Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Does FROM blocking work in .178 ?
  FAQ FAQ  Forum Search   Register Register  Login Login

Does FROM blocking work in .178 ?

 Post Reply Post Reply
Author
Lee View Drop Down
Groupie
Groupie


Joined: 04 February 2005
Location: United States
Status: Offline
Points: 50
Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee Quote  Post ReplyReply Direct Link To This Post Topic: Does FROM blocking work in .178 ?
    Posted: 18 November 2003 at 3:05pm

I have been trying to block spam from someone posing as microsoft but I can not get Spamfilter .178 to block this email.

From: "Microsoft" <security@microsoft.com>
To: <Newsdesk@AmericanMotor.com>
Subject: Use this patch immediately !

Shouldn't simply putting security@microsoft.com in the blacklist From file do it ?  Is this an operator error (ME) or a bug in .178 ?

Thanks,

Lee

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4106
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 18 November 2003 at 11:03pm

Lee,

The blacklist "From" filter works based on the "MAIL FROM" address that is specified by the remote server, not the "From:" header in the email content. You should be able to see the original MAIL FROM address by looking at the "Return-Path" address in the email header.

Roberto F.
LogSat Software

Back to Top
Lee View Drop Down
Groupie
Groupie


Joined: 04 February 2005
Location: United States
Status: Offline
Points: 50
Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee Quote  Post ReplyReply Direct Link To This Post Posted: 19 November 2003 at 12:08am

Roberto, as usual I learn some thing new every time I talk to you. :)

Does this also apply to the DOMAIN filter ?

From: "Microsoft" <security@microsoft.com>
Received: (qmail 26673 invoked from network); 18 Nov 2003 22:07:48 -0000
Received: from unknown (HELO localhost) (64.122.20.32)
  by apbauto.com with SMTP; 18 Nov 2003 22:07:48 -0000
To:
webmaster@domain.com
Subject: Use this patch immediately

Here is the header so is the :
 "Received: from unknown (HELO localhost) (64.122.20.32)"

 Is this the portion of the header you are talking about ?

Lee

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4106
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 19 November 2003 at 11:39pm

That's why we're here!

Yes, the same applies for the domain filter.

Roberto F.
LogSat Software

 

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.207 seconds.