[Declude.JunkMail] WEIGHT for a File Attachment
Is there a way I can add a weight value is a file attachment is a certain type, ie GIF? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WEIGHT for a File Attachment
One way, where X is the weight you wish to assign: BODYXCONTAINSContent-Type: image/gif; Be careful with this because a lot of legit emails contain GIFs. -Dave Doherty Skywaves, Inc. 508-425-7176 [EMAIL PROTECTED] - Original Message - From: David Dodell [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, November 05, 2006 4:10 PM Subject: [Declude.JunkMail] WEIGHT for a File Attachment Is there a way I can add a weight value is a file attachment is a certain type, ie GIF? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight
Title: Weight I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights? Regards, Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ex.1801
Re: [Declude.JunkMail] Weight
Title: Weight When I started, I ended up with a comfortable system with the weights subject tag 14, hold 28 delete at 35. I didn't like oddity of the numbers and sometimes wanted a finer granuality. So I mutiplied all of my weight by 7. I ended up with subject tag at100, hold at 200 and delete at 300. Nice round numbers that the users can understand. - Original Message - From: Kelly Scotto To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 1:31 PM Subject: [Declude.JunkMail] Weight I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights? Regards, Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ex.1801
RE: [Declude.JunkMail] Weight
Title: Message Added the personal touch. Gotcha! -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott FisherSent: Thursday, February 02, 2006 1:57 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Weight When I started, I ended up with a comfortable system with the weights subject tag 14, hold 28 delete at 35. I didn't like oddity of the numbers and sometimes wanted a finer granuality. So I mutiplied all of my weight by 7. I ended up with subject tag at100, hold at 200 and delete at 300. Nice round numbers that the users can understand. - Original Message - From: Kelly Scotto To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 1:31 PM Subject: [Declude.JunkMail] Weight I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights? Regards, Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ex.1801
[Declude.JunkMail] %WEIGHT% is broken - v 2.0.6.12 (Pro)
In $default$.junkmail, WEIGHT10 SUBJECT [SPAM %WEIGHT%] used to change the subject line to: [SPAM 30] Quality Opportunity in 24 hours. The new version now changes it to: [SPAMQuality Opportunity in 24 hours. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight values used in Junkmail config
Dan, A couple of excellent tests to try out are Sort Monsters Sniffer and our URI filter plug-in for Declude. Both of those tests can be evaluated for free. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dan Shadix [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, April 27, 2005 6:36 PM Subject: [Declude.JunkMail] Weight values used in Junkmail config The config files I originally got with Junkmail use a weight range of mostly 10 or less for individual tests. I just downloaded 2.06 and it is the same and contains these lines: WEIGHT10WARN WEIGHT14SUBJECT **SPAM** WEIGHT20HOLD%DATE% It appears to me that most of you are using much a much higher scale. I can see the value of that since it provides more granularity. My question is, does anyone have configs they are sharing or will share to get me started. I plan to make some time to work on tuning my config to catch more spam and it would be nice to not have to start from scratch. Thanks all, -- Dan Shadix IT Systems Administrator Terry Reilly Health Services --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight Ranges
How much extra processing to an e-mail does adding a bunch of weight range statements like: WEIGHT1019 weightrange x x 10 19 WEIGHT2029 weightrange x x 20 29 WEIGHT3034 weightrange x x 30 34 WEIGHT3539 weightrange x x 35 39 I really just want these just to report on from the logs rather than take action on them during e-mail processing. My guess is that it should not take too much CPU. You are correct; the weightrange tests use only a negligible amount of CPU time. Also if I so not want these tests to show up in the %TESTSFAILED% variable then would I add HIDETESTS WEIGHT1019 WEIGHT2029.. And would I need to put in the $default$.junkmail file WEIGHT1019 LOG Correct. Note that you could simply not include the WEIGHT1019 line in the $default$.JunkMail file, which would have the same effect. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight Ranges
Also if I so not want these tests to show up in the %TESTSFAILED% variable then would I add HIDETESTS WEIGHT1019 WEIGHT2029.. And would I need to put in the $default$.junkmail file WEIGHT1019 LOG Correct. Note that you could simply not include the WEIGHT1019 line in the $default$.JunkMail file, which would have the same effect. Personally I like to have it written down in the .junkmail file so that there is no confusion about the test and if it is being employed etc. The KISS principle. Thanx GOran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight Ranges
Scott, How much extra processing to an e-mail does adding a bunch of weight range statements like: WEIGHT1019 weightrange x x 10 19 WEIGHT2029 weightrange x x 20 29 WEIGHT3034 weightrange x x 30 34 WEIGHT3539 weightrange x x 35 39 I really just want these just to report on from the logs rather than take action on them during e-mail processing. My guess is that it should not take too much CPU. Also if I so not want these tests to show up in the %TESTSFAILED% variable then would I add HIDETESTS WEIGHT1019 WEIGHT2029.. And would I need to put in the $default$.junkmail file WEIGHT1019 LOG I do not want to bother putting a line in the headers but I want to have them in the log file for reporting. Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] %WEIGHT% variable as -100
Scott, This may be very minor and possibly just cosmetic, I have found that some messages will have a %WEIGHT% variable returned for a WARN action that is -100 when such a score is impossible on our system. The example below is from a message that scored 0 in the logs (seemingly correct), but shows differently in the headers. I'm using 1.79i6 currently and am not aware of any ill effects as a result. Thanks, Matt 05/06/2004 10:21:44 Q49f201ad01ca801f L1 Message OK 05/06/2004 10:21:44 Q49f201ad01ca801f Subject: Your are ON OUR LIST -- from John 05/06/2004 10:21:44 Q49f201ad01ca801f From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 209.120.224.16 ID: 05/06/2004 10:21:44 Q49f201ad01ca801f Tests failed [weight=0]: CATCHALLMAILS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE SIZE-XS=IGNORE NOTNULL=IGNORE PASSED=IGNORE 05/06/2004 10:21:44 Q49f201ad01ca801f Last action = ""> Received: from lion.glypto.com [209.120.224.16] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A9F21AD01CA; Thu, 06 May 2004 10:21:38 -0400 Received: from nobody by lion.glypto.com with local (Exim 4.24) id 1BLjkl-0005Xn-Dr for [EMAIL PROTECTED]; Thu, 06 May 2004 09:21:35 -0500 To: [EMAIL PROTECTED] Subject: Your are ON OUR LIST -- from John From: [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] Date: Thu, 06 May 2004 09:21:35 -0500 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - lion.glypto.com X-AntiAbuse: Original Domain - inno-tech.com X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - no-reply.com X-MailPure: X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 10:21:44 on 05/06/2004 X-MailPure: Spool File: D49f201ad01ca801f.SMD X-MailPure: Server Name: lion.glypto.com X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: lion.glypto.com [209.120.224.16] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] %WEIGHT% variable as -100
This may be very minor and possibly just cosmetic, I have found that some messages will have a %WEIGHT% variable returned for a WARN action that is -100 when such a score is impossible on our system. The example below is from a message that scored 0 in the logs (seemingly correct), but shows differently in the headers. I'm using 1.79i6 currently and am not aware of any ill effects as a result. X-MailPure: Spam Score: -100 How is the WARN action set up? Which version of Declude are you running? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %WEIGHT% variable as -100
Scott, Sorry, it wasn't the WARN action, it's coming from the XOUTHEADER (gatewayed client in this example): XOUTHEADERX-MailPure: Spam Score: %WEIGHT% - or - XINHEADERX-MailPure: Spam Score: %WEIGHT% 1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights were appearing about 500 points above what they really were (only in the %WEIGHT% variable). I don't believe this has affected how Declude handles the E-mail, just the %WEIGHT% variable itself. It appears that the issue with the -100 only happens when the total score is zero. I believe this is being passed off in the variable when used for external tests, but I haven't verified that yet. Thanks, Matt Received: from mx2.mailpure.com [63.170.56.5] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A5496AC01E4; Mon, 12 Apr 2004 21:41:29 -0400 Received: from mail.pluscentury.biz ([64.205.141.39]) by mx2.mailpure.com with Microsoft SMTPSVC(6.0.3790.0); Mon, 12 Apr 2004 21:40:16 -0400 Received: (qmail 31553 invoked from network); 13 Apr 2004 13:52:18 - Received: from mail.pluscentury.biz (HELO localhost.localdomain) (64.205.141.39) by mail.pluscentury.biz with SMTP; 13 Apr 2004 13:52:18 - User-Agent: KMail/1.4.3 From: Mackenna [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: I bet we can hit it off Reply-To: [EMAIL PROTECTED] Precedence: first-class Mime-Version: 1.0 X-cid: 190 X-eid: 434378 X-lid: 143 Bounces-to: [EMAIL PROTECTED] Content-Type: multipart/alternative;boundary=MuLtIpArT_BoUnDaRy Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 13 Apr 2004 01:40:17.0371 (UTC) FILETIME=[462032B0:01C420F8] Date: 12 Apr 2004 21:40:17 -0400 X-MailPure: X-MailPure: LEGITCONTENT: Passed, legitimate content detected (weight -2). X-MailPure: MXBAIT: Message failed MXBAIT test (line 3, weight 1). X-MailPure: SPAMMYURL: Message failed SPAMMYURL test (line 10, weight 1). X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 21:41:38 on 04/12/2004 X-MailPure: Spool File: D454906ac01e4fad2.SMD X-MailPure: Server Name: mail.pluscentury.biz X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: mail.pluscentury.biz [64.205.141.39] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Received: from lakermmtao02.cox.net [68.230.240.37] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A7E6A008A; Tue, 13 Apr 2004 21:46:14 -0400 Received: from fairview ([68.102.33.6]) by lakermmtao02.cox.net (InterMail vM.6.01.03.02 201-2131-111-104-20040324) with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Tue, 13 Apr 2004 21:45:56 -0400 Return-Receipt-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: Matt Bramble [EMAIL PROTECTED] Subject: e-mail account Date: Tue, 13 Apr 2004 20:56:11 -0500 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000__01C42199.C15A9AF0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-MailPure: X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 21:46:48 on 04/13/2004 X-MailPure: Spool File: D97e6000a008a0bf7.SMD X-MailPure: Server Name: lakermmtao02.cox.net X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: lakermmtao02.cox.net [68.230.240.37] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Received: from qwertyx1.qwertyx.net [12.107.136.168] by mx1.mailpure.com (SMTPD32-8.05) id AC456C7C00A0; Mon, 19 Apr 2004 21:26:29 -0400 Received: by qwertyx1.qwertyx.net (Postfix, from userid 515) id 15B829286D; Mon, 19 Apr 2004 21:26:30 -0400 (EDT) Received: from [192.168.237.100] (dwolk-home [68.236.149.197]) by qwertyx1.qwertyx.net (Postfix) with ESMTP id 8A1839284F for [EMAIL PROTECTED]; Mon, 19 Apr 2004 21:26:29 -0400 (EDT) Subject: Re: DNS errors on my server From: [EMAIL PROTECTED] To: Matthew Bramble [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] References:
Re: [Declude.JunkMail] %WEIGHT% variable as -100
1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights were appearing about 500 points above what they really were (only in the %WEIGHT% variable). I don't believe this has affected how Declude handles the E-mail, just the %WEIGHT% variable itself. It appears that the issue with the -100 only happens when the total score is zero. I believe this is being passed off in the variable when used for external tests, but I haven't verified that yet. I've found the problem. When we made the change to the %WEIGHT% variable to calculate the current weight in the middle of testing, it would check to see if the final weight was 0 and if so would then calculate it directly. It looks like we'll need to change that. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Yep, a configuration of WEIGHT10 DELETE and a WEIGHT20 HOLD would indeed delete a message with a weight of 21. Something you mentioned earlier prompts me to point out another thing; the veterans in the list generally regard HOLD messages not as something they have to check out several times a day to manually sort, but rather as a convenient way to not bug the intended recipient while we are still able to retrieve and deliver the mail for that recipient in case of a false positive. The net result is that we're more likely to err by holding a message than to err by deleting it! For reviewing messages, SpamReview is very popular; I stopped using it a long time ago, though, due to the high volume I get (I delete very little). Also, the \imail\spool\spam folder will of course grow in time, so you'll want a handy utility that you can schedule to delete messages there that are older than whatever time you choose. See the Declude website, Tools page for links to these and other tools. Andrew 8) -Original Message- From: Goran Jovanovic [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 20, 2004 8:28 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Weight and Action Question Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? In your description I would want the DELETE taken. I was thinking of the whole thing is a different light. Specific test gets action taken first then aggregate tests like WEIGHT20 get taken in highest to lowest weight order. Then other things... To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. That's another way of looking at it. In this case, if there is a conflict with an action that has already been taken, the one that has already been taken will have priority. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight and Action Question
If you are trying out a new test and are not sure what it is going to do you set the WEIGHT of that test to 0 and then monitor it. One way would be to use a HOLD action on that test. My question is if the WEIGHT was not set to 0 but say 10 and the action is HOLD will the e-mail be held regardless of the total weight? Not necessarily (since there may be tests with negative weights). For example, by default, if an E-mail does not fail the NOLEGITCONTENT/IPNOTINMX tests, it will start with a weight below 0. Therefore, if an E-mail failed just the new test, the E-mail would not have a weight of 10 or higher. If that is true then why does it matter what the weight is set to? Because some people may, for example, use WEIGHT10 HOLD and WEIGHT20 DELETE. In this case, an E-mail that would have otherwise had a weight of 12 (and therefore held) would now have a weight of 22 (and be deleted). So in this case, the test would be live and running and doing its thing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Well, you might also have a WHITELIST action, or a WEIGHT action for a high value that does a DELETE. I guess what is important is to find out the precedence of the ACTION keywords. So if a WEIGHT10 is set with a DELETE action and the test that you are testing has a WEIGHT of 1 and the total score of the message is 25 then I would hope that regardless of the final weight the HOLD action on a specific test would take precedence. Instead, I would recommend using a weight of 1. A weight of zero, even if the test is triggered and an action taken, will make the test NOT show up in the list of tests triggered in your declude log file on the total weight= line (at LOGLEVEL MID, anyway). This makes sense and is a good point Thanx Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
I guess what is important is to find out the precedence of the ACTION keywords. In the case of multiple actions, Declude JunkMail will try to use both. But in combinations where they cannot logically be combined (such as HOLD and DELETE -- doing one means that you can't do the other), Declude JunkMail will use the stricter action (in the HOLD/DELETE case, DELETE is stricter). The actions are listed in the manual in the order of precedence (the ones towards the bottom are the stricter ones). So if a WEIGHT10 is set with a DELETE action and the test that you are testing has a WEIGHT of 1 and the total score of the message is 25 then I would hope that regardless of the final weight the HOLD action on a specific test would take precedence. No. If the total weight of the E-mail is 25, and you want to delete E-mail with a weight of 10 or higher, the E-mail will be deleted. Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? In your description I would want the DELETE taken. I was thinking of the whole thing is a different light. Specific test gets action taken first then aggregate tests like WEIGHT20 get taken in highest to lowest weight order. Then other things... To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight processing
Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called. You will see from the log snippet below that most of my filter files were skipped because of a weight (=36} was met. However, it appears that the negative weight of -3 from the nIPNOTINMX was applied after the filter file processing, which reduced the weight to 33, so the message was held instead of deleted. Would you be willing to change this so that all other Declude JM tests are run before the filters are called? Thanks, Bill = Filter HEADERS-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter SUBJECT-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter DYNAMIC-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter HELO-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter MAILFROM-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter FORGEDHELO-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter VERP-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter REVDNS-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter BODY-FILTER: Skipping E-mail with a current weight of 36 (=36) SPEWS:2 MAILPOLICE-BULK:5 nIPNOTINMX:-3 LONGSUBJECT:3 SUBJECTSPACES:5 ALLIGATE-SPAM-L1:1 ALLIGATE-SPAM-L2:2 SNIFFER-PORN:12 SPAMCHECK:6 . Total weight = 33. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight processing
Hi Bill: I noticed this a while back and what I did was I elevated the skip weight by 10.. it took care of this.. But I agree with you.. It is hard to know what is happening when tests are not done in order and one skips the tests only to see a surprise negative weight being applied.. I wish we could also skip the tests for negative weight.. Because right now the emails that we want to be delivered by negative weight actually will go through all tests since none can exit on a negative limit. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Saturday, December 20, 2003 2:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Weight processing Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called. You will see from the log snippet below that most of my filter files were skipped because of a weight (=36} was met. However, it appears that the negative weight of -3 from the nIPNOTINMX was applied after the filter file processing, which reduced the weight to 33, so the message was held instead of deleted. Would you be willing to change this so that all other Declude JM tests are run before the filters are called? Thanks, Bill = Filter HEADERS-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter SUBJECT-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter DYNAMIC-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter HELO-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter MAILFROM-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter FORGEDHELO-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter VERP-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter REVDNS-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter BODY-FILTER: Skipping E-mail with a current weight of 36 (=36) SPEWS:2 MAILPOLICE-BULK:5 nIPNOTINMX:-3 LONGSUBJECT:3 SUBJECTSPACES:5 ALLIGATE-SPAM-L1:1 ALLIGATE-SPAM-L2:2 SNIFFER-PORN:12 SPAMCHECK:6 . Total weight = 33. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight processing
Kami Razvan wrote: I wish we could also skip the tests for negative weight.. Because right now the emails that we want to be delivered by negative weight actually will go through all tests since none can exit on a negative limit. I believe the idea here is to place the negative weight filters before the positive weight ones. Unless you want to totally whitelist something based on a filter (as opposed to pseudo-whitelisting it by crediting just some points), it makes sense that you wouldn't have a minimum weight. I guess I'm not really very trusting of anything not whitelisted on my system. I start my order with pseudo-whitelists, and then pseudo-blacklists, then the highest scoring filters that don't make much use of the body down to the lowest scoring filters that do heavy body searches. When I have ANTI files, I list those before the main tests. The logic is a little sloppy in the middle, but it seems to be the right idea. Naturally, it would also make sense to have absolutely everything else run before the custom filters. I suspect the IPNOTINMX thing is a bug instead of something by design. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight processing
Hi Matt: I agree but in case of mailing lists .. It seems like one way to help with the mailing lists that keep changing their providers is to whitelist them by their address in the Header. Since Declude looks at the sender email and does not see the FROM address the best way to handle some mailing lists is by giving negative weight for the email found in header. In those cases we have given enough negative weight to them to make sure they come through regardless of the spam databases they are in. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Saturday, December 20, 2003 2:58 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Weight processing Kami Razvan wrote: I wish we could also skip the tests for negative weight.. Because right now the emails that we want to be delivered by negative weight actually will go through all tests since none can exit on a negative limit. I believe the idea here is to place the negative weight filters before the positive weight ones. Unless you want to totally whitelist something based on a filter (as opposed to pseudo-whitelisting it by crediting just some points), it makes sense that you wouldn't have a minimum weight. I guess I'm not really very trusting of anything not whitelisted on my system. I start my order with pseudo-whitelists, and then pseudo-blacklists, then the highest scoring filters that don't make much use of the body down to the lowest scoring filters that do heavy body searches. When I have ANTI files, I list those before the main tests. The logic is a little sloppy in the middle, but it seems to be the right idea. Naturally, it would also make sense to have absolutely everything else run before the custom filters. I suspect the IPNOTINMX thing is a bug instead of something by design. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight processing
Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called That is by design. We may make an attempt to get the filter tests to run last, but we cannot guarantee the order of the tests. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight processing
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called That is by design. We may make an attempt to get the filter tests to run last, but we cannot guarantee the order of the tests. Okay, I have modified my SKIPIFWEIGHT accordingly. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
My message headers are no long displaying the weight of messages. The weight rules are working. I have weight 10 holding and weight 20 deleting, that works great. I'd still like to see the weight score in the message header if it's less than 10. What have you changed recently? What were you seeing before? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
I downloaded new global and junkmail files a few months back to update my dated ones. Prior to that it would say exceeded weight of x in the headers. I might have had warn instead of hold or Delete. Either way, it would be nice to display the weight in the header so our users can set their level of spam filtering. Possible? Thanks, Steve - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 13, 2003 11:03 AM Subject: Re: [Declude.JunkMail] Weight of in header My message headers are no long displaying the weight of messages. The weight rules are working. I have weight 10 holding and weight 20 deleting, that works great. I'd still like to see the weight score in the message header if it's less than 10. What have you changed recently? What were you seeing before? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
I downloaded new global and junkmail files a few months back to update my dated ones. Prior to that it would say exceeded weight of x in the headers. I might have had warn instead of hold or Delete. Either way, it would be nice to display the weight in the header so our users can set their level of spam filtering. Possible? If you use WEIGHT10 WARN, for example, you'll see a line in the headers similar to what you describe. Are you looking for a header that shows the total weight, or one of the weights that was exceeded? Are you looking for this in all E-mail, or just E-mail that exceeds the given weight? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
A header with the total weight regardless, from 1 to 9. Anything 10 or above we take care of by default. Would I have to setup WEIGHT1 WARN, WEIGHT 2 WARN, etc? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 13, 2003 3:11 PM Subject: Re: [Declude.JunkMail] Weight of in header I downloaded new global and junkmail files a few months back to update my dated ones. Prior to that it would say exceeded weight of x in the headers. I might have had warn instead of hold or Delete. Either way, it would be nice to display the weight in the header so our users can set their level of spam filtering. Possible? If you use WEIGHT10 WARN, for example, you'll see a line in the headers similar to what you describe. Are you looking for a header that shows the total weight, or one of the weights that was exceeded? Are you looking for this in all E-mail, or just E-mail that exceeds the given weight? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
A header with the total weight regardless, from 1 to 9. Anything 10 or above we take care of by default. Do you mean regardless as in every E-mail should have it (XINHEADER would do that), or only on E-mails with a weight from 1-9? If from 1-9, you would need to set up a weightrange test (WEIGHT1_9 weightrange x x 1 9) that you could then use the WARN action with. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
just add XINHEADER X-Declude-Note: weight: %WEIGHT% to the global.cfg file - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 14, 2003 12:02 AM Subject: Re: [Declude.JunkMail] Weight of in header A header with the total weight regardless, from 1 to 9. Anything 10 or above we take care of by default. Do you mean regardless as in every E-mail should have it (XINHEADER would do that), or only on E-mails with a weight from 1-9? If from 1-9, you would need to set up a weightrange test (WEIGHT1_9 weightrange x x 1 9) that you could then use the WARN action with. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight maybe not working right??
Hello,
I just recived several spams to my box all with weights greater then
I allow (weight of 49). Does anyone see anything wrong here?
GLOBAL.CFG
WEIGHT1 weightrange x x 5 11
WEIGHT2 weightrange x x 12 17
WEIGHT3 weightrange x x 18 36
WEIGHT4 weightrange x x 37 0
$default$.junkmail
WEIGHT1 WARN
WEIGHT2 SUBJECT
WEIGHT3 HOLD
WEIGHT4 DELETE
--
Best regards,
~Paul~ mailto:[EMAIL PROTECTED]
---
{This E-mail scanned for viruses by Declude Virus/McAfee}
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight maybe not working right??
- Original Message - From: Paul Ingram [EMAIL PROTECTED] I just recived several spams to my box all with weights greater then I allow (weight of 49). Does anyone see anything wrong here? GLOBAL.CFG WEIGHT1 weightrange x x 5 11 WEIGHT2 weightrange x x 12 17 WEIGHT3 weightrange x x 18 36 WEIGHT4 weightrange x x 37 0 Change WEIGHT4 to a weight test instead of a weightrange: WEIGHT4 weight x x 37 0 This will apply whatever action you define (in your case: DELETE) to any message with a weight of 27 or higher. That should take care of it. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
It was commented out of the global.cfg. Another question: If I have: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] WEIGHT10SUBJECT (SUSPECTED SPAM) In the something.junkmail file will both be appended or will CATCHALLMAILS only show up? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 03, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WEIGHT CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] in my something.junkmail file but the weight did not show up in the subject of a message that I just received. Are you sure that the something.junkmail file was the one used to process the E-mail (aliases can cause Declude to use a different file than you expect)? Do I need to add something to the global.cfg? No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
If I have: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] WEIGHT10SUBJECT (SUSPECTED SPAM) In the something.junkmail file will both be appended or will CATCHALLMAILS only show up? Only one will be appended (I believe it is the last one listed in the global.cfg file that will be used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WEIGHT
In my something.junkmail file I have: WEIGHT10SUBJECT (SUSPECTED SPAM) I know I can add %WEIGHT% to the end if I want the weight to show up in the subject but how can I have theweight show up in the subject of ALL emails I receive even if they do not receive a weight? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WEIGHT
In my something.junkmail file I have: WEIGHT10SUBJECT (SUSPECTED SPAM) I know I can add %WEIGHT% to the end if I want the weight to show up in the subject but how can I have theweight show up in the subject of ALL emails I receive even if they do not receive a weight? You could use: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
I placed: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] in my something.junkmail file but the weight did not show up in the subject of a message that I just received. Do I need to add something to the global.cfg? I'm trying to do this on my own email and nothing else. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 03, 2003 1:54 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] WEIGHT In my something.junkmail file I have: WEIGHT10SUBJECT (SUSPECTED SPAM) I know I can add %WEIGHT% to the end if I want the weight to show up in the subject but how can I have theweight show up in the subject of ALL emails I receive even if they do not receive a weight? You could use: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] in my something.junkmail file but the weight did not show up in the subject of a message that I just received. Are you sure that the something.junkmail file was the one used to process the E-mail (aliases can cause Declude to use a different file than you expect)? Do I need to add something to the global.cfg? No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). By default, it is commented out, no? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). By default, it is commented out, no? It was originally, no longer is commented out with the default settings. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight problem ?
I had a customer send me the headers of an email that did not get caught held ) that should have.. At least I think it should have... snip X-MSMail-priority: Normal X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [801f]. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 211.243.11.104 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [211.243.11.104] X-Declude-Spoolname: D18a2a9cf007cfa90.SMD I have declude set up to hold at 10 delete at 20. Any thoughts ? David Barrett Maine Connect, Inc. I'd rather be a failure at something I enjoy than be a success at something I hate -- George Burns --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight values not working with ROUTETO
This is a weird one, I've setup 2 weights in global.cfg as: WEIGHT15weight x x 15 0 WEIGHT30weight x x 30 0 and use in global.cfg and $default$.junkmail: WEIGHT30ROUTETO [EMAIL PROTECTED] WEIGHT15ROUTETO [EMAIL PROTECTED] (also tried the above the other way round) but all mail over the 15 weight even if it is in the hundreds, only gets put in the weight15 mailbox. Extract from log: 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed DSBL (http://dsbl.org/listing?ip=202.57.162.213). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed MONKEYPROXIES (BLOCKED: See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=202.57.162.213). Action=IGNORE. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed EASYNET-DNSBL (Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed EASYNET-PROXIES (Open Proxy - http://proxies.blackholes.easynet.nl/errors.html). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed HELOBOGUS (Domain xilsyrt has no MX or A records.). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed REVDNS (This E-mail was sent from a MUA/MTA 202.57.162.213 with no reverse DNS entry.). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed SPAMHEADERS (This E-mail has headers consistent with spam [420f].). Action=WARN. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed WEIGHT15 (Weight of 46 reaches or exceeds the limit of 15.). Action=ROUTETO. 06/24/2003 13:09:32 Q3f780031034c12b6 Msg failed WEIGHT30 (Weight of 46 reaches or exceeds the limit of 30.). Action=ROUTETO. A header example: Received: from xilsyrt [202.57.162.213] by ourmailserver.net (SMTPD32-8.00) id AF7831034C; Tue, 24 Jun 2003 13:09:28 +0100 From: Terminate Your DEBT [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Reduce body fat and build lean muscle without exercise qdbc Date: Tue, 24 Jun 2003 05:13:36 -0400 Mime-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: base64 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=202.57.162.213 X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: EASYNET-PROXIES: Open Proxy - http://proxies.blackholes.easynet.nl/errors.html X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: BASE64: A binary encoded text or HTML section was found in this E-mail. X-RBL-Warning: HELOBOGUS: Domain xilsyrt has no MX or A records. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 202.57.162.213 with no reverse DNS entry. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420f]. X-Note: This E-mail was scanned for viruses and spam by balthasar.ourmailserver.net X-Spam-Tests-Failed: DSBL, MONKEYPROXIES, EASYNET-DNSBL, EASYNET-PROXIES, NOABUSE, BASE64, HELOBOGUS, REVDNS, SPAMHEADERS, WEIGHT15, WEIGHT30 [46] X-Spam-Prob: 0.998680 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 354829379 Can anyone tell me what I'm doing wrong? running latest beta BTW. Cheers Jools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight values not working with ROUTETO
Thanks Scott, I'll try the weightrange option! Cheers Jools On Tue, 24 Jun 2003 09:01:33 -0400, you wrote: This is a weird one, I've setup 2 weights in global.cfg as: WEIGHT15weight x x 15 0 WEIGHT30weight x x 30 0 and use in global.cfg and $default$.junkmail: WEIGHT30ROUTETO [EMAIL PROTECTED] WEIGHT15ROUTETO [EMAIL PROTECTED] (also tried the above the other way round) but all mail over the 15 weight even if it is in the hundreds, only gets put in the weight15 mailbox. The catch here is that when an E-mail has a weight of 30 or higher, you are telling Declude JunkMail two things. Since it has failed both the WEIGHT15 and WEIGHT30 tests, you are telling it to both re-route the E-mail to [EMAIL PROTECTED] and [EMAIL PROTECTED] You can't re-route an E-mail to two different addresses, so Declude JunkMail picks which one to send it to. There are two ways you could get around this. The best would be to change the WEIGHT15 line to: WEIGHT15weightrange x x 15 29 That will make sure that an E-mail never fails both the WEIGHT15 and WEIGHT30 tests. The other way would be to change the order that the tests are defined in the global.cfg file, which *should* change the address that the E-mail is re-routed to (but I can't guarantee that). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight values not working with ROUTETO
This is a weird one, I've setup 2 weights in global.cfg as: WEIGHT15weight x x 15 0 WEIGHT30weight x x 30 0 and use in global.cfg and $default$.junkmail: WEIGHT30ROUTETO [EMAIL PROTECTED] WEIGHT15ROUTETO [EMAIL PROTECTED] (also tried the above the other way round) but all mail over the 15 weight even if it is in the hundreds, only gets put in the weight15 mailbox. The catch here is that when an E-mail has a weight of 30 or higher, you are telling Declude JunkMail two things. Since it has failed both the WEIGHT15 and WEIGHT30 tests, you are telling it to both re-route the E-mail to [EMAIL PROTECTED] and [EMAIL PROTECTED] You can't re-route an E-mail to two different addresses, so Declude JunkMail picks which one to send it to. There are two ways you could get around this. The best would be to change the WEIGHT15 line to: WEIGHT15weightrange x x 15 29 That will make sure that an E-mail never fails both the WEIGHT15 and WEIGHT30 tests. The other way would be to change the order that the tests are defined in the global.cfg file, which *should* change the address that the E-mail is re-routed to (but I can't guarantee that). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight Filter - Sample List
Hi, this list has served me well so far: HELO8 CONTAINS$domain REVDNS 8 ENDSWITH.a83c9d.net REVDNS 8 ENDSWITH.are.net REVDNS 8 ENDSWITH.azogle.com REVDNS 8 ENDSWITH.bestpost.net REVDNS 8 ENDSWITH.bigtimevalues.com REVDNS 20 IS casinoandcash.com REVDNS 8 ENDSWITH.consumerinfo.com REVDNS 8 ENDSWITH.DailyInBox.com REVDNS 8 ENDSWITH.dartmail.net REVDNS 8 ENDSWITH.dealcop.com REVDNS 8 ENDSWITH.deliverenetworks.com REVDNS 6 ENDSWITH.dsl-verizon.net REVDNS 8 ENDSWITH.easymailers.net REVDNS 8 ENDSWITH.email-specials.net REVDNS 8 ENDSWITH.emailcourrier.com REVDNS 8 CONTAINS.emailoffers REVDNS 8 ENDSWITH.emailsvc.net REVDNS 8 ENDSWITH.emipsusa.com REVDNS 8 ENDSWITH.etransmail5.com REVDNS 8 ENDSWITH.evaluemail.com REVDNS 8 ENDSWITH.greatofferstoday.com REVDNS 8 ENDSWITH.hispeedmediaoffers.com REVDNS 8 ENDSWITH.hot-info.net REVDNS 8 ENDSWITH.IConNet.net REVDNS 8 ENDSWITH.ioffersdirect.com REVDNS 8 ENDSWITH.mail-gw.net REVDNS 8 ENDSWITH.mailmalls.net REVDNS 8 IS mediaprint.lt REVDNS 8 ENDSWITH.my-specials.com REVDNS 8 ENDSWITH.obdirectmail.com REVDNS 8 ENDSWITH.offer-exchange.com REVDNS 8 ENDSWITH.offersonthenet.com REVDNS 8 ENDSWITH.oneoffer.net REVDNS 8 ENDSWITH.owe-less.com REVDNS 8 ENDSWITH.primetimedirect.net REVDNS 8 ENDSWITH.ramosglobalmarketing.com REVDNS 8 ENDSWITH.real-net.net REVDNS 8 ENDSWITH.roving.com REVDNS 8 ENDSWITH.specialoffers4you.com REVDNS 8 ENDSWITH.steamyxxxads.com REVDNS 8 ENDSWITH.superstorespecials.com REVDNS 8 ENDSWITH.temd.net REVDNS 8 ENDSWITH.tepmail.com REVDNS 8 ENDSWITH.tiburondeltigre.com REVDNS 8 ENDSWITH.truemail.net REVDNS 8 ENDSWITH.virtual-domain.com REVDNS 8 ENDSWITH.webmailer.de REVDNS 8 ENDSWITH.xpwebnet.com HEADERS 3 CONTAINScharset=euc-kr HEADERS 3 CONTAINScharset=big5 COUNTRIES 3 CONTAINScn COUNTRIES 3 CONTAINSkr COUNTRIES 2 CONTAINSbr COUNTRIES 2 CONTAINShk COUNTRIES 2 CONTAINSru COUNTRIES 2 CONTAINStw COUNTRIES 2 CONTAINSuy attachment: winmail.dat
[Declude.JunkMail] Weight is Integer ..
Title: Message Sorry.. the last post about the filename was not the issue causing the problem. It seems like if the weight is put as a real number (20.00) the system somehow passes over it and does not detect the rest. The database output was creating: MAILFROM 20.00 CONTAINS inkjet apparently that causes big big problems. Oh well... it is fixed. Regards, Kami
[Declude.JunkMail] Weight range problem
Here is an example of an e-mail that according to the declude log failed 2 weight range tests. How? rom [EMAIL PROTECTED] Tue Aug 27 08:56:19 2002 Received: from SMTP32-FWD by mail.reliance.net (SMTP32) id A01BC; Tue, 27 Aug 2002 08:56:19 -0700 Received: from siteserver3.reliance.net [64.171.65.15] by mail.reliance.net with ESMTP (SMTPD32-7.12) id A12219A00A4; Tue, 27 Aug 2002 08:56:18 -0700 Received: from mail pickup service by siteserver3.reliance.net with Microsoft SMTPSVC; Tue, 27 Aug 2002 08:56:17 -0700 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: THIS IS PROBABLY SPAM!Already Posted Date: Tue, 27 Aug 2002 08:56:17 -0700 MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 27 Aug 2002 15:56:17.0973 (UTC) FILETIME=[47A4DE50:01C24DE2] X-RBL-Warning: NOABUSE: Not supporting abuse@domain X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain X-RBL-Warning: WEIGHTRANGE10-14: Total weight between 10 and 14. X-Declude-Spoolname: Da122019a00a41199.SMD X-Note: This E-mail was scanned by RelianceSoft, Inc. (www.reliancesoft.com) for spam. X-Tests-Failed: NOABUSE, NOPOSTMASTER, WEIGHTRANGE10-14, WEIGHTRANGE15-19 X-Note: This E-mail was sent from siteserver3.reliance.net. ([64.171.65.15]). X-X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 329860171 Here is the log snippet: 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed NOABUSE (Not supporting abuse@domain). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed NOPOSTMASTER (Not supporting postmaster@domain). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed WEIGHTRANGE10-14 (Total weight between 10 and 14.). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed WEIGHTRANGE15-19 (Total weight between 14 and 19.). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed NOABUSE (Not supporting abuse@domain). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed NOPOSTMASTER (Not supporting postmaster@domain). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed WEIGHTRANGE10-14 (Total weight between 10 and 14.). 08/27/2002 08:56:18 Qa122019a00a41199 Msg failed WEIGHTRANGE15-19 (Total weight between 14 and 19.). And the tests from the global.cfg: #below commented out 08/27/02 #WEIGHT10 weight x x 10 0 #WEIGHT15 weight x x 15 0 #WEIGHT20 weight x x 20 0 #below added 08/27/02 WEIGHT25weight x x 25 0 #Below added 08/27/02 WEIGHTRANGE10-14weightrange x x 10 14 WEIGHTRANGE15-19weightrange x x 14 19 WEIGHTRANGE20-24weightrange x x 20 24 #below comminted out 08/27/02 #WEIGHT10 WARN #WEIGHT15 SUBJECT THIS IS PROBABLY SPAM! #WEIGHT20 HOLD #below added 08/27/02 WEIGHT25HOLD WEIGHTRANGE10-14WARN WEIGHTRANGE15-19SUBJECT THIS IS PROBABLY SPAM! WEIGHTRANGE20-24HOLD John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] weight of 63 passed ??
Strangeness. I'm curious how this message manage to get through and be delivered. I have weight20 set to hold and weight30 to delete. This message made weight63. The address it was delievered to is granted located on a unix box but the messages get relayed through imail and obviously declude processed and tagged this message but it got delivered anyways. (below the message is excerp from my declude log) Return-Path: [EMAIL PROTECTED] Received: from imail.fament.com (imail.fament.com [208.189.26.51]) by unicorn.fament.com (8.11.6/8.11.0) with ESMTP id g6FDFf125937 for [EMAIL PROTECTED]; Mon, 15 Jul 2002 08:15:42 -0500 Received: from SPHINX.ftf.sn [213.154.76.114] by imail.fament.com with ESMTP (SMTPD32-7.07) id ABA29C500FE; Mon, 15 Jul 2002 08:18:26 -0500 Received: from smtp0210.mail.yahoo.com ([213.96.125.231]) by SPHINX.ftf.sn with Microsoft SMTPSVC(5.0.2195.2966); Mon, 15 Jul 2002 11:58:12 + Date: Mon, 15 Jul 2002 07:54:45 -0400 From: Virginia Doub[EMAIL PROTECTED] X-Priority: 3 To: [EMAIL PROTECTED] Subject:Free Online Payment Account - Plus a $5.00 Sign Up Bonus Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 15 Jul 2002 11:58:22.0356 (UTC) FILETIME=[EAF35540:01C22BF6] X-RBL-Warning: OSRELAY: This entry was last confirmed open on 4/19/2002 X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?213.96.125.231 X-RBL-Warning: NOABUSE: Not supporting abuse@domain X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@domain X-RBL-Warning: REVDNS: This E-mail was sent from a mail server 213.154.76.114 with no reverse DNS entry. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100f]. X-RBL-Warning: WEIGHT10: Weight of 63 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [213.154.76.114] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. Status: 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed OSRELAY (This entry was last confirmed open on 4/19/2002). 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?213.96.125.231). 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed NOABUSE (Not supporting abuse@domain). 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed NOPOSTMASTER (Not supporting postmaster@domain). 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed REVDNS (This E-mail was sent from a mail server 213.154.76.114 with no reverse DNS entry.). 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed SPAMHEADERS (This E-mail has headers consistent with spam [4000100f].). 07/15/2002 08:19:29 Qcba209c500fe07cb Msg failed WEIGHT10 (Weight of 63 reaches or exceeds the limit of 10.). --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] weight of 63 passed ??
Strangeness. I'm curious how this message manage to get through and be delivered. My first question: Do you have a WHITELIST entry that could have let it through? I have weight20 set to hold and weight30 to delete. This message made weight63. The address it was delievered to is granted located on a unix box ... And I should mention here that if the E-mail is being sent to another server (unix box), IMail considers it outgoing mail, so the settings in the \IMail\Declude\global.cfg file. To get around this, you can use per-domain settings for that domain. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Weight question...
I'm trying to setup the following tests for weight. When I add the following (minus the # comment sign) #SPAMHEADERSspamheaders x x 3 0 #NOABUSE noabuse x x 3 0 #NOPOSTMASTERnopostmasterx x 3 0 I get the following errors in the log: 05/14/2002 12:06:13 Warning, misconfiguration in noabuse; expecting action 05/14/2002 12:06:13 Warning, misconfiguration in nopostmaster; expecting action I have a feeling that the second field is where I'm screwing things up. I also have the following actions for these single tests: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 4 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 4 0 AND NOABUSE WARN NOPOSTMASTERWARN Thoughts? Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Weight question...
I'm trying to setup the following tests for weight. When I add the following (minus the # comment sign) #SPAMHEADERSspamheaders x x 3 0 #NOABUSE noabuse x x 3 0 #NOPOSTMASTERnopostmasterx x 3 0 I get the following errors in the log: 05/14/2002 12:06:13 Warning, misconfiguration in noabuse; expecting action 05/14/2002 12:06:13 Warning, misconfiguration in nopostmaster; expecting action The problem is that you don't need to add those lines. The weighting is built into the test definitions; you don't need to add separate lines for them. When Declude sees the line starting with NOABUSE, it first checks to see if there has already been a test called NOABUSE defined. If there has, it assumes that you are determining what action to take (NOABUSE HOLD, for example). If the test hasn't been defined, it expects that the line beginning with NOABUSE is a test definition -- but it isn't a valid one (there is no test type called noabuse). If you want to set the weight of the noabuse test to 3, you would just change the existing line: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 4 0 to: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 3 0 I also have the following actions for these single tests: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 4 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 4 0 Note that these are the test definitions (where you would change the weight, if you want). NOABUSE WARN NOPOSTMASTERWARN And these are where you determine the action to take for the outgoing E-mail that fails those tests. So if you get rid of the lines that you added, and then change the test definition line as shown above, you should be all set. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] %WEIGHT% Variable
Should the %WEIGHT% Variable work with the SUBJECT action in 1.35a or 1.36. I know it works other places but when I tried it in the sbject action it didn't work. Thanks Stu - CSOnline Technical Support hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Meadville 814-425-1696 Parker724-399-1158 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] %WEIGHT% Variable
Should the %WEIGHT% Variable work with the SUBJECT action in 1.35a or 1.36. I know it works other places but when I tried it in the sbject action it didn't work. It should work with 1.36, but was just added and has not been thoroughly tested yet. What happens when you try using it? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
DSN:Re: [Declude.JunkMail] %WEIGHT% Variable
I used it with 1.35a WEIGHT15SUBJECT Junkmail Wt:%WEIGHT% (Yes the quotes are part of the subject tag line) The result was exactly that Junkmail Wt:%WEIGHT%Viagra is Great Stu At 04:06 PM 02/01/2002 -0500, you wrote: Should the %WEIGHT% Variable work with the SUBJECT action in 1.35a or 1.36. I know it works other places but when I tried it in the sbject action it didn't work. It should work with 1.36, but was just added and has not been thoroughly tested yet. What happens when you try using it? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . - CSOnline Technical Support hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Meadville 814-425-1696 Parker724-399-1158 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Weight Fix?
I remember several announcements in the past two weeks (since the official 1.30 beta started), that there was going to be a fix in the respective next day or two that would at least re-fix the weight test? It's actually only been about a week -- the holidays seem to make it seem longer. The holidays did delay the new release, which should be out later today or tomorrow. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
MISSING_REVERSE_DNS:Re[2]: [Declude.JunkMail] Weight Fix?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Weight Fix? on Thursday 1:16:53 PM We have not seen it error here. It adds 'em up and HOLDs all exceeding the limit just fine. We basically set all switches to WARN except WEIGHT10 and then we can see just how well each combination of tests adds up. I'd say about 80-85% of all spam is caught now with very very few legit mails and the Imail keyword filters are picking up most of the rest.. This feature adds an 'intelligence' to catching spam.. -- Roger Heath [EMAIL PROTECTED] Here's the original how-to from Scott: The second is a weighting system (that was discussed here recently). With it, you can assign each test a weight, and you can have a new test that will only fail if a total weight value is reached. For example, you could have ORDB assigned a weight of 5, SPAMCOP a weight of 8, and SPAMHEADERS a weight of 3, along with a WEIGHT10 test that would get triggered if a weight of 10 was reached. If just ORDB and SPAMHEADERS failed (a total of 8), the WEIGHT10 test would not be triggered. If the SPAMCOP test failed, it would not trigger the WEIGHT10 test. But, if the SPAMCOP test and either the ORDB or SPAMHEADERS tests failed, the WEIGHT10 test would be triggered. Without much experimentation, we were able to set it up so that the weighting system catches about 95% of the spam at our spamtrap. The only false positive we are aware of was a canned response that we got from Network Solutions (to an E-mail that they claimed would receive a personalized reposonse), because they fail the NOPOSTMASTER test, NOWHOIS test, and REVDNS tests (which had a total weight of 13 the way we set it up, and a limit of 10). Given that Network Solutions wants us to pay $10,000 to let people do Whois lookups on our web site, it didn't really bother me at all that it was caught. To use the new weighting system, you should look at the new global.cfg file, which shows how the entries should look. The definition for each test now has 2 extra numbers added to the end (tests that did not already have 4 pieces of information associated with them, such as REVDNS revdns, need to have a placeholder, so they will now look like REVDNS revdns x x 10 0). The first of the two new numbers indicates the weight if a test fails, while the other number indicates the weight if a test does not fail (which is normally 0). You can then add a test using the type weight, such as WEIGHT10 weight x x 20 0, which would get triggered if the total weight was 20 or higher. - Copy of Original Message(s): - I remember several announcements in the past two weeks (since the official 1.30 beta started), that there was going to be a fix in the respective next day or two that would at least re-fix the weight test? R It's actually only been about a week -- the holidays seem to make it seem R longer. The holidays did delay the new release, which should be out later R today or tomorrow. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
