Print Page | Close Window

SPF "neutral" messages in tblQuarantine

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4049
Printed Date: 12 March 2025 at 7:53pm


Topic: SPF "neutral" messages in tblQuarantine
Posted By: Guests
Subject: SPF "neutral" messages in tblQuarantine
Date Posted: 26 July 2004 at 3:13pm

I am starting to see a large number of messages in tblQuarantine that have a RejectID of zero (0) and Reject Details of "neutral" (just the single word "neutral" nothing else).  This appears to be happening on all messages where the SPF evaluation returns "neutral" as in the following.  (The IPs are correct, the email addresses have been changed.)

07/26/04 00:03:05:617 -- (70) Connection from: 66.135.197.27  -  Originating country : United States
07/26/04 00:03:06:168 -- (70) Resolving 66.135.197.27 - mxpool21.ebay.com
07/26/04 00:03:06:339 -- (70) - SPF record found. analyzing: - v=spf1 ip4:207.217.120.0/23 ip4:207.69.200.0/24 ip4:209.86.89.0/24 ?all
07/26/04 00:03:06:339 -- (70) - SPF analysis done: - neutral
07/26/04 00:03:06:339 -- (70) 66.135.197.27 - Mail from: mailto:namewithheld@earthlink.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - namewithheld@earthlink.net To: mailto:namewithheld@mydomain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - namewithheld@mydomain.com will be quarantined
07/26/04 00:03:07:470 -- (70) EMail from mailto:namewithheld@earthlink.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - namewithheld@earthlink.net to mailto:namewithheld@mydomain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - namewithheld@mydomain.com  was received and quarantined. Size: 13 KB, 13312 bytes
07/26/04 00:03:07:470 -- (70) Disconnect

The above message shows up in tblQuarantine with a RejectId of zero (0) and RejectDetails of "neutral".  I can see what happened here -- the message was posted on an eBay form and handled by an eBay mail server, outside of Earthlink's explicitly declared address space -- but that's an SPF issue, not a SpamFilter issue.  The handling of these "neutral" messages by SpamFilter is what I'm asking about here.  Should these "neutral" messages be handled by SpamFilter as a "pass" or at least a "softfail"?

We're running version 2.1.1.369, database is Microsoft SQL Server 7.0.

Thanks for your help -- Jim


Replies:
Posted By: Desperado
Date Posted: 26 July 2004 at 3:58pm

Jim,

Unless I am missunderstanding your question, if you check the GUI under the SPF settings, the "Neutral" SPF results are NOT blocked by default.  However, you can set them to block (as I have).

Dan S.

Posted By: Guests
Date Posted: 26 July 2004 at 4:23pm

My sentence about "Should these "neutral" messages be handled by SpamFilter as a "pass" or at least a "softfail"?" was a bit confusing.  Let me clarify.

In my GUI, neutral messages are still at the default setting (Pass).  Yet, it seems that neutral messages are NOT passing... they are being quarantined.  (I have not researched to see if this is happening to ALL neutrals or just SOME of them, but it is happening with regular frequency.) 

The way that I discovered the problem was through the database detail itself -- I found a lot of records in tblQuarantine with a RejectID of zero (0) for these "neutral" messages.  It may be an error that is only occurring when neutrals are set to Pass (in the GUI).  Since you are blocking neutrals, this is probably the reason you are not experiencing this same issue.

Thanks -- Jim

Posted By: Desperado
Date Posted: 26 July 2004 at 4:48pm

Jim,

You may want to run this past LogSat at mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com  . You have a good point that since my setting is to "fail" that I may not see the same thing.  However, I am checking my logs anyway.

Dan S.

Posted By: Desperado
Date Posted: 26 July 2004 at 6:28pm

Jim,

I looked in my quarantine for anythin blocked with "neutral" and all seemed to have a reject ID of 15 AFTER July 22.  This is when I updated to build 369.

18510768  mailto:hngcyovaug@bellsouth.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - hngcyovaug@bellsouth.net   mailto:some-user@domain.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - some-user@domain.net  Low cost meds shipped overnight 2004-07-26 01:01:28.000 14156190 15 550 The sender did not meet Sender Policy Framework rules. Please see http://spf.pobox.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spf.pobox.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spf.pobox.com  0 0 5

Is this a build issue?  Before 369 the option to set the neutral to fail was not available so you may be correct that by my setting that option, the effect is not present.

Dan S.

 

Posted By: Desperado
Date Posted: 26 July 2004 at 6:32pm

Jim,

 

Verified it.  One of my servers is set to NOT fail the neutral and it is showing a reject ID = 0.

I will pass this on to Roberto if you have not done so.

Dan

Posted By: Guests
Date Posted: 26 July 2004 at 7:09pm

Dan,

Yes, the error apparently came in between builds 367 and 369, most likely when the "neutral" handling was added.

No, I haven't contacted Roberto outside of the messages posted in this forum.  I figured that these support forum posts would be sufficient... if you'd like to contact him off-forum, that's fine.

Thanks again for your efforts.

Jim

Posted By: Desperado
Date Posted: 26 July 2004 at 7:30pm

Jim,

I sent a message to Roberto.  I also, for the short term, added a RejectID of "0" to the tblRejectCodes and updated my ASP code to detect 15 or 0 and now it shows up in my List Spam page.  And they are being blocked even with the radio button not set.  I am sure this will be resolved soon.

Dan S.

Posted By: LogSat
Date Posted: 26 July 2004 at 11:09pm

Jim,

Thanks for the report. We've uploaded build 2.1.1.371 in the registered user area that should fix this bug.  Please note that it's a pre-release version that has still not been fully tested yet.

Roberto F.
LogSat Software

Posted By: Guests
Date Posted: 27 July 2004 at 12:28am

Roberto,

Thanks for the fast turnaround (as usual) on this issue.

Jim


Print Page | Close Window