Spam Filter ISP Support - Attachment block, bug or feature?

Attachment block, bug or feature?

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6724
Printed Date: 05 February 2025 at 12:00pm

Topic: Attachment block, bug or feature?

Posted By: yapadu
Subject: Attachment block, bug or feature?
Date Posted: 31 July 2009 at 8:34am

I noticed something today about attachments.

Spam Filter has the option to blacklist attachments, you could put in something like this:

*.zip
*.exe
*.bat

Now, you might think you have protected your users from any attachments with these three attachment types right?

Well, not so fast. The attachment blacklist only applies if the message size is under the value set in MaxMsgSizeForSpamFiltering.

If you have a block on .doc, and someone send a .doc file that is 5 megs in size you will end up getting something like this:

X-SF-WhiteListedReason: Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering

Is this by design or a bug?

Replies:

Posted By: LogSat
Date Posted: 31 July 2009 at 10:16am

That is by design.

We had a thread on the forum that was updated to always display the order in which filters are applied ( http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=5171&PID=11418#11418 - www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=5171&PID=11418#11418 ). As this was hard to find we always wanted to move it to a separate posting but never got around it... until now.

We've created a new "sticky" thread on the forum that will always contain the latest list showing the order in which filters are applied. From there we can see that the "Exceeded MaxMsgSizeForSpamFiltering" whitelist precedes the "Attachment Filter", and thus emails over that minimum size will be whitelisted bypassing the attachment filter.

The list can now be found at:

http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=6726&PID=13077 - www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=6726&PID=13077

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: yapadu
Date Posted: 31 July 2009 at 6:19pm

Thanks for the update regarding the filter list, a bit unfortunate since the ability to block attachments is not really 'real'.

I would like to suggest another item to be made sticky (or perhaps part of the same sticky thread). The item that I think is of interest to people is the current minimum network reliability value being used for SFDB and SFDC. I think the default value for SpamFilter is 3, but I read in the past that the minimum value has changed over time and it is now much higher.

Someone trying to make adjustments to the sensitivity of the network reliability, might increase it to 6 or 9 etc. but it would actually not be doing anything because they are not above the minimum value used by the SFDB/SFDC.