whitelist issues
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6931
Printed Date: 26 December 2024 at 9:57am
Topic: whitelist issues
Posted By: Terry
Subject: whitelist issues
Date Posted: 30 March 2011 at 4:13pm
|
I read where the whitelist is no longer the first filter being checked by spamfilter...this appears to be causing some issues with our users....please tell me if this is true... sender "a" is whitelisted (from same mailserver as "sender b"
sender "b" is not whitelisted (but uses the same mailserver as "sender a")
sender "b" sends an email to my account but the ip address he is sending from is blacklisted by "SpamCop" for example...does this add an entry to the "Cached IP blacklist"? Because if it does this would explain to me why we are finding that sender "a" is now being blocked even though they are whitelisted....
if this is the case....this is causing a real problem for us
|
Replies:
Posted By: LogSat
Date Posted: 30 March 2011 at 9:00pm
|
Terry, We keep a list of the order in which SpamFilter's filters are processed at: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726 Please note that this order has never changed, and that the "Cached IP blacklist" has always taken precedence over all other whitelists since its inception. This is because this filter (along with the greylist filter) work at a TCP level even before any SMTP sessions get established. Without an SMTP session, SpamFilter cannot know the email address of the recipient and thus can't apply the whitelists. I've added a note at the bottom of those postings today to highlight a workaround that allows to have some remote sender's IP addresses bypass those two filters as well. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: Terry
Date Posted: 31 March 2011 at 2:38pm
| Roberto, what clear the blacklist ip cache then...does a server reboot reset it? How do things get off this list? |
Posted By: Terry
Date Posted: 31 March 2011 at 4:10pm
| Another followup..is the cache you reference as first to check the same as the file HoneypotBlockedIPS.txt.....is this what you check first....I am thinking that my file is about 5 years old and maybe I should flush it and start again? |
Posted By: LogSat
Date Posted: 31 March 2011 at 9:08pm
SpamFilter maintains the blacklist cache in memory only - nothing is cached to files. To reset it, you can simply stop/restart SpamFilter. You can also use SpamFilter to see the list of IPs that are currently being blacklisted by following the screenshot below. As an FYI, SpamFilter uses the following parameters to determine when an IP is added to this blacklist cache, and for how long it remains there (by default only one hour): ;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted) IPCacheLimboCountTrigger=3
;If an IP sends more than a certain number of spams (default 3 from above) during this number of minutes then it is temporarily banned (blacklisted) IPCacheLimboTimeTrigger=10
;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes IPCacheBlacklistDuration=60  ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Terry wrote:Posted By: LogSat
Date Posted: 31 March 2011 at 9:13pm
The "HoneypotBlockedIPS.txt" is a file that is used if you enable the honeypot filter (which is likely disabled in your case - this is the default setting). This file is semi-unrelated to the "DoNotAddIPToHoneypot" setting in the SpamFilter.ini file. This latter .ini setting is used to, in addition to avoiding IPs to be blacklisted by the honeypot filter (which you probably have disabled), also used to prevent IPs from being blocked by blacklist cache and the greylist filters. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |