Print Page | Close Window

BlackList FROM

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=1453
Printed Date: 04 July 2025 at 10:29am


Topic: BlackList FROM
Posted By: Guests
Subject: BlackList FROM
Date Posted: 23 July 2003 at 8:48pm

I'm trying to figure out how FROM blacklist works.

Put mailto:qq@hotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - qq@hotmail.com in the local balcklist FROM list.

Send an email from mailto:qq@hotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - qq@hotmail.com to SpamFilter.

Watched the activity log, it said:

........EmailFrom is in local blacklist file...

RCPT TO: mailto:xx@xxxx.xxx" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - xx@xxxx.xxx (for example)

Email from mailto:qq@hotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - qq@hotmail.com  to mailto:xx@xxxx.xxx" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - xx@xxxx.xxx  was queued.

Sending email from mailto:qq@hotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - qq@hotmail.com to mailto:xx@xxxx.xxx" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - xx@xxxx.xxx

Disconnect

Email from mailto:qq@hotmail.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - qq@hotmail.com to mailto:xx@xxxx.xxx" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - xx@xxxx.xxx was forwarded to mailserver02

How does this happen?? Why the FROM is in the local blacklist but still it gets through??

Thanks,



Replies:
Posted By: LogSat
Date Posted: 23 July 2003 at 10:12pm

Danny,

Can you please post the full contents of the activity log, starting with the entry that shows the incoming connection being made to the one that shows it being forwarded? We'd also need a copy of your SpamFilter.ini file and a copy of your local black/white list files so we can try to replicate the problem. You can email them to mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com .

If an email is in the FROM blacklist, it should be blocked unless one of the whitelists is causing it to be delivered.

Roberto Franceschetti
LogSat Software

Posted By: Guests
Date Posted: 24 July 2003 at 6:33pm
Hi, I've just forwarded you an email with all the info you indicated. Thanks, Danny 

Posted By: LogSat
Date Posted: 24 July 2003 at 11:28pm

Danny,

Mystery solved... Under your "Settings" - "Customized Items" you do not have an error response for the "Response if FROM email is in local blacklist/empty". Since there is not an error defined to return to the sender, SpamFilter has no choice but to accept the email.

Please note that some other responses are empty as well. Those will also cause emails to not be rejected.

To restore the default error responses, simply close SpamFilter, find in the SpamFilter.ini file the following lines and delete them. Next time SpamFilter is started they will be recreated.

[Error Response]
ResponseBlacklistedMAPS=521 The IP %IP% is Blacklisted by %MAPSResponse%.
ResponseBlacklistLocalIP=
ResponseBlacklistLocalDomain=
ResponseBlacklistLocalEMail=
ResponseBlacklistLocalEMailTo=
ResponseNoReverseDNS=557 Your IP %IP% does not have a reverse DNS entry. Disconnecting...
ResponseMaxRCPTTO=557 You exceeded then maximum number of RCPT TO. Disconnecting...
ResponseCountryBlacklist=557 Your IP address is from a blacklisted country. Disconnecting..
ResponseRelayRestricted=557 You are not allowed to send mail to %EMailTo%
ResponseKeywordMatch=

Roberto Franceschetti
LogSat Software

Posted By: Guests
Date Posted: 24 July 2003 at 11:44pm
Thank you so much, you are the best !!
 
However, what if say I do not want to send out any response when the message is rejected ? Is there anywhere I can find such an option??
 
Thanks again I love your program,
 
Danny

Posted By: LogSat
Date Posted: 25 July 2003 at 7:45am

You could just output the numerric error code (500-somthing), that will do the trick. You could also send in theory just a period "." or some other meaningless characters, but we strongly recommend against not having a numeric error code since that violates RFC standards.

Roberto F.
LogSat Software

Posted By: Guests
Date Posted: 25 July 2003 at 12:59pm
Thank you, I will try it.


Print Page | Close Window