Print Page | Close Window

Beahviour Clarification, please..

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5356
Printed Date: 14 March 2025 at 10:48am


Topic: Beahviour Clarification, please..
Posted By: cristtos
Subject: Beahviour Clarification, please..
Date Posted: 11 October 2005 at 10:14pm

I do not use quarantine, just Tag&Deliver

In this situation what "Do Not Quarantine" tick box does? Do I need to add :null at the end of every banned EmailTo address?

What should happen when:

  • connection is from banned country - connection closed?
  • connection IP on blacklist or in MAPS - connection closed?
  • connection from blacklisted domain - connection closed?
  • mail from banned MallFrom - connection closed?
  • mail to (single) banned MailTo -connection closed?
  • mail to banned MailTo AND other emails - mail accepted and tagged?
  • mail to Honeypot - connection closed AND IP address added to HoneypotBlockedIPs.txt?

I am a bit mistified about the change in behaviour for banned countries (.kr) as it appears to accept and tag rather then drop the connection.

I have about 5 emails in the honeypot list and I can see the mails to those comming through BUT no honeypot action in the log! also HoneypotBlockedIPs.txt is empty

Using 2.6.3.487

I appologise I may look a bit confused


Replies:
Posted By: LogSat
Date Posted: 11 October 2005 at 11:06pm
cristos,

If the "Tag&Deliver" option is set, SpamFilter will deliver the email to the end user. Only a "spam tag" will be added to the email if any of the filters identify the email as spam. Since the email will be delivered to the user, SpamFilter will have to accept it from the remote server, the connection must not be dropped, otherwise the sender will think the email was not delivered when in fact it is delivered.

Should you have other applications after SpamFilter that may reject the email based on the spam tag, it is up to those applications to send a bounce email to the sender (if desired) to let them know the email was blocked.

Note that as SpamFilter does not know how the above application is configured, and what criteria is used to possibly reject emails or deliver them, SpamFilter must accept the email from the sender and inform them that it has been received successfully.

The only exception when the remote server will be disconnected right away is in case of a relay attempt, where the remote server tries to use SpamFilter to relay email to addresses *not* belonging to your local domains.

The "Do not Quarantine" setting is ignored if the Tag&Deliver option is set, as the emails are delivered to the users and are thus not stored in the quarantine database.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: cristtos
Date Posted: 12 October 2005 at 12:53am

Thank you for your prompt reply.

So with Tag&Deliver:

  • "do not quarantine" does not have any effect to the behaviour.
  • honeypot does not have any functionality
  • mails to banned MailTo address will still be delivered (tagged as spam though)
  • mail from banned countries will still be accepted (but tagged as spam)
  • mail from MAPS will still be accepted (but tagged as spam)

If this is the case I would very much like to see a "reuse" of the "do not quarantine" tickbox as a "signal error and drop connection immediately".

It will actualy add the functionality I mistakenly thought is built in.

Meantime I have added :null to the banned MailTo list of emails..

But I do not see I can do that for Korea, put .kr:null in the banned domains?

Note that I have posted a review under my cristtos nick I use here as well (name is Cris in fact)

Posted By: LogSat
Date Posted: 12 October 2005 at 4:35pm
Cris,

Minor correction. The honeypot functionality is still there - an email addressed to an email address in the honeypot list will still (1) cause the sender's IP address to be blacklisted and the email to be tagged as spam, furthermore (2) any future emails from that IP will be tagged as spam.

We'll understand your suggestion to modify the DoNotQuarantine option, you do make a valid point. While we cannot make any predictions right now on when/how it will be implemented, we'll try our best to include it in one of the next releases.

As far as Korea is concerned, there is no way currently to prevent them from being tagged and delivered.

If you can please email us with your SpamFilter order information, we'll add the additional software mamintenance to your account. We were not able to locate it with the little info contained in the forum profile...


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window