Matt,
Consider adding an entry to ANTI-GIBBERISHSUB for ezmlm, a very popular
mailing list manager package for qmail.
Bill
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Matthew Bramble
Sent: Wednesday, October 22, 2003 8:12 PM
To: [EMAIL PROTECTED]
in that directory.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Bill B.
Sent: Sunday, September 28, 2003 1:19 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spam action for non-local aliases
Can anyone think of a method to identify
Can anyone think of a method to identify Imail aliases that forward to non-local
addresses, and apply specific Declude actions for those aliases?
Reason is.. we only provide spam filtering for our customer's mailboxes, but not for
their alias addresses that forward to non-local accounts. And
Awesome Scott! Does this feature work with PREWHITELIST ON so that we can conserve
some resources for Auth'd users?
Thanks,
Bill
-Original Message-
From: R. Scott Perry
Sent: Tue, 16 Sep 2003 20:05:40 -0400
Subject: Re: [Declude.JunkMail] Next release
Scott could you give us an
Dan,
If you're going Unix-based, qmail and Postfix are faster more widely used than Exim.
But with all three you don't have anybody to call if things break.
If you need support, I recommend SurgeMail by Netwin www.surgemail.com ...I've heard
good things about the scalability of their product
What does this line mean in the declude log:
08/22/2003 08:53:39 Q124905aa0274e442 Bogus IP: ?.?.?.?
Thanks,
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an
I just registered and turned it on, and it seems to have a lot of spam IPs listed.
I'll keep an eye out for false positives.
Bill
-Original Message-
From: Joshua Levitsky
Sent: Sun, 27 Jul 2003 10:43:24 -0400
Subject: Re: [Declude.JunkMail] New spamcop style RBL..
- Original
stat.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill B.
Sent: Sunday, July 27, 2003 4:50 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New spamcop style RBL..
I just registered and turned it on, and it seems to have a lot of spam IPs
Message-
From: Joshua Levitsky
Sent: Sun, 27 Jul 2003 12:13:12 -0400
Subject: Re: [Declude.JunkMail] New spamcop style RBL..
- Original Message -
From: Bill B. [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Sunday, July 27, 2003 11:29 AM
Subject: Re: [Declude.JunkMail] New spamcop style
Scott,
I noticed that IMail 8.0 HF1 now includes the anticipated A lines in the Q*.SMD
files when a user is authenticated via SMTP AUTH. The format is:
[EMAIL PROTECTED]
Can you incorporate this into a new test so that we can reduce the weight on emails
that are sent using SMTP
and send mail only at the speed that IMail can handle
I'm curious, what rate did you find Imail capable of handling before it stopped
responding?
Bill
-Original Message-
From: [EMAIL PROTECTED]
Sent: Wed, 18 Jun 2003 13:36:44 -0700
Subject: Re: [Declude.JunkMail] Tar Pitting
Rifat,
What software are you using to do the tarpitting? Are you running it on the same
server as IMail, or on a separate box?
Bill
-Original Message-
From: Rifat Levis
Sent: Mon, 16 Jun 2003 02:01:45 +0300
Subject: [Declude.JunkMail] DSN:Tarpitting and declude firewall integration
- Original Message -
From: Bill B. [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, June 16, 2003 3:11 PM
Subject: Re: [Declude.JunkMail] DSN:Tarpitting and declude firewall
integration integration
Rifat,
What software are you using to do the tarpitting? Are you running it on the
same server
connection, IMail does (SMTPD). Only after IMail has
received the message does it get delivered to Declude. So, any tarpitting
would have to be integrated with IMail, not Declude (or be run on a mail
gateway that sits in front of the IMail/Declude server).
Bill
- Original Message -
From: Bill B
This approach is a bit different than IMGate because it creates a dynamic tarpit,
based on the spamminess of the email. The more tests it fails, the slower the
connection gets...IN REAL TIME! Thats that cool part. From what I understand, IMGate
can only drop the connection...it cannot slow
You can set up a filter to add a weight for that IP speciffically:
HELO 10 CONTAINS 216.220.106.24
Or you could set up a filter to add a weight to any email that uses an IP as its HELO:
HELO 10 ENDSWITH 0
HELO 10 ENDSWITH 1
HELO 10 ENDSWITH 2
HELO 10 ENDSWITH 3
HELO 10 ENDSWITH
Altavista discontinued their free email service about 2 years ago. So if you're still
seeing spam using their domain, you could probably just add a weight to any email from
@altavista.com.
Bill
-Original Message-
From: Kami Razvan
Sent: Fri, 13 Jun 2003 06:58:41 -0400
Subject:
: [Declude.JunkMail] Spamdomains: att.net
I started out with Bill B.'s file and have been following this list with
changes. So far SPAMDOMAINS has worked like a dream.
Could you post what you have so far? I was waiting for a good example file
before I jumped in to using the test.
Attached is my
PROTECTED] On Behalf Of Bill B.
Sent: Friday, June 13, 2003 10:50 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Spamdomains: Altavista
Altavista discontinued their free email service about 2 years ago. So if
you're still seeing spam using their domain, you could probably just add a
weight
Markus, the attached two files should help you.
Bill
-Original Message-
From: Markus Gufler
Sent: Thu, 12 Jun 2003 16:41:13 +0200
Subject: [Declude.JunkMail] OT stunnel
Sore for this OT question.
Is there anyone who can provide or knows about a good instalation and
configuration
I'm not sure that I agree with this test. I use Earthlink DSL at home, and I never
send out emails using my @earthlink.net address. I always use my personal or
business address, neither of which are provided by Earthlink.
I'd bet that a large percentage of DSL, Cable and Dial-up customers do
showed RNDS, then said all the domains those
IPs use. The intent is to ignore MAILFROM (which Spam Domains already checks) and
compare only IP with RDNS.
Scott,
Would that still be effective?
Dan
On Sunday, June 8, 2003 11:49, Bill B. [EMAIL PROTECTED] wrote:
I'm not sure that I agree
That is compuserve (aol). Our logs show the legit email from that domain coming from
IPs having revdns similar to this:
imo-m07.mx.aol.com
...so I'd add this entry to spamdomains:
@cs.com .aol.com
...the @ symbol will keep it from matching senders such as [EMAIL PROTECTED]
Bill
Dan,
Those will work, but only because the revdns for legit email from those domains will
always match outblaze.com and will never match accountant.com and the others.
I'd leave those @ symbols if I were you, because these outblaze domains use generic
dictionary words. So without the @ you
Scott,
Emails with a message body that just contains blank lines and that contains an
attachment, are still failing the BASE64 test.
Attached is a sample.
Bill
base64fail.zip
Description: Zip archive
Here is my updated list that we're using based on todays's discussions and further
review of our log data. Let me know if anybody sees any errors or omissions.
Would anybody like to expand on the Lycos domains? I know they offer free email
accounts at several of their international domain
Since the archives are down, can somebody post an example of the line that goes in the
GLOBAL.CFG file for the SPAMDOMAINS test, as well as suggestions for the contents of
the spamdomains.txt file?
Thanks,
Bill
-Original Message-
From: Bill Landry
Sent: Thu, 29 May 2003 01:24:19
Somebody mentioned aol.com and netscape.com a while ago, but I cant recall which
format it was. Perhaps somebody else remembers...
aol.com netscape.com
AND/OR
netscape.comaol.com
Bill
-Original Message-
From: Dan Patnode
Sent: 29 May 2003 16:12:11 -0700
Subject:
Thats correct, my mistake. It should be netscape.net
Bill
-Original Message-
From: Joshua Levitsky
Sent: Thu, 29 May 2003 22:33:21 -0400
Subject: Re: [Declude.JunkMail] Spamdomains
On Thursday, May 29, 2003, at 07:23 PM, Bill B. wrote:
Somebody mentioned aol.com and netscape.com
you would still end up with no more than 10 SMTP processes
most of the time (since the SMTP process would normally finish in a bit
less time than Declude JunkMail).
I actually don't care about the number of SMTP processes all that much. The point of
what I am trying to accomplish is limit
Ok, it sounds like lowering MaxQueProc will do what I need to do then. I don't want
to bypass Declude, I just want to put a bottle neck at Declude so that if Declude is
too busy, the emails get moved to the overflow until Declude becomes less busy. I was
just confuse on how it all worked.
Hey Scott,
Got another one for you. Check out the DNS for this spammer's domain: e247.com
The MX points to localhost. The MAILFROM test does not catch this yet, but probably
should.
Bill
-Original Message-
From: R. Scott Perry
Sent: Thu, 13 Mar 2003 10:34:41 -0500
Subject: Re:
Is this syntax correct to whitelist an entire domain in the whitelist file?
@bounce.topiksolutions.com
It appears to be whitelisting everything when I add this. We're running Declude
v1.68i4
Thanks,
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
their people.
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill B.
Sent: Friday, March 21, 2003 11:19 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] whitelist file
Is this syntax correct to whitelist an entire domain in the whitelist
When HiJack releases a delayed email, does it just move it back to the spool folder to
be delivered on the next queue run? Or does it deliver it immediately as soon as it
releases it?
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
I see server failures on a bunch of obviously fake hostnames:
WARNING: DNS server 216.12.134.208 returned a SERVER FAILURE error for MX or A for Me.
WARNING: DNS server 216.12.134.208 returned a SERVER FAILURE error for MX or A for
host3.
WARNING: DNS server 216.12.134.208 returned a SERVER
Scott,
We are seeing a case where the mail server will connect to itself. Check out the DNS
for this spammer's domain: hotoptions.net
It has no MX record, but an A record pointing to: 127.0.0.1
If an email from this domain is bounced due to a full mailbox, this will cause Imail
to attempt
Ron,
We use sniffer as a weighted test, giving it a weight of 12 and tagging emails as spam
at 15. Some false positives do occur just like with any other spam test...However,
using it as a heavily weighted test has been extremely effective for us, while keeping
false positives to a minimum.
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill B.
Sent: Sunday, March 09, 2003 6:51 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] spam w/ all images
Scott,
How about adding a test for if the text/html segment of an
email contains all IMG tags, with no actual text
I use the COPYTO action for one of my tests, however if an email is sent to multiple
recipients I notice that its adding the COPYTO recipient once for each recipient when
this test fails.
Any way to make it only add the COPYTO recipient once, regardless of how many original
recipients there
WOW, you're fast! Thanks,
Bill
-Original Message-
From: R. Scott Perry
Sent: Thu, 06 Mar 2003 10:59:47 -0500
Subject: Re: [Declude.JunkMail] COPYTO
I use the COPYTO action for one of my tests, however if an email is sent
to multiple recipients I notice that its adding the COPYTO
Scott,
It appears that the %NRECIPS% variable is always showing double its true value. I ran
a bunch of tests and it looks like it is always double the true number of recipients.
Any ideas why?
I'm running Declude v1.67i13
Thanks,
Bill
---
[This E-mail was scanned for viruses by Declude
Thanks, that fixed it.
Bill
-Original Message-
From: R. Scott Perry
Sent: Wed, 05 Mar 2003 13:48:42 -0500
Subject: Re: [Declude.JunkMail] %NRECIPS% - doubled
It appears that the %NRECIPS% variable is always showing double its true
value. I ran a bunch of tests and it looks like it
Dan,
Sniffer has made a huge difference for us. We weight the test a 12 and flag emails as
Spam at 15. We only ran for a couple of months without it, but I watch our logs very
closely and the benefit of using Sniffer is significant.
Sniffer is an entirely different type of test from Declude.
How does Declude handle an external test that hangs? Does Declude just keep waiting
on a response from the external test?...or does it eventually timeout and continue on?
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the
Okay. I only had it occur twice over the past day with a new external test we built.
We are gonna fix it, but I was curious how that was handled. Thanks,
Bill
-Original Message-
From: R. Scott Perry
Sent: Fri, 07 Feb 2003 10:25:14 -0500
Subject: Re: [Declude.JunkMail] external tests
I have several XINHEADER/XOUTHEADER lines in my GLOBAL.CFG file to provide some useful
information. And I have a couple of tests that uses the BOUNCE action, which instert
the headers and/or full message into the bounced email using the declude variables
%HEADERS% and %FULLMSG%. However,
ok, thanks. It would be nice, but its definitely not a priority.
Bill
-Original Message-
From: R. Scott Perry
Sent: Fri, 07 Feb 2003 18:35:09 -0500
Subject: Re: [Declude.JunkMail] displaying modified headers in bounce
msg
My question is, is there any way to instert the modified
Is there a way I can get access to the real number of recipients even if it is over
100 (without parsing the Q*.SMD file)?
Perhaps a new variable %NTOTALRECIPS% ?
-Original Message-
From: R. Scott Perry
Sent: Thu, 06 Feb 2003 08:11:50 -0500
Subject: Re: [Declude.JunkMail] NRECIPS
I have an custom external test that gets passed the %NRECIPS% variable. The test is
never seeing a value for NRECIPS greater than 99. Is there something in the Declude
code limiting this value to 99?
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
COMMENTS comments 5 x 10 0
where the 5 means that 5 such comments have to be encountered
This means 5 OR MORE comments have to be encountered right? Not exactly 5?
Bill
-Original Message-
From: R. Scott Perry
Sent: Mon, 03 Feb 2003 19:05:41 -0500
Subject: RE: [Declude.JunkMail]
Is anybody using the COPYTO action for an Outgoing test (requires Declude Pro)? I
can't seem to get it to work. It always copies the email to a blank recipient. I've
got this line in the global.cfg file...
SOMETEST COPYTO [EMAIL PROTECTED]
...but the sender of the email where this
Here it is, and I actually sent a bunch of debug information on this problem to
[EMAIL PROTECTED] on Sunday morning...
Diagnostics ON (Declude v1.66i11).
Declude JunkMail: Config file found (d:\imail\Declude\global.CFG).
Declude Virus: Config file found (d:\imail\Declude\Virus.CFG).
Sure thing. I just resent it, but this time to [EMAIL PROTECTED]
-Original Message-
From: R. Scott Perry
Sent: Mon, 27 Jan 2003 13:41:42 -0500
Subject: Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Here it is, and I actually sent a bunch of debug information on this
if not.
Thanks,
Bill
-Original Message-
From: Bill B.
Sent: Mon, 27 Jan 2003 13:48:00 EST
Subject: Re: [Declude.JunkMail] COPYTO action on an Outgoing test
Sure thing. I just resent it, but this time to [EMAIL PROTECTED]
-Original Message-
From: R. Scott Perry
Sent: Mon, 27 Jan 2003 13:41
Schreiner
D CompBiz, Inc.
D www.compbiz.net
D 407-322-8654
D 800-408-3688
D -Original Message-
D From: [EMAIL PROTECTED]
D [mailto:[EMAIL PROTECTED]] On Behalf Of Bill B.
D Sent: Thursday, January 23, 2003 12:16 PM
D To: [EMAIL PROTECTED]
D Subject: Re: [Declude.JunkMail] OT: Dictionary
We started running BlackICE last month and it has been working nice for us. It
requires a few config changes to get it to auto-block IPs that send you dictionary
attacks, but it is definitely a good solution.
Bill
-Original Message-
From: R. Scott Perry
Sent: Thu, 23 Jan 2003
Two ideas that come to mind for handling the action are:
1) Use the strongest action defined in the user's .junkmail file
2) Or, set the action in the line that points to the BLACKLISTFILE. ie:
BLACKLISTFILE HOLD D:\IMail\Declude\domain\user\blacklist.txt
-Original Message-
From:
How about this...
MAILFROM 0 ENDSWITH 0
MAILFROM 0 ENDSWITH 1
MAILFROM 0 ENDSWITH 2
...etc
-Original Message-
From: Bill Landry
Sent: Sun, 19 Jan 2003 13:15:57 -0800
Subject: RE: [Declude.JunkMail] Return address IP
The only way I can think of to currently block an e-mail address
Is there (or will there be) a similar BLACKLISTFILE feature?
Bill
-Original Message-
From: R. Scott Perry
Sent: Fri, 17 Jan 2003 15:24:34 -0500
Subject: RE: [Declude.JunkMail] Declude JunkMail v1.66 (beta) released
Just to ask the obvious but to be sure...
Now the whitelist is a
Should we be downloading an updated copy of all_list.dat periodically? If
so, how often and from where?
Thanks,
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an
We weight sniffer as a 12 and block at 15. This works very well for us.
Bill
-Original Message-
From: Trent M. Davenport
Sent: Fri, 8 Nov 2002 10:24:28 -0800
Subject: [Declude.JunkMail] Message Sniffer Confidence
So, after seeing the last 2 months that message sniffer is around 90%
How does the new feature for handling multiple return codes in ip4r tests work? Does
this mean we can combine the following into a single test?
OSDUL ip4r relays.osirusoft.com 127.0.0.3 5 0
OSFORM ip4r relays.osirusoft.com 127.0.0.8 5 0
OSLIST ip4r relays.osirusoft.com 127.0.0.7 5 0
OSPROXY
WEIGHT20 ROUTETO junkmail@%LOCALHOST%
Bill
-Original Message-
From: Robert Shubert
Sent: Tue, 05 Nov 2002 12:10:14 -0500
Subject: [Declude.JunkMail] move to different user
Is there a way to have declude change the destination address of the
email when it's marked as spam?
I have
With regards to this new feature:
o External tests can now have variables in their definitions.
Does that mean we can define an external test like this in order to pass parameters to
the test?:
DOMBLACKLIST external nonzero D:\domblacklist.exe %LOCALHOST% %MAILFROM% 100 0
-Original
What I am looking into writing based on that new feature is per-domain and possibly
even per-user blacklist/whitelists. Being able to pass variables to external tests
almost makes this possible, but I think there might be a problem for inbound emails
that have multiple recipients. With
The part I'm not quite sure how to handle is knowing which domain's blacklist file to
use in my exe when there are multiple recipients. For example, if I were to set up my
test like this...
DOMBLACKLIST external nonzero D:\domblacklist.exe %LOCALHOST% %MAILFROM% 100 0
...what would the value
Which version of sawmill are you using? I just tried their current beta (6.4b5) and
it crashed hard while processing Imail logs and didn't even recognized the Declude log
format.
Bill
-Original Message-
From: sbsi lists
Sent: Mon, 28 Oct 2002 16:30:30 -0600
Subject: Re[2]:
I was playing with their latest Beta this morning and it didn't seem to recognize the
Declude logs...but maybe it just did not recognize LOGLEVEL MID. I'll play around
with it some more.
Bill
-Original Message-
From: R. Scott Perry
Sent: Tue, 29 Oct 2002 10:14:24 -0500
Subject: RE:
Thats correct...It reads it each time a message is received. We plan to work on a
similar tool using ASP here in the next month or two.
Bill
-Original Message-
From: grb
Sent: Thu, 24 Oct 2002 19:54:47 -0500
Subject: Re: [Declude.JunkMail] client Question
Hey Rich,
Not sure I
While we are on this topic...
Has anybody had experience with a decent content filtering application? Not exactly
spam content filters, but more along the lines of policy-based filters...where a
corporation could estabilsh policies for what types of content to allow their
employees to send
Is Declude HiJack able to protect against webmail users sending too much mail
also?...or does it just protect SMTP?
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send
Thats what I figured. Thanks
Bill
-Original Message-
From: John Tolmachoff
Sent: Fri, 11 Oct 2002 06:30:04 -0700
Subject: RE: [Declude.JunkMail] hijack web mail
I think the point is that someone in Web mail is not going to be sending out
hundreds and thousands of spam. Just too
We're doing that very thing...it works well.
Bill
-Original Message-
From: Trent M. Davenport
Sent: Wed, 2 Oct 2002 14:32:55 -0700
Subject: RE: [Declude.JunkMail] Per User - Alias Account
I'll try that and let you know how it goes.
Trent
---
Trent M. Davenport - Systems
I use the fromfile test that was suggested by Tom on this list, which adds a
weighting for many common items in Spam addresses such as these below:
@ANONYMOUS @ANONYMOUS
.ANONYMOUS .ANONYMOUS
ANONYMOUS. ANONYMOUS.
ANONYMOUS@ ANONYMOUS@
-ANONYMOUS -ANONYMOUS
ANONYMOUS-
Oh...actually I do remember that being discussed a while back. Thanks Scott.
Bill
-Original Message-
From: R. Scott Perry
Sent: Fri, 27 Sep 2002 09:46:28 -0400
Subject: Re: [Declude.JunkMail] fromfile problem
@ANONYMOUS @ANONYMOUS
ANONYMOUS@ ANONYMOUS@
I use several
Instead of whitelisting, you could use a wordfilter to add a negative weighting like
this:
MAILFROM-50 ENDSWITH.mil
Bill
-Original Message-
From: Mike Goetz
Sent: Fri, 27 Sep 2002 09:50:25 -0400
Subject: [Declude.JunkMail] Whitelisting one address
In my bounce
How affective is scanning at multiple Hops? I'm not setting HOPHIGH right now...but
I'm currious if the people who are using it are seeing its benefits, or if it is
causing them any problems.
And what is the recommended HOPHIGH setting (assuming HOP is set to 0)?
Bill
---
[This E-mail was
, 2002 11:19, Bill B [EMAIL PROTECTED] wrote:
How affective is scanning at multiple Hops? I'm not setting
HOPHIGH right now...but I'm currious if the people who are
using it are seeing its benefits, or if it is causing them any
problems.
And what is the recommended HOPHIGH setting (assuming HOP is
set
Scott,
Mail from one of our users continuously fails the MAILFROM test, but I'm not sure that
it should be failing. The only funny thing this message has is the mail server
hostname appended to the end of the address, but I thought that was valid.
Can you have a look? Below are the message
here it is...
09/20/2002 12:18:34 Q4a5a438800aa39c6 [EMAIL PROTECTED] is not local [0] 0.
09/20/2002 12:18:34 Q4a5a438800aa39c6 Outgoing from 128.242.197.219: Sent over 80
E-mails within 30 minutes; quarantining to hold2.
09/20/2002 12:18:34 Q4a5a438800aa39c6 Outgoing from 128.242.197.219:
running Imail 7.10 with Declude 1.60,
and now we're running Imail 7.13 with Declude 1.61. Could it have been a problem with
the older version of either of those?
Bill
-Original Message-
From: Bill B .
Sent: Tue, 24 Sep 2002 12:18:04 EDT
Subject: Re: [Declude.JunkMail] hijack question
here
It is the official hostname for a virtual domain. It is not a domain alias.
-Original Message-
From: R. Scott Perry
Sent: Tue, 24 Sep 2002 12:53:26 -0400
Subject: Re: [Declude.JunkMail] hijack question
09/20/2002 12:18:34 Q4a5a438800aa39c6 [EMAIL PROTECTED] is not local [0] 0.
One of our client's got locked out by HiJack (hold2), but it appears to be because of
inbound mail, not outgoing mail. This client has an email account at another provider
which forwards to an account on our server. He had a few hundred emails from an
automated program sent to his other
Tom,
Here's another one that I've been using for a while in addition to the ones you list:
-SENTTO SENTTO1
SENTTO- SENTTO2
@SENTTO SENTTO3
SENTTO@ SENTTO4
.SENTTO SENTTO5
SENTTO. SENTTO6
...and today I saw a www- come through which I am
Thanks Terry Scott,
I think I'll give BlackICE a try. I will let you all know what I think about it.
Anything that does application-level SMTP firewalling should work. I wish there was
simpler a product that I could just run to listen to port 25, filter out the bad
stuff, and pipe the good
Will an action of HOLD keep IMail from attempting to send a delivery receipt for an
email?
We are having a problem with delivery receipts that are addressed to invalid senders
filling up our mail queues. So I'm hoping that by putting an action of HOLD on the
MAILFROM test this will help
Hwy., Suite 106
Fullerton, CA 92835
714-578-7999, ext. 104
[EMAIL PROTECTED]
www.reliancesoft.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill B.
Sent: Wednesday, September 04, 2002 6:49 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail
Here is where I was getting confused...
If you use the MAILBOX action, for example:
CATCHALLMAILS MAILBOX spam
...when you use this action on an emaill address that has Mail Forwarding turned on,
it will still forward the message even though Declude attempts to drop it into the
sub-mailbox.
Scott or whomever,
Can you think of any way based on this, to force IMail to retain the message in the
sub-mailbox instead of forwarding it? I don't see a way, but I figured I'd ask.
Thanks
-Original Message-
From: Bill B .
Sent: Thu, 29 Aug 2002 8:59:39 EDT
Subject: Re
Unless there is a 'spam.fwd' the SPAM mailbox will be retained, while all
'main' mail will be forwarded. (rename forward.ima to main.fwd)
-Tom
-Original Message-
From: Bill B. [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 29, 2002 10:18 AM
To: [EMAIL PROTECTED]
Subject: Re
Ya, that is an issue. We are currently working on a solution that will do two
things...
1) run clean up code each time the user logs out of webmail, which trims the size of
the spam mailbox if it is greater than a certain size.
2) an automated script that checks for spam mailboxes that have
92 matches
Mail list logo
