RE: [Declude.JunkMail] Declude 4.3
*** Question to thoes that are saying that spam/virus protestion is a lost leader/not a revenue builder. If it does not generate revenue then why don't you stop offering spam/virus protection? *** Is this a serious question? If you don't offer spam and virus filtering, you won't have any customers. In most markets the local competition offers it for free. The national competition certainly does (yahoo, google, earthlink etc). Many of us are fighting against low-priced inferior competition. The problem is that the average customer doesn't know that they are inferior. They *do* know how much they charge, and if they offer spam/virus protection and you don't it doesn't matter how poor the other guy's service is. They will leave. Sure, they will find out later how much the other guys suck, but how much time/effort/money will it cost to get them back? Chances are they'll try the next cut rate place instead of coming back to us anyway. Paul Navarre --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklisted by Comcast
For whatever reason, one of my mail servers has been blacklisted by Comcast.snip Anybody have any deas how to resolve this one? This just happened to me too. The answer is in your log files. Comcast inserts a message in the data conversation that says to send a message to [EMAIL PROTECTED] requesting removal from their blacklist along with your server's IP address. I was off in their list in about 5 hours. I wish I could find out *why* I was on their list, but I'll take what I can get. Paul Navarre --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] casino spam
Ive actually noticed an increase specifically in gambling site spam myself. Paul Navarre Has anyone noticed in the past week an increase in casino, or party poker, etc.. spam? Kyle
RE: [Declude.JunkMail] Paypal and spam domain
A quick look at the messages I have received from paypal recently all show (something).paypal.com. I havent seen any exceptions. Paul Navarre From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Friday, December 31, 2004 1:42 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Paypal and spam domain What servers do legitimate @paypal.com e-mail come from to include in the spamdomans file? John Tolmachoff Engineer/Consultant/Owner eServices For You image001.gif
RE: [Declude.JunkMail] OT - Copying 200,000 plus files
I don't know the answer you are specifically looking for, but you might take the drive out of the USB case and mount it directly into the PC as a slave drive. Copying (regardless of method) should go much more quickly then. Paul Navarre -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jeff Pereira Sent: Wednesday, October 20, 2004 12:00 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT - Copying 200,000 plus files Hi - Sorry for the OT post, but I am in need of assistance. I have 200,000 + TIFF (70 GB Worth)images on an external USB 2.0 hard drive that I need to copy to my local hard drive. It is taking forever. Does anyone know what the fastest way to do this is ? Drag and Drop ?? Cut and Paste ?? Drop to a command prompt ?? Xcopy ?? Please help. TIA jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF Records and Off-Network Customers
I believe that SPF is almost all hype and hardly any value to speak of. I think this is a bit harsh. While SPF is certainly not the answer to all of my prayers, it has some value. It was originally intended to authenticate hosts, but spammers quickly caught on and started giving themselves SPF This is a good development from my perspective. I give a single point to SPF pass, and I may reduce it to 0. In other words, pass won't help a whole lot in identifying legit email. However, when a spammer is using SPF, this also means that they are using their own mailserver. This makes it easy to block. I wish all spammers used SPF. some administrators will claim a modicum of usefulness to having the Unknown records, although I don't see it For me unknown is simply move along, nothing to see here. Not a big help, but no harm either. What you didn't mention is the fail result. I score this fairly highly. I mean if a postmaster tells me there is a problem with a message from their domain, it lets me off the hook if I block it. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do I block these?
Is there anyway to block on these extensions (de,ch)? I don't see any valid email coming from domains with these extensions. Just so you know, this is Germany and Switzerland. Obviously you know your users better than I do, but if I blocked all mail from Germany and Switzerland my phone would ring before I could log off the server! Paul --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] REVDNS vs BODY
Is it accurate to say that a filter in DECLUDE Pro using REVDNS is more efficient and runs faster than a filter using BODY? My standard procedure was to add a BODY filter that contains the domain of a link found in the spam messages that make it through other tests. This makes sure that they will be caught next time. I've noticed though that a surprising number of these domains that are found in the body of the spam are also the reverse DNS of the message sender. Am I better off filtering the REVDNS instead of the BODY? Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Backup MX / Spam
You could write a filter that searches the headers for your backup server's IP address. HEADERS 3 CONTAINS x.x.x.x Matt The problem with this is if your primary does go down (rebooting for a patch for example), these points will be added to *all* email until your primary is back up. I posted just a few days ago asking if it was possible for Declude to check that primary was functional. If so, there could be a test that would add points for any mail sent to the secondary when the primary is functional. I realize that this would require a new version of Declude, but I think it could be really worthwhile. Nobody responded to my last post, so I wasn't sure if there is some reason why this wouldn't work or would be too difficult. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New Test?
Would it be possible to have a test that would check if the highest priority MX was running? If so, then the test should assign a weight if a particular email was sent to a lower priority MX. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Ebay and Spamdomians
In my experience, for HOTMAIL.COM in particular I've never seen a message sent through a non-Hotmail server. I think you might have a configuration problem if you are seeing tons of legitimate e-mail from non Hotmail servers. Especially since it's a web-based e-mail client I wouldn't think they could use anything but Microsoft owned, e.g. hotmail.com, msn.com, servers. I'm glad I posted on this as I am realizing that I am not understanding exactly what is going on. When I had the spamdomains test set at 2/3s of the hold weight, I would find 4 or 5 legitimate messages a day held, with spamdomains putting each message over the top. A quick look in my logs shows that 4 or 5 messages a day is a tiny percentage compared to the number of spammy messages that fail spamdomains. The problem is that these 4 or 5 messages a day are too many for me. It seems somebody is on my case whenever there is a false positive. I realize now that yahoo.com was probably a bad example, although I am sure that I have seen it happen. Perhaps Sheldon's explanation is correct. The bottom line is that I think I need to pay better attention to those false positives and see if I can figure out more about them. Thanks for the feedback, Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Ebay and Spamdomians
I've been surprised at everyone waxing poetic over the spamdomains test. I have had to give this test very little wieght because we constantly get legitimate mail from spam domain addresses, but sent through other servers. For example, I see a ton of legitimate email from hotmail but where the sender sent it presumably through their work server. That's not a knock against Declude. The test works as advertised, and I do use it. I just have to give it very little weight. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] spamdomains
A few days ago I mentioned that I've had to reduce the weight I give to the spamdomains test drastically due to false positives. Here is an example of the type of thing I am running into: Received: from picturecd3.kodak.com [192.232.121.230] by netinteraction.com with ESMTP (SMTPD32-7.13) id A1136D2013E; Sun, 10 Aug 2003 18:27:47 -0700 Received: from picturecd.kodak.com ([207.160.143.56]) by picturecd3.kodak.com (8.11.6/8.11.6) with SMTP id h7B1Kwn15568 for [EMAIL PROTECTED]; Sun, 10 Aug 2003 21:20:59 -0400 (EDT) Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] snip X-RBL-Warning: SPAMDOMAINS: Spamdomain 'hotmail.com' found: Address of [EMAIL PROTECTED] sent from invalid picturecd3.kodak.com. This was some photos that someone sent a client. That leaves me with a frustrating choice. I can either fish these out of hold every time somebody does this, or I can reduce the weight precisely for a domain that that really can benefit from the spamdomains test. Again, this isn't a criticism. I just wanted to show what is happening in the real world. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Ban Attachments
What would be the best way to delete all messages that contain an attachment using Pro? Thanks, Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Counting
How did this get to Weight of 24. FILTER-BODY filter c:\IMail\Declude\IMail_Filter_TextinBody.txt x 0 0 Item Listed had a weight of 4 I am guessing that it caught more than one line in your filter. From what I can see, it only lists the last item caught in your filter file, although it will give all of the points for all of the lines caught. Scott, is there a way to have it list all of the lines caught in the filter? I would find this very helpful. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist Add-on
I had a situation today that has made me consider the whitelist add-on that I have seen discussed here. With the archive down, I am not sure what the name of it is or where to go for more information. Could someone send that information to me please ([EMAIL PROTECTED]). Is it just me or does it seem that major ISPs are being listed in more and more spam databases? I had a customer have his rather important incoming email get autodeleted because it reached a score of 31 on a system of 10+ hold and 30+ delete. btinternet.com (British Telecom) is listed in about 10 spam databases. It seems more and more I have to give major ISPs huge negetive weights, and I seem to have to constantly make them more and more negetive to keep up. Then more and more spam gets through. From my perspective this trend is becoming counter productive; the spam databases are unrealistic to use individually; even with Declude's superb weighting system things are getting more difficult. Scott, do you have an opinion about the whitelist add-on? The idea of keeping track of who are customers are sending email to and then having them whitelisted sounds interesting, but I want to know if there are any reasons why this might cause problems. Thanks, Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] All emails are now showing up with attachment?
For what it is worth, I am now getting email showing up with attachments in my Outlook. It seems strange as I just installed the latest Declude beta before this happened. However, when I go to webmail I don't see any attachments. I haven't heard from any clients yet, so I assume it isn't happening to anyone else. I can't imagine this would be related to Declude, but I thought I would mention it in case this is happening to lots of people. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] All emails are now showing up with attachment?
It appears a reboot solved the emails showing up with attachment problem for me. Paul Navarre --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
