Re: [Declude.JunkMail] External rule not weighting properly

2004-12-03 Thread Dean Lawrence 
Scott,

Thanks for you help. I was mis-reading the configuration. In the
default configs the passing of  NOLEGITCONTENT has a negative weight
of 5 which was offsetting the results. Also, since it passed the test,
it was not showing up in the headers either. Duh!!

Dean
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] External rule not weighting properly

2004-12-03 Thread R. Scott Perry 

X-Spam-Tests-Failed: SNIFFER-EXPERIMENTAL-ABSTRACT, SPFUNKNOWN [0]
As you can see it failed these two tests, but the weight should be 5.
Any thoughts on why this is not working properly?
It is working properly.  If you remove those two tests, you'll see that the 
weight of the E-mail is -5 (due to one or more tests that the E-mail did 
not fail).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] External rule not weighting properly

2004-12-03 Thread Dean Lawrence 
I added some new sniffer classification rules to my global config
file, but my weighting does not seem to work for them. My config lines
look like this:

SNIFFER-GENERAL external060 "C:\IMail\Declude\Sniffer\whmepypa.exe
Authcode"   5   0
SNIFFER-EXPERIMENTAL-ABSTRACT   external061 
"C:\IMail\Declude\Sniffer\whmepypa.exe
Authcode"   5   0
SNIFFER-OBFUSCATION external062 
"C:\IMail\Declude\Sniffer\whmepypa.exe
Authcode"   5   0
SNIFFER-EXPERIMENTAL-RECEIVED-[IP]  external063 
"C:\IMail\Declude\Sniffer\whmepypa.exe
Authcode"   5   0

SPFPASSspfpassx00
SPFFAILspffailx0 0
SPFUNKNOWNspfunknownx0 0

I'm testing the SPF features so that is why they have no weigh yet.

Here is the header of an email that I received.

Received: from melp-rto2.wanadoo.com [194.51.131.67] by
pop.idatatech.com with ESMTP
  (SMTPD32-8.13) id AFD720C80116; Fri, 03 Dec 2004 00:55:35 -0500
Received: from melp-rtp4-back.wanadoo.com (melp-rtp4.wanadoo.com
[192.168.226.230])
by melp-rto2.wanadoo.com (Postfix) with ESMTP id 671E1554A63
for <[EMAIL PROTECTED]>; Fri,  3 Dec 2004 06:53:58 +0100 (CET)
Received: from melp-rtp4-front.wanadoo.com (localhost [127.0.0.1])
by melp-rtp4-back.wanadoo.com (Postfix) with ESMTP id 5CFD591871
for <[EMAIL PROTECTED]>; Fri,  3 Dec 2004 06:53:58 +0100 (CET)
Received: by melp-rtp4-front.wanadoo.com (Postfix)
id 4D02191C6F; Fri,  3 Dec 2004 06:53:58 +0100 (CET)
Date: Fri,  3 Dec 2004 06:53:58 +0100 (CET)
From: [EMAIL PROTECTED] (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="2E2C99306E.1102053238/melp-rtp4-front.wanadoo.com"
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: SNIFFER-EXPERIMENTAL-ABSTRACT: Message failed
SNIFFER-EXPERIMENTAL-ABSTRACT: 61.
X-Declude-Sender: <> [194.51.131.67]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
X-Spam-Tests-Failed: SNIFFER-EXPERIMENTAL-ABSTRACT, SPFUNKNOWN [0]
X-Note: This E-mail was sent from melp-rto2.wanadoo.com ([194.51.131.67]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 399021699

As you can see it failed these two tests, but the weight should be 5.
Any thoughts on why this is not working properly? Are my rules defined
incorrectly?

Thanks,

Dean
-- 
__
Dean Lawrence, CIO/Partner
Internet Data Technology
888.GET.IDT1 ext. 701 * fax: 888.438.4381
http://www.idatatech.com/
Corporate Internet Development and Marketing Specialists
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.