Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - possible problem with To Email blacklist
  FAQ FAQ  Forum Search   Register Register  Login Login

possible problem with To Email blacklist

 Post Reply Post Reply
Author
Ric View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Ric Quote  Post ReplyReply Direct Link To This Post Topic: possible problem with To Email blacklist
    Posted: 07 October 2003 at 2:34pm

I have a number of old email accounts on my ToEmail blacklist and have SpamFilterISP set to NOT quarantine those messages (just to keep the quarantine database size down - I have A LOT of 'old user' spam messages coming in).  I just discovered this morning that the latest rev (1.2.0.206) will reject messages sent to valid users if a blacklisted email address is also on the recipients list.  This doesn't happen with all servers (I originally tested from a Yahoo account, and it worked fine - apparently Yahoo sends the messages individually).  After seeing this in the logfile, I connected via telnet from a different machine to test and confirm.

Here's a logfile excerpt:

10/07/03 11:20:31:555 -- (1060) Connection from: xx.xxx.xxx.x  -  Originating country : United States
10/07/03 11:21:00:156 -- (1060) Resolving xx.xxx.xxx.x - yyy.yyyyyyyyy.com
10/07/03 11:21:00:166 -- (1060) Mail from: anaccount@email.net
10/07/03 11:21:00:797 -- (1060) - MAPS search done... .
10/07/03 11:21:00:797 -- (1060) RCPT TO: validuser@mydomain.com accepted
10/07/03 11:21:12:123 -- (1060) - EmailTO is in local blacklist file...
10/07/03 11:21:12:123 -- (1060) xx.xxx.xxx.x - Mail from: anaccount@email.net To: invaliduser@mydomain.com will be disconnected
10/07/03 11:21:12:123 -- (1060) Disconnect

help?  I've removed my EmailTO Blacklist until this is resolved...

-Ric

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 07 October 2003 at 4:11pm

Ric,

The "ToEMail Blacklist" causes SpamFilter to reject any message that has a recipient in that blacklist. I emphasize on "message" because SpamFilter will not reject the single recipient, it will classify the whole message as spam.

As you discovered mail servers send emails to multiple recipients (CCs or BCCs) in different ways. (1) Some issue multiple "RCPT TO" commands in the same session, meaning they connect to the receiving SMTP server, then list out the recipients, then send out the data stream (once). (2) Others will initiate a new connection to the receivng SMTP server for each single recipient, and send the data stream individually every time over and over for each one (wasting quite a bit of bandwidth...).

In the first case if a recipient is blacklisted the whole email is discarded and the other recipients will not receive it either. In the second case, the session containing the blacklisted address is discarded, but all other recipients will receive theirs since each email is made up of an individual connection.

Roberto F.
LogSat Software

Back to Top
Ric Marques View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Ric Marques Quote  Post ReplyReply Direct Link To This Post Posted: 07 October 2003 at 4:33pm

Roberto -

Thanks for the quick reply... so SpamFilterISP is doing it's job properly, I was just trying to use one of the features improperly... :( darn.

-Ric

Back to Top
fabravo View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote fabravo Quote  Post ReplyReply Direct Link To This Post Posted: 08 October 2003 at 4:18pm
Hey Ric-

I have done the same thing (we really should talk at some point!). I have not kept that close of a watch on what is being rejected by this list, but from what I can see, it is all SPAM. Very rarely are valid messages from the outside being addressed to people who are no longer here.

I think, however, I will watch it a bit more closely for a couple of days, just to make sure!

Take care!

\frank
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.215 seconds.