Re: [Declude.JunkMail] abused whitelist?
Hi, I think you're sending this to the wrong place. Who/what company are you looking for? Thanks, Andrew Baldwin an...@thumpernet.com an...@thumpernet.com 315-277-0685 Monday, October 22, 2012, 2:54:29 PM, you wrote: IA IA IA IA IA IA Hi, IA IA IA IA IA IA We have a client that is getting bounced spams. When I check IA the header, it looks like they’re being whitelisted through IA Declude. I checked the whitelisting settings and only have IA “whitelist auth” (autowhitelist is off). Does this mean their IA account is hacked? How else could the spam get whitelisted? IA IA IA IA IA IA Here is the Declude header, although I can’t figure out why the country chain is blank. IA IA IA IA IA X-Declude-Sender: off...@somedomain.com [190.0.103.59] IA X-Declude-Spoolname: D8baa03aac020.smd IA X-Declude-Note: Scanned by Declude 4.2.20 for spam. IA http://www.declude.com/x-note.htm; IA X-Declude-Scan: Score [0] at 11:09:02 on 22 Oct 2012 IA X-Declude-Fail: Whitelisted, ZEROHOUR [0] IA X-Country-Chain: IA IA IA Thanks, IA IA IA IA IA IA Ben IA --- This E-mail came from the Declude.JunkMail mailing list. To IA unsubscribe, just send an E-mail to imail...@declude.com, and type IA unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] abused whitelist?
Hi, aha! Thanks, Andrew Baldwin an...@thumpernet.com an...@thumpernet.com 315-277-0685 Monday, October 22, 2012, 7:53:29 PM, you wrote: DC Hi Andy, DC He sent it to the Declude Junkmail list, of which you are a member. DC However, the list is pretty much defunct. Declude switched to online forums DC years ago, which effectively killed the list. DC Darin. DC -Original Message- DC From: andyb@thumpernet DC Sent: Monday, October 22, 2012 6:03 PM DC To: Declude.JunkMail@declude.com DC Subject: Re: [Declude.JunkMail] abused whitelist? DC Hi, DC I think you're sending this to the wrong place. Who/what company are DC you looking for? DC Thanks, DC Andrew Baldwin DC an...@thumpernet.com DC an...@thumpernet.com DC 315-277-0685 DC Monday, October 22, 2012, 2:54:29 PM, you wrote: IA IA IA IA IA IA Hi, IA IA IA IA IA IA We have a client that is getting bounced spams. When I check IA the header, it looks like they’re being whitelisted through IA Declude. I checked the whitelisting settings and only have IA “whitelist auth” (autowhitelist is off). Does this mean their IA account is hacked? How else could the spam get whitelisted? IA IA IA IA IA IA Here is the Declude header, although I can’t figure out why the country DC chain is blank. IA IA IA IA IA X-Declude-Sender: off...@somedomain.com [190.0.103.59] IA X-Declude-Spoolname: D8baa03aac020.smd IA X-Declude-Note: Scanned by Declude 4.2.20 for spam. IA http://www.declude.com/x-note.htm; IA X-Declude-Scan: Score [0] at 11:09:02 on 22 Oct 2012 IA X-Declude-Fail: Whitelisted, ZEROHOUR [0] IA X-Country-Chain: IA IA IA Thanks, IA IA IA IA IA IA Ben IA --- This E-mail came from the Declude.JunkMail mailing list. To IA unsubscribe, just send an E-mail to imail...@declude.com, and type IA unsubscribe Declude.JunkMail. The archives can be found at DC http://www.mail-archive.com. DC --- DC This E-mail came from the Declude.JunkMail mailing list. To DC unsubscribe, just send an E-mail to imail...@declude.com, and DC type unsubscribe Declude.JunkMail. The archives can be found DC at http://www.mail-archive.com. DC --- DC This E-mail came from the Declude.JunkMail mailing list. To DC unsubscribe, just send an E-mail to imail...@declude.com, and DC type unsubscribe Declude.JunkMail. The archives can be found DC at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] FW: [049-0F7F8DF6-BE66] Invalid ZIP Vulnerability Detected - for no apparent reason
David, This email was sent to the wrong Andy... Thanks, Andy Baldwin From: David Barker [EMAIL PROTECTED] Sent: Wednesday, April 02, 2008 10:09 AM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] FW: [049-0F7F8DF6-BE66] Invalid ZIP Vulnerability Detected - for no apparent reason Hi Andy, Your example is with our engineers. we will get back to you as soon as we have a answer. Should be today. David From: Andy Schmidt [EMAIL PROTECTED] Sent: Tuesday, April 01, 2008 6:34 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] FW: [049-0F7F8DF6-BE66] Invalid ZIP Vulnerability Detected - for no apparent reason Is Declude's support system working? I got a ticket number issued - but there never seems to be a FOLLOW-UP of any sorts? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Friday, March 28, 2008 12:08 PM To: [EMAIL PROTECTED] Subject: re: [049-0F7F8DF6-BE66] Invalid ZIP Vulnerability Detected - for no apparent reason Thank you for submitting a ticket to support. Your ticket number is [049-0F7F8DF6-BE66]. Please keep this ticket number for your records and include it in the subject (including brackets) of all future emails regarding this issue. The response time during business hours is usually within 24 hours, if you have had no response in this time please do not hesitate to call our support number 1-866-332-5833 Thank You. Declude Technical Support view this ticket online --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
interested thanks, andy - Original Message - From: Bud Durland To: Declude List Sent: Wednesday, April 14, 2004 8:58 AM Subject: [Declude.JunkMail] New test I am testing a small external test program. A message fails the test if there is an discernable IP address in the HELO entry of the message. These fail the test: Received: from host-68-212-107-146.msy.bellsouth.net [68.212.107.146] by mrpcap.com Received: from ip-62-129-160-91.evhr.net [62.129.160.91] by mrpcap.com Received: from acs-24-154-41-142.zoominternet.net [24.154.41.142] by mrpcap.comOnly the bolded part of the line (HELO name) is tested. Basically, dashes become 'dots', and anything other than numbers and dots are stripped out. If what remains looks like a valid 4-octet IP address, the test fails.These entries would NOT fail -- stray number make the location of the IP ambiguous Received: from wbar3.lax1-4-8-227-083.dsl-verizon.net [4.8.227.83] by mrpcap.com Received: from c-24-125-42-12.va.client2.attbi.com [24.125.42.12] by mrpcap.com For testing, I set it up with 0 weight and a HOLD action. So far, it has not flagged anything that was not spam.If anyone is interested in trying it out, let me know. I'll probably be putting it up for download from my web site later this week.-- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com ---
Re: [Declude.JunkMail] Whitelisting SPF
Scott, Is PREWHITELIST explained somewhere in more detail? Thanks, Andy Thumpernet - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 31, 2004 7:43 AM Subject: RE: [Declude.JunkMail] Whitelisting SPF I'm getting a lot of fails in the SPF log from my own clients sending via my server, because I haven't added their dialup ranges into their SPF records - the SPF records only contain my server range of addresses. My dialup IPs are all white listed in declude, so with this being the case, should declude not skip the SPF testing? If not would it be possible to do so? To do that, you can add a line PREWHITELIST ON to the \IMail\Declude\global.cfg file. With that line, Declude JunkMail will prevent tests from being run for many of the various types of whitelists (including the WHITELIST IP lines in the global.cfg file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Domain Registrar recommendation
I use OpenSRS - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 31, 2004 2:04 AM Subject: RE: [Declude.JunkMail] OT: Domain Registrar recommendation I use BulkRegister.com John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Friday, January 30, 2004 10:05 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: Domain Registrar recommendation Anyone using a registrar that they like? I want to get some of my clients accounts off of NetSol. I have some registered at www.dotearth.com but I would like a registrar that I can maintain multiple domains from a central interface like at NetSol. Thanks, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Domain Registrar recommendation
OpenSRS is $10/yr - Original Message - From: Michael Graveen [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, January 31, 2004 8:11 AM Subject: Re: [Declude.JunkMail] OT: Domain Registrar recommendation We use DirectNic - $15.00 per year/domain. Easy to administer all you domains. Mike At 12:05 AM 1/31/2004 -0600, you wrote: Anyone using a registrar that they like? I want to get some of my clients accounts off of NetSol. I have some registered at www.dotearth.com but I would like a registrar that I can maintain multiple domains from a central interface like at NetSol. Thanks, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [This E-mail scanned for viruses by Declude Virus] [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] whitelisted
HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
This was whitelisted as it is/was part of the default config file... - Original Message - From: Rick Klinge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:25 PM Subject: RE: [Declude.JunkMail] whitelisted Fwiw.. I would never whitelist any email based solely because they warranted it to be spam free... Email headers can and do get forged all the time. I have recently sent them a letter and a lot of porno and spam email for them to review.. ~Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Tuesday, January 13, 2004 12:13 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. ___ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
I have been reporting as they come up. Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:13 PM Subject: Re: [Declude.JunkMail] whitelisted I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Yes; the pharmacourt.biz spammers have infringed on the Habeas intellectual property rights. Habeas is going after them. Until this dies down, you may want to temporarily comment out the WHITELIST HABEAS line in the \IMail\Declude\global.cfg file. You should also report it to them (the spammer was nice enough to include the URL to report it at in the headers!). Reporting is important because although Habeas knows that this has happened, they are collecting as much information as possible. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
Hi, If people can use Habeas headers to get their spam delivered, then Habeas HAS been compromised. To say otherwise is a symantic difference that I don't care to debate. Bottom line is that Habeus Warrant doesn't mean anything right now. As for a configuration like mine, as I said, this is included in the default config files obtained directly from Declude. Call me ignorant, that's fine. I have to trust the makers of the software to know what they are doing until I find out/learn otherwise. The purpose of the list is to share info. I could have just taken care of this quietly but instead chose to share the issue on the list because if it was happening to me, I'm sure it is happening to others. I'm sorry if my tone sounds a little indignant. I'm not a stupid person, just a busy one with way too much information to process at times. Thanks, Andy - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:46 PM Subject: RE: [Declude.JunkMail] whitelisted Andy, Habeas has not been compromised. Since Saturday, a spammer has been using the Habeas warrant in the headers to get his junk past configurations like yours. This header text is easy to insert. Note that the X-Mailer: header is also being faked. Each of the spams I've seen like this have come through a zombie on a consumer broadband computer. And is advertising one of three domain names. The general consensus is that you shouldn't WHITELIST on any easily forged text, including the Habeas warrant. Check the archive in the last few days for this list for more discussion and sample configurations that have shared. http://www.mail-archive.com/[EMAIL PROTECTED]/ Andrew 8) -Original Message- From: andyb [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 10:13 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] undeliverable email
Hi, When my customers send email that is undeliverable, a lot of the returned undeliverable messages are being caught as spam. Any suggestions for changes that will allow it will go through? failing SPAMHEADERS and BADHEADERS, IPNOTINMX, WEIGHT10 (action HOLD) Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] email blocking
HI, Is there a way to block email from a specific email address, or only one of my customers? Thanks, Andy
Re: [Declude.JunkMail] Web-o-Trust
I think WOT could be very worth while for the 10-15 minutes it takes to setup. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 10, 2003 4:32 PM Subject: Re: [Declude.JunkMail] Web-o-Trust Scott, I looked into this several months ago, but at the time it did not seem to be getting much interest, and still doesn't appear to have much of a following (maybe 100 participants so far on their list). However, I am willing to give it a go. Question, how do we use this with Declude JunkMail in its current form? Something else that is worth mentioning here is that there are a number of IPs that will almost never send spam, but will be likely to get caught as spam. For example, purchase confirmations from eBay, amazon, etc. have a higher likelihood of getting caught than normal E-mail -- but their IPs just don't send out spam. All it takes is one person adding those IPs, and without any work on the part of everyone else, they will be able to get mail from those IPs without a problem. FWIW, we are working on a Windows program to automatically crawl through WOT files and generate sorted IP blacklist files (along with comments showing where the IP came from), without having to figure out how to run Python that the collate program is written in. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] email blocking
Title: Message Is there any way to get this to only log hits? It is logging everything now, from what I can see. I've read the on-line doc, in one place it says it assigns a 1, 100or a 0 for declude. I'm not sure how it is working with the weighting system... I just need to simply blacklist this one email address to this one user Thanks Andy - Original Message - From: Bill To: [EMAIL PROTECTED] Sent: Wednesday, December 10, 2003 5:08 PM Subject: RE: [Declude.JunkMail] email blocking Andy, You may want to take a look at my WAMCHECK program. It is a user level whitelist/blacklist program. Several people have downloaded it and the comments that I have gotten back are positive. Also, ITS FREE. http://www.wamusa.com/wamcheck Thanks, Bill -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andybSent: Wednesday, December 10, 2003 3:57 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] email blocking HI, Is there a way to block email from a specific email address, or only one of my customers? Thanks, Andy
Re: [Declude.JunkMail] Web-o-Trust
Well, Your try it if it doesn't work, or gets abused, you get rid of it.. It just *might* help. - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 10, 2003 6:27 PM Subject: Re: [Declude.JunkMail] Web-o-Trust I'm with Todd here. I see very little value here. I don't have a problem with blocking E-mail from providers that aren't involved in bulk mailing or don't have large communities of unregulated users. This might help with some false positives related to administrator discussions of banned words or techniques, but for normal E-mail traffic I see this as not being of very much use. As with all such networks, as this grows larger, the potential for problems also grows. Spamcop for instance has suffered greatly from a large number of anti-commercialism administrators or people that are just plain irresponsible reporting their spam, and a system like this represents a potential for problems of a similar type, where you are expected to trust an administrator without regard to the content of the messages, the protections that they have in place to prevent misuse, or even their honesty in joining in the first place. There are many of us that have had issues with our customers spamming on occasion, and if you can't trust your own customers, why should you trust the customers of others over whom you have no control over. If these don't currently represent a measurable problem, then why apply a fix which might prevent a future spamming incident from being blocked? I'm not against the idea of having some form of a registry, however the root of the problem is in differentiating among the gray stuff and not among the non-automated stuff. I find value in things like BONDEDSENDER, though to some purists, they view this as legitimizing large commercial spammers because their definition of spam differs from mine. Heck, Kami and I can't even agree on what spam is when it comes to this gray area stuff, and although I trust Kami's opinion on what he considers to be trusted senders, I wouldn't automatically trust his customers, or some list over which he is only in part involved in maintaining. I'm much rather first create a concise definition for spam and a process for review, and then build a list of automated-mailers to trust and not trust, and share that list with a select group of trusted administrators to maintain, and allow other non-trusted administrators to make use of. The list would have to be IP based, and the people would need to be responsible and dedicated to the task, and share the same values, otherwise it would just become another Spews. If someone can show me the value of crediting points to hosts which account for almost none of my mail volume, over which I have no familiarity with their rules and procedures, and for which I am not aware of any substantial problems, I will definitely reconsider my stance. Matt R. Scott Perry wrote: How do the names get added to the list (or web-o-trust)? By getting someone to trust them. For example, we're asking that our customers let us know that they have set up a WOT file, and we add them to our WOT file, which a lot of people already trust. It appears that companies say, I'm not a spammer, trust me! What keeps the spammers of the list? Several things. First is the limitations -- for example, if you trust us (that the IPs we list and the WOT files that we list are all good), but have a feeling that one of our customers may somehow include a spammer's WOT file, you can use include http://www.declude.com/web-o-trust.txt 2, which will trust us (1) and our customers (2). But it will not trust IPs that our customers trust. Second is omit. If we find that somehow a spammer gets a WOT file that our WOT file trusts, we can omit it (omit http://www.spammer_domain.com/web-o-trust.txt ). But, it would be a real hassle for a spammer to do this -- they typically have lots of compromised servers that they would need to list, and would need to find someone to trust them. Even if they find someone to trust them, they won't have any idea how many people are whitelisting them (since many people will use the limits). Then, once they are caught, they will quickly be removed. Of course, only time will tell how effective it really turns out to be. I think it has a lot of promise. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail
Re: [Declude.JunkMail] Web-o-Trust
That is way too broad and general a statement. My server doesn't NOT allow most spam to pass. I would think most mail admins that would take advantage of WOT would already have their servers setup so they would pass most spam tests anyways. Why whitelist senders that wouldn't have failed your spam tests in the first place or that you don't get mail from? - Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MONKEYFORMMAIL, MONKEYPROXIES
Hi, I noticed this test in my config file, but there are no longer in the Declude default config files... Are they still valid tests? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOLD and WARN
Hi, I'm using SPAMCOP as part of the weighting system and as a HOLD action by itself. Because of this, In spamreview it shows a total WEIGHT but SPAMCOP isn't listed, though I know it added to the WEIGHT because of the spamlog. I take it that's just how it is? IS there a way to have it show in SPAMREVIEW as a failed test, but still keep the HOLD action? I believe if I change it to WARN, it will show in Spam Review... Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
I've got it in and running...seems to be helping already. - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 5:34 PM Subject: Re: [Declude.JunkMail] sniffer Absolutely! It has been a very nice addition to our spam arsenal. Bill - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:36 PM Subject: [Declude.JunkMail] sniffer Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] can this be done?
Hi, Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] can this be done?
Kami, That's way too complicated for my simple mind. I have no idea what is happening in the example. Simple is way better and fits my less than genius IQ. If that's the only way, I'll just make SPAMCOP have a weight of 10, then it will HOLD. I was hoping I could do it by putting a HOLD action on SPAMCOP, but it could be added to the WEIGHT tests also. Thanks, Andy - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, November 30, 2003 10:17 AM Subject: RE: [Declude.JunkMail] can this be done? Hi Andy: We do this by using weightrange. We simply add a weight that is way out of the range of other tests, e.g. 1000 Then we bracket the tests and apply different actions on different ranges. When you use this type of weighing.. For example every test is 1 or 2 or 20.. The collection of all tests can never get to 1000 - so a single test can be gated and picked up using weight range easily.. This is an example of what we have in the global.cfg. WEIGHT15-19s weightrange x x 15 19 WEIGHT15-19c weightrange x x 15 19 WEIGHT20s weight x x 20 0 WEIGHT20r weight x x 20 0 WEIGHT60-999 weightrange x x 60 999 WEIGHTIMGFXs weight x x 1000 0 WEIGHTIMGFXr weight x x 1000 0 WEIGHT1100-1500 weightrange x x 1100 1500 Then in the default$ we take action on each of these ranges separately. Please note: s suffix is for adding to the subject a note and the r is for other actions. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Sunday, November 30, 2003 9:09 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] can this be done? Hi, Can I make a test (like SPAMCOP) be included in the weighting system, but also be a HOLD action by itself? So, if it fails SPAMCOP it will be held, but if the total wieght exceeds the DELETE threshold, it will be deleted. Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Version / Internmediate Policy
All this conversation about betas/releases, etc. Scott, you have the patience of a saint at times. Do what you think is best. You can never keep everyone happy all the time. Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 27, 2003 8:43 PM Subject: Re: [Declude.JunkMail] Version / Internmediate Policy Yep, has happened to me a few times during beta testing. I'm investigating some issue, invest time to dig through logs, report the problem - just to be told oh, that was fixed in interim release xx. Duh! Thank's for warning me. Remember, though, that it was the same way back with just betas and released versions -- after a beta came out, if you reported a bug that we already knew about and had fixed, our answer would be Oh, we know about that, the next beta will take care of it. That would be worse -- you lose the same as you do with interim releases (investing time to analyze and report the problem), but also don't get a fix right away. Yes, it would be nice if we had a list of bug fixes for this very purpose (Known bugs). That is something we will look into. If it is done, though, it will most likely just be These are the bugs that are fixed in the latest interim release, without specifying which interim release fixed it, and the list could be updated less frequently than the interim releases come out. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] holding not deleting
Hi, I have one customer that has a virtual domain. Even though this [EMAIL PROTECTED] is receiving email that exceeds my DELETE threshold, the messagages are only being HELD. Any idea why this is happening? I don't have any special rules setup for this customer under Declude that I can find. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
Hi, I'm holding on 7, deleting on 14 (I didn't change the labels on the tests, they still say WEIGHT10 for HOLD and WEIGHT20 for DELETE). Here, the weight is 18 and should delete, but does not. I see in Spam review that it has exceeded the DELETE threshold also, but it is not being deleted. This is only happening for this *one* customer who has a virtual domain. Thanks, ANdy Here is what spam review reports: X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?69.6.42.52 X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL6636 X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MYFILTER: Message failed MYFILTER test (17) X-RBL-Warning: Total weight: 11 Log file entry 11/28/2003 12:52:24 Q8b540ec MYFILTER:11 . Total weight = 11 11/28/2003 12:52:24 Q8b540ec Msg failed IPNOTINMX (). Action=WARN. 11/28/2003 12:52:24 Q8b540ec Msg failed MYFILTER (Message failed MYFILTER test (17)). Action=WARN. 11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or exceeds the limit of 7.). Action=HOLD. 11/28/2003 12:52:24 Q8b540ec Subject: Learn a new Language in 10 days 11/28/2003 12:52:24 Q8b540ec From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 2nd example Log file 11/28/2003 12:47:40 Q8a3b11e MYFILTER:10 . Total weight = 10 11/28/2003 12:47:40 Q8a3b11e Msg failed IPNOTINMX (). Action=WARN. 11/28/2003 12:47:40 Q8a3b11e Msg failed MYFILTER (Message failed MYFILTER test (6)). Action=WARN. 11/28/2003 12:47:40 Q8a3b11e Msg failed WEIGHT10 (Weight of 10 reaches or exceeds the limit of 7.). Action=HOLD. 11/28/2003 12:47:40 Q8a3b11e Subject: Easy Mortgage Shopping, Apply Free, Any Credit Accepted 11/28/2003 12:47:40 Q8a3b11e From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 208.7.129.160 ID: A05A8049D Spam review X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9187 X-RBL-Warning: WEIGHT10: Weight of 14 reaches or exceeds the limit of 10. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MYFILTER: Message failed MYFILTER test (6) X-RBL-Warning: Total weight: 10 - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 11:37 AM Subject: RE: [Declude.JunkMail] holding not deleting Logs and headers. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of andyb Sent: Friday, November 28, 2003 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] holding not deleting Hi, I have one customer that has a virtual domain. Even though this [EMAIL PROTECTED] is receiving email that exceeds my DELETE threshold, the messagages are only being HELD. Any idea why this is happening? I don't have any special rules setup for this customer under Declude that I can find. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
Yes, they correspond. I checked the name, Q8b540ec.SMD, etc. Same in both spam review and the log file. That's how I found the specific log file entry. This is only happening for this one email address: [EMAIL PROTECTED] Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 1:46 PM Subject: Re: [Declude.JunkMail] holding not deleting I'm holding on 7, deleting on 14 (I didn't change the labels on the tests, they still say WEIGHT10 for HOLD and WEIGHT20 for DELETE). Are you sure? X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. This line in the headers means that Declude JunkMail used the WARN action for the WEIGHT10 test. But: Log file entry 11/28/2003 12:52:24 Q8b540ec MYFILTER:11 . Total weight = 11 11/28/2003 12:52:24 Q8b540ec Msg failed IPNOTINMX (). Action=WARN. 11/28/2003 12:52:24 Q8b540ec Msg failed MYFILTER (Message failed MYFILTER test (17)). Action=WARN. 11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or exceeds the limit of 7.). Action=HOLD. 11/28/2003 12:52:24 Q8b540ec Subject: Learn a new Language in 10 days 11/28/2003 12:52:24 Q8b540ec From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] This shows that it used the HOLD action. Are you *positive* that these log file entries correspond with that E-mail? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
In $junkmail$.junkmail I have WEIGHT10HOLD WEIGHT20DELETE All of the other tests are WARN. In Global.cfg all tests are WARN. Is that correct? Still, the issue seems to be confined to this one [EMAIL PROTECTED] Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 1:46 PM Subject: Re: [Declude.JunkMail] holding not deleting I'm holding on 7, deleting on 14 (I didn't change the labels on the tests, they still say WEIGHT10 for HOLD and WEIGHT20 for DELETE). Are you sure? X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. This line in the headers means that Declude JunkMail used the WARN action for the WEIGHT10 test. But: Log file entry 11/28/2003 12:52:24 Q8b540ec MYFILTER:11 . Total weight = 11 11/28/2003 12:52:24 Q8b540ec Msg failed IPNOTINMX (). Action=WARN. 11/28/2003 12:52:24 Q8b540ec Msg failed MYFILTER (Message failed MYFILTER test (17)). Action=WARN. 11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or exceeds the limit of 7.). Action=HOLD. 11/28/2003 12:52:24 Q8b540ec Subject: Learn a new Language in 10 days 11/28/2003 12:52:24 Q8b540ec From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] This shows that it used the HOLD action. Are you *positive* that these log file entries correspond with that E-mail? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
I'm looking at Weight of 18 reaches or exceeds the limit of 10. It it is 18, it also exceeds 14, the limit I delete at Thanks, andy - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 2:29 PM Subject: RE: [Declude.JunkMail] holding not deleting Here is what spam review reports: X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?69.6.42.52 X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL6636 X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MYFILTER: Message failed MYFILTER test (17) X-RBL-Warning: Total weight: 11 Is this what you are looking at, the 17 here: X-RBL-Warning: MYFILTER: Message failed MYFILTER test (17) That is the line number in the MYFILTER test that caused it to be caught, not the weight. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
1.76i6 I'm only running one email server. Do you want me to send me my config files ( I do have a support contract). Thank, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 2:37 PM Subject: Re: [Declude.JunkMail] holding not deleting Yes, they correspond. I checked the name, Q8b540ec.SMD, etc. Same in both spam review and the log file. That's how I found the specific log file entry. What version of Declude are you running (\IMail\Declude -diag from a command prompt will show you)? I've never heard of any cases where Declude JunkMail logged that it would use the HOLD action (and did), but also used the WARN action. Also: X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. 11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or exceeds the limit of 7.). Action=HOLD. note that the log file shows the weight as 11, but the E-mail headers shows the weight as 18. But wait, there is more: X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. X-RBL-Warning: Total weight: 11 Now, we see two different weights. Could the E-mail be going through 2 different mailservers running Declude? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
I have the weight10 set to HOLD at 7 weight20 test set to DELETE at 14 weight10 and weight20 are just labels, that's all - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 2:39 PM Subject: Re: [Declude.JunkMail] holding not deleting X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. 11/28/2003 12:52:24 Q8b540ec Msg failed WEIGHT10 (Weight of 11 reaches or exceeds the limit of 7.). Action=HOLD. Something really weird is going on here. The E-mail header shows the WEIGHT10 test as catch mail with a weight of 10 or higher, but the log file shows it as catching mail with a weight of 7 or higher. The WEIGHT10 test can do one or the other, but not both. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
Hi, I sent the config files ot [EMAIL PROTECTED] Thanks, andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 3:03 PM Subject: Re: [Declude.JunkMail] holding not deleting 1.76i6 I'm only running one email server. Do you want me to send me my config files ( I do have a support contract). If you could send the config files, that would be helpful. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] holding not deleting
Here is the config file section: XINHEADER X-RBL-Warning: Total weight: %WEIGHT% XOUTHEADER X-RBL-Warning: Total weight: %WEIGHT% XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. XINHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] XOUTHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. XSENDER ON XSPOOLNAME OFF XOUTHEADER Organization: Thumpernet XOUTHEADER X-Note: Please report abuse to [EMAIL PROTECTED] #IPBYPASS 127.0.0.1 -- Original Message -- From: Colbeck, Andrew [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Fri, 28 Nov 2003 12:01:30 -0800 Andy, what is your global.cfg line that produces the total in the header? It doesn't look line mine, and SpamReview has a very specific requirement to report the correct value, e.g. XOUTHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. (my implementation of IMail is as a gateway, so everything is OUT. You may be using XINHEADER.) Also, how about taking apart the rest of the log and your config files and adding up the math manually? Andrew 8) -Original Message- From: andyb [mailto:[EMAIL PROTECTED] Sent: Friday, November 28, 2003 11:51 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] holding not deleting I'm looking at Weight of 18 reaches or exceeds the limit of 10. It it is 18, it also exceeds 14, the limit I delete at Thanks, andy - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 2:29 PM Subject: RE: [Declude.JunkMail] holding not deleting Here is what spam review reports: X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?69.6.42.52 X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL6636 X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MYFILTER: Message failed MYFILTER test (17) X-RBL-Warning: Total weight: 11 Is this what you are looking at, the 17 here: X-RBL-Warning: MYFILTER: Message failed MYFILTER test (17) That is the line number in the MYFILTER test that caused it to be caught, not the weight. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] holding not deleting
Ok, But there is only one email server...I think the weird thing is that of the 20 virtual domains and 500 or so email boxes, this is only happening for this *one* email address Did you see anything else wrong in my config files? Thanks, andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 3:32 PM Subject: Re: [Declude.JunkMail] holding not deleting I sent the config files ot [EMAIL PROTECTED] The only thing that makes sense here is that the E-mail is going through another server running Declude JunkMail. Otherwise: X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10. X-RBL-Warning: Total weight: 11 The WEIGHT10 test would have the wrong total weight of the E-mail, and the wrong weight for the test. The chances of some type of bug in Declude JunkMail changing the trigger weight of the test from 7 to 10 -- the default value -- is extremely small. The chances of that happening *and* Declude JunkMail corrupting the actual weight from 11 to 18 and then back to 11 is nearly non-existent. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %TESTSFAILED%
Would anyone care to post an example so I can see the math? I still don't get how to use IPNOTINMX properly. Thanks, andy - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 28, 2003 1:24 AM Subject: RE: [Declude.JunkMail] %TESTSFAILED% In the case of IPNOTINMX and NOLEGITCONTENT, it works just the opposite. If the messages fails, no weight is added or subtracted. If the test passes, the negative weight is subtracted. Therefore, if one of those tests is listed under %TESTSFAILED%, it means nothing was done. Likewise, the actions for those tests should be INGNORE or LOG only, as again if the tests failed means nothing. Only if the messages passes the test is weight subtracted. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Thursday, November 27, 2003 7:57 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] %TESTSFAILED% Scott I do not think it is a good idea to hide tests like ipnotinmx, because we wont know their weight contribution we need a hidetest when weight =0, but that will show the negative value when passed test something like %weightnot0test% variable with all tests that contributed to the total weight (negative, positive, passed, or failed) this will show ipnotinmx and nonlegitcontent type tests whey they pass Hope you understand what i'm trying to say - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 19, 2003 7:01 PM Subject: Re: [Declude.JunkMail] %TESTSFAILED% Any progress/word on when certain tests can be excluded from this variable? This will be in the next release. :) The next release will allow for an option HIDETESTS in the global.cfg file (the default setting will be HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT), which will prevent those tests from showing up in the X-Spam-Tests-Failed: header. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BODY STARTSWITH
Scott, Is there a summary of the new tests, what they do and how to use them? It's almost like there needs to be class to go to, for setting up filters. Today I discovered that some of the adjustments I've made to config files were catching legitimate list serv mailand so it goes. Is there a way to not have to learn the hard way? Is there a way to glean the experience/knowledge/setup files from you or others so that the wheel doesn't continually have to be re-invented? I know there is are base config files on your web site, but they are just that, basic. Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 25, 2003 6:41 PM Subject: RE: [Declude.JunkMail] BODY STARTSWITH Very kool addition but I'm having trouble with MAXWEIGHT Gotta be simple but I just don't get it: DJMPro v1.76i27 I created a filter called testfilter.txt it contains SKIPIFWEIGHT 40 MAXWEIGHT 20 HEADERS 1 CONTAINSfrom This should [1] skip the test completely if the weight is 40 or higher before the test is run, and [2] set the maximum weight for the test to 20 (which will also stop processing and set the weight to 20 if the weight reaches or exceeds 20 during processing of the filter). I sent myself an email. Total weight of the email was -5 The above filter did not kick off What confuses me here is: *BUT* if I changed the SKIPIFWEIGHT to 400 the filter did execute. 11/25/2003 17:59:05 Qdeb405260116f421 Msg failed TESTFILTER (Message failed TESTFILTER test (line 3, weight -1)). Action=IGNORE. This is showing that the test is adding -1 to the weight. Is the TESTFILTER test set up to start with a weight of -2 (in the test definition line in the global.cfg file)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] one more try...
Thanks everyone, I have it working. It was also necessary to go to the $defualt$.junkmail config file and add MYFILTER WARN so I could see the results in spam review. Thanks, Andy
[Declude.JunkMail] one more try...
Hi all, I've asked a couple of times over the past couple of weeks, but thought I'd ask one more time... I get a lot of spam with return addresses that start with b. ie: [EMAIL PROTECTED] Is there anyway to filter that in declude or in the Imail kill list? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] one more try...
to be sure, the syntax would be: in Global.cfg: MYFILTER filter C:\IMail\Declude\myfilter.txt x x 5 0 In myfilter.txt: MAILFROM5STARTSWITH b. Isn't this adding the weight of 5 twice? I'd like it to only be added once. Upon reading the on-line junk mail manual, this point isn't clear. First time using the filter file. I'm using a dual weight system, 1st tier is hold, 2nd tier deletes. Thanks, andy - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 6:03 PM Subject: RE: [Declude.JunkMail] one more try... Filter file. MAILFROM (weighttoadd) STARTSWITH b. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of andyb Sent: Wednesday, November 05, 2003 2:53 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] one more try... Hi all, I've asked a couple of times over the past couple of weeks, but thought I'd ask one more time... I get a lot of spam with return addresses that start with b. ie: [EMAIL PROTECTED] Is there anyway to filter that in declude or in the Imail kill list? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] one more try...
So, the line MYFILTER filter C:\IMail\Declude\myfilter.txt x x 5 0 should have 2 x's because of the 2 tiered weighting system I'm using? Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, November 05, 2003 7:13 PM Subject: Re: [Declude.JunkMail] one more try... to be sure, the syntax would be: in Global.cfg: MYFILTER filter C:\IMail\Declude\myfilter.txt x x 5 0 In myfilter.txt: MAILFROM5STARTSWITH b. That would work fine. Isn't this adding the weight of 5 twice? I'd like it to only be added once. Yes, that would add the weight twice. The total weight for the test is a combination of the general weight for the test (the 5 in the MYFILTER filter line) plus the weight for each line that matches (the MAILFROM 5 line). In this case, you might instead want to use: MAILFROM0STARTSWITH b. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] false positives
Scott.. Wow, that changes a lot. I knew something was going on with Verisign. Is there a technical description somewhere of what they did so I can catch up? Do you have new default config files listed on your website that incorporate the latest changes needed. Once again, the support of the product make it all work it. Greatly appreciated. Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, October 13, 2003 2:33 PM Subject: Re: [Declude.JunkMail] false positives I'm getting a lot of false positives because of HELOBOGUS and MAILFROM issues. If you are running v1.76, you should download the latest interim release from http://www.declude.com/release/176i/declude.exe . This is happening as one of the many side-effects of bad old Verisign's attempt to hijack traffic to all unregistered .com/.net domains. The latest interim release takes care of this problem. X-RBL-Warning: OSRELAY: Please stop using relays.osirusoft.com While you're at it, you should remove all lines that begin with OS from your Delude JunkMail config files -- the Osirusoft tests died a few months back, after spammers attacked them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] getting bombed?
Title: eBay - scam.. Is everyone getting bombed by spam, or is it just me? CPU usage was at 100%, caused by multiple declude.exe processes running. I rebooted, cleared the queue and it seems to be OK now. Never had any issues until a couple of days ago. Andy - Original Message - From: Kami Razvan To: [EMAIL PROTECTED] Sent: Thursday, October 02, 2003 4:06 AM Subject: [Declude.JunkMail] eBay - scam.. Hi; An interesting email was just caught with a barely hold value. It is asking for the recipient to click to update their eBay records. The only URL in the body that is suspicious is: info-update-ebay.com The Whois is anything but eBay. The email has full eBay logo and TRUSTe information - coming with links from eBay. This is the way the email starts.. Your eBay account is in jeopardy! To secure your account please continue by clicking the link below. Secure your eBay account now! = Has anyone else seen this? You may want to filter that URL. Regards, Kami
[Declude.JunkMail] whitelist
How do I white list all of my IP addresses? The line I had in there is not working. thanks, andy
Re: [Declude.JunkMail] spam review
Can you give me the syntax for that? - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 26, 2003 12:37 PM Subject: RE: [Declude.JunkMail] spam review How do I get the Weight: to show? Andy, It's not the answer but maybe this will also work for you. I've configured Declude to add the weight to the subject-line from a certain weight on. WEIGHT75 SUBJECT [spam%WEIGHT%] We hold on 100 and can now see immediatly the weight and also sort by this weight. This makes it much easier to search for FP's because our experience shows that all messages above 200 points can be deleted without any further control. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spam review
Yes, that part I already have. But I already have WEIGHT10 HOLD and WEIGHT20 DELETE What is the syntax for getting the weight in the subject line? thanks, andy - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 26, 2003 2:08 PM Subject: RE: [Declude.JunkMail] spam review Can you give me the syntax for that? Assuming you have configured 2 weight tests like WEIGHT10 WEIGHT20 in your global.cfg file and you want to hold on 20 points: Set the two actions WEIGHT10 SUBJECT [spam%WEIGHT%] WEIGHT20 HOLD in your $default$.junkmail file. (Note the space after the ] !) This will add a [spamXX] to the subject line of every message collecting at least 10 points. Any massage above 20 points will be moved to the hold folder. Now you can list all hold messages with spam review and see the weight of every message in the subject-column. Hope this helps Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] log entry question
I just upgraded today, so hadn't seen it b4 - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, June 03, 2003 4:40 PM Subject: RE: [Declude.JunkMail] log entry question The message was delivered to 18 remote addresses. I asked the question a couple of weeks earlier. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of andyb Sent: Tuesday, June 03, 2003 2:28 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] log entry question In the log file, what does this mean? 06/03/2003 16:22:12 Q036a29a R1 Message OK 06/03/2003 16:22:12 Q036a29a R2 Message OK 06/03/2003 16:22:12 Q036a29a R3 Message OK 06/03/2003 16:22:12 Q036a29a R4 Message OK 06/03/2003 16:22:12 Q036a29a R5 Message OK 06/03/2003 16:22:12 Q036a29a R6 Message OK 06/03/2003 16:22:12 Q036a29a R7 Message OK 06/03/2003 16:22:12 Q036a29a R8 Message OK 06/03/2003 16:22:12 Q036a29a R9 Message OK 06/03/2003 16:22:12 Q036a29a R10 Message OK 06/03/2003 16:22:12 Q036a29a R11 Message OK 06/03/2003 16:22:12 Q036a29a R12 Message OK 06/03/2003 16:22:12 Q036a29a R13 Message OK 06/03/2003 16:22:12 Q036a29a R14 Message OK 06/03/2003 16:22:12 Q036a29a R15 Message OK 06/03/2003 16:22:12 Q036a29a R16 Message OK 06/03/2003 16:22:12 Q036a29a R17 Message OK 06/03/2003 16:22:12 Q036a29a R18 Message OK Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] yahoo as spam
Hi, I have a customer, she is sending email from her yahoo account to her email address here. It is being caught as spam, as per included log entries. Good ole yahoo, not RFC compliant as the postmaster and abuse email addresses. I have also included my config files. This config has worked very well in the past, almost no false positives and catching approx 85% of all spam. Comments for improvement, please. Thanks, Andy 06/02/2003 05:51:08 Q1e0a290 FIVETENSRC:5 NOPOSTMASTER:3 NOABUSE:2 . Total weight = 10 06/02/2003 05:51:08 Q1e0a290 Msg failed FIVETENSRC (184.129.136.216.blackholes.five-ten-sg.com.). Action=IGNORE. 06/02/2003 05:51:08 Q1e0a290 Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=IGNORE. 06/02/2003 05:51:08 Q1e0a290 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=IGNORE. 06/02/2003 05:51:08 Q1e0a290 Msg failed WEIGHT10 (Weight of 10 reaches or exceeds the limit of 10.). Action=HOLD. 06/02/2003 05:51:08 Q1e0a290 Subject: Fwd: RE: Ed Tech Day / Joyce Carol Oates 06/02/2003 05:51:08 Q1e0a290 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] $default$.junkmail BLACKLIST DELETE OSDUL HOLD OSSOFT HOLD ORDBHOLD SPAMCOP HOLD ZONEIN HOLD MAILFROMHOLD SPAMROUTING HOLD PERCENT HOLD WEIGHT10HOLD # Global.cfg: Declude JunkMail configuration file CODE XXX LOGFILE D:\Imail\spool\spam.log LOGLEVELMID LOG_OK NONE HOP 0 DNS 216.153.138.61 CONSOLE OFF IPBYPASS216.153.138.61 # NS1_Thumper XSENDER ON XSPOOLNAME ON XINHEADER X-Note: Checked for SPAM and Viruses by Thumpernet - http://www.thumpernet.com XINHEADER X-note: Total spam weight of the emai is %WEIGHT% XOUTHEADER X-Note: Please send abuse reports to [EMAIL PROTECTED] BLACKLIST fromfile d:\imail\declude\blacklist.txt OSRELAY ip4rrelays.osirusoft.com127.0.0.2 2 0 OSDUL ip4rrelays.osirusoft.com127.0.0.3 OSSRC ip4rrelays.osirusoft.com127.0.0.4 5 0 OSSOFT ip4rrelays.osirusoft.com127.0.0.6 OSLIST ip4rrelays.osirusoft.com127.0.0.7 3 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 FIVETENSRC ip4rblackholes.five-ten-sg.com 127.0.0.2 5 0 FIVETENDUL ip4rblackholes.five-ten-sg.com 127.0.0.3 5 0 FIVETENOPTINip4rblackholes.five-ten-sg.com 127.0.0.4 3 0 FIVETENOTHERip4rblackholes.five-ten-sg.com 127.0.0.5 5 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 2 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 MAILFROMenvfrom BADHEADERS badheaders x x 4 0 SPAMHEADERS spamheaders x x 4 0 SPAMROUTING spamrouting HEUR10 heuristics 10 x 5 0 PERCENT percent WEIGHT10weight x x 10 0 WHITELIST FROM [EMAIL PROTECTED] WHITELIST FROM @MAILER-DAEMONitrogen.packetcity.com WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST IP 216.153.138.# Anything from our address space WHITELIST FROM@go2france.com WHITELIST FROM@mail.go2france.com WHITELIST FROM@list.ipswitch.com WHITELIST FROM@declude.com WHITELIST FROM@signup.universalstudios.com #For JGL 1/4/02 WHITELIST FROM @listserv.usairways.com #For Rita 1/4/02 WHITELIST FROM@centro.org #for [EMAIL PROTECTED] 1/7/02 WHITELIST FROM @upstate.edu #for lisa b 2/5/02 WHITELIST FROM @listsrv02.usairways.com WHITELIST FROM @registrars.com WHITELIST FROM @hammond-irving.com #reported to spamcop WHITELIST FROM @hillside.com #Peg 02/12/02 WHITELIST FROM [EMAIL PROTECTED] #Peg 02/22/02 WHITELIST FROM @youngliving.com #Peg 02/27/02 WHITELIST FROM @irco.com #Peg 03/06/02 WHITELIST FROM @TerritoryMortgage.com #Peg 04/04/02 WHITELIST FROM @territoryloan.com #Peg 05/30/02 WHITELIST FROM @skf.com #Peg 06/12/02 WHITELIST FROM @paypal.com #Peg 07/10/02 WHITELIST FROM [EMAIL PROTECTED] #Peg 08/08/02 WHITELIST FROM @usa.redcross.org #Peg 08/19/02 WHITELIST FROM [EMAIL PROTECTED] #Peg 09/19/02 WHITELIST FROM [EMAIL PROTECTED] #for k O'Hara 1/6/03 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] yahoo as spam
Ok, This is good for general info. Care to me more specific? - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, June 02, 2003 11:36 AM Subject: RE: [Declude.JunkMail] yahoo as spam Catching almost no FP with holding at 10? I don't think so. Anything coming from Yahoo.com will then automatically be at half of your hold weight. This is a known problem with Yahoo. Couple of recommendations. Change your weighting setup. Setup a white filter. User another external program to help whitelist. (Sorry, cheap plug.) Adjust your weights. Setup a grey filter. Etc. Also, SpamCop has been discussed a couple of times in IMO does not warrant a HOLD. Personally, I do not use FIVTENSCR. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of andyb Sent: Monday, June 02, 2003 10:16 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] yahoo as spam Hi, I have a customer, she is sending email from her yahoo account to her email address here. It is being caught as spam, as per included log entries. Good ole yahoo, not RFC compliant as the postmaster and abuse email addresses. I have also included my config files. This config has worked very well in the past, almost no false positives and catching approx 85% of all spam. Comments for improvement, please. Thanks, Andy 06/02/2003 05:51:08 Q1e0a290 FIVETENSRC:5 NOPOSTMASTER:3 NOABUSE:2 . Total weight = 10 06/02/2003 05:51:08 Q1e0a290 Msg failed FIVETENSRC (184.129.136.216.blackholes.five-ten-sg.com.). Action=IGNORE. 06/02/2003 05:51:08 Q1e0a290 Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=IGNORE. 06/02/2003 05:51:08 Q1e0a290 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=IGNORE. 06/02/2003 05:51:08 Q1e0a290 Msg failed WEIGHT10 (Weight of 10 reaches or exceeds the limit of 10.). Action=HOLD. 06/02/2003 05:51:08 Q1e0a290 Subject: Fwd: RE: Ed Tech Day / Joyce Carol Oates 06/02/2003 05:51:08 Q1e0a290 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] $default$.junkmail BLACKLIST DELETE OSDUL HOLD OSSOFT HOLD ORDBHOLD SPAMCOP HOLD ZONEIN HOLD MAILFROMHOLD SPAMROUTING HOLD PERCENT HOLD WEIGHT10HOLD # Global.cfg: Declude JunkMail configuration file CODE XXX LOGFILE D:\Imail\spool\spam.log LOGLEVELMID LOG_OK NONE HOP 0 DNS 216.153.138.61 CONSOLE OFF IPBYPASS216.153.138.61 # NS1_Thumper XSENDER ON XSPOOLNAME ON XINHEADER X-Note: Checked for SPAM and Viruses by Thumpernet - http://www.thumpernet.com XINHEADER X-note: Total spam weight of the emai is %WEIGHT% XOUTHEADER X-Note: Please send abuse reports to [EMAIL PROTECTED] BLACKLIST fromfile d:\imail\declude\blacklist.txt OSRELAY ip4rrelays.osirusoft.com127.0.0.2 2 0 OSDUL ip4rrelays.osirusoft.com127.0.0.3 OSSRC ip4rrelays.osirusoft.com127.0.0.4 5 0 OSSOFT ip4rrelays.osirusoft.com127.0.0.6 OSLIST ip4rrelays.osirusoft.com127.0.0.7 3 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 FIVETENSRC ip4rblackholes.five-ten-sg.com 127.0.0.2 5 0 FIVETENDUL ip4rblackholes.five-ten-sg.com 127.0.0.3 5 0 FIVETENOPTINip4rblackholes.five-ten-sg.com 127.0.0.4 3 0 FIVETENOTHERip4rblackholes.five-ten-sg.com 127.0.0.5 5 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 2 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 MAILFROMenvfrom BADHEADERS badheaders x x 4 0 SPAMHEADERS spamheaders x x 4 0 SPAMROUTING spamrouting HEUR10 heuristics 10 x 5 0 PERCENT percent WEIGHT10weight x x 10 0 WHITELIST FROM [EMAIL PROTECTED] WHITELIST FROM @MAILER-DAEMONitrogen.packetcity.com WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST IP 216.153.138.# Anything from our address space WHITELIST FROM@go2france.com WHITELIST FROM@mail.go2france.com WHITELIST FROM@list.ipswitch.com WHITELIST FROM@declude.com WHITELIST FROM@signup.universalstudios.com #For JGL 1/4/02 WHITELIST FROM @listserv.usairways.com #For Rita 1/4/02 WHITELIST FROM@centro.org #for [EMAIL PROTECTED] 1/7/02 WHITELIST FROM @upstate.edu #for lisa
Re: [Declude.JunkMail] Spamcheck
What's the difference between spamcheck and declude? - Original Message - From: Frederick P. Squib, Jr. [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, March 22, 2003 7:47 PM Subject: RE: [Declude.JunkMail] Spamcheck Tom, http://www.riedmann.it/spamchk/ Been using it for a while and it works great. Fritz Frederick P. Squib, Jr. Network Operations Citizens Telephone Company Citizens Internet Services http://www.wpa.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MSN
Hi, MSN is not accepting email from my mail server, here is what the log file entries look like: 20030312 001347 127.0.0.1 SMTP (259) Trying msn.com (0) 20030312 001347 127.0.0.1 SMTP (259) Connect msn.com [207.46.181.13:25] (1) 20030312 001347 127.0.0.1 SMTP (259) 20030312 001347 127.0.0.1 SMTP (259) SMTP_DELIV_FAILED 20030312 001347 127.0.0.1 SMTP (259) QUIT 20030312 001347 127.0.0.1 SMTP (259) Could this be I have been listed as a spammer (though I'm not) ? How do I find out? Any other thoughts, or suggestions? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] MSN
Thanks, That's very helpful, it was only happening to MSN email. andy - Original Message - From: Glenn \ WCNet To: [EMAIL PROTECTED] Sent: Wednesday, March 12, 2003 1:13 PM Subject: Re: [Declude.JunkMail] MSN MSN has been having mail troubles for about two weeks. Several of our users have complained. One contacted MSN, and they told her to have us call them. We did, and MSN said they had done some sort of maintenance procedure on their mail system, and something broke. At that point in time they expected to have the fix done within 48 hours. Well, mail started going through again within about 12 hours, but it didn't last for long. Interesting side note: I had occasion to make a tech call to Microsoft yesterday. Mail from their techie handling my case arrived about three hours late. He needed to send me a little test utility, and it didn't come through at all on his @microsoft.com address. He sent it through @hotmail.com and it did arrive. Several other messages from him arrived AFTER we had finished the case. Glenn Z. - Original Message - From: andyb To: [EMAIL PROTECTED] Sent: Wednesday, March 12, 2003 1:55 PM Subject: [Declude.JunkMail] MSN Hi,MSN is not accepting email from my mail server, here is what the log fileentries look like:20030312 001347 127.0.0.1 SMTP (259) Trying msn.com (0)20030312 001347 127.0.0.1 SMTP (259) Connect msn.com[207.46.181.13:25] (1)20030312 001347 127.0.0.1 SMTP (259)20030312 001347 127.0.0.1 SMTP (259) SMTP_DELIV_FAILED20030312 001347 127.0.0.1 SMTP (259) QUIT20030312 001347 127.0.0.1 SMTP (259)Could this be I have been listed as a spammer (though I'm not) ? How do Ifind out?Any other thoughts, or suggestions?Thanks,Andy---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] single user exclusion
Hi, I'm sure this has been answered before... How do I exclude one user from the spam filter? If you could head me in the right direction, I'd appreciate it. thanks, Andrew --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] single user exclusion
yes, thanks andrew - Original Message - From: David Lewis-Waller [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, January 15, 2003 10:57 AM Subject: RE: [Declude.JunkMail] single user exclusion Create a directory for the domain e.g. a directory called 'mydomain.com' under the Declude directory. Copy $default$.junkmail into this folder. You now have domain specific filters. For single users copy $default$.junkmail to user.name.junkmail and edit accordingly. e.g. x:\imail\declude | |- 'Declude config files etc | \mydomain.com ' new directory | | $default$.junkmail 'domain specific file users.name.junkmail 'user specific specific file Declude Pro only. I think this is what you implied! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of andyb Sent: 15 January 2003 17:46 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] single user exclusion Hi, I'm sure this has been answered before... How do I exclude one user from the spam filter? If you could head me in the right direction, I'd appreciate it. thanks, Andrew --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] change HOLD location
That is a bummer, I'm using xcopy to backup files from one computer to another, and the hold directly can have as many as 3000 messages over the weekend (which is big plug for the effectiveness of declude) thanks, andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 04, 2002 11:51 AM Subject: Re: [Declude.JunkMail] change HOLD location Is there a way to change the location of HOLD messages from the default? No, there isn't, but that is something we are planning to change. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
