Re: [Declude.JunkMail] Why is this getting thru????
tried this from two different computers.. one being the mail server which uses my dns server and one that uses an upstream dns server and I get the same response from both C:\Documents and Settings\Administratorping 2.0.0.127.bl.spamcop.net Ping request could not find host 2.0.0.127.bl.spamcop.net. Please check the name and try again. Bennie - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, April 06, 2004 4:31 PM Subject: Re: [Declude.JunkMail] Why is this getting thru I run my own dns server... Is it listed in the IMail SMTP settings? I would trying running some tests, such as ping 2.0.0.127.bl.spamcop.net to see if it is functioning properly (you should see [127.0.0.2] in response to the ping). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
tried this from two different computers.. one being the mail server which uses my dns server and one that uses an upstream dns server and I get the same response from both C:\Documents and Settings\Administratorping 2.0.0.127.bl.spamcop.net Ping request could not find host 2.0.0.127.bl.spamcop.net. Please check the name and try again. That would definitely be a problem. Your DNS isn't working properly. The first step would be to type ipconfig /all from a command prompt (or 'ipconfig /all | find DNS server /i' to see just the DNS lines) to see which DNS server(s) are being used. Then, you'll need to do some testing to see what the problem is with them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
the dns server I use on this machine is managed by ATT it is giving the same response.. which is also the dns server I use as a forward for my dns server Bennie - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 07, 2004 5:10 PM Subject: Re: [Declude.JunkMail] Why is this getting thru tried this from two different computers.. one being the mail server which uses my dns server and one that uses an upstream dns server and I get the same response from both C:\Documents and Settings\Administratorping 2.0.0.127.bl.spamcop.net Ping request could not find host 2.0.0.127.bl.spamcop.net. Please check the name and try again. That would definitely be a problem. Your DNS isn't working properly. The first step would be to type ipconfig /all from a command prompt (or 'ipconfig /all | find DNS server /i' to see just the DNS lines) to see which DNS server(s) are being used. Then, you'll need to do some testing to see what the problem is with them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
tried from dns tools (http://www.dnsstuff.com/tools/ping.ch?ip=2.0.0.127.bl.spamcop.net) and I get the following Can not route to 2.0.0.127.bl.spamcop.net so confused... - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 07, 2004 5:10 PM Subject: Re: [Declude.JunkMail] Why is this getting thru tried this from two different computers.. one being the mail server which uses my dns server and one that uses an upstream dns server and I get the same response from both C:\Documents and Settings\Administratorping 2.0.0.127.bl.spamcop.net Ping request could not find host 2.0.0.127.bl.spamcop.net. Please check the name and try again. That would definitely be a problem. Your DNS isn't working properly. The first step would be to type ipconfig /all from a command prompt (or 'ipconfig /all | find DNS server /i' to see just the DNS lines) to see which DNS server(s) are being used. Then, you'll need to do some testing to see what the problem is with them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
tried from dns tools (http://www.dnsstuff.com/tools/ping.ch?ip=2.0.0.127.bl.spamcop.net) and I get the following Can not route to 2.0.0.127.bl.spamcop.net That's normal. If you go to http://www.dnsstuff.com/tools/lookup.ch?ip=2.0.0.127.bl.spamcop.nettype=A , you'll see that the A record of 2.0.0.127.bl.spamcop.net is 127.0.0.2. It is not possible to route to that IP, which is why you see that message. However, typing ping 2.0.0.127.bl.spamcop.net on a Windows computer will display 127.0.0.2 in the results. the dns server I use on this machine is managed by ATT it is giving the same response.. which is also the dns server I use as a forward for my dns server Then you are using the ATT DNS server, which is most likely not allowing those DNS requests to be looked up. Several large ISPs do not allow their DNS servers to be used for such queries. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
not sure where to go from here.. all the checks on the dns server say that it is working correctly. when I look at the cached lookups it shows bl.spamcop.net... but not the a record or the ip address... Bennie - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 07, 2004 6:35 PM Subject: Re: [Declude.JunkMail] Why is this getting thru tried from dns tools (http://www.dnsstuff.com/tools/ping.ch?ip=2.0.0.127.bl.spamcop.net) and I get the following Can not route to 2.0.0.127.bl.spamcop.net That's normal. If you go to http://www.dnsstuff.com/tools/lookup.ch?ip=2.0.0.127.bl.spamcop.nettype=A , you'll see that the A record of 2.0.0.127.bl.spamcop.net is 127.0.0.2. It is not possible to route to that IP, which is why you see that message. However, typing ping 2.0.0.127.bl.spamcop.net on a Windows computer will display 127.0.0.2 in the results. the dns server I use on this machine is managed by ATT it is giving the same response.. which is also the dns server I use as a forward for my dns server Then you are using the ATT DNS server, which is most likely not allowing those DNS requests to be looked up. Several large ISPs do not allow their DNS servers to be used for such queries. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
not sure where to go from here.. all the checks on the dns server say that it is working correctly. No. If you type the ping command and don't see 127.0.0.2, the DNS server isn't working properly. when I look at the cached lookups it shows bl.spamcop.net... but not the a record or the ip address... That's because ATT ain't letting you do it. Since you have your own DNS server, I would recommend not using forwarders, which forces you to follow any restrictions that ATT places on you. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
BINGO.. removed the forwards to att and it let me find it... thanks Scott Bennie - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 07, 2004 7:00 PM Subject: Re: [Declude.JunkMail] Why is this getting thru not sure where to go from here.. all the checks on the dns server say that it is working correctly. No. If you type the ping command and don't see 127.0.0.2, the DNS server isn't working properly. when I look at the cached lookups it shows bl.spamcop.net... but not the a record or the ip address... That's because ATT ain't letting you do it. Since you have your own DNS server, I would recommend not using forwarders, which forces you to follow any restrictions that ATT places on you. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Why is this getting thru????
Hello, I received the following email... it only got a weight of 6. When I ran the dnsstuff spam lookup it faild more things than what is listed. I have my config file at the bottom I also have the log entries Why did it make it thru. Bennie Received: from peoplepc.com [163.29.216.1] by mail.pepperlink.net (SMTPD32-8.05) id A68C59801EE; Tue, 06 Apr 2004 01:56:28 -0400 To: [EMAIL PROTECTED] From: quinn [EMAIL PROTECTED] Date: Tue, 06 Apr 2004 06:02:29 GMT Message-Id: [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] Subject: Lasts 8x longer than V_I_A_G_R_A, and cheap too!ledzep quebec Content-Type: text/plain; X-IMAIL-SPAM-VALREVDNS: (93848046) X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 163.29.216.1 with no reverse DNS entry. X-Declude-Sender: [EMAIL PROTECTED] [163.29.216.1] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOPOSTMASTER, REVDNS [6] X-Note: QueInControl: D468c059801eefd6b.SMD (49) X-Spam-Tests-Failed: NOPOSTMASTER, REVDNS [6] X-Note: RDNS Real Origin: [No Reverse DNS][163.29.216.1] X-Note: SMTP Real From: [EMAIL PROTECTED] X-Note: SMTP Real To: X-Note: This E-mail was sent from [No Reverse DNS] ([163.29.216.1]). X-RBL-Warning: Total spam weight of this E-mail is 6. X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 378524237 Pay pennies on the dollar for C1ALIS! Lasts for up to 36 hours! http://wehavecheap.com/sv/index.php?pid=eph9106 tacobell fletch pookie1 groovy molly1 pookie1 florida mike1 marvin vanilla yomama molly1 law cardinal jkm monopoly fiona strawber philip apple1 timber vicky jeff basil timber redrumtracy binky dragonfl pacers gocougs valhalla aliens nugget bigman blondie surf peggy percy get off the list here: http://tracy.mybestchoice.net/mm/chair.php --- [This E-mail scanned for viruses by Declude Virus] # # Declude JunkMail configuration file. # # This file has the global Declude JunkMail settings, defines the tests, and lists the # actions to take on outgoing E-mail (for the Pro version; not normally used). # CODE # in the LOGFILE option, if present, automatically gets replaced with the month/date. LOGFILE e:\imail\declude\log\dec.log LOGLEVELMID HOP 0 #HOPHIGH 1 # # Below are some advanced options # HIDETESTS CATCHALLMAILS IPNOTINMX NOLEGITCONTENT XINHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] XINHEADER X-Note: QueInControl: %QUEUENAME% (%NRECIPS%) XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] XINHEADER X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%] XINHEADER X-Note: SMTP Real From: %MAILFROM% XINHEADER X-Note: SMTP Real To: %ALLRECIPS% XOUTHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%] #XINHEADER X-Country-Chain: %COUNTRYCHAIN% XOUTHEADER X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. XSENDER ON XSPOOLNAME OFF XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]). XINHEADER X-RBL-Warning: Total spam weight of this E-mail is %WEIGHT%. #XOUTHEADER Organization: Your Name Here #IPBYPASS 127.0.0.1 #WHITELIST HABEAS #WHITELIST AUTH # # Definitions of the tests to use (do not edit unless you know what you are doing). # These must come before the actions. # # First is the name of the check, then the type of check (ip4r is a DNS lookup using # the reverse of the IP address). # # For type ip4r, 'matchstring' is the string to look for, or * for anything. # AHBL ip4r dnsbl.ahbl.org * 6 0 BLITZEDALL ip4r opm.blitzed.org * 7 0 CBL ip4r cbl.abuseat.org 127.0.0.2 6 0 DSBL ip4r list.dsbl.org * 6 0 ORDB ip4r relays.ordb.org * 5 0 SBL ip4rsbl.spamhaus.org * 7 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 5 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 5 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 5 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 5 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 4 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 5 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 5 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 5 0 SORBS-DUHL ip4r dnsbl.sorbs.net 127.0.0.10 4 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 15 0 DSN rhsbl dsn.rfc-ignorant.org 127.0.0.2 3 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTER rhsbl postmaster.rfc-ignorant.org 127.0.0.3 1 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 10 0 BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -20 0 BADHEADERS badheaders x x 8 0 BASE64 base64 x x 4 0 COMMENTS comments x x 7 0 HELOBOGUS helovalid x x 10 0 IPNOTINMX ipnotinmx x x 0 -1 MAILFROMenvfrom x x 12 0 NOLEGITCONTENT nolegitcontent x x 0 -1 PERCENT percent x x 10 0 REVDNS revdnsexists x x 5 0 ROUTING spamrouting
Re: [Declude.JunkMail] Why is this getting thru????
I run my own dns server... - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, April 06, 2004 7:29 AM Subject: Re: [Declude.JunkMail] Why is this getting thru I received the following email... it only got a weight of 6. That's why it got through. When I ran the dnsstuff spam lookup it faild more things than what is listed. I have my config file at the bottom I also have the log entries Something isn't right with your DNS: Received: from peoplepc.com [163.29.216.1] by mail.pepperlink.net (SMTPD32-8.05) id A68C59801EE; Tue, 06 Apr 2004 01:56:28 -0400 X-Declude-Sender: [EMAIL PROTECTED] [163.29.216.1] Declude JunkMail is seeing the correct IP, but: X-Spam-Tests-Failed: NOPOSTMASTER, REVDNS [6] These two tests are failing, which both use DNS, but none of the IP-based DNS tests failed (BLITZEDALL, CBL, DSBL, ORDB, or SPAMCOP). Are you by any chance using your Internet provider's DNS server? It may be that they are blocking these lookups. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Why is this getting thru????
I run my own dns server... Is it listed in the IMail SMTP settings? I would trying running some tests, such as ping 2.0.0.127.bl.spamcop.net to see if it is functioning properly (you should see [127.0.0.2] in response to the ping). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
