Print Page | Close Window

possible problem with To Email blacklist

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=2150
Printed Date: 14 March 2025 at 3:10pm


Topic: possible problem with To Email blacklist
Posted By: Guests
Subject: possible problem with To Email blacklist
Date Posted: 07 October 2003 at 2:34pm

I have a number of old email accounts on my ToEmail blacklist and have SpamFilterISP set to NOT quarantine those messages (just to keep the quarantine database size down - I have A LOT of 'old user' spam messages coming in).  I just discovered this morning that the latest rev (1.2.0.206) will reject messages sent to valid users if a blacklisted email address is also on the recipients list.  This doesn't happen with all servers (I originally tested from a Yahoo account, and it worked fine - apparently Yahoo sends the messages individually).  After seeing this in the logfile, I connected via telnet from a different machine to test and confirm.

Here's a logfile excerpt:

10/07/03 11:20:31:555 -- (1060) Connection from: xx.xxx.xxx.x  -  Originating country : United States
10/07/03 11:21:00:156 -- (1060) Resolving xx.xxx.xxx.x - yyy.yyyyyyyyy.com
10/07/03 11:21:00:166 -- (1060) Mail from: mailto:anaccount@email.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - anaccount@email.net
10/07/03 11:21:00:797 -- (1060) - MAPS search done... .
10/07/03 11:21:00:797 -- (1060) RCPT TO: mailto:validuser@mydomain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - validuser@mydomain.com accepted
10/07/03 11:21:12:123 -- (1060) - EmailTO is in local blacklist file...
10/07/03 11:21:12:123 -- (1060) xx.xxx.xxx.x - Mail from: mailto:anaccount@email.net" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - anaccount@email.net To: mailto:invaliduser@mydomain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - invaliduser@mydomain.com will be disconnected
10/07/03 11:21:12:123 -- (1060) Disconnect

help?  I've removed my EmailTO Blacklist until this is resolved...

-Ric


Replies:
Posted By: LogSat
Date Posted: 07 October 2003 at 4:11pm

Ric,

The "ToEMail Blacklist" causes SpamFilter to reject any message that has a recipient in that blacklist. I emphasize on "message" because SpamFilter will not reject the single recipient, it will classify the whole message as spam.

As you discovered mail servers send emails to multiple recipients (CCs or BCCs) in different ways. (1) Some issue multiple "RCPT TO" commands in the same session, meaning they connect to the receiving SMTP server, then list out the recipients, then send out the data stream (once). (2) Others will initiate a new connection to the receivng SMTP server for each single recipient, and send the data stream individually every time over and over for each one (wasting quite a bit of bandwidth...).

In the first case if a recipient is blacklisted the whole email is discarded and the other recipients will not receive it either. In the second case, the session containing the blacklisted address is discarded, but all other recipients will receive theirs since each email is made up of an individual connection.

Roberto F.
LogSat Software

Posted By: Guests
Date Posted: 07 October 2003 at 4:33pm

Roberto -

Thanks for the quick reply... so SpamFilterISP is doing it's job properly, I was just trying to use one of the features improperly... :( darn.

-Ric

Posted By: Guests
Date Posted: 08 October 2003 at 4:18pm
Hey Ric-

I have done the same thing (we really should talk at some point!). I have not kept that close of a watch on what is being rejected by this list, but from what I can see, it is all SPAM. Very rarely are valid messages from the outside being addressed to people who are no longer here.

I think, however, I will watch it a bit more closely for a couple of days, just to make sure!

Take care!

\frank


Print Page | Close Window