Where would the new IP Cache Black List you were talking about fit into the filter order? I am going nuts trying trying to think of a way to stop the 24x7 dictionary attacks that are hitting my mail server (yes, I use AuthorizedTo list extensivley). I can write a script to gather all the IP's of the rejected maurauders, but there is no SF file to stick them since in the order list the AuthorizedTo check comes after the Whitelist check and before the Block IP list. There would have to be a list that was checked upon connection for the IP address and if it was in the cache black list be stopped before the first whitelist check was ever performed.

Is that what the new blacklist you mentioned recently going to do?

My SF machine is getting pounded, but that means my regular mailserver gets to go about its business as usual and everyone is happy so SF is really doing a great job for me. Thanks Roberto!

Roberto,

Is there a way for users to customize the filter order?  For instance, I would prefer that the Keywords blacklist fires before the MAPS check, since I am not quarantining spam flagged due to keywords, but I am quarantining spam flagged due to MAPS.  I've found that a lot of the messages in quarantine have the keywords that I've blacklisted, and if the keywords filter would fire first, I would have less email to sift through in the quarantine list.

As of SpamFilter ISP version 3.0.1.553, following is the updated order of the filters. In red are the blacklists, in green the whitelists:

1. Cached IP blacklist
2.         Whitelisted IP
3.         Whitelisted Email Address To
4.         Whitelisted EMail Address From
5.         Whitelisted Email From Domain
6.         Whitelisted Auto White List Force Delivery
7. Allowed Domains
8. Local IP Blacklist
9. Local Domain Blacklist
10. Local Emails Blacklist
11. Local Emails TO Blacklist
12. Not in Authorized TO Emails
13. Country Blacklist
14. Reject No Reverse DNS
15. Reject Empty Mail From
16. Reject Same To From Email address
17. Reject if Recipient�s email in Honeypot email list
18. Reject if IP in Honeypot-generated auto-ban list
19. Reject Same To From Domain
20. Recipient Count > Max RCPTTO
21. MX Record check
22. SFDB Filter
23. SPF Filter
24. MAPS check
25.         Keyword Whitelist
26. Attachment Filter
27. Keywords
28. Image Filtering
    
29. Bayesian Filtering
30. SURBL check
31. Antivirus Plugin

As of SpamFilter ISP version 4.0.0.766, following is the updated order of the filters. In red are the blacklists, in green the whitelists:

1. Cached IP blacklist
2. Greylist
   
3.         Whitelisted IP
4.         Whitelisted Email Address To
5.         Whitelisted EMail Address From
6.         Whitelisted Email From Domain
7.         Whitelisted Auto White List Force Delivery
8. Allowed Domains
9. Local IP Blacklist
10. Local Domain Blacklist
11. Local Emails Blacklist
12. Local Emails TO Blacklist
13. Not in Authorized TO Emails
14. Country Blacklist
15. Reject No Reverse DNS
16. Reject Empty Mail From
17. Reject Same To From Email address
18. Reject if Recipient’s email in Honeypot email list
19. Reject if IP in Honeypot-generated auto-ban list
20. Reject Same To From Domain
21. Recipient Count > Max RCPTTO
22. MX Record check
23. SFDB Filter
24. SPF Filter
25. MAPS check
26.         Exceeded MaxMsgSizeForSpamFiltering
27. Keyword Whitelist
28. SFCD Filter
    
29. Blank emails with attachments only
    
30. Spam Images in PDFs
31. Attachment Filter
    
32. Keywords
33. Image Filtering
    
34. Bayesian Filtering
35. SURBL check
36. Resolve URLs and check IPs in MAPS
37. Antivirus Plugin