[Declude.JunkMail] mailbox forwarding no action
I'm pretty new to Declude Spam so I may have something setup wrong. I have -- IMail: 7.0 ?5? Declude Junkmail: 1.75 Pro Virtual Domain: mail.example.com With alias: example.com Mailbox that has forwarding on it [EMAIL PROTECTED] forwards to: [EMAIL PROTECTED] [EMAIL PROTECTED] User1 has user config file (user1.junkmail) User3 has user config file (user2.junkmail) mail.example.com has default config file ($default$.junkmail) All three config files are basically the say, with the only difference being the WHITELISTFILE settings. declude has default config file ($default.junkmail) This config file has everything turned off. ** Now if a message is sent to User1 it fails tests, the log says that it is moving the message to the spambox mailbox (this is the correct action), but it never makes it, and the users that are setup to receive the forwarded message get it. Now the final users, get the message, in the headers it says it fails but no action is taken. If I remove the forward.ima file from the User1 directory (turning off forwarding) everything behaves as it should ( the message goes into the spam box). Put the forwarding back on and it reverts bas to the problem state. Below is the debug log file, as you can see the log thinks the message is being moved to the correct place, but it never gets there. And there are no logs for the forwarded message to User2 and User3. Am I doing some wrong. If you want I can show you the config files. Thanks in advance. --Jason W. Allen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] mailbox forwarding no action
Virtual Domain: mail.example.com With alias: example.com Mailbox that has forwarding on it [EMAIL PROTECTED] In this case, all E-mail sent to [EMAIL PROTECTED] will use the configurations for [EMAIL PROTECTED]. that would be a per-user file \IMail\Declude\mail.example.com\user1.JunkMail or a per-domain file \IMail\Declude\mail.example.com. forwards to: [EMAIL PROTECTED] [EMAIL PROTECTED] That actually isn't relevant here -- the E-mail will be scanned based on the settings for user1. Now if a message is sent to User1 it fails tests, the log says that it is moving the message to the spambox mailbox (this is the correct action), but it never makes it, and the users that are setup to receive the forwarded message get it. Have you checked the IMail SMTP log files? They should provide some information as to what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] mailbox forwarding no action
See the following recent thread for the answer: http://www.mail-archive.com/declude.junkmail%40declude.com/msg10790.html Matt Jason W. Allen wrote: I'm pretty new to Declude Spam so I may have something setup wrong. I have -- IMail: 7.0 ?5? Declude Junkmail: 1.75 Pro Virtual Domain: mail.example.com With alias: example.com Mailbox that has forwarding on it [EMAIL PROTECTED] forwards to: [EMAIL PROTECTED] [EMAIL PROTECTED] User1 has user config file (user1.junkmail) User3 has user config file (user2.junkmail) mail.example.com has default config file ($default$.junkmail) All three config files are basically the say, with the only difference being the WHITELISTFILE settings. declude has default config file ($default.junkmail) This config file has everything turned off. ** Now if a message is sent to User1 it fails tests, the log says that it is moving the message to the spambox mailbox (this is the correct action), but it never makes it, and the users that are setup to receive the forwarded message get it. Now the final users, get the message, in the headers it says it fails but no action is taken. If I remove the forward.ima file from the User1 directory (turning off forwarding) everything behaves as it should ( the message goes into the spam box). Put the forwarding back on and it reverts bas to the problem state. Below is the debug log file, as you can see the log thinks the message is being moved to the correct place, but it never gets there. And there are no logs for the forwarded message to User2 and User3. Am I doing some wrong. If you want I can show you the config files. Thanks in advance. --Jason W. Allen 09/10/2003 09:14:42.953 Q23c2055400a6d83d Setting DNS server to IMail's 198.6.1.5. 09/10/2003 09:14:42.968 Q23c2055400a6d83d Declude JunkMail Pro Version Registered 09/10/2003 09:14:42.968 Q23c2055400a6d83d Start 09/10/2003 09:14:42.984 Q23c2055400a6d83d Locked E:\IMail\spool\Q23c2055400a6d83d.SMD. 09/10/2003 09:14:42.984 Q23c2055400a6d83d Getting message envelope 09/10/2003 09:14:42.984 Q23c2055400a6d83d Copyall=no_copyall_account. 09/10/2003 09:14:43.000 Q23c2055400a6d83d QE:\IMail\spool\D23c2055400a6d83d.SMD 09/10/2003 09:14:43.000 Q23c2055400a6d83d Hgershwin.mpgis.net 09/10/2003 09:14:43.015 Q23c2055400a6d83d WE:\IMail 09/10/2003 09:14:43.015 Q23c2055400a6d83d E0, 09/10/2003 09:14:43.031 Q23c2055400a6d83d S[EMAIL PROTECTED] 09/10/2003 09:14:43.031 Q23c2055400a6d83d NRCPT TO: [EMAIL PROTECTED] 09/10/2003 09:14:43.046 Q23c2055400a6d83d Recip: NRCPT TO: [EMAIL PROTECTED] 09/10/2003 09:14:43.046 Q23c2055400a6d83d R[EMAIL PROTECTED] 09/10/2003 09:14:43.046 Q23c2055400a6d83d Recip: R[EMAIL PROTECTED] 09/10/2003 09:14:43.062 Q23c2055400a6d83d Setting altaddr 0 to [EMAIL PROTECTED] [EMAIL PROTECTED] 09/10/2003 09:14:43.062 Q23c2055400a6d83d Setting reciphost to example.com 09/10/2003 09:14:43.062 Q23c2055400a6d83d 09/10/2003 09:14:43.078 Q23c2055400a6d83d nRecips: 1 (1 total) 09/10/2003 09:14:43.078 Q23c2055400a6d83d Recip 0: [EMAIL PROTECTED] = [EMAIL PROTECTED] 09/10/2003 09:14:43.093 Q23c2055400a6d83d Starting locality check (sender=declude.com; nr=1 ca=off). 09/10/2003 09:14:43.093 Q23c2055400a6d83d CL Opening HKEY_LOCAL_MACHINE\software\Ipswitch\IMail\Domains 09/10/2003 09:14:43.093 Q23c2055400a6d83d [EMAIL PROTECTED] [0] is local domain2 09/10/2003 09:14:43.109 Q23c2055400a6d83d Done getting message envelope 09/10/2003 09:14:43.109 Q23c2055400a6d83d Getting headers 09/10/2003 09:14:43.125 Q23c2055400a6d83d Done getting envelope and headers 09/10/2003 09:14:43.125 Q23c2055400a6d83d Ver=30 verflag=0 09/10/2003 09:14:43.140 Q23c2055400a6d83d About to run spam tests 09/10/2003 09:14:43.140 Q23c2055400a6d83d Going through datafile 09/10/2003 09:14:43.156 Q23c2055400a6d83d LOOKING FOR IP: Received: from www.declude.com [216.58.1 09/10/2003 09:14:43.156 Q23c2055400a6d83d Setting [IPTEXT] to 216.58.174.203 09/10/2003 09:14:43.156 Q23c2055400a6d83d iptext now=216.58.174.203 09/10/2003 09:14:43.171 Q23c2055400a6d83d Testing IP 216.58.174.203 09/10/2003 09:14:43.171 Q23c2055400a6d83d Handling Received: header 09/10/2003 09:14:43.187 Q23c2055400a6d83d Got IP 216.58.174.203 09/10/2003 09:14:43.187 Q23c2055400a6d83d Setting remote IP address to 216.58.174.203 09/10/2003 09:14:43.203 Q23c2055400a6d83d 203.174.58.216.in-addr.arpa 09/10/2003 09:14:52.890 Q23c2055400a6d83d revdns: nt3.nshosts.com. 09/10/2003 09:14:52.890 Q23c2055400a6d83d Hop 0: Checking IP Address 216.58.174.203. 09/10/2003 09:14:52.890 Q23c2055400a6d83d iptext=216.58.174.203 myip1=d83aaecb i=4 09/10/2003 09:15:02.968 Q23c2055400a6d83d Test 0-BLITZEDALL didn't get a response. 09/10/2003 09:15:02.968 Q23c2055400a6d83d Test 1-CBL didn't get a response. 09/10/2003 09:15:02.968 Q23c2055400a6d83d Test 2-DSBL didn't get a response. 09/10/2003 09:15:02.984 Q23c2055400a6d83d Test 3-EASYNET-DNSBL didn't get a
RE: [Declude.JunkMail] mailbox forwarding no action
What I don't understand, is that the logs say it is using the correct config file and then performing the correct action. But that is as far as it goes. The message doesn't actually get moved the Spambox Mailbox, but gets forwarded on to the downstream users and then settings don't pick it up. The SMTP logs, just show the message being received and then being converted to a .FWD File and forwarded to User2 User3 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 10:32 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] mailbox forwarding no action Virtual Domain: mail.example.com With alias: example.com Mailbox that has forwarding on it [EMAIL PROTECTED] In this case, all E-mail sent to [EMAIL PROTECTED] will use the configurations for [EMAIL PROTECTED]. that would be a per-user file \IMail\Declude\mail.example.com\user1.JunkMail or a per-domain file \IMail\Declude\mail.example.com. forwards to: [EMAIL PROTECTED] [EMAIL PROTECTED] That actually isn't relevant here -- the E-mail will be scanned based on the settings for user1. Now if a message is sent to User1 it fails tests, the log says that it is moving the message to the spambox mailbox (this is the correct action), but it never makes it, and the users that are setup to receive the forwarded message get it. Have you checked the IMail SMTP log files? They should provide some information as to what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
What I don't understand, is that the logs say it is using the correct config file and then performing the correct action. But that is as far as it goes. The message doesn't actually get moved the Spambox Mailbox, but gets forwarded on to the downstream users and then settings don't pick it up. What happens here is Declude JunkMail changes the recipient's address from [EMAIL PROTECTED] to [EMAIL PROTECTED], and IMail is then supposed to deliver it to the spambox account. The SMTP logs, just show the message being received and then being converted to a .FWD File and forwarded to User2 User3 Are you sure that you have a ., at the beginning of the forwarding line? Without that, IMail won't keep a copy in the original recipient's mailbox. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Or should I revise my whole policy about forwarding? --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 10:52 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action What I don't understand, is that the logs say it is using the correct config file and then performing the correct action. But that is as far as it goes. The message doesn't actually get moved the Spambox Mailbox, but gets forwarded on to the downstream users and then settings don't pick it up. What happens here is Declude JunkMail changes the recipient's address from [EMAIL PROTECTED] to [EMAIL PROTECTED], and IMail is then supposed to deliver it to the spambox account. The SMTP logs, just show the message being received and then being converted to a .FWD File and forwarded to User2 User3 Are you sure that you have a ., at the beginning of the forwarding line? Without that, IMail won't keep a copy in the original recipient's mailbox. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. That is the way that it should work. E-mail that is forwarded from one user to another automatically in IMail (as opposed to aliases or forwarding from a mail client) bypasses any scanning. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Very close. The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Unfortunately, I'm not aware of any way around this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
So in other words, If I have mailboxes with forwarding on them Spam will still get through. Disappointing... --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. That is the way that it should work. E-mail that is forwarded from one user to another automatically in IMail (as opposed to aliases or forwarding from a mail client) bypasses any scanning. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Very close. The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Unfortunately, I'm not aware of any way around this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
It appears that I spoke too soon... I have figured it out. I really don't want to beat a dead horse, but I really needed a solution for this. We have Addresses that need to have mail come from them, but note really receive mail, that why it needs to have a real mailbox (valid user) to send mail. Such as techsupport, etc. But these mailboxes are forwarded to multiple people, but with the configuration all the end mailboxes get a ton of spam, that's why it very important, that I find a solution. So for anybody that's interested here is the fix. For the mailbox that is currently forwarded: [EMAIL PROTECTED] Remove all the forwarding on this box. Create an Alias that has the same name as the Mailbox: [EMAIL PROTECTED] Forward this alias to the user(s) you need, to make sure that you can use the existing config files, make sure you forward to the Full Host, such as [EMAIL PROTECTED] You can also setup the forwarding to a list file, See the Imail documentation for that. There you have it. Any spam that comes in for the Alias will get redirected before in gets tested by declude, making declude think that the message came directly to the end user and test it accordingly. --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action So in other words, If I have mailboxes with forwarding on them Spam will still get through. Disappointing... --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. That is the way that it should work. E-mail that is forwarded from one user to another automatically in IMail (as opposed to aliases or forwarding from a mail client) bypasses any scanning. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Very close. The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Unfortunately, I'm not aware of any way around this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
Why do they have to have a real mail box? I send mail as aliases all the time, my support, sales, postmaster, hostmaster, webmaster, staff, etc., addresses are all aliases but I have no problem sending as them, as long as the client is configured correctly. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 11:42 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action It appears that I spoke too soon... I have figured it out. I really don't want to beat a dead horse, but I really needed a solution for this. We have Addresses that need to have mail come from them, but note really receive mail, that why it needs to have a real mailbox (valid user) to send mail. Such as techsupport, etc. But these mailboxes are forwarded to multiple people, but with the configuration all the end mailboxes get a ton of spam, that's why it very important, that I find a solution. So for anybody that's interested here is the fix. For the mailbox that is currently forwarded: [EMAIL PROTECTED] Remove all the forwarding on this box. Create an Alias that has the same name as the Mailbox: [EMAIL PROTECTED] Forward this alias to the user(s) you need, to make sure that you can use the existing config files, make sure you forward to the Full Host, such as [EMAIL PROTECTED] You can also setup the forwarding to a list file, See the Imail documentation for that. There you have it. Any spam that comes in for the Alias will get redirected before in gets tested by declude, making declude think that the message came directly to the end user and test it accordingly. --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action So in other words, If I have mailboxes with forwarding on them Spam will still get through. Disappointing... --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. That is the way that it should work. E-mail that is forwarded from one user to another automatically in IMail (as opposed to aliases or forwarding from a mail client) bypasses any scanning. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Very close. The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Unfortunately, I'm not aware of any way around this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com
RE: [Declude.JunkMail] mailbox forwarding no action
Some of the mail is not coming from a client. I have mail auto generators on some servers for certain apps, and websites. If I try to send from an alias I get relaying errors, since I can't use other settings, other then a mailfrom. So that's why I need a valid Email Address. --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Charles Frolick Sent: Wednesday, September 10, 2003 1:25 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action Why do they have to have a real mail box? I send mail as aliases all the time, my support, sales, postmaster, hostmaster, webmaster, staff, etc., addresses are all aliases but I have no problem sending as them, as long as the client is configured correctly. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 11:42 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action It appears that I spoke too soon... I have figured it out. I really don't want to beat a dead horse, but I really needed a solution for this. We have Addresses that need to have mail come from them, but note really receive mail, that why it needs to have a real mailbox (valid user) to send mail. Such as techsupport, etc. But these mailboxes are forwarded to multiple people, but with the configuration all the end mailboxes get a ton of spam, that's why it very important, that I find a solution. So for anybody that's interested here is the fix. For the mailbox that is currently forwarded: [EMAIL PROTECTED] Remove all the forwarding on this box. Create an Alias that has the same name as the Mailbox: [EMAIL PROTECTED] Forward this alias to the user(s) you need, to make sure that you can use the existing config files, make sure you forward to the Full Host, such as [EMAIL PROTECTED] You can also setup the forwarding to a list file, See the Imail documentation for that. There you have it. Any spam that comes in for the Alias will get redirected before in gets tested by declude, making declude think that the message came directly to the end user and test it accordingly. --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 12:11 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action So in other words, If I have mailboxes with forwarding on them Spam will still get through. Disappointing... --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 10, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] mailbox forwarding no action I have added the ., to the forward file and now a copy of the message gets moved to the spambox. But the message still goes downstream to the forwarded to Users and does not get picked up as spam. That is the way that it should work. E-mail that is forwarded from one user to another automatically in IMail (as opposed to aliases or forwarding from a mail client) bypasses any scanning. I think I follow the logic, of why this is not working: the message comes in from the outside, a copy is made to be processed by the forwarding Engine, the external (original message) gets tested, and since I don't have a copy being saved to the original recipient it doesn't do anything (since I enabled '.', it does get processed by declude and gets moved to the spambox--Correctly), the FWD Message does not get tested since it is now internal to the server, and goes to the downstream users, never getting tested, no action is taken and spam gets through. Is this the correct logic, or am I missing something? Very close. The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. Is there a way around this, such as once the message is moved then it is no longer forwarded, or that an internal message (the FWD message that gets processed by the SMTP-FWD) gets scanned by the Junkmail? Unfortunately, I'm not aware of any way around this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
RE: [Declude.JunkMail] mailbox forwarding no action
May be I misunderstand The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. If the forwarding is handled by Imail AFTER Declude processed it - then would Declude first ACT on the incoming email (e.g., bounce, delete, warn - and Virus checking) and only messages that make it past the Declude filters would eventually be forwarded? That is correct. If it works that way - then where's the problem? There is no reason to rescan the forwarded copies, if the original was already processed? If the E-mail is blocked (such as with DELETE or HOLD), there is no problem. But if you use an action that causes the E-mail to be delivered (such as SUBJECT, WARN, MAILBOX), then the forwarded E-mail will be delivered. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
Scott: May be I misunderstand The forwarding is actually handled by IMail after the E-mail is processed by Declude, so there is no evidence of forwarding when Declude sees the E-mail. If the forwarding is handled by Imail AFTER Declude processed it - then would Declude first ACT on the incoming email (e.g., bounce, delete, warn - and Virus checking) and only messages that make it past the Declude filters would eventually be forwarded? If it works that way - then where's the problem? There is no reason to rescan the forwarded copies, if the original was already processed? If it doesn't work that way, e.g., if one can really entirely bypass Declude simply by sending mail to a forwarding email account - then this would be a huge security hole? But I can't imagine that being the case!? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] mailbox forwarding no action
If I try to send from an alias I get relaying errors, since I can't use other settings, other then a mailfrom. So that's why I need a valid Email Address. Please don't tell us that you're using 'Relay for Local Users'--i.e. that you're running an open relay (unless this is only exposed internally). While some apps can't handle AUTH, is there some reason that you can't relay by IP? Are these server IPs really changing all that much? -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action
See now you've confused me... Which isn't very hard. I believe I have Relay for Local Users Only (If I look in the Imail admin interface, that what it says, but it says relay by addresses in the web admin). Yet If I test relaying (by telneting in and trying to send something with a local user address), I still get a relaying error and it won't let it. To me that means I'm am not a Open relay. But I still need a local usermailbox to send from my App mailers. --Jason W. Allen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Sanford Whiteman Sent: Wednesday, September 10, 2003 2:13 PM To: Jason W. Allen Subject: Re[2]: [Declude.JunkMail] mailbox forwarding no action If I try to send from an alias I get relaying errors, since I can't use other settings, other then a mailfrom. So that's why I need a valid Email Address. Please don't tell us that you're using 'Relay for Local Users'--i.e. that you're running an open relay (unless this is only exposed internally). While some apps can't handle AUTH, is there some reason that you can't relay by IP? Are these server IPs really changing all that much? -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] mailbox forwarding no action
I think you want to look at changing this. If I am correct (wasn't
clear from the settings you described), I could fake my from address as
one of your users and bounce E-mail off of your server. This is a
common test for an open relay.
What you want is "Relay Mail for Addresses" in the real IMail
interface. Then press the addresses button and add the IP's of your
E-mail sending scripts, and range for your local network(s). Anyone
that is outside of either one of these areas can use SMTP AUTH to send
E-mail ("My server requires authentication "checkbox in Outlook
Express, not checked by default; automatic in Netscape).
Matt
Jason W. Allen wrote:
See now you've confused me... Which isn't very hard.
I believe I have Relay for Local Users Only (If I look in the Imail admin
interface, that what it says, but it says relay by addresses in the web
admin). Yet If I test relaying (by telneting in and trying to send
something with a local user address), I still get a relaying error and it
won't let it. To me that means I'm am not a Open relay. But I still need
a local usermailbox to send from my App mailers.
--Jason W. Allen
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Sanford Whiteman
Sent: Wednesday, September 10, 2003 2:13 PM
To: Jason W. Allen
Subject: Re[2]: [Declude.JunkMail] mailbox forwarding no action
If I try to send from an alias I get relaying errors, since I can't
use other settings, other then a mailfrom. So that's why I need a
valid Email Address.
Please don't tell us that you're using 'Relay for Local Users'--i.e.
that you're running an open relay (unless this is only exposed
internally).
While some apps can't handle AUTH, is there some reason that you can't
relay by IP? Are these server IPs really changing all that much?
-Sandy
Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]
Re[4]: [Declude.JunkMail] mailbox forwarding no action
I believe I have Relay for Local Users Only (If I look in the Imail admin interface, that what it says... Then that's what it is, and you're an open relay. Yet If I test relaying (by telneting in and trying to send something with a local user address), I still get a relaying error and it won't let it. That doesn't make sense. You said that your appservers can only relay if they use a local user address as the sender. Then you said that if you telnet in and use a local user address as the sender, you can't relay. Which one is it? Telnet is not substantively different from what your appservers are doing, so you need to get some more consistent results. -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action
Working on it. Thanks for the tests, I don't know what I was doing wrong. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Charles Frolick Sent: Wednesday, September 10, 2003 3:32 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action Just relayed an email through your server from my desk. Transcript folows: Opening mail.mpgis.net... 220 gershwin.mpgis.net (IMail 7.07 36033-2) NT-ESMTP Server X1 HELO argolink.net 250 hello gershwin.mpgis.net MAIL FROM: [EMAIL PROTECTED] 250 ok RCPT TO: [EMAIL PROTECTED] 250 ok its for [EMAIL PROTECTED] DATA 354 ok, send it; end with CRLF.CRLF Sending Data... 250 Message queued QUIT 221 Goodbye You are an open relay. The ONLY acceptable settings are, relay for address or no relay. Thank you, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 1:57 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action See now you've confused me... Which isn't very hard. I believe I have Relay for Local Users Only (If I look in the Imail admin interface, that what it says, but it says relay by addresses in the web admin). Yet If I test relaying (by telneting in and trying to send something with a local user address), I still get a relaying error and it won't let it. To me that means I'm am not a Open relay. But I still need a local usermailbox to send from my App mailers. --Jason W. Allen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
But if you use an action that causes the E-mail to be delivered (such as SUBJECT, WARN, MAILBOX), then the forwarded E-mail will be delivered. I'm a bit dense today - and why would THAT be a problem? Or are you saying the forwarded email would be an entirely new email message and Declude's subject or header inserts would not appear in those forwarded copies? Some of our clients do use forwarding mailboxes - so I just want to be clear about the implications. Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mailbox forwarding no action
But if you use an action that causes the E-mail to be delivered (such as SUBJECT, WARN, MAILBOX), then the forwarded E-mail will be delivered. I'm a bit dense today - and why would THAT be a problem? They are using the MAILBOX action on the original recipient, so it will get delivered to [EMAIL PROTECTED], and then forwarded to [EMAIL PROTECTED] and [EMAIL PROTECTED] Since the forwarding doesn't have the MAILBOX action applied to it, there is no way to tell that it is spam. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action
Just futther proof, here are the headers from the message I sent: Received: from gershwin.mpgis.net [65.199.185.236] by argolink.net with ESMTP (SMTPD32-6.06) id A9D822F401B0; Wed, 10 Sep 2003 15:30:16 -0500 Received: from argolink.net [209.144.1.45] by gershwin.mpgis.net (SMTPD32-7.07) id A8201DF00DE; Wed, 10 Sep 2003 15:14:40 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Relay Test Date: Sept 10, 2003 14:27 -0500 Message-ID: [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [801e]. X-Declude-Sender: [EMAIL PROTECTED] [209.144.1.45] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Declude-Warning: [BADHEADERS] This message may be SPAM. This E-mail was sent from a broken mail client [801e]. X-SPAM-Level: SPAM-NONE X-Declude-Sender: [EMAIL PROTECTED] [65.199.185.236] X-Declude-Spoolname: D89d81b0.SMD X-Note: This E-mail was scanned for SPAM by ArgoLink.net with Declude JunkMail. X-Note: More info at http://help.argolink.net/spam.asp X-Declude-Failed: BADHEADERS, NOLEGITCONTENT, SPAM-NONE X-Declude-Total-Weight: 2 X-Declude-RCPT-Count: 1 X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 363051832 Status: U Ignore the BADHEADERS, I hand typed the message source. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charles Frolick Sent: Wednesday, September 10, 2003 2:32 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action Just relayed an email through your server from my desk. Transcript folows: Opening mail.mpgis.net... 220 gershwin.mpgis.net (IMail 7.07 36033-2) NT-ESMTP Server X1 HELO argolink.net 250 hello gershwin.mpgis.net MAIL FROM: [EMAIL PROTECTED] 250 ok RCPT TO: [EMAIL PROTECTED] 250 ok its for [EMAIL PROTECTED] DATA 354 ok, send it; end with CRLF.CRLF Sending Data... 250 Message queued QUIT 221 Goodbye You are an open relay. The ONLY acceptable settings are, relay for address or no relay. Thank you, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason W. Allen Sent: Wednesday, September 10, 2003 1:57 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] mailbox forwarding no action See now you've confused me... Which isn't very hard. I believe I have Relay for Local Users Only (If I look in the Imail admin interface, that what it says, but it says relay by addresses in the web admin). Yet If I test relaying (by telneting in and trying to send something with a local user address), I still get a relaying error and it won't let it. To me that means I'm am not a Open relay. But I still need a local usermailbox to send from my App mailers. --Jason W. Allen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
