Print Page | Close Window

511 build minor Logging bug

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5422
Printed Date: 28 December 2024 at 2:12am


Topic: 511 build minor Logging bug
Posted By: pcmatt
Subject: 511 build minor Logging bug
Date Posted: 20 December 2005 at 9:16pm

Spf result is not displayed or logged completely:

12/20/05 21:01:25:841 -- (1488) SPF query result:

Appears to be missing pass, fail, etc.

 

 



-------------
-Matt R


Replies:
Posted By: LogSat
Date Posted: 20 December 2005 at 10:56pm
Matt,

Could you please post / email us more entries relative to that log entry, so we can se the sender's domain and IP? It's possible that the above occurs only under certain circumstances...


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: pcmatt
Date Posted: 20 December 2005 at 11:24pm

Indeed it is only a problem with certain sources. I could not say why though.  Here is an example:

12/20/05 21:01:21:950 -- (1488) Connection from: 24.224.254.249  -  Originating country : Canada
12/20/05 21:01:25:419 -- (1488) Resolving 24.224.254.249 - blk-224-254-249.eastlink.ca
12/20/05 21:01:25:841 -- (1488) found SPF record for mail2world.com: v=spf1 ip4:66.28.189.0/24
12/20/05 21:01:25:841 -- (1488) SPF query result:
12/20/05 21:01:25:841 -- (1488) - SPF analysis for mail2world.com done: -
12/20/05 21:01:25:841 -- (1488) Mail from: mailto:Ericka.Gibbons@mail2world.com - Ericka.Gibbons@mail2world.com
12/20/05 21:01:26:232 -- (1488) - MAPS search done... 557 This email has been quarantined. Your Email Server at IP 24.224.254.249 is listed as a source of SPAM by bl.spamcop.net. Click http://www.spamrejection.com/blockedmail.asp?Reason=MAPS - http://www.spamrejection.com/blockedmail.asp?Reason=MAPS for more information. Blocked - see http://www.spamcop.net/bl.shtml - http://www.spamcop.net/bl.shtml ?
12/20/05 21:01:26:232 -- (1488) 24.224.254.249 - Mail from: mailto:Ericka.Gibbons@mail2world.com - Ericka.Gibbons@mail2world.com To: mailto:abcs@idp.net - abcs@idp.net will be rejected
12/20/05 21:01:26:591 -- (1488) Mail from: mailto:Ericka.Gibbons@mail2world.com - Ericka.Gibbons@mail2world.com
12/20/05 21:01:26:591 -- (1488) 24.224.254.249 - Mail from: mailto:Ericka.Gibbons@mail2world.com - Ericka.Gibbons@mail2world.com To: mailto:pcmatt@idp.net - pcmatt@idp.net will be rejected
12/20/05 21:01:28:482 -- (1488) EMail from mailto:Ericka.Gibbons@mail2world.com - Ericka.Gibbons@mail2world.com to mailto:abcs@idp.net - abcs@idp.net , mailto:pcmatt@idp.net - pcmatt@idp.net was received and quarantined. Size: 12 KB, 12288 bytes
12/20/05 21:01:28:482 -- (1488) Blacklist cache - Added 24.224.254.249 to limbo
12/20/05 21:01:28:482 -- (1488) Disconnect

 

 



-------------
-Matt R

Posted By: LogSat
Date Posted: 21 December 2005 at 5:36pm
Matt,

You're correct again. The SPF record for the above domain is:

mail2world.com  text =
        "v=spf1 ip4:66.28.189.0/24"

Note that it's missing the "all" mechanism at the end of the line. The SPF RFC says that there "SHOULD" be either an "all" or "redirect" mechanism at the end of the record to terminate processing. If there is no match (as in your case), then the default should be "neutral", and the SPF test should be ignored. We're not logging the "neutral" entry in this case, and are leaving it blank.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: pcmatt
Date Posted: 21 December 2005 at 5:52pm

Yes, a very minor bug, but as you know SpamFilter allows us to configure Neutral results for "Block" or "Pass" so a Neutral result needs to be logged. 

We're still testing latest build.  Thanks for you speedy replies as always. I'll let you know if we find anything else in 511. Still happly running 487 build -Matt

 



-------------
-Matt R

Posted By: LogSat
Date Posted: 22 December 2005 at 5:13pm
Matt,

Could you give build 512 a shot? It should have fixed your logging bug. It's in the registered user area.



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window