Re: [Declude.JunkMail] No one at Declude?

2013-04-17 Thread Darin Cox
There are a lot of new spam nets that have just been turned up over the past few days. Volumes more than doubled for us, with a lot slipping through. We’ve added quite a few class Cs to our firewall blocks this week as we see new ones light up that are entirely owned by a spammer. That’s helped

Re: [Declude.JunkMail] No one at Declude?

2013-04-17 Thread Darin Cox
)541-9338 From: Darin Cox [mailto:dc...@4cweb.com] Sent: Wednesday, April 17, 2013 10:52 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] No one at Declude? There are a lot of new spam nets that have just been turned up over the past few days. Volumes more than doubled

Re: [Declude.JunkMail] No one at Declude?

2013-04-17 Thread Darin Cox
. From: Darin Cox [mailto:dc...@4cweb.com] Sent: Wednesday, April 17, 2013 12:23 PM To: Declude.JunkMail@declude.com Subject: [SPAM]- Score (19)Re: [Declude.JunkMail] No one at Declude? Not many IPs in that range in use yet according to SenderBase, but those that are are very bad

Re: [Declude.JunkMail] why have spam scores jumped?

2013-03-16 Thread Darin Cox
Message- From: Darin Cox Sent: Friday, March 15, 2013 11:11 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] why have spam scores jumped? Hi Ben, You'll want to set up at least two DNS servers for that. One recursive for mail server lookups, most likely on the mail server

Re: [Declude.JunkMail] NJABL Shut Down

2013-03-05 Thread Darin Cox
Appreciate the heads up, Andy! Darin. From: Andy Schmidt Sent: Tuesday, March 05, 2013 11:09 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] NJABL Shut Down March 1, 2013: NJABL is in the process of being shut down. The DNSBL zones have been emptied. After the Internet has had

Re: [Declude.JunkMail] Fw: Deciphering Comcast reply on weird DNS stuff

2012-11-30 Thread Darin Cox
Hi Ben, Spam only to a server that no longer has MX records pointing to it isn’t really a surprise. Spammers have been known to cache MX records and continue to spam them long after an MX record is changed. The rationale behind that may be to bypass spam filtering gateways that have placed in

Re: [Declude.JunkMail] Joe Jobs

2012-11-28 Thread Darin Cox
Hi Dave, A firm SPF policy generally does help, but it depends on the receiving servers implementing SPF in order to block messages that violate your SPF policy. Aside from that and filtering that blocks any original included message content, there's nothing I know of that can stop bounces and

Re: [Declude.JunkMail] abused whitelist?

2012-10-22 Thread Darin Cox
Hi Andy, He sent it to the Declude Junkmail list, of which you are a member. However, the list is pretty much defunct. Declude switched to online forums years ago, which effectively killed the list. Darin. -Original Message- From: andyb@thumpernet Sent: Monday, October 22, 2012 6:03 PM

Re: [Declude.JunkMail] Dealing with Joe Jobs?

2011-12-07 Thread Darin Cox
Hi Dave, We see this occasionally, and SPF does help a little, but SPF is often not enforced, so it's more valuable for self-addressed spam than anything else... and many senders violate their own SPF policy. Deleting your MX doesn't help since the bounces are coming from all over, not from the

Re: [Declude.JunkMail] Dealing with Joe Jobs?

2011-12-07 Thread Darin Cox
a no such user here response and disconnects. No mail is actually delivered. At least that is my interpretation (from the log files) as to what's happening. I suspect this has been going on for months with the one domain. -Original Message- From: Darin Cox [mailto:dc...@4cweb.com] Sent

Re: [Declude.JunkMail] error 0xC0000142 smtp.exe

2011-05-05 Thread Darin Cox
No, that's typical. We have a script scheduled to delete them every day. It seems the sniffer script doesn't always delete them... probably Declude still has a lock on the file, so it can be read, but not changed or deleted. We monitor our spool and overflow directories, and when thresholds

Re: [Declude.JunkMail] How do you read the Inv-Uribl log file?

2011-04-08 Thread Darin Cox
We've seen this a lot with Inv-URIBL. You can patch it somewhat by putting in a counterweight for Inv-URIBL when it crashes. There is a small set of scores to adjust for. Darin. - Original Message - From: IMail Admin To: Declude.JunkMail@declude.com Sent: Friday, April 08, 2011 1:35

Re: [Declude.JunkMail] Idea for new Declude add-on

2011-02-17 Thread Darin Cox
I agree. We see forging attacks like this periodically. While not every day, there's usually one every week, and when they hit, they hit hard. If we whitelisted or even negative-weighted addresses people sent to, when these attacks hit we would let through a ton of spam. We would _never_

Re: [Declude.JunkMail] Fine tuning Declude

2010-05-12 Thread Darin Cox
added when an account is created. Anyway, if you have any interest, let me know. I know we wouldn't be able to survive if we were accepting email for any address in a domain, so I feel your pain. Best, Darin Cox 4C Web A division of 4C Design Technology Corp. (813) 413-4883 Tampa Bay, FL (919

Re: [Declude.JunkMail] Fine tuning Declude

2010-05-12 Thread Darin Cox
Sorry guys, I meant to send this directly to Michael. Got distracted with other email and phone calls, and didn't check the address before sending. My apologies. Darin. - Original Message - From: Darin Cox To: declude.junkmail@declude.com Sent: Wednesday, May 12, 2010 10:55 AM

Re: [Declude.JunkMail] Fine tuning Declude

2010-05-12 Thread Darin Cox
This is about 1/3 of the process to sync the servers. Then there's the processing of the file on the gateway to add/delete accounts as needed, and the minor Exchange config changes to accept mail from a subdomain. In our implementations, and due to often insufficient access/knowledge on the

Re: [Declude.JunkMail] stop scanning after x points

2010-02-10 Thread Darin Cox
Hi Bonno, You can alter the InvURIBL and Sniffer test definitions in your config to use Pete McNeil's WeightGate utility to conditionally run those tests. An example InvURIBL line is INV-URIBL external weight C:\IMail\Declude\WeightGate\WeightGate.exe -100 %WEIGHT% 500

Re: Re[6]: [Declude.JunkMail] Cutting down on DNS

2009-07-10 Thread Darin Cox
Hi Michael, I'm using Windows 2003 DNS server as well, and have had no trouble with it at all. There are some advantages to Simple DNS when it comes to integration and replication of an entire server, but I've made up those deficiencies with scripting around the DNSCMD utility in the Windows

Re: [Declude.JunkMail] BackScatter

2009-05-16 Thread Darin Cox
Todd, you might want to check SenderBase. We had a similar issue a month ago. SenderBase had recorded a number of backscatter messages from a private list we host that often gets attacked by spammers. The unauthorized access notices that were sent back were seen as backscatter by SenderBase

Re: [Declude.JunkMail] BackScatter

2009-05-16 Thread Darin Cox
] On Behalf Of Darin Cox Sent: Saturday, May 16, 2009 7:33 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] BackScatter Todd, you might want to check SenderBase. We had a similar issue a month ago. SenderBase had recorded a number of backscatter messages from a private list we

Re: [Declude.JunkMail] website design service spam emails

2009-02-19 Thread Darin Cox
Sample headers would help in determining a way to filter these. Also, do you use Message Sniffer? Darin. - Original Message - From: Craig Edmonds cr...@123marbella.com To: declude.junkmail@declude.com Sent: Thursday, February 19, 2009 3:16 AM Subject: [Declude.JunkMail] website

Re: [Declude.JunkMail] What about a TOFILE

2008-12-17 Thread Darin Cox
It's possible to accomplish this now using per address configs, though that would be configured in the $default$.junkmail instead of a separate test definition as you would normally do. To outline this process: - Add a redirect line to the $default$.junkmail for each address you want to

Re: [Declude.JunkMail] create a TODOMAIN file

2008-12-09 Thread Darin Cox
Hi Craig, While it's not a whitelist, you could use the fromfile test with a high negative weight to achieve your goal. We have a tiered set of tests that work similar to this: FROMWHITELIST_LOWfromfilepath to file\fromwhitelist_low.txt-100 0 FROMWHITELIST_MEDfromfile

Re: [Declude.JunkMail] Spam

2008-12-03 Thread Darin Cox
WHITELIST AUTH can whitelist such spam if the user has their own address in their webmail address book. This is the one drawback with WHITELIST AUTH. It would be nice to be able to use this but exempt the user's address from the whitelist. Darin. - Original Message - From: Todd

Re: [Declude.JunkMail] Spam

2008-12-03 Thread Darin Cox
. WHITELIST AUTH is used for user authentication. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, December 03, 2008 2:58 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spam WHITELIST AUTH can whitelist

Re: [Declude.JunkMail] Blacklist Based on TO Address?

2008-10-30 Thread Darin Cox
Instead of blacklisting, why not just create a TO/SUBJECT filter that adds a large weight. That would serve the same purpose as blacklisting. Darin. - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, October 30, 2008 9:02 AM

Re: [Declude.JunkMail] Blacklist Based on TO Address?

2008-10-30 Thread Darin Cox
,Inc d/b/a Able Body Labor ph. 727.724.2610 fx. 727.724.2680 cl. 727.638.6208 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, October 30, 2008 9:43 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Blacklist

Re: [Declude.JunkMail] Negative Weight an IP

2008-10-23 Thread Darin Cox
You can either fix your DNS so the web server doesn't fail the REVDNS check, or add WHITELIST IP ip address of server without the to your Declude config, or both. Darin. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday,

Re: [Declude.JunkMail] Negative Weight an IP

2008-10-23 Thread Darin Cox
Any server sending mail should have REVDNS. Darin. - Original Message - From: Todd Richards [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, October 23, 2008 3:30 PM Subject: RE: [Declude.JunkMail] Negative Weight an IP Sandy, I guess that was a question that was on

Re: Re[6]: [Declude.JunkMail] DNS Changes

2008-10-09 Thread Darin Cox
I have to say I also agree with Sandy. While recommending a free external DNS solution like OpenDNS is an easy fix for many less technical customers, as Sandy has pointed out it is not the best solution. 1. The customer has no control over its availability. With a free external DNS solution

Re: [Declude.JunkMail] Re:Declude vs Perry (ES)

2008-09-09 Thread Darin Cox
Did he keep a copy of the code, or did he just use libraries he developed through the years, as all programmers do, that he used for all of his programming? It's not possible to tell that without an in-depth review of source code for both products. Also, bear in mind that programmers tend to

Re: [Declude.JunkMail] Re:Declude vs Perry (ES)

2008-09-09 Thread Darin Cox
PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, September 09, 2008 2:03 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Re:Declude vs Perry (ES) Did he keep a copy of the code, or did he just use libraries he developed through the years, as all programmers do, that he used for all

Re: [Declude.JunkMail] Command Line Scanner - Help!

2008-06-12 Thread Darin Cox
Hi Kathy, Here is what I posted a week ago. Works for us...with no excessive CPU load. However, it sounds like your problems are a deeper configuration issue since you mention multiple scanners allowing viruses through. Assuming the default

Re: [Declude.JunkMail] form spam filter

2008-04-10 Thread Darin Cox
, and their utility will likely disappear in time, whereas these other methods are neither a burden, nor are they likely to cease being effective. That's my take on it. Matt Darin Cox wrote: Hmmm... good idea. Though the testing/form filler tools I've seen aren't using pasting. They are generating

Re: [Declude.JunkMail] form spam filter

2008-04-09 Thread Darin Cox
Since forms all use different emailers, and the form content is different as well, your only hope is content filtering based on what the spammer submitted... like SURBL filtering or REGEX on the spammer submission. These days, web-based form processing pages should minimally check that the

Re: [Declude.JunkMail] form spam filter

2008-04-09 Thread Darin Cox
in both JavaScript and the ASP or whatever code to do the URL checking. As far as I know, this seems to work perfectly, but setting session variables on the form page doesn't do a damn thing. Matt Darin Cox wrote: Since forms all use different emailers, and the form content is different

Re: [Declude.JunkMail] form spam filter

2008-04-09 Thread Darin Cox
Edmonds 123 Marbella Web Design in Spain W: www.123marbella.net From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: 09 April 2008 15:09 To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] form spam filter Hi Matt, Some do, some don't. I've seen both

Re: [Declude.JunkMail] form spam filter

2008-04-09 Thread Darin Cox
are not doing that right now. Matt Darin Cox wrote: Hi Matt, Some do, some don't. I've seen both methods used on some customer sites. Setting session variables on the form page definitely wouldn't work, as a spammer that hits the form would receive the same session information anyone else

Re: [Declude.JunkMail] form spam filter

2008-04-09 Thread Darin Cox
by spammers elsewhere that read CAPTCHA's anyway, though I suspect that the current form spammers are not doing that right now. Matt Darin Cox wrote: Hi Matt, Some do, some don't. I've seen both methods used on some customer sites. Setting session variables on the form page

Re: [Declude.JunkMail] form spam filter

2008-04-09 Thread Darin Cox
take significantly more time to fill a form than a program, even if it is a keystroke generator From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, April 09, 2008 11:54 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] form spam filter

Re: [Declude.JunkMail] Forged-Spam Backscatter

2008-04-07 Thread Darin Cox
Hi Kevin, This doesn't have anything to do with incoming mail servers, only outgoing. Also, there should be just one SPF record per domain. So assuming you send mail for myriadnetwork.com as well, and either domain can send outbound mail through any of the servers listed in the MX records for

Re: [Declude.JunkMail] why isn't this message deleted

2008-02-26 Thread Darin Cox
. Thanks, Ben - Original Message - From: Darin Cox To: declude.junkmail@declude.com Sent: Tuesday, February 26, 2008 1:19 PM Subject: Re: [Declude.JunkMail] why isn't this message deleted I don't believe it will work that way for you. Forwarded messages are not scanned

Re: [Declude.JunkMail] why isn't this message deleted

2008-02-25 Thread Darin Cox
Yes, it will work. However, I think you'll want the delete setting put on inbound messages rather than outbound. In other words, do the scanning and actions on the inbound message to that account, before it is forwarded to the other account. You'll also want to be careful that you're not

Re: [Declude.JunkMail] Indicate msg size in header on an authenticated whitelisted

2008-01-24 Thread Darin Cox
Slammed...g I did have your message saved to reply, just hadn't had time. Since Declude's whitelisting bypasses any tests, an external test won't work. So, it appears you would need to write a plug-in that is called by IMail, and then chains to Declude after rewriting the message. It might

Re: [Declude.JunkMail] Per-User Blacklist

2008-01-02 Thread Darin Cox
Hi Dean, We do limited per domain configs (from a set of choices, so it is not completely custom per domain), but not per user, and have never seen a need to go to the user level. Maintenance of that would be a nightmare as any change to the master list of tests run or weights involved would

Re: [Declude.JunkMail] Postmaster Spoofed Returns

2007-09-27 Thread Darin Cox
SPF can help a bit, if the receiver of the spoofed emails uses SPF for filtering and does not bounce on SPF violation. We've been able to limit the bounces that get through so far to just a few, mostly through detection of any remnants of the original spam in the bounce. Darin. -

Re: [Declude.JunkMail] Postmaster Spoofed Returns

2007-09-27 Thread Darin Cox
] Postmaster Spoofed Returns I suppose the detection of any remnants of the original spam is going to be a manual process...correct? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, September 27, 2007 9:08 AM To: declude.junkmail

Re: [Declude.JunkMail] Per User config redirecting

2007-09-13 Thread Darin Cox
Hi Bill, No gotchas that I can think of. We've been using that kind of config for a couple of years now. You can redirect for an email address by specifying the email address on the REDIRECT line You can redirect for a domain by specifying @example.com (replace example.com with your domain

Re: [Declude.JunkMail] SPF (Fail or Pass)

2007-09-07 Thread Darin Cox
Only SPFFAIL is recommended, as spammers may have SPF records. Also, since many organizations are not using SPF, SPFUNKNOWN is not useful. Here's how you declare it in your GLOBAL.CFG SPFFAILspffailxput your test weight here0 I find that SPF is very useful, if for no other

Re: [Declude.JunkMail] Interesting Spam

2007-09-06 Thread Darin Cox
I use a command line tool from www.whoisview.com that works well for both domains and IP blocks. Occasionally I run into a domain that doesn't resolve, but when that happens I also have trouble from registrar sites like netsol and godaddy. www.freewho.com generally works well, though. Darin.

Re: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Darin Cox
I whipped this up mid afternoon, and it's catching them for us. An earlier version this morning didn't catch the entire campaign. - MINWEIGHTTOFAIL 23 SKIPIFWEIGHT 250 REVDNS END ENDSWITH .smarsh.com HEADERS 10 CONTAINS X-Mailer: Microsoft Outlook

Re: [Declude.JunkMail] Spam Increase?

2007-08-03 Thread Darin Cox
I think we started seeing it last Saturday... pretty constant since then. Fortunately it's almost entirely being caught so our customers are not seeing it. Darin. - Original Message - From: John T (lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, August 03,

Re: Re[2]: [Declude.JunkMail] Spam Increase?

2007-08-03 Thread Darin Cox
We've saw about a 15% increase a few days ago, and it has stayed there. Bandwidth increase was significantly more than that, though. Took our primary mail server from 20-40% cpu to 50-80%. We just upgraded last night to deal with it. Darin. - Original Message - From: Pete McNeil

Re: [Declude.JunkMail] Spam Increase?

2007-08-03 Thread Darin Cox
DELETE weight and not needing to be virus scanned. I attribute the relative 10% increase over last week to the change in volume. The following chart shows the effect on an 8 core server: Matt Darin Cox wrote: We've saw about a 15% increase a few days ago, and it has stayed

Re: [Declude.JunkMail] Zip files

2007-08-02 Thread Darin Cox
Sure. You could create a Declude combo filter like that. Put a size test before the custom filter in your global.cfg, add the tests the message fails to incoming message headers, and in the custom combo filter look for the size test failure warning in the headers, and look for the zip file in

Re: [Declude.JunkMail] frustration

2007-07-18 Thread Darin Cox
We're running pretty well... catching somewhere between 99.7% and 99.9% of incoming spam. Declude 2.0.6 (waiting on Imail 2006 to stabilize before upgrading to the latest version) on IMail 8.22, along with Sniffer and invURIBL. Darin. - Original Message - From: Uwe Degenhardt

Re: [Declude.JunkMail] Fidelity Independent Adviser

2007-07-18 Thread Darin Cox
We had one that was definitely an FP last week. Submitted and received a response that the rule had already been removed. Darin. - Original Message - From: John T (lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, July 18, 2007 9:03 PM Subject:

[Declude.JunkMail] Re: PDF spam detection

2007-06-28 Thread Darin Cox
So far all that I've seen have a blank body with the pdf attachment. Anyone have any ideas as to how to test for a blank body, or one with only whitespace characters? The new PCRE function can do it, but we're still on 2.0.6 at the moment, waiting until IMail 2006.21 comes out and passes

Re: [Declude.JunkMail] Re: PDF spam detection

2007-06-28 Thread Darin Cox
: application/pdf; Note that I have not tested this, but the code is in fact fairly simple and it should work. Matt Darin Cox wrote: So far all that I've seen have a blank body with the pdf attachment. Anyone have any ideas as to how to test for a blank body, or one with only whitespace

Re: Re[2]: [Declude.JunkMail] Using Footer32 in per domain configuration

2007-06-27 Thread Darin Cox
] To: Darin Cox declude.junkmail@declude.com Sent: Tuesday, June 26, 2007 11:03 PM Subject: Re[2]: [Declude.JunkMail] Using Footer32 in per domain configuration I found the problem. It seems there is an additional undocumented command line switch that needs to be added to the end of the line

Re: [Declude.JunkMail] New PDF worm?

2007-06-27 Thread Darin Cox
Yep. Darin. - Original Message - From: SJ.Stanaitis To: declude.junkmail@declude.com Sent: Wednesday, June 27, 2007 11:17 AM Subject: [Declude.JunkMail] New PDF worm? I'm getting gobs of PDF's snagged in my antispam filter, they're not triggering any AV yet, anyone else seeing

Re: [Declude.JunkMail] New PDF worm?

2007-06-27 Thread Darin Cox
Hi David, What's the CB-ATTACH.txt filter? Darin. - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Wednesday, June 27, 2007 11:24 AM Subject: RE: [Declude.JunkMail] New PDF worm? Yes I am seeing the same thing although when I run the pdf through a

Re: Re[4]: [Declude.JunkMail] Using Footer32 in per domain configuration

2007-06-27 Thread Darin Cox
Excellent practice. I should have thought to look. Appreciate it, Sandy! Darin. - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Darin Cox declude.junkmail@declude.com Sent: Wednesday, June 27, 2007 4:29 PM Subject: Re[4]: [Declude.JunkMail] Using Footer32 in per

[Declude.JunkMail] Using Footer32 in per domain configuration

2007-06-26 Thread Darin Cox
Anyone using Sandy's footer32 in a per domain configuration? I tried a few variations and haven't been able to get it to work. Here's the GLOBAL.CFG line I'm using: ADDFOOTER external nonzero f:\imail\declude\footer32.exe -oo %INOROUT% -yf f:\imail\declude\footer_%LOCALHOST%.txt 0 0

Re: [Declude.JunkMail] Using Footer32 in per domain configuration

2007-06-26 Thread Darin Cox
] Using Footer32 in per domain configuration Darin- I had to #DOMAINWHITELISTSOFF # turned off prewhitelist for footer32 5/12/7 #PREWHITELIST ON Maybe a couple of other Global settings as well I can't quite remember. Jay -Original Message- From: Darin Cox [EMAIL PROTECTED

Re: [Declude.JunkMail] Using Footer32 in per domain configuration

2007-06-26 Thread Darin Cox
this ADDFOOTER external nonzero f:\imail\declude\footer32.exe -oo %INOROUT% -yf f:\imail\declude\footer_%LOCALHOST%.txt -f 0 0 and it works fine, where footer_example.com.txt is the text file containing the footer for the domain example.com. Darin. - Original Message - From: Darin Cox

Re: [Declude.JunkMail] PCRE and REVDNS

2007-06-19 Thread Darin Cox
How about adding it to the downloads section? That seems easier than dealing with a lot of individual requests. Darin. - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, June 19, 2007 10:42 AM Subject: RE: [Declude.JunkMail] PCRE

Re: [Declude.JunkMail] More accidental whitelisting

2007-06-05 Thread Darin Cox
There is a conversion tool that comes with IMail 2006 to convert address books. The new address books are stored in an access database. Darin. - Original Message - From: J Porter To: declude.junkmail@declude.com Sent: Tuesday, June 05, 2007 10:46 AM Subject: Re: [Declude.JunkMail]

Re: [Declude.JunkMail] More accidental whitelisting

2007-05-29 Thread Darin Cox
Hi Ben, I agree that Declude should detect the IMail version, but I can imagine an argument for continuing to process the aliases.txt, where a recent conversion has taken place, and address book conversion has not fully been completed. So, I guess I see this as more of an IMail conversion

Re: [Declude.JunkMail] accidental whitelisting

2007-05-25 Thread Darin Cox
I've always thought that was silly. I would think your own address should always be excluded from whitelisting. When would email from yourself to yourself be filtered such that it would need whitelisting? Darin. - Original Message - From: Scott Fisher To:

Re: [Declude.JunkMail] accidental whitelisting

2007-05-25 Thread Darin Cox
Anyone on the BCC line? If there's an address there that is being whitelisted, then the entire email gets whitelisted to all recipients. Darin. - Original Message - From: Imail Admin To: declude.junkmail@declude.com Sent: Friday, May 25, 2007 9:01 AM Subject: Re: [Declude.JunkMail]

Re: [Declude.JunkMail] accidental whitelisting

2007-05-25 Thread Darin Cox
about BCC recipients. The headers just show the message addressed to me, with the from line from me, but with someone else's IP address. It's probably the oldest spam trick in the book to just forge the From line. Ben - Original Message - From: Darin Cox To: declude.junkmail

Re: [Declude.JunkMail] OT: server monitoring

2007-05-22 Thread Darin Cox
We monitor from multiple locations... from within the datacenter and from the office. While we get double the notifications in the event of a failure, the complete redundancy avoids any common failure points. As a side benefit, monitoring from the office tells us when our office internet

Re: [Declude.JunkMail] all_list.dat ?

2007-05-17 Thread Darin Cox
This is too tempting... g Darin. - Original Message - From: John T (lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, May 17, 2007 3:31 PM Subject: RE: [Declude.JunkMail] all_list.dat ? I think we all fully understand that now Andrew. John T -Original

Re: [Declude.JunkMail] Header Information Util...

2007-05-14 Thread Darin Cox
Why don't you use the mail server log files instead. Much easier to parse, and tools like Grep and Sawmill can be used to do it. Darin. - Original Message - From: IS - Systems Eng. (Karl Drugge) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Monday, May 14, 2007 5:45 PM

Re: [Declude.JunkMail] Header Information Util...

2007-05-14 Thread Darin Cox
Of Darin Cox Sent: Monday, May 14, 2007 6:04 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Header Information Util... Why don't you use the mail server log files instead. Much easier to parse, and tools like Grep and Sawmill can be used to do it. Darin. - Original

Re: [Declude.JunkMail] Header Information Util...

2007-05-14 Thread Darin Cox
this, and pull the data directly. Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, May 14, 2007 8:15 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Header Information Util... Looks to me that if you turn

Re: [Declude.JunkMail] PCRE

2007-05-10 Thread Darin Cox
For those on IMail, the focus right now is probably on getting a stable and fully functional mail server again. IMail 2006.21 preview 1 was just released to hopefully address most, if not all, of the problems with 2006, but it was just posted that those with virtual domains should wait for

Re: [Declude.JunkMail] PCRE

2007-05-10 Thread Darin Cox
software company in the world to have issues and then make customers wait a year and a half for a solution, I guess one consolation is we don't charge you as much to do so :) David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, May 10

Re: [Declude.JunkMail] lot's of legit mailservsr in spamdatabases

2007-04-19 Thread Darin Cox
Yeah, UCEPROTECT in particular seems to have added a lot of major ISPs recently. We started counterweighting ISPs by REVDNS, but we were spending too much time doing that, so we reduced the weight of the UCEPROTECT1 and UCEPROTECT2 tests. Darin. - Original Message - From: Bonno

Re: [Declude.JunkMail] hotmail mailservers in several spamdatabases

2007-04-12 Thread Darin Cox
We have counterweight filter files for all of our higher weight tests. For example, if hotmail ifs failing SORBS-SPAM across the board and we decide to exempt them from that test, then we'll add a REVDNS test to the counterweight file for SORBS-SPAM. This way we can effectively turn tests on

Re: [Declude.JunkMail] AUTOWHITELIST Question....

2007-04-10 Thread Darin Cox
Just the individual's account. One thing that does sometimes happen, though, is that the user puts their own address in their webmail address book. So, anything that forges that person's address when sending to them gets through. Something for the user FAQ... Darin. - Original Message

Re: [Declude.JunkMail] Whitelist weirdness

2007-03-08 Thread Darin Cox
We see that a lot... where the user has their own email address in their webmail contacts, which results in any spam sent to them that forges their email address coming through. Darin. - Original Message - From: Robert Grosshandler [EMAIL PROTECTED] To: declude.junkmail@declude.com

Re: [Declude.JunkMail] OT: SPF record question

2007-02-17 Thread Darin Cox
not strictly using webmail? To me it implies that to cover all bases you would have to have in your SPF string ?all and there would be no way to make it stricter than that, other than to force all your users to use webmail and not Outlook. Gary Original Message From: Darin Cox

Re: [Declude.JunkMail] Re: Documentation

2007-02-16 Thread Darin Cox
ESPAM-PHISH bitmask 2 ESPAM 4 0 ESPAM-BULK bitmask 4 ESPAM 6 0 Darin. - Original Message - From: Darin Cox To: Darin Cox ; [EMAIL PROTECTED] ; Declude.JunkMail@declude.com Sent: Thursday, February 15, 2007 4:37 PM Subject: [Declude.JunkMail] Re: Documentation Hi David, Any

Re: [Declude.JunkMail] disable subject line warning on one email account

2007-02-16 Thread Darin Cox
Not a rule, but either a domain-level or user-level config to change the WARN action to IGNORE. Darin. - Original Message - From: Craig Edmonds To: declude.junkmail@declude.com Sent: Friday, February 16, 2007 6:33 AM Subject: [Declude.JunkMail] disable subject line warning on one

Re: SPAM-WARN:Re: [Declude.JunkMail] OT: SPF record question

2007-02-16 Thread Darin Cox
this indicates that SPF doesn't help you if your users are not using webmail. Is this correct? Gary Original Message From: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, February 07, 2007 4:33 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail

[Declude.JunkMail] Re: Documentation

2007-02-15 Thread Darin Cox
Hi David, Any progress on the documentation? Darin. - Original Message - From: Darin Cox To: [EMAIL PROTECTED] ; Declude.JunkMail@declude.com Sent: Tuesday, February 13, 2007 2:54 PM Subject: Re: Documentation Hi David, Any progress on revising the documentation? I noticed I

Re: [Declude.JunkMail] dns attacks today

2007-02-12 Thread Darin Cox
Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, February 07, 2007 5:59 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] dns attacks today So where's Scott in this picture? And who's Paul Parisi, other than CTO

Re: [Declude.JunkMail] Whitelist questions

2007-02-09 Thread Darin Cox
Whitelist questionsI would suggest negative/counter weights instead of whitelists, but yes, you can have several lists for whitelisting or counterweighting purposes. Here's the general syntax for ip-based or from-address counterweighting. Adjust the file paths from these generic examples

Re: [Declude.JunkMail] Manuals

2007-02-09 Thread Darin Cox
Ugh. David B., can we get manuals back ASAP? PDFs that we can download and save would be great so we can keep a reference in case something like this happens again, our internet connection is down, etc. Darin. - Original Message - From: Dean Lawrence [EMAIL PROTECTED] To:

Re: [Declude.JunkMail] Manuals

2007-02-09 Thread Darin Cox
suffice for now - -Nick Darin Cox wrote: Ugh. David B., can we get manuals back ASAP? PDFs that we can download and save would be great so we can keep a reference in case something like this happens again, our internet connection is down, etc. Darin. - Original Message - From: Dean

Re: [Declude.JunkMail] dns attacks today

2007-02-08 Thread Darin Cox
is still involved with DNSStuff, just not in a PR role. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, February 07, 2007 5:59 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] dns attacks today So where's Scott

Re: [Declude.JunkMail] OT: SPF record question

2007-02-07 Thread Darin Cox
If your MX and A records are also in the 216.15.92.0/25 network, then you don't need to specify the a and mx parameters, so you could simplify to No enforcement, other hosts may send mail for the domain v=spf1 ip4:216.15.92.0/25 ?all Soft fail if policy violated. Filters may or may not block on

Re: [Declude.JunkMail] dns attacks today

2007-02-07 Thread Darin Cox
So where's Scott in this picture? And who's Paul Parisi, other than CTO of DNSstuff.com? Is Scott selling DNSstuff and DNSreport as well? Darin. - Original Message - From: Nick Hayer [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, February 07, 2007 5:06 PM

Re: [Declude.JunkMail] Footer per Domain?

2007-01-29 Thread Darin Cox
Footer per Domain?You could use Sandy's external test that adds a footer. Wrapping it with a script of some sort to check the domain name before running the test sounds like it would meet your needs. You'd need to configure your script as the test in Declude, and could launch Sandy's exe

Re: [Declude.JunkMail] Automatic Whitelisting - IMail 2006.1

2007-01-17 Thread Darin Cox
The latest version of Declude 4 is supposed to have the Auto Whitelisting added back in. Previous versions do not work with IMail 2006 for auto whitelisting purposes. Darin. - Original Message - From: Mike Wiegers [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday,

Re: [Declude.JunkMail] SmarterMail 4.0 is released

2007-01-11 Thread Darin Cox
This is not limited to SmarterMail. For example, IMail's listserv works the same way. I think most do actually. What you really need is a different mailing solution that a traditional listserv. These days, bulk mailing systems will explode the list and send out a unique message to each person

Re: [Declude.JunkMail] ORDB.Org Shutting Down

2006-12-18 Thread Darin Cox
MessageI hate to see it, but it doesn't seem a major loss. ORDB hits on between 0.003% and 0.02% of incoming email for us. Darin. - Original Message - From: Michael Jaworski To: declude.junkmail@declude.com Sent: Monday, December 18, 2006 1:09 PM Subject: [Declude.JunkMail]

[Declude.JunkMail] Fw: [spf-announce] Website relaunch / Increasing SPF deployment and software support / The 2007 council elections

2006-12-14 Thread Darin Cox
FYI... Darin. - Original Message - From: Julian Mehnle [EMAIL PROTECTED] To: SPF Announcements [EMAIL PROTECTED] Sent: Thursday, December 14, 2006 7:34 AM Subject: [spf-announce] Website relaunch / Increasing SPF deployment and software support / The 2007 council elections -BEGIN

  1   2   3   4   5   6   7   8   >