Image filter blocking white listed mail |
Post Reply 
|
| Author | |
jemmie 
Newbie 
Joined: 27 May 2006 Location: Netherlands Status: Offline Points: 18 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Image filter blocking white listed mailPosted: 15 May 2008 at 1:37pm |
|
A day ago ISP blocked a mail, Detected spam signature in embedded image, when the from address was white listed. I disabled the image filter so it should not happen again, but does anyone no if this behavior is by design, image filter take precedence over white list. Or is it some bug in the program.
I use version 4.0.0.772 standard.
|
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 15 May 2008 at 3:50pm |
|
jemmie,
The whitelists have precedence over the image filters (and most other filters). Without looking at the logs we can't be certain, but the most common scenario is when the "from" that was whitelisted is not the "real" sender's email address, but rather the one specified in the "From:" email header. SpamFilter acts upon the "real" email address specified in the email. This is often referred to as the "Envelope" address, or the "Return-Path" address. It is the email address that is provided by the sender's server in the "MAIL FROM" SMTP command. SpamFilter logs this address in the following header: X-SF-RX-Return-Path: <user@some.domain> And it also should appear in the "standard" header: Return-Path: <user@some.domain> |
|
|
|
|
jemmie
Newbie
Joined: 27 May 2006 Location: Netherlands Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 16 May 2008 at 1:12am |
|
Thanks for the respons.
This is the part of the log.
05/15/08 03:30:09:561 -- (80816) Connection from: 194.109.24.31 - Originating country : Netherlands
05/15/08 03:30:09:721 -- (80816) Received MAIL FROM: <userf@xs4all.nl> 05/15/08 03:30:09:751 -- (80816) Received RCPT TO: user@mine.net 05/15/08 03:30:09:782 -- (80816) Resolving 194.109.24.31 - smtp-vbr11.xs4all.nl 05/15/08 03:30:10:022 -- (80816) Mail from: user@xs4all.nl 05/15/08 03:30:10:232 -- (80816) - MAPS search done... 05/15/08 03:30:10:232 -- (80816) RCPT TO: user@mine.net accepted 05/15/08 03:30:10:262 -- (80816) Received RCPT TO: user2@mine.net 05/15/08 03:30:10:262 -- (80816) Mail from: user@xs4all.nl 05/15/08 03:30:10:262 -- (80816) RCPT TO: user2@mine.net accepted 05/15/08 03:30:10:422 -- (80816) Checking SFDC 05/15/08 03:30:10:713 -- (80816) Hash cache - Added OK 05/15/08 03:30:10:783 -- (80816) String matching error for (received: from 194.109.24.31 by mail.mine.net (logsat software smtp server - rc); thu, 15 may 2008 03:30:10 +0200 -- received: from s8f60db (a80-101-66-150.adsl.xs4all.nl [80.101.66.150]) -- by smtp-vbr11.xs4all.nl (8.13.8/8.13.8) with esmtp id m4f1vc0u05 --and-- ((?i)(v . a g r a)) : TRegExpr(comp): ParseReg Unmatched () (pos 16) 05/15/08 03:30:10:823 -- (80816) String matching error for (received: from 194.109.24.31 by mail.mine.net (logsat software smtp server - rc); thu, 15 may 2008 03:30:10 +0200 -- received: from s8f60db (a80-101-66-150.adsl.xs4all.nl [80.101.66.150]) -- by smtp-vbr11.xs4all.nl (8.13.8/8.13.8) with esmtp id m4f1vc0u05 --and-- ((?i)"\#fffff[^f]") [1]) : TRegExpr(comp): ParseReg Unmatched () (pos 17) 05/15/08 03:30:10:833 -- (80816) String matching error for (received: from 194.109.24.31 by mail.mine.net (logsat software smtp server - rc); thu, 15 may 2008 03:30:10 +0200 -- received: from s8f60db (a80-101-66-150.adsl.xs4all.nl [80.101.66.150]) -- by smtp-vbr11.xs4all.nl (8.13.8/8.13.8) with esmtp id m4f1vc0u05 --and-- ((?s)\<(font|span)[^>]+style[^>]+float[^>]*:[^>]*right) [3]) : TRegExpr(comp): ParseReg Unmatched () (pos 53) 05/15/08 03:30:10:953 -- (80816) Scanning image for spam:image001.jpg 05/15/08 03:30:10:953 -- (80816) Detected spam signature in embedded image 05/15/08 03:30:10:963 -- (80816) Starting quarantine procedures 05/15/08 03:30:10:983 -- (80816) Created thread (80304) to add email to quarantine 05/15/08 03:30:10:983 -- (80816) Starting bayesian procedures 05/15/08 03:30:10:983 -- (80304) Adding to Quarantine file:Qrt7D7A.tmp 05/15/08 03:30:11:173 -- (80304) EMail from user@xs4all.nl to user@mine.net, user2@mine.net was received and quarantined. Size: 17 KB, 17408 bytes 05/15/08 03:30:28:326 -- (80816) Blacklist cache - Added 194.109.24.31 to limbo 05/15/08 03:30:28:556 -- (80816) SFDB - Added 194.109.24.31 - Response: Error=0 05/15/08 03:30:28:556 -- (80816) Disconnect Where mine.net is my domain and user@xs4all.nl is the sender and that address is whitelisted.
If I look into the header of the mail I found the -SF-RX-Return-Path and that is the same addres.
X - S F - R X - R e t u r n - P a t h : < u s e r @ x s 4 a l l . n l >
Names are changed in the log.
jemmie
|
|
|
|
|
jemmie
Newbie
Joined: 27 May 2006 Location: Netherlands Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 25 May 2008 at 4:15am |
|
Problem still exist.
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 25 May 2008 at 8:32pm |
|
jemmie,
I'm sorry, we missed the previous post and did not reply to it. We'll need a zipped copy of your activity logfile (or the *exact* section you pasted above), along with your SpamFilter.ini file, and your SpamFilter\domains directory tree. If your email whitelist file is located outside of the "domains" directory, please include that too. From the log entries above, it seems that the address u s e r @ x s 4 a l l . n l is *not* being whitelisted, otherwise this would have been logged. The most likely cause are typos in the address, and/or leading and trailing spaces on the line containing the address. As a side-note, there are also entries being logged that show you're missing a parenthesis in the keywords: ((?i)(v . a g r a)) ((?s)\<(font|span)[^>]+style[^>]+float[^>]*:[^>]*right) [3]) ((?i)"\#fffff[^f]") [1]) |
|
|
|
|
jemmie
Newbie
Joined: 27 May 2006 Location: Netherlands Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 26 May 2008 at 3:11am |
|
Where can I send it
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 26 May 2008 at 9:10am |
|
support at logsat dot com
|
|
|
|
|
jemmie
Newbie
Joined: 27 May 2006 Location: Netherlands Status: Offline Points: 18 |
Post Options
Thanks(0)
Quote Reply
Posted: 28 May 2008 at 3:14am |
|
Found the problem myself. There was a trailing spaces at the address in the white list,
Sorry for the trouble.
jemmie
|
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.188 seconds.