Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
Thank you so much, Kami! I can definitely understand your concise explanation and it sounds like a great way to handle what I am trying to do or at least add another trick in the bag. I'll have to see how I can incorporate this into my current setup. Thanks, Again! Dan - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 14, 2004 4:32 PM Subject: RE: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? I don't even know how to mentally parse the below code that you've listed. REVDNS END ENDSWITH .hotmail.com MAILFROM 3 ENDSWITH @hotmail.com HELO 5 ENDSWITH .hotmail.com Hi Dan: This is what the above means. REVDNS END ENDSWITH .hotmail.com -- if reverse dns ends with Hotmail.com end the filter and do not process the rest of the filter. This way it won't even trigger the test as being run. What that means is the reverse DNS is hotmail.com MAILFROM 3 ENDSWITH @hotmail.com -- naturally if line 2 is executed it means that reverse DNS is NOT hotmail.com and if the mailfrom endswith hotmail.com then add 3 to the weight. As stated this is one of the many filters we have on Good ISP filters. This filter penalizes an email if the sender's email is hotmail but the reverse dns and helo are not. Similarly on line 3- HELO 5 ENDSWITH .hotmail.com Add 5 points if HELO ends with hotmail.com So if someone's email is [EMAIL PROTECTED] and the reverse dns is not hotmail.com the email gets 3 and if HELO is hotmail.com then it gets 8 points. Hope that explains it.. Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
Scott, I know it's been awhile since you posted the answer to my original question but I would _love_ to have a test which functions exactly the same as spamdomains but instead of searching the reverse DNS in a CONTAINS type manner it searched it an ENDSWITH type manner. That would allow me to create a file like the below (that would be used with the ENDSWITH-typespamdomains test)... - a.edu b.edu c.edu d.edu . . . w.edu x.edu y.edu z.edu - which I would use to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD. With edu especially a large majority of the time it does match so points for not matching would be great. And that's just one example of how that would be very useful to me. .Just another request to give consideration for the future. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 02, 2004 7:11 PM Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? If I have a SPAMDOMAINS type test in my GLOBAL.CFG... SD-TLD spamdomains D:\iMail\declude\JunkMail.SpamDomains.TLD.txt x 5 0 ...and I have some entries in the corresponding flat text file like below... .mil will SPAMDOMAINS search the reverse DNS entry in a CONTAINS type manner or an ENDSWITH type manner? It will work like CONTAINS, so: For example would the host name .milton-bradley.com in the below... - X-Note: Sent with HELO [mail] from Reverse DNS [mail.milton-bradley.com] - get flagged as passing or failing the SPAMDOMAINS test? That one would get caught, if the reverse DNS entry did not contain .mil in it. So if the E-mail was from [EMAIL PROTECTED], and the reverse DNS entry was mail.milton-bradley.com, the E-mail would not fail the test (but if the reverse DNS was mail.someone_else.com, it would fail the test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
Dan.. Can you not use a filter file for this? Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, May 14, 2004 9:09 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Scott, I know it's been awhile since you posted the answer to my original question but I would _love_ to have a test which functions exactly the same as spamdomains but instead of searching the reverse DNS in a CONTAINS type manner it searched it an ENDSWITH type manner. That would allow me to create a file like the below (that would be used with the ENDSWITH-typespamdomains test)... - a.edu b.edu c.edu d.edu . . . w.edu x.edu y.edu z.edu - which I would use to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD. With edu especially a large majority of the time it does match so points for not matching would be great. And that's just one example of how that would be very useful to me. .Just another request to give consideration for the future. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 02, 2004 7:11 PM Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? If I have a SPAMDOMAINS type test in my GLOBAL.CFG... SD-TLD spamdomains D:\iMail\declude\JunkMail.SpamDomains.TLD.txt x 5 0 ...and I have some entries in the corresponding flat text file like below... .mil will SPAMDOMAINS search the reverse DNS entry in a CONTAINS type manner or an ENDSWITH type manner? It will work like CONTAINS, so: For example would the host name .milton-bradley.com in the below... - X-Note: Sent with HELO [mail] from Reverse DNS [mail.milton-bradley.com] - get flagged as passing or failing the SPAMDOMAINS test? That one would get caught, if the reverse DNS entry did not contain .mil in it. So if the E-mail was from [EMAIL PROTECTED], and the reverse DNS entry was mail.milton-bradley.com, the E-mail would not fail the test (but if the reverse DNS was mail.someone_else.com, it would fail the test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
Kami, How do you see me using a filter file to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD.? I don't know how to use a filter file to compare a string in one field to a string in another. If it can be done that would be great. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 14, 2004 9:22 AM Subject: RE: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Dan.. Can you not use a filter file for this? Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, May 14, 2004 9:09 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Scott, I know it's been awhile since you posted the answer to my original question but I would _love_ to have a test which functions exactly the same as spamdomains but instead of searching the reverse DNS in a CONTAINS type manner it searched it an ENDSWITH type manner. That would allow me to create a file like the below (that would be used with the ENDSWITH-typespamdomains test)... - a.edu b.edu c.edu d.edu . . . w.edu x.edu y.edu z.edu - which I would use to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD. With edu especially a large majority of the time it does match so points for not matching would be great. And that's just one example of how that would be very useful to me. .Just another request to give consideration for the future. Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 02, 2004 7:11 PM Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? If I have a SPAMDOMAINS type test in my GLOBAL.CFG... SD-TLD spamdomains D:\iMail\declude\JunkMail.SpamDomains.TLD.txt x 5 0 ...and I have some entries in the corresponding flat text file like below... .mil will SPAMDOMAINS search the reverse DNS entry in a CONTAINS type manner or an ENDSWITH type manner? It will work like CONTAINS, so: For example would the host name .milton-bradley.com in the below... - X-Note: Sent with HELO [mail] from Reverse DNS [mail.milton-bradley.com] - get flagged as passing or failing the SPAMDOMAINS test? That one would get caught, if the reverse DNS entry did not contain .mil in it. So if the E-mail was from [EMAIL PROTECTED], and the reverse DNS entry was mail.milton-bradley.com, the E-mail would not fail the test (but if the reverse DNS was mail.someone_else.com, it would fail the test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing
RE: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
Dan.. May be I am not understanding the question. But I basically have a couple of combination tests that are like the following: REVDNS END ENDSWITH.hotmail.com MAILFROM3 ENDSWITH@hotmail.com HELO5 ENDSWITH.hotmail.com So with this logic you can add weight if someone is using Hotmail as return address but is not using hotmail to send mail. We have this for a lot of ISP's. Is this what you are trying to do? Regards, -Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, May 14, 2004 9:31 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Kami, How do you see me using a filter file to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD.? I don't know how to use a filter file to compare a string in one field to a string in another. If it can be done that would be great. Thanks, Dan Geiser [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
Hi, Kami, I don't even know how to mentally parse the below code that you've listed. Would this go inside a filter file? What does each line signify? For example, REVDNS END ENDSWITH .hotmail.com. I've not seen that syntax before. Is END a valid value in that column? What does it do? When was the END value introduced? I am currently running v1.75 and I know there's been a lot of stuff introduced since our Service Agreement expired. Thanks for your feedback. Dan - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 14, 2004 9:40 AM Subject: RE: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Dan.. May be I am not understanding the question. But I basically have a couple of combination tests that are like the following: REVDNS END ENDSWITH .hotmail.com MAILFROM 3 ENDSWITH @hotmail.com HELO 5 ENDSWITH .hotmail.com So with this logic you can add weight if someone is using Hotmail as return address but is not using hotmail to send mail. We have this for a lot of ISP's. Is this what you are trying to do? Regards, -Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, May 14, 2004 9:31 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Kami, How do you see me using a filter file to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD.? I don't know how to use a filter file to compare a string in one field to a string in another. If it can be done that would be great. Thanks, Dan Geiser [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
The END in the weight column is valid starting somewhere in the 1.77s. It causes the filter to immediately end with the current score. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 05/14/04 03:01PM Hi, Kami, I don't even know how to mentally parse the below code that you've listed. Would this go inside a filter file? What does each line signify? For example, REVDNS END ENDSWITH .hotmail.com. I've not seen that syntax before. Is END a valid value in that column? What does it do? When was the END value introduced? I am currently running v1.75 and I know there's been a lot of stuff introduced since our Service Agreement expired. Thanks for your feedback. Dan - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 14, 2004 9:40 AM Subject: RE: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Dan.. May be I am not understanding the question. But I basically have a couple of combination tests that are like the following: REVDNS END ENDSWITH .hotmail.com MAILFROM 3 ENDSWITH @hotmail.com HELO 5 ENDSWITH .hotmail.com So with this logic you can add weight if someone is using Hotmail as return address but is not using hotmail to send mail. We have this for a lot of ISP's. Is this what you are trying to do? Regards, -Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, May 14, 2004 9:31 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS? Kami, How do you see me using a filter file to add a small amount of points for the end of every SENDER that doesn't match the end of every REVDNS in the edu TLD.? I don't know how to use a filter file to compare a string in one field to a string in another. If it can be done that would be great. Thanks, Dan Geiser [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS works as ENDSWITH or CONTAINS?
If I have a SPAMDOMAINS type test in my GLOBAL.CFG... SD-TLD spamdomains D:\iMail\declude\JunkMail.SpamDomains.TLD.txt x 5 0 ...and I have some entries in the corresponding flat text file like below... .mil will SPAMDOMAINS search the reverse DNS entry in a CONTAINS type manner or an ENDSWITH type manner? It will work like CONTAINS, so: For example would the host name .milton-bradley.com in the below... - X-Note: Sent with HELO [mail] from Reverse DNS [mail.milton-bradley.com] - get flagged as passing or failing the SPAMDOMAINS test? That one would get caught, if the reverse DNS entry did not contain .mil in it. So if the E-mail was from [EMAIL PROTECTED], and the reverse DNS entry was mail.milton-bradley.com, the E-mail would not fail the test (but if the reverse DNS was mail.someone_else.com, it would fail the test). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
