Print Page | Close Window

Mail from = mail to filter

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6694
Printed Date: 05 February 2025 at 11:52am


Topic: Mail from = mail to filter
Posted By: info@ideefix-is.com
Subject: Mail from = mail to filter
Date Posted: 26 June 2009 at 7:17am
Hello,
 
Currently I'm testing with SPAM Filter ISP with the enterprice mode activated. In the "filter settings" I enabled the filter "Reject if "Mail from" = "Mail to"". I did this on all domains. But during the tests I dicovered that emails with the same email address in the from and to where not blocked. So there is a lot of spam in the users mailbox. Does anyone know how this is possible and how to solve this?
 
Best regards,
 
Wilfred


Replies:
Posted By: LogSat
Date Posted: 26 June 2009 at 5:32pm
Wilfred,

Please note that SpamFilter acts upon the "real" email address specified in the email. This is often referred to as the "Envelope" address, or the "Return-Path" address. It is the email address that is provided by the sender's server in the "MAIL FROM" SMTP command. SpamFilter logs this address by adding it to the "X-SF-Return-Path" header.

This can be sometimes different that then one specified in the "From" header of an email address. This latter (the one in the header) is what email clients use to display the "From" in an email, but again, this may not be the "real" sender.

Can you please check the emails that are not being stopped by this filter to ensure that you do not run into such a scenario?

If not, if you can please provide us with SpamFilter's activity logfile for one day we'll take a look to see what is happening. If the zipped file is over 5MB in size, please try to upload the file to our ftp server, I'll provide you the login info via a PM.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: LogSat
Date Posted: 28 June 2009 at 11:27am
Wilfred,

We received your logfile. As you correctly already noted, the email was whitelisted as the sender's domain (w.........n.nl) was whitelisted as it was added to the "Excluded IPs / Domains" whitelist. Please note that this whitelist is only used to specify sender's domains and sender's IP addresses that are whitelisted (excluded from filtering rules).

In the Settings tab, as you also correctly say, there is a notice that states:

"Note - You MUST set your local domain(s) in the Black / White List Tab"

We now do realize that this may be misleading, as while in SpamFilter "Standard" mode, there is a tab in the whitelists that is labeled "Local Domains", this tab in not present in the "Enterprise" mode, as it is replaced by the grid database control that contains a list of your domains. The "Local Domains" (which again are your own domains), is used to let SpamFilter know which domains are local to your system, and for which email is going to be addressed. This is different than the "Excluded IPs / Domains" whitelist, which is simply used to tell SpamFilter which senders are going to be whitelisted.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: info@ideefix-is.com
Date Posted: 28 June 2009 at 3:14pm
Roberto,
 
Thank you for youre answer. I removed the domains from the whitelist and the mail from = mail to filter is working fine.
 
Regards,
Wilfred


Print Page | Close Window