[Declude.JunkMail] SPAMHEADERS false positives

2001-05-12 Thread Andy Schmidt
PROTECTED] Subject: failure notice Message-Id: [EMAIL PROTECTED] X-RBL-Warning: Suspected SPAM. Failed heuristic test - SPAM [0.999711] X-Declude-Sender: [204.147.80.11] X-Declude-Spoolname: Dd0e10a8.SMD X-Declude-Note: Processed by Declude 1.21a; remote host relay2.uswest.net. Best Regards Andy

RE: REVDNS:Re: [Declude.JunkMail] SPAMHEADERS false positives

2001-05-14 Thread Andy Schmidt
But Scott - it appears that there IS a Message-ID in the piece that you quoted me!? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday

RE: [Declude.JunkMail] SPAMROUTING - 3 false positive samples

2001-05-15 Thread Andy Schmidt
Hi Scott: Here are three more failed SPAMROUTING messages. The first one was sent by Outlook, another by Outlook Express and I do see a Message-Id in ALL of them. I'm currently HOLDing messages based on SPAMROUTING - but unless we can improve the reliability, I'll have to set it back to WARN

RE: [Declude.JunkMail] SPAMROUTING - domain vs IP origin

2001-05-15 Thread Andy Schmidt
Hi Scott: Thank you for your quick response. Received: from watson (mitax3-237.dialup.optusnet.com.au [198.142.115.237]) This one is a problem because an Australian company somehow managed to get an IP address range through ARIN (which doesn't handle Australian domains). There's not much

RE: [Declude.JunkMail] Version 7 IMail

2001-06-14 Thread Andy Schmidt
Another way to answer this would be to look at the mail header of Scott's message G: Received: from rscott.declude.com [10.10.10.98] by declude.com with ESMTP (SMTPD32-7.00 EVAL) id A9FC4C6603F4; Thu, 14 Jun 2001 15:01:16 -0400 --- This E-mail came from the Declude.JunkMail mailing list.

[Declude.JunkMail] JunkMail Stats

2001-07-28 Thread Andy Schmidt
HEUR357 Best Regards Andy Schmidt Argos Networks 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-9411 x20 (Business) Fax:+1 201 934-9206 http://www.ArgosWeb.net/ smime.p7s

[Declude.JunkMail] Virus Stats

2001-07-28 Thread Andy Schmidt
Viri caught by Declude and McAfee in July. W32/SirCam@MM (ED) 761 W32/Hybris.gen@MM48 W32/Magistr@MM 40 JS/Kak@M 4 W97M/Eight.gen2 VBS/SST.gen@MM2 W32/Ska@M 1 VBS/Haptime@MM1 ---

RE: [Declude.JunkMail] Virus Stats

2001-07-29 Thread Andy Schmidt
I run a little MS Access project that scans the Declude Vir*.log files and then tallies them up by virus type, mail-from and mail-to. Best Regards Andy Schmidt Argos Networks 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-9411 x20 (Business) Fax:+1

RE: [Declude.JunkMail] Virus and Spam Stats

2001-07-29 Thread Andy Schmidt
]]On Behalf Of Andy Schmidt Sent: Sunday, July 29, 2001 17:26 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Virus and Spam Stats Would you mind sharing that project with us? 1. Setup a) I use the following LOG settings - haven't tested ANY others: In GLOBAL.CFG LOGLEVELMID

[Declude.JunkMail] RE:Mail Loop with BOUNCE/ALERT

2001-08-20 Thread Andy Schmidt
to [EMAIL PROTECTED] This also addresses the issue of the Postmaster ending up on spam lists which harvest return email addresses. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 smime.p7s

[Declude.JunkMail] BADHEADER decoding workaround?

2001-08-20 Thread Andy Schmidt
Hi Scott: Since we don't have a web site / cgi that decodes the BADHEADER return codes, you don't mind if I use YOUR email address g as the From: for the following BEADHEADERSbounce.eml as a temporary solution? (Hint, hint...!) From: Horizons@declude com To: %MAILFROM% Subject: Undelivered

RE: [Declude.JunkMail] OSSOFT

2001-08-22 Thread Andy Schmidt
addressed to [EMAIL PROTECTED] Sincerely, Argos Networks http://www.ArgosWeb.net/ -Original Message- %FULLMSG% --- template end -- Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message

RE: [Declude.JunkMail] SMTP AUTH counted as MAPS DUL?

2001-08-30 Thread Andy Schmidt
? What other tests would cause unnecessary overhead (e.g. during list processing) and can safely be excluded? (All assuming that we have the server locked down against open relay)? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458

RE: [Declude.JunkMail] Customized WARN message in header?

2001-10-02 Thread Andy Schmidt
Jason, FWIW - you really don't need to customize to achieve that. I instructed my clients to filter based on X-RBL-Warning: in the header and on [SPAM in the subject line. That IS the common indication that any of the server-activated tests have failed. Best Regards Andy Schmidt Phone: +1

RE: [Declude.JunkMail] MISSING_REVERSE_DNS:spam filter problems with ezsignup

2001-10-04 Thread Andy Schmidt
Sure, if your scripts use the IP address as if it was a domain name - then it's obviously causing problems. If you do a FORWARD DNS lookup against the domain name 216.126.27.237 it will obviously FAIL - so it should NOT be specified whereever a FQDN is required. Some servers DO permit the

[Declude.JunkMail] Problem with DSNReport.com

2001-10-19 Thread Andy Schmidt
Hi, http://www.dnsreport.com/tools/dnsreport.ch?domain=tovlighting.com reports missing MX Reverse Lookup - yet, at the same time http://www.samspade.org/t/lookat?a=63.107.174.32 and http://www.samspade.org/t/lookat?a=63.107.174.14 have no trouble finding the reverse DNS. Best Regards Andy ---

[Declude.JunkMail] Declude 1.28 - Weighting not Working?

2001-11-04 Thread Andy Schmidt
entry.). 11/04/2001 03:39:42 Qfec315c Subject: Make big money sending emails... 11/04/2001 03:39:42 Qfec315c From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458

[Declude.JunkMail] Declude 1.28 - Weight System Arithmetic?

2001-11-04 Thread Andy Schmidt
.). 11/04/2001 03:57:02 Q02d5274 Subject: Free Loan Quotations.Lower your Rate! 11/04/2001 03:57:02 Q02d5274 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934

[Declude.JunkMail] Declude 1.28 - Weighting does not compute

2001-11-04 Thread Andy Schmidt
4 0 HEUR8 heuristics 8 x 3 0 HEURheuristics WEIGHT10weight x x 10 0 WEIGHT8 weight x x 8 0 Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203

[Declude.JunkMail] Heur Cumulative?

2001-11-04 Thread Andy Schmidt
for HEUR8 plus 4 for HEUR9, or only 4 for HEUR9? b) what about tests that have no weight assigned, how are they counted? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201

RE: [Declude.JunkMail] Heur Cumulative?

2001-11-04 Thread Andy Schmidt
Scott, if the value is 0., only the HEUR10 test would be triggered Not to be argumentative, but your sample doesn't quite fit my experiences. a) a value of 0. doesn't seem to trigger HEUR10 - but triggers HEUR9? So it doesn't seem as if you are using a CEILING test (or rounding). b)

[Declude.JunkMail] 1.28 - WhiteList not working

2001-11-06 Thread Andy Schmidt
-software.com. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com/ --- This E-mail came from the Declude.JunkMail mailing list

RE: [Declude.JunkMail] 1.28 - WhiteList not working, Part Deux

2001-11-06 Thread Andy Schmidt
PS - before you ask, the configuration is set to MAILFROM HOLD - and that's exactly what it DID, despite the whitelist! Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Andy Schmidt Sent: Tuesday, November 06, 2001 11:07 AM To: [EMAIL

RE: [Declude.JunkMail] 1.28 - WhiteList not working

2001-11-06 Thread Andy Schmidt
; remote host maywood-is-0001.webhost.hm-software.com. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, November 06, 2001 03:33 PM

RE: [Declude.JunkMail] 1.28 - WhiteList not working

2001-11-06 Thread Andy Schmidt
The easiest way to debug this would be to send an E-mail from the IP address in question, with the Declude debugging turned on. Here it is - as you can see, it DOES recognize the whitelist: 11/06/2001 18:27:57 Q71fb3de Testing whitelist 2 63.107.174. 11/06/2001 18:27:57

RE: [Declude.JunkMail] 1.28 - SwitchRecip not effective?

2001-11-06 Thread Andy Schmidt
I defined SWITCHRECIP ON but it's still using Declude\$default$.junkmail instead of Declude\WebsterWatch.com\$default$.junkmail 11/06/2001 20:45:25 CFG: Setting LOG_OK level to NONE 11/06/2001 20:45:25 CFG: Set hop to 0 and hophigh to 0. 11/06/2001 20:45:25

RE: [Declude.JunkMail] 1.28 - WEIGHT doesn't fail message

2001-11-06 Thread Andy Schmidt
In case you need more - weight is 14 - but WEIGHT10 does NOT fail message! I still believe it has something to do with the fact, that the final recipient is an forwarding alias to an external domain. The first example was forwarded to @aol.com this one to @fcc.net! 11/06/2001 19:52:59 CFG:

RE: [Declude.JunkMail] 1.28 - CRASH

2001-11-06 Thread Andy Schmidt
The DECLUDE.GP* files only contain a few garbled characters - but may be the debug log helps zooming in? (PS: Never let me test G) 11/06/2001 19:07:16 CFG: Setting LOG_OK level to NONE 11/06/2001 19:07:16 CFG: Set hop to 0 and hophigh to 0. 11/06/2001 19:07:16 Console turned OFF 11/06/2001

[Declude.JunkMail] Declude v1.29 - FULLMSG not working

2001-12-06 Thread Andy Schmidt
Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com/ D34e0498.GSC Description: Binary data ---BeginMessage--- Argos Networks' Firewall has rejected

RE: [Declude.JunkMail] Signed Email Problems

2001-12-07 Thread Andy Schmidt
signatures. That made a huge difference in the time it takes to open signed mail in Outlook. -Original Message- From: Support [mailto:[EMAIL PROTECTED]] Sent: Friday, December 07, 2001 05:46 AM To: 'Andy Schmidt' Cc: Smart Business Support Subject: email problems Hi Andy, I receive messages

RE: [Declude.JunkMail] Declude v1.29 beta - Arbitrary Logging, and Weighting IS broken!

2001-12-07 Thread Andy Schmidt
NEIGHBOR 12/07/2001 11:00:51 Qe7a6194 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Why would Declude act differently for the SAME tests! Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20

[Declude.JunkMail] Declude v1.29 beta - WEIGHT no longer working properly

2001-12-07 Thread Andy Schmidt
product: http://weighout.81832.com You are receiving this email as a subscriber to the Opt-In America Mailing List. To remove yourself from all related maillists, just click here: mailto:[EMAIL PROTECTED]?Subject=REMOVE Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite

RE: [Declude.JunkMail] Declude v1.29 beta - Arbitrary Logging, and Weighting IS broken!

2001-12-09 Thread Andy Schmidt
Another one: SPAMCOP:7 . Total weight = 7 Yet - not Msg Failed log entry for SPAMCOP! 12/09/2001 15:40:33 CFG: Setting LOG_OK level to NONE 12/09/2001 15:40:33 CFG: Set hop to 0 and hophigh to 0. 12/09/2001 15:40:33 Console turned OFF 12/09/2001 15:40:33 CFG: Setting XINHEADER to

RE: [Declude.JunkMail] Declude v1.29 beta - Arbitrary Logging, and Weighting IS broken!

2001-12-09 Thread Andy Schmidt
Here a third one - this one is even more drastic. Total weight is 22 - but it does NOT trigger WEIGHT10! I'll hold off sending any more samples - unless you need more: OSRELAY:6 SPAMCOP:7 SPAMROUTING:4 REVDNS:5 . Total weight = 22 but only TWO Msg Failed logs - which add up to 9 - so

RE: [Declude.JunkMail] SPAMROUTING Broken

2001-12-17 Thread Andy Schmidt
in a poor manner consistent with spam [2103]. X-Declude-Sender: [EMAIL PROTECTED] [194.127.224.201] X-Declude-Spoolname: Dfed609e.SMD X-Declude-Note: Processed by Declude 1.30; remote host [No Reverse DNS] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 601 Best Regards Andy Schmidt Phone: +1

[Declude.JunkMail] Verison 1.3.0 - Custom Warnings Broken

2001-12-18 Thread Andy Schmidt
Title: STOCKPLAY - NU ELECTRIC CORPORATION Scott: Sorry - but the 1.3.0 beta seems have to have broken the JunkMail feature in a number of places again. Problem 1: As you can see from my $default$.junkmail file, I have configured: OSRELAYWARNBADHEADERS WARNX-Declude-Note: %WARNING% See:

RE: [Declude.JunkMail] Version 1.3.0 - Custom Warnings Broken

2001-12-18 Thread Andy Schmidt
Scott: This could be caused by the same problem as with the last message (the global.cfg file being used), if it is set to just WARN without any custom text. You seem to be right on this point. Out of 15 spam messages that had SPAMHEADERS/BADHEADERS that were allowed to pass through, I

RE: [Declude.JunkMail] Bounce from null sender?

2001-12-20 Thread Andy Schmidt
% -to %mailfrom% -from %mailto% -subject %subject% (the above syntax is just pretense) Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com

RE: [Declude.JunkMail] v1.31 released

2001-12-27 Thread Andy Schmidt
Thanks - after running it for an hour I have yet to found any WEIGHT problems. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

RE: [Declude.JunkMail] [Declude.Virus] SPAM mail checksums

2001-12-29 Thread Andy Schmidt
This sounds like a promising approach: http://www.rhyolite.com/anti-spam/dcc/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

RE: [Declude.JunkMail] 1.31 crashes EVERY morning at 0:00 hours

2002-01-10 Thread Andy Schmidt
These are the FIRST lines of any day's log file. 01/10/2002 00:00:55 SPAMHEADERS:3 HEUR10:4 . Total weight = 7 01/10/2002 00:00:55 (Error 5 at 40f08a v1.31) 01/10/2002 00:00:55 (log part 2 saved as C:\declude.gp2) 01/10/2002 00:00:55 (log part 1 saved as C:\declude.gp1) 01/10/2002 00:00:55

RE: [Declude.JunkMail] Domain videoage1.com has no MX/A records.

2002-01-16 Thread Andy Schmidt
MAILFROM Test --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for

[Declude.JunkMail] Netsol WHOIS

2002-01-24 Thread Andy Schmidt
Scott, I know you have been complaining about the WHOIS restrictions of Network Solutions. I don't know if you realize, but the following URL seems to be unrestricted: http://www.netsol.com/cgi-bin/whois/whois?STRING=ipswitch.comSearchType=do Best Regards Andy Schmidt Phone: +1 201 934-3414

RE: [Declude.JunkMail] Spam Review Question

2002-01-30 Thread Andy Schmidt
will result in a bounce. The sending email address is never valid. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing

RE: Re[2]: [Declude.JunkMail] Declude v1.35 released

2002-01-30 Thread Andy Schmidt
=4202 X-IXS-Message-Id: OM:[EMAIL PROTECTED] Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list

RE: [Declude.JunkMail] header confusion

2002-01-31 Thread Andy Schmidt
can anyone think of a better names than HEADER/FOOTER Prolog/Epilog Banner/Trailer Top/Bottom Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail

RE: [Declude.JunkMail] Am I blacklisting correctly?

2002-01-31 Thread Andy Schmidt
One person reported being able to send mail to multiple recipients with an .eml file (using a comma between them, IE To: [EMAIL PROTECTED],[EMAIL PROTECTED]) Yes, I have been doing this with success. It's actually documented! --- [This E-mail was scanned for viruses by Declude Virus

[Declude.JunkMail] DSNSTUFF.com - Classless Delegation

2002-02-01 Thread Andy Schmidt
.NS.UU.NET. Searching for PTR record for 55.32/27.239.45.12.in-addr.arpa at AUTH00.NS.UU.NET.: Reports mail.dextershoe.com. etc. (Let's overlook for a moment, that AUTH00.NS.UU.NET currently is actually missing that zone G) Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1

[Declude.JunkMail] DNS Timeout - once again shows as No Reverse DNS

2002-02-14 Thread Andy Schmidt
questions = 1, answers = 0, authority records = 0, additional = 0 QUESTIONS: 222.170.153.141.in-addr.arpa, type = PTR, class = IN DNS request timed out. timeout was 2 seconds. timeout (2 secs) SendRequest failed Best Regards Andy Schmidt Phone: +1 201

[Declude.JunkMail] Ip List for Reverse DNS

2002-02-15 Thread Andy Schmidt
is s typical SPAM header: Received: from s0260.pm0.net [199.236.13.43] If I could add pm0.net and hispeedmailer.com and others to a new Reverse DNS blacklist, then we wouldn't have to try to enter their complete IP block one line at a time. Best Regards Andy Schmidt HM Systems Software, Inc

RE: [Declude.JunkMail] REMOTEHOST vs. SENDERHOST

2002-02-15 Thread Andy Schmidt
Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

RE: [Declude.JunkMail] Return-Path - proper use?

2002-02-15 Thread Andy Schmidt
set by the originating SMTP server? In other words, that header could/should already exists in the header and Imail should NOT add it upon receipt of inbound mail. If ANYTHING, Imail or Declude should add it to any OUTBOUND mail? Scott? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20

RE: [Declude.JunkMail] Return-Path - proper use?

2002-02-15 Thread Andy Schmidt
Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

RE: [Declude.JunkMail] Return-Path - proper use?

2002-02-15 Thread Andy Schmidt
of the SAME address. Of course, Imail doesn't use the RETURN PATH - it relies on its Q* files to store the envelope FROM. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com

RE: [Declude.JunkMail] Return-Path - proper use?

2002-02-15 Thread Andy Schmidt
that any bounces AFTER completion of the SMTP process still know where to send bounces to. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from

RE: [Declude.JunkMail] Return-Path vs. X-Sender header?

2002-02-15 Thread Andy Schmidt
). The FINAL SMTP server in the process is required to ADD the Return-Path header. (Imail does NOT add that header because it stores that information in its Q* file. This alternate storage location of the final envelope from works - but is a violation of RFCs.) Best Regards Andy Schmidt Phone: +1 201

RE: [Declude.JunkMail] REMOTEHOST vs. SENDERHOST

2002-02-15 Thread Andy Schmidt
FROM domain? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL

RE: [Declude.JunkMail] REMOTEHOST vs. SENDERHOST vs. LOCALHOST vs. RECIPHOST

2002-02-15 Thread Andy Schmidt
Is the following true: Incoming Mail %LOCALHOST% = %RECIPHOST% %REMOTEHOST% = %SENDERHOST% Outbound Mail %LOCALHOST% = %SENDERHOST% %REMOTEHOST% = %RECIPHOST% Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned

RE: [Declude.JunkMail] fromfile

2002-02-27 Thread Andy Schmidt
Declude just looks for a exact match How about an IP whitelist? Will WHITELIST IP 127.0.0.1 ALSO imply that 127.0.0.10 - 19 and 100 - 199 are whitelisted? If so, how do whitelist single digit host addresses (such as the above .1). Best Regards Andy Schmidt HM Systems

[Declude.JunkMail] Testing for MIME EOF

2002-03-06 Thread Andy Schmidt
probably some freeware SPAM mailer. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send

RE: [Declude.JunkMail] Testing for MIME EOF

2002-03-06 Thread Andy Schmidt
Scott, but you ARE doing it already - that's why I see the log entry. Warning: EOF in middle of MIME segment [] Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED

RE: [Declude.JunkMail] Bounced Message?

2002-03-08 Thread Andy Schmidt
resolved. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL

RE: [Declude.JunkMail] BLARS:Message Processing Order

2002-03-11 Thread Andy Schmidt
it does is inspect the IP header to get the sender's IP - and, if necessary, will drop the connection to Imail and reply with an error code to the sender. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED

[Declude.JunkMail] Why is FROM header wrong?

2002-03-13 Thread Andy Schmidt
Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

RE: [Declude.JunkMail] Identifying countries

2002-03-18 Thread Andy Schmidt
test. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, March 18, 2002 01:16 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail

RE: [Declude.JunkMail] Bounced Alert Messages due to unknown recipient

2002-03-22 Thread Andy Schmidt
Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Matuska Sent: Friday, March 22, 2002 10:51 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Bounced Alert

RE: [Declude.JunkMail] Confirmation Action

2002-04-01 Thread Andy Schmidt
of losing any important/time-critical email will be even less of an issue. This is 100 times better than some frustrated business partner having to contact the postmaster and plead his case - he can STILL do that, but in the meantime, the email is going through. Best Regards Andy Schmidt Phone

[Declude.JunkMail] DNSSTUFF broken again?

2002-04-01 Thread Andy Schmidt
Is the IP4r lookup broken again. I'm getting no lookup responses for virtually ANY of the Spam databases - even after 10 retries: http://www.dnsstuff.com/tools/ip4r.ch?ip=216.129.91.35 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail

[Declude.JunkMail] Spam Database Lookup.htm

2002-04-01 Thread Andy Schmidt
There don't seem to be any problems from this end. Have there been issues before? When I go there, it shows a couple of timeouts (UIB/UIBOK), but the rest return something. Here is what I see: Shouldn't I AT LEAST be seeing Not Listed? Best Regards Andy Schmidt Title: Spam Database

[Declude.JunkMail] Classless Reverse Lookup - DNSSTUFF

2002-04-05 Thread Andy Schmidt
server to ns1.webhost.hm-software.com, instead it is using the NON-authoritative information provided by ns1.dls.net. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com

[Declude.JunkMail] Reverse DNS Lookup.htm

2002-04-05 Thread Andy Schmidt
Country: UNITED STATES How I am searching: Searching for 162.89.86.65.in-addr.arpa PTR at f.root-servers.net: Got unknown result, sorry! Title: Reverse DNS Lookup Reverse DNS for 65.86.89.162Generated by www.DNSstuff.com Country: UNITED STATES How I am searching: Searching for

RE: [Declude.JunkMail] Reverse DNS Lookup.htm

2002-04-06 Thread Andy Schmidt
Sent: Saturday, April 06, 2002 04:50 PM To: Andy Schmidt Subject: Re: [Declude.JunkMail] Reverse DNS Lookup.htm Hello Andy, DSL.net, Inc. (NETBLK-DSLNET-6) DSLNET-6 65.84.0.0 - 65.86.255.255 H M SYSTEMS SOFTWARE INC. (NETBLK-DSLNET-20020211-6) DSLNET-20020211-6

RE: [Declude.JunkMail] UUnet Backbone Trouble

2002-04-25 Thread Andy Schmidt
http://www1.worldcom.com/us/tools/noc/status.xml 10:17 AM EST. 4/25/02: Routing instabilities on the Backbone. NOC is working issue. No ETR at this time. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 No specific idea, but I did just watch a HUGE

RE: [Declude.JunkMail] hotmail !?

2002-05-01 Thread Andy Schmidt
information. They play god we don't need anyone to ever contact us, we are always without fault. Makes you appreciate, why outfits like them get sued into the ground eventually. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message

[Declude.JunkMail] 155i - now REVDNS is broken

2002-06-29 Thread Andy Schmidt
Scott: The moment I put on the latest 155i this afternoon, I started getting massive false reports of Reverse DNS missing. It took until now before I realized it was NOT my DNS servers etc. The problem is, that Declude does not look up the IP address, but rather looks up . Here is a sample

[Declude.JunkMail] Whitelist stopped working

2002-06-30 Thread Andy Schmidt
Notice - how the following email came from 63.107.174.32 - yet, it STILL has the X-RBL-Warning! That IP is my backup SMTP server (so its set to IPBYPASS) AND it runs a few auxiliary services that send automated emails (so its set to WHITELIST). IPBYPASS63.107.174.32 IPBYPASS

RE: [Declude.JunkMail] Whitelist stopped working, REVDNS lookup fails

2002-06-30 Thread Andy Schmidt
the IP is blank. But, there are also a large number of emails which correctly identify the IP address in the log (at least apparently so). Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business

[Declude.JunkMail] 155i - IPBYPASS not honored?

2002-07-03 Thread Andy Schmidt
Hi Scott: Please check the header below. You can see that Imail/Declude got that mail from 206.46.170.226 - which is on my IPBYPASS list: IPBYPASS63.107.174.32IPBYPASS65.86.89.162# Verizon Mail ServersIPBYPASS206.46.170.218IPBYPASS206.46.170.246IPBYPASS206.46.170.266 # Attempting a

[Declude.JunkMail] Bad Subject Header

2002-07-09 Thread Andy Schmidt
is so bad about the word gate? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.hm-software.com/ --- [This E-mail was scanned for viruses by Declude

RE: [Declude.JunkMail] 155i: SMTP AUTH not treated as LOCAL mail?

2002-07-09 Thread Andy Schmidt
Hi Scott: Is cps-stampings.com a local domain? yes, ignoring upper case/lower case (!?) CPS Stampings has been a local domain for years: [HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail\Domains\CPS-Stampings.com] Address=$virtual030 TopDir=E:\\MAIL\\CPS Flags=dword: MaxSize=dword:00989680

RE: [Declude.JunkMail] Bad Subject Header

2002-07-10 Thread Andy Schmidt
Hi, I'm guessing that there were 2 subject headers in there -- a good one and a bad one. Do you have the full headers for that E-mail by chance? here is the header. After looking at it I suspect that Declude is reporting the string of 9 SPACES behind the word gate Received: from

RE: [Declude.JunkMail] Declude JunkMail v1.56 (beta) released

2002-07-10 Thread Andy Schmidt
WEIGHT 20 If the calculated weight is 25 - will both only execute the last of the three? What can I accomplish with WEIGHTRANGE - e.g., how does it trigger a different result to WEIGHT. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail

RE: [Declude.JunkMail] Declude JunkMail v1.56 (beta) released

2002-07-10 Thread Andy Schmidt
. Okay, so the traditional: WEIGHT10 WEIGHT15 WEIGHT20 is then equivalent to: WEIGHT10 weightrange x x 10 99 WEIGHT15 weightrange x x 15 99 WEIGHT20 weightrange x x 20 99 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned

RE: [Declude.JunkMail] Problems with weightrange - CAUTION

2002-07-11 Thread Andy Schmidt
Yes, I am only able to reply now. I spent all day to extract email addresses (from/to/subject) from the Declude.log and then write a mail-merge to send customized notifications to each sender and recipient - 5,800 in all. Once I turned on the WeightRange - it deleted 99% of the incoming

RE: [Declude.JunkMail] Whitelist/blacklist question...

2002-07-13 Thread Andy Schmidt
people have seen a sudden increase in spam when whitelisting mail.com (which ends up whitelisting @hotmail.com, a popular return address for spammers). Well - that's only because Declude doesn't support regular expressions. I face this problem constantly - the INCLUDES filters are a nice

[Declude.JunkMail] Whitelisted - why?

2002-07-23 Thread Andy Schmidt
Scott, any chance that the "FROM hm-software.com" whitelist picked up on the Return-Path: 36-809-hm-software.com?[EMAIL PROTECTED] ? Obviously, the intent is to ONLY whitelist things that END with "hm-software.com". WHITELISTANYWHERE [EMAIL

RE: [Declude.JunkMail] Adding Weigh to TO:?

2002-07-30 Thread Andy Schmidt
Now the question: Can we add a weigh to the address used in the To List? SP I don't think that is currently possible. Why would you want to do that, though? Scott, actually, I had wished for this myself for a while. We DO have a few legacy domain names where 99% of the incoming messages

RE: [Declude.JunkMail] REDIRECT

2002-07-30 Thread Andy Schmidt
Hi Scott: REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\lenient.cfg hhh that would be a cool feature. Instead of whitelisting Postmaster@ I could now decide to simply test those differently. But - since this is essentially per user configuration - will that feature demand Pro level

RE: [Declude.JunkMail] Spam Review kill.lst problem question

2002-07-31 Thread Andy Schmidt
How about: Here is the headers that I am inserting - in case that helps: XINHEADER X-Declude: Version %VERSION%; %QUEUENAME% from %REVDNS% [%REMOTEIP%] XINHEADER X-Declude: Failed %TESTSFAILED% [%WEIGHT%] XINHEADER Return-Path: %MAILFROM% Best Regards Andy Schmidt Phone: +1

RE: [Declude.JunkMail] What Action Do you take?

2002-08-02 Thread Andy Schmidt
would be to hack into the Virus Gateway interface that they are using to call the Symantec AV DLLs. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came

RE: [Declude.JunkMail] nWhiteLists 200 ?

2002-08-13 Thread Andy Schmidt
Which version of Declude are you running According to the mail header: X-Declude: Version 1.57 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL

RE: [Declude.JunkMail] I Screwed up

2002-08-27 Thread Andy Schmidt
beta? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED

RE: [Declude.JunkMail] What is wrong with this picture?

2002-08-28 Thread Andy Schmidt
Clearly - a denial of lipservice attack G Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Kami Razvan Sent: Wednesday, August 28, 2002 03:52 PM To: [EMAIL

RE: [Declude.JunkMail] OT - Listed on Spwes!

2002-09-17 Thread Andy Schmidt
Unfortunately, SPEWS is part of the OS* tests - I have found them rather GOOD. But spews certainly is a BIG down factor for the OSIRUSOFT lists. Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail

[Declude.JunkMail] DNS Stuff - wrong analysis?

2002-09-18 Thread Andy Schmidt
- your help text could be much more specific. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe

[Declude.JunkMail] Date Header wrong - REALLY?

2002-09-18 Thread Andy Schmidt
Scott- why do I get http://www.declude.com/tools/header.php?code=c020020c for this: Received: from mta541.mail.yahoo.com [216.136.131.23] by hm-software.com (SMTPD32-7.07) id A0461AEF00BE; Wed, 18 Sep 2002 17:29:42 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Loop: [EMAIL

RE: [Declude.JunkMail] Date Header wrong - REALLY?

2002-09-18 Thread Andy Schmidt
So are you inferring that either Imail or the client's Exchange Server inserted that DATE header on the bottom? Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, September 18, 2002 06:15 PM To: [EMAIL

RE: [Declude.JunkMail] Date Header wrong - REALLY?

2002-09-18 Thread Andy Schmidt
Okay, I knew that Imail added Message ID headers - I did NOT know that it also added DATE headers. Is there a knowledge base entry listing the headers that Imail injects? Best Regards Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came

RE: [Declude.JunkMail] Junkmail Notification Intelligence

2002-10-08 Thread Andy Schmidt
in the first place. And if everyone did, then viruses would be stopped at the first hop. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Trent M. Davenport Sent: Tuesday

RE: Re: [Declude.JunkMail] Messenger Service Junk Abuse?

2002-10-14 Thread Andy Schmidt
a virus? Or are these servers which have their NetBios ports exposed to the Internet? Then, this is really not a junk mail issue - since no email is involved in the distribution. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message

  1   2   3   4   5   6   7   8   9   >