Re: [Declude.JunkMail] No one at Declude?
No, there is no one here except us chickens :) http://en.wikipedia.org/wiki/Ain%27t_Nobody_Here_But_Us_Chickens On 4/10/2013 3:10 PM, John Dobbin wrote: Is this list still working? Thanks John Dobbin Pen Publishing Interactive - http://www.penpublishing.com -Original Message- From: Dave Beckstrom [mailto:db...@atving.com] Sent: Tuesday, April 09, 2013 3:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] No one at Declude? Someone should start up a new discussion list that everyone can join before this one goes away. It would be good to have a place to continue collboration. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)789-0966x200 (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROMNOMATCH returning high scores
I have not seen that. Herb On 5/18/2011 12:12 PM, Jim Comerford wrote: Has anyone else seen the FROMNOMATCH test returning ridiculously high scores (like 1027774676) event though its not configured to do so... and yet Declude does not act on the cumulative score, so for example a message with score 1027774676 would not get deleted like it is configured to at a score of 30? Curious if anyone else is seeing this and if they know the cause. -Jim --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)789-0966x200 (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Forged-Spam Backscatter
Same here, we normally run 100 or so messages a min @ 70% spam, now seeing peaks of 400-500 @ 97% Seems much worse in the last 2 weeks or so. I think that we all have lots of company. Herb Darrell ([EMAIL PROTECTED]) wrote: Jim, While others may cringe regarding this, but some of the backscatter I have had to deal with (excess of 500-1000 messages a minute at times) I have had to put filters in place to delete null senders for periods of time. Darrell Jim Comerford wrote: Over the last several weeks we have seen a dramatic increase in spam hitting our server. From about 70,000 mails a day to around 110,000 /day. Most destined for our users is getting properly filtered by declude. What is getting thru is backscatter from spam that is forging addresses from domains we host. It seems just about any address that is posted on a website seems to be being used to forge outgoing spam (not from our server) -- and is generating all sorts of bounce messages. I suspect there is not much I can do to block this backscatter without blocking legit bounce messages... but I thought I'd ask. Here is our config: Imail 8.22 Declude 4.3.64 invURIBL 3.1.1 Sniffer --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Cell (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Any Known issues Inv-URIBL today?
Hi Randy; We have seen that often, in fact what we do is swap that test in on nights and weekends and out during weekdays (by just renaming the declude conf files with a schedule). It is a nice tool but will bog things down. Herb Randy Armbrecht wrote: We're seeing a backup today on mulitple occasions now in the Declude Proc folder. Proc folder has grown to as many as 6000+ items in it; once we turn off our Inv-URIBL filter, messages start processing again. . Any known issues that would cause this? We're still running an older version of Inv-URIBL (1.1x I believe) --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 http://globalweb.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Cell (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Where'd Dell go?
There is a 10 gig connection out between 2 data centers in Chicago, traffic is rerouted now, but that was probably the issue as a pretty big time peering hub is not well connected and had real problems early this morning. Herb Michael Hardrick wrote: Maybe Microsoft is trying to buy them out! Assimilation !!! :P MH *From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On Behalf Of *SJ.Stanaitis *Sent:* Friday, February 01, 2008 7:33 AM *To:* declude.junkmail@declude.com *Subject:* [Declude.JunkMail] OT: Where'd Dell go? I can't seem to get to www.dell.com http://www.dell.com from my network here or 2 other non-related external networks either...anyone else having a problem getting there? Cheers, --SJ SJ.Stanaitis - /Network Administrator/ Decorative Product Source, Inc --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. No virus found in this incoming message.. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.19.17/1253 - Release Date: 1/31/2008 9:09 AM No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.19.18/1255 - Release Date: 2/1/2008 9:59 AM --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Cell (off hours or if out of office) This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Question on Smartermail Domain forwarding/Declude issue
Hi All; We have a couple customers that we used to host mail for that now have their own Exchange servers. However, we still filter their mail using the Smartermail 4.3 Domain Forwarding feature. We normally mark mail with 15 spam points and delete at 40. They have asked us to no longer delete any messages. Does anyone know, can we do an individual config for them by making a sub folder with the domain name as is normally done. From what I can see, this does not work. Anyone know for sure? Running Declude as below Declude 4.3.62 Diagnostics Compilation Platform: SmarterMail Copyright (c) 2000-2005 Declude, Inc. Host NameX Daisy Chain DNS Server X Product Details JunkMail Pro EVAPro Hijack Pro -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] noticed problem after upgrade to beta
Hi All; We have been experiencing the same declude shutdown errors when running declude for smartermail that some of you have been seeing. On Friday I upgraded to the beta version as had been suggested. We had some customers who were not seeing some incoming messages. Declude was tripping on a couple vulnerabilities (see below). I turned off those tests, and have since went back to the production version. Did anyone else see this? There were no attachments in the message. 10/08/2007 07:06:40.687 20122895 Vulnerability flags = 4 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 21 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 24 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 25 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 29 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 30 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 36 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 37 10/08/2007 07:06:40.687 20122895 Outlook 'MIME segment in MIME Postamble' vulnerability in line 39 10/08/2007 07:06:40.687 20122895 Deleting file with vulnerability 10/08/2007 07:06:40.687 20122895 Deleting E-mail with vulnerability! -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail Experiences
addresses in SmarterMail. Or is this totally different? Mike, Let me state it another way. IMail will allow users to send without authentication, but only for a certain IP range. SmarterMail seems to only have 2 options. Authentication required, or totally Open Relay. Bill Green dfn Systems --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail 4.0 is released
Yeah, that would be nice, altho we have stunnel running on a bank's email server and that works too, but extra stuff to install. I do agree that a mail server is really not a list server, so don't fault them on that. I still think it is a very good value all in all. Andy Ognenoff wrote: I have been talking to them about this issue for well over 2 years. I'm rather pissed off. No mention of SSL on SMTP/POP/IMAP services either. That's all that's keeping me from switching to them. (I know there are work arounds but I'd like it officially supported and offered by SmarterTools.) - Andy --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Valid Senders - Best Declude Practices
Hi Mike; I feel your pain, processing 200,000 messages a day for about 15K good ones. It sounds to me like your server may just be underpowered. We just upgraded our server to a new unit moving from Windows 2000 to 2003 R2 and to Dual, Dual core Opterons, even with only one CPU on the mobo now I can tell that we would be able to handle a number like 1M messages a day with Declued/sniffer/smartermail just fine. The better hardware gives you more licensing bang for the buck. Herb Michael Cummins wrote: I can strongly consider Alligate in front of Declude. So let's say I build a dedicated Alligate box to live in front of my two Declude enabled servers. How much of a load would it be able to handle? I would need it to handle close to 250k messages per day (current combined load) with room to grow, and it looks like Alligate is yet-another-thousand-dollar-thing-that-will-need-yearly-subscriptions-of-hun dreds-of-dollars. I'd be happier if I could just send my money to one company. So would Declude, I'm sure. But hey. If that's what you gotta do. I was thinking of using a home built postfix gateway to go in front of the boxen, and if I need more I was just going to add more identical postfix boxen a la round robin DNS. Bad idea? Good idea? But my customers could use some help today, which is why I was thinking of using Declude to do some recipient verification. Conceptually, that would cut down the work load considerably, right? I've been having trouble with my Message Sniffer (in persistent mode) going into a cascading failure during peak periods because of the volume; so I leave it off most of the time, which is a huge waste. I'm just wondering how to go about using Declude to do this. Thanks for all the feedback! I've got an open mind. -- Michael Cummins --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Valid Senders - Best Declude Practices
Yes, we do it to filter for some customers that want to run their own mail server but not have to deal with managing virus and spam filters. We use the same smartermail server to host about 80 domains/1400 mailboxes and do domain forwarding for another 10 or so domains with about 500 addl mailboxes. Herb John T (Lists) wrote: Does SmarterMail allow you to create aliases for a domain, such as [EMAIL PROTECTED] is an alias for [EMAIL PROTECTED]? John T eServices For You "Life is a succession of lessons which must be lived to be understood." Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Michael Cummins Sent: Thursday, December 28, 2006 1:44 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Valid Senders - Best Declude Practices OK. I have a box that I use as an incoming relay for about 30 or so Exchange servers that all live out in the wild. I run Smarter Mail, Declude, Message Sniffer, INVURIBL, F-Prot and all kinds of good stuff before I pass it along to the Exchange server with SmarterMail domain forwarding. I am getting my ass kicked by volume because the mail server accepts any address and forwards it along; most of which of course are addresses that don't exist. I'm building a gateway box in the near future, which will help keep the incoming fluff down a bit, I'm sure, but what I really need to do is to implement some kind of valid recipient list. I doubt that I'll be able to LDAP all over God's green earth with any kind of reliability or speed. Since the gateway won't be implemented for a few weeks, I'm been playing with things to get ready for it, namely, how to get valid sender lists from such a disparate group of Exchange servers. So. I patched together this _vbscript_ that exports a list of exchange addresses using LDAP into a text file. It runs as a WinCron job. I created a batch file that uploads it to one of my Cold Fusion servers. That runs as a WinCron job, too. I wrote a Cold Fusion script that looks for these silly text files every so many minutes and then parses the crappy, cluttered thing into a nice clean CSV for me, and now I can do anything I want with it. I imagine that someday I'll use it in conjunction with the gateway, but hey, I have this information right now. What would be the best way to use this information with Declude? Ideally, it should be implemented on a per domain basis, in case I can't get some Exchange servers to play nice with me. Eventually I suppose it will be mandatory, I'm sure, but not right now when I am coming up with best practices, eh? So do I set up each text file for each domain as a separate filter? And then only use it in the applicable per domain junkmail file? Is that the best way to do it? Or am I making Declude work too hard? I would really love any suggestions you might have. Thanks! -- Michael Cummins --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] New Version 4.3.2.3
If it installed correctly it will. It may be putting it in a different directory, in which case it is probably using the wrong configs as well. Herb Darrell ([EMAIL PROTECTED]) wrote: I am noticing that when restarting the Declude Proc service it does not generate a diags.txt file anymore. Is this normal behavior to be expected with this version. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: SmarterMail's website
Yup, no dns Herb Chris Asaro wrote: I cannot navigate to that address either. Chris From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Michael Graveen Sent: Monday, December 04, 2006 12:40 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] OT: SmarterMail's website Is anyone else having trouble getting to SmarterMail's web site (www.smartertools.com)? I have been unable to access it since Sunday morning. Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Interim Release 4.3.23 - need a few volunteers
Hi David; If the top fix is for the header mod issue where the header modification is being placed at the bottom of the message rather than in header I would be glad to test as we have had hundreds of those messages a day getting thru. Take care, Herb David Barker wrote: 4.3.23 that has the following bug fixes: * Broken Headers * AUTOWHITELIST for Imail 2006 * Revise ROUTING spamrouting * MIME header mismatch, Declude assumes it is an executable Now you can turn on/off the MIME header mismatch test. Default: MISMATCHEDEXT ON In virus.cfg file MISMATCHEDEXT ON MISMATCHEDEXT OFF Function description: If this test is turned off then the e-mail will not be caught as vulnerability. However, there is a log message that the mismatch was found and it is ignored because it is turned off. * Zip vulnerability, declude is holding a valid zip file as vulnerability * Default for the OUTBOUNDSCANNINGSPAM directive is ON * New CommTouch Dll Email me, I cannot promise to respond to everyone, I will stop replying when I have enough volunteers. David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Messages bypassing declude
Hi Serge; Check the very bottom of the message source and see if the header is there. If so it is a problem with declude not being able to find the boundary between the header and the message. I think the beta version that is in test right now is supposed to address that. Herb Serge wrote: Dear declude support, We are having more and more messages that seems to bypass declude No declude headers (see attached file) I need your help on how to trace this issue, and how to correct it ? is this an issue with imail ? or with declude ? how to find out ? We do have a current support contract using imail 8.15 HF2 with declude 4.3.0 regards Serge Dergham Cefib --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Received: from emg210.internetdsl.tpnet.pl [213.77.85.5] by mail.cefib.com with ESMTP (SMTPD32-8.15) id AD5C34E500E8; Thu, 30 Nov 2006 14:40:28 + Return-Path: [EMAIL PROTECTED] Received: from 212.74.112.75 (HELO mk-mx-1.b2b.uk.tiscali.com) by mail.cefib.com with esmtp (,(B4S/N ,0EO37) id 8TI9.P-87.3?N-*E for [EMAIL PROTECTED]; Thu, 30 Nov 2006 14:40:51 -0060 From: Lesa Francis [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Lowest rates approved Date: Thu, 30 Nov 2006 14:40:51 -0060 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0006_01C71495.EA129F00 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.4115 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2905 Importance: Normal X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 376475836 What a regular mail with declude headers should look like Received: from cpe-72-178-168-162.rgv.res.rr.com [72.178.168.162] by mail.cefib.com with ESMTP (SMTPD32-8.15) id A9E658E50148; Fri, 01 Dec 2006 00:40:06 + Return-Path: agreetreatise'[EMAIL PROTECTED] Received: from 207.217.125.16 (HELO mx00-dom.earthlink.net) by cefib.com with esmtp (7-M1LD/A ,=T,2-) id A'3.RP-/1I(K0-2+ for [EMAIL PROTECTED]; Fri, 1 Dec 2006 02:46:20 +0480 From: OTC Financial network agreetreatise'[EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [Spam=29]EQSE News Date: Fri, 1 Dec 2006 02:46:20 +0480 Message-ID: [EMAIL PROTECTED]'s MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-2 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Thread-Index: Aca6Q4.(6(Y74(3;S9@+A)1,GI6I)== X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: Failed GIBBERISH Filter X-RBL-Warning: Failed GIBBERISHSUB Filter X-RBL-Warning: SIZE-S: Message failed SIZE-S: 11. X-RBL-Warning: Failed HELOISIP X-RBL-Warning: SNIFFER: Message failed SNIFFER: 57. X-RBL-Warning: SORBS: Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?72.178.168.162; X-RBL-Warning: SORBS-DUL: Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?72.178.168.162; X-Declude-Sender: agreetreatise'[EMAIL PROTECTED] [72.178.168.162] X-Declude-Spoolname: D79e658e50148239c.smd Organization: CEFIB Internet (Incoming) X-CEFIB-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-CEFIB-Note: Declude version: 4.3.0 X-CEFIB-Note: Spam-Tests-Failed: IPNOTINMX [0], NOLEGITCONTENT [0], GIBBERISH [3], GIBBERISHSUB [4], SIZE-S [0], HELOISIP [3], SNIFFER [15], SORBS [2], SORBS-DUL [2], WEIGHT10 [10], DWEIGHT10 [10], DWEIGHT20 [20], DWEIGHT25 [25], CATCHALLMAILS [0] X-CEFIB-Note: weight: 29 X-CEFIB-Note: This E-mail was sent from cpe-72-178-168-162.rgv.res.rr.com ([72.178.168.162]). X-CEFIB-Note: Country Chain: UNITED STATES-destination X-CEFIB-Note: MailFrom: agreetreatise'[EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-IMail-Rule: H~DWEIGHT10:spam Data- DWEIGHT10 [10], DWEIGHT20 [20] X-UIDL: 464867977 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
Re: [Declude.JunkMail] How Accurate is Sniffer?
My opinion is that it is very accurate, we mark messages as spam on just that, altho would not delete on any single test. We have used it for about 3 years now. Herb David Dodell wrote: I'm doing my 30 day trial of Message Sniffer .. at the moment it is 5 points out of 10 needed to mark something as spam. How accurate is Sniffer?Something that I can raise my weight on? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New pattern
If this is the one you mean, we are getting lots but message sniffer is catching them all. From: Clara Meier [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Probable SPAM:Clara Date: Wed, 15 Nov 2006 14:36:18 +0180 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: Aca6Q783T3'TOP6*:T7V=0B3-U1(E9== X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?200.59.207.181; X-RBL-Warning: SNIFFER: Message failed SNIFFER: 57. X-Declude-Sender: [EMAIL PROTECTED] [200.59.207.181] X-Declude-Spoolname: -2041198825958.eml X-Declude-RefID: X-Declude-Scan: Incoming Score [20] at 08:36:30 on 15 Nov 2006 X-Declude-Fail: SPAMCOP [5], SNIFFER [15], WEIGHT10 [10], WEIGHT15 [15] X-Country-Chain: ARGENTINA-destination X-Declude-Code: f X-Declude-Recipcount: 1 Members, are you tired of your investments bringing you only a few percent return each year? Sick of those bloated blue chips? This week we are bringing you a company which is just the thing for an investor looking for big returns! Dave Doherty wrote: Hi, all- The last day or two, I've been getting a lot of spam with a first name for the subject, and the same name in the from display address. Some of this is geting caught, but a lot is leaking through. Can anyone think of a way to check whether the subject is contained in the from address? -Dave Doherty Skywaves, Inc. 97 Webster Street Worcester, MA 01603 508-425-7176 [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Does anyone know if it works with smartermail? It is not listed on the site, but says other standard smtp servers Herb Doug Traylor wrote: If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. ASSP is a great addition to an overworked Imail/Declude server and will reduce the amount of email that server has to cope with. It is free and will run on the same server as Imail/Declude or on another spare box under Windows or Linux. It will do envelope rejection of invalid recipients, invalid senders, invalid HELO, etc. It is very configurable, and will even do automatic blacklisting of IP's that misbehave. It also has an active development group. see: http://assp.sourceforge.net/ http://www.asspsmtp.org/wiki/Welcome http://en.wikipedia.org/wiki/Anti-Spam_SMTP_Proxy Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] delete mails before processing / 100% CPU / per domain config
Actually it would work with smartermail according to smartermail forum messages, but some of the comments on the smartermail forum state that folks had stability problems with it. The posts are 1 - 2 years old so may be better now. Herb Doug Traylor wrote: If your current box can't handle the load, than the ultimate solution is more processing power - either by upgrading the box, or by delegating some of the work to a gateway. ASSP is a great addition to an overworked Imail/Declude server and will reduce the amount of email that server has to cope with. It is free and will run on the same server as Imail/Declude or on another spare box under Windows or Linux. It will do envelope rejection of invalid recipients, invalid senders, invalid HELO, etc. It is very configurable, and will even do automatic blacklisting of IP's that misbehave. It also has an active development group. see: http://assp.sourceforge.net/ http://www.asspsmtp.org/wiki/Welcome http://en.wikipedia.org/wiki/Anti-Spam_SMTP_Proxy Doug Traylor --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Paid Subscription Black Lists
We have had great success with message sniffer (www.sortmonster.com) Herb Chris Anton wrote: Hi. Any one have any good luck with any paid subscriptions? We have been hit hard lately, and are willing to dish out some dough to get our stats back up. Please advise. Thanks! -Chris --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] End of headers {was - declude not modifying subject line}
What about a brute force rule "I am appending a header more than x characters from the beginning of a y length message so this cannot be a correctly formatted message" and you have set the "deletebadforematmail" switch to "Yes" so delete. Herb Kevin Bilbee wrote: OK sounds reasonable. Since you are the expert and I am trying to understand. Have you ever seen a legitimate message with a no real end of headers, where the two line terminators designating the end of headers are separated by more than white space, tab or space characters? Kevin -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Franco-Rocha [ Declude ] Sent: Thursday, November 09, 2006 5:32 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Kevin, I am very well aware of what byte sequences constitute the end of a line. However, if the problem were this simple it would have been fixed long ago. Contrary to what some have said here, we have seen many instances where IMail likewise appends its headers to the end of the message. The broken line terminators are not necessarily of the same type in a given message. In addition, they are not necessarily adjacent to each other (with leading whitespace or unprintable characters on a line). What may appear obvious to the eye is often not at all what exists behind the scene. You may look at a message and be certain where the headers end and the body begins (the separating blank line). However, that message may not necessarily contain two consecutive EOL sequences of any type anywhere. David Franco-Rocha - Original Message - From: "Kevin Bilbee" [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, November 08, 2006 5:45 PM Subject: RE: [Declude.JunkMail] declude not modifying subject line I do not understand why you need to rewrite the message beyond what you already do? Just determine the end of headers properly then rewrite the message with your headers in the proper location. You already rewrite the message when adding headers so why would it take any longer to properly detect the end of headers. If you have two LF sequences next to each other ignoring the CR then you have the end of headers. For example if you have CRLFCRLF OR LFCRLFCR OR LFLF I have never seen a message use CR alone for an end of line. There are two LF bytes in each sequence ignore the CR bytes. Then when writing out the message with the Declude headers include the original byte sequences for each line. And the Declude lines should have the proper CRLF sequences. My two cents! Kevin Bilbee 1. I don't like to keep going in circles on this. If it was as easy as "just fix it" there would be no issue. Please understand that this is a lot more complex than you may realize, we are considering making the fixing of line terminators as an optional feature to be turned on/off because of a potential performance degradation of rewriting the messages. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] End of headers {was - declude not modifying subject line}
Hi Mike;
I'm sure that you are correct, but it would have to be both malformed
and have the large header. Right now there are hundreds of messages a
day slipping thru that are not being addressed at all. This MAY be a
way to get the vast majority of them without the apparent difficulty of
finding the end of the header so that it can by modified. So far the
ones I have seen have been image spam that are do not have a large
number of to addresses.
Thanks for your feedback.
Herb
Mike N wrote:
I've seen some messages with dozens
of Kbytes of CC and TO E-mail lists that would fail this test.
-
Original Message -
From:
Herb Guenther
To:
declude.junkmail@declude.com
Sent:
Thursday, November 09, 2006 3:30 PM
Subject:
Re: [Declude.JunkMail] End of headers {was - declude not modifying
subject line}
What about a brute force rule "I am appending a header more than x
characters from the beginning of a y length message so this cannot be a
correctly formatted message" and you have set the
"deletebadforematmail" switch to "Yes" so delete.
Herb
Kevin Bilbee wrote:
OK sounds reasonable. Since you are the expert and I am trying to understand. Have you ever seen a legitimate message with a no real end of headers, where the two line terminators designating the end of headers are separated by more than white space, tab or space characters?
Kevin
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
David Franco-Rocha [ Declude ]
Sent: Thursday, November 09, 2006 5:32 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] declude not modifying subject line
Kevin,
I am very well aware of what byte sequences constitute the end of a
line.
However, if the problem were this simple it would have been fixed long
ago.
Contrary to what some have said here, we have seen many instances where
IMail likewise appends its headers to the end of the message.
The broken line terminators are not necessarily of the same type in a
given
message. In addition, they are not necessarily adjacent to each other
(with
leading whitespace or unprintable characters on a line). What may
appear
obvious to the eye is often not at all what exists behind the scene.
You may
look at a message and be certain where the headers end and the body
begins
(the separating blank line). However, that message may not necessarily
contain two consecutive EOL sequences of any type anywhere.
David Franco-Rocha
- Original Message -
From: "Kevin Bilbee" [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, November 08, 2006 5:45 PM
Subject: RE: [Declude.JunkMail] declude not modifying subject line
I do not understand why you need to rewrite the message beyond what you
already do? Just determine the end of headers properly then rewrite the
message with your headers in the proper location. You already rewrite
the
message when adding headers so why would it take any longer to properly
detect the end of headers.
If you have two LF sequences next to each other ignoring the CR then
you
have the end of headers.
For example if you have
CRLFCRLF
OR
LFCRLFCR
OR
LFLF
I have never seen a message use CR alone for an end of line.
There are two LF bytes in each sequence ignore the CR bytes. Then when
writing out the message with the Declude headers include the original
byte
sequences for each line. And the Declude lines should have the proper
CRLF
sequences.
My two cents!
Kevin Bilbee
1. I don't like to keep going in circles on this. If it was as easy
as
"just
fix it" there would be no issue. Please understand that this is a lot
more
complex than you may realize, we are considering making the fixing of
line
terminators as an optional feature to be turned on/off because of a
potential performance degradation of rewriting the messages.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
--
Herb Guenther
Lanex, LLC
www.lanex.com
(262)789-0966x102 Office
(262)780-0424 Direct
This e-mail is confidential and is for the use of the intended recipient(s)only. If
Re: [Declude.JunkMail] declude not modifying subject line
Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the tests are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are only as defect as the other guys. Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in the first place. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, November 01, 2006 10:02 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Herb, I need to clarify something here. This source of this problem is that these messages do not conform to the RFC's and are extremely broken and should not be accepted by the mail server in the first place. That is the source of the problem, Declude is showing the symptom. Have you approached SmarterMail/Imail and asked them to fix this issue, either not accept the message or apply message standardization ? What was their response ? With that said, we are working on correcting this problem because clearly the Mail server is not doing it. Secondly, there are alternatives to marking the Subject line and having the mail server take action based on the headers. You could use actions like. # MAILBOX will move the E-mail to a user's folder (no, not a Windows directory) # ROUTETO will re-route the E-mail to an alternate address # HOLD will hold the message in the spool\spam directory. David B --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] declude not modifying subject line
Hi David; Thanks for the tip on the resource directory, never thought of looking there, altho would be good to restore the link in your KB as well. I would also like to respond to your reply to others in the thread in which you state that it is not productive to have to repeatedly address the same issue. I would respond as a customer by telling you that we spend a significant amount of our time addressing customer complaints. I know that ourselves, and I am sure many others are not in a position to delete email messages, but need to mark them to give users the ability to create and maintain their own filters. So our pain becomes your pain. So, if our customers are getting hammered on this issue every day and every week, and folks want to know why spam that you are identifying is not being marked as spam, I'd sure like to know an elegant answer to give them other than "it doesn't work and is being worked on". I personally get at least 10-20 of these a day, so I get 10 - 20 reminders that I am unhappy. I am not trying to beat up on you or Declude, we have been a customer for many years, and wish to remain so. I'm sure that it will be some work to solve the problem as it is a non trivial task. However, what do you expect us to do, go quietly into the night? There are two ways to stop getting questions on this subject. 1. Fix the problem and get kudos instead of complaints. or 2. Give a real expected date to address the issue and tell us where in the task stack the issue is. The we can either wait or go elsewhere if the timing on the issue is not going to work for us. Last point, on contacting Smartermail in our case, or Imail in other cases. What we would be asking them to do is not deliver messages that they, Outlook, Outlook Express, Thunderbird, and I would guess most every other mail server and email client handle somehow. Non RFC complaint mail is part of the environment, I don't think that that is really the way to go. My goal is not to discourage you, or pick on yourself and Declude, but to get the issue addressed. Wouldn't it be great to cross this item off your list :) Take care, Herb David Barker wrote: Herb, 1. This is currently being worked on, there are several other things that need to be taken into account when doing this, for example if Declude has to rewrite all me messages in order to correct this problem there will be a hit on performance. We are also looking at some other alternatives. Any suggestions are welcome. 2. This is not as simple as having these type of messages fail a test as there are too many variables in play wrt line terminators. 3. In your \Declude folder there should be a \Resources folder which has the latest config files. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Herb Guenther Sent: Wednesday, November 08, 2006 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] declude not modifying subject line Hi David; In an earlier message (below) you mentioned that you were working on adding the ability to handle these malformed messages. A couple questions. 1. When will this happen as it has been a problem for quite a while now? 2. The messages themselves are not failing any of the tests that I am using. Shouldn't we at least be able to have them fail a test and then take an action based on that? Also, I want to make sure that all of my config files are correct, and that I do not have any depreciated tests in them. When I go to the online manuals on your site, the links to the "tests" are broken, and I cannot find samples of the config files. Can you tell me where they are, and perhaps update the links in the KB so that they do point to them? Thanks, Herb David Barker wrote: Agreed Andy. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Andy Schmidt Sent: Wednesday, November 01, 2006 10:31 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] declude not modifying subject line Hi David: Pardon me - but lets not forget that we choose to pay Declude license and maintenance fees, precisely because of its claim of being superior in detecting viruses, vulnerabilities and RFC violations that other components are known to letting through. When your business model is based on the premise that you will be closing the holes that other components leave, then Declude cannot retreat behind an argument that you are "only as defect as the other guys". Clearly, if Imail/Smartermail did act appropriately and offered all the features it should, then you wouldn't have a customer base in the first place. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Barker Sent: Wednesday, November 01, 2006 10:02 AM To: declude.ju
Re: [Declude.JunkMail] declude not modifying subject line
Hi David; First, I'd like to thank you for your response, it is the first that I have had and I really appreciate it. I realize that the issue is the either accidentally or purposely malformed messages. I would assume that there is a whole spectrum of message rfc compliance out there, and everyone has to draw the line somewhere. In an ideal world we could apply some very exact rules and just say too bad, so sad and reject the messages. However customers would view this as I did not get my email and in effect a false positive. So, outright rejection would not be the solution I think. However, to answer your question, we have not approached smartermail on the issue as that is not our spam tool vendor. I think that any message that an email client can display should be viewed as compliant enough from a real world perspective, even tho I agree that philosophically that is not the way it should be. Do you have an idea as to what the time frame for an update to this will be? Take care, Herb David Barker wrote: Herb, I need to clarify something here. This source of this problem is that these messages do not conform to the RFC's and are extremely broken and should not be accepted by the mail server in the first place. That is the source of the problem, Declude is showing the symptom. Have you approached SmarterMail/Imail and asked them to fix this issue, either not accept the message or apply message standardization ? What was their response ? With that said, we are working on correcting this problem because clearly the Mail server is not doing it. Secondly, there are alternatives to marking the Subject line and having the mail server take action based on the headers. You could use actions like. # MAILBOX will move the E-mail to a user's folder (no, not a Windows directory) # ROUTETO will re-route the E-mail to an alternate address # HOLD will hold the message in the spool\spam directory. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Herb Guenther Sent: Tuesday, October 31, 2006 5:59 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] declude not modifying subject line Hi All; Another week has went by and I have not heard any time schedule for fixing the issue with not modifying the message header correctly. This continues to allow hundreds of spam messages to land in our customers mailboxes every day. Again, what is required to get this fixed? We are happy to send samples, message source examples, or whatever is required. Otherwise we are going to move to a gateway filter model and just abandon declude. How did declude get in a situation where phone calls, emails, and service tickets can just be ignored because no one wants to take the bull by the horn? I know that our business does not operate that way. I assume that my disappointment is showing thru, frankly at a loss. Herb -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] declude not modifying subject line
Hi All; Another week has went by and I have not heard any time schedule for fixing the issue with not modifying the message header correctly. This continues to allow hundreds of spam messages to land in our customers mailboxes every day. Again, what is required to get this fixed? We are happy to send samples, message source examples, or whatever is required. Otherwise we are going to move to a gateway filter model and just abandon declude. How did declude get in a situation where phone calls, emails, and service tickets can just be ignored because no one wants to take the bull by the horn? I know that our business does not operate that way. I assume that my disappointment is showing thru, frankly at a loss. Herb -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Proc directory backlogging from time to time
Are you running sniffer in the persistent mode? That will lighten the load quite a bit, we are doing 180K a day w the exact same setup you are. Herb Darrell ([EMAIL PROTECTED]) wrote: Luis, Email me offlist at support [at] invariantsystems.com and I will help you tweak up invURIBL and your declude configuration to help with this situation. You have a fast enough machine that should easily handle 150K+ messages a day easy. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Panda Consulting S.A. Luis Alberto Arango To: declude.junkmail@declude.com Sent: Monday, October 30, 2006 12:05 PM Subject: [Declude.JunkMail] Proc directory backlogging from time to time From time to time our PROC directoryis backlogging emails.. We process about 60K to 80 K every day. And from time to time I found between 8K to 10K in our PROC. It seems to be an spammer flood, but my server is not able to manage it fast enough to empty the directory. We use Declude (version 4.3.7), sniffer latest engine, inv-urbland f-prot When checking at the task manager I see quite a few (8 or 10) sniffer processes running at the same time as well as f-prot and inv-urbl processes, but not fast enough to empty the proc directory. The PROCESSES directive seems to not work. I don't know how to speed up the processes unless I remove sniffer, inv-urbland f-prot. I run a box with XEON Double Core 2.8 GHz, and 2.00GB of RAM running Windows 2003 server. I am running Smartermail 3.3.2439 Any suggestions? ideas? on how to prevent backlogging in the PROC directory? Luis Arango --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] bad header mods by Declude
Hi John; Thanks for the links, and yes, I did just join this list this week. Kind of discouraging actually to see that this has been a known issue for a long time and has not been solved. I had not even thought of the issue re sneaking thru a virus as well. With all of the exchanges I did not actually see an official statement as to when this will be fixed other than that it has perhaps been moved up in priority. I understand that supplying products like declude and sniffer, etc. is not a barrel of laughs as it is a battle. But as a customer I sure want the troops to be protecting my customers. I wonder if a document on issues that are known and being worked on, with a priority and eta that would be under the customer logged in area would help. That way Declude would not have to keep answering some of the same questions over and over again. I know that disclosure can be painful, but at the end of the day it does just reflect reality, the only difference is customers know what is happening instead of guessing. Take care, Herb John T (Lists) wrote: Hello Herb and welcome to the Declude JunkMail list. This is a known issue with spam that has "improper" coding in the header and has been discussed at length. Here are some links to the existing discussions: http://www.mail-archive.com/declude.junkmail@declude.com/msg30444.html http://www.mail-archive.com/declude.junkmail@declude.com/msg30003.html http://www.mail-archive.com/declude.junkmail@declude.com/msg29909.html In a nut shell, Declude (and fpReview) are expecting certain code (that must be there accourding to RFC) to tell where the headers start and end and so forth but some of that code is missing. Declude is well aware of the problem and David Barker has stated that he is raising the priority of getting this fixed. John T eServices For You "Life is a succession of lessons which must be lived to be understood." Ralph Waldo Emerson -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Herb Guenther Sent: Wednesday, October 25, 2006 8:02 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] bad header mods by Declude Hi All; We have been having a problem with Declude not modifying the true subject and header on many spam messages. Sniffer and a number of the other tests catch the message, but Declude is adding a header stub to the bottom of the message source, and not the real header. Since we have our system set up to pre-pend "Probable SPAM:" to the subject line all of these messages go right thru the email clients filters. We are running the latest version of Declude, 4.3.14 with Smartermail. I have submitted several samples and let the folks know at Declude, but have not had any feedback. When mentioning it on the message sniffer mail list others are also experiencing this as well. Have other Declude customers seen this and what information does Declude need to work on this problem? Thanks, Herb -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] bad header mods by Declude
Hi All; We have been having a problem with Declude not modifying the true subject and header on many spam messages. Sniffer and a number of the other tests catch the message, but Declude is adding a header stub to the bottom of the message source, and not the real header. Since we have our system set up to pre-pend Probable SPAM: to the subject line all of these messages go right thru the email clients filters. We are running the latest version of Declude, 4.3.14 with Smartermail. I have submitted several samples and let the folks know at Declude, but have not had any feedback. When mentioning it on the message sniffer mail list others are also experiencing this as well. Have other Declude customers seen this and what information does Declude need to work on this problem? Thanks, Herb -- Herb Guenther Lanex, LLC www.lanex.com (262)789-0966x102 Office (262)780-0424 Direct This e-mail is confidential and is for the use of the intended recipient(s)only. If you are not an intended recipient please advise us of our error by return e-mail then delete this e-mail and any attached files. You may not copy, disclose or use the contents in any way. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
