It has been requested before that we be able to block various character sets.

I've notice a certain spammer when adds to the header:

 charset="iso-xxxx-0"  where xxxx is a random 4-digit number.

I assume this confuses SF into thinking it cannot read the "foreign" character set and passes it on through.  If this is the case, can we get a toggle to quarantine all messages that contain an unknown character set?

Unfortunately we use MS Outlook and all email that is passed through SF goes to Outlook, so you wouldn't be able to analyse.

However we are still getting spam getting through, apparantly using this loophole.  In some of the more recent ones I can spot three different filters that should have stopped the spam but did not.  I am convinced the "charset="iso-xxxx-x"" isssue is the problem and that it is preventing SF from doing it's job.  Even the built in "Mail From = Mail To" is not stopping them, as I believe SF doesn't think it can read the header.

You say that SF DOES scan the contents and it is not being tricked by the fake character set.

It it is being scanned, then why does the spam get through when it contains several triggers that my filters would normally have caught?

Alan,

If you 're not able to see the original source of the email, you cannot say "then why does the spam get through when it contains several triggers that my filters would normally have caught", as the email may be formatted in such a way to make your keyword list fail.

Matt has a very good suggestion in this thread. If you are able to finally see the email source we'll be able to see if there's actually a bug in SpamFilter or if the email source is indeed formatted in such a way to byspass your keywords.

Roberto F.
LogSat Software

Alan,

Luck is not with you... One thing you may want to try is the "debug view" in SpamFilter. If you know the IP address of the sender's server, under the "Settings" and then "Debug View" you can try monitoring traffic from that IP. SpamFilter will catch the initial SMTP traffic, and some of the content. Luck will play its part though, since SpamFilter will try to catch as much traffic as possible, but for performance reasons it won't try super hard, and may skip a few packets. What you'll see though is the email's source, or part of it.

Roberto F.
LogSat Software

Alan,

I've seen that "conversion" on emails received by both Exchange 5.5 and Exchange 2003, both without running SpamFilter. Have you tried the debugging procedure I described in a previous posting to see if you're able to capture the original source?

Roberto F.
LogSat Software

Some of the foreign charset mails are beeing blocked by MAPS, and placed in qdb.

i want to check them out for keyword filtering, honeypot etc, but when i dblclick them to investigate i get:

11/01/05 10:12:57:580 -- Exception occurred during DBGridQuarantineDblClick: Read Timeout

All other qdb items work fine, those don't, Roberto, are you aware of this?

I don't want to send the mails through to the adressee, because then the sender gets whitelisted, and i have to dig through the whitelist to remove it.

In cases like this i could use a 'deliver once' button in the qdb gui.

regardless, the error msg i get isnt supposed to happen.

At the moment i have 3 of the foreign sets mails in the db, and all behave the same.

mail sent, hope you find something suspicious.

Kind regards,

Marco

ps: running SPF build 487, on winNT 4 SP6a server, qdb is running on msAcess DB, using the jet engine

We are facing the same problem!

Does anybody know how to accept mail only from certain IPs(SFs) with sendmail? Maby using procmail?

/Web123