I've run into this problem too. My solution was to setup another delete
test two points lower than your original delete test. So with a WEIGHT30
test, setup a WEIGHT28 test with the action of delete. I don't know how
reliable it is, but it worked for me.
Jason
- Original Message
I would rather not add six new tests to my config. Would you recommend a
single SURBL test? Which one seems to work better?
Regards,
Jason
- Original Message -
From: Darin Cox [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, November 23, 2004 8:02 AM
Subject: Re
http://www.msnbc.msn.com/id/5326107/
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can
]
X-Declude-Sender: [EMAIL PROTECTED] [80.181.183.107]
X-Spam-Tests-Failed: SORBS-DUHL, DSN, SPAMCHK, WEIGHT10, WEIGHT20 [39]
X-UIDL: 385498355
Can someone shed some light on what may be causing this to be delivered?
Thanks
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http
/2004 14:49:58 Qc7df09da00840372 L4 Message OK
[/trunc]
So I'm gonna answer my own question here, and say that Declude got it right,
but Imail didn't catch it in the Rule. Anyone have a clue on why Imail rule
wouldn't catch the text WEIGHT20 using this rule:
H~(WEIGHT20):spambox
TIA
Jason
and forward it to my account. Where does it
go south, does it go from declude to an odd 'forward' process bypassing the
rules, and straight to delivery?
Thanks
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
to be ROUTETO email address. You could do this for
the
WEIGHT20 Piece.
I'm not sending all WEIGHT20 to a separate e-mail address. I'm shooting it
to a sub mailbox. For this I would use the MAILBOX action, and that
requires PRO which we do not have.
Jason
---
[This E-mail was scanned
Don't believe that will work. Does anyone know why a forwarded message
isn't processed by the rules?
Thanks,
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Grant Griffith
- Declude JM
Sent: Tuesday, June 29, 2004 4:44 PM
To: [EMAIL PROTECTED
Anyone here try using Nospamproxy? Looks promising
http://www.nospamproxy.de
Please let me know.
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail
Chuck,
Your most efficient option would be to run your own DNS server. Then
YOU control the query volumes, and no longer rely on ATT.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
Sent: Thursday, April 22, 2004 11:16 AM
files so any
help would be appreciated. Here is the batch I have (very basic):
wamlog c:\imail\spool\dec0418.log Stats.txt
imail1 -s Daily Spam Stats -t [EMAIL PROTECTED] -u Spam -h domain.com -f
Stats.txt
Thanks,
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http
[EMAIL PROTECTED] -u Spam -h
domain.com
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jason
Sent: Monday, April 19, 2004 2:05 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: Scripting batch files
Hello everyone.
I have created a batch
These headers didn't trigger the HELOISIP test. It looks to me like
they should have. Any Ideas?
Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44]
by areatech.com
(SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 10:42:45 -0500
Received: from iowiekwaoakkwjehckckw.com
Don't know about NT4, but we are running it on Win2k using log level low
and it is working well. I don't see it come up in the task manager
either, but it is running.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Glenn Brooks
Sent: Monday
Bud,
Is this the proper format for the config file? :
HELOISIPexternalweight
C:\imail\declude\heloisip\heloisip.exe 10 0
Thanks!
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bud Durland
Sent: Sunday, April 18, 2004 6
Thanks Bill. All I can say is WOW. This test seems to be working very
very well. It is snagging tons of stuff.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Sunday, April 18, 2004 8:13 PM
To: [EMAIL PROTECTED]
Subject: Re
Me too :)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Tuesday, April 13, 2004 10:27 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Surbl.org
I would be interested in your script until native support is added
Yes, your 8 minute update timeframe has passed. ;)
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
?
Thanks
Jason
[AUTOMATED NOTE: Your mail server [66.140.194.140] is missing a reverse DNS entry. All
Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry
will cause your mail to be treated as spam on some servers, such as AOL.]
---
[This E-mail
Innocent? ;). We are already using spamchk as an external test. I
would like to avoid adding spamassassin as well. I was thinking more
along the lines of integrating the test into the declude core...
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED
Did you send Scott a Christmas card?
:)
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Wednesday, April 07, 2004 4:38 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Passing weight to Externalplus test
Great info! Thanks Bill.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Wednesday, April 07, 2004 8:19 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Habeas win judgment
Based on the following link, Habeas
Title: Message
Not
knowing enough about the way WHOIS works, could a test be set up that would
heavily weight any e-mails that come from a "New" domain? This would
really help the pill/porn pushers....
Jason
-Original Message-From:
[EMAIL PROTECTED] [mai
We had a single Colo'd server fall ill to this vulnerability on Friday
night. It wasn't a pretty sight to say the least.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Mike Wiegers
Sent: Sunday, March 21, 2004 6:51 PM
To: [EMAIL PROTECTED
It is a rule. They are located in a rules.ima (inbound rules file).
The rules.ima file gets placed in the top directory of the domain that
you want to use it on. There is lots of data about this in the
knowledge base on Imails web site.
Regards,
Jason
-Original Message-
From
case had someone say my website is
http://[insert ip here]
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harry
Vanderzand
Sent: Friday, March 19, 2004 1:32 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Detecting disguised url's
For some reason this isn't coming up in the archives (though I know I've
seen it)
Can someone shoot me the config line for the new CMDSPACE ?
Thanks
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
Ah, but the Kill.lst is an envelope rejection. It saves many more
resources this way.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, February 10, 2004 2:03 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail
address book can send mail to you
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Terry Fritts
Sent: Sunday, February 08, 2004 4:50 AM
To: Jason
Subject: Re[4]: [Declude.JunkMail] JunkMail User Friendly Interface
Someone about 2 months ago had
here, is it possible to share your efforts?
Thanks!
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sanford
Whiteman
Sent: Saturday, February 07, 2004 11:47 AM
To: Joe Wolf
Subject: Re[2]: [Declude.JunkMail] JunkMail User Friendly Interface
Try running Black ICE on the server. It does a pretty decent job of
auto blocking dictionary attacks. We have it set to close and block a
connection after 6 invalid users from an ip in 30 seconds
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf
Friends? :)
Happy Hollidays Everyone!
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Doug Anderson
Sent: Wednesday, December 31, 2003 1:24 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Russian letters
Careful if using
list of acceptable excluded addresses together,
further improving the tests accuracy.
Jason
-- Original Message --
From: Matthew Bramble [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Date: Wed, 03 Dec 2003 19:38:18 -0500
Alejandro,
From the Declude
RDNS whitelist, then anything with a
.ebay.com address is whitelisted, or whatever we put in the list.
I know we can whitelist in the main .cfg file, but I'm not sure I would
want to whitelist ebay from every test, just whitelist from the
spamdomains test.
Jason
-Original Message-
From
Ahh, but us poor folks that have the standard version are out of luck
:-(
Guess I have a good reason to upgrade now.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Wednesday, December 03, 2003 9:17 PM
To: [EMAIL
on the DNS setup.
Thanks in Advance!
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives
Would you be interested in sharing this. It looks great!
Thanks!
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Daniel Grotjan
Sent: Thursday, November 06, 2003 4:02 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Opinions on web
on the SpamSource button, and it submits to SPAMCOP.
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Thursday, October 30, 2003 4:00 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] SPAMCOP Account
Dan..
BE VERY
So as of Monday are we going to have a new organization running the .com /
.net TLDs? lol
It's about time
Buh Bye Verislime
Jason
- Original Message -
From: Joshua Levitsky [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, October 03, 2003 2:12 PM
Subject: [Declude.JunkMail] Happy
But, Kami just listed the revdns whitelists, wouldn't the spammer have to
have a RDNS listing of something in her whitelist (not likely) to take
advantage of the listing?
Jason
- Original Message -
From: Keith Anderson [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, September 15
Generally speaking, what are the bots looking for? Only mailto:'s? Or are they smart
enough to use a regex search and find any text of the form [EMAIL PROTECTED]?
Jason Wolfe
Lead Developer
Netcomm, Inc.
http://www.netcomm.com
(859) 224-4124
---
[This E-mail was scanned for viruses by Declude
for the forwarded message to User2 and User3.
Am I doing some wrong. If you want I can show you the config files.
Thanks in advance.
--Jason W. Allen
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe
What I don't understand, is that the logs say it is using the correct config
file and then performing the correct action. But that is as far as it goes.
The message doesn't actually get moved the Spambox Mailbox, but gets
forwarded on to the downstream users and then settings don't pick it up.
forwarded, or that an internal message (the FWD message that gets
processed by the SMTP-FWD) gets scanned by the Junkmail? Or should I revise
my whole policy about forwarding?
--Jason W. Allen
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
So in other words, If I have mailboxes with forwarding on them Spam will
still get through.
Disappointing...
--Jason W. Allen
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Wednesday, September 10, 2003 11:23 AM
To: [EMAIL PROTECTED
.
--Jason W. Allen
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jason W. Allen
Sent: Wednesday, September 10, 2003 12:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] mailbox forwarding no action
So in other words, If I have mailboxes
Some of the mail is not coming from a client. I have mail auto generators
on some servers for certain apps, and websites. If I try to send from an
alias I get relaying errors, since I can't use other settings, other then a
mailfrom. So that's why I need a valid Email Address.
--Jason W. Allen
] - whitelist all messages from everyone (turns off Spam
filtering). Enter [EMAIL PROTECTED] to whitelist all messages sent to your
address.
Jason
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, September 10, 2003 11:39 AM
Subject: Re
address), I still get a relaying error and it
won't let it. To me that means I'm am not a Open relay. But I still need
a local usermailbox to send from my App mailers.
--Jason W. Allen
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Sanford Whiteman
Sent
PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen
Sent: Wednesday, September 10, 2003 1:57 PM
To: [EMAIL PROTECTED]
Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action
See now you've confused me... Which isn't very hard.
I believe I have Relay for Local Users Only
Everyone,
We have decided to close the Trustic service. As has become apparent
recently, there are several issues with the system as it is designed. As
such, we do not believe Trustic will reach the level of accuracy that we
require. The issue of handling large ISPs that, for the most part,
asn't mean for
that...
Jason
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Todd - Smart MailSent: Friday, August 01, 2003
6:45 PMTo: [EMAIL PROTECTED]Subject:
[Declude.JunkMail] Spamdomains com.
FYI Spamdomians failed t
-(0470)
07:28 11:53 SMTP-(0470) requeuing C:\IMail\spool\Q54b20182006c927c.SMD
R0 T1
07:28 11:53 SMTP-(0470) finished C:\IMail\spool\Q54b20182006c927c.SMD
status=3
Thanks for the help
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
of things that
still need to be filled out on the site (yes I have sent them the
recommendations),. Let's just hope they are responsive.
And finally, this seems like it will get better with user
participation
Jason
---
[This E-mail was scanned for viruses by Declude Virus (http
Josh,
What is the entry you have put in your config file? (If you don't mind
sharing)
Thanks
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky
Sent: Saturday, July 26, 2003 9:11 PM
To: [EMAIL PROTECTED]
Subject
Title: RE: [Declude.JunkMail] Declude using 50% cpu
Also, can we ask what hardware / OS this is running
on?
Jason
- Original Message -
From:
John Tolmachoff (Lists)
To: [EMAIL PROTECTED]
Sent: Thursday, July 24, 2003 3:03
PM
Subject: RE: [Declude.JunkMail
.
Jason
-- Original Message --
From: Kevin Bilbee [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
Date: Fri, 18 Jul 2003 15:52:25 -0700
Be careful blocking solely on RDNS and HELOBOGUS. There are many legitimate
mail servers out there with ignorant DNS
I would like to begin using the NOLEGITCONTENT
test, but the mail archives are down :(. Can someone send me the lines I
need in the configs to get this going?
Thanks
Jason
Thanks Scott (and Bill)
We are holding on 20 right now (with very few FPs), so without divulging the
details of the test, is -8 too much or too little a weight? Or should I
just test test test to see what types of mail are failing/passing the test?
Thanks Gents!
Jason
- Original Message
Isn't that backwards?
Firewall with Fixup - ESMTP will not work, and mail defaults to
ordinary SMTP transaction
Firewall without Fixup -- ESMTP works fine
Jason
- Original Message -
From: Rick Davidson [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, June 26, 2003 1
Sorry to burst your bubble, but that's not a tarpit.
You have a dynamic IP blocker. Tarpitting doesn't block, it slows the
attack down, consuming more of their resources, and making their connection
seem like it is stuck in a pit of tar (hence the name)
Jason
- Original Message
Kami,
Is your DNS that IMAIL/Declude uses local to you? Or are you using an
upstream DNS? That many IPV4 tests may warrant this. We noticed a large
performance boost by using a DNS on the local LAN.
Just a thought
- Original Message -
From: Kami Razvan [EMAIL PROTECTED]
To:
Rocketmail.com resolves to yahoo.com
So:
Rocketmail.com yahoo.com
Would be a valid entry
What about the following?
Bigfoot.com
Geocities.com
Rocketmail.com
Markus
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the
questions, you're also more
than welcome to contact me by phone at 859 224 4124.
Thanks,
Jason Wolfe
Lead Developer
Netcomm, Inc.
http://www.netcomm.com
(859) 224-4124
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
capabilities to include the
processing of Virus' log format.
More information is available at: http://www.netcomm.com/products/logtool
Email us off-list at [EMAIL PROTECTED] if you have any questions, comments or interest.
Thanks,
Jason Wolfe
Lead Developer
Netcomm, Inc.
http://www.netcomm.com
(859) 224
I would love to try it out as well!!
Sounds very usefull.
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell L.
Sent: Friday, February 28, 2003 6:15 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Log Analyzer - Comments
66 matches
Mail list logo
