Hey all (and Roberto in particular),

SFI is working great here and is well exceeding my expectations however I have a problem that there may be a current workaround for or maybe this "hole" may need to be added to the wishlist for investigation.

If a spammer sends us mail using our domain (eg mydomain.com) that is being spoofed and the same domain (mydomain.com) is in the Excluded FROM Emails whitelist the message will bypass the filters. Is there anyway whatsoever to have other filters (blacklist type) overide whitelist rules?

Maybe something like :overide at the end of the blacklist entry rule could take priority over any whitelisting.

Examples

In HoneyPot or FROM Emails it would be spoofuser@mydomain.com:overide (obviously this couldnt reflect a real email address).

In Keywords Filter it would be email advertise like this:overide

Whilst we could just remove mydomain.com from the whitelist I would prefer to keep the domain listed to ensure that users sending mail from there home's ISP are less likely to experiance problems when their ISP's server is blacklisted.

Any ideas on an existing solution or have you come across this scenerio Roberto.