Re: [Declude.JunkMail] [sniffer] OT - exchange 5.5 help
Title: Re: [sniffer] OT - exchange 5.5 help Configure the IMS (internet mail service/connector in echange manager) You have to disable the microsoft smtp server (iis5 smtp) exchange 55 has its own smtp -Original Message- From: [EMAIL PROTECTED] [EMAIL PROTECTED] To: 'declude.junkmail@declude.com' declude.junkmail@declude.com CC: 'sniffer@SortMonster.com' sniffer@SortMonster.com Sent: Fri Jan 07 07:13:01 2005 Subject: [sniffer] OT - exchange 5.5 help I know this is off topic, but I need a little Exchange 5.5 help. Recently upgraded a client from NT4 with Exchange to Windows 2000 Server SP4 with Exchange 5.5. I am having one problem though. The local server name is server.example.com, which is fine and dandy for the internal network. I need to add a domain suffix for the server for the outside world for sending email. I need the domain suffix to be something like example1.com, where example1.com is a real registered domain. Any help is appreciated and you can email me off list. Daniel === Daniel Ivey GCR Company / GCR Online Voice: 434 - 570 - 1765 Fax: 434 - 572 - 1981 [EMAIL PROTECTED] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [Declude.JunkMail] OT IMail Backup/Restore
When you export the imail registry hive Look at the resulting file... If there are hard references to C: Then run a search/replace all to update to D If you use SQL for user databases then you'll have to write a small sql script to update the mailbox path's for every mailbox. The physcal path is stored in each row. Other than that, its exactly what I've done many times. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Friday, June 11, 2004 11:01 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT IMail Backup/Restore Hi, I think this is going to work I need to backup IMail from the C Drive, reformat the server, create D drive and then put IMail back on D Drive. I figure the way to do this is Old Server Stop all IMail services Backup IMail and all directories Make new server Install IMail on new server D Drive Patch it to same level Restore the IMail directories to D Drive Check all drive references Start Services This should move all the mail and users etc etc Obviously fix all the Declude filter paths etc. Will this work? Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT IMail Backup/Restore
That's all that you need -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Friday, June 11, 2004 4:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT IMail Backup/Restore Tom, Is there more in the registry than under HKLM\Software\Ipswitch\. Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, June 11, 2004 12:07 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] OT IMail Backup/Restore When you export the imail registry hive Look at the resulting file... If there are hard references to C: Then run a search/replace all to update to D If you use SQL for user databases then you'll have to write a small sql script to update the mailbox path's for every mailbox. The physcal path is stored in each row. Other than that, its exactly what I've done many times. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Friday, June 11, 2004 11:01 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT IMail Backup/Restore Hi, I think this is going to work I need to backup IMail from the C Drive, reformat the server, create D drive and then put IMail back on D Drive. I figure the way to do this is Old Server Stop all IMail services Backup IMail and all directories Make new server Install IMail on new server D Drive Patch it to same level Restore the IMail directories to D Drive Check all drive references Start Services This should move all the mail and users etc etc Obviously fix all the Declude filter paths etc. Will this work? Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MS SMTP store and forward
Win 2000: Right click SMTP service - Properties - Access - Relay - [x] Only the list below: ( enter your allowed-to-relay IP ranges ) OK - OK - SMTP Service - Domains Right click Domains New.. - Domain - (repeat for each...) Domain Type = remote - name=commarts.com - right click the new domain, properties - [x] allow incoming mail to be relayed to this domain route domain: [x] forward all mail to smart host = imail.server ok - Similar process for Win2003, I think the relay might be under a different tab though. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Hoyt Sent: Wednesday, May 05, 2004 3:56 PM To: Declude.JunkMail Subject: [Declude.JunkMail] MS SMTP store and forward I would like to set up an SMTP mail store and forward server using Microsoft's SMTP server that can accept email for my domains in the event that my primary iMail server is temporarily down. I would also like to be able to send outbound email through this secondary server because we occasionally do an emailing to our customers and when this emailing occurs my iMail outbound queue fills and my iMail users can experience a performance hit using IMAP. I have MX records for the three domains (commarts.com, designinteract.com, and creativehotlist.com) that point to mail.commarts.com as the primary mail server and direct.commarts.com as secondary mail server (higher preference number) and have RDNS records for these two mail servers. The setup seems simple enough: Run MS SMTP on the IP address for my secondary email MX record and this should take care of the store and forward part (if my primary email server is unreachable the secondary will take the mail and should attempt delivery to the primary mail server for the number and timing of attempts configured in SMTP properties). I want to be able to send outbound mail through this secondary email server without running an open relay. So in short: 1) I want to be able to receive email addressed to my domains through my secondary server that is then passed on to my iMail primary server. 2) I want to specify an internal IP address that is allowed to send through the secondary mail server's SMTP service. 3) I want to make sure that no email not originating from the IP address specified in 2 above is relayed to any domains that are not one of my three domains. iMail server always accepts email with an internal destination-is this also true of MS SMTP? If no, how does one set up MS SMTP to accept mail to internal domains and deny relaying of mail from external to external domains. Thank you in advance, Michael Hoyt Communication Arts 110 Constitution Drive Menlo Park, CA 94025 (650) 326-6040 fax:(650) 326-1648 e-mail: [EMAIL PROTECTED] Web Site: http://www.commarts.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF support to be added to next beta
Any chance we can seperate fail unknown into two different tests? via spf we have ?all or -all which are supposed to be treated differently from what I understand. I would rather seriously penalize any domain that is configured with a -all and the sending IP is fails and would NOT want to penazlize unconfigured or ?all transitional domains. Ideally I would like something like this: SPFPASS spf pass x -5 0 SPFUNKN spf unknown x 4 0 SPFFAIL spf fail x 8 0 -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, December 18, 2003 1:34 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPF support to be added to next beta We will be adding support for SPF (Sender Permitted From, at http://spf.pobox.com ) to the next beta of Declude JunkMail. This is a system that lets owners of domains publish information on what mailservers people can use to send mail from the domain. We expect that this can be very useful in blocking spam (similar to the SPAMDOMAINS test), as well as helping ensure that legitimate mail gets through. For those that are interested, we now have an interim release with SPF support in it. It can be downloaded from http://www.declude.com/interim (a new URL that we are going to be using for interim releases, that explains a bit more about them). To use the new SPF test, you can add lines such as: SPFPASS spf passx -5 0 SPFFAIL spf failx 8 0 to your global.cfg file. SPF returns PASS for E-mail that passes SPF (that comes from an IP that is acceptable to the owner of the domani that it claims to be coming from), FAIL for E-mail that fails SPF (that does not come from an acceptable IP for the domain), or UNKNOWN (for E-mail from domains that do not use SPF yet, or for some other reason should return UNKNOWN). This will help reduce false positives (for domains that have SPF support), and help capture more spam (as spam comes in from domains that have SPF support, but the spammer isn't using an acceptable IP). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPF support to be added to next beta
Gotcha, all 3 are already setup :) I don't really want to penalize for unknown, was just making an example. ( I just setup spf on my postfix box yesterday as well to help get past some restrictions for pass) Sounds like you are setting the the spf-guess (which defaults to mx/24 a/24 right?) -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Thursday, December 18, 2003 2:30 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPF support to be added to next beta Any chance we can seperate fail unknown into two different tests? via spf we have ?all or -all which are supposed to be treated differently from what I understand. They are treated differently. An SPF lookup can result in PASS, FAIL, or UNKNOWN. So: Ideally I would like something like this: SPFPASS spf pass x -5 0 SPFUNKN spf unknown x 4 0 SPFFAIL spf fail x 8 0 This will work fine. At this time, though, I would not recommend penalizing for the UNKNOWN response, as most domains do not yet have an SPF record. However, we plan to soon add a way of letting you force SPF records for domains that don't have them, as well as having a default SPF record. This would allow the UNKNOWN result to be more useful. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Dictionary attacks and Postfix
Little OT for this list, but anyone using postfix as a gateway should have this setup by now! http://www.smartbusiness.net/imail/ Use the above utility to export your userlist from IMAIL to a test file every few minutes. I have attached (Imailexport.zip) an example of what I use to export my userlist and FTP it up to my postfix box. I have the .cmd file scheduled to run every 3 minutes to keep it up to date. On the postfix box I have a script in crontab that runs every minute.. ( attached as postfix-import.sh.txt). On postfix box I created a user 'imail' which the 'imailusers.ftp' file contains the login info for. *Note: the postfix script calls /usr/bin/win2unix which probably doesn't exist. It's a quick script I wrote to remove the cr/lf whatever windows has that unix doesn't use. There are lots of examples out there on how to do it also. Once you have the above in place you end up with /etc/postfix/to_relay_recipients.map Which hash's to to_relay_recipients.map.db And postfix now has an up-to-date list (within 5 minutes) of all the users and aliases that IMAIL has. Then edit your /etc/main.cf with relay_recipient_maps = hash:/etc/postfix/to_relay_recipients.map And enjoy the saved BW CPU cycles of not having to deal with all those annoying bounces. Then if you want to help against dictionary attacks write a script to watch /var/log/maillog and once a treshhold is crossed of 'unknown user in relay recipient table' from a single IP blacklist it. (either via another .map or an ipfw rule) -Original Message- From: Scot Desort [mailto:[EMAIL PROTECTED] Sent: Saturday, November 15, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Dictionary attacks and Postfix Over the last week, as we moved one of our larger email domains over to our Declude server. I have been doing ad-hoc research of our IMAIL and Declude logs looking for patterns in email coming in. When we first started to investigate anti-spam solutions, I was leaning towards a gateway server sitting in front of Imail, similar to IMGATE. I built my own Postfix box and basically configured it very similarly to imgate. Initially, we listed many RBL's in Postfix. But it became clear that Postfix (without the use of an external scanner like SpamAssassin) was becoming a problem because a message would be rejected if it failed only ONE RBL test, since there is no native method to use cumulative scoring with RBL's without using something like SpamAssassin. As we all know, rejecting on the basis of a single RBL failure yields a very high FP rate. As time progressed, we removed many of the RBL's from Postfix. We still have Postfix sitting in front of Imail, but it's primary purpose is to do some attachment filtering (.exe, .pif, .scr etc), as well as the equivalent of Declude's REVDNS, MAILFROM and IPNOTINMX tests. Now that we have Declude running, the usefulness of the Postfix gateway seems limited. And in actuality, it might be increasing our total email volume entering Imail. This is because Postfix acts as a front end gateway/relay server for a domain. Since Postfix does not have access to the Imail user database, it accepts ALL incoming email to a domain that it handles relay for. Now, if I understand spammers (or more specifically, email address harvesters), they are in the business of selling email addresses. The cleaner their databases are, the more money they make. So, one of these harvesters sends a dictionary attack to one of the domains that our Postfix server relays for. Postfix sees the domain as a relay domain, and accepts EVERY single incoming email address for that domain. As far as the harvester is concerned, Postfix has now validated every single email address in the attack. Now, Postfix does it's thing, and forwards the email to Imail. Now Imail processes each message and rejects those addressed to invalid mailboxes. But at this point, it's too late. The harvester has closed his SMTP connection to Postfix and as far as he is concerned, every single one of the addresses is valid. Imail simply bounces the bad messages, which is obviously a waste of time since the bounce address is most likey invalid also. While Postfix may be reducing a small percentage of email from reaching Imail when it fails some of it's own tests, it is my belief that Postfix is actually increasing the amount of email being sent to Imail by validating every email address coming into it as part of a dictionary attack. I think Ipswitch needs to add dictionary attack prevention to Imail. MerakMail does this, and the control they give you over the process looks pretty good (http://www.merakmail.com/Knowledgebase/261.htm). I was shocked to find out that Ipswitch did not include this functionality when version 8 was released. For us, dictionary attacks represent the highest volume of incoming email to our servers. To combat the lack of this functionality, one could do some cumulative analysis on your Imail logs, identifying the IP
RE: [Declude.JunkMail] maybe its just one of AOL's servers???
http://postmaster.info.aol.com/servers.html -Original Message- From: Joshua Levitsky [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 07, 2003 7:26 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] maybe its just one of AOL's servers??? The reason for the above is that our customers use ptr.aol.com and well there's just a bunch of other prefixes before .aol.com and only MX is used for our mail servers. (Nobody here has seen actual email from aol.com coming from something other than *.mx.aol.com right?) -Josh -- Joshua Levitsky, CISSP, MCSE System Engineer AOL Time Warner [5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Auto-unsubscribe
Scott: Curious on how you have your auto-unsubscribe set. I have been unsubscribed twice now and each time I usually figure out when the list seems unusually quiet. This time is probably because of a filter that was a little too aggressive yesterday that I quickly caught and removed... I rejected two messages from the list but was still receiving messages for a little while after that point so didn't think it had triggered an auto-unsub. Just curious so I can watch out for it in the future. ( do/can you send a notice to a recipient when you auto-un subscribe them? ) Thanks Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Multi Server Configs
Dan, Declude does not have that kind of power as it is the IMAIL SMTP Daemon which accepts the mail and places it into the spool. After it is in the spool declude queue moves it to the overflow for faster processing if there are more messages in the spool than imail can run smtp-delivery processes for (MaxQueProc). See http://www.declude.com/dq.htm for more information on how exactly the overflow works. If you want to reject messages before the SMTP envelope is over let me suggest you take a look at 'IMGate' http://imgate.meiway.com/ IMGate is basically a set of configurations for a free Unix OS(Linux or FreeBSD www.freebsd.org) with the (free) Postfix MTA (www.postfix.org). Postfix does have the ability for its SMTP Daemon to reject messages during the first SMTP session based on header and body rules. Many of the people running declude also have one of these servers running in front of our Imail/Declude server to reject such floods. During the start of the SoBig flood I modified my body checks to reject any message with a .pif attachment, and modified my header checks to reject any message containing subject lines of those that the sobig worm uses. Yesterday I rejected over 10,000 messages based on these rules.. Thats 10,000 messages declude never had to process because they were rejected with a 550 code at the SMTP level. There may be some other suggestions on this list, but I think this is something worth at least taking a look at. -Tom -Original Message- From: Dan Patnode [mailto:[EMAIL PROTECTED] Sent: Thursday, August 21, 2003 2:30 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Multi Server Configs I'm running twin dual Xeon 2.4s and was nearly wiped out today by all the extra virus/worm activity. Its midnight and I'm still clearing out the overflow, to the tune of 2 dozen Declude processes. Rather than running them in parallel as we had before (setting them up with the same MX weight), we are running these in series (every message hits the first server until it says uncle, then the second server gets some). Trouble is, the 1st server didn't refuse incoming mail, it just kept piling up in overflow - to the tune of about 10,000 message in the course of a single morning. Is there a way to configure Imail/Declude so as not to use overflow, instead refusing additional connections so they are passed to secondary servers? Thanks Dan PS, more on CPU load itself later --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spoolviewer.exe - bug?
Scott: Does spoolviewer.exe look at the registry to determine the actual spool location? We just moved our spool to a different physical volume to improve performance... D:\imail\spool - e:\imail\spool everything else remained on D except the spool. Everything is functioning great (doubled our performance too!) except now spoolviewer.exe reports all 0's Thanks Tom --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Cox SMTP
Cox ( as well as most ISPs) only block specific ports as needed, and allow everything else. ( vs a corporate organization or ISP servers which block all, and allow whats needed ). To the best of my knowledge cox only blocks Out: 25 In: 25,80 The cox filters only apply to Residential customers, business customers who are using their assigned IP addresses are not effected by any filters. This is no different than earthlink who has long blocked outbound 25 to anywhere except their own servers. This is a good move I wish all residential high speed providers would do. Cable Modems/DSL are known for their high abuse and since this block I have seen the number of viruses/etc trying to come into my network cut down considerably. -Original Message- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 01, 2003 1:22 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Cox SMTP So, you are saying they are not blocking port 26 outbound, only port 25 in and out. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Cox SMTP
(1)no SPAM or Anti-Virus checking How does using a different SMTP server effect your inbound spam filtering? Cox subscribers are forced to use the cox SMTP so what? The only way this should effect your declude is that auto-whitelist may not work. If you still want to scan on the senders IP, adjust your HOPHIGH accordingly. (2)5Meg email attachment size limit. Real bummer. customers have to convert those bitmaps to jpg's from now on. Now I have two SMTP servers on the same server Imail ver 8.0 and Declude Junkmail and Virus using the standard ports so not to effect all my other emails and domains and the second SMTP using port 26 so I can send emails to my server from home over the COX cable modem. This allows me to still have SPAM and virus checking for my cable modem customers and over come the COX imposed 5Meg limit. I'm confused, how does moving the extra HOP from the COX smtp to a second SMTP inside your building effect your inbound spam checking? Attachment limitations can be a PITA. As an administrator I'm surprised you don't have an inbound VPN connection to your office anyways which would bypass their filters and allow you to tunnel to your own SMTP. ( that's what we do ). I understand this wouldn't work for customers... We infact do something similar running secondary SMTP services on port 125 (we find its easier to teach stupid people to add a digit in front of the port number rather than changing one). If your reasoning is for something like auto-whitelist you will also need to set that secondary SMTP server to smarthost via IMAIL (sending ALL outbound mail via IMAIL and not using MX/DNS to deliver). Also hopefully you are using SMTPAUTH or have allowed individual Ips into the MS-SMTP service, open relays on odd ports can also be bad. -Original Message- From: William Baumbach [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 01, 2003 12:58 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Cox SMTP If you did not know Cox the High Speed Internet provider of cable modems. Beginning Wednesday, June 25 2003 has filter access to all 3rd party outgoing (SMTP) mail servers. Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Does Declude Work With IMail Relaying?
There is a way you can get your imail/declude-exchange-relay box to treat the mail as inbound mail, but there is more administrative overhead (ie not a good choice for most people). Our organization does not make changes to our exchange mailbox's often so this works great for us, and has the added benefit of letting imail reject 'unknown' users rather than accepting everything and bouncing them. -Leave IMAIL configured as it was (nexustechgroup.com primary with host aliases). -Leave all your POP accounts... -Setup exchange with @nexustechgroup.com AND @internal.nexustechgroup.com (make sure the mailbox's can accept mail to @internal.nexustechgroup.com, but their primary address is @nexustechgroup.com so outgoing mail reflects the proper address) -if you would like the users to be able to create IMAIL rules (to block stuff before it gets to exchange) then create a main.fwd in each POP folder forwarding to @internal.nexustechgroup.com Ex: [EMAIL PROTECTED] file: \imail\nexustechgroup.com\users\support\main.fwd contains: [EMAIL PROTECTED] -if you just want it treated as local then just create an imail alias for each username forwarding to [EMAIL PROTECTED] This results in IMAIL thinking nexustechgroup.com (and all host aliases) are local. You can let your users create spam filters by logging into their MAIL account and using the IMAIL processing rules if they like (to filter on their own headers) or manage your USERNAME.junkmail or however your organization prefers. When mail would be delivered, it will be 'forwarded' to their internal address (DO NOT EVER give it out) and make it to exchange (translated to [EMAIL PROTECTED] ). All users would be able to receive mail at xxx@(any host alias). The administrative headache is keeping your POP/forwards and aliases up to date every time you make a change in exchange, but it works well for us. -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 01, 2003 6:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Does Declude Work With IMail Relaying? Well, the domain names for the mail which we are going to be relaying mail over to our Exchange Server are NEXUSTECHGROUP.COM, NEXUSTECHLTD.COM and NEXUSTECHNOLOGYGROUP.COM. Currently, NEXUSTECHGROUP.COM is set up in IMail as the primary domain name and NEXUSTECHLTD.COM and NEXUSTECHNOLOGYGROUP.COM are host aliases off of the site. We do use per-domain filtering currently for NEXUSTECHGROUP.COM, which, since they are host aliases, also includes the other 2 domains. Does that mean we can still manage any spam filtering for that domain as we have been, i.e. with the \declude\nexustechgroup.com\$default$.junkmail? Actually, just to make things more confusing, IMail won't perform the domain translation for gateway E-mail, so you would need separate config files for each domain. If per-domain configuration allows me to treat relayed domains as if they are local domains do I now have to setup \declude\nexustechltd.com\$default$.junkmail and \declude\nexustechnologygroup.com\$default$.junkamil for the other 2 domain names, where before I was depending on the NEXUSTECHGROUP.COM to do the work for all three of them because 2 were host aliases? Correct. However, you could use the REDIRECT command to get around this, by having the following lines in the \IMail\Declude\global.cfg file: REDIRECT@nexustechltd.com C:\IMail\Declude\nexustechgroup.com\$default$.JunkMail REDIRECT@nexustechnologygroup.com C:\IMail\Declude\nexustechgroup.com\$default$.JunkMail -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Processing Declude and Imail
Weight20 Subject SPAM-2[%weight%] #Weight20a MAILBOX SPAM Weight30 Subject SPAM-3[%weight%] #Weight30a MAILBOX SPAM Do not use the mailbox action, rather copy a rules.ima into each users folder that does not already have one. The contents of the 'default' rules.ima should be like S~SPAM:SPAM Declude does its magic well before rules.ima comes into play. If you were to use Domain level rules.ima, they execute before user level rules.ima, and your users would not be able to 'whitelist' via rules.ima The rule which moves the spam to the spam.mbx needs to be the very last line in each usres rules.ima What WE do is make a header entry rather than inserting into the subject. Then we don't get the compaints, why did you still mark it as spam when I told you not to since their rules.ima is what whitelisted the email. -Original Message- From: Earl Baumgardner [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 18, 2003 8:13 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Processing Declude and Imail That is what I thought as well. But. When you use the config I have below the rules.ima seemed to get ignored. I would like to the email tagged as Spam to automatically go to the SPAM folder. But I would also like my users to be able to use the IMAIL rules to further filter the email, such as whitelisting or deleting spam. Suggestions anyone? thanks Earl -- Original Message -- From: John Tolmachoff (Lists) [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 18 Jun 2003 18:07:48 -0700 I believe rules.ima gets run last. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Earl Baumgardner Sent: Wednesday, June 18, 2003 5:57 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Processing Declude and Imail When using the MAILBOX feature on Declude, will Imail still apply rules.ima to that incoming email? Ex We have 2 actions on an email. Add SPAM to the subject line and send to SPAM folder. Based on weight we also include a Spam Level such as: SPAM-1 or SPAM-2 that gets added with the subject line. Weight20 Subject SPAM-2[%weight%] Weight20a MAILBOX SPAM Weight30 Subject SPAM-3[%weight%] Weight30a MAILBOX SPAM this will send to a users folder called SPAM. Now say that user wants to apply his own rules to that email. Such as SPAM-1 goes to Inbox or SPAM-3 gets deleted or just basic whitelisting. Can this be done or does the Send To Folder override the Rules.Ima for that user. thanks! ___ Earl Baumgardner WebShoppe [EMAIL PROTECTED] 256.329.2574 www.webshopppe.net WebShoppe WebMail DSL|Dialup|Web Design|Hosting|Frame-Relay|T-1 Protect your computer - Online Virus Scanning http://www.webshoppe.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going?
In our experience as an ISP, this was our INITIAL reaction (based on my personal mailbox), However SPAMCOP turned into about 50% accuracy system wide, and we had to move to at least 2 RBL tests failed to hold, or SNIFFER. It would be a good idea to run the sniffer (http://www.sortmonster.com/sniffer/) trial as well. What declude is currently passing through sniffer should catch most of. -Tom -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Friday, February 28, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? In my experience SPAMCOP has been very good at weeding out SPAM and we hold/block using this test alone. We do occasionally get a false positive or two, but no more or less than any of RBL's that list known open relays. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 11:36 AM To: Declude JunkMail Subject: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail is caught and then c) filtering further for actual identified spam e-mails. He thinks it's too much overhead to add each domain name whereas I think over time as I add more and more domains to the list the number of domains I have to add will go down considerably. Needless to say I gave in and just started holding for the SPAMCOP test because I really didn't feel like taking the time to turn him over to my spam blocking philosophy. So that's basically where I'm at right now and from this I've come up with a number of questions and/or comments I am looking for feedback on. Mostly I'm looking for best practices sorts of answers from the community as a whole... #1) Are there are any other tests, which I am missing, like the SENDERBLOCK test which I might want to consider adding to my bag of tricks to continue to filter out spam e-mail which slide in under my hold weight and also fall in line with my philosophy, i.e. catching legit e-mail is a bad thing? #2) Am I correct in my assumption that holding for SPAMCOP is a bad
RE: [Declude.JunkMail] Idea for a test...
Right, as has been the concnsus when the regexp idea's has been discussed before. Declude is clean small and straightforward. Regexp support adds complexiy which add's to CPU load. We run a postfix gateway as well (that's where we actually run message sniffer, to keep the CPU load on IMAIL as low as possible, we do a good volume). Simple checking to watch for this specific pattern might be a good idea, but IMO full blown regexp support is an overkill for what declude is designed for. There are people developing external tests to accomplish this, which I believe is the best win win solution for the broad customer base declude is targeted at. -Original Message- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Monday, February 24, 2003 1:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Idea for a test... I run regexp for header check on my Postfix gateways, but not for body checks because of the CPU usage it takes to scan message bodies. I like the fact the Declude JunkMail is fast and efficient and would be opposed to adding code that would substantially slow it down. Just my 2 cents... Bill - Original Message - From: Mike K [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, February 24, 2003 10:22 AM Subject: Re: [Declude.JunkMail] Idea for a test... Scott: You may just want to build support for unix style regular expressions. Complicated, but they can do this and much more. Note: Len's IMGate solution can do this also but with half the cpu horsepower that NT/2K require. I use IMGATE as a front end to IMAIL/Declude do exactly this. Expression matching does get cpu intensive if you don't limit it to say the first 5K bytes (scanning a 5 meg attachment for ex.) or so and make sure it runs after less resource intensive tests (rbls). Mike - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, February 24, 2003 10:36 AM Subject: Re: [Declude.JunkMail] Idea for a test... As we all know the spammers insert special characters in the middle of subject words to bypass the filters, e.g. P/O/R/N, or all sort of other variations. Can a test we devised, similar to the COMMENT test that counts the number of special characters or detect similar characters appearing in the middle of words. I guess one way to approach this is to first count if there are more than 1 or 2 special characters and if yes then determine if they are followed by text. This could be a weight test. This does sound like a good idea. Our spamtraps don't seem to get much spam like that, but a test looking for non-alphanumeric characters that are surrounded by alphanumeric characters might make some sense (which would catch P/O/R/N). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] PostfixGate removal ... ?
Title: Message Anyone know how the heck to submit a removal for postfixgate? is there even a way? The link on their website (www.postfixgate.com) is a js popup, which when I pulled the js page it refers to http://www.liswireless.net/postfixgate/dispute/default.htm When you go there, its a redirect to http://www.brandxwireless.com/ Which gives no links for submitting a removal. Thanks in advance if anyone has any info -Tom
RE: [Declude.JunkMail] PostfixGate removal ... ?
Scott, I seem to remember this coming up maybe a few months ago? Hell I have a bad memory. The first link in postfixgate says you shalt not be listed on any other spam lists to be removed, and links to www.dnstuff.com Maybe you guys could throw a note on http://www.dnsstuff.com/tools/ip4r.ch making note that its dead to help guys out like me that have no memory, or people that don't have access to this mailing list to get help from others ? Just a thought, Thanks for the replies everyone.. -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Wednesday, February 05, 2003 11:41 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] PostfixGate removal ... ? Anyone know how the heck to submit a removal for postfixgate? is there even a way? This may help: We're listed in there, but don't care. It seems that they died about a year ago, not adding/removing any entries since then. However, since people had paid them money, I'm guessing they are leaving everything online until all the subscriptions have ended. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Select Email
I do it by using plain old IMAIL Rules... [rules.ima] F~[EMAIL PROTECTED]:main F~[EMAIL PROTECTED]:main F~[EMAIL PROTECTED]:main H!~abc123def123ghi123jkl123:NUL The first 3 lines check the from-address, if there is a match, the message is places in the 'main' mailbox/folder and rules processing completes. The last line says if that long string is NOT found in the headers anywhere, then move to NUL (erase the message). Basically make the last line a catch all delete, so you have to build exceptions above it. -Tom -Original Message- From: Richard Farris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, February 04, 2003 8:39 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Select Email Is there a way to set up an account that receives email from only a select few addresses... Richard Farris Ethixs Online 1.800.548.3877 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Reject Msg based on Size
It has been a feature of every version of IMAIL I remmeber using thus far. Currently I have 6.x and it is located in both The web-administration tools Imail Admin In IMAdmin, Its on the first tab when clicking on a virtual host. Defatult Max mailbox size, Single message max size, default max messages (count). These are just the defaults for creating new users, The limits themselves are actually set on the userlevel. Tree down to a username, and click on the directory tab, here you can set these limits. For those of you using a SQL db like me, its easy to enforce the limits (My host admin users sometimes get smart and will reset their limits themselves beyond what I allow). I run a daily (CF) script to reset all limits to my settings. # this SQL call will get all of your IMAIL table # names stored in the same db, all of mine start with 'mail.' # remove the last and name... select name from sysobjects where xtype='U' and name like 'mail%' # Then loop through the results... # note: maxsize is maximum mailbox size, not message size cfloop query=gettable cfquery name=setsize datasource=imail UPDATE #name# set maxsize = 1024 /cfquery /cfloop -Original Message- From: Roger Heath [mailto:[EMAIL PROTECTED]] Sent: Monday, February 03, 2003 8:14 AM To: Andy Schmidt Subject: Re[2]: [Declude.JunkMail] Reject Msg based on Size Reply to: Andy Schmidt Re: [Declude.JunkMail] Reject Msg based on Size on Monday 8:07:22 AM This is not in my earlier version of Imail... Does this do this on an account basis or domain basis? It must be in later versions unless I am missing something. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - A Why not control the message size in Imail - you can set it per domain A and, I believe, per user. A If the message exceeds the max message size, Imail will reject it - A and it will result in a bounce from the SENDING server. A In fact, Imail's ESMTP will announce the max message size to the A sending server so that it can be rejected BEFORE it is transmitted A (at EHLO time!) A Best Regards A Andy A --- A [This E-mail was scanned for viruses by Declude Virus A (http://www.declude.com)] A --- A This E-mail came from the Declude.JunkMail mailing list. To A unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type A unsubscribe Declude.JunkMail. The archives can be found at A http://www.mail-archive.com. A -- A ActivatorMail(tm) ver.122102 Scanned for all viruses by A www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Does the comments test require non-whitespace beforeafter the comments in order to trigger? So that most legit messages will not trigger it? -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Monday, February 03, 2003 5:36 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released We have just released Declude JunkMail v1.67 (beta). See http://www.declude.com/junkmail/manual.htm . Notable changes since the last beta include: o Adds an AUTOWHITELIST ON option, to automatically whitelist addresses in recipient's address book o Adds a comments test type, to detect anti-filter HTML comments (such as unsub!-- user --cribe) Other additions and fixes can be found in the release notes, at http://www.declude.com/relnotes.htm . --- Quick Resource Reference: Tech Support: [EMAIL PROTECTED] Mailing List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.virus your name or subscribe declude.junkmail your name in the body New Releases List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.releases your name in the body Troubleshooting: See manual URL above; look at Troubleshooting section Emergency Uninstall: See manual URL above; look at Emergency Uninstall section Urgent Support: urgent @declude.com (for urgent/time-sensitive issues only) Declude Addons/Tools URL: http://www.declude.com/tools Manuals: http://www.declude.com/virus/manual.htm , http://www.declude.com/junkmail/manual.htm , http://www.declude.com/hijack/manual.htm . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Junkmail/iMail domain names.
You can give them their own IP in your gateway, and assign it a hostname of theirs. I have about 20 Ips in my Imail machine. The official name is mx01.web4less.net But this is what appears in one of my headers (on the way to exchange) Received: from fw2.netsmith.net [204.49.154.3] by mail.cfi.net with ESMTP (SMTPD32-6.06) id A9D623630206; Tue, 10 Dec 2002 15:17:13 -0600 (mail.cfi.net is the hostname in imail for my 204.49.154.3 ip). Mxfilter.THEIRNAME.COM might suit their needs. (and not mess up your gateway process) Just don't give it any users, and do NOT give it a host alias of 'theirname.com', or it will treat the mail local. -Tom -Original Message- From: Mark Smith [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 10, 2002 3:14 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Junkmail/iMail domain names. Now that I think about it, changing that would probably screw up my Junkmail license key. :) No biggie... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, December 10, 2002 3:16 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Junkmail/iMail domain names. After checking with my customers, I think that what they're referring to is the SMTP header. I don't think that I can change this but I'll try... In the SMTP header they see: Received: from popmail.netrends.com ([65.196.89.161]) by outboundsmtp.domain.com Hmmm... I don't think that there is any way to change that. However, you might want to ask on the IMail Forum, as someone there will likely know if there is a way to change that (searching the IMail Knowledge Base for HELO and EHLO -- the two SMTP commands where the domain name would be sent by IMail -- didn't turn up anything). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Populardomains test
Assuming the big guys spool OUT from their INBOUND MX records I think that would hold true But for example here at my office, we have (2) MX records, which are our inbound filter gateways. However outbound mail spools through DIFFERENT gateways, so all mail leaving my organization should actually fail that test... Most likely the big guys also separate inbound and outbound mail to different IP/servers.. (but I could be wrong) -Tom -Original Message- From: Cris Porter [mailto:[EMAIL PROTECTED]] Sent: Monday, December 09, 2002 9:49 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Populardomains test What if you set the positive weight of the popular domains equal to the negative weight of the IPNOTINMX test? Won't only invalid mail from these domains add to the accumulated weight? Cris Porter JVC America -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Monday, December 09, 2002 9:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Populardomains test I'm missing something that could trigger false positives? What if I send you a note from my yahoo.com account that just happens to trigger one of your filters because I am telling you about a new spam technique? With the way you have it set, just me sending a mail to you from my yahoo.com account is now at 55% (or is that 70% if abuse is 15% and postmaster is 15%) of your hold weight. While I am also testing for those domains, I have that combination (total if it fails domain, abuse and postmaster) at 50% of subject modification and 40% of hold. Just my .02. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail Web Based Interface
I do store all of my user databases in SQL, but it doesn't really matter, the CF side never see's the username/password. It's just a little trick I did to verify the identity of the user. My whitelist/blacklists are so very simple... I'm actually not using declude's whitelists/blacklists... Those work via IMAIL's rules.ima Any approved senders first. [rules.ima] F~[EMAIL PROTECTED]:MAIN ( sends any mail from approved-sender to main mailbox, stop's processing rules on that message ) Then any black lists F~[EMAIL PROTECTED]:NUL ( just deletes mail without any trace ) Then my weight-rule based on what level the client chose (header check) H~X-SpamLevel-Low:SPAM And of course in $default$.junkmail LOW WARN X-SpamLevel-Low: This message triggered the low spam test MEDIUM WARN X-SpamLevel-Medium: This message triggered the medium spam test HIGH WARN X-SpamLevel-High: This message triggered the high spam test And [global.cfg] HIGHweightrange x x 1 15 MEDIUM weightrange x x 16 25 LOW weight x x 26 0 I am actually finishing up a revision that gives my users a way of syncronizing their approved senders lists to their IMAIL address book, and lets them upload/download their IMAIL address book so they can syncronize it with Outlook Express. When I first started this concept I posted my source to the list, but have not updated that source in quite some time. Some of the source is specific to my system (because of the billing system integaration), but most of what you need is contained within just a couple of .cfm's. I will send you them off list this afternoon. -Tom -Original Message- From: Cxan [mailto:[EMAIL PROTECTED]] Sent: Sunday, December 01, 2002 9:49 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail Web Based Interface Tom, This is exactly what I am talking about. I noticed that you used Cold Fusion and that is what our developers use. The idea that I have is extremely close to what you have done. I will search the archive to find your documentation. For the approved and black list did you use a table SQL database. I am assuming that you are not saving your Imail user database in the registry. The reason I ask is I am leaving our Imail user database just as it is (the default) but yet we created a SQL table for whitelist/blacklist information. It is very much a table that holds the rules for per domain or per user email address. This way the users can very much populate this database using interfaces very similar and almost identical to your interface. In addition I wrote a external program in Visual Basic that is call by Declude. queries this table for each incoming email and makes decision and contributes to Decludes weighting system based on the rules stated in the database . That is mainly why I love the design and ideas behind Declude. I was wondering if it is possible to get a copy of your .cfm files and modify them? Best Regards, Mishi - Original Message - From: Tom Baker | Netsmith Inc [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, December 01, 2002 10:23 PM Subject: RE: [Declude.JunkMail] Imail Web Based Interface The session string can be helpful for kicking a user between iwebmsg and your own web server with only a single authentication point. I have already accomplished this with my system, and have integrated my online billing / spam filters with the web templates. You can see an example of what I'm talking about at http://mail.bsc.net/ Email= [EMAIL PROTECTED] Pass = declude Notice whenever your URL begins with http://mail.; you are in IMAIL's Web messeging server, but whenever your URL begins with http://signup.; you have followed a link which kicked you to my other web server, and verified your login information from IMAIL. (preventing you from having to login twice). ( for a specific example, click the spam filters button ) Search the mail archives at http://www.mail-archive.com/declude.junkmail%40declude.com/ to find my older post which explains how I accomplish this, or ask if you are curious. I think this might be along the lines of what you are asking. -Tom -Original Message- From: Cxan [mailto:[EMAIL PROTECTED]] Sent: Sunday, December 01, 2002 4:35 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail Web Based Interface Terry, You have been a great help today. I think the links that you sent me would be a good start. Many Thanks Mishi - Original Message - From: Smart Business Lists [EMAIL PROTECTED] To: Cxan [EMAIL PROTECTED] Sent: Sunday, December 01, 2002 5:28 PM Subject: Re: [Declude.JunkMail] Imail Web Based Interface Mishi Sunday, December 1, 2002 you wrote: The link that you sent me did not explain what I am asking for. Let me explain my question a bit more: Suppose there is a virtual domain called abcvirtual.com on a server called
RE: [Declude.JunkMail] Imail Web Based Interface
The session string can be helpful for kicking a user between iwebmsg and your own web server with only a single authentication point. I have already accomplished this with my system, and have integrated my online billing / spam filters with the web templates. You can see an example of what I'm talking about at http://mail.bsc.net/ Email= [EMAIL PROTECTED] Pass = declude Notice whenever your URL begins with http://mail.; you are in IMAIL's Web messeging server, but whenever your URL begins with http://signup.; you have followed a link which kicked you to my other web server, and verified your login information from IMAIL. (preventing you from having to login twice). ( for a specific example, click the spam filters button ) Search the mail archives at http://www.mail-archive.com/declude.junkmail%40declude.com/ to find my older post which explains how I accomplish this, or ask if you are curious. I think this might be along the lines of what you are asking. -Tom -Original Message- From: Cxan [mailto:[EMAIL PROTECTED]] Sent: Sunday, December 01, 2002 4:35 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Imail Web Based Interface Terry, You have been a great help today. I think the links that you sent me would be a good start. Many Thanks Mishi - Original Message - From: Smart Business Lists [EMAIL PROTECTED] To: Cxan [EMAIL PROTECTED] Sent: Sunday, December 01, 2002 5:28 PM Subject: Re: [Declude.JunkMail] Imail Web Based Interface Mishi Sunday, December 1, 2002 you wrote: The link that you sent me did not explain what I am asking for. Let me explain my question a bit more: Suppose there is a virtual domain called abcvirtual.com on a server called xyzserver.com. When a user logs in to the server using Imail port 8383 then Imail creates a bunch of security character strings like : http://xyzserver.com:8383/Xade9939bcc9fcf9aee8571e9/menu.63104.cgi?mbx=Main What I am trying to figure out is what holds/creates the string : Xade9939bcc9fcf9aee8571e9 Oh, I did misunderstand. I do not believe that the session id is well known. It is certainly not documented in so far as I know and I've never seen a hack described. There have been vulnerabilities described to acquire someone's session id but all I know presuppose the existence of the id. Since the IMAIL password has been hacked and described I suspect the session id has not been or it would also be described somewhere. Therefore, I suspect your most promising path of exploration is to attempt to modify the templates after the session is created. See these links for aid on customizing web messaging templates and the special tags you can use: http://support.ipswitch.com/kb/IM-2615-DM01.htm http://support.ipswitch.com/kb/IM-20010928-DM01.htm http://www.ipswitch.com/support/IMail/guide/imailug7.1/Appendix%20H%20cal_te mplates5.html I know this is not answering your question but maybe it will help. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: PayPal Account Confirmation
Title: PayPal Sorry for posting HTML, but I wanted to preserve the original message at the bottom. I received this fraudulent attempt at retrieving my paypal username and password from a bellsouth ADSL customer who is probably trying to steal money and probably having much success. This email comes directly from his DSL modem into your mail server, he has his own SMTP engine. all the images Link from paypal's official site, however the HTML FORM posts to a port5.com server, which appears to be based in the UK. Received: from 3t1y8s.yahoo.com (adsl-34-73-158.mia.bellsouth.net [67.34.73.158])by fw1.netsmith.net (Postfix) with SMTP id 5135E7C07for [EMAIL PROTECTED]; Fri, 1 Nov 2002 20:27:57 -0600 (CST)Date: Fri, 01 Nov 2002 18:27:42 -0800To: [EMAIL PROTECTED]Subject: PayPal Account Confirmation I have already attempted to pass this message on to paypal, but anyone who has better communications with any authority please report this. I urge everyone to block this in their junkmail rules to protect their users. This is what I have done [global.cfg] PAYPALFAKEfilter d:\imail\declude\filters\paypal.txtx00PAYPALFAKE2filter d:\imail\declude\filters\paypal.txtx00 [paypal.txt] HEADERS 100 CONTAINS PayPal Account Confirmation [$default$.junkmail] PAYPALFAKESUBJECT [PAYPAL FRAUD! THIS IS FAKE] PAYPALFAKE2ROUTETO [your_address_to watch thse get caught] Original Message Below! Thank you, Tom Baker MCSE, CCNP Network Administrator Netsmith, Inc. -Original Message-From: Service PayPal [mailto:[EMAIL PROTECTED]]Sent: Friday, November 01, 2002 8:28 PMTo: [EMAIL PROTECTED]Subject: PayPal Account Confirmation Dear PayPal Customer This e-mail is the notification of recent innovations taken by PayPal to detect inactive customers and non-functioning mailboxes. The inactive customers are subject to restriction and removal in the next 3 months. Please confirm your email address by logging in to your PayPal account using the form below: Email Address: Password: This notification expires November 1, 2002 Thanks for using PayPal! This PayPal notification was sent to your mailbox. Your PayPal account is set up to receive the PayPal Periodical newsletter and product updates when you create your account. To modify your notification preferences and unsubscribe, go to https://www.paypal.com/PREFS-NOTI and log in to your account. Changes to your preferences may take several days to be reflected in our mailings. Replies to this email will not be processed. If you previously asked to be excluded from Providian product offerings and solicitations, they apologize for this e-mail. Every effort was made to ensure that you were excluded from this e-mail. If you do not wish to receive promotional e-mail from Providian, go to http://removeme.providian.com/. Copyright© 2002 PayPal Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners.
RE: [Declude.JunkMail] Unwanted E-cards filling email inboxes
Or use domain processing rules X:\imail\domain_com\rules.ima (gets processed before) X:\imail\domain_com\users\username\rules.ima -Original Message- From: John Tolmachoff [mailto:jtolmachoff;reliancesoft.com] Sent: Sunday, October 27, 2002 9:13 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Unwanted E-cards filling email inboxes Just use a regular rule in your rules.ima file. But then I have to copy that to all users, correct? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. La Habra, CA 90631 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MAILFROM (MX/A)
X-RBL-Warning: MAILFROM: Domain web0.bsc.net has no MX/A records. Just noticed in cleaning up DNS while back that i accidentally erased the A record for my web servers official name. ( I have several A records point to it, and never use the above name ). I've already fixed DNS, updated serial and verified my backups have updated. Sent another message through and it failed again. Does the DNS engine in declude cache failed lookups? if so what do I need to do for it to refresh, or what is the time period before it tries again? I could reboot, but this *is* a mail server we're talkin about :) Thanks in advance --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MAILFROM (MX/A)
Thought I had IMAIL using my main 2 dns servers when in reality its using 2 of my caching servers. By the time I went to check them they had already updated. I'm just too impatient during debugging Thanks again -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 08, 2002 9:50 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] MAILFROM (MX/A) X-RBL-Warning: MAILFROM: Domain web0.bsc.net has no MX/A records. Just noticed in cleaning up DNS while back that i accidentally erased the A record for my web servers official name. ( I have several A records point to it, and never use the above name ). I've already fixed DNS, updated serial and verified my backups have updated. ... and http://www.DNSstuff.com/tools/lookup.ch?name=web0.bsc.nettype=A does confirm this. Sent another message through and it failed again. Does the DNS engine in declude cache failed lookups? if so what do I need to do for it to refresh, or what is the time period before it tries again? I could reboot, but this *is* a mail server we're talkin about :) The DNS engine in Declude JunkMail does not cache entries; it relies on the DNS server that it connects to to do the caching. You should check the first DNS server listed in the IMail SMTP settings to see if it has the old entry in it. If so, you can simply restart it and it should forget the cached entry. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HOPHIGH
I use a difference of 3 HOP 0 HIGHHIGH 2 i love it... I know of at least 1 server where they know their server is an open relay, so they have their server set to send all outbound mail to another smtp server which is not to get around open relay blocks, i still block them, beecause they are hop 1 rather than hop 0 :) -Original Message- From: Bill B [mailto:[EMAIL PROTECTED]] Sent: Thursday, September 26, 2002 1:20 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HOPHIGH How affective is scanning at multiple Hops? I'm not setting HOPHIGH right now...but I'm currious if the people who are using it are seeing its benefits, or if it is causing them any problems. And what is the recommended HOPHIGH setting (assuming HOP is set to 0)? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Junkmail - Spamheaders
Well you are not taking into account systems like mine, which have a setup like HOP 0 HOPHIGH 4 Yes it adds CPU time, but any IP the message passes through gets tested on my system, And a PTR record does not take long to configure at all. on the Webserver. If your Webserver is IIS, why not have it send the mails through the Virtual SMTP server? What about when for XXX reason your Imail-SMTP server was unavailable when the WEB/CGI script was called? The message NEVER gets queued. I personally do install the MS-SMTP server on my web servers, but do not let it deliver directly to the internet either. I Set all CGI/ASP mail scripts to send mail to 127.0.01 or WEB_IP (but on the local machine), Thus the SMTP server is ALWAYS online when that same web server is online. Then under Properties, Delivery, Advanced Smart Host = [192.168.1.1] (brackets stop DNS lookups = save time) -Tom -Original Message- From: Hirthe, Alexander [mailto:[EMAIL PROTECTED]] Sent: Monday, September 23, 2002 10:40 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Junkmail - Spamheaders Hello John, And if I use another tool, the webserver itself has no reverse lookup and no MX entry. It does not need this, because it will only send mail. But why not eliminate one test failure and create a PTR record for it? We are only forwarding the mail from the webserver to IMail, and IMail send's it out. So this PTR would only be for the communication on our internal network. But, hmm, ok, it would fix a part of this problem. And it does only cost me time. And I have the DNS here. I'll try it. ;-) Unless some one else can come up with something different, in this case it would help. Just whitelist the address that the mail is coming from on the Webserver. If your Webserver is IIS, why not have it send the mails through the Virtual SMTP server? First, I don't like Webservers sending direct mail to the world Second, I like virus-proof mails and attachements. (we had user's sending out word files with a macro virus in) Third, I personally don't like the IIS SMTP Server. And I like to have only one logfile to search for errors ;) Alex --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter types and Definitions?
Don't forget HEADERS! I don't see it in the manual, but it was added and I am using it :) -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Monday, September 23, 2002 3:49 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Filter types and Definitions? I was wondering if someone could post the filter types and definitions. For example, I found these and I'm sure there are more. BODY10 CONTAINSif the Body contains a word or phrase HELO10 CONTAINSif the HELO command contains a word or phrase MAILFROM10 CONTAINSif the MAILFROM contains a word or phrase REMOTEIP10 IS if the REMOTEIP IS REVDNS 10 ENDSWITHif REVDNS ENDSWITH SUBJECT 10 CONTAINSif the SUBJECT contains a word or phrase BODY10 CONTAINSif the BODY contains a word or phrase It's in the manual now. You can filter on SUBJECT, HELO, BODY, MAILFROM, REMOTEIP or REVDNS. Those will filter the subject, the HELO/EHLO hostname, the return address, the remote IP address, or the reverse DNS entry of the remote IP address. You can use CONTAINS, STARTSWITH, ENDSWITH, or IS for determining a match. They are pretty much self-explanatory -- IS is an exact match (hi matches just hi, not hi there or I said hi), STARTSWITH looks for something that starts with your filter (hi would match hi or hi there, but not I said hi), ENDSWITH looks for a match at the end (hi would match hi and I said hi, but not hi there), and CONTAINS matches anything that has your filter in it (hi would match hi, I said hi, hi there, and even white). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fine tuning
Lower the weights of the noabuse/nopostmaster tests for one. I think the default is 5 for each. The noabuse/nopostmaster tests fail for most of the big guys (aol.com,earthlink.net,msn.com,etc,etc...) Or You might play by raising the weight of the other tests and trapping/bouncing on a higher WEIGHT. You might want to read the mail-archive as to why bouncing might not be such a good idea. Bouncing can actually add extra load to mail servers as 90% (whatever it is, it's a lot) of junkmail has a FORGED from address, so a single bounce usually adds to multiple bounces until the loop ends. You can also use the beta feature 'filter' to add negative weight for certain providers rather than a complete whitelist. For documentation on the Beta FILTER feature see http://www.mail-archive.com/declude.junkmail@declude.com/msg02791.html And as of 1.57 BETA a few updates were made to the FILTER type http://www.mail-archive.com/declude.junkmail@declude.com/msg03378.html -Tom -Original Message- From: David Dodell [mailto:[EMAIL PROTECTED]] Sent: Tuesday, September 10, 2002 9:55 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Fine tuning I recently implemented using the bounce feature of Junkmail, and spam has dropped 95% however, there are a few users that are trying to send us legtimate email, but their ISP's are listed and failing multiple tests ... ie DSBLMULTI, DNSRBL-SPAM, NOABUSE, NOPOSTMASTER I hate to start making whitelists for each of these people, since that list could become very large very fast ... and obviously telling them their ISP are junk is not going to work ... For example one of them is Bellsouth.net which seems to fail multiple tests ... just whitelist them, but that would allow spam to come through ... Suggestions on how to deal with this? David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ASP/CF/CGI/etc Web Developers....
Title: Message So do I, but you still have to authenticate twice. This was just an idea I had i thought i would share where you only authenticate once (Imail webmail) and can seamlessly integrate your own application with webmail. -Original Message-From: Mark Smith [mailto:[EMAIL PROTECTED]] Sent: Wednesday, September 04, 2002 7:31 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] ASP/CF/CGI/etc Web Developers but the biggest stump can be there is no easy way to check authentication against the IMAIL registry. This isn't so hard if you write a COM .dll object to readfrom the registry. In any case, I don't store passwords in the registry... I use SQL for the IMAIL "database" -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith IncSent: Tuesday, September 03, 2002 11:55 PMTo: '[EMAIL PROTECTED]'Subject: [Declude.JunkMail] ASP/CF/CGI/etc Web Developers The topic has been reachednumerous on this list so I thought I would share an idea I had earlier today that works great with everyone onthis list. Many of you have the idea's of writing your own parsers/interfaces for parts of declude or other parts of imail, but the biggest stump can be there is no easy way to check authentication against the IMAIL registry, or to integrate the features seamlessly into the imail/webmail interface. Any developer can easily validate a session using an IMAIL session without ever needing or knowning the actual password of an account. I have commented my Cold Fusion authorization page [ cf_imail_login.txt ] so that no matter what language you code in you should be able to easily port. For a working example feel free to check my "test" login I make available to this list. http://mail.bsc.net/ login = [EMAIL PROTECTED] pass = declude ( click the "Junkmail" button and you will be sent to an external server, but the interface is identical ) *Note: my working example builds heavily on the attachments I have included. I stripped everything down to the bare logic so everyone can use this to suit their needs. If anyone else finds this information nearly as useful as I did today please let me know. I'm sure this will make using the filters much much simpler for my users. -Tom
RE: [Declude.JunkMail] School system needs advice
Double that. Using declude + sniffer I have not seen a piece of porn get through. Only rarely do I see any spam get through. I would highly suggestion getting sniffer, as much (adult + non-adult) spam often passes all HEADER checks (which is what declude does alone), so you must rely on something that checks the message body (sniffer). Well worth the $$$! (try their Free Demo to get a glimpse of what it does. Keep in mind you are using old body definitions with their demo, and they give almost daily updates once you register). -Original Message- From: Sheldon Koehler [mailto:[EMAIL PROTECTED]] Sent: Tuesday, September 03, 2002 4:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] School system needs advice I need good suggestions, both general and specific. Spam is always going to get through at one time or another. BUT, we have had success adding Sniffer (www.sortmonster.com) into the Declude Junkmail mix. Our local competition uses Postini and the amount of spam that gets by that over priced service is incredible. I have a friend who's work place uses them and he laughs at the amount of spam he does not have to see our service. We also have an IMGate box (http://imgate.meiway.com) as our first line of defense. By doing all of the above, our spam level is very low. I am always tweaking the settings and spend more time on it than I would like. As an ISP, I have to be more open to some of the known junk places for our users that like getting coupons and junk on a daily basis. As a school district, you will be able to get away with rejecting EVERYTHING Sniffer wants to reject. newsletters included as they are not related to school needs. And Sniffer seems to do a great job at catching porno spam!!! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ASP/CF/CGI/etc Web Developers....
Title: Message The topic has been reachednumerous on this list so I thought I would share an idea I had earlier today that works great with everyone onthis list. Many of you have the idea's of writing your own parsers/interfaces for parts of declude or other parts of imail, but the biggest stump can be there is no easy way to check authentication against the IMAIL registry, or to integrate the features seamlessly into the imail/webmail interface. Any developer can easily validate a session using an IMAIL session without ever needing or knowning the actual password of an account. I have commented my Cold Fusion authorization page [ cf_imail_login.txt ] so that no matter what language you code in you should be able to easily port. For a working example feel free to check my "test" login I make available to this list. http://mail.bsc.net/ login = [EMAIL PROTECTED] pass = declude ( click the "Junkmail" button and you will be sent to an external server, but the interface is identical ) *Note: my working example builds heavily on the attachments I have included. I stripped everything down to the bare logic so everyone can use this to suit their needs. If anyone else finds this information nearly as useful as I did today please let me know. I'm sure this will make using the filters much much simpler for my users. -Tom /center !-- END CENTER MAIL SUMMARY TABLE-- pnbsp;/p /td/tr !-- CLOSE MAIN DOCUMENT CELL AND OPEN FOOTER CELL -- trtd table width=100% border=0 cellpadding=0 cellspacing=0 bgcolor=#3399FF tr tdFONT FACE=Arial, Helvetica, sans-serif SIZE=4 /font/font/td/tr /table !-- CLOSE FOOTER COLOR CELL AND MAIN TABLE -- /td/tr /table !-- CLOSE BORDER CELL AND TABLE -- /td/tr /table /body /html How to link back into IMAIL from your web-application. I recommand doing a CFINCLUDE for both your header and footer from within your CF Applcation. To ensure your look fits, just find a webmail template that has as little text as possible, preferabally one with maybe a one-line message to you. (such as no messages) View source, save then replace as needed. Here is an example of your links: a href=http://#mailip##imailuserkey#/logoff.#imailnumber#.cgi; img src=http://#mailip##imailuserkey#/logoffbtn.gif; border=0 alt=Logoff width=74 height=24 /a !--- example header template used in CF to link back to IMAIL Note: I wrote my own template parser which uses double ## rather than singe which is what you will see in this example --- !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN html head TITLEMail Summary: Main/TITLE !--File: MSGSUM.HTML-- /head body bgcolor=#FF topmargin=0 leftmargin=0 a name=Top/a !-- THIS TABLE ENCLOSES THE ENTIRE PAGE CONTENTS WITH A COLORED BORDER-- table width=100% border=0 cellpadding=5 cellspacing=0 tr td align=center bgcolor=#3399FF !-- THIS TABLE ENCLOSES THE ENTIRE PAGE CONTENTS -- !-- OPEN HEADER CELL -- table width=100% border=0 cellpadding=0 cellspacing=0 tr td align=center bgcolor=#3399FFFONT FACE=Arial, Helvetica, sans-serif SIZE=4!-- HEADER MENU -- table width=100% border=0 cellpadding=0 cellspacing=0 trtdFONT FACE=Arial, Helvetica, sans-serif SIZE=4 bMailbox: Main/bnbsp;a name=topnbsp;/anbsp;nbsp; font size=4#chklogin.imailemail#/td tda href=http://##mailipchklogin.imailuserkey##/logoff.##chklogin.imailnumber##.cgi; img src=http://##mailipchklogin.imailuserkey##/logoffbtn.gif; border=0 alt=Logoff width=74 height=24/a /font/font /td/tr trtd colspan=2FONT FACE=Arial, Helvetica, sans-serif SIZE=4 !--Begin SumMenu.cgi This is not an IMAIL tag. Just info-- a href=http://##mailipchklogin.imailuserkey##/menu.##chklogin.imailnumber##.cgi?mbx=Main; img src=http://##mailipchklogin.imailuserkey##/menubtn.gif; border=0 alt=Menu/a a href=http://##mailipchklogin.imailuserkey##/readmail.##chklogin.imailnumber##.cgi?uid=##chklogin.userid##mbx=Main; img src=http://##mailipchklogin.imailuserkey##/checkmail.gif; border=0 alt=Check Mail/a a href=http://##mailipchklogin.imailuserkey##/newmsg.##chklogin.imailnumber##.cgi?uid=##chklogin.userid##mbx=Main; img src=http://##mailipchklogin.imailuserkey##/composebtn.gif; border=0 alt=Compose/a a href=http://##mailipchklogin.imailuserkey##/searchmail.##chklogin.imailnumber##.cgi?uid=##chklogin.userid##mbx=Mainmsg=1; img src=http://##mailipchklogin.imailuserkey##/search.gif; border=0 alt=Search Mail/a a href=##script_name##?cpid=##cpid##p=##p##femail=##femail##a=step2 img border=0 src=http://CFServer.YourServer.Com/images/junkmail.jpg; width=72 height=24 /abr !--End SumMenu.cgi-- /font /td/tr /table !-- END HEADER MENU -- /td/tr !-- CLOSE HEADER CELL AND OPEN MAIN DOCUMENT CELL -- trtd bgcolor=#FF align=centerFONT FACE=Arial, Helvetica, sans-serif BR In order to link to our external mail server correctly a few alterations to the IMAIL templates must
RE: [Declude.JunkMail] Address Book Only in Declude?
Yes, this is how I already accomplished this for my users. I have a cold fusion interface which verified login/password, then manages their rules.ima Anyone they want to allow it writes at the top of the rules.ima... F~[EMAIL PROTECTED]:MAIN Any junk-mail they want to block it sends to SPAM folder H~X-RBL-WARNING:SPAM The problem with authorization is that IMAIL passwords are stored in registry, so you have to make your script verify their password via POP3, or use the IMAIL/REG password Decryption routine that I wrote. Could easily be replicated in .asp as well -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Not to be sarcastic, but wouldn't that be done in a rules.ima file that is configurable by the user? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Thursday, August 29, 2002 7:32 AM To: R. Scott Perry Subject: [Declude.JunkMail] Address Book Only in Declude? I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address book? In my opinion this could be the biggest feature added to Declude at this time. Here's how I'd like it to work: Declude looks at a text cfg file to see if this feature is turned on for a select domain or e-mail account... for example, if in ADDR.CFG email address or domain wyndows.com or [EMAIL PROTECTED] then Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then pass the e-mail to this account, else delete...or return e-mail as rejected.. How soon can I get this, Scott? grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Address Book Only in Declude?
Oh, for an address book only You must also add one last entry at the bottom of rules.ima H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL That will force anything not matched in the above of rules.ima to be deleted Ex: --rules.ima-- H~[EMAIL PROTECTED]:main F~declude.com:main F~[EMAIL PROTECTED]:main H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL --/rules.ima-- Anything that does not match the first 3 lines will be deleted -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:38 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Yes, this is how I already accomplished this for my users. I have a cold fusion interface which verified login/password, then manages their rules.ima Anyone they want to allow it writes at the top of the rules.ima... F~[EMAIL PROTECTED]:MAIN Any junk-mail they want to block it sends to SPAM folder H~X-RBL-WARNING:SPAM The problem with authorization is that IMAIL passwords are stored in registry, so you have to make your script verify their password via POP3, or use the IMAIL/REG password Decryption routine that I wrote. Could easily be replicated in .asp as well -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Not to be sarcastic, but wouldn't that be done in a rules.ima file that is configurable by the user? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Thursday, August 29, 2002 7:32 AM To: R. Scott Perry Subject: [Declude.JunkMail] Address Book Only in Declude? I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address book? In my opinion this could be the biggest feature added to Declude at this time. Here's how I'd like it to work: Declude looks at a text cfg file to see if this feature is turned on for a select domain or e-mail account... for example, if in ADDR.CFG email address or domain wyndows.com or [EMAIL PROTECTED] then Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then pass the e-mail to this account, else delete...or return e-mail as rejected.. How soon can I get this, Scott? grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Address Book Only in Declude?
Excuse the typo everyone, I meant to put a not (!) in that long string H!~THIS... -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:41 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Oh, for an address book only You must also add one last entry at the bottom of rules.ima H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL That will force anything not matched in the above of rules.ima to be deleted Ex: --rules.ima-- H~[EMAIL PROTECTED]:main F~declude.com:main F~[EMAIL PROTECTED]:main H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL --/rules.ima-- Anything that does not match the first 3 lines will be deleted -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:38 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Yes, this is how I already accomplished this for my users. I have a cold fusion interface which verified login/password, then manages their rules.ima Anyone they want to allow it writes at the top of the rules.ima... F~[EMAIL PROTECTED]:MAIN Any junk-mail they want to block it sends to SPAM folder H~X-RBL-WARNING:SPAM The problem with authorization is that IMAIL passwords are stored in registry, so you have to make your script verify their password via POP3, or use the IMAIL/REG password Decryption routine that I wrote. Could easily be replicated in .asp as well -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Not to be sarcastic, but wouldn't that be done in a rules.ima file that is configurable by the user? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Thursday, August 29, 2002 7:32 AM To: R. Scott Perry Subject: [Declude.JunkMail] Address Book Only in Declude? I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address book? In my opinion this could be the biggest feature added to Declude at this time. Here's how I'd like it to work: Declude looks at a text cfg file to see if this feature is turned on for a select domain or e-mail account... for example, if in ADDR.CFG email address or domain wyndows.com or [EMAIL PROTECTED] then Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then pass the e-mail to this account, else delete...or return e-mail as rejected.. How soon can I get this, Scott? grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Address Book Only in Declude?
Ok, I will stop posting on this thread after this. For a working-example on how I have achieved this with imail and cold fusion I have setup a test account. Login = [EMAIL PROTECTED] Pass = declude Manager: http://users.bsc.net/ WebMail: http://mail.bsc.net/ From the manager you can *import* an Outlook Express address book, Or build your own, you can adjust the filter levels, and block individual users. These features just manage the rules.ima, which you can watch by going to the web-mail Interface and clicking Change Processing Rules Anyone on this list is welcome to upload dummy address book's and play with this account I just wanted to demonstrate to others how I have creatively achieved this with IMAIL 6 / Cold Fusion. * note: I built this interface before I became aware of the power of WEIGHT, changing the filter-definitions to work with weights instead of individual headers is on my to-do list, so if anyone actually does look at this please don't flame me on how I could improve that. I am already aware :) -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:44 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Excuse the typo everyone, I meant to put a not (!) in that long string H!~THIS... -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:41 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Oh, for an address book only You must also add one last entry at the bottom of rules.ima H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL That will force anything not matched in the above of rules.ima to be deleted Ex: --rules.ima-- H~[EMAIL PROTECTED]:main F~declude.com:main F~[EMAIL PROTECTED]:main H~THISWILLNEVERMATCHBECAUSEITSAREALLYLONGBOGUSSSTRING:NUL --/rules.ima-- Anything that does not match the first 3 lines will be deleted -Original Message- From: Tom Baker|Netsmith Inc [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:38 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Yes, this is how I already accomplished this for my users. I have a cold fusion interface which verified login/password, then manages their rules.ima Anyone they want to allow it writes at the top of the rules.ima... F~[EMAIL PROTECTED]:MAIN Any junk-mail they want to block it sends to SPAM folder H~X-RBL-WARNING:SPAM The problem with authorization is that IMAIL passwords are stored in registry, so you have to make your script verify their password via POP3, or use the IMAIL/REG password Decryption routine that I wrote. Could easily be replicated in .asp as well -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Address Book Only in Declude? Not to be sarcastic, but wouldn't that be done in a rules.ima file that is configurable by the user? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath Sent: Thursday, August 29, 2002 7:32 AM To: R. Scott Perry Subject: [Declude.JunkMail] Address Book Only in Declude? I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address book? In my opinion this could be the biggest feature added to Declude at this time. Here's how I'd like it to work: Declude looks at a text cfg file to see if this feature is turned on for a select domain or e-mail account... for example, if in ADDR.CFG email address or domain wyndows.com or [EMAIL PROTECTED] then Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then pass the e-mail to this account, else delete...or return e-mail as rejected.. How soon can I get this, Scott? grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from
RE: [Declude.JunkMail] aliases mail forwarding
Easy, instead of mail forwarding use auto-responders but, don't have a response Which the web-messaging won't let you SETUP, but you can view The actual way is via the filenames in the user folder mail forwarding creates a file called D:\imail\domain.com\users\Forward.ima (which contains the destiation address) Instead, use PER MAILBOX forwarding D:\imail\domain.com\users\main.fwd Unless there is a 'spam.fwd' the SPAM mailbox will be retained, while all 'main' mail will be forwarded. (rename forward.ima to main.fwd) -Tom -Original Message- From: Bill B. [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 29, 2002 10:18 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] aliases mail forwarding Scott or whomever, Can you think of any way based on this, to force IMail to retain the message in the sub-mailbox instead of forwarding it? I don't see a way, but I figured I'd ask. Thanks -Original Message- From: Bill B . Sent: Thu, 29 Aug 2002 8:59:39 EDT Subject: Re: [Declude.JunkMail] aliases mail forwarding Here is where I was getting confused... If you use the MAILBOX action, for example: CATCHALLMAILS MAILBOX spam ...when you use this action on an emaill address that has Mail Forwarding turned on, it will still forward the message even though Declude attempts to drop it into the sub-mailbox. I guess that's an IMail thing. Turning on declude debugging shows that it does in fact attempt to put it into the sub-mailbox... 08/29/2002 08:36:55 Q15660575013a39d5 Using [incoming] CFG file d:\imail\Declude\excedentmail.com\wboebel.junkmail. 08/29/2002 08:36:55 Q15660575013a39d5 ...X. 08/29/2002 08:36:55 Q15660575013a39d5 Test #27 [CATCHALLMAILS weight=0] triggered; action = 10 [] 08/29/2002 08:36:55 Q15660575013a39d5 Msg failed CATCHALLMAILS (). 08/29/2002 08:36:55 Q15660575013a39d5 Moving spam to [EMAIL PROTECTED]'s mailbox spam. 08/29/2002 08:36:55 Q15660575013a39d5 AlterRecip( 1, [EMAIL PROTECTED], spam); 08/29/2002 08:36:55 Q15660575013a39d5 AlterRecip: Loading queuefile 08/29/2002 08:36:55 Q15660575013a39d5 AlterRecip: Changing mailbox to spam. Altering queuefile. 08/29/2002 08:36:55 Q15660575013a39d5 Subject: test 3 08/29/2002 08:36:55 Q15660575013a39d5 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 08/29/2002 08:36:55 Q15660575013a39d5 Looping... 08/29/2002 08:36:55 Q15660575013a39d5 Done Looping 08/29/2002 08:36:55 Q15660575013a39d5 AlterRecip( 5, (null), (null)); 08/29/2002 08:36:55 Q15660575013a39d5 AlterRecip: Saving queuefile 08/29/2002 08:36:55 Q15660575013a39d5 X-Note: Sent from [EMAIL PROTECTED] - f7.law4.hotmail.com ([216.33.149.7]). 08/29/2002 08:36:55 Q15660575013a39d5 AlterMessage 08/29/2002 08:36:55 Q15660575013a39d5 Set process priority back to 32. 08/29/2002 08:36:55 Q15660575013a39d5 Adding warning 08/29/2002 08:36:55 Q15660575013a39d5 Final action=0. 08/29/2002 08:36:55 Q15660575013a39d5 d:\imail\spool\Q15660575013a39d5.SMD 08/29/2002 08:36:55 Q15660575013a39d5 Unlocked d:\imail\spool\Q15660575013a39d5.SMD. 08/29/2002 08:36:55 Q15660575013a39d5 Passing to SMTP3: d:\imail\smtp32.exe d:\imail\spool\Q15660575013a39d5.SMD. 08/29/2002 08:36:55 Q15660575013a39d5 Total Time: 312ms -Original Message- From: R. Scott Perry Sent: Thu, 29 Aug 2002 08:17:47 -0400 Subject: Re: [Declude.JunkMail] aliases mail forwarding Yep, I was careful about that. Since I put different text into the warning for the CATCHALLEMAIL test in each $default$.junkmail I was able to reliably tell which configuration was being used for each email. I was very confused up until then, so using the CATCHALLEMAIL test was very handy and a good general debugging idea. In that case, I would suggest using the debug mode, which should help clear this up. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, send an E-mail through like you were before, and then switch back to LOGLEVEL LOW. You can then E-mail me the \IMail\spool\dec.log file (as an attachment), and I can take a look at it to see what is happening. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
RE: [Declude.JunkMail] filter file question
Nods. I like your idea in your last message. I might use similar techniques in some of my scripts I write. -Original Message- From: Madscientist [mailto:[EMAIL PROTECTED]] Sent: Friday, July 26, 2002 1:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] filter file question Regexp is very cpu intensive. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Tom | Baker | Netsmith Inc | Sent: Friday, July 26, 2002 2:43 PM | To: '[EMAIL PROTECTED]' | Subject: RE: [Declude.JunkMail] filter file question | | | Regexp! :) | | Probably wishful thinking, I'm sure writing in pattern | matching would be a hefty involvement. | | | -Original Message- | From: R. Scott Perry [mailto:[EMAIL PROTECTED]] | Sent: Friday, July 26, 2002 1:28 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] filter file question | | | | Scott, I seem to recall reading a while back that in a future release | of Declude JunkMail that quote marks will be supported in the filter | file. Is this correct? This would be a great addition to | the filter | file, as now we periodically catch parts of a work in | another word (it can | be at the beginning, middle, or end of another word), which | we did not | intend to flag. The quote marks around the word could allow | us to specify | to Declude that only exact matches should be flagged. | | Yes, that is something that we are planning to add. That | way, you could | have something like: | | BODY 10 CONTAINS word | | rather than: | | BODY 10 CONTAINS word | | (which would match anotherword). However, this is a | drawback inherent to | filtering: filtering on word won't catch The sentence | ends with your | word. or After the word, there is a comma. (or any of many other | combinations). So although the quotes will reduce false | positives, it may | also reduce the number of hits. | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Declude and Sniffer
Sniffer is great, Declude is great, they compliment each other great! Declude handles all the header checks, While Sniffer looks for patterns in the message body. By running them both I receive almost NO SPAM at all... Try their Demo to get an idea. ( they update their patterns almost daily! So the trial isn't as effective as the commercial version since you can't receive their updates ). -Original Message- From: Jeff Kratka [mailto:[EMAIL PROTECTED]] Sent: Friday, July 26, 2002 3:08 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude and Sniffer Just curious. How many people are using both Declude Junk Mail and the sniffer add-on and has it made a difference if yes. I have been completely pummeled with Spam and am looking for more options. Thanks. Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Negative Weigh..
http://www.mail-archive.com/declude.junkmail@declude.com/msg02791.html (currently, this can be SUBJECT, HELO, BODY, MAILFROM, REMOTEIP or REVDNS), It was your first column, it can ONLY be one of the above (examples:) SUBJECT -5 CONTAINS @text.com HELO -5 CONTAINS @text.com BODY -5 CONTAINS @text.com MAILFROM -5 CONTAINS @text.com REMOTEIP -5 CONTAINS @text.com REVDNS -5 CONTAINS @text.com -Original Message- From: Kami Razvan [mailto:[EMAIL PROTECTED]] Sent: Friday, July 19, 2002 8:03 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Negative Weigh.. Hi Again: So - my interpretation is not correct for thinking that the following line can be extended to NOABUSE, since the following is in the posting of the filter feature [http://www.mail-archive.com/declude.junkmail@declude.com/msg02791.html] REVDNS -5 CONTAINS yahoo.com Or is it because I have added the @ sign to @USAir.com Is the @ sign the problem or something different with NOABUSE? Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Friday, July 19, 2002 8:24 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Negative Weigh.. In applying Negative weight to beta 1.56 - We have: NOABUSE -9 CONTAINS @usairways.com Note that NOABUSE -9 CONTAINS @usairways.com doesn't mean anything to Declude JunkMail. That is the right format for a line in a filter file, but NOABUSE isn't something that Declude JunkMail is able to filter (IE it won't know where to look to find @usairways.com). The first word needs to be a location for Declude JunkMail to try to find the filter text in; for example: MAILFROM -9 CONTAINS @usairways.com Since the WordFilter has a weight of 5 and the NoAbuse has a weigh of 4 so -9 should negate the effect of both. But we get the following in an e-Mail from USAirways. X-Spam-Tests-Failed: NOABUSE, WORDFILTER, WEIGHT10, WEIGHT15, HEUR10 X-Weight: 19 Am I interpreting this right that the -9 is not being applied? If you change it to use MAILFROM instead of NOABUSE, it should work as you expect it to. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: KITHRUP:RE: [Declude.JunkMail] HELO:Declude Console
Actually I do believe I have seen KVM over LAN units (essentially what everyone is talking about), but they are pricy. I'll try to find who made them/where I saw them. -Original Message- From: Mark Smith [mailto:[EMAIL PROTECTED]] Sent: Wednesday, July 17, 2002 8:11 AM To: [EMAIL PROTECTED] Subject: RE: KITHRUP:RE: [Declude.JunkMail] HELO:Declude Console Sorry for the OT conversation :) I could think of a number of corporate helpdesks that would purchase a few of these units. Just think of the money that they would save on travel costs. Ship this unit to the site (even if it had a whole PC Attached to it). Rebuild the WHOLE server (from ground up) and all you would need is a guy to put floppies/CD's in the drives. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist Sent: Wednesday, July 17, 2002 8:59 AM To: [EMAIL PROTECTED] Subject: RE: KITHRUP:RE: [Declude.JunkMail] HELO:Declude Console We've worked on that beast in the lab - it's a side project. Haven't seen one out on the street - maybe it's out there somewhere. The trouble is cost bandwidth. Video capture compression takes a lot of cycles and essentially requires a whole computer to do - a high-end one at that, especially if you want to minimize your updates by looking for changed window features etc... lots of SW/HW. Finally decided to shelve it until we can get custom hardware made to convert the video signals back into reliable bit positions run a specialized sub-processor to recognize key features for the compression engine. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith | Sent: Wednesday, July 17, 2002 8:40 AM | To: [EMAIL PROTECTED] | Subject: RE: KITHRUP:RE: [Declude.JunkMail] HELO:Declude Console | | | I always thought that if someone came out with a device that had KVM | inputs and an Ethernet/modem output that would talk to another | device, it would be the ultimate troubleshooting tool. | | Imagine being able to send this device to a site 1000 miles away and | having total control of the console -- EVEN during BIOS setup. | | Who knows.. Maybe someone's done it. :) | | | | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of | Craig Gittens | Sent: Wednesday, July 17, 2002 8:30 AM | To: [EMAIL PROTECTED] | Subject: RE: KITHRUP:RE: [Declude.JunkMail] HELO:Declude Console | | | Has anyone looked at Remtotely Anywhere? I use it and it | works great. | | http://www.remotelyanywhere.com | | Craig. | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of Todd Ryan | Sent: Wednesday, July 17, 2002 6:51 AM | To: [EMAIL PROTECTED] | Subject: Re: KITHRUP:RE: [Declude.JunkMail] HELO:Declude Console | | | Have you tried TightVNC? (www.tightvnc.com) It was designed for | slow connections and has a few more things tweaked for better | performance. And it's also free. Worth a look... | | TightVNC Features (from their web site): | | Local cursor handling. Cursor movements do not generate screen | updates any more, remote cursor movements are processed locally by | the viewer, so you do not see remote cursor pointer moving too slow | behind the local cursor. | | Efficient compression algorithms. New Tight encoding is optimized | for slow and medium-speed connections and thus generates much less | traffic as compared to traditional VNC encodings. At the same time, | TightVNC supports all the standard VNC encodings, so it can be | easily configured to operate efficiently in fast network | environments too. | | Configurable compression levels. You can choose any appropriate | level of compromise between compression ratios and coding speed, | depending on the your connection speed and processor power. | | Optional JPEG compression. If you don't care too much about perfect | image quality, you can enable JPEG coder which would compress | color-rich screen areas much more efficiently (and image quality | level is configurable too). Web browser access. TightVNC includes | greatly improved Java viewer with full support for Tight encoding, | local cursor feature, 24-bit color mode, and more. The Java viewer | applet can be accessed via built-in HTTP server like in the standard | VNC. | | Operating under Unix and Windows. All new features listed above are | available in both Unix and Win32 versions of TightVNC. | | Advanced Properties dialog in WinVNC. Unlike the standard VNC, | TightVNC gives you a possibility to set a number of advanced | settings directly from the WinVNC GUI, and to apply changed settings | immediately. There is no need to launch regedit to set query | options, connection priority, to allow loopback
[Declude.JunkMail] filter rule update request
Title: Message http://www.mail-archive.com/declude.junkmail@declude.com/msg02791.html (currently, this can be SUBJECT, HELO, BODY, MAILFROM, REMOTEIP or REVDNS), Can we please add HEADER as one of the options? I run Sniffer on postfix infront of Declude and would like to be able to have SNIFFER count as weight, I was expecting to do this based on a filter test [global.cfg] SNIFFERfilterd:\imail\declude\filters\sniffer.txt x 0 0 [sniffer.txt] HEADER20 CONTAINS X-SortMonster-Msg-Sniffer-Match But after it didn't work I went and found that there is no HEADER check I can use This would be great if it could be added to the next beta version! ( I would expect this would take minimal effort) Thank you!
RE: [Declude.JunkMail] list of beta features?
Ok, the filter test, that's what I meant Yes, thank you :) Didn't think to check the global.cfg link DUH -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 11, 2002 1:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] list of beta features? I know all the beta enhancements don't make it to the manual and you can find by digging through the threads here, but is there a beta manual I can use for reference for adding some of the new features? The beta features are just discussed here -- there is no secret location for beta information. I have read numerous threads regaurding the wordfile helobogus tests, and didnt decide to implement them until today... But now I cant find the threads. What is the sytax for defining the HELOBOGUS test and the external wordfile? You can find the syntax for the HELOBOGUS test in the latest config files (the config files do get updated during the beta cycle). There isn't a wordfile, I'm guessing you are referring to the new filtering? http://www.mail-archive.com/declude.junkmail@declude.com/msg02791.html has the information on the filter test type. --- After typing this I looked at my global.cfg, I'm guessing from whats already there helobogus would be HELOBOGUS helobogus x x Y 0 where Y = weight ? That is correct. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Subscription Email failed SPAMHEADERS
Title: Message After trying to subscribe to this list after a while I finally checked my spam folder and saw why I wasnt getting any replies. Kind of amusing the email back from [EMAIL PROTECTED] failed spamheaders. From: [EMAIL PROTECTED]Subject: Confirmation Required (confirmation #00252ab6503e832f6534d44)X-Confirmation: Provided by Declude http://www.declude.comDate: Fri, 21 Jun 2002 06:39:27 -0400Message-Id: [EMAIL PROTECTED]X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420e].X-Declude-Sender: [EMAIL PROTECTED] []X-Declude-Spoolname: D02b712a.SMDX-Note: This E-mail was sent from ([66.189.58.123]).
Re: [Declude.JunkMail] Coldfusion Declude front end?
Title: Message Actually yes, I have written two seperate front ends, as an ISP having a frontend was essential to us. When we first purchased Junkmail Pro I went straight to work for customized versions of \imail\declude\domain.com\user.junkmail After using that for a while and realizing what I really needed was a idiot proof way of managing the \mail\mail_domain_com\users\USER\rules.ima file. The last frontend I wrote does just that, so I erased all my user.JunkMail files so that everyone on my system is using the $default$.Junkmail settings (which is set to WARN on everything for header entries). My frontend has a main menu with 3 options: Filterlevel, Blocked Senders and Approved Senders. When first choosing any of the 3 my script sucks in the current rules.ima into a temporary SQL table (much easier to manage than a text file in CF). The FilterLevel Menu has 5 Choices: Off, Low, Medium, High and Extreme as well as 2 actions (move to SPAM or permanently delete) all 4 actual levels are defined by another SQL table of course, and every level selected gets logged into another table. (so if you update the definitions of the levels you have a log of who has what level and can "push" the new rules.ima to your users). Blocked Senders and Approved Senders work by putting entries in rules.ima to "Move to Main" and "Move to NUL" I haven't written the code to actually "push" updates to your definitions yet, but I would be glad to post my code for both the user.JunkMail and the rules.ima scripts for those interested. From: Matt Robertson Subject: [Declude.JunkMail] Coldfusion Declude front end? Date: Thu, 20 Jun 2002 10:48:28 -0700 Has anyone tried putting a web-based front end on Declude? I just upgraded to JunkMail Pro and am looking for something in ColdFusion. Don't want to have to write it myself if I can avoid it. --Matt Robertson-- MSB Designs, Inc. http://mysecretbase.com
RE: [Declude.JunkMail] Coldfusion Declude front end?
My code is not in a format I am proud to share right now. I am running through putting comments in, and writing a small text file to put up. I'll post the URL to the code by the end of the day. All of my IMAIL domains are stored in a SQL db so anyone using the registry will need to most likely need to do a few modifications, or maybe I can post my registry-sql conversion scripts for Imail as well. (that decrypt passwords too). Thank you, Tom Baker MCSE, CCNP Network Administrator Netsmith, Inc. -Original Message- From: Matt Robertson [mailto:[EMAIL PROTECTED]] Sent: Friday, June 21, 2002 11:00 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Coldfusion Declude front end? Yes, please! I'll post back whatever I come up with as well. --Matt Robertson-- MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, June 21, 2002 4:04 AM To: '[EMAIL PROTECTED]' Subject: Re: [Declude.JunkMail] Coldfusion Declude front end? Actually yes, I have written two seperate front ends, as an ISP having a frontend was essential to us. When we first purchased Junkmail Pro I went straight to work for customized versions of \imail\declude\domain.com\user.junkmail After using that for a while and realizing what I really needed was a idiot proof way of managing the \mail\mail_domain_com\users\USER\rules.ima file. The last frontend I wrote does just that, so I erased all my user.JunkMail files so that everyone on my system is using the $default$.Junkmail settings (which is set to WARN on everything for header entries). My frontend has a main menu with 3 options: Filterlevel, Blocked Senders and Approved Senders. When first choosing any of the 3 my script sucks in the current rules.ima into a temporary SQL table (much easier to manage than a text file in CF). The FilterLevel Menu has 5 Choices: Off, Low, Medium, High and Extreme as well as 2 actions (move to SPAM or permanently delete) all 4 actual levels are defined by another SQL table of course, and every level selected gets logged into another table. (so if you update the definitions of the levels you have a log of who has what level and can push the new rules.ima to your users). Blocked Senders and Approved Senders work by putting entries in rules.ima to Move to Main and Move to NUL I haven't written the code to actually push updates to your definitions yet, but I would be glad to post my code for both the user.JunkMail and the rules.ima scripts for those interested. From: Matt Robertson Subject: [Declude.JunkMail] Coldfusion Declude front end? Date: Thu, 20 Jun 2002 10:48:28 -0700 Has anyone tried putting a web-based front end on Declude? I just upgraded to JunkMail Pro and am looking for something in ColdFusion. Don't want to have to write it myself if I can avoid it. --Matt Robertson-- MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: IPWHOIS:Re[2]: [Declude.JunkMail] Coldfusion Declude front end?
SMTP Auth will not work for your virtual servers, My workaround was to create a master username/password on my primary host username: domainclient password: smtpauth (exactly as listed) And I just give out that username/password to my domain clients who can't seem to use their own local SMTP server. The registry-sql is a combination of perl and cold fusion scripts (I gave up trying to decrypt the passwords in CFM, too much of a bitch). I am going to get this other script published today and dig up my conversion scripts Monday. -Original Message- From: Eje Gustafsson [mailto:[EMAIL PROTECTED]] Sent: Friday, June 21, 2002 12:35 PM To: Tom Baker | Netsmith Inc Subject: IPWHOIS:Re[2]: [Declude.JunkMail] Coldfusion Declude front end? I would love to get a copy of you registry-sql conversion script. I been thinking about doing this change for a while and would be nice to have a way to decrypt the passwords to. BTW is there any drawbacks on using sql database compared to registry ? I think I recall seeing something somewhere about something with virtual servers not working correctly but not sure about version or anything. Are there any such issues if so what are they ? Friday, June 21, 2002, 12:14:23 PM, you wrote: TBNI My code is not in a format I am proud to share right now. I am TBNI running through putting comments in, and writing a small text file TBNI to put up. I'll post the URL to the code by the end of the day. TBNI All of my IMAIL domains are stored in a SQL db so anyone using the TBNI registry will need to most likely need to do a few modifications, TBNI or maybe I can post my registry-sql conversion scripts for Imail as well. (that decrypt TBNI passwords too). TBNI Thank you, TBNI Tom Baker TBNI MCSE, CCNP TBNI Network Administrator TBNI Netsmith, Inc. TBNI -Original Message- TBNI From: Matt Robertson [mailto:[EMAIL PROTECTED]] TBNI Sent: Friday, June 21, 2002 11:00 AM TBNI To: [EMAIL PROTECTED] TBNI Subject: RE: [Declude.JunkMail] Coldfusion Declude front end? TBNI Yes, please! I'll post back whatever I come up with as well. TBNI --Matt Robertson-- TBNI MSB Designs, Inc. TBNI http://mysecretbase.com TBNI -Original Message- TBNI From: [EMAIL PROTECTED] TBNI [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | TBNI Netsmith Inc TBNI Sent: Friday, June 21, 2002 4:04 AM TBNI To: '[EMAIL PROTECTED]' TBNI Subject: Re: [Declude.JunkMail] Coldfusion Declude front end? TBNI Actually yes, I have written two seperate front ends, as an ISP having a TBNI frontend was essential to us. When we first purchased Junkmail Pro I went TBNI straight to work for customized versions of TBNI \imail\declude\domain.com\user.junkmail TBNI After using that for a while and realizing what I really needed was a idiot TBNI proof way of managing the \mail\mail_domain_com\users\USER\rules.ima file. TBNI The last frontend I wrote does just that, so I erased all my user.JunkMail TBNI files so that everyone on my system is using the $default$.Junkmail settings TBNI (which is set to WARN on everything for header entries). TBNI My frontend has a main menu with 3 options: TBNI Filterlevel, Blocked Senders and Approved Senders. TBNI When first choosing any of the 3 my script sucks in the current rules.ima TBNI into a temporary SQL table (much easier to manage than a text file in CF). TBNI The FilterLevel Menu has 5 Choices: Off, Low, Medium, High and Extreme as TBNI well as 2 actions (move to SPAM or permanently delete) all 4 actual levels TBNI are defined by another SQL table of course, and every level selected gets TBNI logged into another table. (so if you update the definitions of the levels TBNI you have a log of who has what level and can push the new rules.ima to TBNI your users). TBNI Blocked Senders and Approved Senders work by putting entries in rules.ima to TBNI Move to Main and Move to NUL TBNI I haven't written the code to actually push updates to your definitions TBNI yet, but I would be glad to post my code for both the user.JunkMail and the TBNI rules.ima scripts for those interested. TBNI From: Matt Robertson TBNI Subject: [Declude.JunkMail] Coldfusion Declude front end? TBNI Date: Thu, 20 Jun 2002 10:48:28 -0700 TBNI Has anyone tried putting a web-based front end on Declude? I just upgraded TBNI to JunkMail Pro and am looking for something in ColdFusion. Don't want to TBNI have to write it myself if I can avoid it. TBNI --Matt Robertson-- TBNI MSB Designs, Inc. TBNI http://mysecretbase.com TBNI --- TBNI [This E-mail was scanned for viruses by Declude Virus TBNI (http://www.declude.com)] TBNI --- TBNI This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, TBNI just send an E-mail to [EMAIL PROTECTED], and type unsubscribe TBNI Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You TBNI can visit our web site at http://www.declude.com . TBNI --- TBNI [This E-mail was scanned for viruses by Declude Virus
