Spam Filter ISP Forums : Wish List https://www.logsat.com/spamfilter/forums/ Mon, 09 Mar 2026 02:31:18 +0000 Tue, 21 Jun 2005 09:59:18 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5219 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Wish List : I vote for option #2 below....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6116&title=wish-list#6116 Author: Guests
Subject: 5219
Posted: 21 June 2005 at 9:59am

I vote for option #2 below.  We already do this with our user'smail clients.  We have them all set to a non-standard SMTP portthat bypasses our spamfilter and goes straight to our mailserver.  Then we don't trust nothing that hits on SMTP 25 thatclaims to be from a domain that we are hosting because we already knowevery legitimate user should be using our proprietary SMTP port. Puts a brick wall up on all those new worms out there and allows us touse a single public IP for both mail server and spamfilter.  Wewere using this method long before SPF came about and it's actually alittle more effective on our own domains, as we don't trust anythingbeing relayed out on port 25 from our own domains...even from IP'sauthorized in our SPF records.

Guess we can look at setting up a backup SMTP server to do the samething by bypassing our in-house filter and just filter from the remotebackup server.

Originally posted by LogSat LogSat wrote:

Marco,

Just posted the following to the other thread at http://logsat.com/spamfilter/forums/forum_posts.asp?TID=5217 #6068

=============

SpamFilter should really see the original IP of the sender whenprocesing emails. If SpamFilter handles emails that are being relayedby a "friendly" server, then things are bound to go wrong, not justwith the honeypot file. Think about the SPF filter for example... Ifthe IP of the server connecting to SpamFilter is not listed in the SPFDNS record of the sender, the email will be rejected. And if yoursecondary is forwarding emails to SpamFilter, that *will* cause a bigissue.

The mains solutions that come to mind are to:
(1) place SpamFilter (or any other antispam software) in front of all the servers listed as MX records,
or (2) forward the email from the secondaries directly to your main SMTP server, bypassing the main spam filter.
or (3) install a second SpamFilter on a separate IP or separate server,configure it skip ALL IP-based tests (reverse-DNS, country, SPF,MAPS-RBL, IP blacklists, MX checks etc.), and have the secondaryforward emails to this lesser-featured SpamFilter.

]]> Tue, 21 Jun 2005 09:59:18 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6116&title=wish-list#6116 <![CDATA[Wish List : Iam because my sister a girl. ]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6103&title=wish-list#6103 Author: Guests
Subject: 5219
Posted: 19 June 2005 at 9:44pm

Iam  because my sister  a girl.

]]> Sun, 19 Jun 2005 21:44:12 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6103&title=wish-list#6103 <![CDATA[Wish List : Marco, Just posted the following...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6069&title=wish-list#6069 Author: LogSat
Subject: 5219
Posted: 13 June 2005 at 7:24pm

Marco,

Just posted the following to the other thread at http://logsat.com/spamfilter/forums/forum_posts.asp?TID=5217 #6068

=============

SpamFilter should really see the original IP of the sender whenprocesing emails. If SpamFilter handles emails that are being relayedby a "friendly" server, then things are bound to go wrong, not justwith the honeypot file. Think about the SPF filter for example... Ifthe IP of the server connecting to SpamFilter is not listed in the SPFDNS record of the sender, the email will be rejected. And if yoursecondary is forwarding emails to SpamFilter, that *will* cause a bigissue.

The mains solutions that come to mind are to:
(1) place SpamFilter (or any other antispam software) in front of all the servers listed as MX records,
or (2) forward the email from the secondaries directly to your main SMTP server, bypassing the main spam filter.
or (3) install a second SpamFilter on a separate IP or separate server,configure it skip ALL IP-based tests (reverse-DNS, country, SPF,MAPS-RBL, IP blacklists, MX checks etc.), and have the secondaryforward emails to this lesser-featured SpamFilter.

]]> Mon, 13 Jun 2005 19:24:59 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6069&title=wish-list#6069 <![CDATA[Wish List : in case the honeypot is triggered,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6063&title=wish-list#6063 Author: Marco
Subject: 5219
Posted: 13 June 2005 at 11:02am

in case the honeypot is triggered, compare the originating ip with the ones in the (to be added) 'relay ip list' and if matched, drop the mail, but DO NOT blacklist the relay's ip.]]> Mon, 13 Jun 2005 11:02:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6063&title=wish-list#6063 <![CDATA[Wish List : Actually the only problem we have...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6058&title=wish-list#6058 Author: kspare
Subject: 5219
Posted: 13 June 2005 at 9:40am

Actually the only problem we have is with the honey pot, I just need to be able to tell the honey pot not to block that ip and it would work fine. I used it as it sits for awhile until I turned on the honey pot, that's where my problems started

]]> Mon, 13 Jun 2005 09:40:41 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6058&title=wish-list#6058 <![CDATA[Wish List : Kevin, No sleep and burned...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6054&title=wish-list#6054 Author: Desperado
Subject: 5219
Posted: 13 June 2005 at 7:42am

Kevin,

No sleep and burned out.  Can you re-word your above post?

Offsite or backup SMTP is always going to be a trade off irregardless of the software.  We do backup smtp for many customers using a simple queuing server and many of the customers primary servers are Spam Filtering appliances.  Their server must "Trust" our server and as such they loose any benefits of filtering on the connection IP address such as rdns, dnsbl's and so on.  SOME, but not all of their servers can still filter on keywords even if the IP is White Listed but that has only a small value so they live with it.

I think that one solution to this issue (which may not be very easy ... not knowing the internals of the SpamFilter software) would be to have an IP Whitelist, just like now and an IP relay list which would allow the backup to connect and instruct the SpamFilter to attempt to look at the IP that originally connected to the backup server.  I fear that this would cause some significant overhead though.

Regards,

]]> Mon, 13 Jun 2005 07:42:17 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6054&title=wish-list#6054 <![CDATA[Wish List : We had the same problem too, just...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6049&title=wish-list#6049 Author: kspare
Subject: 5219
Posted: 13 June 2005 at 2:32am

We had the same problem too, just doubled our a/c capacity.

Roberto, any way you can setup the honeypot so we can whitelist ips to not be affected by it?

My offsite spamfilter is forwarding mail on and somehow the honey pot is seeing email address's that the offsite found in the honey pot, tagged the subject line, but is still found my the honey pot and blocked.

PLEASE! I can't use my offsite mx anymore

]]> Mon, 13 Jun 2005 02:32:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6049&title=wish-list#6049 <![CDATA[Wish List : Roberto, Thanks ... and if I...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6047&title=wish-list#6047 Author: Desperado
Subject: 5219
Posted: 12 June 2005 at 2:52pm

Roberto,

Thanks ... and if I have not said so recently ... you are the King!.

Now ... can you fix my friggin air handling system?  I had to run into work to resopnd to an over temp alarm.  97 degrees in our server room.  Not good!

Regards,

]]> Sun, 12 Jun 2005 14:52:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6047&title=wish-list#6047 <![CDATA[Wish List : More than a &#034;wish&#034; that...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6045&title=wish-list#6045 Author: LogSat
Subject: 5219
Posted: 12 June 2005 at 2:46pm

More than a "wish" that should be considered a bug, jacksun is correct.

We'll be uploading a new build with the fix within the next few hours.
]]> Sun, 12 Jun 2005 14:46:52 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6045&title=wish-list#6045 <![CDATA[Wish List : I agree, case should never be...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6041&title=wish-list#6041 Author: jacksun
Subject: 5219
Posted: 12 June 2005 at 2:08pm

I agree, case should never be a consideration WRT email.
 
Great Idea Dan.
 
Cheers,
Wayne
]]> Sun, 12 Jun 2005 14:08:55 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5219&PID=6041&title=wish-list#6041