re: [Declude.JunkMail] Single Domain Filter
There are a couple different ways to do this. But first you will need to setup a config folder for this specific domain (if you haven't already done so). See http://www.declude.com/searchresults.asp?Cat=124 under Per-Domain and Per-User Settings. Once the config file is setup for this domain/user, you can create a filter that uses something like this: COUNTRIESXXCONTAINSCN Another way to do it is to use an RBL that filters on countries like this: COUNTRIES_CHINAip4rcn.countries.nerd.dk*XX0 See http://countries.nerd.dk/ for more info on this DNSBL and how it can be used to filter using country codes. In both instances, XX would be a weight that fits your setup. Original Message From: Dean Lawrence dean...@gmail.com Sent: Monday, May 21, 2012 11:22 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Single Domain Filter I have a client that has requested that all emails from China be deleted. I am not currently weighting any emails based on country. What is the best way to create a filter that will only affect this one client's emails and cause any issues for my other clients? -- --- Dean M. Lawrence INTERNET DATA TECHNOLOGY p // 888.438.4381 ext. 701 w // www.idatatech.com f // www.facebook.com/idatatech t // www.twitter.com/idatatech Social Marketing | SEO | Design | Internet Development --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit
Sandy, I found this link - http://www.starwindsoftware.com/high-performance-ram-disk-emulator Apparently you can now download it separately. I'll give it a try. I'm also going to test the Dataram product. http://memory.dataram.com/products-and-services/software/ramdisk If anyone else has a comment on these products or other options, please chime in. Regards, Gary Original Message From: Sanford Whiteman sa...@cypressintegrated.com Sent: Friday, May 13, 2011 6:14 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit Gary, I think I might have spaced on a similar question you asked a while back. I recommend Starwind Software's RAM disk -- the one that comes with their iSCSI initiator (you don't actually need any iSCSI SAN in place). We use it on 2003 + 2008. -- Sandy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: ramdisk using Windows Server 2008 64bit
Is anyone out there using a ramdisk with Windows Server 2008 64bit? If so, which one are you using? Someone recommended to me Dataram RAMDisk, can anyone comment on that? Any other recommendations on using a ramdisk with SmarterMail? Thanks, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] bl.csma.biz
I was checking the blacklists used on my server, and noticed that bl.csma.biz hadn't hit any spam in over three months. Their web site seems to indicate it is still running. Are any of you using it, and is it working for you? Thanks, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] doprewhitelist
I just installed Declude 4.5.29. I guess the removal of doprewhitelist didn't make it into this final release. -Gary Original Message From: David Barker dbar...@declude.com Sent: Monday, October 06, 2008 10:46 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] doprewhitelist Part of the interim release debug logging it will be removed for the actual release. David Barker VP Operations Declude Your Email security is our business 978.499.2933 x 7007 office 978.988.1311 fax dbar...@declude.com -declude -dnsstuff From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Harry vanderzand Sent: Monday, October 06, 2008 1:11 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] doprewhitelist I see the following in my logs for each e-mail. What is this about? 10/06/2008 13:10:14.390 q46710345f479.smd Start: doprewhitelist 10/06/2008 13:10:14.390 q46710345f479.smd END: doprewhitelist Harry Vanderzand NEW ADDRESS Effective Jan 24, 2008 Intown Internet 117 Ruskview Road Kitchener, ON, N2M 4S1 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Registered Email Send List (RESL)
Is anybody using the Registered Email Send List (RESL)? It is described at http://www.emailreg.org/index.cgi?p=usage It doesn't seem that it can be used with Declude. Is this type of query something unique to emailreg.org, or are other sites using it too? They do provide a configuration so you can use it wth SpamAssassin. Regards, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DNS Changes
Is there any documentation for DNSOVERRIDE? It doesn't seem to be mentioned on the Declude web site. The only reference I could find to it is http://www.mail-archive.com/declude.junkmail@declude.com/msg24658.html Gary Original Message From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Wednesday, October 08, 2008 8:14 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] DNS Changes The diags.txt file is created as infomation whent he declude proc service is restarted. One thign you need to check is do you have a DNSOVERRIDE set in your declude.cfg file? Declude by default (as long as there is no DNSOVERRIDE) will use the IP of the DNS server in Imail Admin interface. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd Richards wrote: Hi everyone - I moved my primary internal DNS server to a new location last night (seeing up another site in the WAN), and had planned on using the other DNS servers. However, since moving it my spam has been high. I changed the DNS to the other server in the diags.txt, and the invURIBL.exe.config (for invURIBL). That helped, but am still getting some more that I don't normally get. I just realized that there was a setting in IMail Admin too, so that just got changed. Anything else that you can think of that I need to check/change? Also, regarding the diags.txt and the invURIBL config files, is it possible to set more than one DNS server? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] country chain
The ROUTING test was meant for this. It checks for spam that was sent through multiple countries. Another way is to add weight to individual countries using a filter and the COUNTRIES test which will fail based on a country code: COUNTRIES 10 CONTAINS CN If you wanted to get really complicated, you could create an IP4R test for each country using the blacklist at http://countries.nerd.dk/ Original Message From: Harry vanderzand [EMAIL PROTECTED] Sent: Wednesday, October 01, 2008 11:35 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] country chain When spam goes through several countries as in: X-Country-Chain: UNITED ARAB EMIRATES-POLAND-CANADA-destination Is there a way to add weight to mail that would have travelled this way? Harry Vanderzand NEW ADDRESS Effective Jan 24, 2008 Intown Internet 117 Ruskview Road Kitchener, ON, N2M 4S1 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Country Routing Test?
Are you referring to the ROUTING test? Or do you want to fail versus a specific path? Original Message From: David Dodell [EMAIL PROTECTED] Sent: Saturday, May 17, 2008 9:51 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Country Routing Test? Isn't there a test to get a mail routing path such as: X-Country-Chain: GERMANY-CHINA-GERMANY-destination To fail? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Version 4.4.0 leaving some trash?
I noticed that I also have a newly created 25MB file called $RNCD.AVG in the C:\WINDOWS\Temp directory. Could this file be related to this problem? Gary Original Message From: David Barker [EMAIL PROTECTED] Sent: Friday, April 04, 2008 9:34 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Version 4.4.0 leaving some trash? We have been made aware of this and are currently looking into the cause, it seems to be AVG that is the source, if used in combination with a 3rd party scanner. We are trying to replicate the issue to have it resolved. David B From: Adolfo Justiniano [EMAIL PROTECTED] Sent: Friday, April 04, 2008 7:13 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Version 4.4.0 leaving some trash? Is someone else noticing that version 4.4.0 is leaving a lot of txt files in the proc/work directory? Version 4.3.46 didn't do this, I've noticed since we upgraded. Adolfo Justiniano Santa Cruz BBS e-mail: [EMAIL PROTECTED] http://www.scbbs.net --- [This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus system] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Version 4.4.0 leaving some trash?
I am seeing this too. I noticed some errors in the viruslog file complaining about me having an on-access virus scanner. I didn't get this error message before 4.4.0. Gary Original Message From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Friday, April 04, 2008 4:33 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Version 4.4.0 leaving some trash? I just checked and I am seeing this as well. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Adolfo Justiniano wrote: Is someone else noticing that version 4.4.0 is leaving a lot of txt files in the proc/work directory? Version 4.3.46 didn't do this, I've noticed since we upgraded. Adolfo Justiniano Santa Cruz BBS e-mail: [EMAIL PROTECTED] http://www.scbbs.net --- [This E-mail was scanned for viruses by the Santa Cruz BBS anti-virus system] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade?
If you are going to purchase SmarterMail, you may want to wait a little as they are about to release a new version. 5.x is currently in beta. http://www.smartertools.com/forums/38.aspx Original Message From: Hirthe, Alexander [EMAIL PROTECTED] Sent: Monday, March 10, 2008 10:59 AM To: declude.junkmail@declude.com declude.junkmail@declude.com Subject: AW: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? Hi, Ø Alexander, you are really citing two problems with your scale and performance. That's true, and I'm sure I will install IMail 8 on the new server to get an easier migration. (and to be sure, to work on just one case) That's the thing I must do, exchange the hardware. To small disks, to slow CPU. RAM would be ok. The second part (Update the Software) would be nice, even if there will be more support calls after upgrading. Ø My suggestion is that both problems would be relieved by introducing a mail gateway in front of your mailboxes. In the Windows world, Alligate and XWall are popular with Declude/Sniffer users on this list and the Sniffer support list. With either one, I think you will find that the gateway will take the brunt of the antispam effort, leaving the back-end server to service mailbox connections and requests. We use NoSpamToday as a front end server, and this lowers the incoming spam very well. The problem is, we are getting more and more customers :-) and they all want a good working email system. Ø If your existing hardware is old, you could replace the fans and disks and have it become your new gateway, while you purchase some new hardware for your back-end, which will scale much higher than before once the back-end has to do less antispam processing. We bought a new piece of hardware for the frontend Antispamserver. Ø p.s. Did you have a third problem? Were you implying that the feature-set of IMail is no longer to your liking? Is there anyone really using IMail 9? Especially if you had Imail 8 before? I'm paying about 1000$ every year, and I haven't seen a really good working version of IMail since 8.22. I tried it on my testserver, put some domains on it, and it didn't worked like it should. I called support, mailed support and it was not getting better. So I put it away and tried it some month later again. IMail 9 was (is) getting better and better, but still it's not as stable as I want it. Today I installed Smartermail and it's nice, easy to handle, has a nice webinterface, and it's *cheap*. I thought about dumping the IMail SA and buy Smartermail for that price :) That's the reason for the Mail. IMail 8 is working, but it's old. And I think, there could be a better software than IMail 8 :-) Alex From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Hirthe, Alexander Sent: Monday, March 10, 2008 1:44 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hardware upgrade -Software Crossgrade? Hello, we are going to move to an new hardware. At the moment we are running Imail 8, Declude, Sniffer. It works, but Spam detection is not perfect and overall system performance is getting worse. Should we - wait for IMail 10? - use IMail 9? - stay with Imail 8? - move to Smartermail? We host about 200 domains, with about 2000 Mailboxes. Alex Siller AG, Wannenaeckerstrasse 43, 74078 Heilbronn Vorstand: Prof. H.-F. Siller (Vorsitzender), Joern Buelow, Ralf Michi Aufsichtsratsvorsitzender: Armin Sohler Reg. Gericht Stuttgart, HRB 107707, Ust-Id Nr. DE145782955 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Siller AG, Wannenaeckerstrasse 43, 74078 Heilbronn Vorstand: Prof. H.-F. Siller (Vorsitzender), Joern Buelow, Ralf Michi Aufsichtsratsvorsitzender: Armin Sohler Reg. Gericht Stuttgart, HRB 107707, Ust-Id Nr. DE145782955 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] my DNS tests
VISI has been down for a while. http://www.dnsbl.com/2007/02/status-of-relaysvisicom-dead.html Original Message From: Serge [EMAIL PROTECTED] Sent: Wednesday, November 07, 2007 8:17 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] my DNS tests To all, Please quikly brows my tests below and let me know of any that you know are oudated/needs to be deleted or replaced TIA AHBLRELAYS ip4r dnsbl.ahbl.org 127.0.0.2 2 0 AHBLPROXIES ip4r dnsbl.ahbl.org 127.0.0.3 2 0 AHBLSOURCES ip4r dnsbl.ahbl.org 127.0.0.4 2 0 AHBLSUPPORT ip4r dnsbl.ahbl.org 127.0.0.7 2 0 AHBLEXEMPT ip4r exemptions.ahbl.org 127.0.0.2 -5 0 AHBL-DOMAINS RHSBL rhsbl.ahbl.org127.0.0.2 7 0 BONDEDSENDERip4rquery.bondedsender.org 127.0.0.10 -5 0 IPWHOIS ip4r ipwhois.rfc-ignorant.org * 3 0 NJABL ipr4 dnsbl.njabl.org 127.0.0.2 3 0 NJABLDUL ipr4 dnsbl.njabl.org127.0.0.3 3 0 NJABLFORMMAIL ipr4 dnsbl.njabl.org127.0.0.8 3 0 NJABLMULTI ipr4 dnsbl.njabl.org127.0.0.5 3 0 NJABLPROXIES ipr4 dnsbl.njabl.org127.0.0.9 3 0 NJABLSOURCES ipr4 dnsbl.njabl.org127.0.0.4 3 0 CSMA-SBL ip4r sbl.csma.biz 127.0.0.2 5 0 RSL ip4r relays.visi.com 127.0.0.2 5 0 ZEN ip4rzen.spamhaus.org 127.0.0.250 SPAMBAG ip4r blacklist.spambag.org * 5 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 10 0 CBL ip4r cbl.abuseat.org 127.0.0.2 5 0 DSBL ip4r list.dsbl.org * 5 0 MXRATE-BLACKip4r pub.mxrate.net 127.0.0.2 5 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 MAILPOLICE-Fraud rhsbl fraud.rhs.mailpolice.com127.0.0.2 5 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 2 0 FIVETEN-SPAM ip4rblackholes.five-ten-sg.com 127.0.0.210 FIVETEN-BULK ip4rblackholes.five-ten-sg.com 127.0.0.420 FIVETEN-MULTISTAGE ip4rblackholes.five-ten-sg.com 127.0.0.52 0 FIVETEN-SPAMSUPPORT ip4rblackholes.five-ten-sg.com 127.0.0.7 30 FIVETEN-MISC ip4rblackholes.five-ten-sg.com 127.0.0.920 FIVETEN-FREEip4rblackholes.five-ten-sg.com 127.0.0.12 20 SORBS ip4rdnsbl.sorbs.net * 2 0 SORBS-HTTP ip4rdnsbl.sorbs.net 127.0.0.2 4 0 SORBS-SOCKS ip4rdnsbl.sorbs.net 127.0.0.3 4 0 SORBS-MISC ip4rdnsbl.sorbs.net 127.0.0.4 4 0 SORBS-SPAM ip4rdnsbl.sorbs.net 127.0.0.6 4 0 SORBS-ZOMBIE ip4rdnsbl.sorbs.net 127.0.0.9 4 0 SORBS-DUL ip4rdnsbl.sorbs.net 127.0.0.10 2 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] new virus/spam as mp3?
I just started receiving something new that so far is being caught as spam. They are messages with no subject, no body, but have a file attachment that is Content-Type: audio/mpeg. So far I've seen it as elvis.mp3 beatles.mp3 hurricanechris.mp3 I sent it through VirusTotal but didn't get any hits. Anyone else seen this or heard what it is? Thanks, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MSRBL blacklists
After running DLAnalyzer, I noticed that the MSRBL blacklists that I have been using for a while were not reporting any hits. I have the following in my global.cfg file: MSRBL-PHISHINGip4rphishing.rbl.msrbl.net127.0.0.210 MSRBL-IMAGESip4rimages.rbl.msrbl.net127.0.0.210 MSRBL-SPAMip4rspam.rbl.msrbl.net127.0.0.210 I used a message that came from 83.20.28.6 as my test. When I do a search for that ip on the MSRBL web site, it reports it as a hit in their MSRBL-SPAM database: http://www.msrbl.com/check?ip=83.20.28.6 But when I run the message under Declude, I get the following lines in the Declude log: 09/24/2007 19:10:05.411 84033787d Test #50 [MSRBL-PHISHING] is same as Test #50 [MSRBL-PHISHING=*]. Answer=dns.cameldns.com.? 09/24/2007 19:10:05.411 84033787d Test #51 [MSRBL-IMAGES] is same as Test #51 [MSRBL-IMAGES=*]. Answer=dns.cameldns.com.? 09/24/2007 19:10:05.411 84033787d Test #52 [MSRBL-SPAM] is same as Test #52 [MSRBL-SPAM=*]. Answer=dns.cameldns.com.? Is their blacklist working? Anyone else having success with this blacklist? Thanks, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Increase?
When I logged in to my customer page to download the latest all_list.dat, I noticed that Declude had listed in the same section a filter for the PDF spam. I haven't tried it yet, but I assume it came from the discussion that was had here on the list. There was also something called Sample Content Filters which must be some of the PCRE that David Barker has been posting. Gary Original Message From: Dave Beckstrom [EMAIL PROTECTED] Sent: Saturday, August 04, 2007 8:45 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spam Increase? Sorry guys...I've not been able to stay on top of discussions here for a few weeks and I'm sure I missed discussion about how you're catching the PDF spam. Does someone have a filter they are using for PDF spam that they could post for me? Thanks, Dave -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Friday, August 03, 2007 10:25 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spam Increase? I think we started seeing it last Saturday... pretty constant since then. Fortunately it's almost entirely being caught so our customers are not seeing it. Darin. - Original Message - From: John T (lists) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Friday, August 03, 2007 6:19 PM Subject: RE: [Declude.JunkMail] Spam Increase? I actually saw it ramping up since last weekend and every day there have been a change or 2 in the spam to keep it from being caught. John T -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Friday, August 03, 2007 2:35 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spam Increase? Anyone else noticing an increase in spam today? It seems like stuff that was normally being caught before is showing up in my Inbox. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] another whitelist
I'm looking at another whitelist, but this one deosn't seem to use the IP4R format (reversed dotted quad). It's a spanish whitelist, and its instructions can be viewed at http://www.rediris.es/abuses/eswl/en/ Is there another test type that can be used in Declude to implement this (other than ip4r)? I see in the online documentation for Junkmail a mention of the dnsbl test type. How is that different from the ip4r test type? Thanks, Gary Steiner --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] whitelisting/negative weights with DNSWL.org
Is anyone using DNSWL (www.dnswl.org) as a separate Declude test? Seems like it is incorporated into SpamAssassin. Do they seem reliable? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Interim 4.3.57 available
I noticed the file declude.exe version 4.3.57 is significantly smaller than the previous version (495KB vs. 1881KB). Tightened up the code? Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 17, 2007 9:23 AM To: declude.junkmail@declude.com, [EMAIL PROTECTED] Subject: [Declude.JunkMail] Interim 4.3.57 available 4.3.57 JM Fixed crash bug. Declude crash when reading the envelop file (SM and IM), where the HELO line exceeded 512 Characters RFC-821. Truncated HELO after 512 characters. 4.3.54 DEC Added spool # and the list of Tests failed with the weight in the BLKLST log 4.3.53 DEC Fixed SmarterMail CMDSPACE test. SM made changes to test in cmdspc instead of cmdspace 4.3.52 DEC Added date and time for the BLKLST log 4.3.51 DEC LOG change outgoing and incoming message was incorrect 4.3.50 EVA Fixed BANEZIPEXT ON to block any encrypted file name. 4.3.49 EVA Fixed BANEXT EZIP for encrypted files, .RAR can encrypt file names only using a password. 4.3.47 JM Fixed HELO information was reported incorrectly when IPBYPASS is set David Barker VP Operations | Declude Your Email Security is our business O: 978.499.2933 x7007 F: 978.988.1311 E: [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AntiVirus Recommendations
You need to use both runclamscan runclamd. runclamscan.exe calls clamdscan.exe. There should be a file with it called runclamscan_readme.txt that explains this and other things about the program. runclamd.exe runs clamd.exe as a service. Look for a file included with it called runclamd_readme.txt that explains how this program works. Make sure you install ClamAV from the Administrator account, and not from another account with administator priviledge. I experienced some strange problems with permissions after I made this error. Original Message From: John Doyle [EMAIL PROTECTED] Sent: Monday, July 16, 2007 7:39 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Gary A couple more questions does runclamscan.exe call clamd? does clamd run as a service, and if so how do you start it? I tried this weekend with clamd in my virus.cfg file and it flagged all attchments as having an unknown virus, so i turned it back off. I was not aware of runclamscan. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Gary Steiner Sent: Saturday, July 14, 2007 3:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Following are my virus.cfg lines using runclamscan runclamd for the SOSDG version of ClamAV: SCANFILE1 C:\clamav-devel\thirdparty\runclamscan\runclamscan.exe log=2 C:\clamav-devel\bin\clamdscan.exe --quiet -l report.txt VIRUSCODE1 1 REPORT1 FOUND Original Message From: John Doyle [EMAIL PROTECTED] Sent: Saturday, July 14, 2007 9:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Gary Could you post the lines in your virus.cfg file relating to this version of clam. I'm not sure what the entry should look like. The one below slams my cpu. it is not from sosdg, it's from clamwin. my old one is: #SCANFILE1 C:\Progra~1\ClamWin\bin\clamscan.exe --verbose --database=D:\IMail\Declude\Scanners\ClamAV\db --tempdir=D:\IMail\spool\proc\work --no-summary -l report.txt #VIRUSCODE 1 thanks John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Gary Steiner Sent: Friday, July 13, 2007 10:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations My situation is similar to yours. I started with F-Prot, then later added ClamAV. After Declude added AVG and F-Prot changed their pricing, I dropped F-Prot. I've been using the SOSDG port of ClamAV together with runclamd and runclamscan to take advantage of Clamd, and I've never had a problem with CPU usage. http://www.sosdg.org/clamav-win32 The latest version of SmarterMail now incorporates ClamAV (much like Declude and AVG), and they are using the SOSDG port. Gary Original Message From: John Doyle [EMAIL PROTECTED] Sent: Friday, July 13, 2007 8:03 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Don I ran F-Prot and Clam for years. Then when Declude added built in AV we turned that on and I dropped F-Prot when the licensing changed,So I ran Declude and Clam for about a year. I noticed at some point ClamAV was slamming the cpu and timing out. I had to turn it off. I'm not sure at what point ClamAV changed and have not had the time to look at running Clamd version to see if it has the same problem. So we are now running only the Declude scanner and I have the same nervousness as you do about only running one scanner John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Don Schreiner Sent: Thursday, July 05, 2007 6:23 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] AntiVirus Recommendations We have been using F-Prot for several years with great success. Their new mail server licensing change is too expensive. We tried the free Clam AV, but with heavy volume CPU was reaching 100%. I know Declude has built-in Virus Scanner, but we have always run F-Prot in addition. It seems necessary for extra protection, but perhaps now overkill? What are others using or recommend? What is best Virus scanner to keep the CPU cycles reasonable? We are running IMail 8.22, Declude 4.X, Message Sniffer, and invURI. Thanks. -Don Sent via CompBiz.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from
RE: [Declude.JunkMail] AntiVirus Recommendations
Following are my virus.cfg lines using runclamscan runclamd for the SOSDG version of ClamAV: SCANFILE1 C:\clamav-devel\thirdparty\runclamscan\runclamscan.exe log=2 C:\clamav-devel\bin\clamdscan.exe --quiet -l report.txt VIRUSCODE1 1 REPORT1 FOUND Original Message From: John Doyle [EMAIL PROTECTED] Sent: Saturday, July 14, 2007 9:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Gary Could you post the lines in your virus.cfg file relating to this version of clam. I'm not sure what the entry should look like. The one below slams my cpu. it is not from sosdg, it's from clamwin. my old one is: #SCANFILE1 C:\Progra~1\ClamWin\bin\clamscan.exe --verbose --database=D:\IMail\Declude\Scanners\ClamAV\db --tempdir=D:\IMail\spool\proc\work --no-summary -l report.txt #VIRUSCODE 1 thanks John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Gary Steiner Sent: Friday, July 13, 2007 10:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations My situation is similar to yours. I started with F-Prot, then later added ClamAV. After Declude added AVG and F-Prot changed their pricing, I dropped F-Prot. I've been using the SOSDG port of ClamAV together with runclamd and runclamscan to take advantage of Clamd, and I've never had a problem with CPU usage. http://www.sosdg.org/clamav-win32 The latest version of SmarterMail now incorporates ClamAV (much like Declude and AVG), and they are using the SOSDG port. Gary Original Message From: John Doyle [EMAIL PROTECTED] Sent: Friday, July 13, 2007 8:03 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Don I ran F-Prot and Clam for years. Then when Declude added built in AV we turned that on and I dropped F-Prot when the licensing changed,So I ran Declude and Clam for about a year. I noticed at some point ClamAV was slamming the cpu and timing out. I had to turn it off. I'm not sure at what point ClamAV changed and have not had the time to look at running Clamd version to see if it has the same problem. So we are now running only the Declude scanner and I have the same nervousness as you do about only running one scanner John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Don Schreiner Sent: Thursday, July 05, 2007 6:23 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] AntiVirus Recommendations We have been using F-Prot for several years with great success. Their new mail server licensing change is too expensive. We tried the free Clam AV, but with heavy volume CPU was reaching 100%. I know Declude has built-in Virus Scanner, but we have always run F-Prot in addition. It seems necessary for extra protection, but perhaps now overkill? What are others using or recommend? What is best Virus scanner to keep the CPU cycles reasonable? We are running IMail 8.22, Declude 4.X, Message Sniffer, and invURI. Thanks. -Don Sent via CompBiz.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AntiVirus Recommendations
My situation is similar to yours. I started with F-Prot, then later added ClamAV. After Declude added AVG and F-Prot changed their pricing, I dropped F-Prot. I've been using the SOSDG port of ClamAV together with runclamd and runclamscan to take advantage of Clamd, and I've never had a problem with CPU usage. http://www.sosdg.org/clamav-win32 The latest version of SmarterMail now incorporates ClamAV (much like Declude and AVG), and they are using the SOSDG port. Gary Original Message From: John Doyle [EMAIL PROTECTED] Sent: Friday, July 13, 2007 8:03 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] AntiVirus Recommendations Don I ran F-Prot and Clam for years. Then when Declude added built in AV we turned that on and I dropped F-Prot when the licensing changed,So I ran Declude and Clam for about a year. I noticed at some point ClamAV was slamming the cpu and timing out. I had to turn it off. I'm not sure at what point ClamAV changed and have not had the time to look at running Clamd version to see if it has the same problem. So we are now running only the Declude scanner and I have the same nervousness as you do about only running one scanner John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Don Schreiner Sent: Thursday, July 05, 2007 6:23 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] AntiVirus Recommendations We have been using F-Prot for several years with great success. Their new mail server licensing change is too expensive. We tried the free Clam AV, but with heavy volume CPU was reaching 100%. I know Declude has built-in Virus Scanner, but we have always run F-Prot in addition. It seems necessary for extra protection, but perhaps now overkill? What are others using or recommend? What is best Virus scanner to keep the CPU cycles reasonable? We are running IMail 8.22, Declude 4.X, Message Sniffer, and invURI. Thanks. -Don Sent via CompBiz.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Country code
According to the whois at www.arin.net, 41.0.0.0/8 belings to AFRINIC, and if you go to www.afrinic.net and use the whois there, the numbers break down like this: 41.223.109.25 KE (Kenya) 41.207.19.204 CI(Cote d'Ivoire) 41.207.9.101 CI (Cote d'Ivoire) 41.207.2.163 CI (Cote d'Ivoire) 41.207.1.44 CI (Cote d'Ivoire) 41.221.17.90 DZ (Algeria) etc. So maybe this is just an error in the all_list.dat file. Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Thursday, July 05, 2007 11:11 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Country code Date Time Test FromDomain IP CountryCode 6/18/2007 6:38:50 AM COUNTRY-UNUSED goodvibesvideo.com 41.223.109.25*F 6/18/2007 4:00:28 AM COUNTRY-UNUSED reefreef.com 41.223.109.25*F 6/27/2007 6:52:38 AM COUNTRY-UNUSED yunishop.com 41.207.19.204*F 6/15/2007 5:29:54 AM COUNTRY-UNUSED farmprogress.com 41.207.9.101 *F 6/23/2007 1:07:05 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:03 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:05 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:02 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:02 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:06 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:00 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:01 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:08 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:54 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:22 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:53 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:54 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:54 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:45 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:53 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:00 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:08 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:02 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:06:54 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:13 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:25 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:22 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:22 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:08 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:08 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:05 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:21 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/23/2007 1:07:23 AM COUNTRY-UNUSED yahoo.fr 41.207.2.163 *F 6/24/2007 1:52:32 PM COUNTRY-UNUSED farmprogress.com 41.207.1.44 *F 6/18/2007 4:35:46 PM COUNTRY-UNUSED yahoo.fr 41.207.2.162 *F 6/10/2007 2:28:58 PM COUNTRY-UNUSED nospammail.net 41.221.17.90 *F 6/2/20073:31:37 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:14 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:13 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:14 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:14 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:14 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:31 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20073:02:02 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20073:02:07 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20072:56:14 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/20073:35:02 AM COUNTRY-UNUSED yahoo.fr 41.207.4.221 *F 6/2/2007
re: [Declude.JunkMail] Bulk Outbound Mailer
One of my customers is using GroupMail to send out a monthly newsletter along with occasional announcements to a school mailing list. His list currently has between 400-500 members. He is using the free version of GroupMail. http://www.group-mail.com/asp/common/groupmail.asp?ct=232 Original Message From: David Barker [EMAIL PROTECTED] Sent: Monday, July 02, 2007 5:42 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Bulk Outbound Mailer We have a customer who needs to do legitimate :) bulk outbound emailing. He had asked if I knew of any software that can be used to do this. The issue is he uses Imail but the amount of outbound email puts to much strain on server. I said that I would post and ask our loyal Declude customer base. Any ideas ? David Barker VP Operations | Declude Your Email Security is our business O: 978.499.2933 x7007 F: 978.988.1311 E: [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] all_list.dat
The corrupt RIPE data should be referring to 145.53.30.139. Though if you go to www.ripe.net and do a search, 145.53.0.0/16 is listed as belonging to Planet Technologies with an email address of [EMAIL PROTECTED] and being in The Netherlands. Which is essentially the same as the listing for 213.75.0.0/16. Unfortunately the entries in the RIPE database don't have dates associated with them, so you can't tell if those listings were the same back in May when the all_list.dat was created. The listings change all the time, so essentially the all_list.dat file is outdated as soon as it comes out. And it also doesn't help that RIPE, ARIN, APNIC, LACNIC, etc. are all separate independent entities with separate databases, so when things change Declude has to look in many places to update the all_list.dat. Gary Original Message From: Bonno Bloksma [EMAIL PROTECTED] Sent: Friday, June 29, 2007 4:15 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] all_list.dat Hi, I'm using the all-list.dat from may 2007. Occasionaly I was checking the declude junkmail logs to see if any new problems with unknown networks would arise. But today I found out that information is not in the Declude log at level high. In the headers of a mail I found: X-Country-Chain: 'EU' [corrupt RIPE data]-NETHERLANDS-destination The Received lines are: Received: from hpsmtp-eml16.kpnxchange.com [213.75.38.116] by student.tio.nl with ESMTP (SMTPD-9.21) id A48204B4; Fri, 29 Jun 2007 08:19:46 +0200 Received: from hpsmtp-eml05.kpnxchange.com ([213.75.38.105]) by hpsmtp-eml16.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 29 Jun 2007 08:19:46 +0200 Received: from colligno601a0c ([145.53.30.139]) by hpsmtp-eml05.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 29 Jun 2007 08:19:45 +0200 In the loglines for this message there is no mention of corrupt RIPE data which is what I was looking for all the time. So: 1) Can we have a new all_list.dat with updated info please. KPN is a large telco which has 4 ISPs covering the Netherlands. 2) In what way can I detect when the all_list.dat file is getting oudated, when information about networks is missing/corrupt? Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool hotelmanagement en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 [EMAIL PROTECTED] / www.tio.nl --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] tqmcube.com
I've been using them for a while. dhcp.tqmcube.com has given good results, though I've gotten one or two false positives from spam.tqmcube.com (I still use spam.tqmcube.com, just with a lighter weight). ko.tqmcube.com flags ip's from South Korea, and prc.tqmcube.com flags ip's from China, so they are roughly the same as a country filter. I use those two as tests also, and the only instance where I've had trouble with that is a customer that works with a company called Emerson Process who routes their email in a really strange way. Check this out: Received: from ets-lonint02.emrsn.co.uk [80.79.80.101] by mail.plusultraweb.com with SMTP; Mon, 14 May 2007 09:58:26 -0400 Received: from ets-lonvir02.emrsn.co.uk ([129.130.102.103]) by ets-lonint02.emrsn.co.uk (8.12.11/8.12.11) with ESMTP id l4EDxk1l011490 for [EMAIL PROTECTED]; Mon, 14 May 2007 14:59:46 +0100 Received: from ets-lonprx03.emrsn.co.uk ([129.130.102.119]) by ets-lonvir02.emrsn.co.uk with InterScan Messaging Security Suite; Mon, 14 May 2007 14:58:37 +0100 Received: from etsmsg-lonexs01.etsmsg.org (mxsemeabb1.emrsn.co.uk [129.254.5.200]) by ets-lonprx03.emrsn.co.uk (8.12.11/8.12.11) with ESMTP id l4EDwGZp025604; Mon, 14 May 2007 14:58:16 +0100 Received: from etsmsg-lonexr01.etsmsg.org ([129.254.5.213]) by etsmsg-lonexs01.etsmsg.org with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:58:37 +0100 Received: from gbedc-exr02.ema.emersonprocess.com ([129.130.110.15]) by etsmsg-lonexr01.etsmsg.org with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:58:36 +0100 Received: from spmad-exm01.ema.emersonprocess.com ([129.76.41.6]) by gbedc-exr02.ema.emersonprocess.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 14 May 2007 14:58:35 +0100 All of this causes Declude to generate the following: X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [210f]. X-Country-Chain: UNITED STATES-KOREA-KR-UNITED STATES-UNITED KINGDOM-destination Emerson Process is a global company, and I assume they own or rent all those servers in the route, but it's still a weird way to send a message. Gary Original Message From: Kevin Bilbee [EMAIL PROTECTED] Sent: Monday, May 14, 2007 5:26 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] tqmcube.com Anyone have any comments about these guys? Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam reduction ?
May 1st is a big holiday in Europe, so maybe that had some affect. Original Message From: Heimir Eidskrem [EMAIL PROTECTED] Sent: Friday, May 04, 2007 12:45 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Spam reduction ? IS - Systems Eng. (Karl Drugge) wrote: Anyone else seeing a major reduction is spam the past week ? I usually see about 14-15k messages daily, but since Monday have dropped off to about 8k... Did the recent arrests and law suits have a result this early ? *Karl Drugge* *B.S.I.T., A.S., M.C.S.E. ( NT 4.0, 2000, 2003 ), M.C.S.A. ( 2000 + 2003 ), C.C.N.A., Network+, A+* */I dream of the day when I will learn to stop asking questions to which I will regret learning the answers ( Roy Greenhilt, Order of the Stick ) /* --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Been seeing the same. We normally do about 120,000 emails per day but the last week we went down to 95,000 or so. Percent of spam dropped too. We had a crazy job job hit our servers and I thought was related to that but maybe not. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Adding weight by country
You can find it in the knowledgebase at http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=8956 To get a perspective on how it is being used by different folks represented on the mailing list, go to http://www.mail-archive.com/declude.junkmail@declude.com/ and do a search on the word COUNTRIES. Original Message From: Bill Green dfn Systems [EMAIL PROTECTED] Sent: Tuesday, May 01, 2007 8:44 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Adding weight by country I've noticed that most of the spam getting through my declude/sniffer/invuribl setup is coming from certain countries. I would like to add weight to mail from those countries. I've seen discussion on how to do this on the list, but now that I look for it, the only entries I can find are too obscure. I believe it is a custom filter with the word country or countries in the text file? Am I way off base? I can't find it in the manual at all. Can someone pitch me a link, or some other bone? Declude 4.x (latest build) Bill Green dfn systems --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] CMDSPACE/SmarterMail
David,
Has any progress been made on this issue? Using SmarterMail Enterprise 3.3.2621
and Declude 4.3.40, I still am not seeing CMDSPACE getting any hits.
Gary Steiner
Original Message
From: Gary Steiner [EMAIL PROTECTED]
Sent: Thursday, January 04, 2007 1:09 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail
David,
Has any progress been made on this issue? Using SmarterMail Enterprise
3.3.2439 and Declude 4.3.23, I still am not seeing CMDSPACE getting any hits.
Gary Steiner
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Monday, November 13, 2006 10:38 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail
I am looking for more information regarding this issue.
Is this unique to the SM Enterprise Edition?
Also, does it seem to be related to a specific version of Declude?
Any help with this would be appreciated.
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran
Jovanovic
Sent: Friday, November 10, 2006 5:44 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail
My understanding from quite a while ago is that SmarterMail did not pass the
CMDSPACE info on to Declude (somehow). So the test is irrelevant in
SmarterMail. Maybe this has been corrected in some newer version of
SmarterMail??
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Friday, November 10, 2006 3:40 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail
Thanks, David. It's little things like this short acknowledging message
that can go miles towards making your customers feel better about Declude's
support.
Gary
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Friday, November 10, 2006 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail
I see that too, I will look into this.
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Gary
Steiner
Sent: Friday, November 10, 2006 2:27 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] CMDSPACE/SmarterMail
I'm also using SmarterMail Enterprise Edition 3.3.2439 and Declude
4.3.14,
and have had CMDSPACE configured for quite a while, but hadn't thought
anything about it. When I saw your message I ran DLanalyzer on my
logs for
the past two weeks and saw that there were no hits for CMDSPACE at
all. So
it seems I am experiencing the same problem.
Gary
Original Message
From: Michael Jaworski [EMAIL PROTECTED]
Sent: Friday, November 10, 2006 10:45 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] CMDSPACE/SmarterMail
We just started using CMDSPACE and noticed the test does not appears
to be working on SmarterMail Enterprise Edition 3.3.2439 and Declude
4.3.14. I am not seeing any errors in the debug level logs files. A
check of the release logs it appears support for CMDSPACE test in
Smartermail was provided in 4.0.9. (Feb 2006) Anyone seeing the same
thing?
Here are my relevant entries without quotes:
Global.cfg - CMDSPACE cmdspaceX X 8
0
$default$.junkmail - CMDSPACE WARN
Mike
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] dnsbl.antispam.or.id
Is dnsbl.antispam.or.id working? I haven't gotten any hits off it for over two months, but I haven't seen anything posted about it being discontinued or shut down. Anyone else having good/bad luck with it? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] OT: Yahoo Email Problems
Here's an interesting recent post from the SmarterMail forums that covers this topic: http://forums.smartertools.com/forums/thread/30555.aspx Original Message From: Dave Beckstrom [EMAIL PROTECTED] Sent: Thursday, March 29, 2007 12:44 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: Yahoo Email Problems Sorry about the off-topic post. This is the only email server software related list that I am on. I tried to send a couple of email to a Yahoo group and received this message back: Reason: Remote host said: 451 qq unable to read configuration (#4.3.0) Is that a problem with Yahoo or are they blocking email from me? It looks to me like a problem with Yahoo, but I thought I'd run in by you to see what you thought. Thanks, Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filtering question
Have you tried DLanalyzer? http://www.invariantsystems.com/dlanalyzer/ There is a free version that you can use for evaluation. Original Message From: IS - Systems Eng. \(Karl Drugge\) [EMAIL PROTECTED] Sent: Wednesday, March 21, 2007 9:35 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Filtering question Oh well, didn't think there was. I just wanted to get a statistical sampling of what I was deleting. Karl Drugge -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, March 21, 2007 9:01 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Filtering question Hi Karl, Unfortunately not, we don't count emails other than in the console.txt file David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Wednesday, March 21, 2007 8:57 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Filtering question I am trying to get some stats off of my Declude. It would help if I could set Declude to send me every fifth, or tenth, or one hundredth email that I have set to delete, or route-to. Is there a way to do this ? Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] PCRE FILTERING
Here are some web pages you might check out: http://www.cecilw.com/eudora/regexp.htm http://www.adamlyon.com/spam/spam_filter_regex.html http://www.adamlyon.com/spam/afo.txt http://trac.edgewall.org/wiki/BadContent http://www.regexlib.com/ Hopefully at some point Declude will post a list of good examples on their web site. Gary Original Message From: John Olden [EMAIL PROTECTED] Sent: Friday, March 16, 2007 4:58 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] PCRE FILTERING Would anyone be willing to share their regular expressions files (lines) with the group? I know this will be a valuable addition to Declude but most of us don't want to (or know how to) re-invent the wheel. Thanks. -- John Olden - Technology Manager Champaign Park District --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Next Declude Release
In looking for a PCRE/regex for dummies, found these links: http://en.wikipedia.org/wiki/PCRE http://www.pcre.org/ http://gnuwin32.sourceforge.net/packages/pcre.htm http://www.english.uga.edu/humcomp/perl/regex2a.html http://www.regular-expressions.info/ http://www.regex.info/ Original Message From: David Barker [EMAIL PROTECTED] Sent: Wednesday, February 28, 2007 4:21 PM To: declude.junkmail@declude.com, declude.virus@declude.com Subject: [Declude.JunkMail] Next Declude Release Just a quick update next release scheduled for 12 March. FIX ZEROHOUR passing weight to SM when email WHITELISTED (occurred 4.3.30) FIX Ignore Case checking in Imail Address book 2006 FIX Improved performance when OUTBOUNDSPAMSCANNING OFF FIX Updated CommTouch ZEROHOUR Dll FIX EXITSCANONVIRUSDETECT ON works between AVG and Commtouch ADD Support for Regular Expressions in the Filters using PCRE library Currently testing the PCRE and it's looking good. Time to brush up on your PCRE syntax. The format will be in the filters: LOCATION WEIGHT PCREEXPRESSION Example: BODY 5 PCRE(?i:v\s*[i!|]+\s*a\s*g\s*r\s*a) David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Built in AV
You should see one of these in your virus.cfg file: BUILTINSCANNEROFF BUILTINSCANNERON Though I believe the default is ON. I don't think it uses scanner 0 anymore. If AVG finds something, you should see a line in the log file that contains AVG Reports VIRUS: Original Message From: Serge [EMAIL PROTECTED] Sent: Monday, February 26, 2007 9:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Built in AV BlankDavid, For some reason i do not see scanner 0 in my logs anymore, does this mean the built in scanner is not working ? How do I check ? How do i activate it ? V 4.3.23 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: SPF record question
Thanks for that tip Shayne. It seems that my SPF implementation is passed by gmail. Original Message From: Shayne Embry [EMAIL PROTECTED] Sent: Sunday, February 18, 2007 9:30 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: SPF record question Gary, One good way to check your SPF implementation is to send a message to a gmail account. Gmail will allow you to see the entire message header and includes a line showing that Google checks for SPF. Shayne Original Message From: Shayne Embry [EMAIL PROTECTED] Sent: Sunday, February 18, 2007 8:06 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: SPF record question Gary, You are correct. Message from authenticated accounts to other accounts on your server will show the originating IP as the last hop. Be assured, this is not the case with messages leaving your server bound for other locations. We've been using SPF and SmarterMail successfully for several years; in fact, it has saved our butts on several occasions. As for Hotmail, Yahoo, AOL and the like, it's always a crap shoot anyway. We have one client that sends a weekly newsletter; one week everything runs smoothly and the next we'll get 100 messages back from Yahoo. We've given up trying to figure it out, but SPF is not the culprit. Shayne Embry Original Message From: Gary Steiner [EMAIL PROTECTED] Sent: Sunday, February 18, 2007 1:54 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: SPF record question No, I never belived that the SPF check was run against all the received headers. I'm just looking at how Declude does its SPF check on email that comes into my server. It always does it on the last hop. But looking at the headers of the outgoing messages, (as I showed in my message below from February 16, 2007 4:10 PM), the last hop is shown as the IP address of the originating Outlook sender. This is why I am confused. Maybe this is a flaw in SmarterMail in that it does not list itself in the headers of messages that are internal to the server. I'm just not comfortable with SPF and am worried that I am shooting myself in the foot by providing a method for other servers to block my legitimate mail. I probably should have done more testing first, but I don't really have a good way to specifically check for SPF validity. For example, I created a Yahoo account and a Hotmail account. I sent email from my server to each. Hotmail sent my message to its junkmail folder, Yahoo did not. I have no way to know why Hotmail chose to flag the email as junk and Yahoo did not, as neither add any spam checking messages to the header. I can see that both do list my mail server as the last hop and not the originating Outlook computer as the messages in my server's webmail do. At this point maybe I will just wait and see if any of my customers complain about bounced mail. If I don't hear any complaints, then I (probably) don't have anything to worry about. Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: SPF record question
No, I never belived that the SPF check was run against all the received headers. I'm just looking at how Declude does its SPF check on email that comes into my server. It always does it on the last hop. But looking at the headers of the outgoing messages, (as I showed in my message below from February 16, 2007 4:10 PM), the last hop is shown as the IP address of the originating Outlook sender. This is why I am confused. Maybe this is a flaw in SmarterMail in that it does not list itself in the headers of messages that are internal to the server. I'm just not comfortable with SPF and am worried that I am shooting myself in the foot by providing a method for other servers to block my legitimate mail. I probably should have done more testing first, but I don't really have a good way to specifically check for SPF validity. For example, I created a Yahoo account and a Hotmail account. I sent email from my server to each. Hotmail sent my message to its junkmail folder, Yahoo did not. I have no way to know why Hotmail chose to flag the email as junk and Yahoo did not, as neither add any spam checking messages to the header. I can see that both do list my mail server as the last hop and not the originating Outlook computer as the messages in my server's webmail do. At this point maybe I will just wait and see if any of my customers complain about bounced mail. If I don't hear any complaints, then I (probably) don't have anything to worry about. Gary Original Message From: Michael Thomas - Mathbox [EMAIL PROTECTED] Sent: Sunday, February 18, 2007 12:03 AM To: declude.junkmail@declude.com Subject: RE: SPAM-WARN:Re: [Declude.JunkMail] OT: SPF record question Darin, I am not sure why, but Gary seems to think SPF checks are run against ALL of the received headers. I am guessing that he has an SPF test action at the end of his Global.cfg, so that it is testing outgoing? Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Saturday, February 17, 2007 11:37 PM To: declude.junkmail@declude.com Subject: SPAM-WARN:Re: [Declude.JunkMail] OT: SPF record question Yes, it does. Message come in from your mail client and is whitelisted by SMTP AUTH. Now your server sends it to the destination. Receiving server sees the message coming from your server, and that your server is a valid sender for the domain in question according to your SPF policy. The last hop seen by the destination is your server, not your mail client. Your server satisfies your SPF policy, therefore the receiving server checks and records an SPF PASS. Forget about the client, as long as they send through your server, and you don't filter them out... either because they AUTH and you whitelist on AUTH, or any other way you avoid filtering your connecting users. Its all about your server sending to the destination server. This has been working for us for the past year and a half or so. Darin. - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, February 17, 2007 11:22 PM Subject: Re: [Declude.JunkMail] OT: SPF record question My question still isn't coming across. In setting up SPF, I don't want any outgoing messages from my server to be bounced by others because of a bad SPF string. I can whitelist SMTP auth on my server, but that does't help the SPF problem because potentially when one of my users sends a message to someone, say on hotmail.com, it could get bounced because of bad SPF. For example, say my SPF string for my domain is v=spf1 mx mx:smtp.mydomain.com -all. This allows any email sent via my SmarterMail webmail to pass SPF. Now, if one of my users connects to the server with Outlook and SMTP Auth, and uses this to send an email, then the IP address that shows up in the last hop is the one he used to connect to my sever, not the IP address of my server. So the email message he sends would fail SPF. For it to pass, I would have to change my SPF string to v=spf1 mx mx:smtp.mydomain.com ip4:67.189.34.6 -all, and additionally add a ip4: entry for every instance that a user might connect to my server with Outlook . So does this mean that SPF is impractical for anyone not strictly using webmail? To me it implies that to cover all bases you would have to have in your SPF string ?all and there would be no way to make it stricter than that, other than to force all your users to use webmail and not Outlook. Gary Original Message From: Darin Cox [EMAIL PROTECTED] Sent: Friday, February 16, 2007 4:33 PM To: declude.junkmail@declude.com Subject: Re: SPAM-WARN:Re
Re: [Declude.JunkMail] OT: SPF record question
I have a question to follow this subject. If users have Outlook and they are sending email fromm home or whereever using authentication, then the IP that shows up in the header will be their home connection. That being the case, unless your users are strictly using webmail, your SPF record should show no enforcement otherwise all the non-webmail messages will get blocked. To me this indicates that SPF doesn't help you if your users are not using webmail. Is this correct? Gary Original Message From: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, February 07, 2007 4:33 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: SPF record question If your MX and A records are also in the 216.15.92.0/25 network, then you don't need to specify the a and mx parameters, so you could simplify to No enforcement, other hosts may send mail for the domain v=spf1 ip4:216.15.92.0/25 ?all Soft fail if policy violated. Filters may or may not block on soft fail. v=spf1 ip4:216.15.92.0/25 ~all Hard fail if policy violated. Filters should block on hard fail. v=spf1 ip4:216.15.92.0/25 -all However, if you send from an MX or A record (web server) that is not in the 216.15.92.0/25 subnet then you may need those. If you use a soft or hard fail policy, it's very important that you identify _all_ sources of outbound mail for the domain, including all mail servers, marketing mail engines, webservers, external hosts, etc. Otherwise you're liable to have mail blocked as a result of your policy. I've see this happen with a number of larger organizations, where they have forgotten web servers with form-to-mail functions, marketing personnel sending out newsletters, or mobile users using ISP SMTP servers. Regarding your last three records, do you have subdomains with MX records for direct.commarts.com, mail.commarts.com, and smtp.commarts.com? I.e. do you receive mail to @direct.commarts.com, @mail.commarts.com, and @smtp.commarts.com addresses? If not, you don't need those records. Hope this helps, Darin. - Original Message - From: Michael Hoyt [EMAIL PROTECTED] To: Declude JunkMail @declude.com Declude.JunkMail@declude.com Sent: Wednesday, February 07, 2007 2:30 PM Subject: [Declude.JunkMail] OT: SPF record question Sorry for the re-posting but I forgot to add a Subject. I am finally getting my SPF records up but would like some comments on whether I got it right. I would like to be able to send email from any IP address in my 216.15.92.0/25 network. Currently I have MX records for mail.commarts.com (216.15.92.3) which is the only mail server that receives mail and direct.commarts.com (216.15.92.15) and smtp.commarts.com (216.15.92.13). Using the Wizard at openspf.org I generated the following SPF records: commarts.com. IN TXT v=spf1 ip4:216.15.92.0/25 a mx ~all direct.commarts.com. IN TXT v=spf1 a -all mail.commarts.com. IN TXT v=spf1 a -all smtp.commarts.com. IN TXT v=spf1 a -all After reading page 15 of the Whitepaper pertaining to the ~all,-all or ?all part of the text in the first record my question is: If I know that ALL email from my domain will originate from 216.15.92.0/25 should the text be -all and not ~all? And my last question is are the three txt records mentioning my MX servers necessary if I have 216.15.92.0/25 in the first record? Thank you in advance for any insight. -- Michael Hoyt Web Site: http://www.commarts.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: SPAM-WARN:Re: [Declude.JunkMail] OT: SPF record question
Let me give you my case. For this example I used my home Comcast connection to send an email using Outlook and authentication. My server uses Declude and SmarterMail. The header of the received message shows one IP address in a single Received line: Received: from c-67-189-34-6.hsd1.or.comcast.net [67.189.34.6] by mail.plusultraweb.com with SMTP; Fri, 16 Feb 2007 15:43:21 -0500 Michael's message via Declude's mailing list had three Received lines: Received: from smtp.declude.com [63.246.31.248] by mail.plusultraweb.com with SMTP; Fri, 16 Feb 2007 15:46:48 -0500 Received: from mail.mathbox.com [63.150.236.14] by smtp.declude.com with SMTP; Fri, 16 Feb 2007 15:31:18 -0500 Received: from mikesplace [63.150.236.3] by mail.mathbox.com with ESMTP (SMTPD-8.22) id A48F027C; Fri, 16 Feb 2007 15:31:11 -0500 In both messages Declude made checks versus the last hop only (67.189.34.6 in my test message and 63.246.31.248 in the message from Declude's mailing list. Since my Comcast IP address is not listed in my SPF string, it failed Declude's SPF test. So what is the problem here? Is this a flaw in how SmarterMail lists its hops? Should it be showing the Comcast IP address as the final hop, or should it be showing my mail server? Since it is showing the Comcast address, SPF fails. The only way to get around this is to end the SPF string with ?all, but if I'm going to do that, I might as well not use SPF at all. Gary Original Message From: Michael Thomas - Mathbox [EMAIL PROTECTED] Sent: Friday, February 16, 2007 3:47 PM To: declude.junkmail@declude.com Subject: RE: SPAM-WARN:Re: [Declude.JunkMail] OT: SPF record question Gary, Your logic is incorrect. SPF is a check made by the destination mail server (possibly my mail server) against the sending mail server (your mail server). Your users authenticate to your mail server, then submit a message to your mail server for delivery by your mail server to the remote mail server. So, the remote mail server (possibly my mail server) would check the SPF to determine if your mail server was listed as a source for the domain of the sending email address. Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, February 16, 2007 2:56 PM To: declude.junkmail@declude.com Subject: SPAM-WARN:Re: [Declude.JunkMail] OT: SPF record question I have a question to follow this subject. If users have Outlook and they are sending email fromm home or whereever using authentication, then the IP that shows up in the header will be their home connection. That being the case, unless your users are strictly using webmail, your SPF record should show no enforcement otherwise all the non-webmail messages will get blocked. To me this indicates that SPF doesn't help you if your users are not using webmail. Is this correct? Gary Original Message From: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, February 07, 2007 4:33 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] OT: SPF record question If your MX and A records are also in the 216.15.92.0/25 network, then you don't need to specify the a and mx parameters, so you could simplify to No enforcement, other hosts may send mail for the domain v=spf1 ip4:216.15.92.0/25 ?all Soft fail if policy violated. Filters may or may not block on soft fail. v=spf1 ip4:216.15.92.0/25 ~all Hard fail if policy violated. Filters should block on hard fail. v=spf1 ip4:216.15.92.0/25 -all However, if you send from an MX or A record (web server) that is not in the 216.15.92.0/25 subnet then you may need those. If you use a soft or hard fail policy, it's very important that you identify _all_ sources of outbound mail for the domain, including all mail servers, marketing mail engines, webservers, external hosts, etc. Otherwise you're liable to have mail blocked as a result of your policy. I've see this happen with a number of larger organizations, where they have forgotten web servers with form-to-mail functions, marketing personnel sending out newsletters, or mobile users using ISP SMTP servers. Regarding your last three records, do you have subdomains with MX records for direct.commarts.com, mail.commarts.com, and smtp.commarts.com? I.e. do you receive mail to @direct.commarts.com, @mail.commarts.com, and @smtp.commarts.com addresses? If not, you don't need those records. Hope this helps, Darin. - Original Message - From: Michael Hoyt [EMAIL PROTECTED] To: Declude JunkMail @declude.com Declude.JunkMail@declude.com Sent: Wednesday, February 07, 2007 2:30 PM Subject: [Declude.JunkMail] OT: SPF
re: [Declude.JunkMail] Specific filter for individual users
What you will have to do is set up a $default$.junkmail file for each user that wants a unique configuration. Check out http://manuals.declude.com/ProcOnlineHelp/JunkMail_4.0.8_Per-User_Configuration.htm Original Message From: Kelly Scotto [EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 1:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Specific filter for individual users Can someone show an example of how to create individual filters for different users. I have a few customers who would like stronger filtering, for instance I delete at a weight of 8. For some users I would like to delete at 6. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] fuzzyOCR
Is there some equivalent of fuzzyOCR that can be used with Declude? http://fuzzyocr.own-hero.net/wiki/WhatisFuzzyOcr --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterMail 4.0 is released
SmarterTools just released the next major version of SmarterMail. It has been rewritten in ASP.NET 2.0 from which they claim across the board performance improvements. Major new features include greylisting and built-in ClamAV, as well as better features for use as a gateway. For a list of new features see http://www.smartertools.com/Products/SmarterMail/WhyUpgrade.aspx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] all_list.dat ?
David (or any Declude people that may be reading), Any chance of seeing a new all_list.dat any time soon, considering the current one has a date of 6 Jul 06, and considering the additional input from this recent thread? I'm starting to see false positives caused by weights I previously gave to IANA Reserved and RIPE Unlisted. Gary Original Message From: Jay Sudowski - Handy Networks LLC [EMAIL PROTECTED] Sent: Thursday, January 04, 2007 5:57 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] [IANA Reserved] ? Indeed. When we obtained our own IP space from ARIN, it was from 72/8, which had been released only about 6 months prior to it being assigned to us. You wouldn't believe the number of networks that were running with 72/8 in their bogons list and were entirely blocking traffic from our network... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Thursday, January 04, 2007 3:47 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] [IANA Reserved] ? I would be very careful with this. IANA just released (I believe in October) 96/8, 97/8, 98/8, 99/8. With the all_list.dat not being updated frequently I would tred very lightly in this area. Part of 96/8 has been handed out. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: S.J.Stanaitis [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, January 04, 2007 3:29 PM Subject: RE: [Declude.JunkMail] [IANA Reserved] ? Nice. Thanks, Sam SJ.Stanaitis - Network Administrator Decorative Product Source E-commerce Network -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, January 04, 2007 3:16 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] [IANA Reserved] ? sending hop only: COUNTRY 0 IS *R or all hops: COUNTRIES 0 CONTAINS *R - Original Message - From: S.J.Stanaitis [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, January 04, 2007 1:55 PM Subject: RE: [Declude.JunkMail] [IANA Reserved] ? Holy [EMAIL PROTECTED], that answers one question! Any idea how to incorporate the IANA Reserved thing into Declude? Thanks, Sam SJ.Stanaitis - Network Administrator Decorative Product Source E-commerce Network -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, January 04, 2007 2:37 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] [IANA Reserved] ? Here are my december totals for the odd-balls (COUNTRY IS test) Country Name CountOfMessageID DEL SPAM HELD SPAM Poss SPAM OK APNIC Unlisted 97 97 0 0 0 ARIN Unlisted 1426 1395 12 1 18 Central/South America 89 89 0 0 0 European Union 1804 1674 8 1 121 IANA Reserved 11677 11428 91 118 39 Multi-Regional 23 19 1 1 2 RIPE Unlisted 1332 1330 1 1 0 Unknown 4018 3938 13 3 64 # # Special Codes # #*1 Multi-Regional #*2 Europe #*3 North America #*4 Central/South America #*5 Pacific Rim #*A ARIN Unlisted (North America/South Africa) #*B Public Data Network #*E RIPE Unlisted (Europe, North Africa, Middle East) #*I Private IP #*L Loopback #*M Multicast #*P APNIC Unlisted (Asia Pacific) #*R IANA Reserved #*U Unknown - Original Message - From: S.J.Stanaitis [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, January 04, 2007 1:02 PM Subject: [Declude.JunkMail] [IANA Reserved] ? I currently tag each incoming email from a country other than the US (with few exceptions) with a weight of 10. Some emails come in with [IANA Reserved] in the X-Country-Chain header and as such these emails (originating in places like Amsterdam, etc) aren't affected by the FILTER-COUNTRY filter. Any way to add a weight to those IP's too? Do American IP's show up as IANA Reserved ever? Thanks, Sam SJ.Stanaitis - Network Administrator Decorative Product Source E-commerce Network --- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] CMDSPACE/SmarterMail
David, Has any progress been made on this issue? Using SmarterMail Enterprise 3.3.2439 and Declude 4.3.23, I still am not seeing CMDSPACE getting any hits. Gary Steiner Original Message From: David Barker [EMAIL PROTECTED] Sent: Monday, November 13, 2006 10:38 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail I am looking for more information regarding this issue. Is this unique to the SM Enterprise Edition? Also, does it seem to be related to a specific version of Declude? Any help with this would be appreciated. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Friday, November 10, 2006 5:44 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail My understanding from quite a while ago is that SmarterMail did not pass the CMDSPACE info on to Declude (somehow). So the test is irrelevant in SmarterMail. Maybe this has been corrected in some newer version of SmarterMail?? Goran Jovanovic Omega Network Solutions -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, November 10, 2006 3:40 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail Thanks, David. It's little things like this short acknowledging message that can go miles towards making your customers feel better about Declude's support. Gary Original Message From: David Barker [EMAIL PROTECTED] Sent: Friday, November 10, 2006 3:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail I see that too, I will look into this. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, November 10, 2006 2:27 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] CMDSPACE/SmarterMail I'm also using SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14, and have had CMDSPACE configured for quite a while, but hadn't thought anything about it. When I saw your message I ran DLanalyzer on my logs for the past two weeks and saw that there were no hits for CMDSPACE at all. So it seems I am experiencing the same problem. Gary Original Message From: Michael Jaworski [EMAIL PROTECTED] Sent: Friday, November 10, 2006 10:45 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] CMDSPACE/SmarterMail We just started using CMDSPACE and noticed the test does not appears to be working on SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14. I am not seeing any errors in the debug level logs files. A check of the release logs it appears support for CMDSPACE test in Smartermail was provided in 4.0.9. (Feb 2006) Anyone seeing the same thing? Here are my relevant entries without quotes: Global.cfg - CMDSPACEcmdspaceX X 8 0 $default$.junkmail - CMDSPACEWARN Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Taiwan earthquake
Anybody notice a significant drop in spam? From the CNN web site: Quake knocks Asia back to pre-Internet days http://www.cnn.com/2006/WORLD/asiapcf/12/27/taiwan.quake.ap/index.html --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Virus sneaking past Declude/AVG/F-PROT?
Submit a sample through http://www.virustotal.com and it will show you which anti-virus programs are currently identifying it. Gary Original Message From: S.J.Stanaitis [EMAIL PROTECTED] Sent: Friday, December 22, 2006 4:09 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Virus sneaking past Declude/AVG/F-PROT? I've got a single mailbox on my Imail server configured to get all the SPAM. It's then processed in TheBat! (Exciting, I know. Take a moment and revel.) Anyhow, my Symantec Antivirus is snagging a slew of Trojan.Dowiex!inf which it identifies as a low risk Trojan horse. I've got Declude 4 running both AVG and F-Prot and it snuck past. Anyone else seeing this? http://www.symantec.com/security_response/writeup.jsp?docid=2006-121817-5005 -99 Thanks, Sam SJ.Stanaitis - Network Administrator Decorative Product Source E-commerce Network --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Whitelist IP for one domain
It's better to weight your whitelist rather than have an IP be fully
whitelisted. You would have an entry like this
WHITELIST-IPipfile C:\{MAILSERVER}\Declude\Filters\WHITELIST-IP.txt
x -20 0
In the file WHITELIST-IP.txt you would have something like this
123.456.78.90 Identifier or reason for whitelisting
Then create a custom $default$.junkmail file for that particular domain. In
your Declude directory create a directory with the name of the domain, and put
the custom $default$.junkmail file in that directory with the entry for the new
ipfile included.
WHITELIST-IP WARN
That should do it. You can read more about using a custom $default$.junkmail
file for a domain at
http://manuals.declude.com/ProcOnlineHelp/JunkMail_4.0.8_Per-Domain_Configuration.htm
Gary
Original Message
From: Dean Lawrence [EMAIL PROTECTED]
Sent: Wednesday, December 20, 2006 12:52 PM
To: declude.junkmail@declude.com declude.junkmail@declude.com
Subject: [Declude.JunkMail] Whitelist IP for one domain
I have a client who needs to have mail that is being sent from a
particular IP to be whitelisted. I don't want to whitelist this IP for
all of my other domains though. How might I go about this? I looked at
the whitelistfile option, but that doesn't accept an IP. Any thoughts?
Thanks,
--
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
re: [Declude.JunkMail] DNS Based Test - Bad Link on Web
It should read http://shopping.declude.com/Articles.asp?ID=97 When Declude updated its web site a couple months ago, they missed a lot of the old links. All you need to do with the old link is to change www to shopping. Original Message From: Mike Wiegers [EMAIL PROTECTED] Sent: Tuesday, December 19, 2006 10:10 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] DNS Based Test - Bad Link on Web http://www.declude.com/Articles.asp?ID=97 The link from the online manual isn't working. [DNS-based] There are over 50 different ip4r format DNS tests available. Click the link to the left for more information on tests not listed below. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] AVG
Regardless of which anti-virus program you are using, you can easily add ClamAV to give you an extra layer of protection (and it's free). Besides, I've often seen ClamAV pick up new viruses long before F-prot adds them. Gary Original Message From: Serge [EMAIL PROTECTED] Sent: Friday, December 15, 2006 8:44 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] AVG For those on 4.2.X, are you still using Fprot and/or McAfee ..., or are sticking with buit in AVG alone ? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Country Code
Declude has an entry in their Knowledge Base that lists the regions: http://support.declude.com/Customer/KBArticle.aspx?articleid=35KBSearchID=6746 As for country codes, the most official source is probably the IANA: http://www.iana.org/root-whois/index.html Thought they probably get their info from ISO 3166: http://www.iso.org/iso/en/prods-services/iso3166ma/02iso-3166-code-lists/list-en1.html The country codes change every so often. For example, the last change was in September 2006 when the country of Serbia and Montenegro (CS) was broken up into two elements, the Republic of Serbia (RS) and the Republic of Montenegro (ME). So if you have a filter for country codes, it is good to compare it to the ISO list for changes every so often. Gary Original Message From: scott_powner [EMAIL PROTECTED] Sent: Tuesday, December 05, 2006 11:11 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Country Code Ok - an oldie but a goodie: I was trying to display the actual country code in the header. I have the %countrychain% displaying but I seem to be missing a few country codes in my filter so I was trying to find out what codes the filter uses. Any ideas on how to display them? Thank you, Scott T Powner Scott T. Powner Director of Information Technology Midwestern Intermediate Unit IV 453 Maple St. Grove City, Pa. 16127 724.458.6700 ex 273 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterTools offline
For those SmarterMail owners who may have noticed that SmarterTools has been offline for over 24 hours, you can read about it here: http://www.crystaltech.com/forum/topic.asp?TOPIC_ID=16305 Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] How Accurate is Sniffer?
You might want to run it for a little while to see what results you get. I've gotten a lot of false positives with Sniffer. Gary Original Message From: David Dodell [EMAIL PROTECTED] Sent: Thursday, November 30, 2006 10:41 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How Accurate is Sniffer? I'm doing my 30 day trial of Message Sniffer .. at the moment it is 5 points out of 10 needed to mark something as spam. How accurate is Sniffer?Something that I can raise my weight on? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Blacklists Recommendations.
BLITZEDALL went offline in May (see http://opm.blitzed.org). Other than that, all the ones you are using I am also using. Other IP4R tests that I am using successfully that you are not: ADNSBL dnsbl.antispam.or.id BASURA bl.emailbasura.org CSMA-SBLbl.csma.biz IMP-SPAMspamrbl.imp.ch SWINOG dnsrbl.swinog.ch JAMMDNSBL dnsbl.jammconsulting.com PSBLpsbl.surriel.com SPAMBAG blacklist.spambag.org SPAMCANNIBALbl.spamcannibal.org TQM3-DYNA dhcp.tqmcube.com TQM3-SPAM spam.tqmcube.com MXRATE sub.mxrate.net FIVETEN blackholes.five-ten-sg.com WHOIS-DYNA combined-HIB.dnsiplists.completewhois.com MXRATE, FIVETEN, and WHOIS-DYNA have multiple lists, and it is good to give separate weights to each. Make sure you check out their web sites for specifics. NJABL and SORBs have multiple tests, make sure you are using all of them, check out their web sites for specifics. Sometimes these sites with multiple tests delete some and add new ones, so it is a good idea to check their web sites every so often to see if there are any changes. For RHSBLs, make sure you are using SURBL (multi.surbl.org). Statistically (using DLanalyzer), the top ten spam catching blacklists for my servers are CBL, SORBS-DUHL, FIVETEN-SPAM, IMP-SPAM, SPAMCOP, PSBL, NJABL-DYNA, UCEPROTECT-1, UCEPROTECT-3, MXRATE-BLOCK. Are you using invURIBL? It is an inexpensive external test, and it will catch a lot of spam. Gary Original Message From: Chuck Schick [EMAIL PROTECTED] Sent: Monday, November 27, 2006 12:55 PM To: Declude. JunkMail Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Blacklists Recommendations. I am looking for recommendations on other blacklists that Declude users are successfully using. Right now I use. Spamcop list.dsbl.org (trusted) AHBL Spamhaus CBL UCEB ORDB SORBs NJABL BLITZEDALL MailPolice I looked at the Declude list and I am wondering about adding spamsources.fabel.dk bl.csma.biz 0spam.fusionzero.com dnsbl.cyberlogic.net blackholes.five-ten-sg.com (multiple tests) psbl.surriel.com db.wpbl.info Thoughts on these tests. Any others that people are having luck with? We use sniffer with Declude but too much is slipping through. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Per Domain Blacklists
Well, you can have a separate $default$.junkmail file for each domain, so whatever unique tests you wanted for a domain you would just define it in your global.cfg and then list it in the $default$.junkmail for that domain. Gary Original Message From: Dean Lawrence [EMAIL PROTECTED] Sent: Sunday, November 12, 2006 6:43 PM To: declude.junkmail@declude.com declude.junkmail@declude.com Subject: [Declude.JunkMail] Per Domain Blacklists Is there a way to have per domain blacklists? I looked in the manual and saw that you can whitelist addresses like this, but not blacklist. The only references that I found for blacklisting was to put a test in the global.cfg file, but this would be for all domains and I need to try and set-up separate blacklist for each domain. Thanks, Dean -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] CMDSPACE/SmarterMail
I'm also using SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14, and have had CMDSPACE configured for quite a while, but hadn't thought anything about it. When I saw your message I ran DLanalyzer on my logs for the past two weeks and saw that there were no hits for CMDSPACE at all. So it seems I am experiencing the same problem. Gary Original Message From: Michael Jaworski [EMAIL PROTECTED] Sent: Friday, November 10, 2006 10:45 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] CMDSPACE/SmarterMail We just started using CMDSPACE and noticed the test does not appears to be working on SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14. I am not seeing any errors in the debug level logs files. A check of the release logs it appears support for CMDSPACE test in Smartermail was provided in 4.0.9. (Feb 2006) Anyone seeing the same thing? Here are my relevant entries without quotes: Global.cfg - CMDSPACEcmdspaceX X 8 0 $default$.junkmail - CMDSPACEWARN Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] CMDSPACE/SmarterMail
Thanks, David. It's little things like this short acknowledging message that can go miles towards making your customers feel better about Declude's support. Gary Original Message From: David Barker [EMAIL PROTECTED] Sent: Friday, November 10, 2006 3:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] CMDSPACE/SmarterMail I see that too, I will look into this. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, November 10, 2006 2:27 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] CMDSPACE/SmarterMail I'm also using SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14, and have had CMDSPACE configured for quite a while, but hadn't thought anything about it. When I saw your message I ran DLanalyzer on my logs for the past two weeks and saw that there were no hits for CMDSPACE at all. So it seems I am experiencing the same problem. Gary Original Message From: Michael Jaworski [EMAIL PROTECTED] Sent: Friday, November 10, 2006 10:45 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] CMDSPACE/SmarterMail We just started using CMDSPACE and noticed the test does not appears to be working on SmarterMail Enterprise Edition 3.3.2439 and Declude 4.3.14. I am not seeing any errors in the debug level logs files. A check of the release logs it appears support for CMDSPACE test in Smartermail was provided in 4.0.9. (Feb 2006) Anyone seeing the same thing? Here are my relevant entries without quotes: Global.cfg - CMDSPACE cmdspaceX X 8 0 $default$.junkmail - CMDSPACE WARN Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] declude not modifying subject line
Same in SmarterMail. It is interesting when you receive one of these messages to find the Declude header lines at the end of the message, and the one or two header lines that SmarterMail appends (after Declude hands the message back to SmarterMail) right where they should be at the end of the header. SmarterMail knows where the header is even after Declude has processed the message. Maybe Declude should be talking to SmarterMail to find out how they know where the header is in these malformed messages. Gary Original Message From: Andy Schmidt [EMAIL PROTECTED] Sent: Wednesday, November 08, 2006 5:12 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi, As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response I never asked them to address it because Imail prepends the Received headers at the top and appends the other headers in the correct spot, as far as I can tell. It's accepting a message, works around the non-standard line feeds and delivers the message. So there's nothing to fix for them, in my opinion. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 08, 2006 04:37 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line 1. I don't like to keep going in circles on this. If it was as easy as just fix it there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. 2. Just so that you know we are a privately funded company and do not have any VC funding. 3. As per previous posts I agree that Declude needs to deal with this issue, as neither SmarterMail or Imail have addressed this, just out of curiosity has anyone contacted SmarterMail or Imail and asked them to address this issue, and if so what was their response ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, November 08, 2006 2:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Me three! Is it done yet? No? Darn. Frankly, David, if the Declude app is going to have to rewrite the whole message anyway to insert headers, make it an optional *feature* to fix up the line terminators. Then market it as a unique feature; I understand that Venture Capitalists love their startups to have innovative features that differentiate their product in the marketplace. Meanwhile, just fix the Declude app so that inserts the header correctly as befits our reasonable expectations as set by all the other products in the marketplace. Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, November 08, 2006 10:41 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Agreed. Put the headers where they need to be. Don't worry about fixing the message. Having this additional test could be worthwhile as well, to identify and report on mailers that are broken in this fashion. Darin. - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 12:03 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi Dave: 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. Although I know this had been suggested - I personally don't feel that Declude needs (or even SHOULD) rewrite the message. If the message is readable by Imail, Outlook, etc. - then the sender is in luck. If not, then the fact that other software can't read the message will motivate the sender to use RFC compliant formatting. I feel all that's necessary is that Declude's end-of-line parsing should be made intelligent enough so that it DOES detect various CR CR/LF LF LF/CR combinations and treat them as end-of-line, so that it can properly detect the intended last header. This way,
re: [Declude.JunkMail] Help with Configuration
Is it because when it reaches WEIGHT19 and does the ROUTETO [EMAIL PROTECTED], the message is delivered? Then when it tries to perform the action of WEIGHT32 the message is already gone? Does Declude allow for multiple instances of the same action where subsequent actions are performed, or does it perform the action of the same type that occurs first? Is there a precedence on actions of the same type or not? The manual describes precedence for actions of different type (HOLD over WARN for example) but what about actions of the same type (one ROUTETO versus another ROUTETO)? Gary Original Message From: Todd Richards [EMAIL PROTECTED] Sent: Tuesday, November 07, 2006 2:47 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterMail 4.x beta
SmarterTools just announced a features list for the next release of SmarterMail. They are releasing SmarterMail 4.x beta on Monday, November 13th. (They estimate a final release of 4.x around January.) The new features include greylisting and integration with SpamAssassin. Check out the official statement here: http://forums.smartertools.com/forums/thread/21878.aspx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FP reporting for ZEROHOUR
So you are implying that those of us who are not running Commtouch, if we remove the ZEROHOUR statement from the global.cfg the X-Declude-RefID line in the headers will go away? (How to get rid of that line is a question that has been asked here before.) Original Message From: David Barker [EMAIL PROTECTED] Sent: Wednesday, November 01, 2006 1:52 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] FP reporting for ZEROHOUR Ensure you running the latest version of Declude 4.x and that you have ZEROHOUR 14 in the global.cfg David B _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Sent: Wednesday, November 01, 2006 12:47 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] FP reporting for ZEROHOUR Thanks Kevin... Next question -- How can I have Declude add the X-Declude-RefID: to the header ?? - Original Message - From: Kevin Bilbee mailto:[EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 01, 2006 12:16 PM Subject: RE: [Declude.JunkMail] FP reporting for ZEROHOUR Here is the document Declude sent to me for reporting false positives and false negatives. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ken Weise Sent: Wednesday, November 01, 2006 5:46 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] FP reporting for ZEROHOUR I was about to ask that myself. Also, the procedure for reporting spam that is not caught... _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Pereira Sent: Wednesday, November 01, 2006 8:25 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] FP reporting for ZEROHOUR Hi - Does anyone know of the procedure for reporting FP results that are failing the ZEROHOUR test ? jeff --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Upgrading Declude Configs - Which Tests are valid?
I'm using most of the ones you mention, and the ones I'm using all work. He's what I have in my global.config that matches your list: AHBLip4rdnsbl.ahbl.org * 7 0 DSBLip4rlist.dsbl.org * 8 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 7 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 7 0 FIVETEN-SPAMip4rblackholes.five-ten-sg.com 127.0.0.2 5 0 FIVETEN-BULKip4rblackholes.five-ten-sg.com 127.0.0.4 5 0 FIVETEN-MULTISTAGE ip4rblackholes.five-ten-sg.com 127.0.0.5 5 0 FIVETEN-SINGLESTAGE ip4rblackholes.five-ten-sg.com 127.0.0.6 5 0 FIVETEN-SPAM-SUPPORTip4rblackholes.five-ten-sg.com 127.0.0.7 5 0 FIVETEN-WEBFORM ip4rblackholes.five-ten-sg.com 127.0.0.8 5 0 FIVETEN-MISCip4rblackholes.five-ten-sg.com 127.0.0.9 5 0 FIVETEN-CR ip4rblackholes.five-ten-sg.com 127.0.0.13 5 0 NJABL-OPENRELAY ip4rdnsbl.njabl.org 127.0.0.2 3 0 NJABL-DUL ip4rdnsbl.njabl.org 127.0.0.3 3 0 NJABL-SPAMSRC ip4rdnsbl.njabl.org 127.0.0.4 3 0 NJABL-MULTI ip4rdnsbl.njabl.org 127.0.0.5 3 0 NJABL-BADHOST ip4rdnsbl.njabl.org 127.0.0.6 3 0 NJABL-CGI ip4rdnsbl.njabl.org 127.0.0.8 3 0 NJABL-PROXY ip4rdnsbl.njabl.org 127.0.0.9 3 0 NJABL-DYNA ip4rdynablock.njabl.org 127.0.0.3 5 0 If you really want a breakdown on what each one does, you will have to go to their individual web sites. For example, I'm just using the one AHBL test which includes all of that blacklist rolled into one. You can break AHBL into several tests based on what they have on their web site. http://www.ahbl.org/docs/dnsbl.php The same can be said for the others: http://dsbl.org/usage http://rhs.mailpolice.com/usage.php http://www.five-ten-sg.com/blackhole.php http://dnsbl.njabl.org/use.html Using DLanalyzer, here is a breakdown of what percentage of spam on my server was hit by the tests mentioned for the past week: AHBL3.64% DSBL9.83% MAILPOLICE-BULK 0.18% MAILPOLICE-PORN 0.29% FIVETEN-SPAM46.89% FIVETEN-BULK0.30% FIVETEN-MULTISTAGE 0.00% FIVETEN-SINGLESTAGE 0.00% FIVETEN-SPAM-SUPPORT0.11% FIVETEN-WEBFORM 0.00% FIVETEN-MISC0.16% FIVETEN-CR 0.00% NJABL-OPENRELAY 0.06% NJABL-DUL 1.41% NJABL-SPAMSRC 0.09% NJABL-MULTI 0.00% NJABL-BADHOST 0.00% NJABL-CGI 0.00% NJABL-PROXY 3.69% NJABL-DYNA 31.30% You may get different results. Just because a test gets a low percentage of hits doesn't necessarily mean it is a bad test. I suggest you download a copy of the free lite version of DLanalyzer and run it on your logs. This will give you an idea as to which tests are getting hits on your setup and which are not. http://www.invariantsystems.com/dlanalyzer/ Good luck, Gary Original Message From: Brian T. [EMAIL PROTECTED] Sent: Wednesday, November 01, 2006 7:21 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Upgrading Declude Configs - Which Tests are valid? I spent this afternoon cleaning up my global.cfg file and I still have some tests listed that no longer show up in the latest config file from Declude. I was wondering which of the following, if any are still active tests? DSBL , SENDERDB-BLACK, SENDERDB-SUSPICIOUS, MAILPOLICE-BULK, MAILPOLICE-PORN, FIVETEN-SPAM, FIVETEN-BULK, FIVETEN-MULTISTAGE, FIVETEN-SPAMSUPPORT, FIVETEN-MISC, FIVETEN-SINGLESTAGE, FIVETEN-FREE, AHBL-RELAYS, AHBL-PROXIES, AHBL-SOURCES, AHBL-PROVISIONAL, AHBL-FORMMAIL, AHBL-DUL, NJABL-DYNABLOCK, NJABL-RELAYS, NJABL-DUL, NJABL-SOURCES, NJABL-MULTI, NJABL-FORMMAIL, and NJABL-PROXIES Are any of these tests duplicates, as in basically using the same data or basically the same test? Thanks for the help, Brian T. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SmarterMail 4.x beta
SmarterTools just announced some information about the next release of SmarterMail. They are releasing SmarterMail 4.x beta around Novemember 6th. Check out the official statements here: http://forums.smartertools.com/forums/thread/21267.aspx --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] blackholes.us
I found this RBL monitor through Google, though have not used it myself: http://www.cmsconnect.com/BLM/BLMonitor.htm Anyone have any experience with this or some other similar product? Gary Original Message From: Markus Gufler [EMAIL PROTECTED] Sent: Monday, October 16, 2006 4:12 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blackholes.us I've suggested it already years ago: would it be possible to have some warning mechanism in order to detect long response times, timeouts or connection problems (for whatever reason) not only in the debug loglevel? Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, October 16, 2006 8:27 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] blackholes.us Jay, I have noticed over the last 2 months that blackholes seem to timeout very often. David Barker Director of Product Development Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski - Handy Networks LLC Sent: Monday, October 16, 2006 2:22 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] blackholes.us Is blackholes.us down for anyone else? All of our RBL tests to them are timing out. Thanks! - Jay Sudowski // Handy Networks LLC Director of Technical Operations Providing Shared, Reseller, Semi Managed and Fully Managed Windows 2003 Hosting Solutions Tel: 877-70 HANDY x882 | Fax: 888-300-2FAX www.handynetworks.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] catchall/nobody aliases and filter files
You can find links to several pages with filter samples at http://it.farmprogress.com/declude/declude.htm Original Message From: Craig Edmonds [EMAIL PROTECTED] Sent: Saturday, October 14, 2006 12:53 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] catchall/nobody aliases and filter files Unfortunately I have some clients who need the nobody alias in order to catch mails. (I have seriously thought about them signing an agreement when they insist on it becasue I know its not really wise to have catchalls these days.) In the global.cfg file there is a line that says. CATCHALLMAILS catchallmails x x 0 0 Should I increase the weight up to say 10? I mean anyone sending to an account that does not exist, is more than likely someone spamming right? I am starting to fiddle with my declude setting rather than fiddling with myself so any ideas on this would be welcome. Does any one have any sample filter files for these?? #FILTER-ADULT #FILTER-COUNTRY #FILTER-FORGED #FILTER-MEDICAL Kind thanks in advance. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOLD overrides COPYTO as last action?
Say I have the following in my $default$.junkmail file: FILTER-PHISH COPYTO [EMAIL PROTECTED] WEIGHT20 HOLD %DATE% If both tests are triggered on the same email, the COPYTO never occurs. It only does the HOLD. I tried switching the order of the tests in the $default$junkmail file and the global.cfg file, but it doesn't seem to make a difference. Will Declude only perform one action on a message? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] HOLD overrides COPYTO as last action?
Okay, so the HOLD action trumps COPYTO. In fact COPYTO is trumped by just about everything - even WARN, and probably shouldn't even be used unless you are certain the test you are looking for it to fail will definitely be the only one that fails. Since COPYTO is not going to let me do what I wanted to do, I tried to manipulate things with a HOLD. Basically I wanted everything that fails a certain test and is over a certain weight to be collected separate from all the other held spam. So I tried making a filter that was like this: TESTSFAILED 0 CONTAINS WEIGHT20 FILTER-PHISH But it didn't work. I tried every combination, rearranging the order in the TESTSFAILED statement, rearranging the order of the tests in the global.cfg and $default$.junkmail, etc. I came to the conclusion that a weight test is ignored by TESTSFAILED (though I couldn't find anything about this in the manuals, knowledgebase, or archives of declude.junkmail). I was able to get other combinations of tests to work, but as soon as I added a weight test to the mix, TESTSFAILED wouldn't work any more. I also tried using a weightrange, but apparently TESTSFAILED treats it the same as a weight. Maybe weight and weightrange would better be labelled triggers ranther than tests (based on the commenting in the default global.cfg) since these triggers don't seem to be treated the same as other tests. Has anyone else experienced this? And is there any other work around that will let me do what I want to do using filters or some other aspect of Declude? Original Message From: Gary Steiner [EMAIL PROTECTED] Sent: Thursday, October 12, 2006 1:48 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] HOLD overrides COPYTO as last action? Say I have the following in my $default$.junkmail file: FILTER-PHISH COPYTO [EMAIL PROTECTED] WEIGHT20 HOLD %DATE% If both tests are triggered on the same email, the COPYTO never occurs. It only does the HOLD. I tried switching the order of the tests in the $default$junkmail file and the global.cfg file, but it doesn't seem to make a difference. Will Declude only perform one action on a message? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 4.3.x and 3.1.x planned release
David, Is the NONSTANDARDHDR test on by default, or do you need to add it to your virus.cfg file? I've been running every version since 4.2.20, and I have never seen a message with a broken header moved to my \virus folder. Gary Original Message From: David Barker [EMAIL PROTECTED] Sent: Friday, September 15, 2006 11:42 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.3.x and 3.1.x planned release Dave, We had implemented a fix for the broken image spam, in 4.2.20 New NONSTANDARDHDR vulnerability test. Messages found to have broken headers are moved to the \virus folder I do know of reports of broken headers still happening and we are re-evaluating this test to see if we can make it better. If you are running 4.2.20 or later and are still having problems with the broken images could you please send examples to support so we could look at them. Thanks David B. www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Friday, September 15, 2006 11:14 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.3.x and 3.1.x planned release Still no fix for the broken image spam? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, September 15, 2006 7:59 AM To: declude.junkmail@declude.com; declude.virus@declude.com Subject: [Declude.JunkMail] 4.3.x and 3.1.x planned release The following items are being tested for Target Date release: 27 September 2006 4.3.x -- DEC FIX On occasion ZEROHOUR initialized two overlaping threads causing decludeproc crash JM FIX IPBYPASS now takes place before WHITELIST JM FIX X-COUNTRYCHAIN log entry no longer truncated JM FIX DELETE_RECIPIENT removes the specified email address as per-user action only JM FIX With HOLD if extra space after %DATE% incorrect behaviour was observed this is not been normalized HI FIX CONCATENATELOGS with KEEPINDIVIDUALLOGS works correctly JM ADD BANCHARSET defined in the declude.cfg quarentines listed character sets EVA ADD With AVAFTERJM ON the JM Log displays message moved to virus folder 3.1.x -- JM FIX IPBYPASS now takes place before WHITELIST JM FIX X-COUNTRYCHAIN log entry no longer truncated JM FIX DELETE_RECIPIENT removes the specified email address as per-user action only JM FIX With HOLD if extra space after %DATE% incorrect behaviour was observed this is not been normalized JM FIX Declude crash fix. Buffer Overflow reading the From: line in the Headers HI FIX CONCATENATELOGS with KEEPINDIVIDUALLOGS works correctly SM ADD Decludeproc will not start without a valid domainlist.xml In addition to bug fixes we are also working on wishlist items that we have received regarding new tests. If you have any ideas of new tests you would like to see implemented please email your thoughts to me directly [EMAIL PROTECTED] Thanks David B www.declude.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module
It's a catch-22. You send a message to [EMAIL PROTECTED] and get a reply back saying that they will no longer pay attention to messages sent to [EMAIL PROTECTED] What does it mean when customers have to try to get in touch with Declude so that they flip the switch so that the customer can get in touch with Declude? Original Message From: Kevin Bilbee [EMAIL PROTECTED] Sent: Thursday, September 07, 2006 9:32 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module Then I would contact customer service to have them flip the switch so you can place support tickets. Kevin -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Thursday, September 07, 2006 5:17 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module Interesting. If I log in to my account on the Declude web site, there is no option listed for the new CRM module. It is not that it is grayed out as described below. It just isn't there. And I do have a current service agreement. So, since according to this message we can no longer use [EMAIL PROTECTED], and the supposed new CRM module doesn't seem to be available, how do we contact Declude support? By the way, the reason I was trying to contact Declude support is that I was investigating the latest all_list.dat file, and found that the download link on the Declude web site is now no longer valid. (The download link for the Declude GUI didn't work either, as well as the link for the demo copy of Sniffer.) Seems that when Declude updated their web site they forgot to check the one thing on the web site that an existing customer is most likely to use, such as all their download links. And they wonder why we get upset. Original Message From: [EMAIL PROTECTED] Sent: Thursday, September 07, 2006 7:44 PM To: [EMAIL PROTECTED] Subject: re: [17D-0C9324FF-DB7C] Latest all_list.dat Thank you for submitting a ticket to support. Your ticket number is [17D-0C9324FF-DB7C]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833 IMPORTANT NOTICE Declude is migrating to a new CRM business solution which includes a new case management module. We will begin using this feature beginning the week of 28 August, the result of this action means that Declude will no longer accept and create support cases using the email address [EMAIL PROTECTED] You will need to login into your Declude account to submit a case. If you can not submit a case due to the option being grayed out this means that you do not have an active service agreement. Call customer care 866-332-5822 #3 to purchase or renew a service agreement. We understand that this will be awkward and/or unwanted, however our goal is to continue servicing our paying customers. Thank You. Declude Technical Support --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management module
I saw the phone number in the original message, but that doesn't change the
rest of the message. The point is how can a company whose business is email
and the internet exclude all forms of communication except for the telephone?
And even an automated message from their [former] support communication method
did not come out and say that. What it says is if you haven't heard from them
in 24 hours after you have tried to contact them via the web or email, then
call them. It doesn't say anything about flipping switches.
If they wish to limit all customer communication to the telephone, then why
don't they just come out and say we refuse to talk to any of our customers
unless they call us ? It is Declude's fault for encouraging us to use email
as the primary form of communication all this time, and now arbitrarily cutting
it off.
The real question is when we pay for an annual service contract, exactly what
are we getting? Apparently a lot less than we were receiving before August
28th.
Original Message
From: Jay Sudowski - Handy Networks LLC [EMAIL PROTECTED]
Sent: Friday, September 08, 2006 12:57 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case management
module
I think it means you have to pick up the phone and call them.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Friday, September 08, 2006 12:12 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case
management module
It's a catch-22. You send a message to [EMAIL PROTECTED] and get a
reply back saying that they will no longer pay attention to messages
sent to [EMAIL PROTECTED]
What does it mean when customers have to try to get in touch with
Declude so that they flip the switch so that the customer can get in
touch with Declude?
Original Message
From: Kevin Bilbee [EMAIL PROTECTED]
Sent: Thursday, September 07, 2006 9:32 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] [EMAIL PROTECTED] versus new case
management module
Then I would contact customer service to have them flip the switch so
you
can place support tickets.
Kevin
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Gary Steiner
Sent: Thursday, September 07, 2006 5:17 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] [EMAIL PROTECTED] versus new
case management module
Interesting. If I log in to my account on the Declude web
site, there is no option listed for the new CRM module. It
is not that it is grayed out as described below. It just
isn't there. And I do have a current service agreement.
So, since according to this message we can no longer use
[EMAIL PROTECTED], and the supposed new CRM module doesn't
seem to be available, how do we contact Declude support?
By the way, the reason I was trying to contact Declude
support is that I was investigating the latest all_list.dat
file, and found that the download link on the Declude web
site is now no longer valid. (The download link for the
Declude GUI didn't work either, as well as the link for the
demo copy of Sniffer.) Seems that when Declude updated their
web site they forgot to check the one thing on the web site
that an existing customer is most likely to use, such as all
their download links.
And they wonder why we get upset.
Original Message
From: [EMAIL PROTECTED]
Sent: Thursday, September 07, 2006 7:44 PM
To: [EMAIL PROTECTED]
Subject: re: [17D-0C9324FF-DB7C] Latest all_list.dat
Thank you for submitting a ticket to support. Your ticket number
is
[17D-0C9324FF-DB7C].
Please keep this ticket number for your records and include
it in the
subject (including brackets) of all future emails regarding this
issue.
The response time during business hours is usually within
24 hours, if
you have had no response in this time please do not
hesitate to call
our support number 1-866-332-5833
IMPORTANT NOTICE
Declude is migrating to a new CRM business solution which
includes a
new case management module. We will begin using this feature
beginning the week of 28 August, the result of this action
means that
Declude will no longer accept and create support cases
using the email
address [EMAIL PROTECTED]
You will need to login into your Declude account to submit
a case. If
you can not submit a case due to the option being grayed out
this
means that you do not have an active service agreement.
Call customer
care 866-332-5822 #3 to purchase or renew a service agreement.
We understand
[Declude.JunkMail] virus or spam?
Today I discovered a new spam on my server that at first I thought might be a virus. It had the subject line Bill Summary - Invoice #36644 and August Payment Summary, Invoice #48729 with the number being random. It delivers its message inside an attached word document called invoice.doc. When I sent it to www.virustotal.com, nothing was detected. Just to be safe I copied it to an old Macintosh, but couldn't open it with MS Word there. I opened the invoice.doc file with a text editor and found it contained the standard OEM software sales pitch with a link to a web site. I'm still not certain that it isn't a new virus hidden behind a spam. The header seems to contain a strange cr/lf pattern as Declude has trouble with it and ends up putting its X-Header messages at the end of the file. Some were picked up by RBLs some were not. Anyone else seen this before? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 4.3 Upgrade
I'm having this same problem with AVG. I'm running Declude 4.3 with the latest version of SmarterMail. Gary Original Message From: Darrell \([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Monday, July 24, 2006 12:59 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] 4.3 Upgrade I have two servers running under 4.3 with no issues. The only issue I have with the new version is that when I have the AVG scanner enabled it tells me it can't delete 1 of 2 files and that I may have an on access scanner configured (which I don't). If AVG is disabled I stop getting the error message. This problem also existed in 4.2.x. Darrell --- fpReview - Easy way to review held mail. Many features... http://www.invariantsystems.com Mark Reimer writes: Have many people upgraded to 4.3 yet. I was wondering if anyone had experienced any problems with the new version. Mark Reimer IT Project Manager American CareSource 214-596-2464 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 4.3
I guess someone is going to make an official announcement today about Declude 4.3? I see that its downloadable in my account, but it would be nice to know what I'm getting before I install it, especially the new Commtouch stuff. The Restrictions listed next to the Add Commtouch section are especially confusing. https://www.declude.com/articles.asp?ID=205 Who would use Declude and not fit the definitions of the restrictions? Based on my reading of the Restrictions, nobody who uses Declude will ever be able to use Commtouch. If I am misreading this, would someone please explain it to me? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.3
So, that being said, under what conditions can a legacy customer use Commtouch? Since it would seem that Commtouch is being offered as an add-on, what are the benefits of having Commtouch? What does it do that Declude alone does not? And of course it would be nice if this revenue share program was spelled out somewhere. Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 18, 2006 3:57 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 There are restrictions on CommTouch being used by Service Providers we had to ensure that NEW customers (ie. Service Providers After 1 June 06) understand the licensing restrictions. Current Service Providers (ie. Before 1 June 06) are under no restrictions for using Declude; only the CommTouch add-in component. However we have managed to come to an agreement with CommTouch to enable our legacy customers (ie. Service Providers Before 1 June 06) to take advantage of CommTouch under a revenue share program, this program is not being forced onto legacy customers but will be an opportunity for us to help you increase revenues in your business, by providing you with new product like the Declude Gateway which would be independent of Imail/SmarterMail and will include CommTouch. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, July 18, 2006 3:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 I guess we all missed the following paragraph in the license agreement: 3.2.6 sub-license, rent, sell, lease, distribute, or otherwise transfer the Licensed Program save as provided under this End-User License Agreement unless You obtain a separate License from Declude, Inc. for such purposes (for example, You may not embed the Licensed Program into another application and then distribute such to third parties unless You first acquire an OEM License from Declude, Inc.). As of June 1, 2006, ISP's and other service providers are not permitted to use Declude software to clean and forward mail to customers unless a separate revenue share agreement has been established with Declude. http://www.declude.com/Articles.asp?ID=121 Is Declude trying to put us out of business? We pay for the software and now have to pay them some of your meager profits? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 18, 2006 11:24 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude 4.3 I guess someone is going to make an official announcement today about Declude 4.3? I see that its downloadable in my account, but it would be nice to know what I'm getting before I install it, especially the new Commtouch stuff. The Restrictions listed next to the Add Commtouch section are especially confusing. https://www.declude.com/articles.asp?ID=205 Who would use Declude and not fit the definitions of the restrictions? Based on my reading of the Restrictions, nobody who uses Declude will ever be able to use Commtouch. If I am misreading this, would someone please explain it to me? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude 4.3
Basically you are telling me to ignore the Add Commtouch part of your web page that shows up when I log in to my account. What I find particularly amusing is the line Restrictions apply to service providers. If there is anyone subscribed to this mailing list who is not a service provider, please raise your hand. Isn't it generally a good idea to have your product's pricing defined before you introduce the product? I'm sure that everyone here reading the list is extremely curious as to what the revenue share program really is, and when it does come out, unless you hear exclamations of What a Bargain coming off this list there won't be many of us joining that program. Other than the Commtouch add-on, are there any other features or reasons to upgrade to 4.3? Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 18, 2006 5:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 Gary, 1. Server Providers who use CommTouch as an add-in to Declude will be in violation of CommTouch's Terms of service. 2. Some of the benefits of CommTouch are Zero Hour virus protection and additional spam identifying technology such as Recurrent Pattern Detection Technology (RPD) recognized by key industry analysts as a leading technology in email outbreak detection. 3. We are in the process of defining the revenue share program and will provide the details to this when it is ready. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 18, 2006 4:09 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 So, that being said, under what conditions can a legacy customer use Commtouch? Since it would seem that Commtouch is being offered as an add-on, what are the benefits of having Commtouch? What does it do that Declude alone does not? And of course it would be nice if this revenue share program was spelled out somewhere. Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 18, 2006 3:57 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 There are restrictions on CommTouch being used by Service Providers we had to ensure that NEW customers (ie. Service Providers After 1 June 06) understand the licensing restrictions. Current Service Providers (ie. Before 1 June 06) are under no restrictions for using Declude; only the CommTouch add-in component. However we have managed to come to an agreement with CommTouch to enable our legacy customers (ie. Service Providers Before 1 June 06) to take advantage of CommTouch under a revenue share program, this program is not being forced onto legacy customers but will be an opportunity for us to help you increase revenues in your business, by providing you with new product like the Declude Gateway which would be independent of Imail/SmarterMail and will include CommTouch. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, July 18, 2006 3:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Declude 4.3 I guess we all missed the following paragraph in the license agreement: 3.2.6 sub-license, rent, sell, lease, distribute, or otherwise transfer the Licensed Program save as provided under this End-User License Agreement unless You obtain a separate License from Declude, Inc. for such purposes (for example, You may not embed the Licensed Program into another application and then distribute such to third parties unless You first acquire an OEM License from Declude, Inc.). As of June 1, 2006, ISP's and other service providers are not permitted to use Declude software to clean and forward mail to customers unless a separate revenue share agreement has been established with Declude. http://www.declude.com/Articles.asp?ID=121 Is Declude trying to put us out of business? We pay for the software and now have to pay them some of your meager profits? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 18, 2006 11:24 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Declude 4.3 I guess someone is going to make an official announcement today about Declude 4.3? I see that its downloadable in my account, but it would be nice to know what I'm getting before I install it, especially the new Commtouch stuff. The Restrictions listed next to the Add Commtouch section are especially confusing. https://www.declude.com/articles.asp?ID=205 Who would
RE: [Declude.JunkMail] Number of times per test
I don't have STOPATFIRSTHIT in my body filter, and it always stops the first time it finds something. Original Message From: Michael Thomas - Mathbox [EMAIL PROTECTED] Sent: Friday, July 14, 2006 2:31 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Number of times per test If you do not have StopAtFirstHit enabled, then each hit adds the specified points to the total. So, set the MinWeightToFail to 10 and apply 2 point for each hit like: #SKIPIFWEIGHT 10 MINWEIGHTTOFAIL 10 #MAXWEIGHT 15 #STOPATFIRSTHIT BODY 2 CONTAINS replikas Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Friday, July 14, 2006 1:52 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Number of times per test I looked through the manual, but didn't see this defined... I want a test that applies 10 points if a certain string appears in the body of a message a number of times... So if, for example, 'replikas' appears 5 times, and I want to apply ten points only if that string is there 5 times or more, what part of the test definition string do I modify ? Which variable determines that ? Or, could I assign it 2 points each time it appears ? And which variable is that ? Numberoftimes filter C:\Declude\sampletest.txt x 10 0 Karl Drugge --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] F-Prot Licensing
Wow! It's like one of those MasterCard commercials. Here's an example server based on list prices: SmarterMail Enterprise Edition (Unlimited Domains and Users) - $899 Declude Security Suite for Smartermail Enterprise (Unlimited Domains) - $1750 Annual Subscription F-Prot Antivirus for Windows Mail Servers (1000-1999 Users) - $2519 Annual License fee Frisk doesn't even mention a price for Unlimited Users. I guess it's like a Ferrari, if you have to ask how much it costs, you can't afford it. Original Message From: Colbeck, Andrew [EMAIL PROTECTED] Sent: Friday, July 14, 2006 5:40 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] F-Prot Licensing I hadn't noticed that before. This webpage is pretty darn explicit, so yes, the pricing you quoted is correct! From the bottom of the page that describes the corporate licences available: http://www.f-prot.com/products/corporate_users/win/ F-Prot Antivirus for Windows on Mail Servers To use the F-Prot Antivirus scanner on a Windows Mail Server a F-Prot Antivirus for Windows on Mail Servers license is required. This license category differs from the general F-Prot Antivirus for Windows for corporate users license in that it covers use that the general license does not: F-Prot Antivirus for Windows on Mail Servers applies to mail servers, mail relays and mail gateways, i.e. computers that provide mail services to a network, either for incoming or for outgoing e-mail. High-quality, efficient virus scanning is essential for any mail server. E-mail is the most common way for viruses and other malware to spread. The most effective way of stopping the spread of malware onto a network and beyond is at the server. F-Prot Antivirus for Windows on Mail Servers includes a Command Line Scanner (fpcmd.exe) that can be used with third party mail server software such as Declude and MailEnable. Information on how to use the software with such programs can be found on www.declude.com http://www.declude.com/ and www.mailenable.com http://www.mailenable.com/ . If you are interested in purchasing F-Prot Antivirus for Windows on Mail Servers, please visit our order form https://secure.f-prot.com/cgi-bin/buy and take a look at our price lists http://www.f-prot.com/products/prices/price_links.html . NB: Administrators should read question 113 http://www.f-prot.com/support/windows/fpwin_faq/113.html and question 114 http://www.f-prot.com/support/windows/fpwin_faq/114.html in the FAQ section of our Windows support pages http://www.f-prot.com/support/windows/ before installing F-Prot Antivirus for Windows Mail Servers. Andrew 8) _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Friday, July 14, 2006 1:00 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] F-Prot Licensing When did Frisk change the licensing for F-prot! They now have a mail server license for windows on number of users pricing? F-Prot Antivirus for Windows Mail Servers Number of Users Annual license fee 1-24 US$ 269 25-49 US$ 359 50-99 US$ 449 100-199 US$ 719 200-299 US$ 989 300-399 US$ 1259 400-499 US$ 1529 500-749 US$ 1799 750-999 US$ 2069 1000-1999 US$ 2519 2000-2999 US$ 2969 3000-3999 US$ 3419 4000-4999 US$ 3869 5000-5999 US$ 4499 Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
I'm curious as to who was experiencing this deluge. As far as I can tell, 99.9% of the messages now ending up in the error folder are ones that SmarterMail (previous to Declude 4.2.20) would have deleted, and both the user and the system administrator (me) would never have seen them, let alone known that they had even existed. So the only deluge I can see (previous to Declude 4.2.20) would have been in the bit bucket. Sandy hit it right on the nose in stating that this should have been a configurable option. Previously, the only held spam was that which the system administrator had configured as being held. Now Declude has arbitrarily turned the error folder into a new hold folder completely out of the system administrator's control. And if this is indeed a SmarterMail problem, what is Declude going to do if and when SmarterMail fixes it? Rip the bandaid off and put things back to the way they were? Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 11, 2006 4:10 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 That is exactly what was happening prior to the fix and it created a deluge of spam ending up in SmarterMail inboxes. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, July 11, 2006 3:49 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 How about if the message has failed in the .hdr file declude just ignores the file to let SmarterMail process it as it see fit??? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, July 11, 2006 12:26 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Not sure who you spoke to at SmarterTools but I do NOT believe this is true. Declude will not pick up a message until it is completed writing both the .hdr and .eml files, that is the reason why SmarterMail while writing the header will have the .eml file as .em_ (while writing) so that when the .hdr is complete ie. Written then and only then will Declude pick up the file to process it. Also you will see clearly, that the SM logs indicate a problem long before we receive the message. This was a new problem introduced by SmarterMail - 4.2.20 provided a fix for this. Again coming back to a previous post I made talking about the effects of the Mail server on Declude. The question always comes back to who should provide the fix, in this case we did as it was causing messages not being scanned by Declude for spam. I am trying to get a better understanding to the problem from SM and as soon as I have some answers from them I will post to the lists. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 11, 2006 3:13 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Here is SmarterTools take on the problem: Failed is written to the .hdr if the message was not succesfully recieved via SMTP. For instance, if the connection is closed mid transmission. These(and corresponding .emls) are normally just deleted by SmarterMail. The only reason you are noticing them is because of Declude storing them in the error folder. The implication is that Declude is interrupting part of SmarterMail's normail process. Now I know this is essentially what Declude does anyway, but shouldn't Declude know the difference between a message that has finished SMTP and SmarterMail is ready to deliver, and a message that is incomplete in the SMTP process and an SMTP retry is occurring so this failed message should be ignored? Otherwise we are going to get thousands of unneccessary incomplete messages dumped into the error folder that is going to do nothing other than to take up disk space. Not to mention that if some other type of error occurs that puts a message in the error folder, we'll never find it because its buried under all these other superfluous messages. Before 4.2.20, this wasn't a problem. Original Message From: David Barker [EMAIL PROTECTED] Sent: Monday, July 10, 2006 3:24 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Gary, This is a SmarterMail issue. When they fail to complete the .hdr file they write Failed in the .hdr as this was causing major spam leakage for declude we decided to move incomplete messages to the \error folder. You could try changing the Failed to Written and drop the messages
RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
As far as I'm concerned it's not a solution. SmarterMail deleting these
messages was not a problem for me, Declude dumping them into the error folder
is. I wasn't having a problem before 4.2.20, now I am.
Everyone in support has their stint as the piñada. My users don't know who
SmarterTools or Declude are, they just know when they don't get their messages
or messages they send don't reach their destination. But they know who I am,
so I have to hold their hands and hear their cries and then take it back to
SmarterTools and Declude. And believe me, my users really know how to hit a
piñada because most of them are Spanish. :)
Another interesting thing is, before the decision was made to put this fix in
a release version, didn't anyone foresee that dumping all these previously
deleted files into the error folder would cause a problem? As soon as all
those messages started showing up in my error directory it became pretty
obvious. Seems that this work you mention that Declude is doing with
SmarterMail to resolve this problem should have been done before the fix was
put into 4.2.20.
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Tuesday, July 11, 2006 5:49 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Gary,
From time to time I feel like the Declude pinyada but in this instance we
have provided a solution for what is happening in SM. And as I have said we
are working with them to resolve this between us.
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Tuesday, July 11, 2006 5:31 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
I don't have an answer to this question. I just know that it is a problem.
But what I find amusing is, here is another instance of two vendors of
interacting software products who point the finger at each other, both
saying it's the other guy's fault.
Original Message
From: John T \(Lists\) [EMAIL PROTECTED]
Sent: Tuesday, July 11, 2006 5:21 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Although I do not use SmarterMail, my take is these are like T files
in Imail where it is not a complete message, but for some reason
SmarterMail is allowing Declude to have them even though they are not
complete.
John T
eServices For You
Seek, and ye shall find!
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Gary Steiner
Sent: Tuesday, July 11, 2006 12:13 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Here is SmarterTools take on the problem:
Failed is written to the .hdr if the message was not succesfully
recieved via SMTP.
For
instance, if the connection is closed mid transmission. These(and
corresponding
.emls) are
normally just deleted by SmarterMail. The only reason you are
noticing
them is
because of
Declude storing them in the error folder.
The implication is that Declude is interrupting part of
SmarterMail's
normail process.
Now I know this is essentially what Declude does anyway, but
shouldn't
Declude know
the difference between a message that has finished SMTP and
SmarterMail is
ready to
deliver, and a message that is incomplete in the SMTP process and an
SMTP
retry is
occurring so this failed message should be ignored? Otherwise we
are
going to get
thousands of unneccessary incomplete messages dumped into the error
folder
that is
going to do nothing other than to take up disk space. Not to
mention that
if some
other type of error occurs that puts a message in the error folder,
we'll
never find it
because its buried under all these other superfluous messages.
Before
4.2.20, this
wasn't a problem.
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Monday, July 10, 2006 3:24 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Gary,
This is a SmarterMail issue. When they fail to complete the .hdr
file
they
write Failed in the .hdr as this was causing major spam leakage
for declude we decided to move incomplete messages to the \error
folder.
You
could try changing the Failed to Written and drop the messages
in the \spool.
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Gary Steiner
Sent: Monday, July 10, 2006 2:52 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] 4.2 build 20 Released
RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
I don't know. I'm still trying to understand the problem. Declude added a fix to 4.2.20 that moves files to the error directory that they say were coming through as spam leakage. SmarterTools says these files are normally deleted by SmarterMail, and and the only reason I see them in the error directory is that Declude puts them there before SmarterMail has a chance to delete them. Now these two statements contradict each other. Either SmarterMail was deleting these files or it was not. Since I never saw them before 4.23.20, I have to assume that SmarterMail was deleting them. So if SmarterMail was deleting the files, then why did Declude decide to intercept them in 4.2.20 and prevent SmarterMail from deleting them? Hopefully, since as you say Declude is working with SmarterTools to resolve this between us we will see a new fix soon that will make this issue moot. Original Message From: David Barker [EMAIL PROTECTED] Sent: Wednesday, July 12, 2006 7:48 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Gary, If we gave you the option to delete these messages (as SmarterMail should be doing) rather than move them to the \error directory would that solve your problem ? David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Wednesday, July 12, 2006 3:41 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 As far as I'm concerned it's not a solution. SmarterMail deleting these messages was not a problem for me, Declude dumping them into the error folder is. I wasn't having a problem before 4.2.20, now I am. Everyone in support has their stint as the piñada. My users don't know who SmarterTools or Declude are, they just know when they don't get their messages or messages they send don't reach their destination. But they know who I am, so I have to hold their hands and hear their cries and then take it back to SmarterTools and Declude. And believe me, my users really know how to hit a piñada because most of them are Spanish. :) Another interesting thing is, before the decision was made to put this fix in a release version, didn't anyone foresee that dumping all these previously deleted files into the error folder would cause a problem? As soon as all those messages started showing up in my error directory it became pretty obvious. Seems that this work you mention that Declude is doing with SmarterMail to resolve this problem should have been done before the fix was put into 4.2.20. Original Message From: David Barker [EMAIL PROTECTED] Sent: Tuesday, July 11, 2006 5:49 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Gary, From time to time I feel like the Declude pinyada but in this instance we have provided a solution for what is happening in SM. And as I have said we are working with them to resolve this between us. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 11, 2006 5:31 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 I don't have an answer to this question. I just know that it is a problem. But what I find amusing is, here is another instance of two vendors of interacting software products who point the finger at each other, both saying it's the other guy's fault. Original Message From: John T \(Lists\) [EMAIL PROTECTED] Sent: Tuesday, July 11, 2006 5:21 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Although I do not use SmarterMail, my take is these are like T files in Imail where it is not a complete message, but for some reason SmarterMail is allowing Declude to have them even though they are not complete. John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, July 11, 2006 12:13 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 Here is SmarterTools take on the problem: Failed is written to the .hdr if the message was not succesfully recieved via SMTP. For instance, if the connection is closed mid transmission. These(and corresponding .emls) are normally just deleted by SmarterMail. The only reason you are noticing them is because of Declude storing them in the error folder. The implication is that Declude is interrupting part
RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
I don't have an answer to this question. I just know that it is a problem.
But what I find amusing is, here is another instance of two vendors of
interacting software products who point the finger at each other, both saying
it's the other guy's fault.
Original Message
From: John T \(Lists\) [EMAIL PROTECTED]
Sent: Tuesday, July 11, 2006 5:21 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Although I do not use SmarterMail, my take is these are like T files in
Imail where it is not a complete message, but for some reason SmarterMail is
allowing Declude to have them even though they are not complete.
John T
eServices For You
Seek, and ye shall find!
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Tuesday, July 11, 2006 12:13 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Here is SmarterTools take on the problem:
Failed is written to the .hdr if the message was not succesfully
recieved via SMTP.
For
instance, if the connection is closed mid transmission. These(and
corresponding
.emls) are
normally just deleted by SmarterMail. The only reason you are noticing
them is
because of
Declude storing them in the error folder.
The implication is that Declude is interrupting part of SmarterMail's
normail process.
Now I know this is essentially what Declude does anyway, but shouldn't
Declude know
the difference between a message that has finished SMTP and SmarterMail is
ready to
deliver, and a message that is incomplete in the SMTP process and an SMTP
retry is
occurring so this failed message should be ignored? Otherwise we are
going to get
thousands of unneccessary incomplete messages dumped into the error folder
that is
going to do nothing other than to take up disk space. Not to mention that
if some
other type of error occurs that puts a message in the error folder, we'll
never find it
because its buried under all these other superfluous messages. Before
4.2.20, this
wasn't a problem.
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Monday, July 10, 2006 3:24 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Gary,
This is a SmarterMail issue. When they fail to complete the .hdr file
they
write Failed in the .hdr as this was causing major spam leakage for
declude we decided to move incomplete messages to the \error folder.
You
could try changing the Failed to Written and drop the messages in the
\spool.
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Monday, July 10, 2006 2:52 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Now that I've installed 4.2.20, I'm getting a lot of messages in the
error
folder (I'm running SmarterMail 3.3.2369). Most of them seem to be
spam,
but there are some good messages in there. Am I now going to have to
scan
this folder for false positives just like the held spam folder?
Here is an example of the .hdr file for a message that was good:
Failed
[EMAIL PROTECTED]
[EMAIL PROTECTED]
cmdspc: false
helo: ivmail1.fcc.es
What does Failed mean? Is there something I can look for in the
headers
of the message (in the .eml file) that would indicate this? Is there
any
way to requeue this message?
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Friday, July 07, 2006 11:01 AM
To: Declude.Virus@declude.com, Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
EVA ADD New NONSTANDARDHDR vulnerability test. Messages
found to
have broken headers are moved to the \virus folder
EVA FIX ALLOWVULNERABILITIESFROM (for user)
EVA FIX BANEXT buffer overflow
SM ADD When an error is found in the envelope (.hdr) file
the
message is moved to the \error folder
SM ADD Decludeproc will not start without a valid
domainlist.xml
SM FIX QUEUEFILE_SAVEFILE the log is showing the correct
directory
path
SM FIX Allows admin to set VIRDIR to any directory path in
the
virus.cfg
David Barker
Product Manager
Your Email security is our businessT
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail. The archives can be found at
http://www.mail
re: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006
Now that I've installed 4.2.20, I'm getting a lot of messages in the error folder (I'm running SmarterMail 3.3.2369). Most of them seem to be spam, but there are some good messages in there. Am I now going to have to scan this folder for false positives just like the held spam folder? Here is an example of the .hdr file for a message that was good: Failed [EMAIL PROTECTED] [EMAIL PROTECTED] cmdspc: false helo: ivmail1.fcc.es What does Failed mean? Is there something I can look for in the headers of the message (in the .eml file) that would indicate this? Is there any way to requeue this message? Original Message From: David Barker [EMAIL PROTECTED] Sent: Friday, July 07, 2006 11:01 AM To: Declude.Virus@declude.com, Declude.JunkMail@declude.com Subject: [Declude.JunkMail] 4.2 build 20 Released 6 July 2006 EVA ADD New NONSTANDARDHDR vulnerability test. Messages found to have broken headers are moved to the \virus folder EVA FIX ALLOWVULNERABILITIESFROM (for user) EVA FIX BANEXT buffer overflow SMADD When an error is found in the envelope (.hdr) file the message is moved to the \error folder SMADD Decludeproc will not start without a valid domainlist.xml SMFIX QUEUEFILE_SAVEFILE the log is showing the correct directory path SMFIX Allows admin to set VIRDIR to any directory path in the virus.cfg David Barker Product Manager Your Email security is our businessT 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude Security Suite in Add or Remove Programs
I just went into Add or Remove Programs under the Control Panel of my W2K3 server to remove something unrelated to Declude, and noticed that Declude Security Suite is listed there three times. When I click on Click here for support information for each entry, they give versions as follows: 4.02.0003, 4.02.0020, and 4.02.0012 respectively. Do I need to uninstall Declude every time I run an upgrade to 4.x? Doesn't Declude's installer detect these previous instances and correct for them? If I try to remove 4.02.0003 and 4.02.0012 using the Control Panel, will the latest version of Declude still be there when it is finished? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ZEROHOUR
What is the ZEROHOUR test? I see it in the X-Declude headers, but I don't have it defined in any of my config files. I don't see it mentioned in any of the manuals either. Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Where do I enter my serial number
I believe Declude Support has to do it manually on their end. However, they are closed on the weekend, so you are not going to get any response from them til Monday (unless they are taking off Monday in conjunction with the 4th of July, in which case you may have to wait until Wednesday). Regardless, you should send a message to Declude Support ([EMAIL PROTECTED]) with your serial number and hopefully you will hear back from them sooner than later. Gary Original Message From: Joe Raykiewicz [EMAIL PROTECTED] Sent: Sunday, July 02, 2006 11:23 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Where do I enter my serial number I purchased the Declude 4.2 security suite. I have smartermail 3.3 enterprise. Where do I enter my serial number? Thanks, Joe --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] FW: [SPAM]I must apologize ...
Try the SUBJECTCHARS test. It will catch spam that has a certain number of characters in the subject. For 60 characters and a weight of 4 the test would be SUBJECTCHARS subjectchars 60 x 4 0 From: "Marc Catuogno" [EMAIL PROTECTED]Sent: Thursday, June 22, 2006 9:55 PMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I amMr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is anurgent and very confidential business proposition. On June 6, 2001,a Foreign Oil con Is this from broken spamware? The whole 'pitch' is in the subject. What a pain to filter. From: LEWIS MUSASIKE [mailto:[EMAIL PROTECTED] Sent: Thursday, June 22, 2006 3:03 PMTo: [EMAIL PROTECTED]Subject: [SPAM]I must apologize for this unsolicited nature of my email. I amMr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is anurgent and very confidential business proposition. On June 6, 2001,a Foreign Oil consult I have a new email address! You can now email me at: [EMAIL PROTECTED]- LEWIS MUSASIKE ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Test
No. Most likely it is because declude.junkmail typically experiences a lot of traffic, but recently it's been extremely quiet. I guess some folks just got paranoid. Instead of posting test messages, it would be better if folks asked a question or made an appropriate comment to start a thread. Original Message From: Arik Keller [EMAIL PROTECTED] Sent: Tuesday, June 13, 2006 2:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Test Have we been having problems with this? _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaun Patterson Sent: Tuesday, June 13, 2006 1:50 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Test Another Test to See that the List is working properly. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: AW: AW: AW: [Declude.JunkMail] No action taken
Before I started seeing these spams, my Declude logs were set to MID, and each of these new spams would show the same three lines: 06/04/2006 07:25:39.868 50467903 Error in envelope file: c:\SmarterMail\Spool\proc\work\50467903.hdr 06/04/2006 07:25:46.165 50467903 AHBL:6 CBL:14 DSBL:6 MXRATE-BLOCK:7 SORBS-HTTP:5 SORBS-WEB:5 SPAMCOP:14 FIVETENSRC:4 BADHEADERS:8 REVDNS:6 . Total weight = 75. 06/04/2006 07:25:46.165 50467903 Cumulative action(s) taken on this email = NO ACTIONS WERE TAKEN The received message would always contain some bogus character in the Return line: Return-Path: y Sun Jun 04 15:30:55 2006 and the Declude Sender would always be blank: X-Declude-Sender: [85.18.14.30] The WEIGHT14, WEIGHT20, and WEIGHT30 tests I have defined don't show up in the tests failed, and those are the tests that do the holding. Yet as you can see above with a message of weight 75 that those tests should have been triggered. So it would seem that somehow Declude aborts before it gets to those tests. Also, the Country Chain statement that appears in the message header is always blank: X-Country-Chain: I have since changed the log level to DEBUG and sent Declude a copy of those logs. Hopefully everyone else who is experiencing this problem is doing the same. If you want to reproduce this problem on your own system, just take the two characters shown above and swap them for the return line in one of your held spams, then requeue the message. You will see it go through just as described by everyone else on this list. Original Message From: Colbeck, Andrew [EMAIL PROTECTED] Sent: Monday, June 05, 2006 7:43 PM To: declude.junkmail@declude.com Subject: RE: AW: AW: AW: [Declude.JunkMail] No action taken Another country heard from (hey, literally!). I'm not seeing the email patterns reported. I have a gateway-only scenario so I thought a different angle on this might be helpful. Like Matt, I thought an illegal character or unusual MAILFROM might contribute to the problem. I looked through my last few days of logs and although I found enough NO ACTIONS WERE TAKEN, they were all because of valid whitelist entries. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Monday, June 05, 2006 3:49 PM To: declude.junkmail@declude.com Subject: Re: AW: AW: AW: [Declude.JunkMail] No action taken Markus, Maybe you could post log snippets from both IMail and Declude??? In this case a Q file would also be golden. It kind of sounds like a non-standard character is being sent and Declude may be barfing on the pattern??? It may be that Declude is showing a null sender (or l in one of your examples) because it isn't expecting the character and barfs on the data. Then this may in turn be causing other unexpected behavior. Just guessing of course. I would dig, but this stuff isn't coming through my gateway. Matt Markus Gufler wrote: looking at another mailserver smtp logfile I can't realy see some malformed mailfrom line. The only thing I can see in the othe logfiles is a wave of messages with mailfrom lines like [EMAIL PROTECTED] the first character is random the second one seems always be an underscore (or something similar) then is attached a name after the underscore and before the @ after the @ the domains is a random name like mail bk or inbox the final TLD seems always be .ru This pattern of mailfrom is missing completely in the same time range on my IMail Server. There are only mailfrom's like l the first character is random the second one seems bring IMail/Declude in the nirvana... Markus _ Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Markus Gufler Gesendet: Dienstag, 6. Juni 2006 00:07 An: declude.junkmail@declude.com Betreff: AW: AW: AW: [Declude.JunkMail] No action taken After seeing this in the smtp logfile it seems not logic to me that there must be something wrong in the configuration. The first line of the declude logfiles says that the message is failing several tests and that is not whitelisted as other correctly whitelisted messages are Both in- and outgoing final actions are defined to hold such type of messages but they are not hold. There are only 4 defined actions IN:Subject, IN:Hold, OUT:Subject and OUT:Hold plus the IGNORE-action. At least one of this
Re: [Declude.JunkMail] How can I block all the stock spams?
I found after doing an install of Declude 4.2.3, that it contained an all_list.dat file with a date of 3/29/2006 and a file size of 310kb (318,376 bytes). Gary Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Wednesday, May 03, 2006 1:44 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How can I block all the stock spams? 88.247.84.83 should be Turkey. I think an update of the all_list.dat file by Declude may be in order. Mine is dated 10/19/2005. - Original Message - From: Jonas Fornander [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, May 03, 2006 11:16 AM Subject: RE: [Declude.JunkMail] How can I block all the stock spams? Here is the header of one of them from my Outlook. How can they send a message from an IANA reserved IP and have it come through? It's like it passes all tests without a glitch. Received: from SMTP32-FWD by malibuonline.com (SMTP32) id A8B5F01330DA4; Wed, 3 May 2006 03:52:29 -0700 Received: from MX4.NetWood.net [209.247.184.2] by malibuonline.com with ESMTP (SMTPD-8.22) id AB5F02B8; Wed, 03 May 2006 03:52:15 -0700 X-Greylist: delayed 306 seconds by postgrey-1.24 at mx4.netwood.net; Wed, 03 May 2006 03:51:53 PDT Received: from dsl88-247-21587.ttnet.net.tr (unknown [88.247.84.83]) by MX4.NetWood.net (Postfix) with SMTP id E4ED3605F2 for [EMAIL PROTECTED]; Wed, 3 May 2006 03:51:53 -0700 (PDT) Received: from ouo ([88.247.189.90]) by dsl88-247-21587.ttnet.net.tr (8.13.4/8.13.4) with SMTP id k43As5FT008132; Wed, 3 May 2006 13:54:05 +0300 Message-ID: [EMAIL PROTECTED] From: May Morales [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: bowling Date: Wed, 3 May 2006 13:50:22 +0300 MIME-Version: 1.0 Content-Type: multipart/related; type=multipart/alternative; boundary==_NextPart_000_000F_01C66EB8.C44B8810 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. X-RBL-Warning: HELOBOGUS: Domain dsl88-247-21587.ttnet.net.tr has no MX or A records [0301]. X-Declude-Sender: [EMAIL PROTECTED] [88.247.84.83] X-Declude-Spoolname: D8b5f01330da4.smd X-Declude-Note: Scanned by Declude 3.0.5.22 for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [5] at 03:52:29 on 03 May 2006 X-Declude-Fail: HELOBOGUS [5] X-Country-Chain: [IANA Reserved]-UNITED STATES-destination X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 357629068 X-IMail-ThreadID: 8b6d075c321b Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, May 01, 2006 5:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How can I block all the stock spams? You might be able to come up with some filters for them, but I think of Declude more an enabler than a filter in itself. Darin. - Original Message - From: Jonas Fornander [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 01, 2006 8:13 PM Subject: RE: [Declude.JunkMail] How can I block all the stock spams? So Declude can't block these? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, May 01, 2006 5:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How can I block all the stock spams? Sniffer does a good job of it. I can't think of the last one that has slipped through. Darin. - Original Message - From: Jonas Fornander [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 01, 2006 7:47 PM Subject: [Declude.JunkMail] How can I block all the stock spams? Imail 8.22, Declude 3.0.5 Does anyone have a solution on how to block all the penny-stock spams that are circulating? The ones that are blocked seems to be so because the message triggers spamcop etc. However, there seems to be no filter that can remove them because of the content or headers. Some of them pass through with a weight of
[Declude.JunkMail] Declude whitelisting with SmarterMail Trusted Senders
Now that I have installed Declude 3.1 with SmarterMail 2.6, I see that Declude is whitelisting certain addresses based on SmarterMail's Trusted Senders section of My Spam Filtering. Is there any way to turn this feature off in Declude so that it continues to function as part of SmarterMail but not in Declude? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ARIN Unlisted
I received a spam from 209.200.224.192 which Declude reported as X-Country-Chain: [ARIN Unlisted]-destination I went to www.arin.net and did a whois, and 209.200.224.192 came up as a typical US company. What is ARIN unlisted? Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bcc failure - Mystery solved
I've seen something similar to this, though in that paticular case it was a redundant quote or apostrophe in the name part of the email address. Original Message From: Orin Wells [EMAIL PROTECTED] Sent: Saturday, April 01, 2006 8:09 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Bcc failure - Mystery solved Interesting. Buried in among the 87 email addresses was one with a typo that added an extra @ in a bad place. [EMAIL PROTECTED]@aol.com for example. It was 32nd on the list but apparently this was enough to trip up Declude to declare EVERY address to be sensed to include a Percent sign. What the address resolved to was [EMAIL PROTECTED] My guess is Declude is doing a scan on the WHOLE bcc set rather than breaking it down for each address individually even though the message later shows the specific address alleged to be getting tested. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF tests in Declude
I've seen all the talk for and against SPF on this list, and I've been trying to decide how much weight I want to give SPF. (I'm currently using Declude 3.0.6.4 and SmarterMail 2.6). I started playing around with SmarterMail's SPF tags by setting them to a low or zero weight just so I could see the tags in the headers and get an idea as to how much spam was passing, and how much ham was failing.Then I started to think about Declude. For some reason I had assumed that Declude's SPF tests were commented out in my config files. I checked and found that I was wrong. In my global.cfg file, there was the following: SPFFAIL spffail x x 3 0 SPFPASS spfpass x x -3 0 and in my $default$.junkmail file there was SPFFAIL WARN SPFPASS WARN yet I have never seen in the header of any message a tag from Declude that said anything about SPF. I do see tags from SmarterMail like SPF_Pass, SPF_Neutral and SPF_None. I am I missing something here? Do these tests work in Declude? Is there some other statement I need in my config files for these tests to work? Thanks in advance, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPF tests in Declude
I assume the values I show are the default ones that came with Declude. However, that's not my issue. The values are meaningless if the test is not working. I'm not even sure that Delude is using these values, since I never see a Declude SPF tag in a message header. Do your tests show up in your message headers? As an aside, I've seen many non-spammers failing the SmarterMail SPF check, and few spammers passing it. Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Thursday, March 30, 2006 8:35 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SPF tests in Declude Many spammers have an SPF record. So the SPFPASS deserves no negative weight. I have SPFPASS set at zero Here's my settings: SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 SPFFAIL spf fail x 50 0 - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 30, 2006 6:36 PM Subject: [Declude.JunkMail] SPF tests in Declude I've seen all the talk for and against SPF on this list, and I've been trying to decide how much weight I want to give SPF. (I'm currently using Declude 3.0.6.4 and SmarterMail 2.6). I started playing around with SmarterMail's SPF tags by setting them to a low or zero weight just so I could see the tags in the headers and get an idea as to how much spam was passing, and how much ham was failing.Then I started to think about Declude. For some reason I had assumed that Declude's SPF tests were commented out in my config files. I checked and found that I was wrong. In my global.cfg file, there was the following: SPFFAIL spffail x x 3 0 SPFPASS spfpass x x -3 0 and in my $default$.junkmail file there was SPFFAIL WARN SPFPASS WARN yet I have never seen in the header of any message a tag from Declude that said anything about SPF. I do see tags from SmarterMail like SPF_Pass, SPF_Neutral and SPF_None. I am I missing something here? Do these tests work in Declude? Is there some other statement I need in my config files for these tests to work? Thanks in advance, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPF tests in Declude
I couldn't see the forest for the trees. After digging through the archive of this mailing list, I finally figured out that Scott's example had an extra space and one less x. I had assumed the the default format that was installed with Declude was correct. Now I will have to check the other tests that I haven't paid much attention but assumed the default was correct. Thanks Scott, and all the others who patiently gave the answer in the past. Gary Original Message From: Gary Steiner [EMAIL PROTECTED] Sent: Thursday, March 30, 2006 8:51 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SPF tests in Declude I assume the values I show are the default ones that came with Declude. However, that's not my issue. The values are meaningless if the test is not working. I'm not even sure that Delude is using these values, since I never see a Declude SPF tag in a message header. Do your tests show up in your message headers? As an aside, I've seen many non-spammers failing the SmarterMail SPF check, and few spammers passing it. Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Thursday, March 30, 2006 8:35 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] SPF tests in Declude Many spammers have an SPF record. So the SPFPASS deserves no negative weight. I have SPFPASS set at zero Here's my settings: SPFPASS spf pass x 0 0 SPFUNKNOWN spf unknown x 0 0 SPFFAIL spf fail x 50 0 - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 30, 2006 6:36 PM Subject: [Declude.JunkMail] SPF tests in Declude I've seen all the talk for and against SPF on this list, and I've been trying to decide how much weight I want to give SPF. (I'm currently using Declude 3.0.6.4 and SmarterMail 2.6). I started playing around with SmarterMail's SPF tags by setting them to a low or zero weight just so I could see the tags in the headers and get an idea as to how much spam was passing, and how much ham was failing.Then I started to think about Declude. For some reason I had assumed that Declude's SPF tests were commented out in my config files. I checked and found that I was wrong. In my global.cfg file, there was the following: SPFFAIL spffail x x 3 0 SPFPASS spfpass x x -3 0 and in my $default$.junkmail file there was SPFFAIL WARN SPFPASS WARN yet I have never seen in the header of any message a tag from Declude that said anything about SPF. I do see tags from SmarterMail like SPF_Pass, SPF_Neutral and SPF_None. I am I missing something here? Do these tests work in Declude? Is there some other statement I need in my config files for these tests to work? Thanks in advance, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: port forwarding
Dave, Here is the latest reply I received from SmarterTools Regarding this issue: This has been verified as intended action. We do not see this as a bug. If you feel it is a security hazard, do not view HTML messages. Within SmarterMail, simply set the default view to Plain Text, and not HTML. If you feel a message is safe, view it in the HTML mode manually. Maybe you will have better lunk convincing them otherwise. Gary Original Message From: Dave Doherty [EMAIL PROTECTED] Sent: Thursday, March 23, 2006 8:49 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: port forwarding I have had similar experiences with them right back to the beginning. I think the quality of the service you get varies greatly with the individual. If they get it the response is usually pretty good. It does not always seem easy to get them to get it though... I held off deploying SM in my plant for over a year because I wanted to see how the product would evolve. I was - and remain - very impressed with V3 overall. Every complicated product is going to have some issues, the real issue is how they respond when the product meets the users abnd the trouble tickets start flying. I just submitted a detailed ticket with screenshots and a good explanation as to why I think this is a major issue. It will be very interesting to see what kind of response I get. -Dave Doherty Skywaves, Inc. - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 23, 2006 6:42 PM Subject: Re: [Declude.JunkMail] OT: port forwarding Matt, I tried all that... --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: port forwarding
The original message had no HTML part. You probably have a copy of it, it was
Dave Doherty's message to this list dated Wed, 22 Mar 2006 15:49:42 -0500
with a subject line of Re: [Declude.JunkMail] OT: port forwarding.
SmarterMail's web mail interpreted the META tag Dave illustrated in his message
as HTML.
Original Message
From: Kevin Bilbee [EMAIL PROTECTED]
Sent: Thursday, March 23, 2006 1:36 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] OT: port forwarding
This is a bug SmarterMail they need to do the replacements when displaying a
plaintext email. Or switch the view automatically if there is only a
plaintext portion of the email.
Does the origional email have a plaintext and html portion???
If it does and the HTML portion is blank then they are doing what many
clients would do. Default to the HTML view. They also may be using poor
judgment and assuming that no one would ever discuss HTML tags in a plain
text email and not parsing them.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Gary Steiner
Sent: Thursday, March 23, 2006 8:47 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: port forwarding
I can't get SmarterTools to see this as a bug. Their answer is
that their web mail is set to HTML by default, and you should
just click on the plain text link to view it. Their support
doesn't seem to be able to grasp the wider implications of this problem.
Gary
Original Message
From: Matt [EMAIL PROTECTED]
Sent: Wednesday, March 22, 2006 6:31 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: port forwarding
That's surely a bug. Dave sent his message as plain/text and
SmarterMail should be replacing the brackets with HTML encoding before
displaying it as HTML so that it should not be a functional
element when
displayed., i.e.
lt;meta http-equiv=Refresh content=5;
URL=http://www.mydomain.comgt;
If Dave had sent it as an HTML message, his client would have done the
replacement for him.
This should probably be reported to SmarterMail. There are a lot of
potential consequences, for instance, virus scanners won't generally
consider code in plain/text segments to be executable, yet it can be in
SmarterMail webmail if it is working the way that you reported.
Matt
Gary Steiner wrote:
It is interesting how SmarterMail's web mail interprets Dave's
message. It sees the META statement in his message as embedded
code, and runs it when I read the message.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: port forwarding
Matt, I tried all that. It seemed like they didn't want to listen, or that the whole concept was just foreign to them. It's like the support people are multitasking and are unwilling to take the time to properly listen to the customer and dissect the problem. I've had very strange results dealing with their support. One day I get the perfect response to my questions, and the next day it is like I am talking to someone on another planet. Maybe their focus has changed somewhat as well. Their online forums used to be very useful. They were very well organized, and the support people participated on a daily basis. Around the time that 3.0 came out they changed the organization of their forums, lumping a lot of separate secitons together. Now you get the newbie user questions mixed together with the questions from server administrators. Also, it seems that over the past two weeks the support people have stopped posting on the forums altogether, the only ones posting now are the users. If this is an indication of a major policy shift on their part, this does not bode well for the future. Which is a shame considering that SmarterMail seems to be taking off as a product. Deja vu all over again. I've been going over another problem with them regarding Yahoo Groups. For some reason mail sent from SmarterMail to Yahoo Groups gets bounced by Yahoo as a 554 error stating that the message was sent as a BCC (which it most definitely was not). When I talked to Yahoo, they said it was a SmarterMail problem, and of course, SmarterMail insisted it was a Yahoo problem. Everyone is ready to wash their hands of the problem rather than try to get it solved. Sorry if I've gone off on a rant, but both of these problems seem to me to be indicative of potentially significant bugs, but I can't seem to get that message across. Gary Original Message From: Matt [EMAIL PROTECTED] Sent: Thursday, March 23, 2006 5:39 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: port forwarding Gary, I've had some issues getting them past the part where they assume user error or something else that is outside of their immediate control so that they can actually look at the issue at hand. It may be just simply an issue of them not listening/reading carefully enough. All I can say is that you might want to go back to square one and re-explain the issue. I think that Kevin made the essence of that clear in his reply, but I would then add to it the unfortunate issues that can result from displaying plain text as HTML, and suggest that if they are displaying a plain/text only message, to do some bracket replacement in order to keep plain/text elements from becoming functional in the HTML view. Showing a message that is plain/text as HTML is fine just so long as they replace the brackets. Matt Gary Steiner wrote: I can't get SmarterTools to see this as a bug. Their answer is that their web mail is set to HTML by default, and you should just click on the plain text link to view it. Their support doesn't seem to be able to grasp the wider implications of this problem. Gary Original Message From: Matt [EMAIL PROTECTED] Sent: Wednesday, March 22, 2006 6:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: port forwarding That's surely a bug. Dave sent his message as plain/text and SmarterMail should be replacing the brackets with HTML encoding before displaying it as HTML so that it should not be a functional element when displayed., i.e. lt;meta http-equiv=Refresh content=5; URL=http://www.mydomain.comgt; If Dave had sent it as an HTML message, his client would have done the replacement for him. This should probably be reported to SmarterMail. There are a lot of potential consequences, for instance, virus scanners won't generally consider code in plain/text segments to be executable, yet it can be in SmarterMail webmail if it is working the way that you reported. Matt Gary Steiner wrote: It is interesting how SmarterMail's web mail interprets Dave's message. It sees the META statement in his message as embedded code, and runs it when I read the message. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail
re: [Declude.JunkMail] How to let these through?
Create some sort of counter weight. Use an ipfile with 209.191.87.115 or even 209.191.87.0/24, or whitelist mail.mud.yahoo.com depending on how open you want to be. Though counter weights are always better than whitelisting. Gary Original Message From: mail-lists [EMAIL PROTECTED] Sent: Thursday, March 16, 2006 6:24 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How to let these through? Hi All, Declude is catching all these e-mails from Yahoo, but none of them are spam. All are people sending in their resumes to one of our addresses. The only thing I can think of to not have to check the spam mailbox every day is to lessen the weight for sorbs.net or the spamcop. Anybody else have any other ideas? Received: from web37802.mail.mud.yahoo.com [209.191.87.115] by cottonwoodfinancial.com (SMTPD-8.21) id A955043C; Thu, 16 Mar 2006 09:50:45 -0600 Received: (qmail 7894 invoked by uid 60001); 16 Mar 2006 15:51:37 - DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content -Transfer-Encoding; b=WQmus1SO/ZKGxeVX8AV9XGBnoMOymaNYI8yAO0I2spM3QI0PZsFuiYITmvcDV1wa0EwVF1YCez C/8irInVLO4uvaqz7p6hzgooatUWLolYQKWfZyDbzagb0q3uYpoH/ntCW9ptLO+6WXRbn9oD94Gq jzRc6CG5S0FxhM9cEdxmw= ; Message-ID: [EMAIL PROTECTED] Received: from [12.44.141.155] by web37802.mail.mud.yahoo.com via HTTP; Thu, 16 Mar 2006 07:51:37 PST Date: Thu, 16 Mar 2006 07:51:37 -0800 (PST) From: Christina Rangel [EMAIL PROTECTED] Subject: **SPAM**Administrative Assistant position To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=0-1336822531-1142524297=:3557 Content-Transfer-Encoding: 8bit X-RBL-Warning: SORBS-SPAM: Spam Received See: http://www.sorbs.net/lookup.shtml?209.191.87.115; X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?209.191.87.115; X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [209.191.87.115] X-Declude-Spoolname: D8955016c62a1.smd X-Declude-Note: Scanned by Declude 3.0.5.5 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [21] at 09:51:00 on 16 Mar 2006 X-Declude-Tests: SORBS-SPAM, SPAMCOP, NOABUSE, CMDSPACE, WEIGHT10, WEIGHT14, WEIGHT17 X-Country-Chain: UNITED STATES-[ARIN Unlisted]-destination X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 442267111 X-IMail-ThreadID: 8955016c62a1 Received: from web37403.mail.mud.yahoo.com [209.191.87.56] by cottonwoodfinancial.com (SMTPD-8.21) id A9EF0370; Thu, 16 Mar 2006 13:18:07 -0600 Received: (qmail 72097 invoked by uid 60001); 16 Mar 2006 19:18:50 - DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content -Transfer-Encoding; b=I3biouTvlc8omRiaJxaYTU4x5wYoYmWg+DjBnHV3ClJI/q/KEGcOOIcEfrJipktFPMWsUS8wsj /JT0ZL6IGxOzcFQm2qoyAX+UoZQ+p6gdF59FU0+paJhMJZMqmNv9RNeyF1OfpED9qVwWxTASBGdZ VHaVd4Ka38hI6UlPv9w2c= ; Message-ID: [EMAIL PROTECTED] Received: from [66.140.43.241] by web37403.mail.mud.yahoo.com via HTTP; Thu, 16 Mar 2006 11:18:50 PST Date: Thu, 16 Mar 2006 11:18:50 -0800 (PST) From: judy tubbs [EMAIL PROTECTED] Subject: **SPAM**Attention Human Resources, Resume To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=0-1608391185-1142536730=:68928 Content-Transfer-Encoding: 8bit X-RBL-Warning: SORBS-SPAM: Spam Received See: http://www.sorbs.net/lookup.shtml?209.191.87.56; X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?209.191.87.56; X-RBL-Warning: CSMA-SBL: http://bl.csma.biz/cgi-bin/listing.cgi?ip=209.191.87.56; X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [209.191.87.56] X-Declude-Spoolname: Db9ef016166d8.smd X-Declude-Note: Scanned by Declude 3.0.5.5 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [18] at 13:18:37 on 16 Mar 2006 X-Declude-Tests: SORBS-SPAM, SPAMCOP, CSMA-SBL, NOABUSE, WEIGHT10, WEIGHT14, WEIGHT17 X-Country-Chain: UNITED STATES-[ARIN Unlisted]-destination X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 442526958 X-IMail-ThreadID: b9ef016166d8 Cavell McDermott Network Administrator Cottonwood Financial 1901 Gateway Dr. Suite 200 Irving, TX 75038 [EMAIL PROTECTED] tel: mobile: 972-753-0822 x1200 214-403-4918 Add me to your address book...Want a signature like this? Confidentiality Notice: The information contained in this transmission is intended only for the personal and confidential use of the designated recipient named above. If the receiver of
RE: [Declude.JunkMail] ip4r failure
How do I find that out? It is just an address that my hosting provider has given me. I have no control over or way to access the DNS server. Gary Original Message From: John T \(Lists\) [EMAIL PROTECTED] Sent: Wednesday, March 15, 2006 2:40 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] ip4r failure What is the OS of the DNS server being used? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, March 14, 2006 7:27 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] ip4r failure I've been having this problem with Declude going back to August and my installation of 2.0.6. I'm currently running 3.0.6.4 with SmarterMail 2.6. It seems that irregularly Declude's ip4r tests time out, but SmarterMail redundantly running the same tests has no trouble picking up the spam. I have SM and Declude both testing SPAMCOP, DSBL, CBL, Spamhaus SBL, and Basura. What will happen is a spam will get through Declude, but get caught by SM using the same tests. For example, following is from the header of a recent message: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: DYNHELO: Dynamic HELO found. X-Declude-Sender: [EMAIL PROTECTED] [69.205.200.200] X-Declude-Spoolname: 45172055.eml X-Declude-Note: Scanned by Declude 3.0.6.4 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [7] at 21:24:19 on 14 Mar 2006 X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, DYNHELO X-Country-Chain: UNITED STATES-destination X-SmarterMail-Spam: BAYESIAN FILTERING, CBL, SPAMCOP I went over this several times with Declude support, and the best they were able to come up with is for me to add WINSOCKCLEANUP ON to my declude.cfg, which changed nothing. Using the DNS statement in the global.cfg also produced no effect. Maybe now that Declude and SmarterTools have such a close relationship, Declude can ask SmarterTools how their ip4r tests work. Especially since Declude is supposed to be using the DNS server information as set within SmarterMail. Has anyone else experienced this problem? I'm sure the next thing I will hear is that this problem will go away if I upgrade to SM 3.0 and Declude 4.0. TIA, Gary --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ip4r failure
That may speed up resolution, but that's not my issue. The question is why
does SmarterMail catch the spam using the same ip4r tests? It is the same
message, and the tests are being perfomed on the same eml file within a few
seconds of each other. Why does Declude fail and SM succeed?
Gary
Original Message
From: John T \(Lists\) [EMAIL PROTECTED]
Sent: Wednesday, March 15, 2006 1:22 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] ip4r failure
Although others opinions may vary, you are better off using a cache only DNS
server in-house for you mail server resolution. I do this on the Imail
server itself. Speeds up resolution.
John T
eServices For You
Seek, and ye shall find!
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Gary Steiner
Sent: Wednesday, March 15, 2006 10:05 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] ip4r failure
How do I find that out? It is just an address that my hosting provider
has given me.
I have no control over or way to access the DNS server.
Gary
Original Message
From: John T \(Lists\) [EMAIL PROTECTED]
Sent: Wednesday, March 15, 2006 2:40 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] ip4r failure
What is the OS of the DNS server being used?
John T
eServices For You
Seek, and ye shall find!
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Gary Steiner
Sent: Tuesday, March 14, 2006 7:27 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] ip4r failure
I've been having this problem with Declude going back to August and my
installation
of 2.0.6. I'm currently running 3.0.6.4 with SmarterMail 2.6. It
seems
that
irregularly Declude's ip4r tests time out, but SmarterMail redundantly
running the
same tests has no trouble picking up the spam. I have SM and Declude
both
testing
SPAMCOP, DSBL, CBL, Spamhaus SBL, and Basura. What will happen is a
spam
will
get through Declude, but get caught by SM using the same tests. For
example,
following is from the header of a recent message:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected.
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: DYNHELO: Dynamic HELO found.
X-Declude-Sender: [EMAIL PROTECTED] [69.205.200.200]
X-Declude-Spoolname: 45172055.eml
X-Declude-Note: Scanned by Declude 3.0.6.4
(http://www.declude.com/x-note.htm)
for spam.
X-Declude-Scan: Score [7] at 21:24:19 on 14 Mar 2006
X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, DYNHELO
X-Country-Chain: UNITED STATES-destination
X-SmarterMail-Spam: BAYESIAN FILTERING, CBL, SPAMCOP
I went over this several times with Declude support, and the best they
were able to
come up with is for me to add WINSOCKCLEANUP ON to my declude.cfg,
which
changed nothing. Using the DNS statement in the global.cfg also
produced
no effect.
Maybe now that Declude and SmarterTools have such a close
relationship,
Declude
can ask SmarterTools how their ip4r tests work. Especially since
Declude
is supposed
to be using the DNS server information as set within SmarterMail.
Has anyone else experienced this problem? I'm sure the next thing I
will
hear is that
this problem will go away if I upgrade to SM 3.0 and Declude 4.0.
TIA,
Gary
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
