Re: [Declude.JunkMail] What's wrong with my Declude?
Hi, How do I get a current version of global.cfg? My license is long expired and my version is much older. Here's the relevant sections from the global.cfg file I have now: #= RBL IP4R TESTS == # 1. Definitions of the tests to use (do not edit unless you know what you are doing). These must come before the actions. # 2. First is the name of the check, then the type of check (ip4r is a DNS lookup using the reverse of the IP address). # 3. For type ip4r, 'matchstring' is the string to look for, or * for anything. AHBL ip4r dnsbl.ahbl.org* 6 0 ADNSBL ip4r dnsbl.antispam.or.id 127.0.0.2 3 0 BLITZEDALL ip4r opm.blitzed.org* 7 0 CBL ip4r cbl.abuseat.org 127.0.0.2 6 0 CSMA-SBL ip4r sbl.csma.biz 127.0.0.2 2 0 DSBL-CONFIRMED ip4r list.dsbl.org* 6 0 FIVETEN-SRC ip4r blackholes.five-ten-sg.com 127.0.0.2 7 0 JAMMDNSBL ip4r dnsbl.jammconsulting.com 127.0.0.2 3 0 INTERSIL ip4r blackholes.intersil.net 127.0.0.2 5 0 IPWHOIS ip4r ipwhois.rfc-ignorant.org 127.0.0.6 3 0 IMP-SPAM ip4r spamrbl.imp.ch 127.0.0.5 5 0 #ORDB ip4r relays.ordb.org* 5 0 #MTLDB ip4r mtldb.declude.com 127.0.0.2 3 0 #MXRATE is FREE but requires registration http://www.mxrate.com/Subscribe.asp MXRATE-BLOCK ip4r pub.mxrate.net 127.0.0.2 7 0 MXRATE-SUSPICIOUS ip4r pub.mxrate.net 127.0.0.4 2 0 NJABL ip4r dnsbl.njabl.org 127.0.0.2 5 0 SBL ip4r sbl.spamhaus.org * 9 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 5 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 5 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 5 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 5 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 4 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 5 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 5 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 5 0 SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 6 0 SPAMBAG ip4r blacklist.spambag.org 127.0.0.2 2 0 SPAMCANNIBAL ip4r bl.spamcannibal.org 127.0.0.2 2 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 8 0 #UCEPROTECT-1 ip4r dnsbl-1.uceprotect.net 127.0.0.2 8 0 #UCEPROTECT-2 ip4r dnsbl-2.uceprotect.net 127.0.0.2 7 0 UCEPROTECT-1 ip4r dnsbl-1.uceprotect.net 127.0.0.2 5 0 UCEPROTECT-2 ip4r dnsbl-2.uceprotect.net 127.0.0.2 4 0 UCEPROTECT-3 ip4r dnsbl-3.uceprotect.net 127.0.0.2 2 0 BARRACUDA IP4Rb.barracudacentral.org 127.0.0.2 3 0 #= GOOD MAIL IP4R TESTS == BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -10 0 IADB ip4r iadb.isipp.com 127.0.0.1 -5 0 FIVETEN-OPTIN ip4r blackholes.five-ten-sg.com 127.0.0.4 -3 0 MXRATE-ALLOW ip4r pub.mxrate.net 127.0.0.3 -3 0 #= RHBSL TESTS == AHBL-DOMAINSRHSBL rhsbl.ahbl.org127.0.0.2 10 0 BADWHOIS rhsbl whois.rfc-ignorant.org 127.0.0.5 3 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 1 0 MAILPOLICE-BLOCK rhsbl block.rhs.mailpolice.com 127.0.0.2 8 0 MAILPOLICE-FRAUD rhsbl fraud.rhs.mailpolice.com 127.0.0.2 8 0 SURBL rhsbl multi.surbl.org* 5 0 Thanks, Ben --- [This E-mail was checked by Declude] - Original Message - From: Scott Fisher sfis...@farmprogress.com To: declude.junkmail@declude.com Sent: Wednesday, July 28, 2010 11:59 AM Subject: RE: [Declude.JunkMail] What's wrong with my Declude? One thing is to add zen.spamhaus.org (removing cbl, sbl and perhaps njabl). It's the newer list from spamhaus ZEN IP4R zen.spamhaus.org * 7 0 You'd probably be best off comparing your global.cfg to Declude's current globabl.cfg. -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Imail Admin Sent: Wednesday, July 28, 2010 1:30 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] What's wrong with my Declude? Hi, We've been using Declude JM/AV with Imail for a long time. The current versions are Imail 2006.23 and Declude 1.63. I don't spend much time tweaking the system any more -- it's a small server that only handles about 40 domains (none of them heavy users). Anyway, lately (last couple of weeks) I've noticed more spam getting through. A lot more. Everything seems to be working as always, but it's not as effective. I'm looking for advice on how to make this effective without spending either big bucks or investing huge amounts of time. Any advice? Here is my DL Analyzer report: Total Messages Processed: 7,487 Messages That Failed Defined Test(s): 7,404 Percentage That Failed Defined Test(s): 98.89% Average Message Weight: 42 Average Message Weight/Failed: 42 TEST # FAILED PERCENTAGE CATCHALLMAILS 7,404 98.89% IPNOTINMX 7,306
Re: [Declude.JunkMail] What's wrong with my Declude?
Hi Pete, By SNF I assume you mean Sniffer? How do I tell for sure which version is running and whether it is getting the latest downloads? I know it's running at least partially because the report lists it. I checked the cfg file and it says configuration for v2r3, so I assume that's version 2 and not version 3? Then I checked my old emails and found that my last license renewal was at the end of last August, so I have a valid license. I haven't received any noticed since then about newer versions or even renewing my license this year. Thanks, Ben --- [This E-mail was checked by Declude] - Original Message - From: Pete McNeil madscient...@microneil.com To: declude.junkmail@declude.com Sent: Wednesday, July 28, 2010 12:18 PM Subject: Re: [Declude.JunkMail] What's wrong with my Declude? On 7/28/2010 2:29 PM, Imail Admin wrote: lately (last couple of weeks) I've noticed more spam getting through. A lot more. Check your SNF installation. I looked up your license ID and checked for your telemetry and did not find it. This usually means that SNF is not currently running on your system or that you have not yet upgraded to version 3. Hope this helps, _M -- President MicroNeil Research Corporation www.microneil.com --- [This E-mail scanned for viruses by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
On 8/1/2010 1:36 PM, Imail Admin wrote: Hi Pete, By SNF I assume you mean Sniffer? How do I tell for sure which version is running and whether it is getting the latest downloads? I know it's running at least partially because the report lists it. I checked the cfg file and it says configuration for v2r3, so I assume that's version 2 and not version 3? Then I checked my old emails and found that my last license renewal was at the end of last August, so I have a valid license. I haven't received any noticed since then about newer versions or even renewing my license this year. That all sounds about right. I'm betting (based on the above) that you simply never upgraded to version 3. The best way to do that is to use our installer. http://www.armresearch.com/products/snfClientServerWinInstaller.jsp http://www.armresearch.com/message-sniffer/download/SNF_CS_Installer.exe Another good way (if you're upgrading Declude also) is to switch to the built-in OEM version of SNF in Declude. (contact Declude about that if you wish to switch). _M --- [This E-mail was checked by Declude] -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
Hi Pete, Thanks. I think I'll try your installer first. I checked and my Sniffer subscription runs out in late September. I'm considering the possibility of upgrading Declude (first time in many years) and getting the OEM Sniffer with it. If I do that, it'll be in September. My system is so old (Imail 2006.23 running on top of Windows Server 2000) that I worry it won't handle the newest versions of these products. Thanks, Ben --- [This E-mail was checked by Declude] - Original Message - From: Pete McNeil madscient...@microneil.com To: declude.junkmail@declude.com Sent: Sunday, August 01, 2010 11:28 AM Subject: Re: [Declude.JunkMail] What's wrong with my Declude? On 8/1/2010 1:36 PM, Imail Admin wrote: Hi Pete, By SNF I assume you mean Sniffer? How do I tell for sure which version is running and whether it is getting the latest downloads? I know it's running at least partially because the report lists it. I checked the cfg file and it says configuration for v2r3, so I assume that's version 2 and not version 3? Then I checked my old emails and found that my last license renewal was at the end of last August, so I have a valid license. I haven't received any noticed since then about newer versions or even renewing my license this year. That all sounds about right. I'm betting (based on the above) that you simply never upgraded to version 3. The best way to do that is to use our installer. http://www.armresearch.com/products/snfClientServerWinInstaller.jsp http://www.armresearch.com/message-sniffer/download/SNF_CS_Installer.exe Another good way (if you're upgrading Declude also) is to switch to the built-in OEM version of SNF in Declude. (contact Declude about that if you wish to switch). _M --- [This E-mail was checked by Declude] -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
Hi Pete, OK, I did the upgrade. One thing that was slightly different from the instructions was that even though I directed it to install into the same folder as the prior Sniffer installation (d:\imail\sniffer), it only offered me a choice of a new install and said nothing about an upgrade. Still, it seemed to go through smoothly, so I'll just cross my fingers. Now that that's done, do I need to change my global.cfg setting? The old setting is SNIFFER external nonzero D:\imail\sniffer\liajkovy.exe w91zgqvr4g73s6o5 7 0. Thanks, Ben --- [This E-mail was checked by Declude] - Original Message - From: Pete McNeil madscient...@microneil.com To: declude.junkmail@declude.com Sent: Sunday, August 01, 2010 11:28 AM Subject: Re: [Declude.JunkMail] What's wrong with my Declude? On 8/1/2010 1:36 PM, Imail Admin wrote: Hi Pete, By SNF I assume you mean Sniffer? How do I tell for sure which version is running and whether it is getting the latest downloads? I know it's running at least partially because the report lists it. I checked the cfg file and it says configuration for v2r3, so I assume that's version 2 and not version 3? Then I checked my old emails and found that my last license renewal was at the end of last August, so I have a valid license. I haven't received any noticed since then about newer versions or even renewing my license this year. That all sounds about right. I'm betting (based on the above) that you simply never upgraded to version 3. The best way to do that is to use our installer. http://www.armresearch.com/products/snfClientServerWinInstaller.jsp http://www.armresearch.com/message-sniffer/download/SNF_CS_Installer.exe Another good way (if you're upgrading Declude also) is to switch to the built-in OEM version of SNF in Declude. (contact Declude about that if you wish to switch). _M --- [This E-mail was checked by Declude] -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
On 8/1/2010 3:03 PM, Imail Admin wrote: Hi Pete, OK, I did the upgrade. One thing that was slightly different from the instructions was that even though I directed it to install into the same folder as the prior Sniffer installation (d:\imail\sniffer), it only offered me a choice of a new install and said nothing about an upgrade. Still, it seemed to go through smoothly, so I'll just cross my fingers. Now that that's done, do I need to change my global.cfg setting? The old setting is SNIFFER external nonzero D:\imail\sniffer\liajkovy.exe w91zgqvr4g73s6o5 7 0. I'm guessing the installer didn't understand the old installation -- that happens sometimes because they all tend to be a little different. You should comment out your old SNIFFER line -- the installer should have created a new one for you that calls SNFClient. Note that SNFClient will accept and ignore the authentication string, but it doesn't need to have it... Your new SNIFFER line might look something like: SNIFFER external nonzero D:\sniffer\SNFClient.exe 7 0 Hope this helps, _M --- [This E-mail was checked by Declude] -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
Got it. Thanks! --- [This E-mail was checked by Declude] - Original Message - From: Pete McNeil madscient...@microneil.com To: declude.junkmail@declude.com Sent: Sunday, August 01, 2010 2:34 PM Subject: Re: [Declude.JunkMail] What's wrong with my Declude? On 8/1/2010 3:03 PM, Imail Admin wrote: Hi Pete, OK, I did the upgrade. One thing that was slightly different from the instructions was that even though I directed it to install into the same folder as the prior Sniffer installation (d:\imail\sniffer), it only offered me a choice of a new install and said nothing about an upgrade. Still, it seemed to go through smoothly, so I'll just cross my fingers. Now that that's done, do I need to change my global.cfg setting? The old setting is SNIFFER external nonzero D:\imail\sniffer\liajkovy.exe w91zgqvr4g73s6o5 7 0. I'm guessing the installer didn't understand the old installation -- that happens sometimes because they all tend to be a little different. You should comment out your old SNIFFER line -- the installer should have created a new one for you that calls SNFClient. Note that SNFClient will accept and ignore the authentication string, but it doesn't need to have it... Your new SNIFFER line might look something like: SNIFFER external nonzero D:\sniffer\SNFClient.exe 7 0 Hope this helps, _M --- [This E-mail was checked by Declude] -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
Hi, I'm running IMail 2006.23 as well and running the latest Declude with build in sniffer. It is the easiest to set up. Met vriendelijke groet, Bonno Bloksma senior systeembeheerder tio hogeschool hospitality en toerisme begijnenhof 8-12 / 5611 el eindhoven t 040 296 28 28 / f 040 237 35 20 b.blok...@tio.nl / www.tio.nl - Original Message - From: Imail Admin To: declude.junkmail@declude.com Sent: Sunday, August 01, 2010 8:40 PM Subject: Re: [Declude.JunkMail] What's wrong with my Declude? Hi Pete, Thanks. I think I'll try your installer first. I checked and my Sniffer subscription runs out in late September. I'm considering the possibility of upgrading Declude (first time in many years) and getting the OEM Sniffer with it. If I do that, it'll be in September. My system is so old (Imail 2006.23 running on top of Windows Server 2000) that I worry it won't handle the newest versions of these products. Thanks, Ben --- [This E-mail was checked by Declude] - Original Message - From: Pete McNeil madscient...@microneil.com To: declude.junkmail@declude.com Sent: Sunday, August 01, 2010 11:28 AM Subject: Re: [Declude.JunkMail] What's wrong with my Declude? On 8/1/2010 1:36 PM, Imail Admin wrote: Hi Pete, By SNF I assume you mean Sniffer? How do I tell for sure which version is running and whether it is getting the latest downloads? I know it's running at least partially because the report lists it. I checked the cfg file and it says configuration for v2r3, so I assume that's version 2 and not version 3? Then I checked my old emails and found that my last license renewal was at the end of last August, so I have a valid license. I haven't received any noticed since then about newer versions or even renewing my license this year. That all sounds about right. I'm betting (based on the above) that you simply never upgraded to version 3. The best way to do that is to use our installer. http://www.armresearch.com/products/snfClientServerWinInstaller.jsp http://www.armresearch.com/message-sniffer/download/SNF_CS_Installer.exe Another good way (if you're upgrading Declude also) is to switch to the built-in OEM version of SNF in Declude. (contact Declude about that if you wish to switch). _M --- [This E-mail was checked by Declude] -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What's wrong with my Declude?
Hi, We've been using Declude JM/AV with Imail for a long time. The current versions are Imail 2006.23 and Declude 1.63. I don't spend much time tweaking the system any more -- it's a small server that only handles about 40 domains (none of them heavy users). Anyway, lately (last couple of weeks) I've noticed more spam getting through. A lot more. Everything seems to be working as always, but it's not as effective. I'm looking for advice on how to make this effective without spending either big bucks or investing huge amounts of time. Any advice? Here is my DL Analyzer report: Total Messages Processed: 7,487 Messages That Failed Defined Test(s): 7,404 Percentage That Failed Defined Test(s): 98.89% Average Message Weight: 42 Average Message Weight/Failed: 42 TEST # FAILED PERCENTAGE CATCHALLMAILS 7,404 98.89% IPNOTINMX 7,306 97.58% WEIGHT4 6,791 90.70% WEIGHT5 6,726 89.84% WEIGHT7 6,652 88.85% WEIGHT8 6,554 87.54% WEIGHT10 6,481 86.56% WEIGHT12 6,282 83.91% NOLEGITCONTENT 6,239 83.33% WEIGHT15 6,147 82.10% WEIGHT20 5,930 79.20% WEIGHT20R 5,930 79.20% BARRACUDA 5,917 79.03% WEIGHT30 5,534 73.91% WEIGHT30R 5,534 73.91% INV-URIBL 5,427 72.49% SPFUNKNOWN 5,290 70.66% SNIFFER 4,625 61.77% CBL 4,121 55.04% UCEPROTECT-2 3,840 51.29% UCEPROTECT-3 3,702 49.45% SPAMCOP 3,659 48.87% UCEPROTECT-1 3,355 44.81% REVDNS 2,467 32.95% CMDSPACE 2,290 30.59% SUBCHARS-50 2,227 29.74% SUBCHARS-55 1,787 23.87% SPFPASS 1,664 22.23% SORBS-WEB 1,574 21.02% SUBCHARS-60 1,441 19.25% SORBS-DUHL 1,086 14.51% FIVETEN-SRC 1,085 14.49% FROMNOMATCH 1,072 14.32% NOPOSTMASTER 886 11.83% NOABUSE 728 9.72% SUBSPACE-12 592 7.91% BADHEADERS 583 7.79% SURBL 564 7.53% DYNHELO 541 7.23% WEIGHT7R 505 6.75% NONENGLISH 500 6.68% IMP-SPAM 392 5.24% SPFFAIL 342 4.57% WEIGHT10R 334 4.46% SORBS-SPAM 325 4.34% WEIGHT8R 293 3.91% SUBSPACE-15 286 3.82% WEIGHT4R 269 3.59% WEIGHT5R 245 3.27% WEIGHT15R 217 2.90% SPAMCANNIBAL 217 2.90% HELOBOGUS 217 2.90% SBL 205 2.74% SUBSPACE-17 201 2.68% WEIGHT12R 174 2.32% AHBL 158 2.11% SPAMHEADERS 152 2.03% BADWHOIS 133 1.78% FIVETEN-OPTIN 113 1.51% DSN 57 0.76% BONDEDSENDER 46 0.61% ROUTING 36 0.48% SIZE-300K 33 0.44% BASE64 32 0.43% SIZE-500K 20 0.27% IADB 19 0.25% AHBL-DOMAINS 15 0.20% SIZE-1MB 12 0.16% CONTSPACES 4 0.05% NJABL 4 0.05% BADCTYREVDNSTO 1 0.01% Thanks, Ben --- [This E-mail scanned for viruses by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What's wrong with my Declude?
On 7/28/2010 2:29 PM, Imail Admin wrote: lately (last couple of weeks) I've noticed more spam getting through. A lot more. Check your SNF installation. I looked up your license ID and checked for your telemetry and did not find it. This usually means that SNF is not currently running on your system or that you have not yet upgraded to version 3. Hope this helps, _M -- President MicroNeil Research Corporation www.microneil.com --- [This E-mail scanned for viruses by Declude] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
