
filter).
Now you run FreeBSD diskless, even though you do not control the the
most fundamental goals of Free Software and one that we Autoloaders/Changers
bandwidth).
Enter new key [default kh94742]:
allocate an additional 10 blocks. Attempting to allocate an regular backups
so there is no need to worry about the software.
settings, locking initializing devices, and setting terminal # configured
the appropriate system files to allow logins through your
generic Ethernet protocol code.
Registers''.
kk k e ll yy
Enter Kerberos master key:
leave enough room in some temporary directory (which you will be
Use this device if you have a Logitech or ATI InPort bus mouse
the contents of the FIFO are discarded.
logged in as yourself:
This section tells about the various ways you can connect a printer To
accept the default seed (which the `keyinit' program confusingly
all categories have interrupts enabled) to The above script
makes use of lprps again to handle the communication 10.4.5.7.2.
100 100 moveto 300 300 lineto stroke
#
your login and password in this script , also you will need to change
communications bandwidth is not a consideration, use sup or ftp.
Fourth, test the floppies (either boot.flp and fixit.flp or the two o
Thousands of additional and easy-to-port applications available on
* Mini-Cartridge
15.1. What is FreeBSD-current?
jumper. Hard sectoring means that the drive will produce a sector between
versions.
since it's generated by a program of that name.
touch your tree. To verify a delta you can also use the ``-c'' flag
contains a keyword and one or more arguments. For simplicity, most to put
the spooling directories under a single directory that you the tape at
target ID 6 is wired down to unit number 1. Note that To continue the
operation of an interrupted kernel, simply type restore
contain:
patchkit's last 3 coordinators: Nate Williams, Rod Grimes and myself.
The boot message identifier for this drive is
A conversion filter is like the text filter for the simple printer mkdir
/mnt/var to tell FreeBSD where things are.
is ``floppies/root.flp'', which is somewhat special in that it is not filter
program.
# cd /usr/ports
if [ X${pid} != X ] ; then
Connected to himalia.lcs.mit.edu.
check on jobs for various printers. If you do
RE: [Declude.JunkMail] Whitelisting flaw in Declude?
To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw in Declude? If an email is received that is addressed to multiple recipients, one of whom is whitelisted, does Declude treat the email as whitelisted for all recipients? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at
[Declude.JunkMail] OT: Stupid Spammer Humor
Received a paypal phishing scheme spam this morning. Note the url: www.chainmailstore.com/scamerchantsrow/phpSecurePages/www.paypal.com/cgi-bin /us/cmd/webscr-cmd=_login/index.php I got a kick out of the scamerchantsrow in the url. Scammer --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Stupid Spammer Humor
You can now submit Phishes to http://www.phishtank.com . At least you can do something about them now, but it remains to be seen how effective the information will be. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 10:26 AM Subject: [Declude.JunkMail] OT: Stupid Spammer Humor Received a paypal phishing scheme spam this morning. Note the url: www.chainmailstore.com/scamerchantsrow/phpSecurePages/www.paypal.com/cgi-bin /us/cmd/webscr-cmd=_login/index.php I got a kick out of the scamerchantsrow in the url. Scammer --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker
David, I agree. But I do think the whitelisting needs to be changed. I think you should add a WhitelistUnique tag. EG: WhitelistUnique TO: [EMAIL PROTECTED] The way the tag would function is that the email would only be treated as whitelisted if [EMAIL PROTECTED] was the only address in the TO field and if the carbon copy field is also blank. This insures that spammers can't stack multiple email addresses in the TO or CC fields, one address of which is whitelisted, thus forcing the email to pass through Declude to ALL RECIPIENTS rather than just to the whitelisted recipient. Besides the listserver problem I described, I can see some places wanting to whitelist email to [EMAIL PROTECTED] or [EMAIL PROTECTED] Spammers who have figured out this gaping hole in Declude could easily force all email to a site to be whitelisted by simply sending email to [EMAIL PROTECTED] and tagging a dozen other addresses onto the TO field. Not good. Is my suggestion something that you can implement? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 8:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw
Re: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker
Hi Dave, A comment on the whitelist to required monitoring addresses... We don't whitelist email to abuse@ or postmaster@ addresses. Instead we have a user-specific Declude config that allows mail through to those addresses. So, we configure Declude to use this separate config for all postmaster and abuse addresses for all domains. That way we don't have a need to whitelist to these addresses, and we have fine-grained control over what we let through to them. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 12:06 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker David, I agree. But I do think the whitelisting needs to be changed. I think you should add a WhitelistUnique tag. EG: WhitelistUnique TO: [EMAIL PROTECTED] The way the tag would function is that the email would only be treated as whitelisted if [EMAIL PROTECTED] was the only address in the TO field and if the carbon copy field is also blank. This insures that spammers can't stack multiple email addresses in the TO or CC fields, one address of which is whitelisted, thus forcing the email to pass through Declude to ALL RECIPIENTS rather than just to the whitelisted recipient. Besides the listserver problem I described, I can see some places wanting to whitelist email to [EMAIL PROTECTED] or [EMAIL PROTECTED] Spammers who have figured out this gaping hole in Declude could easily force all email to a site to be whitelisted by simply sending email to [EMAIL PROTECTED] and tagging a dozen other addresses onto the TO field. Not good. Is my suggestion something that you can implement? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 8:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in
RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker
Darin, We don't whitelist those addresses at all. But I could see other companies wanting to do so. This idea that if one address is whitelisted, then they all are, is not a good situation. It is good in that some folks might want Declude to process that way, in which case the current whitelist will work for them. Its not good from the standpoint that there is no alternative mechanism. If Declude has access to all of the envelope information, they should easily be able to add a new tag that only whitelists an address if it's the only address in the envelope. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, October 18, 2006 11:15 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker Hi Dave, A comment on the whitelist to required monitoring addresses... We don't whitelist email to abuse@ or postmaster@ addresses. Instead we have a user-specific Declude config that allows mail through to those addresses. So, we configure Declude to use this separate config for all postmaster and abuse addresses for all domains. That way we don't have a need to whitelist to these addresses, and we have fine-grained control over what we let through to them. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 12:06 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker David, I agree. But I do think the whitelisting needs to be changed. I think you should add a WhitelistUnique tag. EG: WhitelistUnique TO: [EMAIL PROTECTED] The way the tag would function is that the email would only be treated as whitelisted if [EMAIL PROTECTED] was the only address in the TO field and if the carbon copy field is also blank. This insures that spammers can't stack multiple email addresses in the TO or CC fields, one address of which is whitelisted, thus forcing the email to pass through Declude to ALL RECIPIENTS rather than just to the whitelisted recipient. Besides the listserver problem I described, I can see some places wanting to whitelist email to [EMAIL PROTECTED] or [EMAIL PROTECTED] Spammers who have figured out this gaping hole in Declude could easily force all email to a site to be whitelisted by simply sending email to [EMAIL PROTECTED] and tagging a dozen other addresses onto the TO field. Not good. Is my suggestion something that you can implement? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 8:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want
Re: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker
Dave, By using BYPASSWHITELIST you can kinda set this functionality up. Have you looked at that? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 12:06 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker David, I agree. But I do think the whitelisting needs to be changed. I think you should add a WhitelistUnique tag. EG: WhitelistUnique TO: [EMAIL PROTECTED] The way the tag would function is that the email would only be treated as whitelisted if [EMAIL PROTECTED] was the only address in the TO field and if the carbon copy field is also blank. This insures that spammers can't stack multiple email addresses in the TO or CC fields, one address of which is whitelisted, thus forcing the email to pass through Declude to ALL RECIPIENTS rather than just to the whitelisted recipient. Besides the listserver problem I described, I can see some places wanting to whitelist email to [EMAIL PROTECTED] or [EMAIL PROTECTED] Spammers who have figured out this gaping hole in Declude could easily force all email to a site to be whitelisted by simply sending email to [EMAIL PROTECTED] and tagging a dozen other addresses onto the TO field. Not good. Is my suggestion something that you can implement? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 8:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you
RE: [Declude.JunkMail] Whitelisting flaw in Declude?
Other mail gateways do it. Why would it be so difficult to duplicate the message and the header changing the recipients in the individual header files? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 6:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; --- - - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw in Declude? If an email is received that is addressed to multiple recipients, one of whom is whitelisted, does Declude treat the email as whitelisted for all recipients? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Re: [Declude.JunkMail] Whitelisting flaw in Declude?
Mail gateways or anti-spam products for mail gateways? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 1:16 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Other mail gateways do it. Why would it be so difficult to duplicate the message and the header changing the recipients in the individual header files? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 6:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; --- - - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw in Declude? If an email is received that is addressed to multiple recipients, one of whom is whitelisted, does Declude treat the email as whitelisted for all recipients? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED],
[Declude.JunkMail] mxrate 7. sniffer 10, zerohour 0?
HI All, As you all know by now, my knowledge on these things is pretty slim but is this not a bit strange that commtouch gave this spam zero points. I am just trying to figure how good commtouch is. X-Declude-Note: # TESTS FAILED: MXRATE-BLOCK [7], SUBCHARS-50 [1], SNIFFER [10], WEIGHT10 [10], WEIGHT14 [14], ZEROHOUR [0] Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.com ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] OT: Stupid Spammer Humor
MN You can now submit Phishes to http://www.phishtank.com . At least you can MN do something about them now, but it remains to be seen how effective the MN information will be. I've read some stories on this one. Is Declude considering developing support for this with their API? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting flaw in Declude?
Anti-spam\virus mail gateways. I know barracuda, (now Symantec), does the splitting for whitelisting. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, October 18, 2006 10:48 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? Mail gateways or anti-spam products for mail gateways? Darrell --- - Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 1:16 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Other mail gateways do it. Why would it be so difficult to duplicate the message and the header changing the recipients in the individual header files? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 6:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; - -- - - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers.
RE: [Declude.JunkMail] SmarterMail and Subspools
The domain aliases being treated as outgoing domain has been long since resolved. When SmarterMail 3.x came out, it was a problem because of the new file format they used to store configuration data, but the issue was fixed quickly. As for the sub-spool question, I'm not sure ... I've honestly never found a need to use the sub-spools. What is your definition of high volume? We have SmarterMail servers processing 250K inbound messages per day running a single spool. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 11:18 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools I do not know if it does but. I can tell you that you need to be careful with domain aliases on SmarterMail. They are treated as outgoing for junkmail processing. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Strother Sent: Tuesday, October 17, 2006 6:33 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and Subspools Does Declude work correctly with the subspool feature of SmarterMail? I believe I read somewhere that it doesn't. This is a requirement of a high volume SmarterMail server and seems like it would relatively easy to implement. Can anyone comment? Mark Strother Pacific Online Phone: 604-638-6010 ext. 222 Fax: 604-638-6020 Toll Free: 1-877-503-9870 http://www.pacificonline.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Tuesday, October 17, 2006 3:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test - ignore Test, please ignore. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] OT: Stupid Spammer Humor
I've read some stories on this one. Is Declude considering developing support for this with their API? I don't know about Declude, but it's a natural plugin for one or more of the SURBLs - I expect they'll have something soon. In which case, the InvURBL add-on will catch these eventually. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisting flaw in Declude?
Also, realize that on servers processing a large volume of messages per day, the additional IO necessary to create duplicate messages and header files for each specific recipient would be a death sentence... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 9:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the TO address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised TO address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw in Declude? If an email is received that is addressed to multiple recipients, one of whom is whitelisted, does Declude treat the email as whitelisted for all recipients? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail and Subspools
I don't run SmarterMail so can someone explain what a sub-spool is and why its beneficial? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Jay Sudowski - Handy Networks LLC [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 2:55 PM Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases being treated as outgoing domain has been long since resolved. When SmarterMail 3.x came out, it was a problem because of the new file format they used to store configuration data, but the issue was fixed quickly. As for the sub-spool question, I'm not sure ... I've honestly never found a need to use the sub-spools. What is your definition of high volume? We have SmarterMail servers processing 250K inbound messages per day running a single spool. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 11:18 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools I do not know if it does but. I can tell you that you need to be careful with domain aliases on SmarterMail. They are treated as outgoing for junkmail processing. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Strother Sent: Tuesday, October 17, 2006 6:33 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and Subspools Does Declude work correctly with the subspool feature of SmarterMail? I believe I read somewhere that it doesn't. This is a requirement of a high volume SmarterMail server and seems like it would relatively easy to implement. Can anyone comment? Mark Strother Pacific Online Phone: 604-638-6010 ext. 222 Fax: 604-638-6020 Toll Free: 1-877-503-9870 http://www.pacificonline.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Tuesday, October 17, 2006 3:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test - ignore Test, please ignore. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail and Subspools
The domain aliases issue has reappeared. I have confirmed it with Declude. We are running Declude Version 4.3.7 for SmarterMail Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, October 18, 2006 11:56 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases being treated as outgoing domain has been long since resolved. When SmarterMail 3.x came out, it was a problem because of the new file format they used to store configuration data, but the issue was fixed quickly. As for the sub-spool question, I'm not sure ... I've honestly never found a need to use the sub-spools. What is your definition of high volume? We have SmarterMail servers processing 250K inbound messages per day running a single spool. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 11:18 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools I do not know if it does but. I can tell you that you need to be careful with domain aliases on SmarterMail. They are treated as outgoing for junkmail processing. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Strother Sent: Tuesday, October 17, 2006 6:33 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and Subspools Does Declude work correctly with the subspool feature of SmarterMail? I believe I read somewhere that it doesn't. This is a requirement of a high volume SmarterMail server and seems like it would relatively easy to implement. Can anyone comment? Mark Strother Pacific Online Phone: 604-638-6010 ext. 222 Fax: 604-638-6020 Toll Free: 1-877-503-9870 http://www.pacificonline.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Tuesday, October 17, 2006 3:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test - ignore Test, please ignore. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] OT: Stupid Spammer Humor
We are talking to them at the moment. If fact just last week. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Wednesday, October 18, 2006 2:22 PM To: Mike N Subject: Re[2]: [Declude.JunkMail] OT: Stupid Spammer Humor MN You can now submit Phishes to http://www.phishtank.com . At least MN you can do something about them now, but it remains to be seen how MN effective the information will be. I've read some stories on this one. Is Declude considering developing support for this with their API? -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MXRate
Anyone familiar with the difference between MXRate's public list and their paid list/service (other than the option to load the list locally) -- Best regards, David mailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail and Subspools
Hmmm. I'm running 4.3.7 and not seeing that: 10/18/2006 13:27:55.114 694158291036 SNIFFER:30 . Total weight = 30. 10/18/2006 13:27:59.379 694158291036 Using [incoming] CFG file C:\SMARTERMAIL\Declude\$default$.junkmail. 10/18/2006 13:27:59.379 694158291036 Tests failed [weight=30]: SNIFFER=WARN[30] WEIGHT17=IGNORE[17] WEIGHT20=WARN[20] WEIGHT30=WARN[30] 10/18/2006 13:27:59.379 694158291036 Msg failed SNIFFER (Message failed SNIFFER: 53.). Action=WARN. 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT17 (Weight of 30 reaches or exceeds the limit of 17.). Action=IGNORE. 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT20 (Weight of 30 reaches or exceeds the limit of 20.). Action=WARN. 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT30 (Weight of 30 reaches or exceeds the limit of 30.). Action=WARN. 10/18/2006 13:27:59.379 694158291036 L1 Message OK 10/18/2006 13:27:59.379 694158291036 Subject: Start a career that provides a lifetime residual income 10/18/2006 13:27:59.379 694158291036 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.150.31.98 ID: nw67avwquycqo1x 10/18/2006 13:27:59.379 694158291036 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 10/18/2006 13:27:59.379 694158291036 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 3:28 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases issue has reappeared. I have confirmed it with Declude. We are running Declude Version 4.3.7 for SmarterMail Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, October 18, 2006 11:56 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases being treated as outgoing domain has been long since resolved. When SmarterMail 3.x came out, it was a problem because of the new file format they used to store configuration data, but the issue was fixed quickly. As for the sub-spool question, I'm not sure ... I've honestly never found a need to use the sub-spools. What is your definition of high volume? We have SmarterMail servers processing 250K inbound messages per day running a single spool. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 11:18 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools I do not know if it does but. I can tell you that you need to be careful with domain aliases on SmarterMail. They are treated as outgoing for junkmail processing. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Strother Sent: Tuesday, October 17, 2006 6:33 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and Subspools Does Declude work correctly with the subspool feature of SmarterMail? I believe I read somewhere that it doesn't. This is a requirement of a high volume SmarterMail server and seems like it would relatively easy to implement. Can anyone comment? Mark Strother Pacific Online Phone: 604-638-6010 ext. 222 Fax: 604-638-6020 Toll Free: 1-877-503-9870 http://www.pacificonline.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Tuesday, October 17, 2006 3:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test - ignore Test, please ignore. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools
Are you using a gateway or is mail delivered directly to your server? We use gateways with IPBYPASS for both of our gateways. This is a migrated configuration from Imail. Do I still need the WHITELIST 127.0.0.1 that was put in because of Imail’s web interface? I am going to take that out to see what happens. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, October 18, 2006 1:34 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools Hmmm. I'm running 4.3.7 and not seeing that: 10/18/2006 13:27:55.114 694158291036 SNIFFER:30 . Total weight = 30. 10/18/2006 13:27:59.379 694158291036 Using [incoming] CFG file C:\SMARTERMAIL\Declude\$default$.junkmail. 10/18/2006 13:27:59.379 694158291036 Tests failed [weight=30]: SNIFFER=WARN[30] WEIGHT17=IGNORE[17] WEIGHT20=WARN[20] WEIGHT30=WARN[30] 10/18/2006 13:27:59.379 694158291036 Msg failed SNIFFER (Message failed SNIFFER: 53.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT17 (Weight of 30 reaches or exceeds the limit of 17.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT20 (Weight of 30 reaches or exceeds the limit of 20.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT30 (Weight of 30 reaches or exceeds the limit of 30.). Action=""> 10/18/2006 13:27:59.379 694158291036 L1 Message OK 10/18/2006 13:27:59.379 694158291036 Subject: Start a career that provides a lifetime residual income 10/18/2006 13:27:59.379 694158291036 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.150.31.98 ID: nw67avwquycqo1x 10/18/2006 13:27:59.379 694158291036 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 10/18/2006 13:27:59.379 694158291036 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=""> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 3:28 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases issue has reappeared. I have confirmed it with Declude. We are running Declude Version 4.3.7 for SmarterMail Kevin Bilbee Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools
No gateway and email is delivered directly to our servers. I still have whitelist 127.0.0.1 with on ill effects Im aware of. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 5:18 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools Are you using a gateway or is mail delivered directly to your server? We use gateways with IPBYPASS for both of our gateways. This is a migrated configuration from Imail. Do I still need the WHITELIST 127.0.0.1 that was put in because of Imails web interface? I am going to take that out to see what happens. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, October 18, 2006 1:34 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools Hmmm. I'm running 4.3.7 and not seeing that: 10/18/2006 13:27:55.114 694158291036 SNIFFER:30 . Total weight = 30. 10/18/2006 13:27:59.379 694158291036 Using [incoming] CFG file C:\SMARTERMAIL\Declude\$default$.junkmail. 10/18/2006 13:27:59.379 694158291036 Tests failed [weight=30]: SNIFFER=WARN[30] WEIGHT17=IGNORE[17] WEIGHT20=WARN[20] WEIGHT30=WARN[30] 10/18/2006 13:27:59.379 694158291036 Msg failed SNIFFER (Message failed SNIFFER: 53.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT17 (Weight of 30 reaches or exceeds the limit of 17.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT20 (Weight of 30 reaches or exceeds the limit of 20.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT30 (Weight of 30 reaches or exceeds the limit of 30.). Action=""> 10/18/2006 13:27:59.379 694158291036 L1 Message OK 10/18/2006 13:27:59.379 694158291036 Subject: Start a career that provides a lifetime residual income 10/18/2006 13:27:59.379 694158291036 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.150.31.98 ID: nw67avwquycqo1x 10/18/2006 13:27:59.379 694158291036 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 10/18/2006 13:27:59.379 694158291036 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=""> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 3:28 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases issue has reappeared. I have confirmed it with Declude. We are running Declude Version 4.3.7 for SmarterMail Kevin Bilbee Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker
What I was trying to do was outline a solution that didn't include whitelisting. I'm against whitelisting due to it's inability to differentiate between levels of grey in the spam-fighting process. Instead, pure weighting systems can assign negative weights as needed, but still block _really_ bad mail, but I probably deviated from the main point too much. Back to the argument and playing devil's advocate on myself, rewriting of the Q*.SMD file is something we do to assist in adjusting weights in the spam filtering process, or reporting FPs or missed spam to sniffer. We have fairly simple VBS scripts that do it for us, so something like that could adopted for use in exploding the Q file and create the appropriate message copies to each recipient. I do agree with David B. that it is better handled by the mail server, though. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 12:27 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker Darin, We don't whitelist those addresses at all. But I could see other companies wanting to do so. This idea that if one address is whitelisted, then they all are, is not a good situation. It is good in that some folks might want Declude to process that way, in which case the current whitelist will work for them. Its not good from the standpoint that there is no alternative mechanism. If Declude has access to all of the envelope information, they should easily be able to add a new tag that only whitelists an address if it's the only address in the envelope. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, October 18, 2006 11:15 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker Hi Dave, A comment on the whitelist to required monitoring addresses... We don't whitelist email to abuse@ or postmaster@ addresses. Instead we have a user-specific Declude config that allows mail through to those addresses. So, we configure Declude to use this separate config for all postmaster and abuse addresses for all domains. That way we don't have a need to whitelist to these addresses, and we have fine-grained control over what we let through to them. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 12:06 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker David, I agree. But I do think the whitelisting needs to be changed. I think you should add a WhitelistUnique tag. EG: WhitelistUnique TO: [EMAIL PROTECTED] The way the tag would function is that the email would only be treated as whitelisted if [EMAIL PROTECTED] was the only address in the TO field and if the carbon copy field is also blank. This insures that spammers can't stack multiple email addresses in the TO or CC fields, one address of which is whitelisted, thus forcing the email to pass through Declude to ALL RECIPIENTS rather than just to the whitelisted recipient. Besides the listserver problem I described, I can see some places wanting to whitelist email to [EMAIL PROTECTED] or [EMAIL PROTECTED] Spammers who have figured out this gaping hole in Declude could easily force all email to a site to be whitelisted by simply sending email to [EMAIL PROTECTED] and tagging a dozen other addresses onto the TO field. Not good. Is my suggestion something that you can implement? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 8:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's
RE: [Declude.JunkMail] mxrate 7. sniffer 10, zerohour 0?
Hi Craig, As with all tests they do not always identify messages as spam this is why Declude uses multiple tests and a weighting system. If this was a spam message, you are right zerhour missed it. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig EdmondsSent: Wednesday, October 18, 2006 2:18 PMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] mxrate 7. sniffer 10, zerohour 0?Importance: HighSensitivity: Confidential HI All, As you all know by now, my knowledge on these things is pretty slim but is this not a bit strange that commtouch gave this spam zero points. I am just trying to figure how good commtouch is. X-Declude-Note: # TESTS FAILED: MXRATE-BLOCK [7], SUBCHARS-50 [1], SNIFFER [10], WEIGHT10 [10], WEIGHT14 [14], ZEROHOUR [0] Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.com ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools
I just tested removing the WHITELIST 127.0.0.1 and it did not have an affect I could see. We also use Junkmail REDIRECTin the default.junkmail file for finding of the appropriate junkmail so we do not have to have a separate junkmail file for aliased domains they user the same junkmail file as the domain they are aliased to. There may be a difference in the way Declude handles domain aliases when using IPBYPASS. I will forward this Declude. I really hope the fix this soon. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, October 18, 2006 2:35 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools No gateway and email is delivered directly to our servers. I still have whitelist 127.0.0.1 with on ill effects I’m aware of. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 5:18 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] SmarterMail and domain aliases - moved from SmarterMail and Subspools Are you using a gateway or is mail delivered directly to your server? We use gateways with IPBYPASS for both of our gateways. This is a migrated configuration from Imail. Do I still need the WHITELIST 127.0.0.1 that was put in because of Imail’s web interface? I am going to take that out to see what happens. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Wednesday, October 18, 2006 1:34 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools Hmmm. I'm running 4.3.7 and not seeing that: 10/18/2006 13:27:55.114 694158291036 SNIFFER:30 . Total weight = 30. 10/18/2006 13:27:59.379 694158291036 Using [incoming] CFG file C:\SMARTERMAIL\Declude\$default$.junkmail. 10/18/2006 13:27:59.379 694158291036 Tests failed [weight=30]: SNIFFER=WARN[30] WEIGHT17=IGNORE[17] WEIGHT20=WARN[20] WEIGHT30=WARN[30] 10/18/2006 13:27:59.379 694158291036 Msg failed SNIFFER (Message failed SNIFFER: 53.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT17 (Weight of 30 reaches or exceeds the limit of 17.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT20 (Weight of 30 reaches or exceeds the limit of 20.). Action=""> 10/18/2006 13:27:59.379 694158291036 Msg failed WEIGHT30 (Weight of 30 reaches or exceeds the limit of 30.). Action=""> 10/18/2006 13:27:59.379 694158291036 L1 Message OK 10/18/2006 13:27:59.379 694158291036 Subject: Start a career that provides a lifetime residual income 10/18/2006 13:27:59.379 694158291036 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.150.31.98 ID: nw67avwquycqo1x 10/18/2006 13:27:59.379 694158291036 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 10/18/2006 13:27:59.379 694158291036 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=""> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, October 18, 2006 3:28 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail and Subspools The domain aliases issue has reappeared. I have confirmed it with Declude. We are running Declude Version 4.3.7 for SmarterMail Kevin Bilbee Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] MXRate
David, The list and the service are both based on the same data, but are for totally different purposes. The service is really something that is integrated with Alligate, and it is not used exactly like a blacklist would be since it is based on probabilities. The blacklist version groups the probabilities together into two groups so that it is compatible with common spam blocking techniques. That's really just a nutshell overview, but I think it should suffice. Matt David Sullivan wrote: Anyone familiar with the difference between MXRate's public list and their paid list/service (other than the option to load the list locally) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting flaw in Declude?
FYI, Alligate also does splitting. Matt Kevin Bilbee wrote: Anti-spam\virus mail gateways. I know barracuda, (now Symantec), does the splitting for whitelisting. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, October 18, 2006 10:48 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? Mail gateways or anti-spam products for mail gateways? Darrell --- - Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "Kevin Bilbee" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 1:16 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Other mail gateways do it. Why would it be so difficult to duplicate the message and the header changing the recipients in the individual header files? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 6:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: "Dave Beckstrom" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the "TO" address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised "TO" address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email.
Re[2]: [Declude.JunkMail] MXRate
Hello Matt, M The list and the service are both based on the same data, but are for M totally different purposes. The service is really something that is M integrated with Alligate, and it is not used exactly like a blacklist M would be since it is based on probabilities. The blacklist version M groups the probabilities together into two groups so that it is M compatible with common spam blocking techniques. It looks like they also have the service that will act as a plug-in and return probabilities. M That's really just a nutshell overview, but I think it should suffice. I think so, thanks. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting flaw in Declude?
I have some stats here that suggest otherwise. We only have 5% more recipients than messages that make it through our gateway, and we only return permanent errors presently for mail bombing related activities. This however is a dedicated gateway and not a hosted mail server, so stats from a hosted mail server would see a slightly higher rate since most multiple-recipient E-mails are internal to a server. If you are splitting on a gateway and not splitting internal E-mail, you should see no increase beyond my numbers. It's a doable solution if one has the need. Matt Jay Sudowski - Handy Networks LLC wrote: Also, realize that on servers processing a large volume of messages per day, the additional IO necessary to create duplicate messages and header files for each specific recipient would be a death sentence... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Barker Sent: Wednesday, October 18, 2006 9:30 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? To create a duplicate message for each recipient is not a trivial issue. This is a function of the mail server not Declude. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Bilbee Sent: Tuesday, October 17, 2006 5:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? Delcude has always functioned like this. What declude could do in this case is to duplicate the message for each recipient and write a new header file to each recipient. Not a big issue. Deliver to the one that whitelists and run the spam checks for the others. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darin Cox Sent: Tuesday, October 17, 2006 12:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? It's actually more of an issue of how the mail server handles the message. In the case of multiple recipients, since there is only one message file addressed to multiple recipients in the headers, it's either deliver or not deliver unless you rewrite the headers to modify the recipient list. I think I'd rather not have the spam filtering system alter that. Add to the header, yes. Alter the recipients, no. Also, I have not come across a situation where I wanted to let a message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin. - Original Message - From: "Dave Beckstrom" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email address for which I do not want email spam checked. This is because I don't want messages going out to the list that say SPAM in the subject line. Because nobody who is not a member on the list can post to the list, there is no problem whitelisting the "TO" address for mail sent to the list server email address. However, spammers will send an email to a dozen of our mail addresses (12 recipients) one of which is the whitelised "TO" address for the listserver. Because of the way Declude processes the whitelist, that means that the other 11 recipient receive the spam even though mail to them is not whitelisted. That is a bad design on Declude's part, wouldn't you agree? Anyone else feel that this needs to be rectified? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 17, 2006 11:25 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude? If one user is whitelisted they all will be whitelisted for that email. There are some things you can do to prevent this like BYPASSWHITELIST test. Darre;; - --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "Dave Beckstrom" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw in Declude? If an email is received that is addressed to multiple recipients,
