I have been evaluating Spamfilter and trying to figure out if it is actually helping. As I watch the activity screen there seems to be a LOT of spam that still gets through.

The Reverse DNS seems to catch a lot of mail but not sure the MAPS is actually working correctly.

I continue to receive emails from IP's that I know is listed in the MAP servers such as dnsbl.njabl.org.

Do all MAP servers require the "dnsbl.njabl.org, true" format ? Does the TRUE statement mean you get a reverse IP response ?

Any suggestions ?

Lee

Lee,

If you can email us your SpamFilter.ini file at support@logsat.com we can take a look at how you configured SpamFilter to make sure everything is working correctly.

The MAPS lookups are working correctly. I just checked our logs and we have thousands of rejects by njabl.org. Can you please let us know some examples of which IP you are referring to, and provide us with a copy of your SpamFilter logfile that shows the email getting thru?

The "true" next to a RBL means their DNS is expecting the IP to be reversed, i.e. to test a connection from 1.2.3.4 they expect a query for 4.3.2.1.bl.spamcop.net.

Hope this helps,

Roberto Franceschetti LogSat Software

Roberto, here is an example of what I am talking about.

This IP 67.34.45.66 was in an email I just received. When I do a lookup at http://www.njabl.org/cgi-bin/lookup.cgi?query=67.34.45.66" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.njabl.org/cgi-bin/lookup.cgi?query=67.34.45.66" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.njabl.org/cgi-bin/lookup.cgi?query=67.34.45.66

It shows up in their database as an open proxy. So why did this make it through Spamfilter and the MAPS lookup ?

Thanks again,

Lee

The IP 67.34.45.66 is currently listed by both bl.spamcop.net and dnsbl.njabl.org. SpamFilter should indeed have stopped it. As mentioned in the other posts, if you can send us your ini and a logfile we can take a look at what is happening on your system.

Roberto Franceschetti LogSat Software

Roberto, thanks for the reply.

I think part of the problem might be I needed to stop and restart the service so it would reload the ini file. But I looked at the log files and how can you tell if and what MAPS server is rejecting the email ?

The only thing I can see in the log file that mentions the MAPS search is... "MAPS search done... ."

Is there suppose to be a list of MAPS queries or rejection notices in the log file ?

Obviously there is a trade off between enough debug info and filling up your disk with useless log files.

Lee

Lee,

The logfile and the activity log in the GUI do show MAPS rejects, along with which RBL rejected the connection. Here's a sample from our own logs:

03/29/03 00:01:06:756 -- (414) Connection from: 208.237.122.151 - Originating country : United States 03/29/03 00:01:07:176 -- (414) Resolving 208.237.122.151 - mail2.adultdailydigest.com 03/29/03 00:01:07:176 -- (414) Mail from: bounce-kleckley_netwide.net@adultdailydigest.com 03/29/03 00:01:07:266 -- (414) - MAPS search done... 521 The IP 208.237.122.151 is Blacklisted by bl.spamcop.net.9Blocked - see http://spamcop.net/bl.shtml?208.237.122.151" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spamcop.net/bl.shtml?208.237.122.151" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spamcop.net/bl.shtml?208.237.122.151 . 03/29/03 00:01:07:266 -- (414) 208.237.122.151 - Mail from: bounce-kleckley_netwide.net@adultdailydigest.com To: kleckley@netwide.net will be quarantined 03/29/03 00:01:07:557 -- (414) EMail from sheri@adultdailydigest.com to kleckley@netwide.net was received and quarantined. Size: 1 KB 03/29/03 00:01:07:667 -- (414) Disconnect

Once making changes to the MAPS Servers in the SpamFilter's Settings tab, all that's needed is to click on the "Save Settings" button to activate them.

If you do not see lolg entries like the one above, there may be other problems in your config. We may be able to tell if you can send us a copy of your ini file and of one of your spamfilter logs.

Roberto Franceschetti LogSat Software .

Roberto, I figured out the problem.

On a 800x600 (at least mine) screen resolution the DNS SERVER field is covered up by the SAVE SETTINGS button. So I never entered my DNS info.

After getting your post I started staring at the INI file, line by line and noticed the DNS was 1.1.1.1. After changing this and restarting the app it is now blocking MAPS information.

Works great now ! Thanks.

Lee

Roberto, I emailed you the information you requested. Thanks for your help.

On a related topic....

If I enter an IP in the ORBS search box does it search the MAPS servers in my ini file ?

Can this be used as a tool to determine if my configuration is correct ? In other words if I enter a known blacklisted IP in the ORBS shouldn't it come back as "Found" ?

Lee