1. Viruses - if an email is infected, there is no whitelist to save it... it will be blocked, period.
2. Allowed Domains - to avoid becoming an open-relay, no email is ever delivered unless the recipient domain is listed in the "Allowed Domains" list. The only whitelist that can be used to allow delivery of emails to non-local addresses is the IP whitelist. The theory is that any spammer can eventually guess how to use/fake your whitelists to then abuse your SpamFilter as an open relay. The only thing that they can't really fake is the IP address (IP spoofing won't help here...).

1.         Whitelisted IP
2. Allowed Domains
3.         Whitelisted Email Address To
4.         Whitelisted EMail Address From
5.         Whitelisted Email From Domain
6.         Whitelisted Auto White List Force Delivery
7. Local Domain Blacklist
8. Local Emails Blacklist
9. Local Emails TO Blacklist
10. Not in Authorized TO Emails
11. Country Blacklist
12. Reject No Reverse DNS
13. Reject Empty Mail From
14. Reject Same To From Email address
15. Reject if Recipient email in Honeypot email list
16. Reject if IP in Honeypot-generated autoban list
17. Reject Same To From Domain
18. Recipient Count > Max RCPTTO
19. MX Record check
20. SPF Filter
21. MAPS check
22.         Keyword Whitelist
23. Attachment Filter
24. Keywords
25. Bayesian Filtering
26. SURBL check
27. Antivirus Plugin

Where would the new IP Cache Black List you were talking about fit into the filter order? I am going nuts trying trying to think of a way to stop the 24x7 dictionary attacks that are hitting my mail server (yes, I use AuthorizedTo list extensivley). I can write a script to gather all the IP's of the rejected maurauders, but there is no SF file to stick them since in the order list the AuthorizedTo check comes after the Whitelist check and before the Block IP list. There would have to be a list that was checked upon connection for the IP address and if it was in the cache black list be stopped before the first whitelist check was ever performed.

Is that what the new blacklist you mentioned recently going to do?

My SF machine is getting pounded, but that means my regular mailserver gets to go about its business as usual and everyone is happy so SF is really doing a great job for me. Thanks Roberto!

1. Cached IP blacklist
2.         Whitelisted IP
3. Allowed Domains
4.         Whitelisted Email Address To
5.         Whitelisted EMail Address From
6.         Whitelisted Email From Domain
7.         Whitelisted Auto White List Force Delivery
8. Local IP Blacklist
9. Local Domain Blacklist
10. Local Emails Blacklist
11. Local Emails TO Blacklist
12. Not in Authorized TO Emails
13. Country Blacklist
14. Reject No Reverse DNS
15. Reject Empty Mail From
16. Reject Same To From Email address
17. Reject if Recipient’s email in Honeypot email list
18. Reject if IP in Honeypot-generated auto-ban list
19. Reject Same To From Domain
20. Recipient Count > Max RCPTTO
21. MX Record check
22. SPF Filter
23. MAPS check
24.         Keyword Whitelist
25. Attachment Filter
26. Keywords
27. Bayesian Filtering
28. SURBL check
29. Antivirus Plugin

Roberto,

Is there a way for users to customize the filter order?  For instance, I would prefer that the Keywords blacklist fires before the MAPS check, since I am not quarantining spam flagged due to keywords, but I am quarantining spam flagged due to MAPS.  I've found that a lot of the messages in quarantine have the keywords that I've blacklisted, and if the keywords filter would fire first, I would have less email to sift through in the quarantine list.

As of SpamFilter ISP version 3.0.1.553, following is the updated order of the filters. In red are the blacklists, in green the whitelists:

1. Cached IP blacklist
2.         Whitelisted IP
3.         Whitelisted Email Address To
4.         Whitelisted EMail Address From
5.         Whitelisted Email From Domain
6.         Whitelisted Auto White List Force Delivery
7. Allowed Domains
8. Local IP Blacklist
9. Local Domain Blacklist
10. Local Emails Blacklist
11. Local Emails TO Blacklist
12. Not in Authorized TO Emails
13. Country Blacklist
14. Reject No Reverse DNS
15. Reject Empty Mail From
16. Reject Same To From Email address
17. Reject if Recipient�s email in Honeypot email list
18. Reject if IP in Honeypot-generated auto-ban list
19. Reject Same To From Domain
20. Recipient Count > Max RCPTTO
21. MX Record check
22. SFDB Filter
23. SPF Filter
24. MAPS check
25.         Keyword Whitelist
26. Attachment Filter
27. Keywords
28. Image Filtering
    
29. Bayesian Filtering
30. SURBL check
31. Antivirus Plugin

As of SpamFilter ISP version 4.0.0.766, following is the updated order of the filters. In red are the blacklists, in green the whitelists:

1. Cached IP blacklist
2. Greylist
   
3.         Whitelisted IP
4.         Whitelisted Email Address To
5.         Whitelisted EMail Address From
6.         Whitelisted Email From Domain
7.         Whitelisted Auto White List Force Delivery
8. Allowed Domains
9. Local IP Blacklist
10. Local Domain Blacklist
11. Local Emails Blacklist
12. Local Emails TO Blacklist
13. Not in Authorized TO Emails
14. Country Blacklist
15. Reject No Reverse DNS
16. Reject Empty Mail From
17. Reject Same To From Email address
18. Reject if Recipient’s email in Honeypot email list
19. Reject if IP in Honeypot-generated auto-ban list
20. Reject Same To From Domain
21. Recipient Count > Max RCPTTO
22. MX Record check
23. SFDB Filter
24. SPF Filter
25. MAPS check
26.         Exceeded MaxMsgSizeForSpamFiltering
27. Keyword Whitelist
28. SFCD Filter
    
29. Blank emails with attachments only
    
30. Spam Images in PDFs
31. Attachment Filter
    
32. Keywords
33. Image Filtering
    
34. Bayesian Filtering
35. SURBL check
36. Resolve URLs and check IPs in MAPS
37. Antivirus Plugin