Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - 511 build minor Logging bug
  FAQ FAQ  Forum Search   Register Register  Login Login

511 build minor Logging bug

 Post Reply Post Reply
Author
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Topic: 511 build minor Logging bug
    Posted: 20 December 2005 at 9:16pm

Spf result is not displayed or logged completely:

12/20/05 21:01:25:841 -- (1488) SPF query result:

Appears to be missing pass, fail, etc.

 

 

-Matt R
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 20 December 2005 at 10:56pm
Matt,

Could you please post / email us more entries relative to that log entry, so we can se the sender's domain and IP? It's possible that the above occurs only under certain circumstances...
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Posted: 20 December 2005 at 11:24pm

Indeed it is only a problem with certain sources. I could not say why though.  Here is an example:

12/20/05 21:01:21:950 -- (1488) Connection from: 24.224.254.249  -  Originating country : Canada
12/20/05 21:01:25:419 -- (1488) Resolving 24.224.254.249 - blk-224-254-249.eastlink.ca
12/20/05 21:01:25:841 -- (1488) found SPF record for mail2world.com: v=spf1 ip4:66.28.189.0/24
12/20/05 21:01:25:841 -- (1488) SPF query result:
12/20/05 21:01:25:841 -- (1488) - SPF analysis for mail2world.com done: -
12/20/05 21:01:25:841 -- (1488) Mail from:
Ericka.Gibbons@mail2world.com
12/20/05 21:01:26:232 -- (1488) - MAPS search done... 557 This email has been quarantined. Your Email Server at IP 24.224.254.249 is listed as a source of SPAM by bl.spamcop.net. Click http://www.spamrejection.com/blockedmail.asp?Reason=MAPS for more information. Blocked - see http://www.spamcop.net/bl.shtml?
12/20/05 21:01:26:232 -- (1488) 24.224.254.249 - Mail from:
Ericka.Gibbons@mail2world.com To: abcs@idp.net will be rejected
12/20/05 21:01:26:591 -- (1488) Mail from:
Ericka.Gibbons@mail2world.com
12/20/05 21:01:26:591 -- (1488) 24.224.254.249 - Mail from: Ericka.Gibbons@mail2world.com To: pcmatt@idp.net will be rejected
12/20/05 21:01:28:482 -- (1488) EMail from
Ericka.Gibbons@mail2world.com to abcs@idp.net, pcmatt@idp.net was received and quarantined. Size: 12 KB, 12288 bytes
12/20/05 21:01:28:482 -- (1488) Blacklist cache - Added 24.224.254.249 to limbo
12/20/05 21:01:28:482 -- (1488) Disconnect

 

 

-Matt R
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 5:36pm
Matt,

You're correct again. The SPF record for the above domain is:

mail2world.com  text =
        "v=spf1 ip4:66.28.189.0/24"

Note that it's missing the "all" mechanism at the end of the line. The SPF RFC says that there "SHOULD" be either an "all" or "redirect" mechanism at the end of the record to terminate processing. If there is no match (as in your case), then the default should be "neutral", and the SPF test should be ignored. We're not logging the "neutral" entry in this case, and are leaving it blank.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
pcmatt View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 February 2005
Location: United States
Status: Offline
Points: 116
Post Options Post Options   Thanks (0) Thanks(0)   Quote pcmatt Quote  Post ReplyReply Direct Link To This Post Posted: 21 December 2005 at 5:52pm

Yes, a very minor bug, but as you know SpamFilter allows us to configure Neutral results for "Block" or "Pass" so a Neutral result needs to be logged. 

We're still testing latest build.  Thanks for you speedy replies as always. I'll let you know if we find anything else in 511. Still happly running 487 build -Matt

 

-Matt R
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 22 December 2005 at 5:13pm
Matt,

Could you give build 512 a shot? It should have fixed your logging bug. It's in the registered user area.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.227 seconds.