Re: [Declude.JunkMail] WEIGHT for a File Attachment
One way, where X is the weight you wish to assign: BODYXCONTAINSContent-Type: image/gif; Be careful with this because a lot of legit emails contain GIFs. -Dave Doherty Skywaves, Inc. 508-425-7176 [EMAIL PROTECTED] - Original Message - From: David Dodell [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, November 05, 2006 4:10 PM Subject: [Declude.JunkMail] WEIGHT for a File Attachment Is there a way I can add a weight value is a file attachment is a certain type, ie GIF? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight
Title: Weight When I started, I ended up with a comfortable system with the weights subject tag 14, hold 28 delete at 35. I didn't like oddity of the numbers and sometimes wanted a finer granuality. So I mutiplied all of my weight by 7. I ended up with subject tag at100, hold at 200 and delete at 300. Nice round numbers that the users can understand. - Original Message - From: Kelly Scotto To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 1:31 PM Subject: [Declude.JunkMail] Weight I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights? Regards, Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ex.1801
RE: [Declude.JunkMail] Weight
Title: Message Added the personal touch. Gotcha! -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott FisherSent: Thursday, February 02, 2006 1:57 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Weight When I started, I ended up with a comfortable system with the weights subject tag 14, hold 28 delete at 35. I didn't like oddity of the numbers and sometimes wanted a finer granuality. So I mutiplied all of my weight by 7. I ended up with subject tag at100, hold at 200 and delete at 300. Nice round numbers that the users can understand. - Original Message - From: Kelly Scotto To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 1:31 PM Subject: [Declude.JunkMail] Weight I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights? Regards, Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ex.1801
Re: [Declude.JunkMail] Weight values used in Junkmail config
Dan, A couple of excellent tests to try out are Sort Monsters Sniffer and our URI filter plug-in for Declude. Both of those tests can be evaluated for free. Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Dan Shadix [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, April 27, 2005 6:36 PM Subject: [Declude.JunkMail] Weight values used in Junkmail config The config files I originally got with Junkmail use a weight range of mostly 10 or less for individual tests. I just downloaded 2.06 and it is the same and contains these lines: WEIGHT10WARN WEIGHT14SUBJECT **SPAM** WEIGHT20HOLD%DATE% It appears to me that most of you are using much a much higher scale. I can see the value of that since it provides more granularity. My question is, does anyone have configs they are sharing or will share to get me started. I plan to make some time to work on tuning my config to catch more spam and it would be nice to not have to start from scratch. Thanks all, -- Dan Shadix IT Systems Administrator Terry Reilly Health Services --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight Ranges
How much extra processing to an e-mail does adding a bunch of weight range statements like: WEIGHT1019 weightrange x x 10 19 WEIGHT2029 weightrange x x 20 29 WEIGHT3034 weightrange x x 30 34 WEIGHT3539 weightrange x x 35 39 I really just want these just to report on from the logs rather than take action on them during e-mail processing. My guess is that it should not take too much CPU. You are correct; the weightrange tests use only a negligible amount of CPU time. Also if I so not want these tests to show up in the %TESTSFAILED% variable then would I add HIDETESTS WEIGHT1019 WEIGHT2029.. And would I need to put in the $default$.junkmail file WEIGHT1019 LOG Correct. Note that you could simply not include the WEIGHT1019 line in the $default$.JunkMail file, which would have the same effect. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight Ranges
Also if I so not want these tests to show up in the %TESTSFAILED% variable then would I add HIDETESTS WEIGHT1019 WEIGHT2029.. And would I need to put in the $default$.junkmail file WEIGHT1019 LOG Correct. Note that you could simply not include the WEIGHT1019 line in the $default$.JunkMail file, which would have the same effect. Personally I like to have it written down in the .junkmail file so that there is no confusion about the test and if it is being employed etc. The KISS principle. Thanx GOran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %WEIGHT% variable as -100
This may be very minor and possibly just cosmetic, I have found that some messages will have a %WEIGHT% variable returned for a WARN action that is -100 when such a score is impossible on our system. The example below is from a message that scored 0 in the logs (seemingly correct), but shows differently in the headers. I'm using 1.79i6 currently and am not aware of any ill effects as a result. X-MailPure: Spam Score: -100 How is the WARN action set up? Which version of Declude are you running? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] %WEIGHT% variable as -100
Scott, Sorry, it wasn't the WARN action, it's coming from the XOUTHEADER (gatewayed client in this example): XOUTHEADERX-MailPure: Spam Score: %WEIGHT% - or - XINHEADERX-MailPure: Spam Score: %WEIGHT% 1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights were appearing about 500 points above what they really were (only in the %WEIGHT% variable). I don't believe this has affected how Declude handles the E-mail, just the %WEIGHT% variable itself. It appears that the issue with the -100 only happens when the total score is zero. I believe this is being passed off in the variable when used for external tests, but I haven't verified that yet. Thanks, Matt Received: from mx2.mailpure.com [63.170.56.5] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A5496AC01E4; Mon, 12 Apr 2004 21:41:29 -0400 Received: from mail.pluscentury.biz ([64.205.141.39]) by mx2.mailpure.com with Microsoft SMTPSVC(6.0.3790.0); Mon, 12 Apr 2004 21:40:16 -0400 Received: (qmail 31553 invoked from network); 13 Apr 2004 13:52:18 - Received: from mail.pluscentury.biz (HELO localhost.localdomain) (64.205.141.39) by mail.pluscentury.biz with SMTP; 13 Apr 2004 13:52:18 - User-Agent: KMail/1.4.3 From: Mackenna [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: I bet we can hit it off Reply-To: [EMAIL PROTECTED] Precedence: first-class Mime-Version: 1.0 X-cid: 190 X-eid: 434378 X-lid: 143 Bounces-to: [EMAIL PROTECTED] Content-Type: multipart/alternative;boundary=MuLtIpArT_BoUnDaRy Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 13 Apr 2004 01:40:17.0371 (UTC) FILETIME=[462032B0:01C420F8] Date: 12 Apr 2004 21:40:17 -0400 X-MailPure: X-MailPure: LEGITCONTENT: Passed, legitimate content detected (weight -2). X-MailPure: MXBAIT: Message failed MXBAIT test (line 3, weight 1). X-MailPure: SPAMMYURL: Message failed SPAMMYURL test (line 10, weight 1). X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 21:41:38 on 04/12/2004 X-MailPure: Spool File: D454906ac01e4fad2.SMD X-MailPure: Server Name: mail.pluscentury.biz X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: mail.pluscentury.biz [64.205.141.39] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Received: from lakermmtao02.cox.net [68.230.240.37] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id A7E6A008A; Tue, 13 Apr 2004 21:46:14 -0400 Received: from fairview ([68.102.33.6]) by lakermmtao02.cox.net (InterMail vM.6.01.03.02 201-2131-111-104-20040324) with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Tue, 13 Apr 2004 21:45:56 -0400 Return-Receipt-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: Matt Bramble [EMAIL PROTECTED] Subject: e-mail account Date: Tue, 13 Apr 2004 20:56:11 -0500 Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000__01C42199.C15A9AF0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-MailPure: X-MailPure: X-MailPure: Spam Score: -100 X-MailPure: Scan Time: 21:46:48 on 04/13/2004 X-MailPure: Spool File: D97e6000a008a0bf7.SMD X-MailPure: Server Name: lakermmtao02.cox.net X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: lakermmtao02.cox.net [68.230.240.37] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Received: from qwertyx1.qwertyx.net [12.107.136.168] by mx1.mailpure.com (SMTPD32-8.05) id AC456C7C00A0; Mon, 19 Apr 2004 21:26:29 -0400 Received: by qwertyx1.qwertyx.net (Postfix, from userid 515) id 15B829286D; Mon, 19 Apr 2004 21:26:30 -0400 (EDT) Received: from [192.168.237.100] (dwolk-home [68.236.149.197]) by qwertyx1.qwertyx.net (Postfix) with ESMTP id 8A1839284F for [EMAIL PROTECTED]; Mon, 19 Apr 2004 21:26:29 -0400 (EDT) Subject: Re: DNS errors on my server From: [EMAIL PROTECTED] To: Matthew Bramble [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] References:
Re: [Declude.JunkMail] %WEIGHT% variable as -100
1.79i6 is the version that I am running presently. Following are some other examples, with the first appearance in my inbox being April 12th which happens to be less than a week after you added the weight variable to the external tests, and just after you resolved the issue where the weights were appearing about 500 points above what they really were (only in the %WEIGHT% variable). I don't believe this has affected how Declude handles the E-mail, just the %WEIGHT% variable itself. It appears that the issue with the -100 only happens when the total score is zero. I believe this is being passed off in the variable when used for external tests, but I haven't verified that yet. I've found the problem. When we made the change to the %WEIGHT% variable to calculate the current weight in the middle of testing, it would check to see if the final weight was 0 and if so would then calculate it directly. It looks like we'll need to change that. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Yep, a configuration of WEIGHT10 DELETE and a WEIGHT20 HOLD would indeed delete a message with a weight of 21. Something you mentioned earlier prompts me to point out another thing; the veterans in the list generally regard HOLD messages not as something they have to check out several times a day to manually sort, but rather as a convenient way to not bug the intended recipient while we are still able to retrieve and deliver the mail for that recipient in case of a false positive. The net result is that we're more likely to err by holding a message than to err by deleting it! For reviewing messages, SpamReview is very popular; I stopped using it a long time ago, though, due to the high volume I get (I delete very little). Also, the \imail\spool\spam folder will of course grow in time, so you'll want a handy utility that you can schedule to delete messages there that are older than whatever time you choose. See the Declude website, Tools page for links to these and other tools. Andrew 8) -Original Message- From: Goran Jovanovic [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 20, 2004 8:28 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Weight and Action Question Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? In your description I would want the DELETE taken. I was thinking of the whole thing is a different light. Specific test gets action taken first then aggregate tests like WEIGHT20 get taken in highest to lowest weight order. Then other things... To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. That's another way of looking at it. In this case, if there is a conflict with an action that has already been taken, the one that has already been taken will have priority. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Correct. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight and Action Question
If you are trying out a new test and are not sure what it is going to do you set the WEIGHT of that test to 0 and then monitor it. One way would be to use a HOLD action on that test. My question is if the WEIGHT was not set to 0 but say 10 and the action is HOLD will the e-mail be held regardless of the total weight? Not necessarily (since there may be tests with negative weights). For example, by default, if an E-mail does not fail the NOLEGITCONTENT/IPNOTINMX tests, it will start with a weight below 0. Therefore, if an E-mail failed just the new test, the E-mail would not have a weight of 10 or higher. If that is true then why does it matter what the weight is set to? Because some people may, for example, use WEIGHT10 HOLD and WEIGHT20 DELETE. In this case, an E-mail that would have otherwise had a weight of 12 (and therefore held) would now have a weight of 22 (and be deleted). So in this case, the test would be live and running and doing its thing. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Well, you might also have a WHITELIST action, or a WEIGHT action for a high value that does a DELETE. I guess what is important is to find out the precedence of the ACTION keywords. So if a WEIGHT10 is set with a DELETE action and the test that you are testing has a WEIGHT of 1 and the total score of the message is 25 then I would hope that regardless of the final weight the HOLD action on a specific test would take precedence. Instead, I would recommend using a weight of 1. A weight of zero, even if the test is triggered and an action taken, will make the test NOT show up in the list of tests triggered in your declude log file on the total weight= line (at LOGLEVEL MID, anyway). This makes sense and is a good point Thanx Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
I guess what is important is to find out the precedence of the ACTION keywords. In the case of multiple actions, Declude JunkMail will try to use both. But in combinations where they cannot logically be combined (such as HOLD and DELETE -- doing one means that you can't do the other), Declude JunkMail will use the stricter action (in the HOLD/DELETE case, DELETE is stricter). The actions are listed in the manual in the order of precedence (the ones towards the bottom are the stricter ones). So if a WEIGHT10 is set with a DELETE action and the test that you are testing has a WEIGHT of 1 and the total score of the message is 25 then I would hope that regardless of the final weight the HOLD action on a specific test would take precedence. No. If the total weight of the E-mail is 25, and you want to delete E-mail with a weight of 10 or higher, the E-mail will be deleted. Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight and Action Question
Think of it this way -- if you used the HOLD action for E-mail with a weight of 5 or higher, and the DELETE action for E-mail with a weight of 10 or higher, which action would you want taken on an E-mail with a weight of 25? In your description I would want the DELETE taken. I was thinking of the whole thing is a different light. Specific test gets action taken first then aggregate tests like WEIGHT20 get taken in highest to lowest weight order. Then other things... To paraphrase you JunkMail looks through all the actions of all the tests that have been tripped starting with the most severe (strict) DELETE and working down the list. So if you did it wrong and setup WEIGHT10 DELETE and WEIGHT20 HOLD then all e-mail with a weight of 10 or higher would be deleted and none would be held. Right? OK you would have to be mostly asleep to set it up this way... Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight processing
Hi Bill: I noticed this a while back and what I did was I elevated the skip weight by 10.. it took care of this.. But I agree with you.. It is hard to know what is happening when tests are not done in order and one skips the tests only to see a surprise negative weight being applied.. I wish we could also skip the tests for negative weight.. Because right now the emails that we want to be delivered by negative weight actually will go through all tests since none can exit on a negative limit. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Saturday, December 20, 2003 2:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Weight processing Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called. You will see from the log snippet below that most of my filter files were skipped because of a weight (=36} was met. However, it appears that the negative weight of -3 from the nIPNOTINMX was applied after the filter file processing, which reduced the weight to 33, so the message was held instead of deleted. Would you be willing to change this so that all other Declude JM tests are run before the filters are called? Thanks, Bill = Filter HEADERS-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter SUBJECT-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter DYNAMIC-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter HELO-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter MAILFROM-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter FORGEDHELO-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter VERP-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter REVDNS-FILTER: Skipping E-mail with a current weight of 36 (=36) Filter BODY-FILTER: Skipping E-mail with a current weight of 36 (=36) SPEWS:2 MAILPOLICE-BULK:5 nIPNOTINMX:-3 LONGSUBJECT:3 SUBJECTSPACES:5 ALLIGATE-SPAM-L1:1 ALLIGATE-SPAM-L2:2 SNIFFER-PORN:12 SPAMCHECK:6 . Total weight = 33. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight processing
Kami Razvan wrote: I wish we could also skip the tests for negative weight.. Because right now the emails that we want to be delivered by negative weight actually will go through all tests since none can exit on a negative limit. I believe the idea here is to place the negative weight filters before the positive weight ones. Unless you want to totally whitelist something based on a filter (as opposed to pseudo-whitelisting it by crediting just some points), it makes sense that you wouldn't have a minimum weight. I guess I'm not really very trusting of anything not whitelisted on my system. I start my order with pseudo-whitelists, and then pseudo-blacklists, then the highest scoring filters that don't make much use of the body down to the lowest scoring filters that do heavy body searches. When I have ANTI files, I list those before the main tests. The logic is a little sloppy in the middle, but it seems to be the right idea. Naturally, it would also make sense to have absolutely everything else run before the custom filters. I suspect the IPNOTINMX thing is a bug instead of something by design. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Weight processing
Hi Matt: I agree but in case of mailing lists .. It seems like one way to help with the mailing lists that keep changing their providers is to whitelist them by their address in the Header. Since Declude looks at the sender email and does not see the FROM address the best way to handle some mailing lists is by giving negative weight for the email found in header. In those cases we have given enough negative weight to them to make sure they come through regardless of the spam databases they are in. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Saturday, December 20, 2003 2:58 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Weight processing Kami Razvan wrote: I wish we could also skip the tests for negative weight.. Because right now the emails that we want to be delivered by negative weight actually will go through all tests since none can exit on a negative limit. I believe the idea here is to place the negative weight filters before the positive weight ones. Unless you want to totally whitelist something based on a filter (as opposed to pseudo-whitelisting it by crediting just some points), it makes sense that you wouldn't have a minimum weight. I guess I'm not really very trusting of anything not whitelisted on my system. I start my order with pseudo-whitelists, and then pseudo-blacklists, then the highest scoring filters that don't make much use of the body down to the lowest scoring filters that do heavy body searches. When I have ANTI files, I list those before the main tests. The logic is a little sloppy in the middle, but it seems to be the right idea. Naturally, it would also make sense to have absolutely everything else run before the custom filters. I suspect the IPNOTINMX thing is a bug instead of something by design. Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight processing
Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called That is by design. We may make an attempt to get the filter tests to run last, but we cannot guarantee the order of the tests. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight processing
- Original Message - From: R. Scott Perry [EMAIL PROTECTED] Scott, I have setup my filter files with SKIPIFWEIGHT 36, which is my delete weight. However, I just noticed that it appears that not all other JM processing happens before the filter files are called That is by design. We may make an attempt to get the filter tests to run last, but we cannot guarantee the order of the tests. Okay, I have modified my SKIPIFWEIGHT accordingly. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
My message headers are no long displaying the weight of messages. The weight rules are working. I have weight 10 holding and weight 20 deleting, that works great. I'd still like to see the weight score in the message header if it's less than 10. What have you changed recently? What were you seeing before? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
I downloaded new global and junkmail files a few months back to update my dated ones. Prior to that it would say exceeded weight of x in the headers. I might have had warn instead of hold or Delete. Either way, it would be nice to display the weight in the header so our users can set their level of spam filtering. Possible? Thanks, Steve - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 13, 2003 11:03 AM Subject: Re: [Declude.JunkMail] Weight of in header My message headers are no long displaying the weight of messages. The weight rules are working. I have weight 10 holding and weight 20 deleting, that works great. I'd still like to see the weight score in the message header if it's less than 10. What have you changed recently? What were you seeing before? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
I downloaded new global and junkmail files a few months back to update my dated ones. Prior to that it would say exceeded weight of x in the headers. I might have had warn instead of hold or Delete. Either way, it would be nice to display the weight in the header so our users can set their level of spam filtering. Possible? If you use WEIGHT10 WARN, for example, you'll see a line in the headers similar to what you describe. Are you looking for a header that shows the total weight, or one of the weights that was exceeded? Are you looking for this in all E-mail, or just E-mail that exceeds the given weight? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
A header with the total weight regardless, from 1 to 9. Anything 10 or above we take care of by default. Would I have to setup WEIGHT1 WARN, WEIGHT 2 WARN, etc? - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 13, 2003 3:11 PM Subject: Re: [Declude.JunkMail] Weight of in header I downloaded new global and junkmail files a few months back to update my dated ones. Prior to that it would say exceeded weight of x in the headers. I might have had warn instead of hold or Delete. Either way, it would be nice to display the weight in the header so our users can set their level of spam filtering. Possible? If you use WEIGHT10 WARN, for example, you'll see a line in the headers similar to what you describe. Are you looking for a header that shows the total weight, or one of the weights that was exceeded? Are you looking for this in all E-mail, or just E-mail that exceeds the given weight? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
A header with the total weight regardless, from 1 to 9. Anything 10 or above we take care of by default. Do you mean regardless as in every E-mail should have it (XINHEADER would do that), or only on E-mails with a weight from 1-9? If from 1-9, you would need to set up a weightrange test (WEIGHT1_9 weightrange x x 1 9) that you could then use the WARN action with. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight of in header
just add XINHEADER X-Declude-Note: weight: %WEIGHT% to the global.cfg file - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 14, 2003 12:02 AM Subject: Re: [Declude.JunkMail] Weight of in header A header with the total weight regardless, from 1 to 9. Anything 10 or above we take care of by default. Do you mean regardless as in every E-mail should have it (XINHEADER would do that), or only on E-mails with a weight from 1-9? If from 1-9, you would need to set up a weightrange test (WEIGHT1_9 weightrange x x 1 9) that you could then use the WARN action with. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight maybe not working right??
- Original Message - From: Paul Ingram [EMAIL PROTECTED] I just recived several spams to my box all with weights greater then I allow (weight of 49). Does anyone see anything wrong here? GLOBAL.CFG WEIGHT1 weightrange x x 5 11 WEIGHT2 weightrange x x 12 17 WEIGHT3 weightrange x x 18 36 WEIGHT4 weightrange x x 37 0 Change WEIGHT4 to a weight test instead of a weightrange: WEIGHT4 weight x x 37 0 This will apply whatever action you define (in your case: DELETE) to any message with a weight of 27 or higher. That should take care of it. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
It was commented out of the global.cfg. Another question: If I have: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] WEIGHT10SUBJECT (SUSPECTED SPAM) In the something.junkmail file will both be appended or will CATCHALLMAILS only show up? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 03, 2003 3:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WEIGHT CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] in my something.junkmail file but the weight did not show up in the subject of a message that I just received. Are you sure that the something.junkmail file was the one used to process the E-mail (aliases can cause Declude to use a different file than you expect)? Do I need to add something to the global.cfg? No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
If I have: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] WEIGHT10SUBJECT (SUSPECTED SPAM) In the something.junkmail file will both be appended or will CATCHALLMAILS only show up? Only one will be appended (I believe it is the last one listed in the global.cfg file that will be used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WEIGHT
In my something.junkmail file I have: WEIGHT10SUBJECT (SUSPECTED SPAM) I know I can add %WEIGHT% to the end if I want the weight to show up in the subject but how can I have theweight show up in the subject of ALL emails I receive even if they do not receive a weight? You could use: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
I placed: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] in my something.junkmail file but the weight did not show up in the subject of a message that I just received. Do I need to add something to the global.cfg? I'm trying to do this on my own email and nothing else. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 03, 2003 1:54 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] WEIGHT In my something.junkmail file I have: WEIGHT10SUBJECT (SUSPECTED SPAM) I know I can add %WEIGHT% to the end if I want the weight to show up in the subject but how can I have theweight show up in the subject of ALL emails I receive even if they do not receive a weight? You could use: CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
CATCHALLMAILS SUBJECT [Weight=%WEIGHT%] in my something.junkmail file but the weight did not show up in the subject of a message that I just received. Are you sure that the something.junkmail file was the one used to process the E-mail (aliases can cause Declude to use a different file than you expect)? Do I need to add something to the global.cfg? No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). By default, it is commented out, no? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WEIGHT
No, assuming that the CATCHALLMAILS catchallmails x x 0 0 line is in there (it is in the default config file). By default, it is commented out, no? It was originally, no longer is commented out with the default settings. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight values not working with ROUTETO
Thanks Scott, I'll try the weightrange option! Cheers Jools On Tue, 24 Jun 2003 09:01:33 -0400, you wrote: This is a weird one, I've setup 2 weights in global.cfg as: WEIGHT15weight x x 15 0 WEIGHT30weight x x 30 0 and use in global.cfg and $default$.junkmail: WEIGHT30ROUTETO [EMAIL PROTECTED] WEIGHT15ROUTETO [EMAIL PROTECTED] (also tried the above the other way round) but all mail over the 15 weight even if it is in the hundreds, only gets put in the weight15 mailbox. The catch here is that when an E-mail has a weight of 30 or higher, you are telling Declude JunkMail two things. Since it has failed both the WEIGHT15 and WEIGHT30 tests, you are telling it to both re-route the E-mail to [EMAIL PROTECTED] and [EMAIL PROTECTED] You can't re-route an E-mail to two different addresses, so Declude JunkMail picks which one to send it to. There are two ways you could get around this. The best would be to change the WEIGHT15 line to: WEIGHT15weightrange x x 15 29 That will make sure that an E-mail never fails both the WEIGHT15 and WEIGHT30 tests. The other way would be to change the order that the tests are defined in the global.cfg file, which *should* change the address that the E-mail is re-routed to (but I can't guarantee that). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Weight values not working with ROUTETO
This is a weird one, I've setup 2 weights in global.cfg as: WEIGHT15weight x x 15 0 WEIGHT30weight x x 30 0 and use in global.cfg and $default$.junkmail: WEIGHT30ROUTETO [EMAIL PROTECTED] WEIGHT15ROUTETO [EMAIL PROTECTED] (also tried the above the other way round) but all mail over the 15 weight even if it is in the hundreds, only gets put in the weight15 mailbox. The catch here is that when an E-mail has a weight of 30 or higher, you are telling Declude JunkMail two things. Since it has failed both the WEIGHT15 and WEIGHT30 tests, you are telling it to both re-route the E-mail to [EMAIL PROTECTED] and [EMAIL PROTECTED] You can't re-route an E-mail to two different addresses, so Declude JunkMail picks which one to send it to. There are two ways you could get around this. The best would be to change the WEIGHT15 line to: WEIGHT15weightrange x x 15 29 That will make sure that an E-mail never fails both the WEIGHT15 and WEIGHT30 tests. The other way would be to change the order that the tests are defined in the global.cfg file, which *should* change the address that the E-mail is re-routed to (but I can't guarantee that). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] weight of 63 passed ??
Strangeness. I'm curious how this message manage to get through and be delivered. My first question: Do you have a WHITELIST entry that could have let it through? I have weight20 set to hold and weight30 to delete. This message made weight63. The address it was delievered to is granted located on a unix box ... And I should mention here that if the E-mail is being sent to another server (unix box), IMail considers it outgoing mail, so the settings in the \IMail\Declude\global.cfg file. To get around this, you can use per-domain settings for that domain. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Weight question...
I'm trying to setup the following tests for weight. When I add the following (minus the # comment sign) #SPAMHEADERSspamheaders x x 3 0 #NOABUSE noabuse x x 3 0 #NOPOSTMASTERnopostmasterx x 3 0 I get the following errors in the log: 05/14/2002 12:06:13 Warning, misconfiguration in noabuse; expecting action 05/14/2002 12:06:13 Warning, misconfiguration in nopostmaster; expecting action The problem is that you don't need to add those lines. The weighting is built into the test definitions; you don't need to add separate lines for them. When Declude sees the line starting with NOABUSE, it first checks to see if there has already been a test called NOABUSE defined. If there has, it assumes that you are determining what action to take (NOABUSE HOLD, for example). If the test hasn't been defined, it expects that the line beginning with NOABUSE is a test definition -- but it isn't a valid one (there is no test type called noabuse). If you want to set the weight of the noabuse test to 3, you would just change the existing line: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 4 0 to: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 3 0 I also have the following actions for these single tests: NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 4 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 4 0 Note that these are the test definitions (where you would change the weight, if you want). NOABUSE WARN NOPOSTMASTERWARN And these are where you determine the action to take for the outgoing E-mail that fails those tests. So if you get rid of the lines that you added, and then change the test definition line as shown above, you should be all set. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] %WEIGHT% Variable
Should the %WEIGHT% Variable work with the SUBJECT action in 1.35a or 1.36. I know it works other places but when I tried it in the sbject action it didn't work. It should work with 1.36, but was just added and has not been thoroughly tested yet. What happens when you try using it? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Weight Fix?
I remember several announcements in the past two weeks (since the official 1.30 beta started), that there was going to be a fix in the respective next day or two that would at least re-fix the weight test? It's actually only been about a week -- the holidays seem to make it seem longer. The holidays did delay the new release, which should be out later today or tomorrow. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
