RBL useless or just wrong implemented?

Hi guys,

I hope somebody has an answer since I run out of them :-)


Basically I am using GFI MailEssentials to protect my MTA against SPAM. As
soon I activate GFIs RBL Module it blocks virtually all inbound emails.

First I researched my DNS settings. They are definetly ALL OK.

Then I investigated the mail headers and IPs and found out that GFI
Mailessentials basically checks EVERY IP of the mailheader against RBL
lists. Of course ALL emails which have been sent somehow from a home network
will be blocked. I always thought that RBL Filter should check the IPs of
the relaying MTA and NOT the origin of the mail.

I hope I was clear what I mean. So for example user X sends an email via
gmx.de (german webmailer). Since gmx writes the IP of the User X as received
from into the header GFIs RBL will block it - even though GMX is a clean an
reputable system.

I tried to contact GFIs support but never got an answer. I posted this in
their forum and it got deleted (which makes me think I am right).

There is a similar thread in the GFI Forum on 
http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklists/m_900736438/tm.htm
I posted to that one as well - and got deleted!

Can anybody explain me please which IPs of the header should be checked
against RBL lists?

Thanks a lot
Karl!


0
KarlLager (6)
9/16/2006 8:01:30 PM
exchange.admin 57650 articles. 2 followers. Follow

22 Replies
502 Views

Similar Articles

[PageSpeed] 39

No. I would only check the host that connected to you. You may also want to 
check the RBL you are using. Some list the entire netblocks for the various 
ISP dial-ups. They consider that SMTP traffic shouldn't be coming directly 
from the home user machine and should only come via the relay host for that 
ISP's.

Most RBL's work on the premise that you don't want to accept the email for 
those hosts that are listed. The rejection (to me) should be rejected at the 
connection level and before you've accepted the message. Checking the IP 
addresses in the headers of the email may be used as some sort of confidence 
score but I would think that's not worth the effort.


"Karl Lager" <KarlLager@spam.freemail.de> wrote in message 
news:eZQ5Vsc2GHA.3428@TK2MSFTNGP05.phx.gbl...
> Hi guys,
>
> I hope somebody has an answer since I run out of them :-)
>
>
> Basically I am using GFI MailEssentials to protect my MTA against SPAM. As
> soon I activate GFIs RBL Module it blocks virtually all inbound emails.
>
> First I researched my DNS settings. They are definetly ALL OK.
>
> Then I investigated the mail headers and IPs and found out that GFI
> Mailessentials basically checks EVERY IP of the mailheader against RBL
> lists. Of course ALL emails which have been sent somehow from a home 
> network
> will be blocked. I always thought that RBL Filter should check the IPs of
> the relaying MTA and NOT the origin of the mail.
>
> I hope I was clear what I mean. So for example user X sends an email via
> gmx.de (german webmailer). Since gmx writes the IP of the User X as 
> received
> from into the header GFIs RBL will block it - even though GMX is a clean 
> an
> reputable system.
>
> I tried to contact GFIs support but never got an answer. I posted this in
> their forum and it got deleted (which makes me think I am right).
>
> There is a similar thread in the GFI Forum on 
> http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklists/m_900736438/tm.htm
> I posted to that one as well - and got deleted!
>
> Can anybody explain me please which IPs of the header should be checked
> against RBL lists?
>
> Thanks a lot
> Karl!
>
> 


0
9/17/2006 1:37:32 AM
"Karl Lager" <KarlLager@spam.freemail.de> wrote:

>Basically I am using GFI MailEssentials to protect my MTA against SPAM. As
>soon I activate GFIs RBL Module it blocks virtually all inbound emails.
>
>First I researched my DNS settings. They are definetly ALL OK.
>
>Then I investigated the mail headers and IPs and found out that GFI
>Mailessentials basically checks EVERY IP of the mailheader against RBL
>lists. 

Spam filters usually have some way of limiting the depth of the
checking they do on the "Received:" header. Checking more than the IP
address that sent the message is sure to lead to problems unless your
server isn't the "first hop" in from the Internet.

>Of course ALL emails which have been sent somehow from a home network
>will be blocked. 

Why? Do you consider all mail that arrives from an IP address found in
some RBL that thinks it's a dynamicly assigned IP address? Tat's no
blocking spam, it's blocking connections.

>I always thought that RBL Filter should check the IPs of
>the relaying MTA and NOT the origin of the mail.

You can usually confgure them to do that, or to check "X" number of
"Received:" headers.

>I hope I was clear what I mean. So for example user X sends an email via
>gmx.de (german webmailer). Since gmx writes the IP of the User X as received
>from into the header GFIs RBL will block it - even though GMX is a clean an
>reputable system.
>
>I tried to contact GFIs support but never got an answer. I posted this in
>their forum and it got deleted (which makes me think I am right).
>
>There is a similar thread in the GFI Forum on 
>http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklists/m_900736438/tm.htm
>I posted to that one as well - and got deleted!
>
>Can anybody explain me please which IPs of the header should be checked
>against RBL lists?

The only reliable information in the headers is the information YOUR
server puts into them. All other header info can be easily forged. By
checking all the "Received:" headers you're probably only penalizing
legitimate senders.

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/17/2006 3:04:01 AM
"Jim Schwartz" <shamusnc@not.earthlink.net> wrote:

>No. I would only check the host that connected to you. You may also want to 
>check the RBL you are using. Some list the entire netblocks for the various 
>ISP dial-ups. They consider that SMTP traffic shouldn't be coming directly 
>from the home user machine and should only come via the relay host for that 
>ISP's.

That's a pretty good assumption. A good deal of the spam today comes
from zombie networks and the zombies send mail directly, not through
ISP's relay  servers. But that doesn't mean that all
dial-up/dynamically assigned IP addresses are bad. I do think that
port 25 should be prevented from reching the Internet on those type of
cnnections, though. The ISP provides a SMTP relay server that should
be used.

>Most RBL's work on the premise that you don't want to accept the email for 
>those hosts that are listed. The rejection (to me) should be rejected at the 
>connection level and before you've accepted the message. Checking the IP 
>addresses in the headers of the email may be used as some sort of confidence 
>score but I would think that's not worth the effort.

Only if the server doing the checking isn't the "first hop" in from
the Internet.

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/17/2006 3:10:13 AM
Many of the larger ISP's already block that traffic from coming out of their 
networks. Sort of a pain for those running their own mailhost on their home 
networks, but there are several easy workarounds.

"Rich Matheisen [MVP]" <richnews@rmcons.com.NOSPAM.COM> wrote in message 
news:qpepg2p54u619kc0n27tdijc4r6iu1rgog@4ax.com...
> "Jim Schwartz" <shamusnc@not.earthlink.net> wrote:
>
>>No. I would only check the host that connected to you. You may also want 
>>to
>>check the RBL you are using. Some list the entire netblocks for the 
>>various
>>ISP dial-ups. They consider that SMTP traffic shouldn't be coming directly
>>from the home user machine and should only come via the relay host for 
>>that
>>ISP's.
>
> That's a pretty good assumption. A good deal of the spam today comes
> from zombie networks and the zombies send mail directly, not through
> ISP's relay  servers. But that doesn't mean that all
> dial-up/dynamically assigned IP addresses are bad. I do think that
> port 25 should be prevented from reching the Internet on those type of
> cnnections, though. The ISP provides a SMTP relay server that should
> be used.
>
>>Most RBL's work on the premise that you don't want to accept the email for
>>those hosts that are listed. The rejection (to me) should be rejected at 
>>the
>>connection level and before you've accepted the message. Checking the IP
>>addresses in the headers of the email may be used as some sort of 
>>confidence
>>score but I would think that's not worth the effort.
>
> Only if the server doing the checking isn't the "first hop" in from
> the Internet.
>
> -- 
> Rich Matheisen
> MCSE+I, Exchange MVP
> MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
> Don't send mail to this address mailto:h.pott@getronics.com
> Or to these, either: mailto:h.pott@pinkroccade.com 
> mailto:melvin.mcphucknuckle@getronics.com 
> mailto:melvin.mcphucknuckle@pinkroccade.com 


0
9/17/2006 3:20:19 AM
Hi Jim

"Jim Schwartz" <shamusnc@not.earthlink.net> schrieb im Newsbeitrag 
news:wF1Pg.12602$bM.9664@newsread4.news.pas.earthlink.net...
> No. I would only check the host that connected to you. You may also want 
> to check the RBL you are using. Some list the entire netblocks for the 
> various ISP dial-ups. They consider that SMTP traffic shouldn't be coming 
> directly from the home user machine and should only come via the relay 
> host for that ISP's.

Thank you very much. That I am trying to make clear to GFI for ages. But 
they dont react and delete usually my forum posts!

>
> Most RBL's work on the premise that you don't want to accept the email for 
> those hosts that are listed. The rejection (to me) should be rejected at 
> the connection level and before you've accepted the message. Checking the 
> IP addresses in the headers of the email may be used as some sort of 
> confidence score but I would think that's not worth the effort.

You are right. It always bugged me that they are just sorting the SPAM 
instead of rejecting it.
Maybe I should consider a different product? Do you have any suggestions?

Karl 


0
KarlLager (6)
9/17/2006 6:38:36 AM
Hi Rich,

> Only if the server doing the checking isn't the "first hop" in from
> the Internet.

Well, except some newsletters most emails coming in directly (without any 
relay involved) are usually SPAM. 


0
KarlLager (6)
9/17/2006 6:40:05 AM
Hi Rich,


"Rich Matheisen [MVP]" <richnews@rmcons.com.NOSPAM.COM> schrieb im 
Newsbeitrag news:29epg2d90128hvoaup0v4hpa26j001fuvl@4ax.com...
> "Karl Lager" <KarlLager@spam.freemail.de> wrote:

> Spam filters usually have some way of limiting the depth of the
> checking they do on the "Received:" header.

Not GFI. They ALWAYS check ALL IPs. Result is that mails queue back in the 
queue folder (DNS takes some time...) and most emails send from private 
machines (dynamic IPs) are blocked!


> Checking more than the IP
> address that sent the message is sure to lead to problems unless your
> server isn't the "first hop" in from the Internet.

I know! But it seems the GFI guys havent understood or dont want to 
understand.


>>Of course ALL emails which have been sent somehow from a home network
>>will be blocked.
>
> Why? Do you consider all mail that arrives from an IP address found in
> some RBL that thinks it's a dynamicly assigned IP address? Tat's no
> blocking spam, it's blocking connections.

Because the percentage of ISP IPs listed in RBL lists is quite high. As I
said in my sample. Even if a user sends me an email via webmail (yahoo, gmx 
etc) GFI
will block it since the webmail enters the users IP as received from and GFI 
checks that IP against RBL.
So using a safe relay doesnt help to get the mail pass the RBL filter.

> You can usually confgure them to do that, or to check "X" number of
> "Received:" headers.

Tell them. Seems they understood RBL unusual :-(

> The only reliable information in the headers is the information YOUR
> server puts into them. All other header info can be easily forged. By
> checking all the "Received:" headers you're probably only penalizing
> legitimate senders.

I know - they dont!

>
> -- 
> Rich Matheisen
> MCSE+I, Exchange MVP
> MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
> Don't send mail to this address mailto:h.pott@getronics.com
> Or to these, either: mailto:h.pott@pinkroccade.com 
> mailto:melvin.mcphucknuckle@getronics.com 
> mailto:melvin.mcphucknuckle@pinkroccade.com


Thanks a lot Rich for you help.
I will give it a last try to convience them that their RBL is not 
implemented correct. Otherwise I will have to start evaluating proper RBL 
products. Do
you have any suggestions? Greylisting would be cool as well.

Karl 


0
KarlLager (6)
9/17/2006 6:46:51 AM
On Sun, 17 Sep 2006 08:40:05 +0200, "Karl Lager"
<KarlLager@spam.freemail.de> wrote:

>Hi Rich,
>
>> Only if the server doing the checking isn't the "first hop" in from
>> the Internet.
>
>Well, except some newsletters most emails coming in directly (without any 
>relay involved) are usually SPAM. 
>


Most email is SPAM regardless!

0
adavid (8731)
9/17/2006 11:54:32 AM
On Sun, 17 Sep 2006 08:38:36 +0200, "Karl Lager"
<KarlLager@spam.freemail.de> wrote:

>Hi Jim
>
>"Jim Schwartz" <shamusnc@not.earthlink.net> schrieb im Newsbeitrag 
>news:wF1Pg.12602$bM.9664@newsread4.news.pas.earthlink.net...
>> No. I would only check the host that connected to you. You may also want 
>> to check the RBL you are using. Some list the entire netblocks for the 
>> various ISP dial-ups. They consider that SMTP traffic shouldn't be coming 
>> directly from the home user machine and should only come via the relay 
>> host for that ISP's.
>
>Thank you very much. That I am trying to make clear to GFI for ages. But 
>they dont react and delete usually my forum posts!
>
>>
>> Most RBL's work on the premise that you don't want to accept the email for 
>> those hosts that are listed. The rejection (to me) should be rejected at 
>> the connection level and before you've accepted the message. Checking the 
>> IP addresses in the headers of the email may be used as some sort of 
>> confidence score but I would think that's not worth the effort.
>
>You are right. It always bugged me that they are just sorting the SPAM 
>instead of rejecting it.
>Maybe I should consider a different product? Do you have any suggestions?
>
>Karl 


For RBLs? Vamsoft is a good product and cheap.
For anti-Spam? Brightmail, even though its a Symantec product now.
Mail Frontier is good.  , well, too many to list. Lots to choose from.
If you are having problems with GFI, dump it. Heck, IMF is better than
nothing.

BTW, I would have made the subject of this thread "GFI doesnt work" or
something. I bet they notice that and they cant delete the posts here.



>
0
adavid (8731)
9/17/2006 11:58:21 AM
>>Well, except some newsletters most emails coming in directly (without any
>>relay involved) are usually SPAM.
>>
>
>
> Most email is SPAM regardless!
>

LOL - very true. Thats another reason why I am fed up with sorting/reviewing 
SPAM in Junk Folder. To be honest that doesnt save work/money. Maybe it 
costs even more because my user now have to monnitor the inbox AND the 
SPAM/JUNK MAIL for false positives.


Karl 


0
KarlLager (6)
9/17/2006 12:42:53 PM
> For RBLs? Vamsoft is a good product and cheap.
> For anti-Spam? Brightmail, even though its a Symantec product now.
> Mail Frontier is good.  , well, too many to list. Lots to choose from.
> If you are having problems with GFI, dump it. Heck, IMF is better than
> nothing.

I was considering to upgrade to 2003 to be able to use IMF. In the past I 
tried to support small ISVs. But since I experience bad support from these I 
will no try to stick strickly to market leaders. There must be a reason that 
marktet leaders are market leaders and support must be one reason I guess.

> BTW, I would have made the subject of this thread "GFI doesnt work" or
> something. I bet they notice that and they cant delete the posts here.

Well, I wasnt even sure if the RBS is useless or crappy implemented. So I 
wanted to hear professional advise on how RBL should work.

Karl 


0
KarlLager (6)
9/17/2006 12:45:52 PM
"Karl Lager" <KarlLager@spam.freemail.de> wrote:

>Hi Rich,
>
>> Only if the server doing the checking isn't the "first hop" in from
>> the Internet.
>
>Well, except some newsletters most emails coming in directly (without any 
>relay involved) are usually SPAM. 

I'm not sure what relevance that has. I was talking about *your*
server (the one that's checking the RBL) being the "first hop" in, not
theirs. :-)

I do agree with what you say, though. Zombie networks will fall into
that category. 

I really don't care about any address other than the one that sent me
the message. The other addresses are easily forged and are, very
often, meaningless (those are the ones that cause me to get "spam"
reports from SpamCop -- and why you shouldn't depend on RBL's to be
the sole determining factor in deciding to reject a connection).

For the forged headers, there are other ways to figure out if a
message is trustworthy or not. Sometimes it pretty damned obvious
(e.g. the Messge-ID will contain my domain after the "@", or the
"Received:" header will contain my domain but not any of my IP
addresses in that header).

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/17/2006 4:08:36 PM
"Karl Lager" <KarlLager@spam.freemail.de> wrote:

					[ snip ]

>LOL - very true. Thats another reason why I am fed up with sorting/reviewing 
>SPAM in Junk Folder. To be honest that doesnt save work/money. Maybe it 
>costs even more because my user now have to monnitor the inbox AND the 
>SPAM/JUNK MAIL for false positives.

If you have an inaccurate spam filter, that's very true. An
interesting fact: a good spam filter is more accurate than a human at
detecting spam.

If you doubt that, try classifying someone else's mail as spam or ham.
Then ask the spam filter. Then ask the recipient. :-)

The false-positive rate for the spam filter will be smaller, and more
consistent, than the human's. Oh -- just be sure to make the sample
size large enough to be meaningful, and do the test on mail that
hasn't been passed through any spam filters yet.

FWIW, there's no reason why you have to put mail into a separate
folder becasue you think it's spam. Just mark the subject line with
the filter's judgement. If the user want's to put everything marked as
**SPAM** into another folder, that's their call.

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/17/2006 4:49:17 PM
"Karl Lager" <KarlLager@spam.freemail.de> wrote:

					[ snip ]

>> Why? Do you consider all mail that arrives from an IP address found in
>> some RBL that thinks it's a dynamicly assigned IP address? Tat's no
>> blocking spam, it's blocking connections.
>
>Because the percentage of ISP IPs listed in RBL lists is quite high. As I
>said in my sample. Even if a user sends me an email via webmail (yahoo, gmx 
>etc) GFI
>will block it since the webmail enters the users IP as received from and GFI 
>checks that IP against RBL.
>So using a safe relay doesnt help to get the mail pass the RBL filter.

So, given that you have no choice in how deep the RBL checking should
go, why include RBL's that list dial-up and dynamic-IP addresses?
Surely the RBL's that the product uses is configurable by you?

					[ snip ]

>Thanks a lot Rich for you help.
>I will give it a last try to convience them that their RBL is not 
>implemented correct. Otherwise I will have to start evaluating proper RBL 
>products. Do
>you have any suggestions? Greylisting would be cool as well.

VamSoft's ORM (http://www.vamsoft.com/orf) is relatively inexpensive.
IIRC, they have a 30-day trial period, too. If nothing else, you can
add ORF to the set of protocl and event sinks and tell GFI to NOT
check RBL's.

I don't know what else GFI does. If it does any sort of Bayesian
analysis on the message contents I'd leave that enabled. If they
supply vetted dictionaries of words/phrases I'd leave those in
operation too -- especially if they're periodically updated by the
vendor.

Oh -- another thing that ORF will do is check the URL's found n the
message body against the SURBL list of spam URL's. Besides doint the
greylisting, this is pretty effective, too.

If you're looking for a really good product you won't find one for
notheing, nor will you find one that doesn't cost a good deal of
money. E.g. Ciphertrust's IronMail (http://www.ciphertrust.com). For a
small company the cost may be too much. But if you're looking to do
something for your clients, maybe you can look into acting as a spam
filter for them and then send the mail on to their MTA's (kind of like
a small-scale Postini).

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/17/2006 5:34:00 PM
This is a multi-part message in MIME format.

------=_NextPart_000_0007_01C6DACD.C3A55120
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear Karl,

ONLY the connecting IP should be checked against RBL lists. Besides the =
fact that all other IPs of the header can be forged it would create to =
many false positives to check all IPs of the header. You should also =
consider that as soon a connecting IP is found in any RBL list the MTA =
should drop the connection with the reason why its dropping the =
connection. Like that the sender would get the information that he is =
listed in a RBL list.

Just consider the following case. User A sends an email via B to C. The =
IP of user A is listed for some reason in one of the RBL lists. Since B =
is a secure relay it would not make sense to block A. On the other hand =
B must alwasy be blocked if its well known for relaying SPAM or allowing =
users to SPAM. That would force Bs admin to get his act done.

I read =
http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklists/m_900=
736438/tm.htm and really had a good laugh. NickS of GFI is saying that =
it is ok that virtually all mails are blocked by RBL because they have =
whitelisting. I am really asking myself why they go into the hassle of =
developing filters. Why dont they simply block everything except =
whitelisted. Their product would become much more performant.=20

A really good compromise of rejecting, sorting etc is being carried out =
by ex2003s IMF. If you have the budget to upgrade - I would do it If you =
have time to wait I would wait for the new ex12. Its antispam and AV =
capabilities are par excellance!

Good Luck!
Andreas


"Karl Lager" <KarlLager@spam.freemail.de> schrieb im Newsbeitrag =
news:eZQ5Vsc2GHA.3428@TK2MSFTNGP05.phx.gbl...
> Hi guys,
>=20
> I hope somebody has an answer since I run out of them :-)
>=20
>=20
> Basically I am using GFI MailEssentials to protect my MTA against =
SPAM. As
> soon I activate GFIs RBL Module it blocks virtually all inbound =
emails.
>=20
> First I researched my DNS settings. They are definetly ALL OK.
>=20
> Then I investigated the mail headers and IPs and found out that GFI
> Mailessentials basically checks EVERY IP of the mailheader against RBL
> lists. Of course ALL emails which have been sent somehow from a home =
network
> will be blocked. I always thought that RBL Filter should check the IPs =
of
> the relaying MTA and NOT the origin of the mail.
>=20
> I hope I was clear what I mean. So for example user X sends an email =
via
> gmx.de (german webmailer). Since gmx writes the IP of the User X as =
received
> from into the header GFIs RBL will block it - even though GMX is a =
clean an
> reputable system.
>=20
> I tried to contact GFIs support but never got an answer. I posted this =
in
> their forum and it got deleted (which makes me think I am right).
>=20
> There is a similar thread in the GFI Forum on=20
> =
http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklists/m_900=
736438/tm.htm
> I posted to that one as well - and got deleted!
>=20
> Can anybody explain me please which IPs of the header should be =
checked
> against RBL lists?
>=20
> Thanks a lot
> Karl!
>=20
>
------=_NextPart_000_0007_01C6DACD.C3A55120
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.3790.2759" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><FONT face=3DArial>Dear Karl,</FONT></DIV>
<DIV><FONT face=3DArial></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial>ONLY the connecting IP should be checked against =
RBL=20
lists. Besides the fact that all other IPs of the header can be forged =
it would=20
create to many false positives to check all IPs of the header. You =
should also=20
consider that as soon a connecting IP is found in any RBL list the MTA =
should=20
drop the connection with the reason why its dropping the connection. =
Like that=20
the sender would get the information that he is listed in a RBL=20
list.</FONT></DIV>
<DIV><FONT face=3DArial></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial>Just consider the following case. User A sends =
an email=20
via B to C. The IP of user A is listed for some reason in one of the RBL =
lists.=20
Since B is a secure relay it would not make sense to block A. On the =
other hand=20
B must alwasy be blocked if its well known for relaying SPAM or allowing =
users=20
to SPAM. That would force Bs admin to get his act done.</FONT></DIV>
<DIV><FONT face=3DArial></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial>I read </FONT><A=20
href=3D"http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklis=
ts/m_900736438/tm.htm"><FONT=20
face=3DArial>http://forums.gfi.com/Checking_ALL_IPs_in_header_against_bla=
cklists/m_900736438/tm.htm</FONT></A><FONT=20
face=3DArial>&nbsp;and really had a good laugh. NickS of GFI is saying =
that it is=20
ok that virtually all mails are blocked by RBL because they have =
whitelisting. I=20
am really asking myself why they go into the hassle of developing =
filters. Why=20
dont they simply block everything except whitelisted. Their product =
would become=20
much more performant. </FONT></DIV>
<DIV><FONT face=3DArial></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial>A really good compromise of rejecting, sorting =
etc is=20
being carried out by ex2003s IMF. If you have the budget to upgrade - I =
would do=20
it If you have time to wait I would wait for the new ex12. Its antispam =
and AV=20
capabilities are par excellance!</FONT></DIV>
<DIV><FONT face=3DArial></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial>Good Luck!</FONT></DIV>
<DIV><FONT face=3DArial>Andreas</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>"Karl Lager" &lt;</FONT><A=20
href=3D"mailto:KarlLager@spam.freemail.de"><FONT face=3DArial=20
size=3D2>KarlLager@spam.freemail.de</FONT></A><FONT face=3DArial =
size=3D2>&gt; schrieb=20
im Newsbeitrag </FONT><A =
href=3D"news:eZQ5Vsc2GHA.3428@TK2MSFTNGP05.phx.gbl"><FONT=20
face=3DArial =
size=3D2>news:eZQ5Vsc2GHA.3428@TK2MSFTNGP05.phx.gbl</FONT></A><FONT=20
face=3DArial size=3D2>...</FONT></DIV><FONT face=3DArial size=3D2>&gt; =
Hi guys,<BR>&gt;=20
<BR>&gt; I hope somebody has an answer since I run out of them =
:-)<BR>&gt;=20
<BR>&gt; <BR>&gt; Basically I am using GFI MailEssentials to protect my =
MTA=20
against SPAM. As<BR>&gt; soon I activate GFIs RBL Module it blocks =
virtually all=20
inbound emails.<BR>&gt; <BR>&gt; First I researched my DNS settings. =
They are=20
definetly ALL OK.<BR>&gt; <BR>&gt; Then I investigated the mail headers =
and IPs=20
and found out that GFI<BR>&gt; Mailessentials basically checks EVERY IP =
of the=20
mailheader against RBL<BR>&gt; lists. Of course ALL emails which have =
been sent=20
somehow from a home network<BR>&gt; will be blocked. I always thought =
that RBL=20
Filter should check the IPs of<BR>&gt; the relaying MTA and NOT the =
origin of=20
the mail.<BR>&gt; <BR>&gt; I hope I was clear what I mean. So for =
example user X=20
sends an email via<BR>&gt; gmx.de (german webmailer). Since gmx writes =
the IP of=20
the User X as received<BR>&gt; from into the header GFIs RBL will block =
it -=20
even though GMX is a clean an<BR>&gt; reputable system.<BR>&gt; <BR>&gt; =
I tried=20
to contact GFIs support but never got an answer. I posted this =
in<BR>&gt; their=20
forum and it got deleted (which makes me think I am right).<BR>&gt; =
<BR>&gt;=20
There is a similar thread in the GFI Forum on <BR>&gt; </FONT><A=20
href=3D"http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklis=
ts/m_900736438/tm.htm"><FONT=20
face=3DArial=20
size=3D2>http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blackli=
sts/m_900736438/tm.htm</FONT></A><BR><FONT=20
face=3DArial size=3D2>&gt; I posted to that one as well - and got =
deleted!<BR>&gt;=20
<BR>&gt; Can anybody explain me please which IPs of the header should be =

checked<BR>&gt; against RBL lists?<BR>&gt; <BR>&gt; Thanks a lot<BR>&gt; =

Karl!<BR>&gt; <BR>&gt;</FONT></BODY></HTML>

------=_NextPart_000_0007_01C6DACD.C3A55120--

0
aouhr (1)
9/18/2006 12:54:20 AM
In article <uACbv0r2GHA.480@TK2MSFTNGP06.phx.gbl>, 
aouhr@googlemail.spam.com says...
> I read http://forums.gfi.com/Checking_ALL_IPs_in_header_against_blacklists/m_900736438/tm.htm and really had a good laugh. NickS of GFI is saying that it is ok that virtually all mails are blocked by RBL because they have whitelisting. I am really asking myself why they go into the hassle of developing filters. Why dont they simply block everything except whitelisted. Their product would become much more performant. 

I use GFI, but I use a their entire set of rules and few white-list 
items. In general after about 30 days, we find only 1 or 2 email per 
day, out of 4,000+ seem to not be detected properly (they miss a few 
spam as the spammers change things, but in another day it's caught).

As for RBL's, I would have to say that while using the good lists, we 
reject almost 65% of all inbound email without any false detections.

I've used many solutions, and IMF/Outlook Junk is reasonably good, but 
GFI catches all the crap that IMF doesn't.

-- 

spam999free@rrohio.com
remove 999 in order to email me
0
void (121)
9/18/2006 1:39:52 AM
"Andreas Oberuhr" <aouhr@googlemail.spam.com> wrote:

>ONLY the connecting IP should be checked against RBL lists. Besides the fact that all other IPs of the header can be forged it would create to many false positives to check all IPs of the header. You should also consider that as soon a connecting IP is found in any RBL list the MTA should drop the connection with the reason why its dropping the connection. 

Why drop the connection? Is the source of the message spam or is the
contents of the message spam? If you want to consider the presence of
the sending IP address a contributing factor in your determination of
a message's spamminess, that's fair. But consider that there are many
IP addresses that are used by more than one domain and to consider all
messages sent by that IP address to be unworthy of delivery regardless
of their content is, well, wrong.

>Like that the sender would get the information that he is listed in a RBL list.

And the sender, if they don't own that IP address, will do what?

>Just consider the following case. User A sends an email via B to C. The IP of user A is listed for some reason in one of the RBL lists. Since B is a secure relay it would not make sense to block A. 

Or B, for that matter.

>On the other hand B must alwasy be blocked if its well known for relaying SPAM or allowing users to SPAM. 

And what about your poor customer "A"? He can no longer communicate
with you using e-mail from his ISP "B", even if "A"s mail is entirely
innocent.

>That would force Bs admin to get his act done.

Or not.


-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/18/2006 2:55:52 AM
Leythos <void@nowhere.lan> wrote:

					[ snip ]

>As for RBL's, I would have to say that while using the good lists, we 
>reject almost 65% of all inbound email without any false detections.

If you never get a chance to examine the message how do you know that
you didn't reject a message that wasn't spam? It's hard to measure the
FP rate unless you know what the message contains.

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/18/2006 2:58:58 AM
In article <nn2sg2lvsugfnvoa1si4rutvtkmo0q8f3f@4ax.com>, 
richnews@rmcons.com.NOSPAM.COM says...
> Leythos <void@nowhere.lan> wrote:
> 
> 					[ snip ]
> 
> >As for RBL's, I would have to say that while using the good lists, we 
> >reject almost 65% of all inbound email without any false detections.
> 
> If you never get a chance to examine the message how do you know that
> you didn't reject a message that wasn't spam? It's hard to measure the
> FP rate unless you know what the message contains.

Because I can see them when they hit the firewall and know what IP's 
messages should be entering from and what IP's should be 
blocked/rejected generally. We also don't have any reports of missing 
messages from any client/customer.

-- 

spam999free@rrohio.com
remove 999 in order to email me
0
void (121)
9/18/2006 10:14:35 AM
Leythos <void@nowhere.lan> wrote:

					[ snip ]

>Because I can see them when they hit the firewall and know what IP's 
>messages should be entering from and what IP's should be 
>blocked/rejected generally. 

Small system? :-)

>We also don't have any reports of missing 
>messages from any client/customer.

And certainly none from potential clients or customers! Or
newsletters, professional organizations, etc.

It's your system. You run it the way you want to. I think you're doing
yourself a disservice, though.


-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/19/2006 12:19:57 AM
We flat out don't accept email from the internet with our domain as the 
from. Of course explaining that to our users has been a pain. And some of 
our vendors are flat out clueless (or lazy)[1] and don't code their 
applications to not send as me.

[1] I vote lazy.

"Rich Matheisen [MVP]" <richnews@rmcons.com.NOSPAM.COM> wrote in message 
news:casqg2tqlpkqp9jpl4nra631cojtsackh0@4ax.com...
> "Karl Lager" <KarlLager@spam.freemail.de> wrote:
>
>>Hi Rich,
>>
>>> Only if the server doing the checking isn't the "first hop" in from
>>> the Internet.
>>
>>Well, except some newsletters most emails coming in directly (without any
>>relay involved) are usually SPAM.
>
> I'm not sure what relevance that has. I was talking about *your*
> server (the one that's checking the RBL) being the "first hop" in, not
> theirs. :-)
>
> I do agree with what you say, though. Zombie networks will fall into
> that category.
>
> I really don't care about any address other than the one that sent me
> the message. The other addresses are easily forged and are, very
> often, meaningless (those are the ones that cause me to get "spam"
> reports from SpamCop -- and why you shouldn't depend on RBL's to be
> the sole determining factor in deciding to reject a connection).
>
> For the forged headers, there are other ways to figure out if a
> message is trustworthy or not. Sometimes it pretty damned obvious
> (e.g. the Messge-ID will contain my domain after the "@", or the
> "Received:" header will contain my domain but not any of my IP
> addresses in that header).
>
> -- 
> Rich Matheisen
> MCSE+I, Exchange MVP
> MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
> Don't send mail to this address mailto:h.pott@getronics.com
> Or to these, either: mailto:h.pott@pinkroccade.com 
> mailto:melvin.mcphucknuckle@getronics.com 
> mailto:melvin.mcphucknuckle@pinkroccade.com 


0
9/19/2006 3:02:21 AM
"Jim Schwartz" <shamusnc@not.earthlink.net> wrote:

>We flat out don't accept email from the internet with our domain as the 
>from. Of course explaining that to our users has been a pain. And some of 
>our vendors are flat out clueless (or lazy)[1] and don't code their 
>applications to not send as me.
>
>[1] I vote lazy.

Well, I'd say that you're wrong to use only the "From:" header to make
that determinaton.

These, for example, are a valid combinations:
	From: abc@xyx.xom
	Sender: ddd@vvv.org

	From: abc@xyx.xom
	Resent-Sender: ddd@vvv.org

	From: abc@xyx.xom
	Resent-From: ddd@vvv.org

Not to pick on any one company, but Cisco falls into the category of
clueless with headers like this:

	From: me@mydomain.com
	To:   me@mydomain.com

So do many of the web-based e-mail applications.

-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@getronics.com
Or to these, either: mailto:h.pott@pinkroccade.com mailto:melvin.mcphucknuckle@getronics.com mailto:melvin.mcphucknuckle@pinkroccade.com
0
richnews (7316)
9/20/2006 12:36:13 AM
Reply:

Similar Artilces:

rbl #2
Hi, which RBLs are more effect? please advise. I noticed recent some used to work fine, and not working any more.... thanks al -- Hello wtk, I use three RBL in Connection Filtering, bellow I list it a.. smtp.dnsbl.sorbs.net (www.sorbs.net) a.. relays.ordb.org (www.ordb.org) a.. sbl-xbl.spamhaus.org (www.spamhaus.org) -- Best Regards, Anderson Patricio "wtk" <wtk@discussions.microsoft.com> wrote in message news:4851FAA5-1608-445E-90DB-376ABAF04E84@microsoft.com... > Hi, > > which RBLs are more effect? please advise. I noticed recent some used to >...

Table relationships
I've created a database with about 15 tables for a participant data in a research study. Each participant will complete the 15 assessment measures. My ultimate goal is to create a data entry system whereby a research assistant can pull up a form and enter an ID number, plus the answers to the 15 assessment measures. I know I can create a query to combine all the tables, but it seems like the research assistant would have to enter the id and date 15 times (once for each table pulled in to the query). Is there a way to just enter the ID number one time and have it apply t...

pics printing in wrong place
Does anyone know why my pictures print in the wrong place? I have several pics from the same source in my publication, however, some of them print correctly and others don't. I've noticed that the ones printing incorrectly are all going to the upper left hand corner of the page. I'm very new at using Publisher and suspect that my problem may be my print driver,in which case, i'm clueless as to how to fix it. I'm using publisher 2002 and a KYOCERA-MITA 4030 printer. Hi terracotta (terracotta@discussions.microsoft.com), in the newsgroups you posted: || Does anyone kno...

Wrong Password on Backup File
I switched computers and saved my backup on a removeable hard drive. I attempted to restore my backup file on my newly installed Money 2004 program on a new computer and when it asks for my password, I enter it and it says I have the wrong one. I am CERTAIN that this is the password and don't know why it's saying it's the wrong one. Is there anyway to get the information from the file or bypass the password? Or do I have to find out all my information all over again? In microsoft.public.money, Phu wrote: >I switched computers and saved my backup on a removeable hard ...

Whats wrong with this?
=IF('M ORQ Rec'!B2=0,0,IF('M ORQ Rec'!B2>=12,20,IF('M ORQ Rec'!B2>=10,18,IF('M ORQ Rec'!B2>=7,16,IF('M ORQ Rec'!B2<=6,15,"N"))))) I want it to display N if there is text in B2, but it always shows 20 instead. Thanks -- LucasBuck ------------------------------------------------------------------------ LucasBuck's Profile: http://www.excelforum.com/member.php?action=getinfo&userid=19710 View this thread: http://www.excelforum.com/showthread.php?threadid=500793 Try this: =IF(ISTEXT(B2),"N",IF(B2=0,0,IF(B2>=...

How to setup just internal mailing
Hi! I need your help. I'm using Exchange 2003 and i want to some users or groups cant send or recieve mail by another domains. How can i setup to internal mailing for a group or an user. Thanks On 5 Mar 2007 00:29:48 -0800, emir.kuzeyli@gmail.com wrote: >Hi! >I need your help. I'm using Exchange 2003 and i want to some users or >groups cant send or recieve mail by another domains. >How can i setup to internal mailing for a group or an user. > >Thanks http://www.msexchange.org/tutorials/MF025.html "Restricting users from Sending and Receiving Internet Mail in...

Connection Filtering with RBL's
Ok first let me setup my situation. Over the last year i just finished,a study to watch the spam levels increase over the year. Back in January 2006 i installed the IMF Filter and just this past month i applied all the updates. I need to know the following questions. 1-How can I see what version of Excahnge with all its service packs? 2-In reference to MS article ID: 823866 How to configure Block lists they say you need to make usre that patch are updated because if aplying the filtering process may your exchange server may stop responding. 3-How can i easy setup a solution to block e-m...

MS Excel Office 2007 Percent Chart is WRONG
On a line chart, the plots are all about 30 points lower than what is shown in the data source. The source is a percent chart. Please advise. Post back with a sample of data pasted into your response (text only, no attachments). What version of Excel? - Jon ------- Jon Peltier, Microsoft Excel MVP Tutorials and Custom Solutions Peltier Technical Services, Inc. - http://PeltierTech.com _______ "DOUG ECKERT" <DOUGECKERT@discussions.microsoft.com> wrote in message news:71BCF416-8013-4340-91F0-735DEE1E0491@microsoft.com... > On a line chart, the plots are all about 30 p...

Text box that contains a range of cells not just one.
I am trying to create a text box in a chart that contains a range of cells. I ahve seen this on a chart but cannot don't understand how it was done. Every time I try I can only enter one cell. Hi, You can only link to one cell so you need to concatenate the cells in another cell and then link to that. Cheers Andy Chili Don wrote: > I am trying to create a text box in a chart that contains a range of cells. > I ahve seen this on a chart but cannot don't understand how it was done. > Every time I try I can only enter one cell. -- Andy Pope, Microsoft MVP - Exce...

RBL
What does this mean? Am I blacklisted. Where do I need to go to be removed. You do not have permission to send to this recipient. For assistance, contact your system administrator. <mail.handsonatlanta.org #5.7.1 smtp;554 5.7.1 This message has been blocked because it is from a RBL/ORDBL IP address.> I got this one as well when I sent an e-mail to Microsoft. You do not have permission to send to this recipient. For assistance, contact your system administrator. <mail.handsonatlanta.org #5.7.1 smtp;550 5.7.1 Email rejected because 207.203.175.195 is listed by cbl.abu...

Something may be wrong with my Ram,motherboard,hard drive or whatnot? Help me =[
Alright when i start up my laptop it goes into the HP invent screen and shows the F keys at the bottom. Than after a little bit it goes onto the screen that has the blinking underscore (the blinking _ sign" than it just stays there... It makes these loud beeping noises than stops after a little bit. I don't know what to do and I REALLY don't want to take it to a professional for reasons i don't wish to say. Edit: I don't think that I have my system restore CD's as well, and I would love to keep my files. -- Aizen Also double kudos if someone ...

Parameter Query-enter just once for use in multiple places
I have an Excel spreadsheet where I have multiple places I am searching for an amount within a range of dates. When asked what the check date is, I only want the user to have to answer the question once, when the parameter box pops up. Then this answer would be carried forward to the various criteria. Right now, the box pops up seven times, where you have to put the same check date over and over again. Anyone know how to accomplish this? -- JR more info? -- Don Guillett SalesAid Software donaldb@281.com "jrenzul" <jrenzul@discussions.microsoft.com> wrote in message ne...

I just earn $200 from Free Munny
Just sigup with this link : http://www.freemunny.com/signup.php?ref=mohazlan Complete 100 offer after register Simple! You can sign up and complete offers. We have a bunch of them. Our most popular offers are things like surveys, free trials, and credit card offers where we reward you you make more than you spend, or just try a product or service. More on the offers later. Then, you "withdraw" your balance to get paid by the next payday! Minimum cashout $2.00 to your paypal account. http://www.freemunny.com/signup.php?ref=mohazlan ...

Re: Downloaded transactions wrong
Downloading transactions from the bank and they posted in Microsof Money 2004 as being from the wrong merchant (i.e.: really Walmart bu shows from a local lawnmower shop that we've dealt with recently an vice versa). All amounts are right just wrong payee per transaction. Also, several days ago all cash withdrawls using an ATM card at th bank's ATM showed as being from Sears. I know the obvious is that it must be the bank but when viewing th transactions online using the bank's website the data is correct. Thanks in advance for any help. Mik - dmbisho ----------------------...

Exchange 2003 Connection Filtering & RBL not working
I have added blocklists from spamhaus,spamcop, etc on my exchange 2003 server. I have followed ALL of the instructions and have confirmed that the default virtual smtp server is configured to apply connection filtering. I am running performance counters to monitor its effectiveness. It is not reporting any connections rejected by blocklist providers and it is not even showing any blocklist DNS queries issued. Can anyone explain what I am missing? According to the performance counters, it is not even trying to do a lookup. There is no noticeable reduction in spam and the smtp logs s...

Error message: Just-In-Time Debugger.
I have a program that sometimes crashes. When it does, an error message appears that is titled: "Visual Studio Just-In-Time Debugger". The error says that there is no installed just in time debugger installed. Is there a way to stop this message from appearing? I'd prefer if the program just terminated. > I have a program that sometimes crashes. When it does, an error message > appears that is titled: "Visual Studio Just-In-Time Debugger". The error > says that there is no installed just in time debugger installed. > > Is there a way to stop this...

Wrong insertion of national holy days in outlook 2000
Can anyone tell me why insertion of national holy days (Easter, christmas, nationalday etc..) inserts itself in 2003(!) when we now try to update our calenders? It is now "double" for 2003 and nothing to see for 2004.. We use norwegian outlook 2000 (and exchange 2000) Lars Hansson Inst. of transport economics, Oslo ...

Do you backup the entire HQ server or just the Database?
I'm looking to finally do some long awaited preventitive maintenance on our RMS setup. We have a server running HQ here at the office. I was thinking of going for an external hard drive solution + flash drive backup. Should you backup the entire computer or is it more feasible to backup just the database file? Any reccomendations on software or a manual way of doing it in Windows 2000 server? I ran a search and found a useful batch file for use in task scheduler to just backup the database at timed intervals. However I would like some ideas or thoughts on a more comprehensive backup...

What is wrong with updating securities?
WHAT IS WRONG WITH THE UPDATE SECURITIES FUNCTION? Almost every day it hangs at least once - you click on update, and it says updating securities, and it just sits there forever. I've let it sit 1/2 hour or more and it still didn't come back. End up having to kill it via Task Manager and then start over again. And then usually it will download without a problem!! This occured occasionally in Money 2003, but in 2004 it is 10x worse! I don't know if having to kill money via task manager will screw up my money data file in the long run, but it is getting really aggrevating. Makes...

OFX downloading into wrong account / Disabling online banking
When I download an OFX file from my financial institution for a specific checking account the transactions in the OFX file are automatically posted to another credit card account I have set up in Money 2007 under the same FI as the checking account. I have tried to disassociate the FI and the account by going to the account setting of the credit card account and removing the FI from the list but it gives me the message "a bank name must be specified for on-line enabled accounts" How do I disable this account from on- line access and get the OFX to dowload to the correct account? ...

wrong logo for Smith Barney
Does anyone know why Smith Barney has a logo for Vista National Credit Union? Look at: http://www.microsoft.com/money/bankonline.aspx?FirstLetter=S&FinananceOrganisationType=BanksOnly#108 Donald S. Goldman wrote: > Does anyone know why Smith Barney has a logo for Vista National Credit > Union? > > Look at: > > http://www.microsoft.com/money/bankonline.aspx?FirstLetter=S&FinananceOrganisationType=BanksOnly#108 > It is now fixed ...

when I rename outcmd.dat to .old, do I type outcmd.old or just rename to .old
I was given these directions and I am just clarifying: Close Outlook. Find and rename outcmd.dat to .old. (If using Windows 2000 or XP, you will need to enable searching hidden and system folders.) Once you have done so, reopen Outlook and it should open fine. You will need to rebuild any custom toolbars or customizations as the file outcmd.dat controls how the toolbars display. When it becomes corrupted, it will cause Outlook to hang because it cannot create the toolbars that you expect. bob <bob@donotspam> wrote: > I was given these directions and I am just clarifying: >...

Whats wrong with this formula?????
First of all, I want to thank you guys, you are great!! I have this formula in a cel, and as soon as I add the last line, it comes up saying my formula has an error. =IF(AND(C3=0,C11=1),C7+(I7*2), IF(AND(C3=1,C11=1),L2+(I7*2), IF(AND(C3=0,C11=2),C7+(I7*2), IF(AND(C3=2,C11=2),L2+(I7*2), IF(AND(C3=0,C11=4),C7+(I7*2), IF(AND(C3=4,C11=4),L2*2+(I7*2), IF(AND(C3=0,C11=44),C7+(I7*2), IF(AND(C3=44,C11=44),c7+(i7*2)))))))) am I past the amount of formulas, or characters I am allowed to use? Jen You have exceeded the maximum number of nested IF functions, 7. Plus I think you have more arguments t...

Receiving OE email in wrong box
Some of the emails I receive come in in the Deleted folder and not the Inbox folder. How can I fix this so all of the new emails arrive in the Inbox? "Sam" <anonymous@discussions.microsoft.com> wrote in message news:ad9201c3ec33$75a41280$a301280a@phx.gbl... > Some of the emails I receive come in in the Deleted folder > and not the Inbox folder. How can I fix this so all of > the new emails arrive in the Inbox? Check your rules. This newsgroup is for support of Outlook 97/98/2000/2002/2003 from the Office suite of products. Outlook Express is actually a separate...

How can I just count the records where the check boxes are "No"
I have a audit form and when something is not completed then it is not checked. I need to have a total at the end of each item to count how many records are out of compliance. Please HELP need by this afternoon Julie Gilliam <Julie Gilliam@discussions.microsoft.com> wrote: >I have a audit form and when something is not completed then it is not >checked. I need to have a total at the end of each item to count how many >records are out of compliance. Use a text box with an expression like any of: =Count(IIf([check field], Null, 0)) or =Sum(IIf([check field...