Spam Filter ISP Forums : Quarantine and multiple recipeitrecipient https://www.logsat.com/spamfilter/forums/ Tue, 10 Mar 2026 18:38:29 +0000 Fri, 11 Aug 2006 04:25:37 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5724 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Quarantine and multiple recipeitrecipient : True, however I would guess that...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8702&title=quarantine-and-multiple-recipeitrecipient#8702 Author: StevenJohns
Subject: 5724
Posted: 11 August 2006 at 4:25am

True, however I would guess that in 99% of your installations, SF is running on the same box as the POP3 server and simply hands the enail to a simple smtp server which doesn't do much apart from dropping the email into the mailbox.

So, the question of which process splits the email becomes fairly irrelevant. Is it SF, the intermediate SMTP server, the MTA....all of which may well run on the same box.

]]> Fri, 11 Aug 2006 04:25:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8702&title=quarantine-and-multiple-recipeitrecipient#8702 <![CDATA[Quarantine and multiple recipeitrecipient : The RFC rules here apply to the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8700&title=quarantine-and-multiple-recipeitrecipient#8700 Author: LogSat
Subject: 5724
Posted: 10 August 2006 at 11:34pm

The RFC rules here apply to the two SMTP servers talking to each other. Once an email is accepted by a server, it's over as far as the RFC in questions are concerned.

If the user has specific client-side rules, you go into a completely different scenario, outside the scope of SMTP servers and server-side spam filtering. The SMTP server will have no clue as of what the email client is doing. If the email client deletes an email without showing it to the user, the SMTP server (in general) will have no idea of what happened.
]]> Thu, 10 Aug 2006 23:34:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8700&title=quarantine-and-multiple-recipeitrecipient#8700 <![CDATA[Quarantine and multiple recipeitrecipient : yep, hence we don&#039;t send...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8687&title=quarantine-and-multiple-recipeitrecipient#8687 Author: StevenJohns
Subject: 5724
Posted: 10 August 2006 at 4:48am

yep, hence we don't send NDR's....exactly my point.

another scenario...

A user works in the technical dept of company X. He, and several others receive promotional emails from a supplier on a regular basis. This supplier is then dropped, for whatever reason. The emails still arrive. The user gets promoted and so the emails are irrelevant to him anyhow. The user creates a rule in outlook to move all emails from this supplier to the junk folder and/or simply delete them straight away (after all, these emails are now by definition "unsolicited commercial email" UCE...SPAM...). Some of the recipients haven't bothered to create such a rule, and so they get these emails in their inbox....and manually delete them.

The sending server gets a 250 for each recipient, but in reality, the email only arrives in some inboxes, not all of them (because of the outlook rules).
This happens all of the time, I have dozens of clients who's users create these rules.
It would be easier, cleaner, quicker, less resource intensive etc.etc.etc. to stop these emails at the server for specific users.

It may be noted that the 250 response that you send back to the sending email server is related to the connection, not the content. Currently as per RFC, there is not method devised to tell the sending server that the email was delivered, but the user deleted it (either manually or with a rule), therefore there is no conformance issue in accepting the email for all recipients, then selectively removing certain recipients from the recipient list if that is what they want.

]]> Thu, 10 Aug 2006 04:48:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8687&title=quarantine-and-multiple-recipeitrecipient#8687 <![CDATA[Quarantine and multiple recipeitrecipient : StevenJohns,Scenario. The SMTP...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8684&title=quarantine-and-multiple-recipeitrecipient#8684 Author: LogSat
Subject: 5724
Posted: 09 August 2006 at 10:21pm

StevenJohns,

Scenario. The SMTP session is past the "RCPT TO" commands, where the recipients can be rejected by SpamFilter, and the sender has issued the DATA command and the transmittal of the email has begun. SpamFilter will now scan the email contents, and apply the various content-based filters:
keywords, SURBL, attachment type, spam-image, antivirus, Bayesian.

At this point SpamFilter can do only one of two things. Either it will accept the email by sending a "250" ok code, or it will reject it with a 5xx  error code. There are no in betweens... the email is either accepted or it's rejected.

If SpamFilter sends a 250 code, the sender's mail server will assume the email is sent and all recipients have received it.

If SpamFilter sends a 5xx code, the sender's mail server will know the email was rejected and all recipients did not receive it.

This is how SMTP works... and there's no way around it.

What SpamFilter *could* do is send a 250 code, telling the sender the emails were received. SpamFilter can then deliver it to some recipients, and not to others. While this could be done, SpamFilter MUST per RFC (and for common sense) notify the sender that some recipients did not receive the email. The ONLY way to do this, since the sender has already received the 250 code, is for SpamFilter to send NDR (non-delivery email notifications) to the sender. This however is a very bad idea, as most of the times the sender is fake, so SpamFilter would be sending huge amounts of NDR emails to innocent victims, practially spamming them. This would result in SpamFilter's IP address to be blaclisted very soon.

]]> Wed, 09 Aug 2006 22:21:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8684&title=quarantine-and-multiple-recipeitrecipient#8684 <![CDATA[Quarantine and multiple recipeitrecipient : Steven, can you share your code...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8676&title=quarantine-and-multiple-recipeitrecipient#8676 Author: Alan
Subject: 5724
Posted: 09 August 2006 at 2:17pm

Steven, can you share your code that you are using to do this?
Maybe send via private message?
]]> Wed, 09 Aug 2006 14:17:28 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8676&title=quarantine-and-multiple-recipeitrecipient#8676 <![CDATA[Quarantine and multiple recipeitrecipient : Just a quick question.... Why...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8675&title=quarantine-and-multiple-recipeitrecipient#8675 Author: StevenJohns
Subject: 5724
Posted: 09 August 2006 at 11:51am

Just a quick question....

 

Why can't SF split the email and deliver it to a single recipient, whilst also rejecting it for other recipients.

 

I run my own filters here which I have written in vb.net that do exactly this and I haven't had any issues. This has been running for the last 18 months with no complaints. Also, I do not send NDR's to rejected mails....most of them bounce anyway as the sender's address is either spoofed or non-existant.

 

 

]]> Wed, 09 Aug 2006 11:51:51 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8675&title=quarantine-and-multiple-recipeitrecipient#8675 <![CDATA[Quarantine and multiple recipeitrecipient : Hi Roberto, Sorry for the delay!...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8649&title=quarantine-and-multiple-recipeitrecipient#8649 Author: lyndonje
Subject: 5724
Posted: 04 August 2006 at 8:32am

Hi Roberto,

Sorry for the delay! I've been off work.

I've just checked the log again and there are no (101404) threads missing from the above.

Regards,
Lyndon.
]]> Fri, 04 Aug 2006 08:32:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8649&title=quarantine-and-multiple-recipeitrecipient#8649 <![CDATA[Quarantine and multiple recipeitrecipient : Well... looking at this over I...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8566&title=quarantine-and-multiple-recipeitrecipient#8566 Author: LogSat
Subject: 5724
Posted: 21 July 2006 at 4:28pm

Well... looking at this over I admit I'm confused as well...

Logs are sequential, and are supposed to log what is happening at the moment. It is normal that first they say the email will be blocked, but then a whitelist is triggered, and thus the email will be delivered.

What I do not understand myself right now is how you ended up with two deliveries in the same thread:

07/20/06 09:38:22:963 -- (101404) EMail from noreply@sender.co.uk to james@recipient.co.uk was queued. Size: 1 KB, 1024 bytes
07/20/06 09:38:23:120 -- (101404) Bypassed all rules for: james@recipient.co.uk from
07/20/06 09:38:23:370 -- (101404) EMail from  to james@recipient.co.uk was queued. Size: 3 KB, 3072 bytes

That can happen, but there's usually more "stuff" being logged in between the queued events, which I don't see.

Before I try to explain the NDR, is this the complete, accurate log for thread 101404?
]]> Fri, 21 Jul 2006 16:28:26 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8566&title=quarantine-and-multiple-recipeitrecipient#8566 <![CDATA[Quarantine and multiple recipeitrecipient : Hi Roberto, I understand this,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8560&title=quarantine-and-multiple-recipeitrecipient#8560 Author: lyndonje
Subject: 5724
Posted: 21 July 2006 at 4:06am

Hi Roberto,

I understand this, and am aware that SF can not split emails, but the logs still confused me.

The logs don't actually say the email is being delivered to allrecipients. I suppose you just have to assume this knowning SF can notsplit them? This is fine, but why does SF generate a bounce backknowning it can not split the email and is going to deliver it anyway?

Could you also clarrify this for me:

"If so still leaves me with the two differentsender addresses, noreply@sender and james@sender (causing the MAIL TO& FRAM matching). Could one be the MAIL FROM, and the other justthe From:?"

Am I correct in thinking one address it the MAIL FROM and the other the From:?

Regards,
Lyndon.
]]> Fri, 21 Jul 2006 04:06:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8560&title=quarantine-and-multiple-recipeitrecipient#8560 <![CDATA[Quarantine and multiple recipeitrecipient : lyndonje,Everything is actually...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8558&title=quarantine-and-multiple-recipeitrecipient#8558 Author: LogSat
Subject: 5724
Posted: 20 July 2006 at 4:42pm

lyndonje,

Everything is actually working as designed. The incoming email has multiple recipients, and it would have been rejected as both the SPF and "Mail from=Mail to" filters cause it to fail.

However while processing the recipients, SpamFilter saw that james@recipient.co.uk has force-delivered an email from noreply@sender.co.uk. This means that any emails from noreply@sender.co.uk to james@recipient.co.uk will end up in the "AutoWhiteList ForceDelivery" and will be whitelisted.

SpamFilter will thus deliver the email, with the side-effect of all users receiving it.

This fact (all users receiving an email if one is whitelisted) has been discussed a lot about in the past (and present...). It boils down to SpamFilter not being able to "split" an email and deliver it to some users yet not deliver it for others.

The *only* way this could occur is for SpamFilter to stop the email for everyone, and then send non-delivery notification emails to inform the sender that some users didn't receive it. However, this would cause other huge problems, as most often such emails will be spam, so SpamFilter will send NDR to senders of spam emails. These senders are most times unfortunate victims who had their email address spoofed. SpamFilter would thus send NDRs to innocent victims, and this would eventually result in your own IP address being blacklisted, as you'd be sending practically undesired emails to innocent people...
]]> Thu, 20 Jul 2006 16:42:44 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5724&PID=8558&title=quarantine-and-multiple-recipeitrecipient#8558