Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SPAM tagging issue in SFI v3.5..
  FAQ FAQ  Forum Search   Register Register  Login Login

SPAM tagging issue in SFI v3.5..

 Post Reply Post Reply
Author
Thermo View Drop Down
Newbie
Newbie


Joined: 10 July 2006
Location: Canada
Status: Offline
Points: 25
Post Options Post Options   Thanks (0) Thanks(0)   Quote Thermo Quote  Post ReplyReply Direct Link To This Post Topic: SPAM tagging issue in SFI v3.5..
    Posted: 27 April 2007 at 4:37pm
I have one email address in the "Unfiltered Emails" whitelist with the :tag option so the email header gets the SPAM tag. The way it worked in SFI v3.1.3.615, SPAM sent to the unfiltered email address got tagged as did all email addresses included in the email. In v3.5.. the unfiltered email address is the only one that gets the SPAM header tag, the other email addresses included in the email now bypass all filtering and end up in the users Inboxes.

I have had to remove the email address from the unfiltered emails whitelist.

Can you make the tagging in v3.5.. function the same as it did in v3.1.3?

Michael
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 28 April 2007 at 4:01am
The intended action in the new version is that the unfiltered message gets tagged and the rest quarantined.  I say intended because there seems to be times when the messages are, in fact, delivered.  I have not put this all together but it seems to depend on weather ot not the addresses are in the TO:, CC or BCC fields.  I started to look at this be then got sidetracted.  I think Thermo is on to something but as I stated, I am not clear on the exact issue yet.
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
Thermo View Drop Down
Newbie
Newbie


Joined: 10 July 2006
Location: Canada
Status: Offline
Points: 25
Post Options Post Options   Thanks (0) Thanks(0)   Quote Thermo Quote  Post ReplyReply Direct Link To This Post Posted: 28 April 2007 at 11:12am
This is a section of the log showing what happened, I changed our companies email addresses. It's thread 3992, jeff@company.com gets the message SPAM tagged as it should, but the email gets bypassed for frank, ed, carl and bob.

4/27/07 05:04:40:522 -- (3992) Connection from: 221.148.79.75  -  Originating country : Korea, Republic of
04/27/07 05:04:43:163 -- (3992) - IP address is from a blacklisted country...
04/27/07 05:04:43:163 -- (3992) 221.148.79.75 - Mail from: ramsey@gfagrow.org To: jeff@company.com will be spam-tagged
04/27/07 05:04:44:725 -- (3992) EMail from ramsey@gfagrow.org to jeff@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:44:741 -- (2668) Sending email from ramsey@gfagrow.org to jeff@company.com --
04/27/07 05:04:44:772 -- (2828) Time to add Msg to Bayes corpus:16
04/27/07 05:04:44:881 -- (2668) EMail from ramsey@gfagrow.org to jeff@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:46:069 -- (3992) Bypassed all rules for: frank@company.com from atiles@giciane.trix.net
04/27/07 05:04:47:631 -- (3992) EMail from atiles@giciane.trix.net to frank@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:47:631 -- (3092) Sending email from atiles@giciane.trix.net to frank@company.com --
04/27/07 05:04:47:663 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:47:788 -- (3092) EMail from atiles@giciane.trix.net to frank@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:49:163 -- (3992) Bypassed all rules for: ed@company.com from goldstein@globalhomeproducts.com
04/27/07 05:04:50:725 -- (3992) EMail from goldstein@globalhomeproducts.com to ed@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:50:725 -- (2180) Sending email from goldstein@globalhomeproducts.com to ed@company.com --
04/27/07 05:04:50:756 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:50:866 -- (2180) EMail from goldstein@globalhomeproducts.com to ed@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:52:069 -- (3992) Bypassed all rules for: carl@company.com from jsco@gintri.com
04/27/07 05:04:53:663 -- (3992) EMail from jsco@gintri.com to carl@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:53:663 -- (3204) Sending email from jsco@gintri.com to carl@company.com --
04/27/07 05:04:53:678 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:53:803 -- (3204) EMail from jsco@gintri.com to carl@company.com --  was forwarded to 127.0.0.1:26
4/27/07 05:04:54:397 -- (1756) Connection from: 82.179.199.194  -  Originating country : Russian Federation
04/27/07 05:04:54:944 -- (1756) - IP address is from a blacklisted country...
04/27/07 05:04:54:944 -- (1756) 82.179.199.194 - Mail from: barncaredsefexe@maine.rr.com To: peter@company.com will be rejected
04/27/07 05:04:55:225 -- (3992) Bypassed all rules for: bompane@company.com from sandra@gma-online.de
04/27/07 05:04:56:788 -- (3992) EMail from sandra@gma-online.de to bompane@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:56:788 -- (1732) Sending email from sandra@gma-online.de to bompane@company.com --
04/27/07 05:04:56:819 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:56:913 -- (1732) EMail from sandra@gma-online.de to bompane@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:56:913 -- (1732) Some recipients do not exist, sending NDR bounce to sender
04/27/07 05:04:56:913 -- (1732) EMail from: sandra@gma-online.de to: bompane@company.com was returned to sender - The following recipients are unknown:

bompane@company.com
04/27/07 05:04:57:069 -- (1732) Error-email from sandra@gma-online.de to bompane@company.com was forwarded to 127.0.0.1
04/27/07 05:04:57:866 -- (1756) Created thread (2904) to add email to quarantine
04/27/07 05:04:57:897 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:57:913 -- (2904) EMail from barncaredsefexe@maine.rr.com to peter@company.com was received and quarantined. Size: 29 KB, 29696 bytes
04/27/07 05:04:58:147 -- (3992) Bypassed all rules for: bob@company.com from extrimum@greatsoundpros.com
04/27/07 05:04:58:272 -- (1756) Blacklist cache - Added 82.179.199.194 to limbo
04/27/07 05:04:58:506 -- (1756) SFDB - Added 82.179.199.194 - Response: Error=0
04/27/07 05:04:58:506 -- (1756) Disconnect
04/27/07 05:04:59:725 -- (3992) EMail from extrimum@greatsoundpros.com to bob@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:59:725 -- (2564) Sending email from extrimum@greatsoundpros.com to bob@company.com --
04/27/07 05:04:59:741 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:59:866 -- (2564) EMail from extrimum@greatsoundpros.com to bob@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:05:00:413 -- (3992) Disconnect
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 28 April 2007 at 11:20am
Thermo,

You posted the log just as were were typing in the forum requesting for it

What we see right away is that this is not a single email with multiple recipients, but rather several, separate emails sent in the same session.

The new SpamFilter 3.5 is able to "split" emails with multiple recipients, so that the email is delivered for the allowed recipients, but is blocked for the others.

As this is not apparently the case here, we'll need to look into it further, as you may indeed have found a bug, since this is not an issue of splitting the email, but rather of handling multiple emails in the same session.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 28 April 2007 at 4:34pm
Bug confirmed.

Nice catch Thermo, thanks a lot for reporting this. We'll have it fixed shortly, and will make the patch available within 24/48 hours.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133
Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 02 May 2007 at 9:00am
Updated to 3.5.3.665 but am still seeing mails not split up correctly. This mail was sent to 111@xxx.com with cc: to 222@xxx.com, 333@xxx.com, 444@xxx.com and 555@xxx.com. 555@xxx.com has the :SPAM tag in unfiltered E-Mails, 222@xxx.com and 444@xxx.com do not exist (and therefore are not listed in the "Authorized E-Mails" list).

05.01.07 20:42:36:296 -- (1480) Connection from: 210.245.125.227  -  Originating country : Vietnam
05.01.07 20:42:38:437 -- (1480) Resolving 210.245.125.227 - digipower.vn
05.01.07 20:42:39:000 -- (1480) - SFDB filter match - relevance:85
05.01.07 20:42:39:000 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 111@xxx.com will be rejected
05.01.07 20:42:39:750 -- (1480) - EmailTO is not in AuthorizedTOEmail list...
05.01.07 20:42:39:750 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 222@xxx.com will be rejected
05.01.07 20:42:40:250 -- (1480) Mail from: uaaihmjbeq@digipower.vn
05.01.07 20:42:40:250 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 333@xxx.com will be rejected
05.01.07 20:42:40:765 -- (1480) - EmailTO is not in AuthorizedTOEmail list...
05.01.07 20:42:40:765 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 444@xxx.com will be rejected
05.01.07 20:42:41:265 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 555@xxx.com will be spam-tagged
05.01.07 20:42:41:265 -- (1480) Mail from: uaaihmjbeq@digipower.vn
05.01.07 20:42:54:812 -- (1480) EMail from uaaihmjbeq@digipower.vn to "111@xxx.com, 222@xxx.com, 333@xxx.com, 444@xxx.com, 555@xxx.com" was queued. Size: 28 KB, 28672 bytes
05.01.07 20:42:54:812 -- (7812) Sending email from uaaihmjbeq@digipower.vn to 111@xxx.com, 222@xxx.com, 333@xxx.com, 444@xxx.com, 555@xxx.com --
05.01.07 20:42:55:500 -- (7812) EMail from uaaihmjbeq@digipower.vn to 111@xxx.com, 222@xxx.com, 333@xxx.com, 444@xxx.com, 555@xxx.com --  was forwarded to xxx.xxx.xxx.xxx:25
05.01.07 20:42:55:500 -- (7812) EMail from: uaaihmjbeq@digipower.vn to: 222@xxx.com, 444@xxx.com was returned to sender - The following recipients are unknown: 222@xxx.com, 444@xxx.com
05.01.07 20:42:55:500 -- (7812) Some recipients do not exist, sending NDR bounce to sender


Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 02 May 2007 at 8:12pm
I'm afraid at first glance we only patched the problem that occurred when the same SMTP session sent multiple separate emails, and did not address the problem with the tagging. We thought they fell under the same category, but judging from your log this appears not to be the same. We'll post an update here after looking into this further.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.289 seconds.