AutoWhitelist problems |
Post Reply 
|
| Author | |
clator 
Newbie 
Joined: 22 February 2007 Location: United States Status: Offline Points: 4 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: AutoWhitelist problemsPosted: 22 February 2007 at 5:21pm |
|
I've noticed a ton of spam getting in lately, mostly of two varieties. Either with the VAR114/VAR115 subject, or with a subject of some random Biblical-esque saying. They almost always have pharmaceutical content inside on a big image.
I was curious as to how they were getting in, and looked in my SpamFilter logs to find the most recent one. Apparently it was AutoWhiteListed, but I cannot figure out why. The header itself contains the phrase "X-SF-WhiteListedReason: AutoWhiteList Force Delivery" ... could that be it? Can I send somebody the details in email so they do not get posted publicly? Edited by clator |
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 22 February 2007 at 5:33pm |
|
Yeap... that's the main reason. The emails are being whitelisted due to an entry in your AutoWhiteListForceDelivery.txt file.
When you force-deliver an email that was in the quarantine, the sender is automatically matched with the recipient. From then on, all emails from that sender to that recipient are automatically whitelisted. The entry: from@sender.com|to@recipient.com will be added to your AutoWhiteListForceDelivery.txt file. Looking at the email yo ujust received, look at the address specified in the "X-SF-RX-Return-Path" or the "Return-Path" headers. That's you sender, and most likely you'll find them in the AutoWhiteListForceDelivery file. If so, simply delete that line from the file, no need to stop/restart SpamFilter... |
|
|
|
|
clator
Newbie
Joined: 22 February 2007 Location: United States Status: Offline Points: 4 |
Post Options
Thanks(0)
Quote Reply
Posted: 22 February 2007 at 7:17pm |
|
Excellent. I never understood that file before your explanation. I've edited it and restarted. Hopefully this will help.
|
|
|
|
|
Radu
Newbie
Joined: 03 April 2007 Status: Offline Points: 1 |
Post Options
Thanks(0)
Quote Reply
Posted: 03 April 2007 at 5:13am |
|
Does it mean that all spammers who include "X-SF-WhiteListedReason: keyword whitelist match" can bypass the spam filter?
|
|
|
|
|
lyndonje
Senior Member 
Joined: 31 January 2006 Location: United Kingdom Status: Offline Points: 192 |
Post Options
Thanks(0)
Quote Reply
Posted: 03 April 2007 at 7:58am |
|
Hi Radu,
No that is not the case. That is the header added by SF when a keyword whitelist match is detected. This header is NOT checked by SF to determine whether or not an email should be classed as spam. Regards Lyndon. |
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.193 seconds.