Jeremy,

The order in which the filters is applied is listed at http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=5171#5826. If a filter blocks an email, all subsequent filters will be ignored to avoid wasting resources. This will indeed cause a number of emails where the recipient is not in the "Autorized TO" list to be quarantined instead of being rejected right away.

jeremy,

The only three filters that are before the "Authorized TO" list are:

1. Local Domain Blacklist
2. Local Emails Blacklist
3. Local Emails TO Blacklist

emails blocked by these are usually very, very small in numbers, if any at all. Are you actually receiving 200,000 emails each week blocked by these 3? If you have a huge blacklist of blacklisted sender's domains and emails, that may explain this large number, but if not, you may be targeted by very specific spammers/attackers.

In "normal" installations, the 3 lists above are often much smaller than the "Authorized TO" list, which is why SpamFilter examines the smaller ones first to try saving some resources. An option may be to change the order of the filters by moving up the "Authorized TO". We'll be monitoring the thread for feedback on this.

Geez, I can't even read my own warning. And think that I had even super bolded the notice "Please always check the latest post in this thread" on that thread.

You're right, I did not see the updated order. What you posted is correct, the 4 filters (not 3) that cause emails to be quarantined before the "Authorized TO" list is hit are:

1. Local IP Blacklist
2. Local Domain Blacklist
3. Local Emails Blacklist
4. Local Emails TO Blacklist

I did not mention the others that appear first (allowed domains, and the "forgotten" blacklist cache and greylist) because these ones reject emails immediately, without allowing them to be quarantined, so do not apply in ths discussion.
c

That depends on the reliability of your IP blacklist, which is causing the bulk of these blocks. If you are note receiving false positives from it, you could enable the option to "do not quarantine" emails from this filter.

Also, if you have the list of allowed users in a database, it's rather simple to create a query that will weed out the unwanted recipients. If the list is only in a text file, there's a few extra steps involved to bulk import it in a temp table in MySQL (don't know yet if MySQL can perform a query directly against a text file, as MS SQL can do). I'll take a stab at it tonite to see if I can help you here, but please email me to stop me if the data is already in the DB!

Oh well.. since I've already started, and as it can be used by others who do have a file-based list, here it is anyways :-)


CREATE TABLE test(
email varchar(320)
);

LOAD DATA INFILE "/tmp/WL_AuthorizedTOEmails.txt"
INTO TABLE test
LINES TERMINATED BY '\r\n';

UPDATE tblquarantine  LEFT JOIN test ON tblquarantine.emailto = test.email
SET expire=1 WHERE ISNULL(test.email)

DROP TABLE test;



The above will mark the emails for deletion so that SpamFilter can then delete them during regular cleanup. If you want to delete them right away, this one will do the job:

CREATE TABLE test(
email varchar(320)
);

LOAD DATA INFILE "/tmp/WL_AuthorizedTOEmails.txt"
INTO TABLE test
LINES TERMINATED BY '\r\n';

DELETE tblquarantine FROM tblquarantine LEFT JOIN test ON tblquarantine.emailto = test.email
WHERE ISNULL(test.email);

DELETE tblmsgs FROM tblmsgs LEFT JOIN tblquarantine ON tblmsgs.msgid = tblquarantine.msgid
WHERE ISNULL(tblquarantine.msgid);

DROP TABLE test;