RE: Re[2]: [Declude.JunkMail] XML? Just Say "NO" !
The XML file has one more advantage: A GUI could be created by Declude (which seems to be in our future anyway) that could easily configure Declude in a very structured way. This would simplify Declude configuration immensely! It could easily be done with a group policy looking editor. That should make all of the MS admins very happy. One other advantage is that Declude could include a config file checker that can parse the file and report any errors (like missing or duplicate info). This would be much more difficult on a flat file (probably why they haven't done it before now). As for the speed issue: IMO, the difference between the XML file and the flat file processing will be negligible with the relatively small file size. The disk cache will have the file in memory almost all of the time and the extra bytes required of the XML file will be offset by the faster parsing of the XML structure (parsing of regular expressions is very fast) provided by the MS XML object parser. MS has put a lot of effort into the efficiency of the XML object parser because they use it so often! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 12, 2004 4:06 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] XML? Just Say "NO" ! Well we differ here on this point. XML is much more verbose and will explode the size of the config files probably 1000 fold Here is a sample Now SPFFAIL spf failx 14 0 After XML - Possible Sample spf fail x 14 0 To parse the xml code for every load of declude.exe would take much more processing. This example takes the text lien and explodes it from 23 characters to 161 characters not to mention the added size to declude.exe to process the xml files. I do not think you have done much performace testing of XML in e loaded server environment. The loading of the config files from disk is minimal they should be cached due to the high frequecy of use. So 1 config file or 10 should not make much difference. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Pete McNeil > Sent: Monday, July 12, 2004 3:57 PM > To: Kevin Bilbee > Subject: Re[2]: [Declude.JunkMail] XML? Just Say "NO" ! > > > On Monday, July 12, 2004, 4:54:31 PM, Kevin wrote: > > KB> XML will definitly slow down the loading of Declude and I > know scott will > KB> not do that. XML will be a greate feature for the gateway > version though. > KB> Hint, Hint. > > I respectfully submit that this is not necessarily true. There is no > clear reason I can think of that an XML file configuration would need > to load any more slowly than the current configuration files. In fact, > I suspect that the structured nature of the file would most probably > improve the load speed if the parser were coded properly. This has > almost always been my experience when converting applications from > complex flat-file configs to xml configs. > > Consider also that it is likely an XML based configuration would > reduce the number of files required for a given system. - searching > for files takes time too. > > _M > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] XML? Just Say "NO" !
I like the XML idea. It is certainly editable by Notepad across a slow connection because an XML file is a plain text file (with specific chars used for specific purposes). But it would give the people that want programmatic control over the file a great capability. Then we can choose our method: Notepad or XML object. Also, viewing an XML file in IE is very easy to pick out the data you want to view. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of decjunkmail Sent: Monday, July 12, 2004 11:46 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] XML? Just Say "NO" ! Hi, I vote NO for XML. I'm sorry, but XML is much more like a registry setting or a binary configuration file -- Great for programmatic manipulation, but terrible for manual/interactive use. A text file in notepad is easy to change and edit interactively (even remotely on low-bandwidth connections) - as long as the goal for declude configuration files is to facilitate quick and easy changes, then it should stay as a text file. If the goal is to create a parametric-driven, API for automatic configuration/provisioning or programming, then XML or registry keys, or a binary database is fine. Note - I have used some XML, mostly with ASP.NET/VB.NET and although I can dig my way around config.net files and the like, I still prefer ".ini" files if I'm going to be fiddling with configurations. Yes, XML is great to serialize database structures, move them across web services, or dissimiliar internal database stores, but they are not as friendly for configuration files. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Monday, July 12, 2004 9:43 AM To: [EMAIL PROTECTED] Subject: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail Ok, couldn't resist my $.02 M> sense, but I think they are putting the cart before the horse. Wouldn't M> it be much better to work on creating a new format for the config files Like an XML based config file that incorporated Junkmail, Virus and Hijack configurations as well as per user controls. Ooooh, how much easier that would be to control from code M> In the mean time, it would make sense to also spend some time tightening M> up loose ends which have not been getting that much attention. If you M> asked for everyone's top 5 list from around here at least, I'm pretty M> sure that it would include things besides a new DNSBL test on virus data M> with a GUI installer, or the GUI itself. Declude is very capable at the M> moment, but there are some loose ends that could be tied up over a short M> period of time that would really help finish the foundation. Voicing Like a sender white list option for Vulnerabilities in DV. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Multiple Threat Lookup Database test for Declude JunkMail
I was not even aware that there was another support channel!! Please tell us what it is! I have always posted my Q's here and received my support responses here. I too think that the new management should be more involved in this list. If they were in these discussions, we would see them as real people involved in solving our problems with SPAM. I for one would feel more forgiving toward them if they were feeling the pain of their decisions. As for now, I only see Scott feeling the pain of someone else's decisions. I agree with Scott that the new management must have time to learn the industry and perhaps try out new ideas, that's how technology advances. But don't do it from an ivory tower! Scott has always been in the trenches with the rest of us. I would like to see the new management get a little "dirty" with us, too. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Saturday, July 10, 2004 4:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] New Multiple Threat Lookup Database test for Declude JunkMail > I'm going to be letting Barry know about what is going on with this > thread. He doesn't monitor this list, but does get a copy of every single > support request that comes in, which in my opinion is more important at > this stage. But isn't this list considered the first line of support? Therefore, I would think that Barry would be at least subscribed to the list so he can see what is going in real time, whether or not he has time or the ability to respond. Which in response to your response on another response (follow that) those that are contacting Declude via support, I hope you are pointing them to this list, as that will take off some of the load from you. BTW, who does the live support? (Please do not tell me outsourced.) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail
I have a message more for management more than Scott (and I hope they are listening!): Don't fix what aint broken! Declude has a solid following because of the way that Scott has treated IMail users in the past with feature upgrades, release methods and great support. If the new management is going to "restrict" or "force" Scott's efforts then the result will be a loss of customers. We are a rather finicky group!! And we know how to latch onto a good product or dump a bad one. I know that Scott is not in "complete" control any more, but I hope that corporate bureaucracy is not introduced into an otherwise smooth running product. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, July 09, 2004 4:39 PM To: [EMAIL PROTECTED] Subject: Re: Re[2]: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail >We know the Computer Horizons was sold, how much control do you have over >Declude these days? That depends on how you define "control" (no, I'm not a politician!). In this case, the level of control isn't clearly defined. The transition of management can be tricky, and needs to be handled carefully. If the new owners wanted nearly 100% control, they could have it (I definitely would not support that decision, though, and on the other hand, I'm sure they wouldn't try to do that). But it is important for the new owners to have as much control as possible, within reason. Put another way, while the new owners do some things differently than I would have (as is always the case with a transition in management), I haven't seen them do anything that I would really disapprove of. If I did, though, I am sure that they would listen to me and give serious thought to what I said. They are well aware that I got the company where it is now, and that if I am telling them they made a serious mistake, they would pay attention. >One of the best things I liked about Declude was your constant collaboration >on IMail and this group. How often do we see and IMail developer in the >IMail forum. :) Honestly, that's one of the best things that *I* like about Declude too. That's why I'm still participating in the IMail Forum and the Declude mailing lists. >Do have any say as to what is going to happen in the future or does the >management just taking suggestions? I definitely do have a lot of input about what is going to happen in the future. :) The final decisions, of course, will be up to the new management -- but they will definitely listen carefully to what I say. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Injunction against SpamCop
This could have serious implications everywhere on the internet... - When I go to Google and see a person's poor review of a product, then I don't buy that product, is very similar. Google is a third party, the reviewer is a disgruntled user, I'm deciding not to purchase (or use) the product because of this review, and the producer of the product is not allowed to correct the problem before the posting. Shame on you Google! - When I go to Pricescan and see a list of vendors selling a product, but one vendor has a poor Vendor Rating and I don't buy from that vendor. Pricescan is a third party, I choose not to buy from the poorly rated vendor, and I don't see any ability for the vendor to review the source of the poor rating before it's published. Shame on you Pricescan! The only real difference with SpamCop (and similar services) is: 1. The amount of money the spammers will spend on fighting the issue. 2. The amount of money that SpamCop has to defend itself. 3. The speed in which the filtering mechanism occurs (vs. Google, Pricescan) 4. The volume of complaints that can be processed in a short period of time. 5. The lawmaker's lack of understanding of email technology (and its costs). 6. How pervasive the public feels the problem is. IMHO: The only thing that will stop spam is when enough lawmakers have enough spam sent to them to cause enough frustration! Then they will understand the problem. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, May 12, 2004 10:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Injunction against SpamCop Well, there is SOME truth behind their allegation - it's just too bad, that in this case, a spammer can use the truth for their purposes. But, for anyone maintaining a VALID, subscription based mailing list, SpamCops approach is troublesome, counterproductive at best, damaging at worst (even if their intentions are good). It frequently happens that a prior customer is no longer interested in future mailings. But, instead of following directions to "unsubscribe" - they simply forward the email to a spam-reporting service. If that spam-reporting service doesn't provide me with the full unsubscribe request, then everyone will be unhappy: a) the ex-customer will continue to receive mailings and be more and more enraged about being "spammed", b) the business will continue to receive reports from Spamcop and the like - to which they cannot react (lacking the identifying information) c) the mail server may end up being incorrectly black-listed. If I read the allegations correctly, the spammer is NOT complaining about being black-listed - but about the fact that they are not provided with the necessary information to honor the customers "unsubscribe" request. They are also complaining that a report is filed with a third party (the spammers ISP) - even the spammer has not been given the opportunity to actually comply with the wishes of the "unsubscribing" user. Ultimately, SpamCop should have some "mailer" service, where, for a fee, a mailer can register their "unsubscribe" URL. Spamcop could automatically "unsubscribe" any users who send in a spam report. Then they could track, which users have been unsubcribed with this particular mailer - and if another report comes in AFTER having unsubscribed, THEN this could represent a violation of law and would probably justify more drastic measures to be taken. Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Hunter Sent: Wednesday, May 12, 2004 01:53 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Injunction against SpamCop I wouldn't dismiss this too quickly. The concern here is the trend. Spammers using the law/can-spam act against companies that are fighting spam. They don't have to win the suits, they just have to make it expensive, or otherwise not worth it, like they have for many blacklists in the past year that shut down. From the looks of the judgement it appears like they are trying to prove that it is illegal for us to block or hold spam at all. Or make us change our systems so that end users can see the spam and have the option to opt-out. Who do you think has more money to throw into this, Spammers or Spamcop? Todd Hunter At 12:41 PM 5/12/2004 -0400, you wrote: >They are quite well blacklisted and the absense from SpamCop probably >won't make a difference. > >Matt > > > >Jeff M
RE: [Declude.JunkMail] Country Code for Palestine?
That’s interesting… I thought their country code would be more representative of Palenstine. Perhaps “.ter” for terrorists! ;) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Monday, May 10, 2004 8:45 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Country Code for Palestine? COUNTRIES 20 CONTAINS ps # Occupied Palestinian Territories (i.e., West Bank and Gaza Strip) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, May 10, 2004 6:35 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Country Code for Palestine? Thanks, Markus. But your file didn't contain the country code for Palestine.
[Declude.JunkMail] Wildcards in sender blacklist
I found some discussions of this last year and I wanted to see if anything had changed: Are wildcards supported in the sender blacklists? For example: @mail*.rapiddealsbyemail.com @mail*.emailcourrier.com @relay*.reunion.com @*xxx* Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Cosmic 419er lost in space
I say let him pay for the transgressions of his brethren in Lagos! ;) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Friday, April 16, 2004 1:20 PM To: '[EMAIL PROTECTED]' Subject: [Declude.JunkMail] OT: Cosmic 419er lost in space http://www.theregister.co.uk/2004/04/16/cosmic_419er/ A little levity for Friday. Andrew 8) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Internet Usage Monitoring
Monster.com?? LOL -Just kidding. Can the PIX log to a syslog server? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, March 30, 2004 12:43 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Internet Usage Monitoring Management wants to do web usage mainitoring. They do not at this time want to do blocking. We have a pix firewall that does what Cisco calls URL logging but in relaity it does not log the url but the ip address of the server and the path on the server to the document being viewed. What they want is a log of client ip and url including the host name. They also do not want to abandon the PIX. Any one have any suggestions? Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [HOLD weight]RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
We use IMail 7.15 on a static IP (in fact we have a block of static IPs) from MPower, but they will not delegate or customize the RDNS entries for any customers. As I know from many previous threads, this is VERY common among ISPs. Not having an RDNS entry is a very reliable measure of SPAM, but if it exists, the text of the entry is not reliable. This is why I suggest not giving the type of RDNS entry much credibility, but certainly check if the RDNS exists!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno Sent: Monday, March 29, 2004 9:30 AM To: [EMAIL PROTECTED] Subject: RE: [HOLD weight]RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) Actually your e-mail did hit my hold weight... maybe I should lower those rev DNS weights I just put in.. Are you using Charters SMTP or your own? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Holt Sent: Monday, March 29, 2004 12:22 PM To: [EMAIL PROTECTED] Subject: [HOLD weight]RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I also forgot to mention that I can't contact Adrian to arrange a whitelist (should any of our users need to send to his users) because my messages will be blacklisted. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adrian Hauri Sent: Sunday, March 28, 2004 6:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) Our company blocks everything with reverse DNS entry from *.client.comcast.net, *.rr.com, *.du.shawcable.net, *.eastlink.ca, *.client.attbi.com, *client2.attbi.com, *cable.wanadoo.nl, *.de.comcast.net, *.md.comcast.net, *.tn.comcast.net, *.va.comcast.net, *.ipt.aol.com, *.east.verizon.net, *.vie.surfer.at, *.sprint-hsd.net, *cable.wanadoo.nl etc. Additionallly we block everything with *-number-* (like -26-), *.number.*, *.cable.*, *.pp.*, *.ip.*, *modem*, *async*, *rback*, *dyn*, *dhcp*, *ppp*, *dial*, *dsl* in the reverse DNS. This blocks a lot of unwanted emails. It is rare that a reverse DNS entry of a legal mailserver has dsl in the name. We just had one reverse DNS entry that we had to whitelist: mailservers for swiftdsl.com.au. But it helped us to minimize the rbl lookup and speed up the mail processing. There were some people who rang us up because they got the bounce message but all of them didn't have a proper reverse DNS entry for their mailserver. It's up to you how strict you are with blocking emails. But because we do not run a mail service for a lot of clients we can apply strict rules. Adrian - ToadShow Pty Ltd phone: 07 3004 7900 fax: 07 3846 1220 email: [EMAIL PROTECTED] http://www.toadshow.com.au - - Original Message - From: marc catuogno To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 9:32 AM Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I just got this e-mail and I just feel like someone is targeting my domain for a spam campaign. When I hit view source, it only said "test". Any suggestions on how to block this?? I'm surprised that DUL or DYNA didn't catch this at all, looks like it came in though a dynamic Comcast IP not one of their SMTP servers. I put "prod-infinitum.com" into the declude header filter with enough weight to hold it, but I don't think that would be enough. Thanks - Marc -Original Message- From: Shella Arrington [mailto:[EMAIL PROTECTED] Sent: Sunday, March 28, 2004 5:10 AM To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS test Headers: Received: from c-24-13-168-241.client.comcast.net [24.13.168.241] by mail.prudentialrand.com (SMTPD32-8.05) id AED14440132; Sun, 28 Mar 2004 17:16:49 -0500 Received: from 18.104.180.255 by 24.13.168.241; Sun, 28 Mar 2004 11:13:22 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Shella Arrington" <[EMAIL PROTECTED]> Reply-To: "Shella Arrington" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS Date: Sun, 28 Mar 2004 13:10:22 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--0825904990538747225" X-Mailer: PIPEX NetMail 2.2.0-pre13 X-IP: 221.134.57.232 X-IMAIL-SPAM-VALFROM: (71565618) X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" [2-18-9000] X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" [2-19-9800] X-RBL-Warning: IPNOTINMX: [2-25-c800] X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . [2-32-1] X-Declude-Sender: [EMAIL PROTECTED] [24.13.168.241] X-Declude-Spoolname: D4ed1044401323a46.SMD X-Note: This E-mail was scanned by Declude Junk
RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
To reiterate my message to Len, because I think its appropriate here also: I'm sure that blocks a lot of SPAM, but why stop there...you should just shut down all of your internet connectivity and you would stop 100% of the SPAM. Now that's a filter to be proud of!! :) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adrian Hauri Sent: Sunday, March 28, 2004 6:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) Our company blocks everything with reverse DNS entry from *.client.comcast.net, *.rr.com, *.du.shawcable.net, *.eastlink.ca, *.client.attbi.com, *client2.attbi.com, *cable.wanadoo.nl, *.de.comcast.net, *.md.comcast.net, *.tn.comcast.net, *.va.comcast.net, *.ipt.aol.com, *.east.verizon.net, *.vie.surfer.at, *.sprint-hsd.net, *cable.wanadoo.nl etc. Additionallly we block everything with *-number-* (like -26-), *.number.*, *.cable.*, *.pp.*, *.ip.*, *modem*, *async*, *rback*, *dyn*, *dhcp*, *ppp*, *dial*, *dsl* in the reverse DNS. This blocks a lot of unwanted emails. It is rare that a reverse DNS entry of a legal mailserver has dsl in the name. We just had one reverse DNS entry that we had to whitelist: mailservers for swiftdsl.com.au. But it helped us to minimize the rbl lookup and speed up the mail processing. There were some people who rang us up because they got the bounce message but all of them didn't have a proper reverse DNS entry for their mailserver. It's up to you how strict you are with blocking emails. But because we do not run a mail service for a lot of clients we can apply strict rules. Adrian - ToadShow Pty Ltd phone: 07 3004 7900 fax: 07 3846 1220 email: [EMAIL PROTECTED] http://www.toadshow.com.au - - Original Message - From: marc catuogno To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 9:32 AM Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I just got this e-mail and I just feel like someone is targeting my domain for a spam campaign. When I hit view source, it only said "test". Any suggestions on how to block this?? I'm surprised that DUL or DYNA didn't catch this at all, looks like it came in though a dynamic Comcast IP not one of their SMTP servers. I put "prod-infinitum.com" into the declude header filter with enough weight to hold it, but I don't think that would be enough. Thanks - Marc -Original Message- From: Shella Arrington [mailto:[EMAIL PROTECTED] Sent: Sunday, March 28, 2004 5:10 AM To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS test Headers: Received: from c-24-13-168-241.client.comcast.net [24.13.168.241] by mail.prudentialrand.com (SMTPD32-8.05) id AED14440132; Sun, 28 Mar 2004 17:16:49 -0500 Received: from 18.104.180.255 by 24.13.168.241; Sun, 28 Mar 2004 11:13:22 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Shella Arrington" <[EMAIL PROTECTED]> Reply-To: "Shella Arrington" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS Date: Sun, 28 Mar 2004 13:10:22 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--0825904990538747225" X-Mailer: PIPEX NetMail 2.2.0-pre13 X-IP: 221.134.57.232 X-IMAIL-SPAM-VALFROM: (71565618) X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" [2-18-9000] X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" [2-19-9800] X-RBL-Warning: IPNOTINMX: [2-25-c800] X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . [2-32-1] X-Declude-Sender: [EMAIL PROTECTED] [24.13.168.241] X-Declude-Spoolname: D4ed1044401323a46.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT, CMDSPACE [9] X-Country-Chain: X-Note: This E-mail was sent from c-24-13-168-241.client.comcast.net ([24.13.168.241]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 380366455 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
I also forgot to mention that I can't contact Adrian to arrange a whitelist (should any of our users need to send to his users) because my messages will be blacklisted. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adrian Hauri Sent: Sunday, March 28, 2004 6:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) Our company blocks everything with reverse DNS entry from *.client.comcast.net, *.rr.com, *.du.shawcable.net, *.eastlink.ca, *.client.attbi.com, *client2.attbi.com, *cable.wanadoo.nl, *.de.comcast.net, *.md.comcast.net, *.tn.comcast.net, *.va.comcast.net, *.ipt.aol.com, *.east.verizon.net, *.vie.surfer.at, *.sprint-hsd.net, *cable.wanadoo.nl etc. Additionallly we block everything with *-number-* (like -26-), *.number.*, *.cable.*, *.pp.*, *.ip.*, *modem*, *async*, *rback*, *dyn*, *dhcp*, *ppp*, *dial*, *dsl* in the reverse DNS. This blocks a lot of unwanted emails. It is rare that a reverse DNS entry of a legal mailserver has dsl in the name. We just had one reverse DNS entry that we had to whitelist: mailservers for swiftdsl.com.au. But it helped us to minimize the rbl lookup and speed up the mail processing. There were some people who rang us up because they got the bounce message but all of them didn't have a proper reverse DNS entry for their mailserver. It's up to you how strict you are with blocking emails. But because we do not run a mail service for a lot of clients we can apply strict rules. Adrian - ToadShow Pty Ltd phone: 07 3004 7900 fax: 07 3846 1220 email: [EMAIL PROTECTED] http://www.toadshow.com.au - - Original Message - From: marc catuogno To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 9:32 AM Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I just got this e-mail and I just feel like someone is targeting my domain for a spam campaign. When I hit view source, it only said "test". Any suggestions on how to block this?? I'm surprised that DUL or DYNA didn't catch this at all, looks like it came in though a dynamic Comcast IP not one of their SMTP servers. I put "prod-infinitum.com" into the declude header filter with enough weight to hold it, but I don't think that would be enough. Thanks - Marc -Original Message- From: Shella Arrington [mailto:[EMAIL PROTECTED] Sent: Sunday, March 28, 2004 5:10 AM To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS test Headers: Received: from c-24-13-168-241.client.comcast.net [24.13.168.241] by mail.prudentialrand.com (SMTPD32-8.05) id AED14440132; Sun, 28 Mar 2004 17:16:49 -0500 Received: from 18.104.180.255 by 24.13.168.241; Sun, 28 Mar 2004 11:13:22 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Shella Arrington" <[EMAIL PROTECTED]> Reply-To: "Shella Arrington" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS Date: Sun, 28 Mar 2004 13:10:22 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--0825904990538747225" X-Mailer: PIPEX NetMail 2.2.0-pre13 X-IP: 221.134.57.232 X-IMAIL-SPAM-VALFROM: (71565618) X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" [2-18-9000] X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" [2-19-9800] X-RBL-Warning: IPNOTINMX: [2-25-c800] X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . [2-32-1] X-Declude-Sender: [EMAIL PROTECTED] [24.13.168.241] X-Declude-Spoolname: D4ed1044401323a46.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT, CMDSPACE [9] X-Country-Chain: X-Note: This E-mail was sent from c-24-13-168-241.client.comcast.net ([24.13.168.241]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 380366455 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Raid Controller
I know that I’m coming into this late and I’m a little confused about much of this discussion. I don’t see how it’s possible to get better performance by aggregating all of the disks and then partitioning them out. This will still create contention when more than one partition is needed because they are on the same spindles. I always thought the rule was to separate logical processes across separate spindles whenever possible and practical. This would mean that multiple RAID sets would be faster when allocating a RAID set to each of the following separately: Windows system Swap file (or even multiple swap files on multiple RAID sets) Imail system Logging Webmail/calendaring Now this would get expensive, but we are discussing performance here, right? Going back to the SCSI vs. SATA price/performance issue: I have used SCSI for many moons and they are rock solid, but very expensive. However, I usually end up replacing a drive every couple of years. So my definition of rock solid is “no data loss” and “not more than one dead drive each year”. That’s acceptable to me. Besides, I can have RAID keep a hot spare to auto-rebuild the array and then I can hot replace the dead drive to become a new hot spare. It seems that SATA controllers and drives can now give me this level of reliability. And we have already agreed to the SATA performance being virtually equal to SCSI performance. Now it just sounds like SCSI bigotry. Kind of like the *nix people bashing the M$ people. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, March 25, 2004 4:02 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Raid Controller Matt, I agree with you. I am now confused, as I though it was better to separate physical Spans/Sets/groups by task, not logical partitions on one span/set/group by task. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, March 25, 2004 3:34 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Raid Controller Ok, I'll bury this for the sake of everyone else on this list (though I though the full discussion wouldn't hurt since the topic comes up in brief often so I kept it here). Basically you are saying throw 4 disks into a span and mirror the span (8 drives total, one disk seen by the system, and partitioned into logical drives only for personal preference and not performance). I was under the assumption that the logic was to separate spans for different tasks, in other words have multiple RAID 10 arrays instead of dedicating everything to just one. I can see how redundancy isn't really an issue and performance is better than RAID 50 in this case with the only drawback being wasted space, but that is of no consequence here. Please feel free to correct me if I'm wrong, otherwise thanks for the discussion :) Matt Keith Anderson wrote: The harse ain dead yet. Well, first thing is all RAID levels create one single volume thatcombines the total available drive space. No matter what RAID level youuse, all 10 drives become one big volume, just like the 24-drive RAID 10that I've got here. You can partition it through Windows only if youwant to have more than one volume. Raid 10 will always be the fastest redundant RAID. Again, let's examinethe process for a 4-disk system: WRITE RAID 10: Write to primary stripe (half of the drives, high-priority CPU cycles) Copy to backup stripe (half of the drives, delayed, idle-time CPUcycles) WRITE RAID 5: Write to primary stripe (high-priority CPU cycles to all drives) READ RAID 10: Read from primary stripe (half the drives) READ RAID 5: Read from the whole stripe (all of the drives) There's also a calculative processor delay in RAID5 that RAID 10 doesn'thave to worry about. RAID 10 always knows where the data needs to go,RAID 5 has to figure it out, then create a parity block for everystripe. You need to examine why you are asking this question-- what is your realstorage need, performance vs. volume size vs. security? Do you need theextra usable space with RAID 5 more than you need the 30-40% boost inperformance that you get with RAID 10? Do you need RAID 10's extrasecurity of surviving a double-drive failure? Keith -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of MattSent: Thursday, March 25, 2004 3:06 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Raid Controller Not to beat a dead horse, but... Am I mistaken about on RAID 5 array with 4 disks out performing one RAID 10 array with 4 disks? RAID 10 will do double RAID 0 plus a slight hit for mirroring. I though RAID 5 with 4 disks wou
RE: [Declude.JunkMail] test
Pong... Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Madscientist Sent: Tuesday, March 02, 2004 5:54 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] test ping --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] new dow and hour tests
What would be a good use for these tests? Or what is the motivation behind there creation? I don't understand what kind of Spam would be caught with them. Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, February 18, 2004 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] new dow and hour tests >Can someone explain these new tests? From the release notes: New tests "dow" and "hour", to allow hour and day-of-week detection. IE "HOUR hour 9 16 0 0" for local 9AM->4:59PM. DOW dow 1 5 0 0 for Monday through Friday. So if you add the following lines to your \IMail\Declude\global.cfg file: HOURhour9 16 0 0 DOW dow 1 5 0 0 it will create two new tests, HOUR and DOW. The HOUR test will be triggered if the E-mail was received between 9AM and 4:59PM (16:59); the DOW test will be triggered if the E-mail was received between Monday and Friday. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do they do it?
I noticed something similar when I added a new user to an existing domain and within 24 hours that account had SPAM traffic. Junkmail was catching it, but I'm not sure how the spammers found the address that quickly. Is this similar to Joe's issue? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf Sent: Thursday, February 05, 2004 7:35 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How do they do it? Thanks for the reply. No dictionary attacks that I can see in the logs for these domains, but it's possible that it happened. The previous host was DigiHost. There was no sign of spam filtering and it's not on their list of features or options. Will ask one of the customers for permission to post a header. Gotta keep inside our Privacy Policy. Thanks for the quick reply! -Joe - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, February 05, 2004 9:16 AM Subject: Re: [Declude.JunkMail] How do they do it? > > >I've had two cases recently where I had hosting customers move their email > >services to my Imail/Declude box. Both moved from a national hosting > >company and had no spam protection of any kind on their services. Both > >complained within a week of the move that they're getting bombarded by spam. > >Both claim that they didn't receive much spam on their old host. One had a > >mail archive that I was able to look at and there really wan't much in the > >way of spam in there. > > The only thing that I can think of is that the spammers have access to the > zone files (which list all the domains in a TLD and their NS records), and > are looking for changes in the NS records, and targeting those domains. > > Are the spams going to valid user accounts? Is this a dictionary > attack? My guess is that the hosting company was indeed filtering spam. > > >How is it that these spammers are hitting these domains when they move to my > >box? I have JunkMail pretty well configured (I think) and they still get > >more spam than they did before the move. Doesn't make sense to me. > > Could you send me the full headers of several spams that are getting > through? I may be able to get a better idea of what is happening. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT- Getting a URL de-listed on AOL
“he'll probably use his AOL account to do his mailings (if they allow the volume)” AOL will stop them from coming in, but not from going out!! AOL and Earthlink are 2 of the biggest SPAM sources we see. I wish they would practice what they preach! ;) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, January 29, 2004 10:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT- Getting a URL de-listed on AOL My point was that commissioned individuals in businesses like this (real estate and auto dealerships) tend to look to bulk mailings as a way to enhance their business opportunities. My neighbor for instance just got his license and he keeps telling me how he needs to set up an E-mail list. He's definitely the type of guy that will do a poor job of preening his list following complaints, he'll probably use his AOL account to do his mailings (if they allow the volume), and he'll probably send out messages with little or no value. Essentially, these people don't know better, and they need to be instructed by their business as to exactly what acceptable E-mail use is. If his company is large enough to have several dozens of commissioned individuals taking upon themselves to become small-time spammers, then that can create problems for the company as a whole, as is likely indicated in Marc's situation. Now if I was the guy at AOL that made the determination as to whether or not to remove Marc's domain from my blacklist, my first question would be, "what have you done to limit the abuse/spam?" This is why I recommended that he start there. As far as "We hate spam too" links on home pages go, they are highly indicative of companies with poor control, a lack of best practices, or even a front to fool E-mail administrators into not blacklisting them. That would be a red flag in my book. It's hardly any different from the disclaimers that you often see on spam coming from sources with 1,000 different domain names. Not that the idea of being anti-spam is bad, but this has become too commonly used to trick people. If Marc wants to get off of AOL's list, he's probably going to have to work pretty hard to get it done. Word is that they are notoriously non-responsive regardless. If he finds the right person and the process turns out to be easy enough, it's still a good idea to get his ducks in order so that future problems might be prevented. I'm quite sure that this is good advice. Matt Sanford Whiteman wrote: The first step would be to put in place measures that stopped theunsolicited mailings. This is easy to say, but probably impossible to do. If they have notpruned their lists of unwanted "memberships," that's probably becausethey no longer have any idea which ones were solicited or opted-in,which ones were illegally scraped--or even which ones are bouncing. So the only way to stop the unsolicited mailings is to stop _all_mailings to AOL and immediately send gentle "probe only" messages to"refresh" members at other domains; you should also post a "We HateSpam, Too" button on your home page with a link for immediate andpermanent removal to imply good faith. And this needs to be taken to the executive level to set clear policy.I'd consider this a very grave problem for a consumer-orientedbusiness to be barred from the leading consumer ISP. But it's a*business* problem, and as a technical person, your onlyresponsibility should be to explain it, not solve it. --Sandy Sanford Whiteman, Chief TechnologistBroadleaf Systems, a division ofCypress Integrated Systems, Inc.e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ ---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. -- =MailPure custom filters for Declude JunkMail Pro.http://www.mailpure.com/software/=
RE: [Declude.JunkMail] Challenge/Response with Declude
Is it true that AutoWhite only works on WebMail? Could someone elaborate on the AutoWhite functionality, because I must have missed something to think would cover these C/R issues. I do like the idea of C/R only for grey area messages. This would virtually eliminate the complaints of challenging the obvious good or obvious bad messages, then reducing the number of challenge messages to something less than 5% of the messages. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Wednesday, January 28, 2004 12:20 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Challenge/Response with Declude > > That is what AutoWhite for Declude does. > > However, that does not lesson any of the problems with C/R software. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Greg Foulks > > Sent: Wednesday, January 28, 2004 12:05 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Challenge/Response with Declude > > > > I guess what I'm trying to say is that I like the concept I also > > agree with all of con's that have presented. It would be nice if there > > was someway we could automate the whitelist. > > > > What about this spin? What if Declude took the email address that the > > internal user was sending to and put it in the whitelist? If it's a good > > address going out then it must be good coming in, right? > > > > Greg > > > > Andy Schmidt wrote: > > > > >Hi, > > > > > > > > > > > >>>I think the consensus is it is not acceptable << > > >>> > > >>> > > > > > >Then let mine be the only opposing voice. > > > > > >I think because of Declude's weight features, Challenge/Response would > be > > a > > >very valuable and very usable option. > > > > > >Any messages with LOW weight pass. This addresses your concern of > > "breaking > > >e-commerce". If they want to make money, they better have their mail > > server > > >set up appropriately. > > > > > >Any messages with HIGH weight, get held or deleted. I have yet to hear > a > > >complaint. > > > > > >In the middle are a small percentage of medium weights that do fail a > > spam > > >test or two - but are possibly legitimate. Those few messages > currently > > get > > >a bounce message so that a false positive "victim" has a chance to > > >"intervene". I have gotten zero complaints from people saying "hey, > you > > >spammed me with your bounce message", but every so often I do get a > thank > > >you from a "false positive" victim who, due to my bounce message, is > able > > to > > >address THEIR problem. > > > > > >It is those bounce messages, which in the future could come with a > > >"challenge/response" URL, containing the URL with the queue-ID as a > > >parameter to a web application that will release their message. It's a > > >shame that we currently are forced to "manually" manage the false > > positives > > >when Declude could automate that process! > > > > > >(Hm - now that I'm saying this - I should just write a little web > > >application that copies the held D and Q file back to the spool and > > include > > >the parameterized URL in my bounce messages... If I only had the > > time...) > > > > > >Best Regards > > >Andy Schmidt > > > > > >H&M Systems Software, Inc. > > >600 East Crescent Avenue, Suite 203 > > >Upper Saddle River, NJ 07458-1846 > > > > > >Phone: +1 201 934-3414 x20 (Business) > > >Fax:+1 201 934-9206 > > > > > >http://www.HM-Software.com/ > > > > > >--- > > >[This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > >--- > > >This E-mail came from the Declude.JunkMail mailing list. To > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > >type "unsubscribe Declude.JunkMail". The archives can be found > > >at http://www.mail-archive.com. > > >
RE: [Declude.JunkMail] Manual
Title: Message I agree with this approach. It would separate the BETA users from the curious RELEASE users (who probably should wait for the release). Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Friday, January 23, 2004 2:16 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Manual I'm all in favour of the manual being sync'ed with the releases. That's a no-brainer. Beta support handling is a bone of contention, and I'd rather that support maintenance of those features not interfere with the stellar support we already get from Declude. Therefore, I suggest that: 1) Create a new mailing list for Declude.JunkMail.Beta that those who live on the bleeding edge can join. Cross-posting to Declude.JunkMail and Declude.Virus is discouraged. Announcements of features would be done there. 2) As suggested already, simple documentation of new features under testing be provided, e.g. sample usage and obvious gotchas, rather than the support/beta list getting clogged with people discovering a beta feature and asking how to use it. 3) Tracking what's in the Release and what's in the Beta then makes it irrelevant what's in a given Interim. Declude could then e-mail out a "new release announcement" to the customer base (that'd be us). A lot of traffic in this support list is based on administrators who are quite far behind but are seeing "new" tests discussed and want to get up to speed. 4) Perhaps: prefix the Beta feature names with BETA, e.g. BETAHIDETESTS, BETASPFPASS; the onus is then on we the mail administrators to do search and replace when we implement the Release version...? Valuable or pointless? Strict or customer-abusive? Judging by the discussion today, some would prefer the clarity... but then, I only deal with one global.cfg and one $default$.junkmail so my judgement is limited. Andrew. -Original Message- From: Matt [mailto:[EMAIL PROTECTED] Sent: Friday, January 23, 2004 1:34 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Manual Maybe beta's should be by invitation/request only, and distributed only to that group like a normal beta program? At the same time, bug fixes can be applied to the last release, as well as the most recent beta, or only to the beta's if that's all that is affected? It's a bit more work to maintain two different sets of code in this way, but it keeps the bugs relating to full releases from requiring you to upgrade to a beta interim release. This would also cut down dramatically on the overhead of releasing betas to the general public and having to deal with the potential pitfalls of this (i.e. too much discussion). Matt paul wrote: I'll add my .02 worth to this discussion: What I feel would be the best as a user: 1: Maybe instead of 1.76 beta to 1.77 beta, it should've been 1.76 Release, with an update to the manual about the new features of 1.76. 2: Betas should have a page devoted to the new features with a disclaimer "These may not be in the next release - use at your own risk" That way, those that don't use the betas and wait for an actual release get what they want, and beta users get what they want as well. Paul -- =MailPure custom filters for Declude JunkMail Pro.http://www.mailpure.com/software/=
RE: [Declude.JunkMail] Clarification
1. Place negative weight tests first. 2. While testing effectiveness of a single test, place it first or turn off the stop processing flag for a period of time. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Thursday, January 22, 2004 3:01 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Clarification > > If a filter is skipped by SKIPIFWEIGHT, at that point I am not concerned > about logging that filter, as I do not want it to run. Remember, > SKIPIFWEIGHT is only for filters. > > However, what if a message gets a high weight early, but then would get a > negative weight from a filter? You took action before the message had a > chance to get the negative weight. > > What if you are checking to see the effectiveness of one test compared to > others? If processing is stopped short, that test may not be run on all > messages. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Dave Doherty > > Sent: Thursday, January 22, 2004 1:00 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Clarification > > > > John- > > > > Doesn't SKIPIFWEIGHT also defeat the logging of the skipped tests? > > > > -Dave Doherty > > Skywaves, Inc. > > > > - Original Message - > > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Thursday, January 22, 2004 1:04 PM > > Subject: RE: [Declude.JunkMail] Clarification > > > > > > > I would like to see the SKIPIFWEIGHT option removed. If we had a > > > conditional option to stop when a specific weight is reached, then > there > > > would be not need for SKIPIFWEIGHT. In addition, why would anyone use > > > SKIPIFWEIGHT on less than every test...and why would anyone define one > > > test with a different SKIPIFWEIGHT value than another test? This > leads > > > me back to a HOLDIFWEIGHT/DELETEIFWEIGHT logic which optionally stops > > > processing when reached. > > > > Coming in late some my comments may be off. > > > > Scott has stated before that to stop all processing once a certain > weight > > has been reached would be difficult and/or problematic. That is where > > SKIPIFWEIGHT comes in. I use SKIPIFWEIGHT on all body filters, as those > > are > > the most expensive in terms of CPU cost. I then have body filters listed > > in > > order, from most effective to least effective or specific target. > Example, > > I > > have a custom body filter on my server for one client only. That is the > > last > > filter to run. > > > > Also, another reason to not stop processing is if you are doing log > > analysis > > and adjust filters or blocks based on that analysis. If you stop > > processing > > at say 35, but the message would have failed 5 other tests, those tests > > will > > then not show up in log analysis. > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Clarification
I would like to see the SKIPIFWEIGHT option removed. If we had a conditional option to stop when a specific weight is reached, then there would be not need for SKIPIFWEIGHT. In addition, why would anyone use SKIPIFWEIGHT on less than every test...and why would anyone define one test with a different SKIPIFWEIGHT value than another test? This leads me back to a HOLDIFWEIGHT/DELETEIFWEIGHT logic which optionally stops processing when reached. Relating to Dave's comments below: Would it not be more flexible to move the IFWEIGHT options to the .junkmail file to take advantage of the available scoping options (system/domain/user)? This is also more consistent with the existing .junkmail options such as HEADER, WARN, DELETE, HOLD... Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Dave Doherty > Sent: Wednesday, January 21, 2004 7:29 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Clarification > > Scott- > > I think this is a great idea. > > Once we know a message has passed the delete limit, why would we want to > keep testing it in routine operations? Of course, we'd need to be able to > turn it off when needed for debugging or whatever, but it would save a lot > of processing time under normal conditions. > > My suggestion would be to define it in global.cfg (maybe QUITIFWEIGHT ?) > and > have it become active only when encountered in the junkmail file test > sequence. That would let us group the positive tests first, then any tests > we considered mandatory, then QUITIFWEIGHT would stop the processing at > that > point or any later point if the specified weight is met or exceeded. > > That would minimize the need for SKIPIFWEIGHT and other statements. > > My two cents worth, anyway. > > -Dave Doherty > Skywaves, Inc. > > > > - Original Message - > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, January 21, 2004 11:41 AM > Subject: RE: [Declude.JunkMail] Clarification > > > > > > > Is there a test, in the works, that will end all processing of > > >any further filters. Basically, exit all Declude processing, or is it > > >best to use the SKIPWEIGHT, thanks, > > > > There isn't anything like that in the works now, but it is something > that > > we may end up adding. > > > > -Scott > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Clarification
I may seem small, but the SKIPIFWEIGHT functionality seems overly cumbersome to use. I don't like defining the same lines repeatedly for each test. I would like to place the HOLDIFWEIGHT and/or DELETEIFWEIGHT lines in the $default$.junkmail file. Or in any per domain/per user .junkmail file. This would allow me to have the tests add/delete weight to the current message weight and have the system/domain/user settings determine when to perform all actions (ie. HOLD, DELETE, HEADER, WARN, IGNORE, etc). One possible solution to this may be to move the WEIGHTHEADER, WEIGHTHOLD and WEIGHTDELETE lines to the .junkmail file. This way the settings could be defined as appropriate for the scope (system/domain/user). Instead of defined them as tests, they would be conditional actions based on the changing message weight. If this was done, I would ask for an option on each WEIGHT action to stop further processing. In any case, I feel that it's important for me to be able to change the test (or test group) processing order. Over 70% of our deleted messages could be determined without leaving the server (no network access) by using the sniffer test and the internal tests (BadHeaders, Routing, etc) only. Again, it may seem small, but limiting the necessary processing and network access in any way can add up. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Sanford Whiteman > Sent: Wednesday, January 21, 2004 5:22 PM > To: Matt > Subject: Re[2]: [Declude.JunkMail] Clarification > > > I'm thinking this could be accomplished by Declude passing in a > > current score and having the individual external tests handle what > > they do on their own. I'm thinking that this might already be > > possible though, but I'm not sure about what order they are > > processed in, and I'm not sure that among others, Sniffer handles > > such a thing currently. > > FTR, SPAMC32 does offer SKIPIFWEIGHT functionality via a command-line > option. > > --Sandy > > > > Sanford Whiteman, Chief Technologist > Broadleaf Systems, a division of > Cypress Integrated Systems, Inc. > e-mail: [EMAIL PROTECTED] > > SpamAssassin plugs into Declude! > http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Clarification
I can’t speak as to the internal organization of Junkmail. It might be very difficult to separate the similar tests from each other. Perhaps the similar tests could be grouped and the group could be placed in an order with other tests. As to the tests we would like to see run first, certainly Sniffer! More than 90% of our deleted messages fail the Sniffer test. That is very indicative to us and I would like this one run first. For us, if a message fails sniffer, it only needs to fail one or two other tests to be deleted. It would be nice if we could perhaps run the internal Junkmail tests next (ie. BadHeaders, NoPostmaster, NoAbuse, Routing, HeloBogus, etc) because these don’t need to make any network calls to accomplish (ie. they only need the message itself). Many of our deleted messages fail two or three of these and could be deleted immediately without further testing (assuming they failed Sniffer). Next, run the tests that require only internal machine resources, such as fromfile and pattern matching tests. Finally, and it sounds like all of the RBL tests are launched simultaneously, burn the bandwidth to test the RBLs, RevDNS, etc., that require network bandwidth. This progressive approach would allow us to place the tests which we find most useful at the front of the test queue. And have a weight at which testing is no longer considered useful in determining the fate of a message. I think this approach could cover a feature request that I have seen here repeatedly: A way to combine test failures into a single outcome. For example, a test called DefinitelyDelete defined as failed Sniffer and failed Spamcop and failed Badheaders. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, January 21, 2004 1:36 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Clarification Todd, The RBL's and the built in Declude tests are very efficient. The RBL's also go off all at once essentially, so there is no good way to stagger them one by one. I think it would be great though if Declude allowed us to set a SKIPIFWEIGHT value for FROMFILE's, IPFILE's, SPAMDOMAIN's and other associated text filters in a manner similar to the custom filters. And also, allow us to set a SKIPIFWEIGHT value for external tests. It would be nice to be able to order some things, though I would assume that RBL's and then built-in technical tests would always be run in that order, but then which of the others would be run would be nice to be able to set. My top request would be to stop external tests based on weight because I assume that this would be where the majority of overhead could lie on an otherwise well organized system. I'm thinking this could be accomplished by Declude passing in a current score and having the individual external tests handle what they do on their own. I'm thinking that this might already be possible though, but I'm not sure about what order they are processed in, and I'm not sure that among others, Sniffer handles such a thing currently. Matt Todd Holt wrote: The following has been suggested before and is similar:- Allow the Declude admin to set the order of test processing and stopprocessing if the weight reaches a specified limit. Your concern at the time was:- If the admin places the tests in the wrong order it would be possibleto exceed maximum allowed weight prior to running negative weight tests. I think this is an education issue, just like everything else aboutadministering software. I also think this would reduce our processing time per message byallowing us to place the tests with the highest hit percentage first andstop processing early on most messages. (Over 90% of our delete weightmessages failed Sniffer and either BadHeaders or SpamCop) I would liketo save the processing time if those push the weight into the deleterange. I could make sure to place the negative weight tests first. Todd HoltXidix Technologies, IncLas Vegas, NV USAwww.xidix.com702.319.4349 -Original Message-From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-[EMAIL PROTECTED]] On Behalf Of R. Scott PerrySent: Wednesday, January 21, 2004 8:42 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Clarification Is there a test, in the works, that will end all processing of any further filters. Basically, exit all Declude processing, or is it best to use the SKIPWEIGHT, thanks, There isn't anything like that in the works now, but it is something that we may end up adding. -Scott---Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailservervulnerability det
RE: [Declude.JunkMail] Clarification
The following has been suggested before and is similar: - Allow the Declude admin to set the order of test processing and stop processing if the weight reaches a specified limit. Your concern at the time was: - If the admin places the tests in the wrong order it would be possible to exceed maximum allowed weight prior to running negative weight tests. I think this is an education issue, just like everything else about administering software. I also think this would reduce our processing time per message by allowing us to place the tests with the highest hit percentage first and stop processing early on most messages. (Over 90% of our delete weight messages failed Sniffer and either BadHeaders or SpamCop) I would like to save the processing time if those push the weight into the delete range. I could make sure to place the negative weight tests first. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Wednesday, January 21, 2004 8:42 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Clarification > > > > Is there a test, in the works, that will end all processing of > >any further filters. Basically, exit all Declude processing, or is it > >best to use the SKIPWEIGHT, thanks, > > There isn't anything like that in the works now, but it is something that > we may end up adding. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail Evaluation
Yes. Imail! Go with Declude, you won't be sorry. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Spencer Salva > Sent: Tuesday, January 20, 2004 4:01 PM > To: Declude. JunkMail (E-mail) > Subject: [Declude.JunkMail] Declude JunkMail Evaluation > > My company currently uses Declude JunkMail & AntiVirus and we're starting > a > new project that will require similar software. I was wondering if anyone > on here has used other email filtering software that you gave up in favor > of > Declude, and if so, why? > > Spencer Salva > Systems Analyst > Solimar Systems, Inc. > tel: (619) 849-2800 > [EMAIL PROTECTED] > www.solimarsystems.com > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
Always remember, "You get what you pay for." The windows defrager is free and is essentially Diskeeper "Light". Our testing has shown that the full version is faster and does a better job during each pass (usually only a single pass is required). And I don't remember if the windows defragger supports boot-time defragmentation. We run this about once a month to cleanup the things that can't be done during normal windows operation. However, this does require that the server be down during the boot-time defrag. Don't short change yourself, go with the full version! You'll be very happy with it. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Omar K. > Sent: Wednesday, January 14, 2004 10:55 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Does Diskeeper Help on an imail server > > This is good stuff, other than the obvious scheduling capability, does > diskeeper do a better job than the built-in defrag in windows server? > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Russ Uhte (Lists) > Sent: Wednesday, January 14, 2004 8:07 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Does Diskeeper Help on an imail server > > > At 12:47 PM 1/14/2004, Timothy Bohen wrote: > >My imail server is obviously hugely fragmented. If I spend the money on > >diskeeper will it be able to keep up with the fragmentation on a very > busy > >imail server? I know this isn't a diskeeper mailing list but I always get > >the best/fastest answers on this list. > >Thanks > > I generally process about 200,000 messages per day (or roughly > 2/sec.) Diskeeper made a world of difference on my server. I schedule it > to do smart scheduling on off peak hours, and it has no problem keeping > up. Well worth the money in my opinion. > > -Russ > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Diskeeper Help on an imail server
Our experience with Diskeeper on a very busy machine is quite honestly, no. Diskeeper needs disk I/O cycles to do its work and must steal them from other processes. Unfortunately, IMail is also disk intensive, creating massive contention for drive resources. Suggestion: DO NOT use "Smart Scheduling" mode on a server as it may start at any time without regard to high load time segments. Do you have a window when the server is less loaded? Perhaps 3-5am? That is our window for virus scans, backups and diskeeper defrags (every night) on all our servers. Our activity is light during this window and the impact to our customers is negligible. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Timothy Bohen > Sent: Wednesday, January 14, 2004 9:47 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Does Diskeeper Help on an imail server > > My imail server is obviously hugely fragmented. If I spend the money on > diskeeper will it be able to keep up with the fragmentation on a very busy > imail server? I know this isn't a diskeeper mailing list but I always get > the best/fastest answers on this list. > Thanks > > > > > > Sent via the WebMail system at mail1.cmsinter.net > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF setup wizard output
OK, thanks. We have a hosted DNS and I'm getting the entries done now. I'll let you know. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Friday, December 19, 2003 7:32 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] SPF setup wizard output > > Yes, Todd, that should work just fine. If you would like to test it after > implementing, let me know and I will forge your domain and send you an > e-mail from a yahoo.com account. > > Bill > - Original Message - > From: "Todd Holt" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, December 19, 2003 7:17 PM > Subject: RE: [Declude.JunkMail] SPF setup wizard output > > > > It would appear that I could this single line in the zone file: > > > > v=spf1 ip4:208.57.224.88 -all > > > > and that would specify that all valid mail from the domain originates > > from this IP address. > > > > Is this correct? > > > > Todd Holt > > Xidix Technologies, Inc > > Las Vegas, NV USA > > www.xidix.com > > 702.319.4349 > > > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of Todd Holt > > > Sent: Friday, December 19, 2003 6:54 PM > > > To: [EMAIL PROTECTED] > > > Subject: [Declude.JunkMail] SPF setup wizard output > > > > > > I ran the SPF setup wizard from the spf.pobox.com site and it resulted > > > in the following lines to be inserted into DNS: > > > > > > las-DSL224-cust088.mpowercom.net. IN TXT "v=spf1 a -all" > > > mail.xidix.com. IN TXT "v=spf1 a -all" > > > mail2.xidix.com. IN TXT "v=spf1 a -all" > > > wsip-24-234-126-147.lv.lv.cox.net. IN TXT "v=spf1 a -all" > > > > > > Why does it specify the 1st and 4th lines? The 1st line appears to be > > > the RDNS suffix of our primary inbound server and the 4th line appears > > > to be the RDNS of our backup inbound mail server IP address. > > > > > > In addition, the wizard said that it found 4 MX records for our > > server. > > > We only have 2 (see > > > http://www.dnsreport.com/tools/dnsreport.ch?domain=xidix.com). Why did > > > it find 4 MX records? Why should it care how many MX records we have? > > > These are to specify incoming mail servers and SPF is to specify > > > outgoing mail servers (that mail for my domain is allowed to be sent > > > from). Or am I missing something here? > > > > > > We only send mail from 1 IP address. Can I just specify that 1 > > address? > > > I want to specify that all mail for this domain (Xidix.com) is sent > > from > > > a single IP address (208.57.224.88). > > > > > > What am I missing in this picture? > > > > > > Todd Holt > > > Xidix Technologies, Inc > > > Las Vegas, NV USA > > > www.xidix.com > > > 702.319.4349 > > > > > > > > > --- > > > [This E-mail scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > --- > > > [This E-mail scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF setup wizard output
It would appear that I could this single line in the zone file: v=spf1 ip4:208.57.224.88 -all and that would specify that all valid mail from the domain originates from this IP address. Is this correct? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Todd Holt > Sent: Friday, December 19, 2003 6:54 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] SPF setup wizard output > > I ran the SPF setup wizard from the spf.pobox.com site and it resulted > in the following lines to be inserted into DNS: > > las-DSL224-cust088.mpowercom.net. IN TXT "v=spf1 a -all" > mail.xidix.com. IN TXT "v=spf1 a -all" > mail2.xidix.com. IN TXT "v=spf1 a -all" > wsip-24-234-126-147.lv.lv.cox.net. IN TXT "v=spf1 a -all" > > Why does it specify the 1st and 4th lines? The 1st line appears to be > the RDNS suffix of our primary inbound server and the 4th line appears > to be the RDNS of our backup inbound mail server IP address. > > In addition, the wizard said that it found 4 MX records for our server. > We only have 2 (see > http://www.dnsreport.com/tools/dnsreport.ch?domain=xidix.com). Why did > it find 4 MX records? Why should it care how many MX records we have? > These are to specify incoming mail servers and SPF is to specify > outgoing mail servers (that mail for my domain is allowed to be sent > from). Or am I missing something here? > > We only send mail from 1 IP address. Can I just specify that 1 address? > I want to specify that all mail for this domain (Xidix.com) is sent from > a single IP address (208.57.224.88). > > What am I missing in this picture? > > Todd Holt > Xidix Technologies, Inc > Las Vegas, NV USA > www.xidix.com > 702.319.4349 > > > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF setup wizard output
I ran the SPF setup wizard from the spf.pobox.com site and it resulted in the following lines to be inserted into DNS: las-DSL224-cust088.mpowercom.net. IN TXT "v=spf1 a -all" mail.xidix.com. IN TXT "v=spf1 a -all" mail2.xidix.com. IN TXT "v=spf1 a -all" wsip-24-234-126-147.lv.lv.cox.net. IN TXT "v=spf1 a -all" Why does it specify the 1st and 4th lines? The 1st line appears to be the RDNS suffix of our primary inbound server and the 4th line appears to be the RDNS of our backup inbound mail server IP address. In addition, the wizard said that it found 4 MX records for our server. We only have 2 (see http://www.dnsreport.com/tools/dnsreport.ch?domain=xidix.com). Why did it find 4 MX records? Why should it care how many MX records we have? These are to specify incoming mail servers and SPF is to specify outgoing mail servers (that mail for my domain is allowed to be sent from). Or am I missing something here? We only send mail from 1 IP address. Can I just specify that 1 address? I want to specify that all mail for this domain (Xidix.com) is sent from a single IP address (208.57.224.88). What am I missing in this picture? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Windows Server 2003
I'm just giving you a hard time, John. I appreciate your effort to collate some data on the subject. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Friday, December 19, 2003 4:29 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Windows Server 2003 > > No. I am saying that only 176 responses to the survey does not give a > reliable survey result when there are clearly at least 10 times that many > out there, if not way more. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Todd Holt > > Sent: Friday, December 19, 2003 4:13 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Windows Server 2003 > > > > John, > > Are you saying that small servers are not reliable?? :)) > > > > Todd Holt > > Xidix Technologies, Inc > > Las Vegas, NV USA > > www.xidix.com > > 702.319.4349 > > > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > > > Sent: Friday, December 19, 2003 3:05 PM > > > To: [EMAIL PROTECTED] > > > Subject: RE: [Declude.JunkMail] Windows Server 2003 > > > > > > Unfortunately, there were only 176 responses, mostly from small to mid > > > size > > > setups. Therefore, the results were not reliable. > > > > > > John Tolmachoff > > > Engineer/Consultant/Owner > > > eServices For You > > > > > > > > > > -Original Message- > > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > > [EMAIL PROTECTED] On Behalf Of Omar K. > > > > Sent: Friday, December 19, 2003 2:15 PM > > > > To: [EMAIL PROTECTED] > > > > Subject: RE: [Declude.JunkMail] Windows Server 2003 > > > > > > > > Yeah, whatever happened to that, I poured my heart out there :) > > > > > > > > -Original Message- > > > > From: [EMAIL PROTECTED] > > > > [mailto:[EMAIL PROTECTED] On Behalf Of DLAnalyzer > > > > Support > > > > Sent: Friday, December 19, 2003 11:52 PM > > > > To: [EMAIL PROTECTED] > > > > Subject: Re: [Declude.JunkMail] Windows Server 2003 > > > > > > > > > > > > John, > > > > > > > > I remember you did a survey awhile back on problems with Imail/etc. > > > Were > > > > the results of that ever posted? > > > > > > > > Darrell > > > > > > > > Check Out DLAnalyzer a comprehensive reporting tool for > > > > Declude Junkmail Logs - http://www.dlanalyzer.com > > > > > > > > > > > > John Tolmachoff (Lists) writes: > > > > > > > > > For the majority, W2K3 is the way to go if you are able to. > > Ipswitch > > > > does > > > > > support running Imail on W2K3. > > > > > > > > > > There are some possible issues. > > > > > > > > > > 1. Running MS DSN service on W2K3 WITH Imail Anti-Spam DNS tests > > is a > > > > > problem. > > > > > > > > > > 2. Some issues have been reported on the Imail list when the > > server > > > > > processes a high volume of messages per day. Nothing seems to be > > > > conclusive > > > > > as far as I know to date, and from the posts, I have not seen a > > > definite > > > > > pattern. > > > > > > > > > > John Tolmachoff > > > > > Engineer/Consultant/Owner > > > > > eServices For You > > > > > > > > > > > > > > >> -Original Message- > > > > >> From: [EMAIL PROTECTED] > > [mailto:Declude.JunkMail- > > > > >> [EMAIL PROTECTED] On Behalf Of Jonathan > > > > >> Sent: Thursday, December 18, 2003 10:44 PM > > > > >> To: [EMAIL PROTECTED] > > > > >> Subject: RE: [Declude.JunkMail] Windows Server 2003 > > > > >> > > > > >> So I haven't heard anything else back on t
RE: [Declude.JunkMail] Windows Server 2003
John, Are you saying that small servers are not reliable?? :)) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Friday, December 19, 2003 3:05 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Windows Server 2003 > > Unfortunately, there were only 176 responses, mostly from small to mid > size > setups. Therefore, the results were not reliable. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Omar K. > > Sent: Friday, December 19, 2003 2:15 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Windows Server 2003 > > > > Yeah, whatever happened to that, I poured my heart out there :) > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of DLAnalyzer > > Support > > Sent: Friday, December 19, 2003 11:52 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Windows Server 2003 > > > > > > John, > > > > I remember you did a survey awhile back on problems with Imail/etc. > Were > > the results of that ever posted? > > > > Darrell > > > > Check Out DLAnalyzer a comprehensive reporting tool for > > Declude Junkmail Logs - http://www.dlanalyzer.com > > > > > > John Tolmachoff (Lists) writes: > > > > > For the majority, W2K3 is the way to go if you are able to. Ipswitch > > does > > > support running Imail on W2K3. > > > > > > There are some possible issues. > > > > > > 1. Running MS DSN service on W2K3 WITH Imail Anti-Spam DNS tests is a > > > problem. > > > > > > 2. Some issues have been reported on the Imail list when the server > > > processes a high volume of messages per day. Nothing seems to be > > conclusive > > > as far as I know to date, and from the posts, I have not seen a > definite > > > pattern. > > > > > > John Tolmachoff > > > Engineer/Consultant/Owner > > > eServices For You > > > > > > > > >> -Original Message- > > >> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > >> [EMAIL PROTECTED] On Behalf Of Jonathan > > >> Sent: Thursday, December 18, 2003 10:44 PM > > >> To: [EMAIL PROTECTED] > > >> Subject: RE: [Declude.JunkMail] Windows Server 2003 > > >> > > >> So I haven't heard anything else back on this .. are you guys all > > staying > > >> away from Windows 2003 and Imail? I'm having a hard time trying to > > justify > > >> the risk of running new servers on 2k3 when 2k works just fine .. but > > then > > >> again, 2k3 seems more stable over time but not if Imail doesn't > > >> support it well yet. > > >> > > >> g > > >> > > >> Thoughts? > > >> > > >> Jonathan > > >> > > >> At 05:04 PM 12/4/2003, you wrote: > > >> >The issues seem to appear at high volumes. > > >> > > > >> >Besides, I am more than willing to use those licenses for you. ;) > > >> > > > >> >John Tolmachoff > > >> >Engineer/Consultant/Owner > > >> >eServices For You > > >> > > > >> > > > >> > > -Original Message- > > >> > > From: [EMAIL PROTECTED] > [mailto:Declude.JunkMail- > > >> > > [EMAIL PROTECTED] On Behalf Of Jonathan > > >> > > Sent: Thursday, December 04, 2003 2:43 PM > > >> > > To: [EMAIL PROTECTED] > > >> > > Subject: [Declude.JunkMail] Windows Server 2003 > > >> > > > > >> > > So, what's the scoop with current Imail 8, declude, sniffer, etc > on > > >> > > Windows > > >> > > 2003 Server? We're thinking about moving it to some new iron > > >> internally, > > >> > > and Ive got some 2k3 licenses just burning a hole in my pocket. > :) > > >> > > > > >> > > I heard some stability issues, saw some imail patches/etc .. > things > > >> stable > > >>
RE: [Declude.JunkMail] Test order
This could be a very useful feature. I could define my negative weight tests first, then the "high probability/high weight" tests next. Then if the weight exceeds my delete weight quickly, Declude could stop spending cycles/bandwidth on the other tests. Admittedly, I would require the admin to correctly configure the order of the tests. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Friday, December 19, 2003 11:55 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Test order > > > >Are the tests performed in the order listed in the global.cfg? > > No. > > Declude JunkMail has a hard-coded for the test types. However, for each > test type, the tests will be run in the order that they are listed in the > global.cfg file. > > So if you have an ip4r test and a filter test, the order they are listed > in > will not matter. However, if you have 2 filter tests, they will be run in > the order they are listed in the global.cfg file. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test order
Are the tests performed in the order listed in the global.cfg? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist Auth?
I found the whitelist auth in the archives. Sorry. I still want to know how to stop performing tests after a certain weight level. Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Todd Holt > Sent: Friday, December 19, 2003 11:13 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Whitelist Auth? > > I have been looking for the syntax for this entry. Can you publish it? > My understanding is that this will whitelist anyone that has > authenticated for SMTP. Is that correct? > > Also, what is the entry to stop performing tests if the weight reaches a > certain level? > > Thanks, > > Todd Holt > Xidix Technologies, Inc > Las Vegas, NV USA > www.xidix.com > 702.319.4349 > > > > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist Auth?
I have been looking for the syntax for this entry. Can you publish it? My understanding is that this will whitelist anyone that has authenticated for SMTP. Is that correct? Also, what is the entry to stop performing tests if the weight reaches a certain level? Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AOL and Reverse DNS
> SPAM from AOL accounts - hm, I have to admit that I only see an > (automatically selected) cross-section of spam messages with header (which > are routed to SPAMCOP for analysis) - but I can't remember seeing AOL as > an implicated party often (if ever). I am interpreting this statement as you don't think AOL users are a source of spam. Here is a small sample of addresses in our kill.lst that have been added because they send spam: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] If AOL is so interested in stopping spam, they should start with their own users! I think that they only want to stop inbound spam because that doesn't come from paying customers. Outbound spam, on the other hand, shouldn't be touched (in AOLs terms) because you wouldn't want to make a paying customer mad, would you? Well I scan all emails, both directions. It's a violation of our TOS to send spam and I want to stop it. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Andy Schmidt > Sent: Wednesday, December 17, 2003 10:18 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AOL and Reverse DNS > > Good point, they should be more accessible. That would be my biggest > complaint with most black-lists. > > As far as policies - as long as their policy is simply to follow RFCs (or > universally agreed recommendations, e.g. no open relays/proxies), I don't > see any obligation on their end to try to put everyone on notice. The > RFCs > were notice enough for years. > > SPAM from AOL accounts - hm, I have to admit that I only see an > (automatically selected) cross-section of spam messages with header (which > are routed to SPAMCOP for analysis) - but I can't remember seeing AOL as > an > implicated party often (if ever). > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue, Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.HM-Software.com/ > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd Holt > Sent: Wednesday, December 17, 2003 12:09 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AOL and Reverse DNS > > > >AOL is implementing the very same "checks" that we are using in > Declude. > This is true. > > >So what's the whining all about? > 1. AOL publishes a policy that they don't adhere to. > 2. The policy changes regularly. > 3. If we have a problem sending mail to them, they are unreachable. 4. > They > are pointing fingers at us "little guys" as the problem. How many spam > have > you received from an AOL account? > > I can only speak for myself, but none of those apply to me. > > Todd Holt > Xidix Technologies, Inc > Las Vegas, NV USA > www.xidix.com > 702.319.4349 > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Andy Schmidt > > Sent: Tuesday, December 16, 2003 10:40 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] AOL and Reverse DNS > > > > Exactly, Chuck. > > > > AOL is implementing the very same "checks" that we are using in > Declude. > > So > > what's the whining all about? I've been desperately waiting for years > for > > some of the big players to enforce standards (e.g., reverse DNS) and > > prudent practices (e.g., no open relays, mail servers on dynamic IPs > > have to > relay > > through their providers). I applaud AOL and hope Yahoo and Hotmail > follow > > suit soon. > > > > Then I can move the Reverse DNS failures and the Open Relay and DUL > RBLs > > from a carefully chosen weight to straight DELETE - and simply adopt > > "industry standards". > > > > If someone complains, I no longer have to "defend" to business > managers, > > why > > my servers are the "only" ones bouncing some moron's email - because > that > > point won't be made anymore. > > > > Even better, it will force wanna-be mail-admin's to either learn their > > trade or to get someone do to it right. Not every tinkerer who runs > > Windows NT/2000/XP workstation on their DSL or Cable modem at home > > needs to > run > > personal web services and turn on SMTP (ideal
RE: [Declude.JunkMail] AOL and Reverse DNS
>AOL is implementing the very same "checks" that we are using in Declude. This is true. >So what's the whining all about? 1. AOL publishes a policy that they don't adhere to. 2. The policy changes regularly. 3. If we have a problem sending mail to them, they are unreachable. 4. They are pointing fingers at us "little guys" as the problem. How many spam have you received from an AOL account? I can only speak for myself, but none of those apply to me. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Andy Schmidt > Sent: Tuesday, December 16, 2003 10:40 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AOL and Reverse DNS > > Exactly, Chuck. > > AOL is implementing the very same "checks" that we are using in Declude. > So > what's the whining all about? I've been desperately waiting for years for > some of the big players to enforce standards (e.g., reverse DNS) and > prudent > practices (e.g., no open relays, mail servers on dynamic IPs have to relay > through their providers). I applaud AOL and hope Yahoo and Hotmail follow > suit soon. > > Then I can move the Reverse DNS failures and the Open Relay and DUL RBLs > from a carefully chosen weight to straight DELETE - and simply adopt > "industry standards". > > If someone complains, I no longer have to "defend" to business managers, > why > my servers are the "only" ones bouncing some moron's email - because that > point won't be made anymore. > > Even better, it will force wanna-be mail-admin's to either learn their > trade > or to get someone do to it right. Not every tinkerer who runs Windows > NT/2000/XP workstation on their DSL or Cable modem at home needs to run > personal web services and turn on SMTP (ideally in open relay mode) - if > they do, they can do it for their own entertainment. But unless they do it > correctly (e.g., define a smart host), their mails won't be delivered to > the > outside world. Nothing wrong with that. > > Best Regards > Andy Schmidt > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick > Sent: Wednesday, December 17, 2003 12:07 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] AOL and Reverse DNS > > > I will disagree. I do not believe there is any comparison between MS EULA > and AOL mail policies. I do not see AOL's actions as the > "...internet-nazi-police tactics..." as you claim. I do not see where AOL > is gaining any competitive advantage, they are simply trying to protect > their network and client base the same as many of us. I have picked up > many > AOL customers for Internet access because they could no longer stand the > spam in their AOL mail accounts. > > I actually applaud AOL doing this - it will force many people to get a > reverse DNS entry and maybe they will fix their DNS record along the way. > If I block people because of Reverse DNS, the blocked entity will simply > criticize our policies. If AOL blocks them they will fix their rdns. > > If more mail servers had the MX records and reverse DNS entries, I could > tighten up my filtering because I would have less worries about blocking > legitimate mail from badly configured mail servers. > > I guess I do not see the problem - it is not much different than when most > ISPs started blocking Port 25 for access. Or implemented SMTP > Authentication. > > Just me 2 cents on the subject. > > Chuck Schick > -- Original Message -- > From: "Todd Holt" <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Tue, 16 Dec 2003 16:32:57 -0800 > > >I know this will stir a few people the wrong way, but. > > > >If so many people are upset that MS is being monopolistic by using > >their EULA to prevent software from operating, then why don't those > >same people get upset at AOL for the internet-nazi-police tactics used > >to prevent mail from being delivered? > > > >MS just says that you can't use certain apps on their OS. AOL says > >that you can't deliver mail through mail servers (that control more > >email than any other on the planet) because they deemed it "bad" > >through inaccurate, generalized and dare I say "monopolistic" policies. > > > >The lack of complaints about AOL just shows that the MS bashe
RE: [Declude.JunkMail] Does anyone not have Reverse DNS?
Jason, I think I have been convinced to push this issue with MPower. First I hope that John's contact can help me out, but I will also forward the RFC to them. Thanks for the debate! :) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] > Sent: Wednesday, December 17, 2003 6:35 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Does anyone not have Reverse DNS? > > Todd, thanks for the insight. > > >Jason, > >Many ISPs refuse (for one reason or another) to delegate RDNS. > > Instead of delegating the RDNS to you, would they make the changes for > you? > Say, give them a list of your IPs and what you would like the RDNS to be? > > I guess I'm very fortunate to have worked with competent, and cooperative > ISPs the past 5 years. I too had my servers once on SDSL. and in 2 > different colo facilities. All gave me RDNS the way I wanted it. (btw, all > the providers I used were great, I just moved a few times) > > >And a few times people on this list have set forth criteria that would > >classify us as unacceptable. Bundling us into the dynamic IP bunch > >because of our RNDS from MPower: > >las-DSL224-cust089.mpowercom.net > > That's just not fair, AND not worth your money. You should demand that > they > serve you the way you need to be! > > >The most common reason for this reasoning is that most admins consider > >"DSL" to be equal to "consumer". But there is such a thing as SDSL > >(symmetric DSL) at speeds > 2Mbit! A better hosting environment than > my > >T-1. > > ARgggH!! Agreed. Stupid admins! Is the world not full of too many of them > already? > > Thanks for chiming in with your thoughts. I think you need to pressure > your > provider to give you RDNS entries with your own domain name content, after > all you are a paying business-class customer. You might want to refer them > to the RFC that states RDNS is a good thing, your being lumped into > dynamic > block lists based on the contents of the existing RDNS name is a serious > operational issue, and AOL's policies for blocking email. > > --Jason > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does anyone not have Reverse DNS?
> In the meantime, why not relay your outbound mail through your ISP? Obviously you have never relayed your outbound mail through an ISP! If you had, you would not suggest that course of action. :) Currently, I have no problems. I hope that I can keep it this way! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Andy Schmidt > Sent: Tuesday, December 16, 2003 10:46 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Does anyone not have Reverse DNS? > > >> 1. ISPs are not accurately, clearly and fairly specifying RDNS entries. > They need to do a better job of this, but have little motivation to do > this. > << > > Well - I see your point and admit that there will be a painful time of > adjustment. > > But frankly, providers like yours will adopt their policies, when many of > their business customers suddenly have valid complaints that they are > unable > to send emails anymore. There is no need for them to DELEGATE DNS, but at > least they have to offer to adopt their Reverse DNS to your needs (e.g. > generic host entries for your domain). > > In the meantime, why not relay your outbound mail through your ISP? > > Best Regards > Andy Schmidt > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Todd Holt > Sent: Wednesday, December 17, 2003 01:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Does anyone not have Reverse DNS? > > > Jason, > Many ISPs refuse (for one reason or another) to delegate RDNS. > > For example, we have a T-1 from MPower in Las Vegas. It is business > class. > It has is a static block of 8 IPs. Normally considered by most as > acceptable to host a mail server. But Mpower refuses to delegate RDNS. > > And a few times people on this list have set forth criteria that would > classify us as unacceptable. Bundling us into the dynamic IP bunch > because > of our RNDS from MPower: las-DSL224-cust089.mpowercom.net > > The most common reason for this reasoning is that most admins consider > "DSL" > to be equal to "consumer". But there is such a thing as SDSL (symmetric > DSL) at speeds > 2Mbit! A better hosting environment than my T-1. > > In conclusion, I see two distinct problems here: > 1. ISPs are not accurately, clearly and fairly specifying RDNS entries. > They > need to do a better job of this, but have little motivation to do this. > > 2. Mail admins need to do a better job of creating criteria for mail > classification. Don't lump all DSL into spam source. Don't put a lot of > stock into what an RDNS says, just that it exists. I really appreciate > Pete > McNeil's unique approach in building a tool that looks for the same things > that I would look for by hand, in the content, not the context. I think > we > need more out of the box thinking like this. > > Todd Holt > Xidix Technologies, Inc > Las Vegas, NV USA > www.xidix.com > 702.319.4349 > > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] > > Sent: Tuesday, December 16, 2003 7:52 PM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] Does anyone not have Reverse DNS? > > > > I wanted to throw this question to the list: > > > > 1) Who does *NOT* have Reverse DNS (PTR) entries for their > mailservers? > > > > 2) If so, why not? > > > > Personally I think reverse DNS entries adds an ounce of ownership to > who > > actually uses an IP address. For instance, I have several IPs given to > me > > by my colo provider. I have reverse DNS on all of them, even the IPs I > > haven't used yet. If anyone looks my IPs up they will see something > like: > > Number.freedom2be.net as reverse DNS. This is basically telling them > that > > "freedom2be.net" is the operator of the IP address. > > > > 3) Shouldn't all mail servers on the internet have a reverse DNS entry > > with some valid "administrative" domain name? We use "freedom2be.net" > > exclusively for our reverse DNS entries. As our mail server is > multi-homed > > with many different domains. If someone needs to contact the > appropriate > > owner of the IP, say our mail server was doing something "bad" (which > it > > never has) they would know that &q
RE: [Declude.JunkMail] Does anyone not have Reverse DNS?
I have been told many times that MPower will create an RDNS entry, but only the using the standard format for all MPower RDNS entries (which is obviously inaccurate). I would love to have it changed to reflect our company name. Can you forward the name of your contact or have them contact me? Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Tuesday, December 16, 2003 10:43 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Does anyone not have Reverse DNS? > > Todd, by understanding at Mpower is they will not delegate, but will make > an > entry for you for what you need. If they are not allowing an entry for > you, > contact me off list as I have a contact at Mpower that may be able to look > into it. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Todd Holt > > Sent: Tuesday, December 16, 2003 10:33 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Does anyone not have Reverse DNS? > > > > Jason, > > Many ISPs refuse (for one reason or another) to delegate RDNS. > > > > For example, we have a T-1 from MPower in Las Vegas. It is business > > class. It has is a static block of 8 IPs. Normally considered by most > > as acceptable to host a mail server. But Mpower refuses to delegate > > RDNS. > > > > And a few times people on this list have set forth criteria that would > > classify us as unacceptable. Bundling us into the dynamic IP bunch > > because of our RNDS from MPower: > > las-DSL224-cust089.mpowercom.net > > > > The most common reason for this reasoning is that most admins consider > > "DSL" to be equal to "consumer". But there is such a thing as SDSL > > (symmetric DSL) at speeds > 2Mbit! A better hosting environment than my > > T-1. > > > > In conclusion, I see two distinct problems here: > > 1. ISPs are not accurately, clearly and fairly specifying RDNS entries. > > They need to do a better job of this, but have little motivation to do > > this. > > > > 2. Mail admins need to do a better job of creating criteria for mail > > classification. Don't lump all DSL into spam source. Don't put a lot > > of stock into what an RDNS says, just that it exists. I really > > appreciate Pete McNeil's unique approach in building a tool that looks > > for the same things that I would look for by hand, in the content, not > > the context. I think we need more out of the box thinking like this. > > > > Todd Holt > > Xidix Technologies, Inc > > Las Vegas, NV USA > > www.xidix.com > > 702.319.4349 > > > > > > > > > -Original Message- > > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > > [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] > > > Sent: Tuesday, December 16, 2003 7:52 PM > > > To: [EMAIL PROTECTED] > > > Subject: [Declude.JunkMail] Does anyone not have Reverse DNS? > > > > > > I wanted to throw this question to the list: > > > > > > 1) Who does *NOT* have Reverse DNS (PTR) entries for their > > mailservers? > > > > > > 2) If so, why not? > > > > > > Personally I think reverse DNS entries adds an ounce of ownership to > > who > > > actually uses an IP address. For instance, I have several IPs given to > > me > > > by my colo provider. I have reverse DNS on all of them, even the IPs I > > > haven't used yet. If anyone looks my IPs up they will see something > > like: > > > Number.freedom2be.net as reverse DNS. This is basically telling them > > that > > > "freedom2be.net" is the operator of the IP address. > > > > > > 3) Shouldn't all mail servers on the internet have a reverse DNS entry > > > with some valid "administrative" domain name? We use "freedom2be.net" > > > exclusively for our reverse DNS entries. As our mail server is > > multi-homed > > > with many different domains. If someone needs to contact the > > appropriate > > > owner of the IP, say our mail server was doing something "bad" (which > > it > > > never has) they would know that "freedom2be.net" is the domain to > > email. > > > (such as [
RE: [Declude.JunkMail] AOL and Reverse DNS
Not much comfort to those admins that are being blocked by AOL when their servers are setup correctly. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of DLAnalyzer Support > Sent: Tuesday, December 16, 2003 8:42 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] AOL and Reverse DNS > > Todd, > > I suspect no one has an issue with what AOL is doing is because we are so > close to the situation (i.e. we are all trying to block spam). > > Darrell > > > > > Todd Holt writes: > > > I know this will stir a few people the wrong way, but. > > > > If so many people are upset that MS is being monopolistic by using their > > EULA to prevent software from operating, then why don't those same > > people get upset at AOL for the internet-nazi-police tactics used to > > prevent mail from being delivered? > > > > MS just says that you can't use certain apps on their OS. AOL says that > > you can't deliver mail through mail servers (that control more email > > than any other on the planet) because they deemed it "bad" through > > inaccurate, generalized and dare I say "monopolistic" policies. > > > > The lack of complaints about AOL just shows that the MS bashers are not > > upset about the MS policies (or monopoly), they just want to complain > > about the big company on the block. I think if the majority owner of > > AOL was the richest person on the planet, they would bash AOL. How > > short sided!!! > > > > Further, all of the justice dept. proceedings are based on complaints by > > the competition, not the users. On the other hand, AOL has thousands of > > consumer complaints, but very few (if any) complaints by competitors. > > It's obvious that the justice dept. just wants to appease whiny losers > > like Jim Barksdale and Scott McNealy. And the MS bashers just fall in > > line. Lemmings. > > Todd Holt > > Xidix Technologies, Inc > > Las Vegas, NV USA > > www.xidix.com > > 702.319.4349 > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt > > Sent: Tuesday, December 16, 2003 3:26 PM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] AOL and Reverse DNS > > > > Hi, > > > > I just noticed that AOL has stepped up their policies another notch. > > > > They used to say that "AOL **MAY**" not accept email from servers > > without Reverse DNS. > > In the last two weeks, that changed: > > http://postmaster.aol.com/guidelines/standards.html > > > > * AOL's servers will not accept connections from unsecured > > systems. These include open relays, open proxies, open routers, or any > > other system that has been determined to be available for unauthorized > > use. > > * AOL's mail servers will not accept connections from systems that > > use dynamically assigned or residential IP addresses. > > * AOL will not deliver e-mail that contains a hex-encoded > > Universal Resource Locator (URL). (Ex: http://%6d%6e%3f/) > > * AOL's mail servers will reject connections from any IP address > > that does not have reverse DNS (a PTR record). > > > > > > Best Regards > > Andy Schmidt > > > > H&M Systems Software, Inc. > > 600 East Crescent Avenue, Suite 203 > > Upper Saddle River, NJ 07458-1846 > > > > Phone: +1 201 934-3414 x20 (Business) > > Fax:+1 201 934-9206 > > > > http://www.HM-Software.com/ > > > > > Check Out DLAnalyzer a comprehensive reporting tool for > Declude Junkmail Logs - http://www.dlanalyzer.com > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does anyone not have Reverse DNS?
Jason, Many ISPs refuse (for one reason or another) to delegate RDNS. For example, we have a T-1 from MPower in Las Vegas. It is business class. It has is a static block of 8 IPs. Normally considered by most as acceptable to host a mail server. But Mpower refuses to delegate RDNS. And a few times people on this list have set forth criteria that would classify us as unacceptable. Bundling us into the dynamic IP bunch because of our RNDS from MPower: las-DSL224-cust089.mpowercom.net The most common reason for this reasoning is that most admins consider "DSL" to be equal to "consumer". But there is such a thing as SDSL (symmetric DSL) at speeds > 2Mbit! A better hosting environment than my T-1. In conclusion, I see two distinct problems here: 1. ISPs are not accurately, clearly and fairly specifying RDNS entries. They need to do a better job of this, but have little motivation to do this. 2. Mail admins need to do a better job of creating criteria for mail classification. Don't lump all DSL into spam source. Don't put a lot of stock into what an RDNS says, just that it exists. I really appreciate Pete McNeil's unique approach in building a tool that looks for the same things that I would look for by hand, in the content, not the context. I think we need more out of the box thinking like this. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] > Sent: Tuesday, December 16, 2003 7:52 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Does anyone not have Reverse DNS? > > I wanted to throw this question to the list: > > 1) Who does *NOT* have Reverse DNS (PTR) entries for their mailservers? > > 2) If so, why not? > > Personally I think reverse DNS entries adds an ounce of ownership to who > actually uses an IP address. For instance, I have several IPs given to me > by my colo provider. I have reverse DNS on all of them, even the IPs I > haven't used yet. If anyone looks my IPs up they will see something like: > Number.freedom2be.net as reverse DNS. This is basically telling them that > "freedom2be.net" is the operator of the IP address. > > 3) Shouldn't all mail servers on the internet have a reverse DNS entry > with some valid "administrative" domain name? We use "freedom2be.net" > exclusively for our reverse DNS entries. As our mail server is multi-homed > with many different domains. If someone needs to contact the appropriate > owner of the IP, say our mail server was doing something "bad" (which it > never has) they would know that "freedom2be.net" is the domain to email. > (such as [EMAIL PROTECTED]) Isn't this a good idea? > > --Jason > [EMAIL PROTECTED] > > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RR.COM
I truly think they do this to keep the smaller players looking bad to their customers. "If you can't get mail to AOL, what kind of mail server are you running? Come to AOL where the mail always gets to AOL!" Now that is monopolistic! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Hosting Support > Sent: Tuesday, December 16, 2003 4:42 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] RR.COM > > AOL's official policy is just that reverse DNS has to exist, but we did > recently experience (about three weeks ago) them blocking mail from us if > reverse DNS didn't match the reported server name. > > Darin. > > > - Original Message - > From: "Matthew Bramble" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Tuesday, December 16, 2003 6:39 PM > Subject: Re: [Declude.JunkMail] RR.COM > > > Scott, > > Your HELO (nerosoft.com) doesn't match your reverse DNS domain > (mail.netbound.com). This could be the result of some idiot at AOL > rejecting your E-mail based on those things not matching. > > The switch should be easy enough to test out this theory. Try changing > your domain in IMail to netbound.com for just a second and see what > happens. The reverse DNS change just takes a bit longer to propagate, > though that might be a good idea to do for the long-term. Generally > speaking, reverse DNS is used for E-mail filtering and nothing else of > importance, so choose to match mail over all other things. > > Please let the list know if this works, though I'm just stabbing in the > dark of course. I've seen places as large as GM block on just reverse > DNS alone, which is pretty stupid in my book, and that warning from > AOL's HELO has been there for months at least, and shows that they have > at least considered this idiotic move. > > Matt > > > > Scott MacLean wrote: > > > Does anyone know how to expedite getting removed from > > AOL/Netscape/Compuserve's IP spam list? I have no idea how we got > > there, but they have been blocking mail from every domain on my server > > for almost two weeks now. I can guarantee we've never sent any spam > > their way, or any way, for that matter. Attempting to send email to > > any of those domains ends up with this result: > > > > 20031216 000133 127.0.0.1 SMTP (0384324F) Trying aol.com (0) > > 20031216 000133 127.0.0.1 SMTP (0384324F) Connect aol.com > > [205.188.156.154:25] (1) > > 20031216 000133 127.0.0.1 SMTP (0384324F) 554-(RLY:B2) The > > information presently available to AOL indicates this > > 20031216 000133 127.0.0.1 SMTP (0384324F) 554-server is > > transmitting unsolicited e-mail to AOL. Based on AOL's > > 20031216 000133 127.0.0.1 SMTP (0384324F) 554-Unsolicited Bulk > > E-mail policy at http://www.aol.com/info/bulkemail.html > > 20031216 000133 127.0.0.1 SMTP (0384324F) 554-AOL cannot accept > > further e-mail transactions from this server. > > 20031216 000133 127.0.0.1 SMTP (0384324F) 554-Please have your > > ISP/ASP or server admin call AOL at 1-888-212-5537, > > 20031216 000133 127.0.0.1 SMTP (0384324F) 554 or visit > > http://postmaster.info.aol.com <http://postmaster.info.aol.com/> for > > more information. > > 20031216 000133 127.0.0.1 SMTP (0384324F) SMTP_DELIV_FAILED > > > > They don't even give us a chance - we connect, and they dump us > instantly. > > > > Calling them at that number gives you not much more than a promise > > that "they'll look into it and get back to you", i.e. they won't > > bother and will never call you back. The postmaster web site doesn't > > help much. > > > > I'm at a bit of a loss. > > > > Hmmm. I just did a test from my mail server. I did a manual telnet to > > a few different AOL listed MX servers on port 25, and got this: > > > > 220-rly-ya02.mx.aol.com ESMTP mail_relay_in-ya2.4; Tue, 16 Dec 2003 > > 17:55:45 -0500 > > 220-America Online (AOL) and its affiliated companies do not > > 220- authorize the use of its proprietary computers and computer > > 220- networks to accept, transmit, or distribute unsolicited bulk > > 220- e-mail sent from the internet. Effective immediately: AOL > > 220- may no longer accept connections from IP addresses which > > 220 have no reverse-DNS (PTR record) assigned. > > > > I was able t
RE: [Declude.JunkMail] AOL and Reverse DNS
Title: Message I would agree with this type of governing body. One that sets standards like RDNS entries and what they mean. < pessimistic rant> But it is still up to each mail admin(s) to implement an anti-spam policy. And the history of governing bodies is such that only the biggest players have a voice. This would probably mean that AOL, Earthlink, RR, Hotmail, etc would be on the governing council…and it would be interpreted to their greatest competitive advantage…and nothing would have changed! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Hosting Support Sent: Tuesday, December 16, 2003 4:47 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] AOL and Reverse DNS This is exactly why I think we should have a some sort of global internet council for setting standards, rather than all of us little guys having to react, after the fact, whenever a large player makes a change. The global council could maintain a distribution list to help mail admins to keep up with proposed changes and implementation schedules. This is very similar to any other industry that must keep up with compliance standards. In some ways this also seems like an unfair competition tactic as it makes the little guys look bad when our customers can't send mail to AOL...it encourages customers to move to the large players to avoid not having mail delivered to their users. Darin. - Original Message - From: Todd Holt To: [EMAIL PROTECTED] Sent: Tuesday, December 16, 2003 7:32 PM Subject: RE: [Declude.JunkMail] AOL and Reverse DNS I know this will stir a few people the wrong way, but… If so many people are upset that MS is being monopolistic by using their EULA to prevent software from operating, then why don’t those same people get upset at AOL for the internet-nazi-police tactics used to prevent mail from being delivered? MS just says that you can’t use certain apps on their OS. AOL says that you can’t deliver mail through mail servers (that control more email than any other on the planet) because they deemed it “bad” through inaccurate, generalized and dare I say “monopolistic” policies. The lack of complaints about AOL just shows that the MS bashers are not upset about the MS policies (or monopoly), they just want to complain about the big company on the block. I think if the majority owner of AOL was the richest person on the planet, they would bash AOL. How short sided!!! Further, all of the justice dept. proceedings are based on complaints by the competition, not the users. On the other hand, AOL has thousands of consumer complaints, but very few (if any) complaints by competitors. It’s obvious that the justice dept. just wants to appease whiny losers like Jim Barksdale and Scott McNealy. And the MS bashers just fall in line. Lemmings. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, December 16, 2003 3:26 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] AOL and Reverse DNS Hi, I just noticed that AOL has stepped up their policies another notch. They used to say that "AOL **MAY**" not accept email from servers without Reverse DNS. In the last two weeks, that changed: http://postmaster.aol.com/guidelines/standards.html AOL's servers will not accept connections from unsecured systems. These include open relays, open proxies, open routers, or any other system that has been determined to be available for unauthorized use. AOL's mail servers will not accept connections from systems that use dynamically assigned or residential IP addresses. AOL will not deliver e-mail that contains a hex-encoded Universal Resource Locator (URL). (Ex: http://%6d%6e%3f/) AOL's mail servers will reject connections from any IP address that does not have reverse DNS (a PTR record). Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 http://www.HM-Software.com/
RE: [Declude.JunkMail] RR.COM
But only if its done accurately. And right now, the state of the RDNS entries is such that it can't be done accurately. This is due in large part to the ISPs not having proper RDNS entries (or having sweeping blocks of static and dynamic, business and consumer class IPs with the same RDNS entries). I would like to first see the ISPs start accurately coding the RDNS entries such that we can tell the businesses from the consumers. And I have no problem filtering on consumer connections running their own mail servers. Then I want the ISPs to crack down on their own customers that spam. Difficult thing to do!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Sheldon Koehler > Sent: Tuesday, December 16, 2003 4:26 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] RR.COM > > > Please let the list know if this works, though I'm just stabbing in the > > dark of course. I've seen places as large as GM block on just reverse > > DNS alone, which is pretty stupid in my book, and that warning from > > AOL's HELO has been there for months at least, and shows that they have > > at least considered this idiotic move. > > I would LOVE to see AOL start blocking on RDNS! If they do it, then we can > start doing it. Then within a few months, all of the legitimate mail > servers > on the planet will have proper RDNS and the Spammers will have a much > harder > time with life. Spam will decline a LOT!!! > > Sheldon > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > Ten Forward Communications 360-457-9023 > Nationwide access, neighborhood support! > > "Whenever you find yourself on the side of the majority, it's time > to pause and reflect." Mark Twain > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AOL and Reverse DNS
Title: Message I know this will stir a few people the wrong way, but… If so many people are upset that MS is being monopolistic by using their EULA to prevent software from operating, then why don’t those same people get upset at AOL for the internet-nazi-police tactics used to prevent mail from being delivered? MS just says that you can’t use certain apps on their OS. AOL says that you can’t deliver mail through mail servers (that control more email than any other on the planet) because they deemed it “bad” through inaccurate, generalized and dare I say “monopolistic” policies. The lack of complaints about AOL just shows that the MS bashers are not upset about the MS policies (or monopoly), they just want to complain about the big company on the block. I think if the majority owner of AOL was the richest person on the planet, they would bash AOL. How short sided!!! Further, all of the justice dept. proceedings are based on complaints by the competition, not the users. On the other hand, AOL has thousands of consumer complaints, but very few (if any) complaints by competitors. It’s obvious that the justice dept. just wants to appease whiny losers like Jim Barksdale and Scott McNealy. And the MS bashers just fall in line. Lemmings. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, December 16, 2003 3:26 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] AOL and Reverse DNS Hi, I just noticed that AOL has stepped up their policies another notch. They used to say that "AOL **MAY**" not accept email from servers without Reverse DNS. In the last two weeks, that changed: http://postmaster.aol.com/guidelines/standards.html AOL's servers will not accept connections from unsecured systems. These include open relays, open proxies, open routers, or any other system that has been determined to be available for unauthorized use. AOL's mail servers will not accept connections from systems that use dynamically assigned or residential IP addresses. AOL will not deliver e-mail that contains a hex-encoded Universal Resource Locator (URL). (Ex: http://%6d%6e%3f/) AOL's mail servers will reject connections from any IP address that does not have reverse DNS (a PTR record). Best Regards Andy Schmidt H&M Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 http://www.HM-Software.com/
RE: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges
I certainly DO NOT want the ISPs to block outbound port 25!! We have a number of mail customers that must send there outbound mail through the ISPs SMTP server. Now we rely on them to keep the SMTP server up and running, relaying in a timely manner, not adding footers to the email and providing customer service for outbound SMTP issues. Have you ever tried to call Earthlink, Sprint, SBC or PacBell about an SMTP issue?? The point fingers more than the telephone side does! I want the ISPs to be forced (by law) to shutdown users who send spam. But I don't see this happening any time soon. If it did, some spammer would probably sue the ISP for shutting him down after sending child pornography to pedophiles. I he would probably win. I have resigned myself to the fact that I must fight this battle myself (with a lot of help from my fellow mail admins) and not rely on the government for help. They don't want to get into the political mess this could cause. Thanks to the work of Scott, I have a great tool for this battle. And thanks to everyone else here, I have a place to educate myself on how to fight this battle. Fight the good fight, people!!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of David Daniels > Sent: Friday, December 12, 2003 11:10 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges > > If ISPs would block outbound port 25 that would go a long way towards > keeping spam. Right now most of our spam is coming from cable and DSL IPs. > We block outbound port 25 except from our mail servers and a couple of > customers who have a legitimate reason to use another mail server. If so > we > open a hole to that mail server only. It's done on a case by case basis. > Is > it a pain in the ass? Most certainly but if any spam leaves our network it > will be easy as hell to track. It really burns my ass to be spammed from > these networks because the provider is either too lazy or incompetent to > block these ports. > > David Daniels > Administrator > Starfish Internet Service > [EMAIL PROTECTED] > - Original Message - > From: "Burzin Sumariwalla" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, December 12, 2003 1:22 PM > Subject: OT: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges > > > > I agree with you. The statement was more general than it should have > > been. Personally I think the ISP route > > is one of the best places to begin active anti-spam measures at > (Sorry > > ISP admins). If legislatively, ISPs > > can be forced to have customers adhere to strict RFC compliance and if > > legislatively ISPs can be forced to take > > consistent and strict measures it might force spammers into smaller and > > smaller corners. > > > > I don't represent and ISP, so maybe I'm being to optimistic. > > > > > > Burzin > > > > > > > > At 10:59 AM 12/12/2003, you wrote: > > >The only people that will hit the spammers' pocketbooks are the ISPs > getting > > >together and forcing them out of their jobs... or to get people to stop > > >buying their stuff! > > > > -- > > Burzin Sumariwalla Phone: (314) 994-9411 x291 > > [EMAIL PROTECTED] Fax: (314) 997-7615 > >Pager: (314) 407-3345 > > > > Networking and Telecommunications Manager > > Information Technology Services > > St. Louis County Library District > > 1640 S. Lindbergh Blvd. > > St. Louis, MO 63131 > > > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges
<.02> The courts will see this as a "victimless" crime and give him a 2 month sentence, under house arrest, blah, blah, blah, ginger. Then companies can sue him in civil court for losses they can document... Can you document your monetary losses from SPAM from a specific source?? I know that I can't. That's what they count on. If they really wanted to stop SPAM they would, by making a mandatory 1 year in jail for conviction of sending a single piece of SPAM. That would make the punishment too great to risk committing the crime. Why do you think so many people break the speed limit? Not because they are unlikely to get caught, but if they do get caught, the punishment is only a small fine and traffic school (which you can now take at home in most states). The bottom line is that this is a political way to say they are doing something about the problem without spending a lot of money or effort on a problem they see as a nuisance. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Anderson > Sent: Thursday, December 11, 2003 4:15 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges > > > It's the "five years" that makes it a deterrent. Nobody cares about the > amount of the arbitrary fines for committing murder, either. > > > -Original Message- > > From: Todd Holt [mailto:[EMAIL PROTECTED] > > Sent: Thursday, December 11, 2003 4:56 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Virginia Indicts Two Men On > > Spam Charges > > > > I applaud there efforts, but... > > $2500 a piece will deter no one!!! > > > > > > > > http://www.washingtonpost.com/wp-dyn/articles/A56209-2003Dec11.html > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges
I applaud there efforts, but... $2500 a piece will deter no one!!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Frederick Samarelli > Sent: Thursday, December 11, 2003 3:27 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Virginia Indicts Two Men On Spam Charges > > http://www.washingtonpost.com/wp-dyn/articles/A56209-2003Dec11.html > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Web-o-Trust
That sounds reasonable.
You wrote of a process to compile a whitelist (implemented as negative
weight on a blacklist). Does this process "walk" to all of the includes
and their include, etc. to create the whitelist file?
Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
www.xidix.com
702.319.4349
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of R. Scott Perry
> Sent: Wednesday, December 10, 2003 3:00 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Web-o-Trust
>
>
> >How do the names get added to the list (or web-o-trust)?
>
> By getting someone to trust them.
>
> For example, we're asking that our customers let us know that they
have
> set
> up a WOT file, and we add them to our WOT file, which a lot of people
> already trust.
>
> >It appears that companies say, "I'm not a spammer, trust me!" What
> >keeps the spammers of the list?
>
> Several things.
>
> First is the limitations -- for example, if you trust us (that the IPs
we
> list and the WOT files that we list are all "good"), but have a
feeling
> that one of our customers may somehow include a spammer's WOT file,
you
> can
> use "include http://www.declude.com/web-o-trust.txt 2", which will
trust
> us
> (1) and our customers (2). But it will not trust IPs that our
customers
> trust.
>
> Second is "omit". If we find that somehow a spammer gets a WOT file
that
> our WOT file trusts, we can omit it ("omit
> http://www.spammer_domain.com/web-o-trust.txt ).
>
> But, it would be a real hassle for a spammer to do this -- they
typically
> have lots of compromised servers that they would need to list, and
would
> need to find someone to trust them. Even if they find someone to
trust
> them, they won't have any idea how many people are whitelisting them
> (since
> many people will use the limits). Then, once they are caught, they
will
> quickly be removed.
>
> Of course, only time will tell how effective it really turns out to
be. I
> think it has a lot of promise.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail
mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day
evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus
> (http://www.declude.com)]
---
[This E-mail scanned for viruses by Declude Virus (http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] Web-o-Trust
Pardon my jumping in this discussion late: How do the names get added to the list (or web-o-trust)? It appears that companies say, "I'm not a spammer, trust me!" What keeps the spammers of the list? The distributed nature of the management is what keeps the time commitment down, but at the same time minimizes the effectiveness. What am I missing here? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of andyb > Sent: Wednesday, December 10, 2003 2:36 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Web-o-Trust > > I think WOT could be very worth while for the 10-15 minutes it takes to > setup. > > - Original Message - > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 10, 2003 4:32 PM > Subject: Re: [Declude.JunkMail] Web-o-Trust > > > > > > >Scott, I looked into this several months ago, but at the time it did > not > > >seem to be getting much interest, and still doesn't appear to have much > of a > > >following (maybe 100 participants so far on their list). However, I am > > >willing to give it a go. Question, how do we use this with Declude > JunkMail > > >in its current form? > > > > Something else that is worth mentioning here is that there are a number > of > > IPs that will almost never send spam, but will be likely to get caught > as > > spam. For example, purchase confirmations from eBay, amazon, etc. have > a > > higher likelihood of getting caught than normal E-mail -- but their IPs > > just don't send out spam. All it takes is one person adding those IPs, > and > > without any work on the part of everyone else, they will be able to get > > mail from those IPs without a problem. > > > > FWIW, we are working on a Windows program to automatically crawl through > > WOT files and generate sorted IP blacklist files (along with comments > > showing where the IP came from), without having to figure out how to run > > Python that the collate program is written in. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > > Declude Virus: Catches known viruses and is the leader in mailserver > > vulnerability detection. > > Find out what you've been missing: Ask about our free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude virus hanging...
Thanks all for your help. I upgraded to 1.76i and the problem is solved. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Wednesday, December 03, 2003 11:02 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Declude virus hanging... > > Todd, is the production file called virus1.cfg? I don't know if that > would > cause any problems, but the default file name is just virus.cfg. What > version of Declude are you running. There was a problem with having more > than 5 or 6 BANNAME entries in the virus.cfg file. Scott release an > interim > update yesterday to resolve this. > > Bill > - Original Message - > From: "Todd Holt" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, December 03, 2003 10:45 PM > Subject: [Declude.JunkMail] Declude virus hanging... > > > > When I have Declude.Virus active it creates a .vir directory for each > > message, then never finishes the message, just leaves it hanging > > forever. When I turn off virus, messages flow properly. I have tried > > switching from f-prot to AVG with the same result. Virus.cfg attached. > > > > Any thoughts?? > > > > Todd Holt > > Xidix Technologies, Inc > > Las Vegas, NV USA > > www.xidix.com > > 702.319.4349 > > > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude virus hanging...
When I have Declude.Virus active it creates a .vir directory for each message, then never finishes the message, just leaves it hanging forever. When I turn off virus, messages flow properly. I have tried switching from f-prot to AVG with the same result. Virus.cfg attached. Any thoughts?? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 virus1.cfg Description: Binary data
RE: [Declude.JunkMail] Capital One
ROFLOL! :) Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of nick > Sent: Friday, November 21, 2003 11:48 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Capital One > > > John, > > If you would send your username & password we all can really confirm > if its real :)) > > > -Nick > -- Original Message -- > From: Matthew Bramble <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Fri, 21 Nov 2003 14:11:31 -0500 > > >John, > > > >I think that one is actually real :) the bfi01[dot]com link is actually > >a redirection for BigFoot Interactive which handles the mailings for > >CapitalOne. It goes to the real site. > > > >Matt > > > > > > > >John Tolmachoff (Lists) wrote: > > > >>Here is a "nice" deceptive one purporting to be from Capital One, even > going > >>so far as to tell you the from address will change periodically and the > site > >>may be down from time to time: > >> > >>--ABCD-TATH06CBF112C4836245D2E4AC5E7-EFGH > >>Content-Type: text/plain; charset=us-ascii > >>Content-Transfer-Encoding: quoted-printable > >> > >>Capital One(R)--what's in your wallet?(SM) > >> > >>* > >>Log in to see your Capital One statement > >>* = > >> > >> = > >> > >>RE: Your account ending in 4727 > >> > >>Your current Capital One statement is now available for viewing = > >> > >>online. Simply log in to Online Account Services at = > >> > >>http://capitalone.bfi0.com/TART0524EF6B34836245D2E4AC5E7 > >>and click the My Statement tab. > >> > >>While you're in Online Account Services, click on the Customer = > >> > >>Service Tab to . . . > >> = > >> > >>- Update your e-mail address = > >> > >>- Change your payment due date = > >> > >>- Change your password = > >> > >>- Request your PIN = > >> > >>- View your account terms = > >> > >>- View your online account history = > >> > >> > >>Is all your information reaching you? > >>** > >>To help ensure this time-sensitive message reaches your inbox = > >> > >>each month, add the Capital One address that appears in the = > >> > >>"From" line above to your electronic address book. This is = > >> > >>especially important if you or your service provider uses e-mail = > >> > >>filters. > >> > >>Pay your bill for free > >>*** > >>You can make payments safely and securely through Online Account = > >> > >>Services. Just click the Pay My Bill tab and complete the payment = > >> > >>profile. Online payments post the same day when they're made = > >> > >>before 3:00 p.m. ET Monday through Saturday.* > >> > >>Use our Web site as a resource to access a variety of consumer = > >> > >>lending products and special services. Please visit > >>http://capitalone.bfi0.com/TART0524EF8B24836245D2E4AC5E7 > >> > >>Thanks for using Capital One's Online Account Services. > >> > >>To log in, visit > >>http://capitalone.bfi0.com/TART0524EF4BD4836245D2E4AC5E7 > >> > >> > >>- > >>Important Information from Capital One > >> > >>The site may be unavailable during normal weekly maintenance or = > >> > >>due to unforeseen circumstances. = > >> > >> > >>*Your online payment posts the same day when it's made before = > >> > >>3:00 p.m. ET Monday through Saturday. Payments made after = > >> > >>3:00 p.m. ET Monday through Friday will post the following day. = > >> > >>Payments made after 3:00 p.m. ET on Saturday and anytime on = > >> > >>Sunday will post to your account on Monday. Payments will not be = > >> > >>posted on Thanksgiving, Christmas and New Years day. = > >> > >> > >>Capital One and its service providers are committed to providing
RE: [Declude.JunkMail] What next?
LOL! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Purtell > Sent: Thursday, November 13, 2003 11:32 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] What next? > > You could try my method; tell them you're a 92-year-old Korean woman! > > Keith Purtell, Web/Network Administrator > VantageMed Operations (Kansas City) > > CONFIDENTIALITY NOTICE: This email message, including any attachments, is > for the sole use of the > intended recipient(s) and may contain confidential and privileged > information. Any unauthorized > review, use, disclosure or distribution is prohibited. If you are not the > intended recipient, please > contact the sender by reply email and destroy all copies of the original > message. > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of John > > Tolmachoff > > (Lists) > > Sent: Thursday, November 13, 2003 1:00 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] What next? > > > > > > Sorry, I do not register for news sites. > > > > > > > > John Tolmachoff > > > > Engineer/Consultant/Owner > > > > eServices For You > > > > > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan > > Sent: Thursday, November 13, 2003 10:42 AM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] What next? > > > > > > > > http://www.washingtonpost.com/wp-dyn/articles/A36039-2003Nov13.html > > > > > > > > Just found this interesting... > > > > > > > > Kami > > > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: OE contacts to Outlook
Does anyone have a process to move Outlook Express 6.0 contacts and messages to Outlook 2000? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.JunkMail] Incoming email being blacklisted when not in the blacklist file not in the blacklist file
To clarify my understanding: If the entry contains an @ sign (domain only or full email address), the domain portion of the from address will be matched exactly. If the entry does NOT contain an @ sign, it will partial match anything in the from address (possibly even the mailbox name). Are these statements correct? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, November 11, 2003 10:16 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Incoming email being blacklisted when not > in the blacklist file not in the blacklist file > > > >Is there any way to define it as "ends with" logic? > > That type of filtering is only available in a filter file. The sender > blacklists work on a partial match or exact match only. > > >Are there any wildcard chars available for this? > > No. There are no wildcards anywhere in Declude JunkMail. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Incoming email being blacklisted when not in the blacklist file not in the blacklist file
Is there any way to define it as "ends with" logic? Are there any wildcard chars available for this? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, November 11, 2003 9:08 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Incoming email being blacklisted when not > in the blacklist file not in the blacklist file > > > >.de is what the problem was. I had a ton of spam coming from .de domains > so > >I put .de in my blacklist. I don't understand why .de would block > >[EMAIL PROTECTED] when this email ends with the domain .com. > > ".de" in a sender blacklist is the format for "If the E-mail address > contains '.de', block it". "[EMAIL PROTECTED]" contains ".de", so it gets > blocked. > > That allows people to do things like have "mettler" (which would block any > E-mail with "mettler" in it). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] JM log entry missing
Oh. Never thought of that. I found it in the virus log. It ha been quarantinedby virus. Thanks for the info. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Thursday, October 30, 2003 5:56 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] JM log entry missing > > > >Using LogLevel=MID, should there be at least one entry for each message > >that is received (except IMail killed messages)? > > Yes, there should (unless Declude Virus or Declude Hijack blocks the > E-mail). If you see an SMTP or SMTP- line in the IMail log file, you > should definitely see at least one entry in the Declude JunkMail log file > (at LOGLEVEL LOW or higher, unless you use LOG_OK NONE). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] JM log entry missing
Using LogLevel=MID, should there be at least one entry for each message that is received (except IMail killed messages)? If not, what would be the conditions to cause no entry in the log file for a particular message? Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sender blacklists
Thanks for the info. I think we will be upgrading to 8.x to take advantage of the wildcarded kill.lst. Thanks to everyone for their input. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Thursday, October 30, 2003 11:12 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Sender blacklists > > > >@abcdef.com will catch @.abcdef.com? > > No. It will only catch E-mail with "@abcdef.com" in the return address, > so > it will not catch "@.abcdef.com". > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sender blacklists
@abcdef.com will catch @.abcdef.com? It would seem to imply a wildcard between the @ and the rest of the domain name. Is that true? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Thursday, October 30, 2003 10:46 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Sender blacklists > > > >Can sender blacklists support wildcards? > > > >ie. @*.abcdef.com > > From Tuesday: > > > I don't believe any files (IMail Kill List or Declude JunkMail > blacklists) allow for wildcards. > > > In a Declude JunkMail "sender blacklist", you can use ".ps01.net" to > catch @*.ps0.net. > > In response, though, IMail v8's SMTP Kill File can use wildcards. > > Instead, you should use: > > .abcdef.com > > which will work exactly the same as what you show above. Or, you can use: > > .abcdef.com > @abcdef.com > > which will catch anything from the abcdef.com domain. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Sender blacklists
Can sender blacklists support wildcards? ie. @*.abcdef.com Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Terry Parks > Sent: Thursday, October 30, 2003 9:09 AM > To: Declude. JunkMail > Subject: [Declude.JunkMail] Earthlink, AOL, HOTMAIL > > Is anybody else having trouble with mail being returned from these > domains. > The returned email shows no consistent errors and well over half the time > only reports that mail was undeliverable. It's not consistent, and does > not > affect all addresses, but it is wide spread. > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: WinME not resolving DNS
Believe me, that is my first instinct also!! But I'm trying to do a favor for a good client and I don't want to insult him by telling him that his computer sucks! Even though it's the truth! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Wednesday, October 29, 2003 9:29 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: WinME not resolving DNS > > Best way to deal with this problem: > > Dump Windows ME. Run, don't walk. > > And this comes from a MCSE. > > (Sorry, could not resist.) > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: WinME not resolving DNS
No. But I thought that rebooting the machine flushed the DNS cache and I did reboot it. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Kris McElroy > Sent: Wednesday, October 29, 2003 9:00 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: WinME not resolving DNS > > have you tried from the command line ipconfig /flushdns > > > > > Thanks, > > > Kris McElroy > [EMAIL PROTECTED] > > Chief Technology Officer > Duracom, INC. > www.duracom.net > > "I am always doing that which I can not do, in order that I may learn how > to > do it." > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Todd Holt > Sent: Wednesday, October 29, 2003 10:43 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] OT: WinME not resolving DNS > > > I have a customer that has a home computer running WinME. Worked fine > connected to his cable modem. He moved the computer to another room and > I installed a Linksys Router/AP on the cable modem and a USB wireless > Ethernet on his computer. I can get connectivity and the DNS is listed > in WinIPCfg, but his machine will not resolve DNS. If I go to a web > server that I know the address of, I can browse that site just fine. > > Does anyone know why it won't resolve DNS queries? Are there any > specific configs I should check. > > Todd Holt > Xidix Technologies, Inc > Las Vegas, NV USA > www.xidix.com > 702.319.4349 > > > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: WinME not resolving DNS
I have a customer that has a home computer running WinME. Worked fine connected to his cable modem. He moved the computer to another room and I installed a Linksys Router/AP on the cable modem and a USB wireless Ethernet on his computer. I can get connectivity and the DNS is listed in WinIPCfg, but his machine will not resolve DNS. If I go to a web server that I know the address of, I can browse that site just fine. Does anyone know why it won't resolve DNS queries? Are there any specific configs I should check. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Wildcard kill list entries
Can the kill file contain wild card entries? For example: @*ps01.net Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Understanding Imail, junkmail, virus logs
Thanks for the info. Your always a wealth of information! :)
Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
www.xidix.com
702.319.4349
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of R. Scott Perry
> Sent: Tuesday, October 14, 2003 2:28 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Understanding Imail, junkmail, virus
logs
>
>
> >In the Imail logs:
> >- A single process ID represents all of the work for a single message
in
> >a single direction.
> >
> >- If a message is received from a remote server, the log lines for
that
> >message will reference a spool\D##.SMD file (an inbound
connection,
> >process=SMTPD).
> >
> >- If a message is received from a local authenticated user (for
example:
> >sending through Outlook), the log lines for that message will
reference
> >a spool\D##.SMD file (an inbound connection, process=SMTPD).
> >Subsequently, a separate set of log lines will reference a
> >spool\Q##.SMD file (an outbound connection, process=SMTP-) for
the
> >outbound connection to send that message to a remote server (if the
> >message is bound for a remote domain). The Q and D files for this
> >entire message will have the same file name other than the Q and D.
> >
> >- A message sent from a local user to another local user will only
have
> >a spool\D##.SMD file (an inbound connection, process=SMTPD).
>
> I believe this is all correct. Note that most of this refers just to
the
> logging -- for example, a Q*.SMD file and D*.SMD file will be used for
> both
> incoming and outgoing E-mail.
>
> >- To accurately count the number of messages processed, one only
needs
> >to count the inbound messages b/c any outbound messages must have
been
> >preceeded by an inbound message.
>
> "inbound" and "outbound" may cause confusion here (but technically
could
> be
> considered correct terms).
>
> Instead, I would say that you can accurately count the number of
messages
> processed by counting the "MAIL FROM:" SMTPD lines. You could instead
> count the "RCPT TO:" SMTPD lines to get the total number of
recipients.
>
> >In the Junkmail and Virus logs:
> >- The set of log lines representing work done on a single message
will
> >have the Q file specified (minus the .SMD) on each associated line.
> >This identifier is "mated" with the Imail log entry which references
the
> >D version of the same name.
>
> Correct. By taking the spool file name and removing the first
character
> and extension, you can find the E-mail in both the IMail and Declude
log
> files.
>
> >- All Junkmail/Virus processing is done on the inbound connection,
> >either from a remote server or the user client app (ie. Outlook). No
> >processing is done on the outbound connection; hence no D files are
> >specified.
>
> Correct.
>
> Note that the "D" file is the "data" file (which has a copy of the
E-mail
> in it, including headers), and the "Q" file is the "recipient" file
(which
> contains information about the recipients and other information that
IMail
> finds useful to save about the E-mail). They refer to an E-mail that
> IMail
> has already received via SMTPD ("inbound"), but not yet delivered via
> SMTP32 ("outbound").
>
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail
mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day
evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus
> (http://www.declude.com)]
---
[This E-mail scanned for viruses by Declude Virus (http://www.declude.com)]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
[Declude.JunkMail] Understanding Imail, junkmail, virus logs
Regarding the relationships between Imail logs, Junkmail logs and Virus logs: In the Imail logs: - A single process ID represents all of the work for a single message in a single direction. - If a message is received from a remote server, the log lines for that message will reference a spool\D##.SMD file (an inbound connection, process=SMTPD). - If a message is received from a local authenticated user (for example: sending through Outlook), the log lines for that message will reference a spool\D##.SMD file (an inbound connection, process=SMTPD). Subsequently, a separate set of log lines will reference a spool\Q##.SMD file (an outbound connection, process=SMTP-) for the outbound connection to send that message to a remote server (if the message is bound for a remote domain). The Q and D files for this entire message will have the same file name other than the Q and D. - A message sent from a local user to another local user will only have a spool\D##.SMD file (an inbound connection, process=SMTPD). - To accurately count the number of messages processed, one only needs to count the inbound messages b/c any outbound messages must have been preceeded by an inbound message. In the Junkmail and Virus logs: - The set of log lines representing work done on a single message will have the Q file specified (minus the .SMD) on each associated line. This identifier is "mated" with the Imail log entry which references the D version of the same name. - All Junkmail/Virus processing is done on the inbound connection, either from a remote server or the user client app (ie. Outlook). No processing is done on the outbound connection; hence no D files are specified. --- I wrote this as a number of statements that indicate my understanding. Please comment on any incorrect statements. Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, October 14, 2003 11:03 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Understanding Imail logs document > > > >A link to this was posted recently. Can someone please repost the link? > > It's http://www.declude.com/info/logs.htm . > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Understanding Imail logs document
A link to this was posted recently. Can someone please repost the link? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Dictionary attacks --- anyone have any solutions.
Yes. Soil-tech.com is a local domain that we host and Tony is a valid user on that domain. It almost appears that Imail is seeing his OutlookExpress as a mail server, not a authenticated mail client. Any other suggestions? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Saturday, October 11, 2003 5:37 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Dictionary attacks --- anyone have any > solutions. > > > >I have a customer using Outlook Express 6 and each message he sends > >fails the HELOBOGUS test as shown below: > > > >10/10/2003 14:45:30 Q28770c310140cd76 Msg failed HELOBOGUS (Domain TONY > >has no MX or A records.). Action=HEADER. > >10/10/2003 14:45:30 Q28770c310140cd76 From: [EMAIL PROTECTED] To: > >[EMAIL PROTECTED] IP: 24.234.126.165 ID: > > > >What would cause this? > > Is "soil-tech.com" a local domain? If not, the sender needs to use a > valid > host name in the HELO/EHLO data that it sends. "TONY" is not a valid > Internet host name. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reading junkmail log files
Is there white paper on reading the junkmail log files? Like the one that someone created on reading IMail logs. Thanks, Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Dictionary attacks --- anyone have any solutions.
I have a customer using Outlook Express 6 and each message he sends fails the HELOBOGUS test as shown below: 10/10/2003 14:45:30 Q28770c310140cd76 HELOBOGUS:6 . Total weight = 6 10/10/2003 14:45:30 Q28770c310140cd76 Msg failed HELOBOGUS (Domain TONY has no MX or A records.). Action=HEADER. 10/10/2003 14:45:30 Q28770c310140cd76 Msg failed WEIGHTHEADER (Weight of 6 reaches or exceeds the limit of 1.). Action=IGNORE. 10/10/2003 14:45:30 Q28770c310140cd76 L1 Message OK 10/10/2003 14:45:30 Q28770c310140cd76 Subject: test from tony 10/10/2003 14:45:30 Q28770c310140cd76 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 24.234.126.165 ID: What would cause this? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Message Sniifer
See http://www.mail-archive.com/declude.junkmail%40declude.com/msg11972.html Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Wesley M > Sent: Thursday, October 09, 2003 4:55 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Message Sniifer > > Does anyone know how effective the Message Sniffer plug-in for Declude > is? > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: google.com not returning correctly
Thank you to everyone that pointed me in the right direction. It was the Trojan.QHosts virus. The McAfee removal instructions took care of the problem. Thanks again for everyone's help. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Robert Grosshandler > Sent: Thursday, October 09, 2003 9:38 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] OT: google.com not returning correctly > > Todd Holt wrote: > > >I have a customer that has 2 computers behind a d-link router > >implementing NAT. One computer works fine and can goto www.google.com > >just fine. The other computer, however, cannot. > > > > This can be caused by a virus modifying the HOSTS file, and adding an > entry for google, etc. Edit the hosts file to remove any reference to > sites that don't seem to be working. Usually, the only entry is > 'localhost', but you may have legitimate network specific changes. > > Also - Kazaa Lite modifies HOSTS files. > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: google.com not returning correctly
I have a customer that has 2 computers behind a d-link router implementing NAT. One computer works fine and can goto www.google.com just fine. The other computer, however, cannot. The computer that works correctly returns 216.239.57.99 for google. The other computer returns 207.44.194.56. This appears to be the default page for unknown sites on a web server. I have scanned the system with spybot (removed 10 bad things), delete all IE temp files, deleted IE history, did an ipconfig /flushdns, rebooted. All to no avail. This is the only machine doing this and both machines are using the same DNS servers through the same router. This problem also appears when trying to use www.altavista.com, but www.yahoo.com, www.lycos.com seem fine. Has anyone seen this before? Could this be a virus, spyware, etc? Thanks in advance for any help. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MS Customer Assistance SPAM
I know that most admins are looking for no/low cost spam protection, but I have to say that sniffer (at $300/yr) is the single best investment (except for the requisite Declude, of course) to detect spam. And I find it's most accurate on sporn. We obviously use the other detection methods such as RBLs, but our reliance on them is reduced. Lately I've heard a number of admin complain that their spam has increased with the elimination of some RBLs, but our spam rates have remained fairly static. I think its because sniffer detects most of the spam and the RBLs are used to confirm spam (not detect it to begin with). For the time it saves me in admin, I can generate much more than $300/yr in additional revenue using that saved time!! You really owe it to yourself to look at www.sortmonster.com/messagesniffer. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Bridges, Samantha > Sent: Wednesday, October 08, 2003 12:15 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] MS Customer Assistance SPAM > > Hello > > Any ideas how to block the spam message from MS Customer Assistance? I > keep getting it and want to stop it! Aarrrgghhh. > > Also, I have noticed an increase in the amount of spam getting through. > In particular, more and more sporno (porn). Is this because of the spam > domains being attacked by spammers? Or, why is more and more spam > getting in? > > Thanks > > Samantha > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hurah!
Don't worry, with the politics of the situation and the money to be made, it will return. Just wait. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Monday, October 06, 2003 11:20 AM > To: '[EMAIL PROTECTED]' > Subject: RE: [Declude.JunkMail] Hurah! > > Ok, Joshie, I'll bite. You received a NXDOMAIN response when querying for > a > .com TLD, which means... > > Verisign is no longer hijacking, I mean wildcarding, all non-existent .com > and .net domains to 64.94.110.11 > > The VERISCAM test is now useless. > > -Original Message- > From: Joshua Levitsky [mailto:[EMAIL PROTECTED] > Sent: Saturday, October 04, 2003 5:53 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Hurah! > > > Anyone notice what is so wonderful about the query below? > > > ; <<>> DiG 9.2.2 <<>> skjsakjsajkas.com > ;; global options: printcmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 29043 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 > > ;; QUESTION SECTION: > ;skjsakjsajkas.com. IN A > > ;; AUTHORITY SECTION: > com.10800 IN SOA a.gtld-servers.net. > nstld.verisign-grs.com. 2003100400 1800 900 604800 86400 > > > -- > Joshua Levitsky, CISSP, MCSE > System Engineer > AOL Time Warner > [5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Happy days are here again...
So, ICANN comes up with a figure that is equal to the cost of maintaining the internet for a year and each registrar pays a percentage of that figure based on the percentage of all registrations that they manage? If this is true, then… The wildcard in effect makes them customers of the registrant…by registering each of the 40,000,000,000+ domains. This would make the total number of registered of domains increase to a staggering number. And VeriSlime would be managing 99.9…% of those domains. They would effectively pay the entire bill for running the internet! I like it!!! J But…another question… Why should we pay a fixed amount each year to the registrants if they don’t pay a fixed amount? This sounds pretty hokey to me! (No offense to VTech fans!) I thought that a fixed amount of our payments were going to the internet infrastructure improvements. Silly me! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Friday, October 03, 2003 3:28 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Happy days are here again... ICANN is just there to oversee the workings of the industry and they're not in it for profit. They charge registrars a fee based on the percentage of the number of registrations they are responsible for, and the total collected from all registrars is a number related only to organizational costs. VeriSign pays something like and additional $250,000 a year to ICANN for maintaining the .com and .net registries, however they collect $6 for each .com and .net domain name registered for their operating costs (and profit). While technically they pay themselves this $6 figure for registrations, it is only on paper for accounting purposes and no money changes hands (assuming that they track the transactions). Matt Todd Holt wrote: So they don't have to pay for all registrations? I don't understandthis. Todd HoltXidix Technologies, IncLas Vegas, NV USAwww.xidix.com702.319.4349 -Original Message-From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-[EMAIL PROTECTED]] On Behalf Of Matthew BrambleSent: Friday, October 03, 2003 2:54 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] Happy days are here again... Todd Holt wrote: IMHO, ICANN should send a bill to VeriSlime for the registration of all combinations which could be caught by the wildcard. Does anyone knowthe maximum length of a domain name, how many different characters can be used in a domain name (a-z,A-Z,0-9,_,-,...), how many .com and .net domain names are currently registered and how much VeriSlime pays foreach domain registration? I believe that since something like 256 characters are now allowed indomain names, 64 different standard characters allowed, and since there are around 40 million .com and .net addresses currently registered, that would equate to (2 x 64^256) - 40,000,000, or approximately... 270,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0,000,000,000,000,000,,000,000,000,000,000,000,000,000,000,000,000,000,000 ,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,0 00,000,000,000,000,000,000,000,000,000,000,000,000,000 This doesn't include the high-bit characters though :) BTW, payments to ICANN are only proportional to total registrations, and totals less than $3 million a year across 100% of registrations. So in effect, this would cost them little extra if they were to be charged. Matt
RE: [Declude.JunkMail] Happy days are here again...
So they don't have to pay for all registrations? I don't understand this. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Matthew Bramble > Sent: Friday, October 03, 2003 2:54 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Happy days are here again... > > Todd Holt wrote: > > >IMHO, ICANN should send a bill to VeriSlime for the registration of all > >combinations which could be caught by the wildcard. Does anyone know > >the maximum length of a domain name, how many different characters can > >be used in a domain name (a-z,A-Z,0-9,_,-,...), how many .com and .net > >domain names are currently registered and how much VeriSlime pays for > >each domain registration? > > > > I believe that since something like 256 characters are now allowed in > domain names, 64 different standard characters allowed, and since there > are around 40 million .com and .net addresses currently registered, that > would equate to (2 x 64^256) - 40,000,000, or approximately... > > 270,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 00 > 0,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0, > 000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 00 > 0,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0, > 000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 00 > 0,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,00 0, > 000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 00 > 0,000,000,000,000,000,,000,000,000,000,000,000,000,000,000,000,000,000,0 00 > ,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 ,0 > 00,000,000,000,000,000,000,000,000,000,000,000,000,000 > > This doesn't include the high-bit characters though :) > > BTW, payments to ICANN are only proportional to total registrations, and > totals less than $3 million a year across 100% of registrations. So in > effect, this would cost them little extra if they were to be charged. > > Matt > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Happy days are here again...
VeriSlime: ICANN is using anecdotal and isolated issues to attempt to regulate non-registry services, but in the interests of further working with the technical community we will temporarily suspend Site Finder." Joe user: If VereSlime had an email address that every user with a problem could send issues to, then you would see that its not isolated. VeriSlime: Launched September 15, Site Finder provides useful tools for Internet users who mistype a domain name or attempt to connect to a web site that doesn't exist. Joe user: Thanks, but no thanks. Are you also going to help all of the phone companies to create an auto-attendant to help me find the actual number that I am calling when I dial the wrong number, so that I won't get that annoying message? Are you also going to help the USPS to create a method of finding the actual address for my letter when I mis-address it, to prevent the letter from being returned to me? Now those would be useful!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Bill Landry > Sent: Friday, October 03, 2003 1:05 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Happy days are here again... > > And the beat goes on...: > > http://biz.yahoo.com/prnews/031003/sff057_1.html > > Bill > - Original Message - > From: "Joshua Levitsky" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, October 03, 2003 12:12 PM > Subject: [Declude.JunkMail] Happy days are here again... > > > > I could not be happier... > > > > http://www.icann.org/correspondence/twomey-to-lewis-03oct03.htm > > > > > > -- > > Joshua Levitsky, CISSP, MCSE > > System Engineer > > AOL Time Warner > > [5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Happy days are here again...
It's about time! IMHO, ICANN should send a bill to VeriSlime for the registration of all combinations which could be caught by the wildcard. Does anyone know the maximum length of a domain name, how many different characters can be used in a domain name (a-z,A-Z,0-9,_,-,...), how many .com and .net domain names are currently registered and how much VeriSlime pays for each domain registration? This could be enough money to pay for the all of the proposed expansions, redesigns, etc, that are on the drawing board!!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Joshua Levitsky > Sent: Friday, October 03, 2003 12:12 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Happy days are here again... > > I could not be happier... > > http://www.icann.org/correspondence/twomey-to-lewis-03oct03.htm > > > -- > Joshua Levitsky, CISSP, MCSE > System Engineer > AOL Time Warner > [5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Interim release to detect wildcard DNS entries (aka VERISCAM)
Where can I download the interim release? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Thursday, September 18, 2003 1:42 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Interim release to detect wildcard DNS entries > (aka VERISCAM) > > We have just come out with an interim release (v1.75i8) that will detect > the wildcard A records from all TLDs that use them. This works > automatically with the MAILFROM and HELOBOGUS tests, without any > configuration changes needed. > > However, the latest interim release includes an experimental new feature > in > Declude Virus, that will automatically look up virus names to see if they > are forging viruses. This will send the name of the virus and the IP > address that sent it to our servers as part of the lookup. If you do not > feel comfortable with this information being sent, you can add a line > "AUTOFORGE OFF" to your virus.cfg file. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Some good info on the Verislime coup
Just another example of what happens when basic infrastructure is privatized! I'm not a bleeding heart liberal proponent of government controlling everything, but I do believe that certain infrastructure components need to be controlled by a disinterested third party (or less interested) that can be controlled by the "will of the people" to some degree (by voting). This problem is similar to the deregulation of electricity. Now many parts of the country pay more for electricity than before. And what happens if some "bonehead" company takes over a huge section of the grid, then goes bankrupt? We now have absolutely no control over the internet! Be careful of what you wish for, because you just may get it! Another interesting note from the article, how about this hypothetical situation: One of my users sends a message to his mother telling her that he just found out that he tested positive for AIDS. Not wanting his employer to know because of fears of discrimination. And expecting that only his mother will read the message. In that message, he accidentally misspells the domain name in his mothers address. This message now gets sent to Verislime's SMTP relay server, the content saved and the message discarded. Next, the content is sold to a researcher who contacts the original users employer asking for medical history on the "person with AIDS". Now the employer knows, the discrimination occurs. Does that user have a right to sue me as the email provider for not insuring his privacy? Tell me the lawyers won't have a field day with that. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Sheldon Koehler > Sent: Thursday, September 18, 2003 9:33 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Some good info on the Verislime coup > > > http://homepages.tesco.net./~J.deBoynePollard/FGA/verisign-internet- > coup.html > > > Sheldon > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > Ten Forward Communications 360-457-9023 > Nationwide access, neighborhood support! > > "Whenever you find yourself on the side of the majority, it's time > to pause and reflect." Mark Twain > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries
Joshua makes a great case for how to adjust the weighting system. However, I think the initial test assumptions are flawed. Case in point: As Joshua corrected noted, our RDNS is las-DSL224-cust088.mpowercom.net. However, we are on a T-1 line from MPower. Now I agree that MPower is to blame for incorrectly specifying (IMHO) the RDNS entry. Nonetheless, I am powerless (as much as I have tried) to get MPower to change this policy/procedure. The result is that your test is throwing points towards me for being a DSL connection and I’m not even connecting with DSL! I wish, as much as everyone else, that the RDNS entries were more accurate, but they aren’t. And they cannot be trusted to give the information your seeking from them. This is the same discussion we had when AOL started filtering on DSL connections. I think the test is likely to produce sporadic (hopefully very few), but important false positives. I hope no one is deleting messages that contain points from this test. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky Sent: Wednesday, September 17, 2003 5:02 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries On Sep 17, 2003, at 7:31 PM, Todd Holt wrote: 1. Can this filter distinguish between ADSL and SDSL? If not, is this acceptable? 2. Is the filter doing this? 3. Are there any unique instructions for doing this 88.224.57.208.in-addr.arpa. 604800 IN PTR las-DSL224-cust088.mpowercom.net In the case of your mail.xidix.com, you would not fail that test because they made your PTR have DSL224- rather than -224- where it would have failed. I don't know if this was on purpose in Matthew's filter or not. I do see benefit in giving some points to a PTR like yours just like I throw points at CHINA or BRAZIL when I actually do get legit mail from Brazil, but I find my legit Brazil email doesn't get enough points to be blocked, and sometimes throwing some points at Brazil can help to catch spam that would not be otherwise. By the same token I would not block DSL like yours, but I would give a couple of points simply to make the other tests more sensitive because then it would take less for you to hit my threshold. I have plenty of mail that has 5 or 6 points and is perfectly legit, and that's fine as long as legit mail doesn't get 50 or 60 points. -Josh
RE: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries
I hate to open up old wounds, but…going back to the AOL filtering issue… I would agree that the few (very few) number of legitimate mail servers connecting with cable modem or consumer DSL are acceptable false positives when filtered out as SPAM sources. But one must consider that many legitimate mail servers are operated over business class DSL connections. I used an SDSL (768k) connection for 2 years very successfully. The key difference here is between consumer DSL (ADSL) and business DSL (SDSL). If a filter cannot distinguish between ADSL and SDSL then the false positive rate (IMHO) is too high as it will lump all of the SDSL connections in with the SPAM sources. Can this filter distinguish between ADSL and SDSL? If not, is this acceptable? Is the filter doing this? Are there any unique instructions for doing this? Any thoughts? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Wednesday, September 17, 2003 3:54 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries Ok, I've been testing this one for about a week with very positive results. It's still a work in progress as far as exclusions go (candidates welcome), but I have been using it with a good deal of success as is for the past week. The filter is called DYNAMIC and it can be downloaded at the following location: http://www.mailpure.com/decludefilters/dynamic/Dynamic_09-17-2003.txt (Links to the most recent versions of the filters that I have been testing are located at the bottom of this message. I will put up some HTML soon to help enable the process since I have noted a few people downloading older versions from older postings to this group) What the DYNAMIC filter does is detect E-mail from a sender with a reverse DNS lookup that has the tell-tale marks of being used for dial-up, DSL or cable broadband access. I have found it to be very useful in scoring spam and it has a good impact on messages that don't fail many tests without being responsible for rejecting messages due to false positives. As an extra added bonus, the use of the WHITELIST AUTH functionality that Scott announced yesterday is beneficial to this filter's use (explained in the file). The method is a little controversial because it doesn't look for direct signs of spam such as OBFUSCATION, GIBBERISH or GIBBERISHSUB, but instead looks at where the message is coming from, knowing that dial-up, DSL and cable broadband address space is becoming increasingly problematic for spam origination, maybe due to recent virus outbreaks installing SMTP servers or backdoors on always-on connected machines. There are plenty of examples where such space though hosts legitimate mail servers without customized reverse DNS, typically being business users. Declude's own servers should trip this test if not whitelisted. Therefore the scoring is low, however in a recent thorough test of over 1,000 filter hits (excluding Declude of course), the false positive rate was still only 2.0% of filter hits and nothing failed because of this test alone. Unlike the other filters that I have recently been testing, this one doesn't tend to catch opt-in advertising, just small-busuness false positives that have mostly properly configured machines that score very low, so adding a few points to some of them is of no real harm. This test also often crosses over into DUL territory, especially the less than pure EASYNET-DYNA blocklist. Because of that, one should be careful to adjust the scores so that a double hit won't fail a message alone. I also use SORBS-DUL which seems remarkably pure to the idea of being dynamic addresses where mail servers aren't allowed to be hosted on, so I don't feel there is any danger in having that test as a part of the mix. Please see the detailed comments in the filter file for more information on configuration. For those statistically inclined, I did a painstaking review on 2 days of traffic in order to get an impression on exactly what the impact was: DYNAMIC FILTER STATISTICS == 5,530 - Unique Incoming Messages 4,183 - Messages Rejected as Spam from All Filters (75.6% of Unique Incoming Messages, approximate) 1,053 - Filter Hits (19% of Unique Incoming Messages) == 1,032 - Positives (98.0% of Filter Hits) 21 - False Positives (2.0% of Filter Hits) = 70 - Hits That Made a Difference* (6.6% of Filter Hits) 23 - Spams Failed or at Least Scored Because of Filter (2.2% of Filter Hits) 0 - False Positives Failed Because of the Additio
RE: [Declude.JunkMail] A slight increase in spam not getting caught thanks to Network Solutions
Any more than they already have?? Its not a stupid move at all (if you NetSol). The make all of their money on the ignorance of newbies that just don't know any better. Once people realize what lyin', cheatin', stealin' scum they are...you get the idea. Do all of the unregistered domains resolve to this range: 64.94.110.x??? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Keith Anderson > Sent: Monday, September 15, 2003 4:40 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] A slight increase in spam not getting > caught thanks to Network Solutions > > > Seems like the easiest solution is to block all email from domains that > resolve to 64.94.110.x The question is, how do we do this? (I'm still > learning... sorry if this is a stupid question.) > > NS is going to make a lot of enemies doing this. > > > Just so people are aware, Network Solutions just hours ago > > made the dumb > > move of making all unregistered domains point to their web > > site. As a > > result, very little E-mail will fail the MAILFROM test in > > Declude JunkMail > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email addresses on a company webpage?
With all this talk of email addresses on web pages... What is the best way to obfuscate them? HTML (how is this done?)? Java (how is this done?)? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Sean Fahey > Sent: Monday, September 15, 2003 11:49 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Email addresses on a company webpage? > > We're not a very big company - about 35 employees. > > I created an account for a new employee who wasn't due to start for 5 days > and added his e-mail address to the company directory on our web site. In > keeping with the corporate policy, the directory > listings are not obfuscated (please don't ask why, it's lame). By the time > the employee started and was in orientation with me to go over company > applications the following week, he had already recv'd 9 spam messages > (with > many more blocked by Declude). So, conveniently it was a good time to go > over Outlook's filters capabilities too. > > Spams for Viagra and it's ilk have become the most annoying, most frequent > complaint - even over the porn, beastiality, and Nigerian money scams. > > Anyway, enough of that tangent - the point is, bot traffic to our dinky > lil > ol' site is constant and we are harvested frequently. If you post your > contacts, consider if they really have to be hot mailto tags, or could > they > at least be obfuscated. > > Just my 2 cents. > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan Spangenberg > Sent: Monday, September 15, 2003 1:17 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Email addresses on a company webpage? > > > I've been reading the recent threads and someone mentioned it a bad idea > to post employee email addresses on their company webpage because of > spammers or bots harvesting them. > Isn't this a little bit paranoid or am I just naive? Isn't it a pretty > common practice for a company to list emails addresses on their webpage, > at least for sales and service individuals? I see many smaller companies > doing this. Maybe they just take the risk and manage the spam when it > comes in, or change specific addresses if the spam gets too bad. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: National Do Not Call Registry
When will the government listen to the "will of the people" and just outlaw spam and tele-marketing (with severe enough penalties to deter)? Ooops. I'm sorry. I had brain fart. I wasn't thinking that the lobbyists for keeping spam and tele-marketing around have deeper pockets than the poor users. Combined with the golden rule of capitalism: "He who has the gold makes the rules.", results in what we have today. I think that the do not call list will result in a new call list worth $$MM. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Dan Patnode > Sent: Friday, June 27, 2003 6:37 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] OT: National Do Not Call Registry > > More info and stats: > > > http://www.bankrate.com/brm/news/advice/20030627a1.asp > > The Federal Trade Commission says more than 1,000 people per second are > trying to register either online or by phone. > > In an ironic twist, a technology consulting firm discovered that spam > filters, specifically Yahoo's and perhaps others, are blocking many of the > confirmation e-mails consumers are supposed to receive to complete their > online registration. > > > > > > > On Friday, June 27, 2003 12:49, Dan Patnode <[EMAIL PROTECTED]> wrote: > >Stops the telemarketers (with some exceptions), debuted this > >morning: > > > >http://donotcall.gov/ > > > > > > > >More junk stopping info: > > > >http://www.obviously.com/junkmail/ > > > >--- > >[This E-mail was scanned for viruses by Declude Virus > >(http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: The Titian Key Product to Remove Spam.. patent pending?
But wait, there’s more!!! If you order today, we will include absolutely free…the amazing Ginzu SPAM knife. It never needs sharpening and can slice the fat off your SPAM messages just as easy as that! It slices…it dices…it even makes julienne fries!! Blah, blah, blah Ginger… -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Eddie Pang Sent: Friday, June 06, 2003 3:09 AM To: Declude. [EMAIL PROTECTED] com Subject: [Declude.JunkMail] OT: The Titian Key Product to Remove Spam.. patent pending? FWIW.. Looks like a variation of a mail gateway at a cost of $1000.00 per month! http://www.titankey.com/features.asp eddie :)
RE: [Declude.JunkMail] Catching SPAM when the sender = recipient
Have these people never heard of the "sent items" folder? I know people do this a lot, but it is not necessary (IMHO) and generates extra mail traffic. We have tried very hard to teach our people to use the "sent items" so we don't have a huge problem with marking these as spam. <$.02> This method of getting copies of something they have sent falls under the category: "Just because you can doesn't mean you should." In addition, many people are more inclined to open something that is from themselves (whether they recognize sending it or not!) and it becomes a delivery system for virus' and the like. I look forward to being able to stop it. Thanks, Todd -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of John Tolmachoff Sent: Friday, October 25, 2002 10:06 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Catching SPAM when the sender = recipient >Be careful if you do this... > >A lot of people actually send messages to others as BCC and then put >themselves in To in order to make sure it has gone out. > >We see a lot of that. I too see that. One of our largest clients will often send out excess inventory lists to several people. As those people are competitors to each other, they will include them as BCC and them selves as the TO. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Catching SPAM when the sender = recipient
I have noticed that many spammers in recent months have begun to use the recipients email as the senders email. Can this be trapped by the current tests or should I request a new test to cover this? The only legitimate mail that would pass this test would be users sending mail to themselves and for us it would be worth losing the capability which I don't think is used much. Todd --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Looking for feedback
LOL. :-) -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of John Tolmachoff Sent: Wednesday, October 23, 2002 1:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Looking for feedback >One of these days i'll take a typing class. Yuol hove to sand in lane behnd me. :)) John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FromFile Usage Report- Image`fx
What was used to create this report? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner@;declude.com]On Behalf Of Tom Sent: Monday, October 21, 2002 9:13 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] FromFile Usage Report- Image`fx Report ID Version 1.04b Detailed Report for: 10/21/2002 21:36:59 Declude Log file information: --- Total amount of unique messages found in log: 3370 Total amount of fromfile IDs found in log: 297 Total amount of fromfile ID failures found in log: 1589 Total Percentage of fromfile effectiveness: 47% --- Fromfile and Merge file Information: --- Total amount of addresses in the original fromfile: 1502 Total amount of addresses updated from usage: 297 Total amount of addresses added from merge: 3 Total amount of addresses that were removed: 0 Total amount of addresses in the merge file: 5 Total amount of duplicate addresses in merge file: 2 Total amount of addresses now in the fromfile: 1505 Total percentage of the fromfiles actual usage: 20% --- List of spammers caught by the Fromfile: --- found: 3 ID-20021021-000584 .verticalresponse.com found: 22 ID-20021021-65 .bluerockdove.com found: 19 ID-20021021-001128 @marvelousmail.com found: 16 ID-20021021-000736 @boing.azoogle.com found: 4 ID-20021021-001084 @list.euniverse.com found: 1 ID-20021021-001179 @newfunpages.com found: 4 ID-20021021-000192 .enflyer.com found: 4 ID-20021021-95 .chtah.com found: 3 ID-20021021-000207 .FAMILYTIME.COM found: 27 ID-20021021-000740 @bounce.azoogle.com found: 27 ID-20021021-000619 .YOURMAILSOURCE.COM found: 2 ID-20021021-000550 .tm04.com found: 11 ID-20021021-000560 .transcentives.net found: 1 ID-20021021-000727 @bigtimedealz.net found: 19 ID-20021021-000410 .optamail.com found: 2 ID-20021021-000361 .mycreativeoffers.com found: 29 ID-20021021-000510 .specialmailoffers.com found: 14 ID-20021021-000199 .eu30.com found: 21 ID-20021021-49 .bbwgroup.com found: 1 ID-20021021-001172 @nationwidefinancial.org found: 2 ID-20021021-001163 @mtsbp634.edirectbroadcast.com found: 4 ID-20021021-000281 .intervolved.net found: 3 ID-20021021-000549 .tm03.com found: 3 ID-20021021-000854 @discountmail.net found: 35 ID-20021021-000123 .currentmail.com found: 27 ID-20021021-000710 @beawnez.com found: 2 ID-20021021-000917 @fairreach.net found: 20 ID-20021021-001139 @membersselect.com found: 5 ID-20021021-000929 @flowgo.com found: 4 ID-20021021-001216 @OverlyCute.net found: 15 ID-20021021-001205 @opti10.com found: 4 ID-20021021-000826 @dbase.bb02.net found: 8 ID-20021021-000524 .super-best-deal.com found: 12 ID-20021021-000538 .thesuperspecialsales.com found: 2 ID-20021021-000830 @deal-seeker.com found: 2 ID-20021021-000170 .EDIETS.COM found: 4 ID-20021021-000415 .optinmailing.com found: 12 ID-20021021-001094 @lm-mailbck.mylottomail.com found: 23 ID-20021021-82 .c0olmail.com found: 28 ID-20021021-000337 .mb00.net found: 16 ID-20021021-001206 @opti7.com found: 9 ID-20021021-000974 @gr-mailbck.giantreward.com found: 2 ID-20021021-000142 .directoffers.net found: 5 ID-20021021-001399 @vendarefinancial.com found: 10 ID-20021021-000747 @bounces.freelotto.com found: 6 ID-20021021-001314 @sollist698.com found: 6 ID-20021021-001211 @optinfreebies.com found: 10 ID-20021021-000180 .emailcourrier.com found: 9 ID-20021021-000205 .exitrequest.com found: 19 ID-20021021-001112 @MAIL1.SAVINGSENGINE.COM found: 17 ID-20021021-000994 @hi-speedemail.net found: 3 ID-20021021-000399 .onehanesplace.com found: 39 ID-20021021-000495 .shineandsparkle.com found: 4 ID-20021021-000741 @bounce.colonize.com found: 15 ID-20021021-001354 @thecasinobeat.com found: 12 ID-20021021-000620 .yourwebspecials.com found: 5 ID-20021021-001497 [EMAIL PROTECTED] found: 1 ID-20021021-001120 @mailrinru.ru found: 9 ID-20021021-000869 @e54.org found: 14 ID-20021021-000744 @bounce.rapid-e.net found: 1 ID-20021021-001098 @lolfun.com found: 2 ID-20021021-000718 @bestnetoffers.com found:
RE: [Declude.JunkMail] DNSReport claims domain not supporting abuse account, but it does
I'm still confused about this... I have a domain, xidix.com, and it has a [EMAIL PROTECTED] account and an [EMAIL PROTECTED] account. If someone sends email to either of those addresses, they will not be rejected. What else do I need to setup to be RFC compliant? Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, October 08, 2002 3:05 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DNSReport claims domain not supporting abuse account, but it does >DNS Reports at: >http://www.dnsreport.com/tools/dnsreport.ch?domain=xidix.com > >claims: > >WARNING: One or more of your mailservers does not accept mail to >[EMAIL PROTECTED] Mailservers are expected by RFC2142 to accept mail to >abuse. > >mail.speakeasy.net's abuse response: > >>> RCPT TO: <[EMAIL PROTECTED]> > <<< 550 sorry, I don't accept bounce messages with more than one >recipient. Go read RFC2821. (#5.7.1) > > >However, I have an abuse account on that domain, as I do on each of my >domains. Why is DNSReport telling me this? The problem is that you don't accept E-mail to abuse@ if the E-mail is sent to other addresses, as well. The problem is that people won't be able to get mail to you if they send it to postmaster@ and abuse@. Note that RFC2821 has no section 5.7.1. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNSReport claims domain not supporting abuse account, but it does
DNS Reports at: http://www.dnsreport.com/tools/dnsreport.ch?domain=xidix.com claims: WARNING: One or more of your mailservers does not accept mail to [EMAIL PROTECTED] Mailservers are expected by RFC2142 to accept mail to abuse. mail.speakeasy.net's abuse response: >>> RCPT TO: <[EMAIL PROTECTED]> <<< 550 sorry, I don't accept bounce messages with more than one recipient. Go read RFC2821. (#5.7.1) However, I have an abuse account on that domain, as I do on each of my domains. Why is DNSReport telling me this? Todd --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Review kill.lst problem question
Adding the XSENDER option took care of my problem. Thanks to Tom and Scott for your help on this problem and especially to Tom for all the effort on SpamReview! Paypal donation on the way! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz (by way of "R. Scott Perry" <[EMAIL PROTECTED]>) Sent: Wednesday, July 31, 2002 9:17 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam Review kill.lst problem question Please reply to [EMAIL PROTECTED] If you are having problems with adding to kill.lst please review the following and let me know if this is or is not your problem. Per Scott Perry's Instructions, I look for "X-Declude-Sender:" to locate the Sender of the email. The only way this will be included in the files I am looking at is if you have this option set in Declude: "XSENDER ON" If this option is missing or set to OFF in Declude you will have have a "X-Declude-Sender:" entry in your email files and the Add to Kill will not work. My question to you is: How is your XSENDER option set? Note From Scott: If the "XSENDER ON" option is used. Without that, there is no way of knowing for sure what the return address is without looking at the IMail log files for the "MAIL FROM:" line. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Review kill.lst problem question
Oops. My bad. I had the XSENDER commented out. I just uncommented it and set it to ON. I'll let you know in a little while when I get some junkmail. Thanks, Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Schwarz (by way of "R. Scott Perry" <[EMAIL PROTECTED]>) Sent: Wednesday, July 31, 2002 9:17 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam Review kill.lst problem question Please reply to [EMAIL PROTECTED] If you are having problems with adding to kill.lst please review the following and let me know if this is or is not your problem. Per Scott Perry's Instructions, I look for "X-Declude-Sender:" to locate the Sender of the email. The only way this will be included in the files I am looking at is if you have this option set in Declude: "XSENDER ON" If this option is missing or set to OFF in Declude you will have have a "X-Declude-Sender:" entry in your email files and the Add to Kill will not work. My question to you is: How is your XSENDER option set? Note From Scott: If the "XSENDER ON" option is used. Without that, there is no way of knowing for sure what the return address is without looking at the IMail log files for the "MAIL FROM:" line. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Oh gosh!
Title: Message I should get a copy and SPAM them back!! They shouldn't be able to tell who is doing it! Then, if someone does get upset at me (because my SPAM was not anonymous), I can sue them for deceptive trade practices. :-) LOL Todd -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark SmithSent: Sunday, July 28, 2002 7:40 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Oh gosh! Interesting spam that I found...-0- -Original Message-From: Nicastor Viernes [mailto:[EMAIL PROTECTED]] Sent: Sunday, July 28, 2002 7:18 PMTo: [EMAIL PROTECTED]Subject: SPAM: Safely Send bulk email using your DSL or Cable Connection... Introducing the brand new "BonFire" mailer.Anonymous worry free bulk email software. Send bulk email using your DSL or cable connection...and never lose your connection ISP again. What is BonFire?BonFire software uses unique technology to provide complete anonymous delivery.Your IP will never be shown in the headers of any mail sent using BonFire.BonFire is Cost Effective, and is very easy software to use.Simply load your list, message, subject and press 'Send'.Its as easy as that. ° True anonymity (using proxy routing - the new wave in bulk email stealth technology).° No more hunting for relays or paying hundreds of dollars for open servers.° You can run multiple copies simultaneously on different computers.° Port 25 ISP not required (not affected by port 25 blocking).° Speeds of over 300,000 emails per hour confirmed.° Simply purchase one of the mailing packages.° Client side software control.° Easy to use interface.° Free upgrades. Pricing..BonFire is free,BUT.. YOU MUST PURCHASE EMAIL CREDITS IN BLOCKS.BonFire is subscription based bulk email software system.Our email credits are the lowest priced in the industry.For example:A purchase of 10 million credits will enable BonFire to send 10 million emails,but additional credits must be purchased when the credits run out.BonFire comes with 50,000 FREE credits..so you can test it for yourself. Credit Prices:1 Million Email Credits..$99.005 Million Email Credits..$299.0010 Million Email Credits$349.0050 Million Email Credits$899.00100 Million Email Credits..$1499.00250 Million Email Credits..$2599.00500 Million Email Credits..$3999.001 Billion Email Credits...$5999.0010 Billion Email Credits.$.00Receive a free Bulletproof POP mailbox with purchase. Performance:The main premise behind BonFire is anonymity to hide your IP connection.This has been achieved without any sacrifice in email delivery speed.Best results are on Cable, ADSL, DSL, T1, or a T3 connection,but a dialup connection will work just fine. The type of email lists you use may also affect the software's performance.Single domain lists will mail faster than a mixed domain email list.A smaller message puts less strain on the mail servers,therefore, smaller messages mean faster delivery.A small text or html message is all you need,to get your customers attention. An eye catching subject line is also very important.BonFire will send either html or text messages.You can also control the BCC count. Just check a few boxes and send yourself some messages as a test..You'll see for yourself the great value of the BonFire mailer. Click Here to receive a copy of BonFire. Save the Planet, Save the Trees, Save the Ozone.Advertise via E-mail, No wasted paper.Delete with one simple keystroke.Click Here To Be Removed.
