Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Kevin Rogers
I'm looking for a little help creating SPF records. I'm trying to use the tools at openspf.org. We only have one server that sends out mail for our domain. We have a secondary server that accepts email sent to our domain if our primary server is down (myriadnetwork.com). After going through t

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Colbeck, Andrew
Symantec says that backscatter-as-deliberate-spam-technique is back in vogue. See their April State of Spam Report http://www.symantec.com/enterprise/security_response/weblog/2008/04/post _8.html Andrew. From: [EMAIL PROTECTED] [mailto:[EMAIL PR

RE: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Craig Edmonds
I second that. I am not trying to brown nose or anything here but without declude we would be completely screwed. In 3 years with declude I think I have only had to email them once with a support query and that was answered pretty much within an hour. Sure, some spam gets through now and again b

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Jim Comerford
... but I noticed the domains that we were seeing this with did not have any SPF records in place. So when I saw this sudden increase come through, I added a strict SPF policy for that domain. The backscatter for that domain all but stopped. ... Good thing to check... the latest domain to g

RE: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Stephan Chayer
Dan, Todd, I feel a little like you. We are using, selling and supporting Declude for the past 4 years. It works great for us. Especially since they brought up version 4 including Commtouch and AVG, that was a nice move. We went through all the product and pricing changes for the past year

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread David Barker
The filter deals with Backscatter. Jon is the issue you are talking about is your mail server bouncing messages? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 3:59 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Forge

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Jon Lucas
Will the filter keep spoofed email senders from getting into the queue manager in IMail? the format I am seeing is like bipweks@mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thursday, April 03, 2008 12:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Forged-Spam

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Todd Richards
Jim - I'm running the exact same set up as you are. We had the same problem about two weeks ago. I don't know if this made much difference or not, but I noticed the domains that we were seeing this with did not have any SPF records in place. So when I saw this sudden increase come through, I

Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Herb Guenther
Same here, we normally run 100 or so messages a min @ 70% spam, now seeing peaks of 400-500 @ 97% Seems much worse in the last 2 weeks or so. I think that we all have lots of company. Herb Darrell ([EMAIL PROTECTED]) wrote: Jim, While others may cringe regarding this, but some of the backs

[Declude.JunkMail] Exclude a single user from a banned file rule

2008-04-03 Thread Goran Jovanovic
Hi, Is it possible to BANEXT EXE for everyone except for one user? The user in question would be allowed to receive all the .exe files they can handle? Let me know please Thanks Goran Jovanovic Omega Network Solutions --- This E-mail came from the Declude.JunkMail mailing list. To unsubscri

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread David Barker
We use 2 filters to address the issue which work well for us. I will make them available on our website this week. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Comerford Sent: Thursday, April 03, 2008 2:46 PM To: declude.junkmail@declude.com Subject: [Declude.Jun

RE: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Craig Edmonds
I have been having exactly the same problem on both mail servers. Both are. Imail 8.15 Declude 4.3.64 invURIBL 3.1.1 Sniffer Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.net LEGAL DISCLAIMER - This message may contain confidential, proprietary or legall

Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Darrell ([EMAIL PROTECTED])
Jim, While others may cringe regarding this, but some of the backscatter I have had to deal with (excess of 500-1000 messages a minute at times) I have had to put filters in place to delete null senders for periods of time. Darrell Jim Comerford wrote: Over the last several weeks we have see

[Declude.JunkMail] Forged-Spam Backscatter

2008-04-03 Thread Jim Comerford
Over the last several weeks we have seen a dramatic increase in spam hitting our server. From about 70,000 mails a day to around 110,000 /day. Most destined for our users is getting properly filtered by declude. What is getting thru is backscatter from spam that is forging addresses from domai

Re: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Linda Pagillo
Thank you Todd. It's my pleasure! If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Ext.2 Linda Pagillo Technical Support Engineer | Declude Your Email Security is our business Direct: 978-225-8436 Office: 978.499.2933 Ext.2

RE: [Declude.JunkMail] Reasons to renew

2008-04-03 Thread Todd Richards
I totally agree with Dan’s email. Declude has been working great for us, so it’s money well spent. On the other hand, our IMail SA just expired, which cost us close to $1000 a year and a half ago, and I was never satisfied to the point where I could upgrade. So that amounted to worthless mone

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
We are through Outlook where we configure "our email server requires authentication" and the password is input there...I just don't know why that is getting missed by the email system... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Barker Sent: Thu

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
I found that if I whitelist each VPN user, then we can successfully send email via a VPN connection, so we at least have a viable fix for the problem. I believe that the key is that being authenticated on the VPN server does not necessarily mean that the user is authenticated on the mail server

AW: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Hirthe, Alexander
WHITELIST IP192.107.21.0/24 Or the long answer: http://support.declude.com/Customer/KBArticle.aspx?articleid=41 > -Ursprüngliche Nachricht- > Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von > Jon Lucas > Gesendet: Donnerstag, 3. April 2008 17:33 > An: declude.junkmai

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread David Barker
Set you LOGLEVEL to DEBUG in your global.cfg then track a message using the spool number and see if the whitelisting is taking place. Also does the header of the email show whitelisted? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thur

FW: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
Hi David... I applied the CIDR address range to the global.cfg WHITELIST, but emails sent via VPN are still getting filtered into the SPAM folder. I am still scratching my head on this one...so far nothing has affected this problem. Jon Lucas Poly-Cast, Inc. 503-648-5357 -Original Mess

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
Hi David... I applied the CIDR address range to the global.cfg WHITELIST, but emails sent via VPN are still getting filtered into the SPAM folder. I am still scratching my head on this one...so far nothing has affected this problem. Jon Lucas Poly-Cast, Inc. 503-648-5357 -Original Messag

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread David Barker
Are you authenticating with your mail server? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lucas Sent: Thursday, April 03, 2008 12:00 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spoofed names I added the VPN Server ipaddress

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
I added the VPN Server ipaddress as well as my current VPN Address to the global.cfg whitelist section, but it did not help the problem. Declude immediately grabs any message that I send except for a reply to someone else's email and dumps it into the spam folder. -Original Message-

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread David Barker
You have to use CIDR range as the example you provided: WHITELIST IP 198.107.21.0/24 However remember that users who authenticate with the server are automatically whitelisted. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Lu

RE: [Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
I found out that the problem in part is due to users using VPN, and the internal addresses are not whitelisted. In the Global.cfg file, can you whitelist a range of ipaddresses, such as 198.107.21.1 - 198.107.21.255? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROT

[Declude.JunkMail] Spoofed names

2008-04-03 Thread Jon Lucas
What is the best way to block spoofed names? We are getting a lot of spoofed emails in our IMail queue that just linger there like bipweks@.com. I tried blacklisting the name, but it appears that Declude then filters out all emails. I then went to the spam folder, and put all of the NAMES