RE: [Declude.JunkMail] whitelist and mult rcpt
Darrell / Scott: We do not whitelist the postmaster account, instead you setup a filter test that contains an allrecips for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a routeto back to the postmasters account. Hm - I assume your method only works, if I don't use a DELETE and/or BOUNCE action directly on individual tests - or will routeto supercede delete and/or bounce? Let's assume... Bounce on: Any OSDUL/OSSOFT Weight = 10 Hold on: Any MailFrom/Percent I delete on: Weight = 20 If someone needs assistance who gets caught by the MailFrom/Percent or OSDUL/OSSOFT and all your test does is reduce weights - I assume the people's emails would still not get through? So I do need to whitelist the PostMaster? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
We do not whitelist the postmaster account, instead you setup a filter test that contains an allrecips for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a routeto back to the postmasters account. Hm - I assume your method only works, if I don't use a DELETE and/or BOUNCE action directly on individual tests - or will routeto supercede delete and/or bounce? DELETE takes priority over all other actions. So if you have SPAMCOP DELETE, any E-mail failing the SPAMCOP test will be deleted (unless the E-mail is whitelisted). In that case, the weighting system won't help. The idea above assumes that you are using the weighting system exclusively. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
In the interim, a less complex method might be to have a setting which will ignore a white list entry for an address if more than one recipient is specified. This might take the form of a special kind of whitelist entry. Most valid messages to postmaster, for example, only have postmaster as the recipient. I know this would be less complicated than splitting up the messages. I wonder if there is a clean way to intercept message retreival or final delivery (better) with a program like a second pass of Declude or another utility like Message Sniffer. I'm not close enough to the guts of IMail to know if this is practical, but it might significantly simplify this problem. Any ideas Scott? _M ]-Original Message- ]From: [EMAIL PROTECTED] ][mailto:[EMAIL PROTECTED] Behalf Of Karen Oland ]Sent: Thursday, May 29, 2003 12:57 AM ]To: [EMAIL PROTECTED] ]Subject: [Declude.JunkMail] whitelist and mult rcpt ] ] ]We've been getting a lot of spam in the last week or so that ]bypasses all ]our spam filters -- they are all copied to the postmaster@ ]account for our ]domain. Apparently, they are taking advantage of the common ]practice of ]whitelisting the postmaster and the inability of spam ]filtering programs to ]separate actions on messages sent to multiple users. No ]doubt, it won't be ]long before most messages do the same, rendering both your postmaster ]account and spam filters useless. ] ]I know it has been asked for before and said to be ]impossible (programmer ]speak, for don't want to do it -- I know, being one), but ]PLEASE consider ]creating multiple copies of messages that arrive for multiple ]recipients, so ]that the spam filters can operate (yes, this means some ]complications, but a ]little trickery could reduce problems -- for example, only ]making a copy for ]the recipient(s) that are whitelisted). ] ]--- ][This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
Karen, This is something that I brought up on the list awhile back with how to avoid this. As we were getting hammered with spam getting to the end user cause they were tagging the whitelisted postmaster account to it. We do not whitelist the postmaster account, instead you setup a filter test that contains an allrecips for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a routeto back to the postmasters account. What this does is the following [1] Allows all messages regardless of how many spam tests they fail to always be routed to the postmaster [2] If the message contains a user account other than the postmaster the mail will be delivered to the user if the message is under your spam threshold and if it is over your spam threshold whatever action you have specified will then be enacted on that message. Darrell Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Karen Oland Sent: Thursday, May 29, 2003 12:57 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelist and mult rcpt We've been getting a lot of spam in the last week or so that bypasses all our spam filters -- they are all copied to the postmaster@ account for our domain. Apparently, they are taking advantage of the common practice of whitelisting the postmaster and the inability of spam filtering programs to separate actions on messages sent to multiple users. No doubt, it won't be long before most messages do the same, rendering both your postmaster account and spam filters useless. I know it has been asked for before and said to be impossible (programmer speak, for don't want to do it -- I know, being one), but PLEASE consider creating multiple copies of messages that arrive for multiple recipients, so that the spam filters can operate (yes, this means some complications, but a little trickery could reduce problems -- for example, only making a copy for the recipient(s) that are whitelisted). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
YES. This would solve the problem we are having (although not perhaps everyone's problems g). None of these messsages were only to the postmaster. They all came either with two names in the TO line or with a CC that included the postmaster. Karen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Madscientist Sent: Thursday, May 29, 2003 8:49 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] whitelist and mult rcpt In the interim, a less complex method might be to have a setting which will ignore a white list entry for an address if more than one recipient is specified. This might take the form of a special kind of whitelist entry. Most valid messages to postmaster, for example, only have postmaster as the recipient. I know this would be less complicated than splitting up the messages. I wonder if there is a clean way to intercept message retreival or final delivery (better) with a program like a second pass of Declude or another utility like Message Sniffer. I'm not close enough to the guts of IMail to know if this is practical, but it might significantly simplify this problem. Any ideas Scott? _M ]-Original Message- ]From: [EMAIL PROTECTED] ][mailto:[EMAIL PROTECTED] Behalf Of Karen Oland ]Sent: Thursday, May 29, 2003 12:57 AM ]To: [EMAIL PROTECTED] ]Subject: [Declude.JunkMail] whitelist and mult rcpt ] ] ]We've been getting a lot of spam in the last week or so that ]bypasses all ]our spam filters -- they are all copied to the postmaster@ ]account for our ]domain. Apparently, they are taking advantage of the common ]practice of ]whitelisting the postmaster and the inability of spam ]filtering programs to ]separate actions on messages sent to multiple users. No ]doubt, it won't be ]long before most messages do the same, rendering both your postmaster ]account and spam filters useless. ] ]I know it has been asked for before and said to be ]impossible (programmer ]speak, for don't want to do it -- I know, being one), but ]PLEASE consider ]creating multiple copies of messages that arrive for multiple ]recipients, so ]that the spam filters can operate (yes, this means some ]complications, but a ]little trickery could reduce problems -- for example, only ]making a copy for ]the recipient(s) that are whitelisted). ] ]--- ][This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
Why would you white list the postmaster anyway, only 1 of about 1000 emails to my postmaster account is legitimate. Same for abuse. See http://www.rfc-ignorant.org . They list domains that ignore abuse complaints. Perhaps the reason spam is so widespread now is because people aren't bothering to listen to the abuse complaints. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
From: R. Scott Perry Perhaps the reason spam is so widespread now is because people aren't bothering to listen to the abuse complaints. :) True. Oddly, we get ZERO emails sent to abuse (other than a flurry of virus attempts a while back). But, postmaster has become one of the most popular email accounts here, along with two business email lists (for sales, etc) that have been grabbed off a company web page (since no-one here can send from those group addresses). Karen --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
This is directly off the rfc-ignorant.org site. So it is OK to reject/block
email to the postmaster as long as the following is applied.
After careful consideration, there seemed to be a consensus among users that
use of blacklists, etc., did not meet the narrowly tailored requirements
for blocking mail to postmaster, but that it would be undesirable to list
sites simply for employing the MAPS RBL and such on their postmaster
address. It was decided that we wouldn't list folks if the rejection message
for postmaster seemed to indicate the reason for denial ({ip} rejected as
listed on the MAPS RBL, etc.)
Full text at http://www.rfc-ignorant.org/policy-postmaster.php
Due to the amount of non-legitimate email sent to the postmaster account. I
think mail servers should spam scan these emails and delete or hold the
messaages and possible send a message back with why the message was not
delivered. If some one really has an issue with mail delivery do a whois and
pick up the phone and call, if that number is invalid then?? I tell my
users and even my non-users that email is not guarenteed to get the the
reciepient. The postmaster\abuse accounts are no different.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Thursday, May 29, 2003 9:49 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] whitelist and mult rcpt
Why would you white list the postmaster anyway, only 1 of about
1000 emails
to my postmaster account is legitimate. Same for abuse.
See http://www.rfc-ignorant.org . They list domains that ignore abuse
complaints.
Perhaps the reason spam is so widespread now is because people aren't
bothering to listen to the abuse complaints. :)
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
This is directly off the rfc-ignorant.org site. So it is OK to reject/block
email to the postmaster as long as the following is applied.
After careful consideration, there seemed to be a consensus among users that
use of blacklists, etc., did not meet the narrowly tailored requirements
for blocking mail to postmaster, but that it would be undesirable to list
sites simply for employing the MAPS RBL and such on their postmaster
address. It was decided that we wouldn't list folks if the rejection message
for postmaster seemed to indicate the reason for denial ({ip} rejected as
listed on the MAPS RBL, etc.)
Full text at http://www.rfc-ignorant.org/policy-postmaster.php
Here, they are essentially saying You can block likely spam to postmaster@
*if* the sender is notified of why the E-mail is blocked.
I think mail servers should spam scan these emails and delete or hold the
messaages and possible send a message back with why the message was not
delivered. If some one really has an issue with mail delivery do a whois and
pick up the phone and call, if that number is invalid then??
This is a different issue. The problems here are that [1] The sender will
never know that their E-mail didn't get read, and [2] The sender will never
know why their E-mail didn't get read. Bounce messages are a bad thing,
simply because they will cause a lot of spam to spread.
I remember back in the days where spammers had a very little bit of
courtesy, and would never ever E-mail postmaster@ accounts, and would never
ever E-mail .org E-mail addresses.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
Then could you add special handling in declude for postmaster and abuse to allow for an alert to be passed back the the sender if the email should be deleted or held and one of the reciepients is postmaster or abuse or mabe the accounts could be configurable. A template email could be used to send back. You should be able to accomplish this with the BOUNCE action, using per-user settings. However, we DO NOT RECOMMEND using the BOUNCE action, as it just forces other people to deal with the spam you are trying to avoid. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
But if the email is set to bounce and it is sent to multiple receipients along with postmaster and one of the other reciepients is set to delete then wont the email just be deleted and never bounced? Kevin -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, May 29, 2003 12:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] whitelist and mult rcpt Then could you add special handling in declude for postmaster and abuse to allow for an alert to be passed back the the sender if the email should be deleted or held and one of the reciepients is postmaster or abuse or mabe the accounts could be configurable. A template email could be used to send back. You should be able to accomplish this with the BOUNCE action, using per-user settings. However, we DO NOT RECOMMEND using the BOUNCE action, as it just forces other people to deal with the spam you are trying to avoid. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
But if the email is set to bounce and it is sent to multiple receipients along with postmaster and one of the other reciepients is set to delete then wont the email just be deleted and never bounced? You are correct -- the DELETE action will take priority over the BOUNCE action. I'll see if we can come up with some way of working around this, but it will likely get very complex. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
I know it has been asked for before and said to be impossible (programmer speak, for don't want to do it -- I know, being one), but PLEASE consider creating multiple copies of messages that arrive for multiple recipients, so that the spam filters can operate (yes, this means some complications, but a little trickery could reduce problems -- for example, only making a copy for the recipient(s) that are whitelisted). Some one will surely correct me, but it seems that there is an option some where in Imail V 8.0 to configure the amount of recipients per message on incoming. Any one know if this is right or wrong? I will look into it myself later. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
