Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - BlackList FROM
  FAQ FAQ  Forum Search   Register Register  Login Login

BlackList FROM

 Post Reply Post Reply
Author
Danny View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Danny Quote  Post ReplyReply Direct Link To This Post Topic: BlackList FROM
    Posted: 23 July 2003 at 8:48pm

I'm trying to figure out how FROM blacklist works.

Put qq@hotmail.com in the local balcklist FROM list.

Send an email from qq@hotmail.com to SpamFilter.

Watched the activity log, it said:

........EmailFrom is in local blacklist file...

RCPT TO: xx@xxxx.xxx (for example)

Email from qq@hotmail.com to xx@xxxx.xxx was queued.

Sending email from qq@hotmail.com to xx@xxxx.xxx

Disconnect

Email from qq@hotmail.com to xx@xxxx.xxx was forwarded to mailserver02

How does this happen?? Why the FROM is in the local blacklist but still it gets through??

Thanks,

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2003 at 10:12pm

Danny,

Can you please post the full contents of the activity log, starting with the entry that shows the incoming connection being made to the one that shows it being forwarded? We'd also need a copy of your SpamFilter.ini file and a copy of your local black/white list files so we can try to replicate the problem. You can email them to support@logsat.com.

If an email is in the FROM blacklist, it should be blocked unless one of the whitelists is causing it to be delivered.

Roberto Franceschetti
LogSat Software

Back to Top
Danny View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Danny Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2003 at 6:33pm
Hi, I've just forwarded you an email with all the info you indicated. Thanks, Danny 
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2003 at 11:28pm

Danny,

Mystery solved... Under your "Settings" - "Customized Items" you do not have an error response for the "Response if FROM email is in local blacklist/empty". Since there is not an error defined to return to the sender, SpamFilter has no choice but to accept the email.

Please note that some other responses are empty as well. Those will also cause emails to not be rejected.

To restore the default error responses, simply close SpamFilter, find in the SpamFilter.ini file the following lines and delete them. Next time SpamFilter is started they will be recreated.

[Error Response]
ResponseBlacklistedMAPS=521 The IP %IP% is Blacklisted by %MAPSResponse%.
ResponseBlacklistLocalIP=
ResponseBlacklistLocalDomain=
ResponseBlacklistLocalEMail=
ResponseBlacklistLocalEMailTo=
ResponseNoReverseDNS=557 Your IP %IP% does not have a reverse DNS entry. Disconnecting...
ResponseMaxRCPTTO=557 You exceeded then maximum number of RCPT TO. Disconnecting...
ResponseCountryBlacklist=557 Your IP address is from a blacklisted country. Disconnecting..
ResponseRelayRestricted=557 You are not allowed to send mail to %EMailTo%
ResponseKeywordMatch=

Roberto Franceschetti
LogSat Software

Back to Top
Danny View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Danny Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2003 at 11:44pm
Thank you so much, you are the best !!
 
However, what if say I do not want to send out any response when the message is rejected ? Is there anywhere I can find such an option??
 
Thanks again I love your program,
 
Danny
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 25 July 2003 at 7:45am

You could just output the numerric error code (500-somthing), that will do the trick. You could also send in theory just a period "." or some other meaningless characters, but we strongly recommend against not having a numeric error code since that violates RFC standards.

Roberto F.
LogSat Software

Back to Top
Danny View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Danny Quote  Post ReplyReply Direct Link To This Post Posted: 25 July 2003 at 12:59pm
Thank you, I will try it.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.160 seconds.