I have one email address in the "Unfiltered Emails" whitelist with the :tag option so the email header gets the SPAM tag. The way it worked in SFI v3.1.3.615, SPAM sent to the unfiltered email address got tagged as did all email addresses included in the email. In v3.5.. the unfiltered email address is the only one that gets the SPAM header tag, the other email addresses included in the email now bypass all filtering and end up in the users Inboxes.

I have had to remove the email address from the unfiltered emails whitelist.

Can you make the tagging in v3.5.. function the same as it did in v3.1.3?

Michael

This is a section of the log showing what happened, I changed our companies email addresses. It's thread 3992, jeff@company.com gets the message SPAM tagged as it should, but the email gets bypassed for frank, ed, carl and bob.

4/27/07 05:04:40:522 -- (3992) Connection from: 221.148.79.75  -  Originating country : Korea, Republic of
04/27/07 05:04:43:163 -- (3992) - IP address is from a blacklisted country...
04/27/07 05:04:43:163 -- (3992) 221.148.79.75 - Mail from: ramsey@gfagrow.org To: jeff@company.com will be spam-tagged
04/27/07 05:04:44:725 -- (3992) EMail from ramsey@gfagrow.org to jeff@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:44:741 -- (2668) Sending email from ramsey@gfagrow.org to jeff@company.com --
04/27/07 05:04:44:772 -- (2828) Time to add Msg to Bayes corpus:16
04/27/07 05:04:44:881 -- (2668) EMail from ramsey@gfagrow.org to jeff@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:46:069 -- (3992) Bypassed all rules for: frank@company.com from atiles@giciane.trix.net
04/27/07 05:04:47:631 -- (3992) EMail from atiles@giciane.trix.net to frank@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:47:631 -- (3092) Sending email from atiles@giciane.trix.net to frank@company.com --
04/27/07 05:04:47:663 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:47:788 -- (3092) EMail from atiles@giciane.trix.net to frank@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:49:163 -- (3992) Bypassed all rules for: ed@company.com from goldstein@globalhomeproducts.com
04/27/07 05:04:50:725 -- (3992) EMail from goldstein@globalhomeproducts.com to ed@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:50:725 -- (2180) Sending email from goldstein@globalhomeproducts.com to ed@company.com --
04/27/07 05:04:50:756 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:50:866 -- (2180) EMail from goldstein@globalhomeproducts.com to ed@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:52:069 -- (3992) Bypassed all rules for: carl@company.com from jsco@gintri.com
04/27/07 05:04:53:663 -- (3992) EMail from jsco@gintri.com to carl@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:53:663 -- (3204) Sending email from jsco@gintri.com to carl@company.com --
04/27/07 05:04:53:678 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:53:803 -- (3204) EMail from jsco@gintri.com to carl@company.com --  was forwarded to 127.0.0.1:26
4/27/07 05:04:54:397 -- (1756) Connection from: 82.179.199.194  -  Originating country : Russian Federation
04/27/07 05:04:54:944 -- (1756) - IP address is from a blacklisted country...
04/27/07 05:04:54:944 -- (1756) 82.179.199.194 - Mail from: barncaredsefexe@maine.rr.com To: peter@company.com will be rejected
04/27/07 05:04:55:225 -- (3992) Bypassed all rules for: bompane@company.com from sandra@gma-online.de
04/27/07 05:04:56:788 -- (3992) EMail from sandra@gma-online.de to bompane@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:56:788 -- (1732) Sending email from sandra@gma-online.de to bompane@company.com --
04/27/07 05:04:56:819 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:56:913 -- (1732) EMail from sandra@gma-online.de to bompane@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:56:913 -- (1732) Some recipients do not exist, sending NDR bounce to sender
04/27/07 05:04:56:913 -- (1732) EMail from: sandra@gma-online.de to: bompane@company.com was returned to sender - The following recipients are unknown:

bompane@company.com
04/27/07 05:04:57:069 -- (1732) Error-email from sandra@gma-online.de to bompane@company.com was forwarded to 127.0.0.1
04/27/07 05:04:57:866 -- (1756) Created thread (2904) to add email to quarantine
04/27/07 05:04:57:897 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:57:913 -- (2904) EMail from barncaredsefexe@maine.rr.com to peter@company.com was received and quarantined. Size: 29 KB, 29696 bytes
04/27/07 05:04:58:147 -- (3992) Bypassed all rules for: bob@company.com from extrimum@greatsoundpros.com
04/27/07 05:04:58:272 -- (1756) Blacklist cache - Added 82.179.199.194 to limbo
04/27/07 05:04:58:506 -- (1756) SFDB - Added 82.179.199.194 - Response: Error=0
04/27/07 05:04:58:506 -- (1756) Disconnect
04/27/07 05:04:59:725 -- (3992) EMail from extrimum@greatsoundpros.com to bob@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:59:725 -- (2564) Sending email from extrimum@greatsoundpros.com to bob@company.com --
04/27/07 05:04:59:741 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:59:866 -- (2564) EMail from extrimum@greatsoundpros.com to bob@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:05:00:413 -- (3992) Disconnect

Bug confirmed.

Nice catch Thermo, thanks a lot for reporting this. We'll have it fixed shortly, and will make the patch available within 24/48 hours.

I'm afraid at first glance we only patched the problem that occurred when the same SMTP session sent multiple separate emails, and did not address the problem with the tagging. We thought they fell under the same category, but judging from your log this appears not to be the same. We'll post an update here after looking into this further.